[resolu]je suis perdue

[angelique]

pourquoi t'as pas d'antivirus???

 

 

1• telecharge sur ton bureau mslook.bat :

 

http://www.sendspace.com/file/b987ag

 

execute en tant qu'administrateur toujours , et copie_colle le contenue du fichier texte qui s'affiche

 

2• relance HijackThis en tant qu'admin , "do a system scan only" coche les lignes ci dessous et clic fixchecked:

 

F2 - REG:system.ini: Shell=explorer.exe wproxp.exe

F2 - REG:system.ini: UserInit=C:\Windows\System32\userinit.exe,C:\Windows\System32\wscript.exe C:\Windows\System32\boot.vbs,

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)

 

==> clic fixchecked

 

3• telecharge antivir: http://dl1.avgate.net/down/windows/antivir...n_winu_en_h.exe

 

on va l'installer apres

 

== poste un nouveau rapport hijackthis et le rapport de mslook.bat

[miki40]

Angélique

Des antivirus j'en ai eu deux avira et avast.

C'est par avira qu'est venue ma premiière déconvenue il m'a fait détruire le fichier boot.vbs en me disant qu'il avait un virus et l'autre c'est pareil il m'en a trouvé plein alors j'en ai eu assez et j'ai téléchargé windows live on care que j'essaie depuis hier.

Comme j'ai désinstallé avira avant de restaurer le fichier c'est le caca depuis.

Je suis tesrecommandations mais pour ces antivirus maintenant je n'ose plus en installer aucun autre. Je suis super perdue.

[miki40]

REGEDIT4

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\services]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupfolder]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^e-Carte Bleue Banque Populaire.lnk]

"backup"="C:\\Windows\\pss\\e-Carte Bleue Banque Populaire.lnk.CommonStartup"

"location"="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup"

"backupExtension"=".CommonStartup"

"command"="C:\\PROGRA~1\\E-CART~1\\ECBL-N~1.EXE \" /dontopenmycards\""

"item"="e-Carte Bleue Banque Populaire"

"YEAR"=dword:000007d8

"MONTH"=dword:00000006

"DAY"=dword:00000011

"HOUR"=dword:00000016

"MINUTE"=dword:00000006

"SECOND"=dword:00000018

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Outil de mise à jour Google.lnk]

"backup"="C:\\Windows\\pss\\Outil de mise à jour Google.lnk.CommonStartup"

"location"="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup"

"backupExtension"=".CommonStartup"

"command"="C:\\PROGRA~1\\Google\\GOOGLE~3\\GOOGLE~1.EXE -systray -startup"

"item"="Outil de mise à jour Google"

"YEAR"=dword:000007d8

"MONTH"=dword:00000006

"DAY"=dword:00000011

"HOUR"=dword:00000016

"MINUTE"=dword:00000006

"SECOND"=dword:00000018

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupfolder\C:^Users^micky et jean louis^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^wkcalrem.LNK]

"backup"="C:\\Windows\\pss\\wkcalrem.LNK.Startup"

"location"="C:\\Users\\micky et jean louis\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup"

"backupExtension"=".Startup"

"command"="C:\\PROGRA~1\\COMMON~1\\MICROS~1\\WORKSS~1\\WkCalRem.exe "

"item"="wkcalrem"

"YEAR"=dword:000007d8

"MONTH"=dword:00000006

"DAY"=dword:00000011

"HOUR"=dword:00000016

"MINUTE"=dword:00000006

"SECOND"=dword:00000018

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\Adobe Reader Speed Launcher]

"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"

"item"="Adobe Reader Speed Launcher"

"hkey"="HKLM"

"command"="\"C:\\Program Files\\Adobe\\Reader 8.0\\Reader\\Reader_sl.exe\""

"inimapping"="0"

"YEAR"=dword:000007d8

"MONTH"=dword:00000006

"DAY"=dword:00000011

"HOUR"=dword:00000016

"MINUTE"=dword:00000006

"SECOND"=dword:00000019

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\Packard Bell Data Secure]

"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"

"item"="Packard Bell Data Secure"

"hkey"="HKCU"

"command"="C:\\Program Files\\Packard Bell Data Secure\\PBDataSecure.exe"

"inimapping"="0"

