Infection de mon ordinateur avec Tuto4PC

narcotichappy -  
Bonjours,
Je me permet de poser cette question car je me retrouve en difficulté face à ce virus qui est considéré d'après d'autre forum comme un cheval de trois. Voici la démarche que j'ai entrepris pour le virer de mon ordinateur mais qui est jusqu'à là peu concluante:
- J'ai commencé avec Adwcleaner => Il me relance l'installation mais ne trouve rien;
- Puis, Malwarebytes=> il me trouve toujours des fichiers infectés mais ne les supprime jamais complètement.
- De plus; à chaque ouverture de windows xp tuto4pc demande une installation en m'ouvrant une fenêtre qui met impossible de fermer (control-alt-F4...)
- J'ai installé par la suite ZHPdiag dont je vous soumet le rapport ci-dessous: 
http://pjjoint.malekal.com/files.phpid=ZHPDiag_20131005_w14k15l11x15y10
Je ne suis malheureusement pas assez calée en informatique pour comprendre le rapport et je sais donc pas quoi mettre dans ZHPfix. En espérant que vous pourriez me venir en aide.
Cordialement,

9 réponses

  2. narcotichappy Auteur
    voici le rapport
    0
    1. Malekal_morte- Modérateur
      Salut,

      Faire un scan OTL pour diagnostiquer les programmes qui tournent et déceler des infections - Le programme va générer deux rapports OTL.txt et Extras.txt
      Fournir les deux rapports :

      Tu peux suivre les indications de cette page pour t'aider : https://www.malekal.com/tutorial-otl/

      * Télécharge http://www.geekstogo.com/forum/files/file/398-otl-oldtimers-list-it/ sur ton bureau.
      (Sous Vista/Win7, il faut cliquer droit sur OTL et choisir Exécuter en tant qu'administrateur)

      Dans le cas d'Avast!, ne pas lancer le programme dans la Sandbox (voir lien d'aide ci-dessus).

      * Lance OTL
      * En haut à droite de Analyse rapide, coche "tous les utilisateurs"
      * Sur OTL, sous Personnalisation, copie-colle le script ci-dessous :

      netsvcs
      msconfig
      safebootminimal
      safebootnetwork
      activex
      drivers32
      %ALLUSERSPROFILE%\Application Data\*.
      %ALLUSERSPROFILE%\Application Data\*.exe /s
      %APPDATA%\*.
      %APPDATA%\*.exe /s
      %temp%\*.exe /s
      %SYSTEMDRIVE%\*.exe
      %systemroot%\*. /mp /s
      %systemroot%\system32\consrv.dll
      %systemroot%\system32\*.dll /lockedfiles
      %windir%\Tasks\*.job /lockedfiles
      %systemroot%\system32\drivers\*.sys /lockedfiles
      %systemroot%\System32\config\*.sav
      /md5start
      explorer.exe
      winlogon.exe
      services.exe
      wininit.exe
      /md5stop
      HKEY_CLASSES_ROOT\CLSID\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InprocServer32 /s
      HKEY_LOCAL_MACHINE\SYSTEM\SYSTEM\CurrentControlSet\Services\lanmanserver\parameters /s
      HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems /s
      HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\AppCertDlls /s
      HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList /s
      HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor /s
      HKEY_CURRENT_USER\Software\Microsoft\Command Processor /s
      CREATERESTOREPOINT
      nslookup https://www.google.fr/?gws_rd=ssl /c
      SAVEMBR:0
      hklm\software\clients\startmenuinternet|command /rs
      hklm\software\clients\startmenuinternet|command /64 /rs

      * Clique sur le bouton Analyse.

      * Quand le scan est fini, utilise le site http://pjjoint.malekal.com/ pour envoyer le rapport OTL.txt (et Extra.txt si présent).
      Donne le ou les liens pjjoint qui pointent vers ces rapports ici dans une réponse.
      Je répète : donne le lien du rapport pjjoint ici en réponse.

      NE PAS COPIER/COLLER LE RAPPORT ICI - DONNER LE LIEN PJJOINT DANS UN NOUVEAU MESSAGE

      0
      1. narcotichappy
        merci pour cette réponse rapide, je m'empresse de le faire
        0
    4. Malekal_morte- Modérateur
      Relance OTL.
      o sous Personnalisation (Custom Scan), copie_colle le contenu du cadre ci dessous (bien prendre :OTL en début).
      Clic Correction (Fix), un rapport apparraitra, copie/colle le contenu ici:

      :OTL
      SRV - [2013/10/04 10:51:19 | 000,119,408 | ---- | M] (The Software Group) [On_Demand | Stopped] -- C:\Program Files\Software\Update\SoftwareUpdate.exe -- (Software_update_m)
      SRV - [2013/10/04 10:51:19 | 000,119,408 | ---- | M] (The Software Group) [Auto | Stopped] -- C:\Program Files\Software\Update\SoftwareUpdate.exe -- (Software_update)
      FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\\ocr@babylon.com: C:\Program Files\Babylon\Babylon-Pro\Utils\ocr@babylon.com
      FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\{5a95a9e0-59dd-4314-bd84-4d18ca83a0e2}: C:\Program Files\Wajam\Firefox\{5a95a9e0-59dd-4314-bd84-4d18ca83a0e2}.xpi
      CHR - plugin: Software Update (Enabled) = C:\Program Files\Software\Update\1.2.201.0\npSoftwareOneClick8.dll
      [2013/09/29 12:37:50 | 000,000,000 | ---D | M] (BonanzaDeals) -- C:\Documents and Settings\Stephane\Application Data\Mozilla\Firefox\Profiles\72t86lfb.default\extensions\{f9d03c26-0575-497e-821d-f7956d23e0ca}
      [2013/07/02 13:37:08 | 000,000,000 | ---D | M] (Delta Toolbar) -- C:\Documents and Settings\Stephane\Application Data\Mozilla\Firefox\Profiles\72t86lfb.default\extensions\ffxtlbr@delta.com
      [2013/07/12 10:09:43 | 000,000,000 | ---D | M] (Menu Contextuel Orange) -- C:\Documents and Settings\Stephane\Application Data\Mozilla\Firefox\Profiles\72t86lfb.default\extensions\menu_contextuel_orange@orange.fr
      [2013/07/02 13:37:09 | 000,000,000 | ---D | M] (WebCake) -- C:\Documents and Settings\Stephane\Application Data\Mozilla\Firefox\Profiles\72t86lfb.default\extensions\plugin@getwebcake.com
      [2013/06/30 18:05:13 | 000,000,000 | ---D | M] (Cool Smiley Bar for Facebook) -- C:\Documents and Settings\Stephane\Application Data\Mozilla\Firefox\Profiles\72t86lfb.default\extensions\pluswinks@PlusWinks
      [2013/07/02 13:33:15 | 000,006,505 | ---- | M] () -- C:\Documents and Settings\Stephane\Application Data\Mozilla\Firefox\Profiles\72t86lfb.default\searchplugins\babylon.xml
      [2013/07/02 13:34:26 | 000,001,294 | ---- | M] () -- C:\Documents and Settings\Stephane\Application Data\Mozilla\Firefox\Profiles\72t86lfb.default\searchplugins\delta.xml
      O4 - HKLM..\Run: [upt4pc_fr_62.exe] C:\Documents and Settings\Stephane\Local Settings\Application Data\tuto4pc_fr_62\upt4pc_fr_62.exe ()
      [2013/09/28 19:05:39 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\BonanzaDealsLive
      [2013/10/01 15:46:59 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Stephane\Local Settings\Application Data\tuto4pc_fr_68
      [2013/10/05 13:10:00 | 000,000,918 | ---- | M] () -- C:\WINDOWS\tasks\BonanzaDealsLiveUpdateTaskMachineUA.job
      [2013/09/04 14:01:44 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Stephane\Application Data\PerformerSoft
      [2013/09/30 20:35:26 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Stephane\Local Settings\Application Data\tuto4pc_fr_62
      :Commands
      [emptytemp]
      [emptyflash]
      [resethosts]
      [reboot]

