Dyrhuboa.dll

yevgi Messages postés 78 Statut Membre -  
yevgi Messages postés 78 Statut Membre -
Bonjour,
j'ai un probleme avec mon vista depuis quelques jours,
a chaque fois que je demare mon PC a l'entrée a Windows j'ai le message suivant qui s'affiche:
"erreur dans c:\users\yevgi\appdata\local\temp\dyrhuboa.dll
entrée manquente : run"
ceci a pour effet que a chaque ouverture d'une fenetre quelconque (poste de travail,raccourci a des fichier divers...)
windows quitte la fenetre et il y a une sorte d'actualisation d'explorer qui des fois m'oblige a aller dans le gestionnaire des taches de windows et lancer explorer.exe en tant que nouvelle application.
que faire afin de resoudre cce probleme?s'agit-il d'un virus?
merci d'avance

--
tout les animaux sont egaux,mais certain sont plus egaux que d'autre

25 réponses

  • 1
  • 2
  1. green day Messages postés 26374 Date d'inscription   Statut Modérateur, Contributeur sécurité Dernière intervention   2 166
     
    Salut

    cette dll a tous les aspects pour un trojan voir in rootkit !

    Télécharge ceci :

    Lien : http://www.commentcamarche.net/telecharger/telecharger 159 hijackthis

    Démo : http://pageperso.aol.fr/balltrap34/demohijack.htm

    Choisir l'option "do a scan and a logfile", et faire un copier/coller du rapport ainsi générer sur le forum.

    ++

    PS : je demande aux modos de déplacer ton message dans le forum virus/sécu !

    0
  2. yevgi Messages postés 78 Statut Membre 7
     
    merci pour la reponse rapide
    je vais esseyer.
    0
    1. yevgi Messages postés 78 Statut Membre 7
       
      salut,
      j'ai installé le programme et j'ai pu m'en debarasser mais le probleme perciste...
      a chaque fois que j'ouvre un fichier explorer fait une sorte d'actualisation...
      c'est lourd!
      si quelqu'un a d'autres idées...
      0
  3. green day Messages postés 26374 Date d'inscription   Statut Modérateur, Contributeur sécurité Dernière intervention   2 166
     
    Salut

    poste le rapport !!

    ++
    0
  4. yevgi Messages postés 78 Statut Membre 7
     
    je ne sais pas comment faire... ^^
    0

  5. Vous n’avez pas trouvé la réponse que vous recherchez ?

    Posez votre question
  6. green day Messages postés 26374 Date d'inscription   Statut Modérateur, Contributeur sécurité Dernière intervention   2 166
     
    Regarde la démo ! cf poste 1 !

    ++
    0
  7. yevgi Messages postés 78 Statut Membre 7
     
    dac merci
    alor voila le rapport:

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 22:19:35, on 16/03/2008
    Platform: Windows Vista (WinNT 6.00.1904)
    MSIE: Internet Explorer v7.00 (7.00.6000.16609)
    Boot mode: Normal

