Infection trojan TR/Trash.Gen

[domie26]

Voici le rapport d'OTL

All processes killed

========== OTL ==========

Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\10 deleted successfully.

Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\Locked deleted successfully.

Registry value HKEY_USERS\S-1-5-21-482693211-1043793889-2174145967-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{7FCC73D8-0CD9-4553-81F6-E827F6AE4432} deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7FCC73D8-0CD9-4553-81F6-E827F6AE4432}\ not found.

FastUserSwitchingCompatibility removed from NetSvcs value successfully!

Nla removed from NetSvcs value successfully!

Ntmssvc removed from NetSvcs value successfully!

NWCWorkstation removed from NetSvcs value successfully!

Nwsapagent removed from NetSvcs value successfully!

SRService removed from NetSvcs value successfully!

WmdmPmSp removed from NetSvcs value successfully!

LogonHours removed from NetSvcs value successfully!

PCAudit removed from NetSvcs value successfully!

helpsvc removed from NetSvcs value successfully!

uploadmgr removed from NetSvcs value successfully!

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\StartUpFolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^InterVideo WinCinema Manager.lnk\ deleted successfully.

C:\Windows\pss\InterVideo WinCinema Manager.lnk.CommonStartup moved successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\StartUpFolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Microsoft Office.lnk\ deleted successfully.

C:\Windows\pss\Microsoft Office.lnk.CommonStartup moved successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\StartUpReg\Adobe Reader Speed Launcher\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\StartUpReg\BtTray\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\StartUpReg\DivX Download Manager\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\StartUpReg\EPSON Stylus SX400 Series (Copie 1)\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\StartUpReg\swg\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\StartUpReg\Uniblue Registry Booster2\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\StartUpReg\WinampAgent\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\StartUpReg\Windows Defender\ deleted successfully.

C:\ProgramData\hnbdehzc.pfe moved successfully.

C:\Users\Domie\AppData\Roaming\Uniblue\Registry Booster2 folder moved successfully.

C:\Users\Domie\AppData\Roaming\Uniblue folder moved successfully.

========== REGISTRY ==========

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\exefile\shell\open\command\\""|""%1" %*" /E : value set successfully!

 

OTL by OldTimer - Version 3.2.42.2 log created on 05012012_125920

 

Files\Folders moved on Reboot...

 

Registry entries deleted on Reboot...

[pear]

C'est bon.

 

Encore quelque chose ?

[domie26]

Oui, car je ne comprends pas pourquoi j'ai ce message, quand je clique propriété dans ordinateur, j'ai le message suivant :

nombre de jours avant l'activation automatique : 1

ça me fait un peu peur, en sachant que mon vista est d'origine.

 

Autrement je vous remercie beaucoup pour tout ce travail effectué.

 

Merci et bonne fin de semaine

[pear]

http://support.microsoft.com/kb/940315/fr