      * poste le rapport ici

      0
      1. narcotichappy
        All processes killed
        ========== OTL ==========
        Service Software_update_m stopped successfully!
        Service Software_update_m deleted successfully!
        C:\Program Files\Software\Update\SoftwareUpdate.exe moved successfully.
        Service Software_update stopped successfully!
        Service Software_update deleted successfully!
        File C:\Program Files\Software\Update\SoftwareUpdate.exe not found.
        Registry value HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\\***@*** deleted successfully.
        File C:\Program Files\Babylon\Babylon-Pro\Utils\***@*** not found.
        Registry value HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\{5a95a9e0-59dd-4314-bd84-4d18ca83a0e2} deleted successfully.
        Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5a95a9e0-59dd-4314-bd84-4d18ca83a0e2}\ not found.
        File C:\Program Files\Wajam\Firefox\{5a95a9e0-59dd-4314-bd84-4d18ca83a0e2}.xpi not found.
        File C:\Program Files\Software\Update\1.2.201.0\npSoftwareOneClick8.dll not found.
        C:\Documents and Settings\Stephane\Application Data\Mozilla\Firefox\Profiles\72t86lfb.default\extensions\{f9d03c26-0575-497e-821d-f7956d23e0ca}\defaults\preferences folder moved successfully.
        C:\Documents and Settings\Stephane\Application Data\Mozilla\Firefox\Profiles\72t86lfb.default\extensions\{f9d03c26-0575-497e-821d-f7956d23e0ca}\defaults folder moved successfully.
        C:\Documents and Settings\Stephane\Application Data\Mozilla\Firefox\Profiles\72t86lfb.default\extensions\{f9d03c26-0575-497e-821d-f7956d23e0ca}\content\images folder moved successfully.
        C:\Documents and Settings\Stephane\Application Data\Mozilla\Firefox\Profiles\72t86lfb.default\extensions\{f9d03c26-0575-497e-821d-f7956d23e0ca}\content folder moved successfully.
        C:\Documents and Settings\Stephane\Application Data\Mozilla\Firefox\Profiles\72t86lfb.default\extensions\{f9d03c26-0575-497e-821d-f7956d23e0ca} folder moved successfully.
        C:\Documents and Settings\Stephane\Application Data\Mozilla\Firefox\Profiles\72t86lfb.default\extensions\***@***\META-INF folder moved successfully.
        C:\Documents and Settings\Stephane\Application Data\Mozilla\Firefox\Profiles\72t86lfb.default\extensions\***@***\content\imgs\flgs folder moved successfully.
        C:\Documents and Settings\Stephane\Application Data\Mozilla\Firefox\Profiles\72t86lfb.default\extensions\***@***\content\imgs folder moved successfully.
        C:\Documents and Settings\Stephane\Application Data\Mozilla\Firefox\Profiles\72t86lfb.default\extensions\***@***\content folder moved successfully.
        C:\Documents and Settings\Stephane\Application Data\Mozilla\Firefox\Profiles\72t86lfb.default\extensions\***@*** folder moved successfully.
        C:\Documents and Settings\Stephane\Application Data\Mozilla\Firefox\Profiles\72t86lfb.default\extensions\***@***\content folder moved successfully.
        C:\Documents and Settings\Stephane\Application Data\Mozilla\Firefox\Profiles\72t86lfb.default\extensions\***@***\chrome folder moved successfully.
        C:\Documents and Settings\Stephane\Application Data\Mozilla\Firefox\Profiles\72t86lfb.default\extensions\***@*** folder moved successfully.
        C:\Documents and Settings\Stephane\Application Data\Mozilla\Firefox\Profiles\72t86lfb.default\extensions\***@***\skin folder moved successfully.
        C:\Documents and Settings\Stephane\Application Data\Mozilla\Firefox\Profiles\72t86lfb.default\extensions\***@***\META-INF folder moved successfully.
        C:\Documents and Settings\Stephane\Application Data\Mozilla\Firefox\Profiles\72t86lfb.default\extensions\***@***\locale\en-US folder moved successfully.
        C:\Documents and Settings\Stephane\Application Data\Mozilla\Firefox\Profiles\72t86lfb.default\extensions\***@***\locale folder moved successfully.
        C:\Documents and Settings\Stephane\Application Data\Mozilla\Firefox\Profiles\72t86lfb.default\extensions\***@***\defaults\preferences folder moved successfully.
        C:\Documents and Settings\Stephane\Application Data\Mozilla\Firefox\Profiles\72t86lfb.default\extensions\***@***\defaults folder moved successfully.
        C:\Documents and Settings\Stephane\Application Data\Mozilla\Firefox\Profiles\72t86lfb.default\extensions\***@***\content folder moved successfully.
        C:\Documents and Settings\Stephane\Application Data\Mozilla\Firefox\Profiles\72t86lfb.default\extensions\***@*** folder moved successfully.
        C:\Documents and Settings\Stephane\Application Data\Mozilla\Firefox\Profiles\72t86lfb.default\extensions\pluswinks@PlusWinks\chrome\skin folder moved successfully.
        C:\Documents and Settings\Stephane\Application Data\Mozilla\Firefox\Profiles\72t86lfb.default\extensions\pluswinks@PlusWinks\chrome\content\mz folder moved successfully.
        C:\Documents and Settings\Stephane\Application Data\Mozilla\Firefox\Profiles\72t86lfb.default\extensions\pluswinks@PlusWinks\chrome\content folder moved successfully.
        C:\Documents and Settings\Stephane\Application Data\Mozilla\Firefox\Profiles\72t86lfb.default\extensions\pluswinks@PlusWinks\chrome folder moved successfully.
        C:\Documents and Settings\Stephane\Application Data\Mozilla\Firefox\Profiles\72t86lfb.default\extensions\pluswinks@PlusWinks folder moved successfully.
        C:\Documents and Settings\Stephane\Application Data\Mozilla\Firefox\Profiles\72t86lfb.default\searchplugins\babylon.xml moved successfully.
        C:\Documents and Settings\Stephane\Application Data\Mozilla\Firefox\Profiles\72t86lfb.default\searchplugins\delta.xml moved successfully.
        Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\upt4pc_fr_62.exe deleted successfully.
        C:\Documents and Settings\Stephane\Local Settings\Application Data\tuto4pc_fr_62\upt4pc_fr_62.exe moved successfully.
        C:\Documents and Settings\All Users\Application Data\BonanzaDealsLive\Update\Log folder moved successfully.
        C:\Documents and Settings\All Users\Application Data\BonanzaDealsLive\Update folder moved successfully.
        C:\Documents and Settings\All Users\Application Data\BonanzaDealsLive folder moved successfully.
        C:\Documents and Settings\Stephane\Local Settings\Application Data\tuto4pc_fr_68\tuto4pc_fr_68\1.10 folder moved successfully.
        C:\Documents and Settings\Stephane\Local Settings\Application Data\tuto4pc_fr_68\tuto4pc_fr_68 folder moved successfully.
        C:\WINDOWS\tasks\BonanzaDealsLiveUpdateTaskMachineUA.job moved successfully.
        C:\Documents and Settings\Stephane\Application Data\PerformerSoft folder moved successfully.
        C:\Documents and Settings\Stephane\Local Settings\Application Data\tuto4pc_fr_62\Download folder moved successfully.
        C:\Documents and Settings\Stephane\Local Settings\Application Data\tuto4pc_fr_62 folder moved successfully.
        ========== COMMANDS ==========