    Running processes:
    C:\Windows\system32\Dwm.exe
    C:\Program Files\Windows Defender\MSASCui.exe
    C:\Program Files\Sigmatel\C-Major Audio\WDM\sttray.exe
    C:\Windows\System32\rundll32.exe
    C:\Windows\System32\rundll32.exe
    C:\Windows\WindowsMobile\wmdc.exe
    C:\Program Files\Java\jre1.6.0\bin\jusched.exe
    C:\Windows\System32\ico.exe
    C:\Windows\System32\Pmxmiced.exe
    C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
    C:\Program Files\McAfee\MSK\mskagent.exe
    C:\Program Files\Common Files\Intel\IntelDH\NMS\Support\IntelHCTAgent.exe
    C:\Program Files\Intel\IntelDH\CCU\CCU_TrayIcon.exe
    C:\Program Files\Winamp\winampa.exe
    C:\Program Files\WinTV\EPG Services\System\EPGClient.exe
    C:\Program Files\Dell Support Center\bin\sprtcmd.exe
    C:\Program Files\Intel\IntelDH\CCU\CCU_Engine.exe
    C:\Program Files\Windows Media Player\wmpnscfg.exe
    C:\Windows\System32\rundll32.exe
    C:\Program Files\Windows Mail\WinMail.exe
    C:\Windows\System32\rundll32.exe
    C:\Program Files\WinTV\Ir.exe
    C:\Games\Heroes3\Register\Remind32.exe
    C:\Games\Heroes3\RegisterSOD\Remind32.exe
    c:\PROGRA~1\mcafee.com\agent\mcagent.exe
    C:\Program Files\McAfee\MPS\mpsevh.exe
    C:\Program Files\Windows Media Player\wmplayer.exe
    C:\Windows\system32\taskeng.exe
    C:\Program Files\Windows Media Player\WMPSideShowGadget.exe
    C:\Program Files\Windows Mail\WindowsMailGadget.exe
    c:\program files\mcafee\msc\mcuimgr.exe
    C:\Program Files\WinRAR\WinRAR.exe
    C:\Windows\explorer.exe
    C:\Program Files\Alcohol Soft\Alcohol 52\Alcohol.exe
    J:\setup.exe
    C:\Users\Yevgi\AppData\Local\Temp\is-GOJ38.tmp\is-839QO.tmp
    C:\Program Files\Winamp\winamp.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.google.fr
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
    O1 - Hosts: ::1 localhost
    O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - c:\Program Files\Java\jre1.6.0\bin\ssv.dll
    O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - c:\program files\mcafee\virusscan\scriptcl.dll
    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
    O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
    O2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\Dell\BAE\BAE.dll
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
    O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
    O4 - HKLM\..\Run: [ECenter] C:\Dell\E-Center\EULALauncher.exe
    O4 - HKLM\..\Run: [SigmatelSysTrayApp] C:\Program Files\SigmaTel\C-Major Audio\WDM\sttray.exe
    O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
    O4 - HKLM\..\Run: [Windows Mobile Device Center] %windir%\WindowsMobile\wmdc.exe
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "c:\Program Files\Java\jre1.6.0\bin\jusched.exe"
    O4 - HKLM\..\Run: [PMX Daemon] ICO.EXE
    O4 - HKLM\..\Run: [IAAnotif] "C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe"
    O4 - HKLM\..\Run: [MskAgentexe] C:\Program Files\McAfee\MSK\MskAgent.exe
    O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
    O4 - HKLM\..\Run: [NMSSupport] "C:\Program Files\Common Files\Intel\IntelDH\NMS\Support\IntelHCTAgent.exe" /startup
    O4 - HKLM\..\Run: [CCUTRAYICON] "C:\Program Files\Intel\IntelDH\CCU\CCU_TrayIcon.exe"
    O4 - HKLM\..\Run: [dscactivate] "C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe"
    O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
    O4 - HKLM\..\Run: [MSServer] rundll32.exe C:\Windows\system32\ljhgh.dll,#1
    O4 - HKLM\..\Run: [EPGServiceTool] C:\PROGRA~1\WinTV\EPG Services\System\EPGClient.exe
    O4 - HKCU\..\Run: [DellSupportCenter] "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCenter
    O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
    O4 - HKCU\..\Run: [badb843f] rundll32.exe "C:\Users\Yevgi\AppData\Local\Temp\wpwiqkwx.dll",b
    O4 - HKCU\..\Run: [MSServer] rundll32.exe C:\Users\Yevgi\AppData\Local\Temp\efcbb.dll,#1
    O4 - HKCU\..\Run: [cmds] rundll32.exe C:\Users\Yevgi\AppData\Local\Temp\awvuv.dll,c
    O4 - HKCU\..\Run: [BMb9e8b7a3] Rundll32.exe "C:\Users\Yevgi\AppData\Local\Temp\yitpoyxe.dll",s
    O4 - HKCU\..\Run: [MS Juan] rundll32 "C:\Users\Yevgi\AppData\Local\Temp\dyrhuboa.dll",run
    O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
    O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
    O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
    O4 - HKUS\S-1-5-21-31434581-3181455718-583861208-1000\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'IUSR_NMPR')
