Virus demarrage

ok merci

http://pjjoint.malekal.com/files.php?id=814fdcdad091411

alors pour la première question concernant le démarrage j'ai effectué une restauration système pour ouvrir l'ordi.
Ensuite j'ai lancé un examen avec malwarbytes , résultat 3 rootklits 1 trojan que j'ai supprimés.
Re avec malwarbytes RESULTAT EN QUARANTAINE
Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Version de la base de données: 6772

Windows 6.1.7600 (Safe Mode)
Internet Explorer 8.0.7600.16385

04/06/2011 23:11:27
mbam-log-2011-06-04 (23-11-27).txt

Type d'examen: Examen rapide
Elément(s) analysé(s): 170321
Temps écoulé: 2 minute(s), 30 seconde(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 3
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 1

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
HKEY_CLASSES_ROOT\CLSID\{00000000-0000-0000-0000-000000000000} (IPH.GenericBHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Slvhxhlu (IPH.GenericBHO) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{00000000-0000-0000-0000-000000000000} (IPH.GenericBHO) -> Quarantined and deleted successfully.

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
c:\Windows\SysWOW64\wdafnvwj.dll (IPH.GenericBHO) -> Quarantined and deleted successfully.

ok

Bonjour;
Tout d'abord merci beaucoup , j'ai cependant encore des problèmes sur le démarrage,message (pas systématique) mais qui apparaît de temps en temps "réparation du démarrage" il cherche et voilà rien. Donc je suis obligée de relancer.
je vais refaire ZHPdiag
a+

http://www.cijoint.fr/cjlink.php?file=cj201106/cij4rsIuQz.zip
a+

j'ai supprimé le message où apparait ton nom et prénom -)

et nous on fait comment pour suivre ?

All processes killed
Error: Unable to interpret <reg > in the current context!
Error: Unable to interpret <[-HKCU\Software\Microsoft\Windows\CurrentVersion\ext\stats\{83ff80f4-8c74-4b80-b5ba-c8ddd434e5c4}] > in the current context!
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Anne-Sophie Biffano
->Temp folder emptied: 857 bytes
->Java cache emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: anne-sophie BIFFANO.anne-sophieBIFF
->Temp folder emptied: 4609673 bytes
->Temporary Internet Files folder emptied: 51982188 bytes
->Google Chrome cache emptied: 0 bytes
->Flash cache emptied: 669 bytes

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 32902 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Public

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 4443997 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 33170 bytes
RecycleBin emptied: 240391 bytes

Total Files Cleaned = 59,00 mb


OTM by OldTimer - Version 3.1.18.0 log created on 06062011_202030

Files moved on Reboot...
File C:\Users\Anne-Sophie Biffano\AppData\Local\Temp\Low\Fichiers Internet temporaires\Content.IE5\OZ61ZB17\mUo13eYbO03jdGtwKQEMWZDJuCLR3-AuETsrnjpAmdRlsRW2talQrMVgPufELz74BfP0y_4V2wFdkA3pDFPq-IqFqZ0Cn4nQiqP-GjkfmMZh7u-ND-TNZOMG3-DcZXdq5pPeHOEV5oFAQP2HQdG8Lal4wa0A3Ck[1].jpg not found!
C:\Users\anne-sophie BIFFANO.anne-sophieBIFF\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.
C:\Users\anne-sophie BIFFANO.anne-sophieBIFF\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\MSIMGSIZ.DAT moved successfully.

Registry entries deleted on Reboot...

Bonjour
j'ai de nouveau des problèmes au demarrage je suis obligée de mettre demarrage sans echec
merci
a+

re
IL s'ouvre normalement mais tres long
Pouvez vous effacer encore mon nom dans le dernier rapport merci
a+

maintenant il ne fait que s'arrêter.
http://www.cijoint.fr/cjlink.php?file=cj201106/cijmnTwlgQ.zip

je suis en mode sans echec
a+

bonjour,
D'abord quand je suis au démarrage il ouvre une fenêtre recherche de réparation du système de démarrage et il cherche et me dit au bout de plusieurs minutes qu'il n'a pas pu récupérer les données.
Ou alors tout s'ouvre normalement et il s'arrête.
Une autre fois, une fenêtre bleue(sur le fond noir) s'ouvre message en anglais et tout s'arrête.

Très instable
a+

1) le message en anglais dis quoi ?

2) as-tu le cd de windows ?

re
je suis sur le pc de mes parents, il ouvre une fenêtre systematiquement sur "reparation du demarrage.
Votre ordinateur n'a pas pu demarrer " et il cherche

2) la seule chose que j'ai pu noter du message en anglais a has been detected.......(fenêtre bleu écriture blanche)
3) j'avais fait un cd de sauvegarde mais je n'arrive pas ou plutot je ne sais pas le faire accepter par le pc

A problem has been detected and Windows has been shut down to prevent damage
to your computer.