"YEAR"=dword:000007d8

"MONTH"=dword:00000006

"DAY"=dword:00000011

"HOUR"=dword:00000016

"MINUTE"=dword:00000006

"SECOND"=dword:00000018

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\Pando]

"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"

"item"="Pando"

"hkey"="HKCU"

"command"="\"C:\\Program Files\\Pando Networks\\Pando\\pando.exe\" /Minimized"

"inimapping"="0"

"YEAR"=dword:000007d8

"MONTH"=dword:00000006

"DAY"=dword:00000011

"HOUR"=dword:00000016

"MINUTE"=dword:00000006

"SECOND"=dword:00000018

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\Picasa Media Detector]

"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"

"item"="Picasa Media Detector"

"hkey"="HKCU"

"command"="C:\\Program Files\\Picasa2\\PicasaMediaDetector.exe"

"inimapping"="0"

"YEAR"=dword:000007d8

"MONTH"=dword:00000006

"DAY"=dword:00000011

"HOUR"=dword:00000016

"MINUTE"=dword:00000006

"SECOND"=dword:00000018

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\QuickTime Task]

"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"

"item"="QuickTime Task"

"hkey"="HKLM"

"command"="\"C:\\Program Files\\QuickTime\\QTTask.exe\" -atboottime"

"inimapping"="0"

"YEAR"=dword:000007d8

"MONTH"=dword:00000006

"DAY"=dword:00000011

"HOUR"=dword:00000016

"MINUTE"=dword:00000006

"SECOND"=dword:00000019

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\Skype]

"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"

"item"="Skype"

"hkey"="HKCU"

"command"="\"C:\\Program Files\\Skype\\Phone\\Skype.exe\" /nosplash /minimized"

"inimapping"="0"

"YEAR"=dword:000007d8

"MONTH"=dword:00000006

"DAY"=dword:00000011

"HOUR"=dword:00000016

"MINUTE"=dword:00000006

"SECOND"=dword:00000018

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\SynTPEnh]

"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"

"item"="SynTPEnh"

"hkey"="HKLM"

"command"="C:\\Program Files\\Synaptics\\SynTP\\SynTPEnh.exe"

"inimapping"="0"

"YEAR"=dword:000007d8

"MONTH"=dword:00000006

"DAY"=dword:00000011

"HOUR"=dword:00000016

"MINUTE"=dword:00000006

"SECOND"=dword:00000019

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\WAWifiMessage]

"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"

"item"="WAWifiMessage"

"hkey"="HKLM"

"command"="%ProgramFiles%\\Hewlett-Packard\\HP Wireless Assistant\\WiFiMsg.exe"

"inimapping"="0"

"YEAR"=dword:000007d8

"MONTH"=dword:00000006

"DAY"=dword:00000011

"HOUR"=dword:00000016

"MINUTE"=dword:00000006

"SECOND"=dword:00000019

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\state]

"startup"=dword:00000002

[angelique]

bien sur que non , avira a fait du bon boulot !!! il a détruit boot.vbs qui est belle et bien une infection, tu peux le remercier et le reinstaller.

 

Fait ce que je te dis et poste les rapports demandés, il manque un nouveau rapport HijackThis apres effectué ce que je t'ai demandé.

[miki40]

Angélique

ça y est j'ai fait ce que tu m'as indiqué je crois que les antivirus sont déjà sur mon pc

j'attends tes indications mais je voudrais savoir ce que tu penses du logiciel que j'ai mis hier à part le fait qu'il est payant à 90 jours et cher 50 € si antivir est mieux moi je veux bien mais quand même il m'a joué un sale tour non ?

REGEDIT4

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\services]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupfolder]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^e-Carte Bleue Banque Populaire.lnk]

"backup"="C:\\Windows\\pss\\e-Carte Bleue Banque Populaire.lnk.CommonStartup"

"location"="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup"

"backupExtension"=".CommonStartup"

"command"="C:\\PROGRA~1\\E-CART~1\\ECBL-N~1.EXE \" /dontopenmycards\""

"item"="e-Carte Bleue Banque Populaire"

"YEAR"=dword:000007d8

"MONTH"=dword:00000006

"DAY"=dword:00000011

"HOUR"=dword:00000016

"MINUTE"=dword:00000006

"SECOND"=dword:00000018

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Outil de mise à jour Google.lnk]