    O4 - Startup: 3DO Registration.lnk = C:\Games\Heroes3\Register\Remind32.exe
    O4 - Startup: H3 The Shadow of Death(TM).lnk = C:\Games\Heroes3\RegisterSOD\Remind32.exe
    O4 - Global Startup: AutoStart IR.lnk = C:\Program Files\WinTV\Ir.exe
    O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - c:\Program Files\Java\jre1.6.0\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - c:\Program Files\Java\jre1.6.0\bin\ssv.dll
    O9 - Extra button: @C:\Windows\WindowsMobile\INetRepl.dll,-222 - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
    O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
    O9 - Extra 'Tools' menuitem: @C:\Windows\WindowsMobile\INetRepl.dll,-223 - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
    O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
    O13 - Gopher Prefix:
    O17 - HKLM\System\CCS\Services\Tcpip\..\{7A02E051-227A-459C-932E-817F1D4AAB89}: NameServer = 192.168.1.1
    O23 - Service: Intel(R) Alert Service (AlertService) - Intel(R) Corporation - C:\Program Files\Intel\IntelDH\CCU\AlertService.exe
    O23 - Service: Intel(R) DHTrace Controller (DHTRACE) - Intel(R) Corporation - C:\Program Files\Common Files\Intel\IntelDH\bin\DHTraceController.exe
    O23 - Service: DQLWinService - Unknown owner - C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe
    O23 - Service: McAfee E-mail Proxy (Emproxy) - McAfee, Inc. - C:\PROGRA~1\COMMON~1\McAfee\EmProxy\emproxy.exe
    O23 - Service: EPGService - Hauppauge Computer Works - C:\PROGRA~1\WinTV\EPG Services\System\EPGService.exe
    O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    O23 - Service: HauppaugeTVServer - Hauppauge Computer Works - C:\PROGRA~1\WinTV\HCWTVS~1.EXE
    O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
    O23 - Service: Intel(R) Software Services Manager (ISSM) - Intel(R) Corporation - C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\ISSM.exe
    O23 - Service: Intel(R) Viiv(TM) Media Server (M1 Server) - Unknown owner - C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\mediaserver.exe
    O23 - Service: McAfee HackerWatch Service - McAfee, Inc. - C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe
    O23 - Service: Intel(R) Application Tracker (MCLServiceATL) - Intel(R) Corporation - C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\MCLServiceATL.exe
    O23 - Service: McAfee Update Manager (mcmispupdmgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcupdmgr.exe
    O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
    O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\program files\common files\mcafee\mna\mcnasvc.exe
    O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
    O23 - Service: McAfee Protection Manager (mcpromgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcpromgr.exe
    O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
    O23 - Service: McAfee Redirector Service (McRedirector) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\redirsvc\redirsvc.exe
    O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
    O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
    O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
    O23 - Service: McAfee Privacy Service (MPS9) - McAfee, Inc. - C:\PROGRA~1\McAfee\MPS\mps.exe
    O23 - Service: McAfee SpamKiller Service (MSK80Service) - McAfee Inc. - C:\Program Files\McAfee\MSK\MskSrver.exe
    O23 - Service: Intel(R) NMSCore (NMSCore) - Intel(R) Corporation - C:\Program Files\Common Files\Intel\IntelDH\NMS\NMSCore\NMSCore.exe
    O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe
    O23 - Service: PnkBstrB - Unknown owner - C:\Windows\system32\PnkBstrB.exe
    O23 - Service: Intel(R) Quality Manager (QualityManager) - Intel(R) Corporation - C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\qualitymanager.exe
    O23 - Service: Intel(R) Remoting Service (Remote UI Service) - Intel(R) Corporation - C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\Remote UI Service.exe
    O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
    O23 - Service: SupportSoft Sprocket Service (dellsupportcenter) (sprtsvc_dellsupportcenter) - SupportSoft, Inc. - C:\Program Files\Dell Support Center\bin\sprtsvc.exe
    O23 - Service: SigmaTel Audio Service (STacSV) - SigmaTel, Inc. - C:\Windows\system32\STacSV.exe
    O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe
    0
  8. green day Messages postés 26374 Date d'inscription   Statut Modérateur, Contributeur sécurité Dernière intervention   2 166
     