The problem seems to be caused by the following file: ntoskrnl.exe

IRQL_NOT_LESS_OR_EQUAL

If this is the first time you've seen this stop error screen,
restart your computer. If this screen appears again, follow
these steps:

Check to make sure any new hardware or software is properly installed.
If this is a new installation, ask your hardware or software manufacturer
for any Windows updates you might need.

If problems continue, disable or remove any newly installed hardware
or software. Disable BIOS memory options such as caching or shadowing.
If you need to use safe mode to remove or disable components, restart
your computer, press F8 to select Advanced Startup Options, and then
select Safe Mode.

Technical Information:

*** STOP: 0x0000000a (0x00000000000000dc, 0x0000000000000002, 0x0000000000000001,
0xfffff80002c6b8c5)


2)A problem has been detected and Windows has been shut down to prevent damage
to your computer.

The problem seems to be caused by the following file: ntoskrnl.exe

KMODE_EXCEPTION_NOT_HANDLED

If this is the first time you've seen this stop error screen,
restart your computer. If this screen appears again, follow
these steps:

Check to make sure any new hardware or software is properly installed.
If this is a new installation, ask your hardware or software manufacturer
for any Windows updates you might need.

If problems continue, disable or remove any newly installed hardware
or software. Disable BIOS memory options such as caching or shadowing.
If you need to use safe mode to remove or disable components, restart
your computer, press F8 to select Advanced Startup Options, and then
select Safe Mode.

Technical Information:

*** STOP: 0x0000001e (0xffffffffc0000005, 0xfffff80002cac047, 0x0000000000000000,
0x000007fffffa0000)




3)A problem has been detected and Windows has been shut down to prevent damage
to your computer.

The problem seems to be caused by the following file: ntoskrnl.exe

KMODE_EXCEPTION_NOT_HANDLED

If this is the first time you've seen this stop error screen,
restart your computer. If this screen appears again, follow
these steps:

Check to make sure any new hardware or software is properly installed.
If this is a new installation, ask your hardware or software manufacturer
for any Windows updates you might need.

If problems continue, disable or remove any newly installed hardware
or software. Disable BIOS memory options such as caching or shadowing.
If you need to use safe mode to remove or disable components, restart
your computer, press F8 to select Advanced Startup Options, and then
select Safe Mode.

Technical Information:

*** STOP: 0x0000001e (0xffffffffc0000096, 0xfffff80002c6896a, 0x0000000000000000,
0x0000000000000000)

*** ntoskrnl.exe - Address 0xfffff80002c8cf00 base at 0xfffff80002c1b000 DateStamp
0x4a5bc600



4) Check to make sure any new hardware or software is properly installed.
If this is a new installation, ask your hardware or software manufacturer
for any Windows updates you might need.

If problems continue, disable or remove any newly installed hardware
or software. Disable BIOS memory options such as caching or shadowing.
If you need to use safe mode to remove or disable components, restart
your computer, press F8 to select Advanced Startup Options, and then
select Safe Mode.

Technical Information:

*** STOP: 0x0000001e (0xffffffffc0000096, 0xfffff80002c5c96a, 0x0000000000000000,
0x0000000000000000)

*** ntoskrnl.exe - Address 0xfffff80002c80f00 base at 0xfffff80002c0f000 DateStamp
0x4a5bc600

suite apres 9 lignes

bonsoir
j'ai recup l'ouverture de mon pc en faisant une restauration du systeme mais toujours les ecrans bleus. voilà la suite des messages de bluescreenview
merci je suis découragée
A+

A problem has been detected and Windows has been shut down to prevent damage
to your computer.

5) The problem seems to be caused by the following file: ntoskrnl.exe

KMODE_EXCEPTION_NOT_HANDLED

If this is the first time you've seen this stop error screen,
restart your computer. If this screen appears again, follow
these steps:

Check to make sure any new hardware or software is properly installed.
If this is a new installation, ask your hardware or software manufacturer
for any Windows updates you might need.

If problems continue, disable or remove any newly installed hardware
or software. Disable BIOS memory options such as caching or shadowing.
If you need to use safe mode to remove or disable components, restart
your computer, press F8 to select Advanced Startup Options, and then
select Safe Mode.

Technical Information:

*** STOP: 0x0000001e (0xffffffffc0000005, 0xfffff80002c66047, 0x0000000000000000,
0x000007fffffa0000)

*** ntoskrnl.exe - Address 0xfffff80002c85f00 base at 0xfffff80002c14000 DateStamp
0x4a5bc600

6)
A problem has been detected and Windows has been shut down to prevent damage
to your computer.