"backup"="C:\\Windows\\pss\\Outil de mise à jour Google.lnk.CommonStartup"

"location"="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup"

"backupExtension"=".CommonStartup"

"command"="C:\\PROGRA~1\\Google\\GOOGLE~3\\GOOGLE~1.EXE -systray -startup"

"item"="Outil de mise à jour Google"

"YEAR"=dword:000007d8

"MONTH"=dword:00000006

"DAY"=dword:00000011

"HOUR"=dword:00000016

"MINUTE"=dword:00000006

"SECOND"=dword:00000018

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupfolder\C:^Users^micky et jean louis^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^wkcalrem.LNK]

"backup"="C:\\Windows\\pss\\wkcalrem.LNK.Startup"

"location"="C:\\Users\\micky et jean louis\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup"

"backupExtension"=".Startup"

"command"="C:\\PROGRA~1\\COMMON~1\\MICROS~1\\WORKSS~1\\WkCalRem.exe "

"item"="wkcalrem"

"YEAR"=dword:000007d8

"MONTH"=dword:00000006

"DAY"=dword:00000011

"HOUR"=dword:00000016

"MINUTE"=dword:00000006

"SECOND"=dword:00000018

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\Adobe Reader Speed Launcher]

"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"

"item"="Adobe Reader Speed Launcher"

"hkey"="HKLM"

"command"="\"C:\\Program Files\\Adobe\\Reader 8.0\\Reader\\Reader_sl.exe\""

"inimapping"="0"

"YEAR"=dword:000007d8

"MONTH"=dword:00000006

"DAY"=dword:00000011

"HOUR"=dword:00000016

"MINUTE"=dword:00000006

"SECOND"=dword:00000019

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\Packard Bell Data Secure]

"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"

"item"="Packard Bell Data Secure"

"hkey"="HKCU"

"command"="C:\\Program Files\\Packard Bell Data Secure\\PBDataSecure.exe"

"inimapping"="0"

"YEAR"=dword:000007d8

"MONTH"=dword:00000006

"DAY"=dword:00000011

"HOUR"=dword:00000016

"MINUTE"=dword:00000006

"SECOND"=dword:00000018

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\Pando]

"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"

"item"="Pando"

"hkey"="HKCU"

"command"="\"C:\\Program Files\\Pando Networks\\Pando\\pando.exe\" /Minimized"

"inimapping"="0"

"YEAR"=dword:000007d8

"MONTH"=dword:00000006

"DAY"=dword:00000011

"HOUR"=dword:00000016

"MINUTE"=dword:00000006

"SECOND"=dword:00000018

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\Picasa Media Detector]

"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"

"item"="Picasa Media Detector"

"hkey"="HKCU"

"command"="C:\\Program Files\\Picasa2\\PicasaMediaDetector.exe"

"inimapping"="0"

"YEAR"=dword:000007d8

"MONTH"=dword:00000006

"DAY"=dword:00000011

"HOUR"=dword:00000016

"MINUTE"=dword:00000006

"SECOND"=dword:00000018

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\QuickTime Task]

"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"

"item"="QuickTime Task"

"hkey"="HKLM"

"command"="\"C:\\Program Files\\QuickTime\\QTTask.exe\" -atboottime"

"inimapping"="0"

"YEAR"=dword:000007d8

"MONTH"=dword:00000006

"DAY"=dword:00000011

"HOUR"=dword:00000016

"MINUTE"=dword:00000006

"SECOND"=dword:00000019

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\Skype]

"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"

"item"="Skype"

"hkey"="HKCU"

"command"="\"C:\\Program Files\\Skype\\Phone\\Skype.exe\" /nosplash /minimized"

"inimapping"="0"

"YEAR"=dword:000007d8

"MONTH"=dword:00000006

"DAY"=dword:00000011

"HOUR"=dword:00000016

"MINUTE"=dword:00000006

"SECOND"=dword:00000018

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\SynTPEnh]

"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"

"item"="SynTPEnh"

"hkey"="HKLM"

"command"="C:\\Program Files\\Synaptics\\SynTP\\SynTPEnh.exe"

"inimapping"="0"