    Salut

    * Désactiver le contrôle des comptes utilisateurs (le réactiver à la fin de la désinfection) :
    * Aller dans démarrer puis panneau de configuration
    * Double Cliquer sur l'icône Comptes d'utilisateurs
    * Cliquer ensuite sur désactiver et valider.

    Télécharger ComboFix sur le Bureau : http://download.bleepingcomputer.com/sUBs/ComboFix.exe
    * Démarrer en mode sans échec
    * Faire un clic-droit sur combofix présent sur le bureau et choisir Exécuter en tant qu'administrateur
    * Double cliquer sur combofix.exe.
    * Appuyer sur la touche Y (Yes) pour démarrer le scan
    * Le rapport sera crée dans: C:\Combofix.txt

    ==> poste le rapport stp

    ++
    0
    1. yevgi Messages postés 78 Statut Membre 7
       
      d'accord merci je vais esseyer
      le probleme est que je ne peut pas ouvrir les fichier car ca entraine le refresh d'explorer est donc la fermeture du fichier,
      ce refresh s'active au bout de 15 sec maxi...
      mais bon je vais voir et je te tiendrai au courant...
      0
  9. yevgi Messages postés 78 Statut Membre 7
     
    reussi ^^
    tu veux que je le publi comme il est?
    c'est un peu long...
    0
  10. green day Messages postés 26374 Date d'inscription   Statut Modérateur, Contributeur sécurité Dernière intervention   2 166
     
    Salut

    oui, colle tout stp

    ++
    0
    1. yevgi Messages postés 78 Statut Membre 7
       
      dac,
      le voila:

      ComboFix 08-03-24.2 - Yevgi 2008-03-25 23:41:09.1 - NTFSx86
      Microsoft® Windows Vista™ Édition Familiale Premium 6.0.6000.0.1252.1.1036.18.1236 [GMT 1:00]
      Endroit: C:\Users\Yevgi\Desktop\ComboFix.exe
      * Création d'un nouveau point de restauration
      .

      (((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
      .

      C:\Users\Yevgi\AppData\Local\Temp\awvuv.dll
      C:\Windows\pskt.ini

      .
      ((((((((((((((((((((((((((((( Fichiers cr‚‚s 2008-02-25 to 2008-03-25 ))))))))))))))))))))))))))))))))))))
      .