The problem seems to be caused by the following file: ntoskrnl.exe

IRQL_NOT_LESS_OR_EQUAL

If this is the first time you've seen this stop error screen,
restart your computer. If this screen appears again, follow
these steps:

Check to make sure any new hardware or software is properly installed.
If this is a new installation, ask your hardware or software manufacturer
for any Windows updates you might need.

If problems continue, disable or remove any newly installed hardware
or software. Disable BIOS memory options such as caching or shadowing.
If you need to use safe mode to remove or disable components, restart
your computer, press F8 to select Advanced Startup Options, and then
select Safe Mode.

Technical Information:

*** STOP: 0x0000000a (0x00000000000000dc, 0x0000000000000002, 0x0000000000000001,
0xfffff80002ca98c5)

*** ntoskrnl.exe - Address 0xfffff80002ccdf00 base at 0xfffff80002c5c000 DateStamp
0x4a5bc600



7) A problem has been detected and Windows has been shut down to prevent damage
to your computer.

The problem seems to be caused by the following file: ntoskrnl.exe

KMODE_EXCEPTION_NOT_HANDLED

If this is the first time you've seen this stop error screen,
restart your computer. If this screen appears again, follow
these steps:

Check to make sure any new hardware or software is properly installed.
If this is a new installation, ask your hardware or software manufacturer
for any Windows updates you might need.

If problems continue, disable or remove any newly installed hardware
or software. Disable BIOS memory options such as caching or shadowing.
If you need to use safe mode to remove or disable components, restart
your computer, press F8 to select Advanced Startup Options, and then
select Safe Mode.

Technical Information:

*** STOP: 0x0000001e (0xffffffffc0000096, 0xfffff80002ca596a, 0x0000000000000000,
0x0000000000000000)

*** ntoskrnl.exe - Address 0xfffff80002cc9f00 base at 0xfffff80002c58000 DateStamp
0x4a5bc600

8) A problem has been detected and Windows has been shut down to prevent damage
to your computer.

The problem seems to be caused by the following file: ntoskrnl.exe

IRQL_NOT_LESS_OR_EQUAL

If this is the first time you've seen this stop error screen,
restart your computer. If this screen appears again, follow
these steps:

Check to make sure any new hardware or software is properly installed.
If this is a new installation, ask your hardware or software manufacturer
for any Windows updates you might need.

If problems continue, disable or remove any newly installed hardware
or software. Disable BIOS memory options such as caching or shadowing.
If you need to use safe mode to remove or disable components, restart
your computer, press F8 to select Advanced Startup Options, and then
select Safe Mode.

Technical Information:

*** STOP: 0x0000000a (0xfffff88007ffd6e0, 0x0000000000000002, 0x0000000000000000,
0xfffff80002a94f9f)

*** ntoskrnl.exe - Address 0xfffff80002a90f00 base at 0xfffff80002a1f000 DateStamp
0x4a5bc600

9) A problem has been detected and Windows has been shut down to prevent damage
to your computer.

The problem seems to be caused by the following file: amdsata.sys

KMODE_EXCEPTION_NOT_HANDLED

If this is the first time you've seen this stop error screen,
restart your computer. If this screen appears again, follow
these steps:

Check to make sure any new hardware or software is properly installed.
If this is a new installation, ask your hardware or software manufacturer
for any Windows updates you might need.

If problems continue, disable or remove any newly installed hardware
or software. Disable BIOS memory options such as caching or shadowing.
If you need to use safe mode to remove or disable components, restart
your computer, press F8 to select Advanced Startup Options, and then
select Safe Mode.

Technical Information:

*** STOP: 0x0000001e (0xffffffffc0000005, 0xfffff8000217350a, 0x0000000000000001,
0x0000000000000018)

*** amdsata.sys - Address 0xfffff88000fb6301 base at 0xfffff88000fb5000 DateStamp
0x49f79245








fin

J'ai une autre fenetre qui s'ouvre
windows a redemarré après un arrêt non planifié
windows peut rechercher une solution en ligne
details des problèmes
Signature du problème :
Nom d'événement de problème: BlueScreen
Version du système: 6.1.7600.2.0.0.768.3
Identificateur de paramètres régionaux: 1036

Informations supplémentaires sur le problème :
BCCode: a
BCP1: 00000000000C2440
BCP2: 0000000000000002
BCP3: 0000000000000001
BCP4: FFFFF80002CD54D8
OS Version: 6_1_7600
Service Pack: 0_0
Product: 768_1

Fichiers aidant à décrire le problème :
C:\Windows\Minidump\061011-47876-01.dmp
C:\Users\asb\AppData\Local\Temp\WER-105191-0.sysdata.xml

Lire notre déclaration de confidentialité en ligne :
http://go.microsoft.com/fwlink/?linkid=104288&clcid=0x040c

Si la déclaration de confidentialité en ligne n'est pas disponible, lisez la version hors connexion :
C:\Windows\system32\fr-FR\erofflps.txt