"YEAR"=dword:000007d8

"MONTH"=dword:00000006

"DAY"=dword:00000011

"HOUR"=dword:00000016

"MINUTE"=dword:00000006

"SECOND"=dword:00000019

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\WAWifiMessage]

"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"

"item"="WAWifiMessage"

"hkey"="HKLM"

"command"="%ProgramFiles%\\Hewlett-Packard\\HP Wireless Assistant\\WiFiMsg.exe"

"inimapping"="0"

"YEAR"=dword:000007d8

"MONTH"=dword:00000006

"DAY"=dword:00000011

"HOUR"=dword:00000016

"MINUTE"=dword:00000006

"SECOND"=dword:00000019

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\state]

"startup"=dword:00000002

 

 

 

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 16:52:34, on 19/08/2008

Platform: Windows Vista SP1 (WinNT 6.00.1905)

MSIE: Internet Explorer v7.00 (7.00.6001.18000)

Boot mode: Normal

 

Running processes:

C:\Windows\system32\taskeng.exe

C:\Windows\system32\Dwm.exe

C:\Windows\explorer.exe

C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe

C:\Windows\RtHDVCpl.exe

C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe

C:\Program Files\HP\QuickPlay\QPService.exe

C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe

C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe

C:\Program Files\HP\HP Software Update\hpwuSchd2.exe

C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe

C:\Program Files\ScanSoft\OmniPageSE4.0\OpWareSE4.exe

C:\Windows\System32\spool\drivers\w32x86\3\WrtMon.exe

C:\Program Files\Synaptics\SynTP\SynTPStart.exe

C:\Program Files\HP\Digital Imaging\bin\HpqSRmon.exe

C:\Windows\System32\rundll32.exe

C:\Program Files\Microsoft Windows OneCare Live\winssnotify.exe

C:\Windows\ehome\ehtray.exe

C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

C:\Program Files\Packard Bell Data Secure\PBDataSecure.exe

C:\Program Files\Windows Media Player\wmpnscfg.exe

C:\Windows\System32\rundll32.exe

C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe

C:\Windows\System32\spool\drivers\w32x86\3\WrtProc.exe

C:\Windows\ehome\ehmsas.exe

C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

C:\Program Files\IncrediMail\bin\IMApp.exe

C:\Program Files\Microsoft Windows OneCare Live\WinSSNotifyE.exe

C:\Program Files\Adobe\Reader 8.0\Reader\AcroRd32Info.exe

C:\Windows\system32\prevhost.exe

C:\Windows\system32\conime.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Windows\System32\notepad.exe

C:\Windows\explorer.exe

C:\Windows\system32\notepad.exe

C:\Windows\System32\cmd.exe

C:\Windows\system32\notepad.exe

C:\HJT\HiJackThis.exe

 

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a...n&pf=laptop

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a...n&pf=laptop

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

O1 - Hosts: ::1 localhost

O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

O2 - BHO: e-Carte Bleue Browser Helper Object - {2E03C0FD-4C48-43A7-9A54-00240C70FF16} - C:\Windows\system32\BhoECart.dll

O2 - BHO: CInterceptor Object - {38D3FE60-3D53-4F37-BB0E-C7A97A26A156} - C:\Program Files\Pando Networks\Pando\PandoIEPlugin.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll

O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: Easy Gif Animator Toolbar Helper - {96372AB6-15EB-4316-B497-71C741BC548C} - C:\Program Files\Easy Gif Animator Extension\v3.3.0.0\EasyGifAnimator_Toolbar.dll

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll

O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\4.1.509.6972\swg.dll

O3 - Toolbar: Easy Gif Animator Toolbar - {35065594-9169-4A34-B167-FC4865038E53} - C:\Program Files\Easy Gif Animator Extension\v3.3.0.0\EasyGifAnimator_Toolbar.dll

O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll

O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide

O4 - HKLM\..\Run: [sMSERIAL] C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe

O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe

O4 - HKLM\..\Run: [iAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe

O4 - HKLM\..\Run: [QPService] "C:\Program Files\HP\QuickPlay\QPService.exe"

O4 - HKLM\..\Run: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start

O4 - HKLM\..\Run: [HP Health Check Scheduler] C:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe

O4 - HKLM\..\Run: [hpWirelessAssistant] %ProgramFiles%\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe

O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"

O4 - HKLM\..\Run: [sSBkgdUpdate] "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot

O4 - HKLM\..\Run: [OpwareSE4] "C:\Program Files\ScanSoft\OmniPageSE4.0\OpwareSE4.exe"

O4 - HKLM\..\Run: [WrtMon.exe] C:\Windows\system32\spool\drivers\w32x86\3\WrtMon.exe

O4 - HKLM\..\Run: [synTPStart] C:\Program Files\Synaptics\SynTP\SynTPStart.exe

O4 - HKLM\..\Run: [NeroFilterCheck] C:\Windows\system32\NeroCheck.exe

O4 - HKLM\..\Run: [hpqSRMon] C:\Program Files\HP\Digital Imaging\bin\hpqSRMon.exe

O4 - HKLM\..\Run: [MSConfig] "C:\Windows\System32\msconfig.exe" /auto

O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [OneCareUI] "C:\Program Files\Microsoft Windows OneCare Live\winssnotify.exe"

O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe

O4 - HKCU\..\Run: [incrediMail] C:\Program Files\IncrediMail\bin\IncMail.exe /c

O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

O4 - HKCU\..\Run: [Packard Bell Data Secure] C:\Program Files\Packard Bell Data Secure\PBDataSecure.exe

O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe

O4 - HKUS\S-1-5-19\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')

O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')

O4 - HKUS\S-1-5-20\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')

O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present

O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll

O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll

O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll

O13 - Gopher Prefix:

O17 - HKLM\System\CCS\Services\Tcpip\..\{02A28693-6A4C-4543-AA21-B04F0E86296F}: NameServer = 80.10.246.134 80.10.246.7

O17 - HKLM\System\CS1\Services\Tcpip\..\{02A28693-6A4C-4543-AA21-B04F0E86296F}: NameServer = 80.10.246.134 80.10.246.7

O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe

O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - C:\Program Files\HP\QuickPlay\Kernel\TV\CLCapSvc.exe

O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - C:\Program Files\HP\QuickPlay\Kernel\TV\CLSched.exe

O23 - Service: Com4Qlb - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4Qlb.exe

O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: HP Health Check Service - Hewlett-Packard - C:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe

O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe

O23 - Service: Intel® Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe

O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\Windows\System32\LEXBCES.EXE

O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe

O23 - Service: lxbc_device - - C:\Windows\system32\lxbccoms.exe

O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe

O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe

 

--

End of file - 9890 bytes

[angelique]

j'attends tes indications mais je voudrais savoir ce que tu penses du logiciel que j'ai mis hier à part le fait qu'il est payant à 90 jours et cher 50 € si antivir est mieux moi je veux bien mais quand même il m'a joué un sale tour non ?

 

NON , antivir t'a viré l'infection, t'as sauvé en 1 mot, tu peux le remercier , c'est juste une valeur registre qui fesait appel à l'infection boot.vbs qui n'etait pas supprimé, d'ou le message boot.vbs manquant!! desormais tu ne l'auras plus au prochain reboot de ton PC.

 

•Vire ton truc à 50€ , et reinstalle antivir avec le lien que je t'ai donné plus haut.

 

• supprime MSLook.bat

 

 

tuto pour le configurer antivir:

http://www.malekal.com/tutorial_antivir.php

 

http://www.libellules.ch/tuto_antivir.php

 

et fait un scan complet , poste le rapport en fin d'analyse, quarantaine les infections trouvées

[miki40]

Angélique

Je télécharge le fichier antivir mais cela sera long car je n'ai que le bas débit.

A +

Cordialement

[angelique]

ok

[miki40]

Angélique ça télécharge toujours j'en ai pour plus d'une heure encore chez moi impossible d'avoir l'adsl!!!

Dès que je l'ai je l'installe et je t'envoie les comptes-rendus.

Merci pour ton hyper efficacité.

Bien cordialement sois assurée de toute ma reconnaissance.

Miki40

[miki40]

Zébulon.fr c'est ici qu'on est le mieux aidé !!!

J'en ai essayé des forums depuis deux mois.

Aucun n'a su ou plutôt voulu aller jusqu'où Angélique m'a menée !!!

Merci Angélique !