      2008-03-25 23:46 . 2008-01-30 13:48 39,424 --a------ C:\Windows\System32\hgggd.dll
      2008-03-25 16:38 . 2008-01-30 13:48 39,424 --a------ C:\Windows\System32\cbxut.dll
      2008-03-22 15:37 . 2008-03-22 15:37 665 --a------ C:\Windows\eReg.dat
      2008-03-22 15:17 . 2008-03-22 15:17 <REP> d-------- C:\Kama sutra
      2008-03-22 15:13 . 2008-03-22 15:13 <REP> d-------- C:\Program Files\Ubisoft
      2008-03-22 15:13 . 2003-10-27 14:06 505,104 --a------ C:\Windows\System32\msxml.dll
      2008-03-22 15:13 . 2003-10-27 14:06 89,360 --a------ C:\Windows\System32\VB5DB.DLL
      2008-03-22 15:13 . 2003-10-27 14:06 69,632 --a------ C:\Windows\System32\xmltok.dll
      2008-03-22 15:13 . 2003-10-27 14:06 36,864 --a------ C:\Windows\System32\xmlparse.dll
      2008-03-22 15:13 . 2003-10-27 14:06 35,840 --a------ C:\Windows\System32\comdlg32.oca
      2008-03-22 15:13 . 2003-10-27 14:06 29,184 --a------ C:\Windows\System32\MSINET.oca
      2008-03-22 15:13 . 2003-10-27 14:06 28,432 --a------ C:\Windows\System32\msxmlr.dll
      2008-03-22 15:13 . 2003-10-27 14:06 26,096 --a------ C:\Windows\System32\xmlinst.exe
      2008-03-22 15:13 . 2003-10-27 14:06 24,576 --a------ C:\Windows\System32\msxml3a.dll
      2008-03-22 11:52 . 2008-03-22 11:52 <REP> d-------- C:\Users\Yevgi\AppData\Roaming\Ubisoft
      2008-03-22 11:52 . 2008-03-22 11:52 <REP> d-------- C:\Users\All Users\Ubisoft
      2008-03-22 11:52 . 2008-03-22 11:52 <REP> d-------- C:\ProgramData\Ubisoft
      2008-03-19 20:53 . 2008-03-21 17:15 16 --a------ C:\Windows\popcinfo.dat
      2008-03-17 21:25 . 2008-03-17 21:25 <REP> d-------- C:\Users\Yevgi\AppData\Roaming\Microsoft Games
      2008-03-16 22:37 . 2008-03-16 22:37 <REP> d-------- C:\NVIDIA
      2008-03-16 22:36 . 2008-03-16 22:36 <REP> d-------- C:\Program Files\GSC World Publishing
      2008-03-09 22:07 . 2008-03-09 22:07 <REP> d-------- C:\Users\Yevgi\AppData\Roaming\InstallShield Installation Information
      2008-03-09 21:46 . 2008-03-09 21:46 <REP> d-------- C:\Windows\System32\AGEIA
      2008-03-09 21:46 . 2008-03-09 21:46 <REP> d-------- C:\Program Files\AGEIA Technologies
      2008-03-06 18:50 . 2008-03-06 18:50 <REP> dr-hs---- C:\_Backup.RC
      2008-03-06 18:50 . 2008-03-06 18:50 <REP> d--h----- C:\_Backup
      2008-03-06 18:49 . 2008-03-06 18:49 <REP> d-------- C:\Users\Yevgi\AppData\Roaming\VCOM
      2008-03-06 18:49 . 2008-03-06 18:49 <REP> d-------- C:\Users\All Users\VCOM
      2008-03-06 18:49 . 2008-03-06 18:49 <REP> d-------- C:\ProgramData\VCOM
      2008-03-06 18:49 . 2008-03-06 18:49 <REP> d-------- C:\Program Files\VCOM
      2008-03-06 18:48 . 2008-03-15 19:26 <REP> d-------- C:\Program Files\Common Files\Wise Installation Wizard
      2008-03-05 23:26 . 2008-03-24 21:26 <REP> d-------- C:\Series
      2008-03-02 22:07 . 2008-03-02 22:07 <REP> d-------- C:\Program Files\Trend Micro
      2008-02-27 19:58 . 2008-02-27 19:58 1,158 --a------ C:\Windows\mozver.dat
      2008-02-27 17:31 . 2008-03-16 22:48 108,144 --a------ C:\Windows\System32\CmdLineExt.dll
      2008-02-27 03:08 . 2008-02-27 03:08 194,560 --a------ C:\Windows\System32\WebClnt.dll
      2008-02-27 03:08 . 2008-02-27 03:08 110,080 --a------ C:\Windows\System32\drivers\mrxdav.sys
      2008-02-27 03:06 . 2008-02-27 03:06 806,400 --a------ C:\Windows\System32\drivers\tcpip.sys
      2008-02-27 03:06 . 2008-02-27 03:06 217,144 --a------ C:\Windows\System32\drivers\netio.sys
      2008-02-27 03:06 . 2008-02-27 03:06 167,424 --a------ C:\Windows\System32\tcpipcfg.dll
      2008-02-27 03:06 . 2008-02-27 03:06 24,064 --a------ C:\Windows\System32\netcfg.exe
      2008-02-27 03:06 . 2008-02-27 03:06 22,016 --a------ C:\Windows\System32\netiougc.exe
      2008-02-27 03:05 . 2008-02-27 03:05 1,327,104 --a------ C:\Windows\System32\quartz.dll
      2008-02-27 03:05 . 2008-02-27 03:05 223,232 --a------ C:\Windows\System32\WMASF.DLL
      2008-02-27 03:05 . 2008-02-27 03:05 130,048 --a------ C:\Windows\System32\drivers\srv2.sys
      2008-02-27 03:05 . 2008-02-27 03:05 101,888 --a------ C:\Windows\System32\drivers\mrxsmb.sys
      2008-02-27 03:05 . 2008-02-27 03:05 84,992 --a------ C:\Windows\System32\drivers\srvnet.sys
      2008-02-27 03:05 . 2008-02-27 03:05 58,368 --a------ C:\Windows\System32\drivers\mrxsmb20.sys
      2008-02-27 03:05 . 2008-02-27 03:05 11,776 --a------ C:\Windows\System32\sbunattend.exe
      2008-02-27 03:05 . 2008-02-27 03:05 9,728 --a------ C:\Windows\System32\LAPRXY.DLL
      2008-02-27 03:05 . 2008-02-27 03:05 2,048 --a------ C:\Windows\System32\asferror.dll
      2008-02-27 03:04 . 2008-02-27 03:04 <REP> d-------- C:\Program Files\MSXML 4.0
      2008-02-27 03:04 . 2008-02-27 03:04 3,504,824 --a------ C:\Windows\System32\ntkrnlpa.exe
      2008-02-27 03:04 . 2008-02-27 03:04 3,470,520 --a------ C:\Windows\System32\ntoskrnl.exe
      2008-02-27 03:03 . 2008-02-27 03:03 2,048 --a------ C:\Windows\System32\tzres.dll
      2008-02-26 22:09 . 2008-02-27 22:14 <REP> d-------- C:\War III Ced
      2008-02-26 21:43 . 2008-02-26 21:43 283 --a------ C:\Windows\game.ini
      2008-02-26 19:32 . 2008-02-26 19:32 1,712,984 --a------ C:\Windows\System32\wuaueng.dll
      2008-02-26 19:32 . 2008-02-26 19:32 1,524,224 --a------ C:\Windows\System32\wucltux.dll
      2008-02-26 19:32 . 2008-02-26 19:32 53,080 --a------ C:\Windows\System32\wuauclt.exe
      2008-02-26 19:32 . 2008-02-26 19:32 43,352 --a------ C:\Windows\System32\wups2.dll
      2008-02-26 19:31 . 2008-02-26 19:31 549,720 --a------ C:\Windows\System32\wuapi.dll
      2008-02-26 19:31 . 2008-02-26 19:31 163,000 --a------ C:\Windows\System32\wuwebv.dll
      2008-02-26 19:31 . 2008-02-26 19:31 80,896 --a------ C:\Windows\System32\wudriver.dll
      2008-02-26 19:31 . 2008-02-26 19:31 33,624 --a------ C:\Windows\System32\wups.dll
      2008-02-26 19:31 . 2008-02-26 19:31 31,232 --a------ C:\Windows\System32\wuapp.exe
      2008-02-26 19:11 . 2008-02-26 19:26 <REP> d--hsc--- C:\Program Files\Common Files\WindowsLiveInstaller
      2008-02-26 19:10 . 2008-02-26 19:10 <REP> d-------- C:\Users\All Users\WLInstaller
      2008-02-26 19:10 . 2008-02-26 19:10 <REP> d-------- C:\ProgramData\WLInstaller
      2008-02-26 19:10 . 2008-02-26 19:26 <REP> d-------- C:\Program Files\Windows Live
      2008-02-26 19:04 . 2008-02-26 19:04 0 --a------ C:\Windows\nsreg.dat
      2008-02-25 21:36 . 2008-02-25 21:36 <REP> d-------- C:\Program Files\JoWooD

