Fenêtre avec texte récalcitrante

Salut,

Faire un Scan OTL - Temps : Environ 40min
=====================
OTL permet de diagnostiquer les programmes qui tournent et déceler des infections - Le programme va générer deux rapports OTL.txt et Extras.txt
Fournir les deux rapports :

Tu peux suivre les indications de cette page pour t'aider : https://www.malekal.com/tutorial-otl/

* Télécharge http://www.geekstogo.com/forum/files/file/398-otl-oldtimers-list-it/ sur ton bureau.
(Sous Vista/Win7, il faut cliquer droit sur OTL et choisir Exécuter en tant qu'administrateur)

* Lance OTL
* En haut à droite de Analyse rapide, coche "tous les utilisateurs"
* Sur OTL, sous Personnalisation, copie-colle le script ci-dessous :

netsvcs
msconfig
safebootminimal
safebootnetwork
activex
drivers32
%ALLUSERSPROFILE%\Application Data\*.
%ALLUSERSPROFILE%\Application Data\*.exe /s
%ALLUSERSPROFILE%\Application Data\*.dll /s
%APPDATA%\*.
%APPDATA%\*.exe /s
%temp%\*.exe /s
%SYSTEMDRIVE%\*.exe
%systemroot%\*. /mp /s
%systemroot%\system32\consrv.dll
%systemroot%\system32\*.dll /lockedfiles
%windir%\Tasks\*.job /lockedfiles
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
/md5start
explorer.exe
winlogon.exe
services.exe
wininit.exe
/md5stop
HKEY_CLASSES_ROOT\CLSID\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InprocServer32 /s
HKEY_LOCAL_MACHINE\SYSTEM\SYSTEM\CurrentControlSet\Services\lanmanserver\parameters /s
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems /s
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\AppCertDlls /s
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList /s
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor /s
HKEY_CURRENT_USER\Software\Microsoft\Command Processor /s
CREATERESTOREPOINT
nslookup www.google.fr /c
ipconfig /all /c
ping www.google.fr /c
SAVEMBR:0
hklm\software\clients\startmenuinternet|command /rs
hklm\software\clients\startmenuinternet|command /64 /rs

* Clique sur le bouton Analyse.

**** Si durant le scan - OTL ne répond pas, ne touche à rien et laisse le scan se poursuivre ****

* Quand le scan est fini, utilise le site http://pjjoint.malekal.com/ pour envoyer le rapport OTL.txt (et Extra.txt si présent).
Donne le ou les liens pjjoint qui pointent vers ces rapports ici dans une réponse.
Je répète : donne le lien du rapport pjjoint ici en réponse.

NE PAS COPIER/COLLER LE RAPPORT ICI - DONNER LE LIEN PJJOINT DANS UN NOUVEAU MESSAGE

Like the angel you are, you laugh creating a lightness in my chest,
Your eyes they penetrate me,
(Your answer's always 'maybe')
That's when I got up and left

https://pjjoint.malekal.com/files.php?id=20140718_r5f7d14d6h13

https://pjjoint.malekal.com/files.php?id=20140719_b13m11i14d14m13

essaye ça :

Relance OTL.
o sous Personnalisation (Custom Scan), copie_colle le contenu du cadre ci dessous (bien prendre :OTLdébut).
Clic Correction (Fix), un rapport apparraitra, copie/colle le contenu ici:

:OTL
F3 - HKU\S-1-5-21-1057498529-474972215-3363973391-1000 WinNT: Load - (C:\Users\norbert\LOCALS~1\Temp\msayyyya.scr) - File not found
:reg
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
"Load"=-

* poste le rapport ici

Redémarre l'ordinateur

========== OTL ==========
Registry value HKEY_USERS\S-1-5-21-1057498529-474972215-3363973391-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\\Load:C:\Users\norbert\LOCALS~1\Temp\msayyyya.scr deleted successfully.
========== REGISTRY ==========
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows\\Load deleted successfully.

OTL by OldTimer - Version 3.2.69.0 log created on 07192014_195233

Refais un scan Malwarebytes et donne le rapport ici.

Malwarebytes Anti-Malware
www.malwarebytes.org

Scan Date: 20/07/2014
Scan Time: 10:57:13
Logfile: rapport.txt
Administrator: Yes

Version: 2.00.2.1012
Malware Database: v2014.07.20.02
Rootkit Database: v2014.07.17.01
License: Free
Malware Protection: Disabled
Malicious Website Protection: Disabled
Self-protection: Disabled

OS: Windows Vista Service Pack 2
CPU: x86
File System: NTFS
User: norbert

Scan Type: Threat Scan
Result: Completed
Objects Scanned: 294418
Time Elapsed: 9 min, 43 sec

Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled

Processes: 0
(No malicious items detected)

Modules: 0
(No malicious items detected)

Registry Keys: 2
PUP.Optional.RegCleanPro.A, HKLM\SOFTWARE\SYSTWEAK\RegClean Pro, , [f0d2e0c187f4bf777311a51f9072817f],
PUP.Optional.BundleInstaller.A, HKLM\SOFTWARE\VITTALIA\AxtanInstaller, , [9a283968ed8ebe78d819a83f6c9641bf],

Registry Values: 0
(No malicious items detected)

Registry Data: 0
(No malicious items detected)

Folders: 1
PUP.Optional.CrossRider.A, C:\Users\norbert\AppData\Local\Google\Chrome\User Data\Default\databases\chrome-extension_ihkeoookbpemkdccdccdmacnidhooohk_0, , [b40e534ecbb049ed2d67a6099e647f81],