        [EMPTYTEMP]

        User: Administrateur
        ->Temp folder emptied: 0 bytes
        ->Temporary Internet Files folder emptied: 33170 bytes
        ->Flash cache emptied: 57472 bytes

        User: Administrator

        User: All Users

        User: Default User
        ->Temp folder emptied: 0 bytes
        ->Temporary Internet Files folder emptied: 33170 bytes
        ->Flash cache emptied: 57472 bytes

        User: Hudson

        User: LocalService
        ->Temp folder emptied: 115616 bytes
        ->Temporary Internet Files folder emptied: 594807 bytes

        User: NetworkService
        ->Temp folder emptied: 0 bytes
        ->Temporary Internet Files folder emptied: 800629 bytes

        User: Stephane
        ->Temp folder emptied: 1581623 bytes
        ->Temporary Internet Files folder emptied: 7242130 bytes
        ->Java cache emptied: 0 bytes
        ->FireFox cache emptied: 10847630 bytes
        ->Google Chrome cache emptied: 12221135 bytes
        ->Flash cache emptied: 59818 bytes

        %systemdrive% .tmp files removed: 0 bytes
        %systemroot% .tmp files removed: 1154048 bytes
        %systemroot%\System32 .tmp files removed: 3072 bytes
        %systemroot%\System32\dllcache .tmp files removed: 0 bytes
        %systemroot%\System32\drivers .tmp files removed: 0 bytes
        Windows Temp folder emptied: 41470296 bytes
        %systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 324430795 bytes
        %systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 34313 bytes
        RecycleBin emptied: 233872 bytes

        Total Files Cleaned = 382,00 mb

        [EMPTYFLASH]

        User: Administrateur
        ->Flash cache emptied: 0 bytes

        User: Administrator

        User: All Users

        User: Default User
        ->Flash cache emptied: 0 bytes

        User: Hudson

        User: LocalService

        User: NetworkService

        User: Stephane
        ->Flash cache emptied: 0 bytes

        Total Flash Files Cleaned = 0,00 mb

        C:\WINDOWS\System32\drivers\etc\Hosts moved successfully.
        HOSTS file reset successfully

        OTL by OldTimer - Version 3.2.69.0 log created on 10052013_150818

        Files\Folders moved on Reboot...
        File move failed. C:\WINDOWS\temp\_avast_\Webshlock.txt scheduled to be moved on reboot.

        PendingFileRenameOperations files...

        Registry entries deleted on Reboot...

        voilà, le registe et j'ai été dans msconfig puis dans démarrage et il semblerait qu'il n'y est plus
        0
        1. Malekal_morte- Modérateur
          Refais un scan OTL et donne le rapport, histoire de contrôler.
          0
          1. narcotichappy
            Je ne peux plus le faire car j'ai fait un malwarebyte, un avast et un ccleaner et je pense que ccleaner pas complètement viré OLT, mais en tout cas je ne rencontre plus aucun problème et les résultats de mes scans sont vides, merci beaucoup pour votre compétence. Bonne fin de journée à vous.
            0