      .
      (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
      .
      2008-03-25 22:46 --------- d-----w C:\Program Files\WinTV
      2008-03-22 14:06 --------- d--h--w C:\Program Files\InstallShield Installation Information
      2008-03-11 23:07 --------- d-----w C:\Program Files\Privé
      2008-02-27 03:54 --------- d-----w C:\Program Files\Windows Sidebar
      2008-02-27 02:07 54,784 ----a-w C:\Windows\system32\drivers\i8042prt.sys
      2008-02-27 02:07 495,160 ----a-w C:\Windows\system32\drivers\Wdf01000.sys
      2008-02-27 02:07 35,384 ----a-w C:\Windows\system32\drivers\WdfLdr.sys
      2008-02-27 02:07 35,384 ----a-w C:\Windows\system32\drivers\kbdclass.sys
      2008-02-27 02:07 34,360 ----a-w C:\Windows\system32\drivers\mouclass.sys
      2008-02-27 02:07 19,968 ----a-w C:\Windows\system32\drivers\sermouse.sys
      2008-02-27 02:07 15,872 ----a-w C:\Windows\system32\drivers\mouhid.sys
      2008-02-27 02:07 15,872 ----a-w C:\Windows\system32\drivers\kbdhid.sys
      2008-02-27 02:02 52,736 ----a-w C:\Windows\AppPatch\iebrshim.dll
      2008-02-26 21:12 --------- d-----w C:\ProgramData\Dell
      2008-02-26 20:43 22,328 ----a-w C:\Windows\system32\drivers\PnkBstrK.sys
      2008-02-26 20:43 22,328 ----a-w C:\Users\Yevgi\AppData\Roaming\PnkBstrK.sys
      2008-02-25 18:40 --------- d-----w C:\Users\Yevgi\AppData\Roaming\La Bataille pour la Terre du Milieu
      2008-02-24 22:24 --------- d-----w C:\Users\Yevgi\AppData\Roaming\PeerNetworking
      2008-02-24 20:51 --------- d-----w C:\Users\Yevgi\AppData\Roaming\InstallShield
      2008-02-22 14:17 --------- d-----w C:\Program Files\Activision Value
      2008-02-22 14:15 --------- d-----w C:\ProgramData\Media Center Programs
      2008-02-14 21:49 --------- d-----w C:\Program Files\3DO
      2008-02-14 15:43 --------- d-----w C:\ProgramData\OrbNetworks
      2008-02-14 15:42 --------- d-----w C:\Program Files\Orb Networks
      2008-02-13 16:31 --------- d-----w C:\Program Files\vtplus
      2008-02-13 16:31 --------- d-----w C:\Program Files\Common Files\IviSDK
      2008-02-12 15:02 278,984 ----a-w C:\Windows\system32\drivers\atksgt.sys
      2008-02-12 14:41 --------- d-----w C:\Program Files\Alcohol Soft
      2008-02-12 14:38 715,248 ----a-w C:\Windows\system32\drivers\sptd.sys
      2008-02-11 20:04 --------- d-----w C:\Program Files\OpenAL
      2008-02-11 15:38 --------- d-----w C:\Program Files\WinAce
      2008-01-25 12:10 --------- d-----w C:\Program Files\Google
      2008-01-16 21:14 537,600 ----a-w C:\Windows\AppPatch\AcLayers.dll
      2008-01-16 21:14 449,536 ----a-w C:\Windows\AppPatch\AcSpecfc.dll
      2008-01-16 21:14 2,144,256 ----a-w C:\Windows\AppPatch\AcGenral.dll
      2008-01-16 21:14 173,056 ----a-w C:\Windows\AppPatch\AcXtrnal.dll
      2008-01-16 13:26 174 --sha-w C:\Program Files\desktop.ini
      .