Files: 6
PUP.Optional.OptimumInstaller.A, C:\Users\norbert\Downloads\Setup.exe, , [675b802187f495a1c8f670e569981fe1],
PUP.Optional.Bandoo, C:\Users\norbert\Downloads\iLividSetup-r726-n-bi.exe, , [cdf5ecb57407c472b40e58b927dadb25],
PUP.Optional.Iminent.A, C:\Users\norbert\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_igdhbblpcellaljokkpfhcjlagemhgjl_0.localstorage, , [4e74f7aae9922c0ac639696adb27a060],
PUP.Optional.CrossRider.A, C:\Users\norbert\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_ihkeoookbpemkdccdccdmacnidhooohk_0.localstorage, , [447e6f32651666d0926ac016b64c3ac6],
PUP.Optional.CrossRider.A, C:\Users\norbert\AppData\Local\Google\Chrome\User Data\Default\databases\chrome-extension_ihkeoookbpemkdccdccdmacnidhooohk_0\1, , [b40e534ecbb049ed2d67a6099e647f81],
PUP.Optional.CrossRider.A, C:\Users\norbert\AppData\Local\Google\Chrome\User Data\Default\databases\chrome-extension_ihkeoookbpemkdccdccdmacnidhooohk_0\2, , [b40e534ecbb049ed2d67a6099e647f81],

Physical Sectors: 0
(No malicious items detected)

(end)
<?xml version="1.0" encoding="UTF-16"?>
-<mbam-log> -<header> <date>2014/07/20 10:57:13 +0200</date> <logfile>mbam-log-2014-07-20 (10-57-11).xml</logfile> <isadmin>yes</isadmin> </header> -<engine> <version>2.00.2.1012</version> <malware-database>v2014.07.20.02</malware-database> <rootkit-database>v2014.07.17.01</rootkit-database> <license>free</license> <file-protection>disabled</file-protection> <web-protection>disabled</web-protection> <self-protection>disabled</self-protection> </engine> -<system> <osversion>Windows Vista Service Pack 2</osversion> <arch>x86</arch> <username>norbert</username> <filesys>NTFS</filesys> </system> -<summary> <type>threat</type> <result>completed</result> <objects>294418</objects> <time>583</time> <processes>0</processes> <modules>0</modules> <keys>2</keys> <values>0</values> <datas>0</datas> <folders>1</folders> <files>6</files> <sectors>0</sectors> </summary> -<options> <memory>enabled</memory> <startup>enabled</startup> <filesystem>enabled</filesystem> <archives>enabled</archives> <rootkits>disabled</rootkits> <deeprootkit>disabled</deeprootkit> <heuristics>enabled</heuristics> <pup>enabled</pup> <pum>enabled</pum> </options> -<items> -<key><path>HKLM\SOFTWARE\SYSTWEAK\RegClean Pro</path><vendor>PUP.Optional.RegCleanPro.A</vendor><action/><hash>f0d2e0c187f4bf777311a51f9072817f</hash></key> -<key><path>HKLM\SOFTWARE\VITTALIA\AxtanInstaller</path><vendor>PUP.Optional.BundleInstaller.A</vendor><action/><hash>9a283968ed8ebe78d819a83f6c9641bf</hash></key> -<folder><path>C:\Users\norbert\AppData\Local\Google\Chrome\User Data\Default\databases\chrome-extension_ihkeoookbpemkdccdccdmacnidhooohk_0</path><vendor>PUP.Optional.CrossRider.A</vendor><action/><hash>b40e534ecbb049ed2d67a6099e647f81</hash></folder> -<file><path>C:\Users\norbert\Downloads\Setup.exe</path><vendor>PUP.Optional.OptimumInstaller.A</vendor><action/><hash>675b802187f495a1c8f670e569981fe1</hash></file> -<file><path>C:\Users\norbert\Downloads\iLividSetup-r726-n-bi.exe</path><vendor>PUP.Optional.Bandoo</vendor><action/><hash>cdf5ecb57407c472b40e58b927dadb25</hash></file> -<file><path>C:\Users\norbert\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_igdhbblpcellaljokkpfhcjlagemhgjl_0.localstorage</path><vendor>PUP.Optional.Iminent.A</vendor><action/><hash>4e74f7aae9922c0ac639696adb27a060</hash></file> -<file><path>C:\Users\norbert\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_ihkeoookbpemkdccdccdmacnidhooohk_0.localstorage</path><vendor>PUP.Optional.CrossRider.A</vendor><action/><hash>447e6f32651666d0926ac016b64c3ac6</hash></file> -<file><path>C:\Users\norbert\AppData\Local\Google\Chrome\User Data\Default\databases\chrome-extension_ihkeoookbpemkdccdccdmacnidhooohk_0\1</path><vendor>PUP.Optional.CrossRider.A</vendor><action/><hash>b40e534ecbb049ed2d67a6099e647f81</hash></file> -<file><path>C:\Users\norbert\AppData\Local\Google\Chrome\User Data\Default\databases\chrome-extension_ihkeoookbpemkdccdccdmacnidhooohk_0\2</path><vendor>PUP.Optional.CrossRider.A</vendor><action/><hash>b40e534ecbb049ed2d67a6099e647f81</hash></file> </items> </mbam-log>

ok il ne semble plus là :)

il faut que tu changes tous tes mots de passe WEB (Facebook, mail etc).

Merci à vous pour la suppression de ma fenêtre, et les conseils.

Sincères salutations