      ((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
      .
      .
      REGEDIT4
      *Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s

      [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
      "DellSupportCenter"="C:\Program Files\Dell Support Center\bin\sprtcmd.exe" [2007-11-15 10:23 202544]

      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
      "Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [2008-01-16 22:12 1006264]
      "ECenter"="C:\Dell\E-Center\EULALauncher.exe" [2007-05-25 07:03 17920]
      "SigmatelSysTrayApp"="C:\Program Files\SigmaTel\C-Major Audio\WDM\sttray.exe" [2007-09-12 09:40 405504]
      "NvSvc"="C:\Windows\system32\nvsvc.dll" [2007-10-25 05:52 86016]
      "NvCplDaemon"="C:\Windows\system32\NvCpl.dll" [2007-10-25 05:52 8530464]
      "NvMediaCenter"="C:\Windows\system32\NvMcTray.dll" [2007-10-25 05:52 81920]
      "Windows Mobile Device Center"="%windir%\WindowsMobile\wmdc.exe" [ ]
      "SunJavaUpdateSched"="c:\Program Files\Java\jre1.6.0\bin\jusched.exe" [2008-01-16 14:35 77824]
      "PMX Daemon"="ICO.EXE" [2006-11-08 16:01 49152 C:\Windows\System32\ico.exe]
      "IAAnotif"="C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe" [2007-07-26 20:03 178712]
      "MskAgentexe"="C:\Program Files\McAfee\MSK\MskAgent.exe" [2007-01-17 18:30 152144]
      "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 04:06 40048]
      "MSServer"="C:\Windows\system32\hgggd.dll" [2008-01-30 13:48 39424]
      "NMSSupport"="C:\Program Files\Common Files\Intel\IntelDH\NMS\Support\IntelHCTAgent.exe" [2007-06-27 11:14 439512]
      "CCUTRAYICON"="C:\Program Files\Intel\IntelDH\CCU\CCU_TrayIcon.exe" [2007-06-27 11:18 215256]
      "dscactivate"="C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe" [2007-11-15 10:24 16384]
      "WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2007-05-14 23:22 35328]
      "EPGServiceTool"="C:\PROGRA~1\WinTV\EPG Services\System\EPGClient.exe" [2007-08-01 04:26 675840]

      [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
      "EnableLUA"= 0 (0x0)

      [hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
      "{89A1E40D-0254-4F99-B9AE-B60A2D8754A9}"= C:\Windows\system32\hgggd.dll [2008-01-30 13:48 39424]

      [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Orb]
      --a------ 2007-01-20 01:50 253952 C:\Program Files\Orb Networks\Orb\bin\OrbTray.exe

      [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiSpyware]
      "DisableMonitoring"=dword:00000001

      [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]
      "DisableMonitoring"=dword:00000001

      [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall]
      "DisableMonitoring"=dword:00000001

      [HKLM\~\services\sharedaccess\parameters\firewallpolicy\DomainProfile]
      "EnableFirewall"= 0 (0x0)

      [HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
      "{6AAD1578-915F-4998-BDA1-52BFA57029CF}"= UDP:Profile=Private:LocalSubnet:LocalSubnet|C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\TSHWMDTCP.exe:SPCM
      "{18AC111E-2A35-40DF-9C7F-DD1C2DE51374}"= TCP:Profile=Private:LocalSubnet:LocalSubnet|C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\TSHWMDTCP.exe:SPCM
      "{A7DED6C4-07F0-45A6-9996-070565830F4C}"= UDP:Profile=Private:LocalSubnet:LocalSubnet|C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\Remote UI Service.exe:Intel(R) Remoting Service
      "{54A17BD3-500D-4B5F-8527-6F9AC998C6B2}"= TCP:Profile=Private:LocalSubnet:LocalSubnet|C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\Remote UI Service.exe:Intel(R) Remoting Service
      "{B6BCF073-E804-4B7C-8052-6941137F6B2C}"= UDP:Profile=Private:LocalSubnet:LocalSubnet|C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\mediaserver.exe:Intel(R) Viiv(TM) Media Server
      "{4A78A54D-0354-43C7-808E-576081A84C4B}"= TCP:Profile=Private:LocalSubnet:LocalSubnet|C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\mediaserver.exe:Intel(R) Viiv(TM) Media Server
      "{96E2687C-5A4C-484B-B4B9-B33BF1F9A28B}"= TCP:Profile=Private|9442:127.0.0.1:Intel(R) Viiv(TM) Media Server Discovery
      "{4181C01B-F7E9-442F-866F-F261BF4CB017}"= TCP:Profile=Private|1900:LocalSubnet:LocalSubnet:Intel(R) Viiv(TM) Media Server UPnP Discovery
      "{576B83F1-55B7-4E5C-B759-DA22FD58BA3D}"= Profile=Private|C:\Program Files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
      "{39274DBA-3908-4088-9106-01CF744A4DC5}"= Disabled:UDP:C:\Games\Call of Duty 4\iw3mp.exe:Call of Duty(R) 4 - Modern Warfare(TM)
      "{A19363A0-21C0-46F2-B6BF-0ABE464704FC}"= Disabled:TCP:C:\Games\Call of Duty 4\iw3mp.exe:Call of Duty(R) 4 - Modern Warfare(TM)
      "{3ACB499E-D69E-4353-94A8-E12CDC3A11ED}"= Disabled:UDP:C:\Games\Crysis\Bin32\Crysis.exe:Crysis_32
      "{14107EEC-276D-4160-B14A-3838E5DFDCD2}"= Disabled:TCP:C:\Games\Crysis\Bin32\Crysis.exe:Crysis_32
      "{8FDC5EBC-FA74-4128-86FF-836DEA7F819B}"= Disabled:UDP:C:\Games\Crysis\Bin32\CrysisDedicatedServer.exe:CrysisDedicatedServer_32
      "{4834F166-A192-4A8C-BC63-7E7B292E395A}"= Disabled:TCP:C:\Games\Crysis\Bin32\CrysisDedicatedServer.exe:CrysisDedicatedServer_32
      "{A08E7197-2161-4CC6-82C7-0EA363F8CAA9}"= Disabled:UDP:C:\Games\Hellgate London\Launcher.exe:Hellgate : London
      "{F38AA40C-0FEA-4CAF-9886-E56E244A87A7}"= Disabled:TCP:C:\Games\Hellgate London\Launcher.exe:Hellgate : London
      "{C7A61758-6BFE-4512-AD95-FBC7A186726B}"= Disabled:UDP:C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\Remote UI Service.exe:Intel(R) Remoting Service
      "{7E17D8F2-5EFF-407C-8425-D1AAC2FBA291}"= Disabled:TCP:C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\Remote UI Service.exe:Intel(R) Remoting Service
      "{728C4C0C-2F7C-4907-B744-EAFAD898565C}"= Disabled:UDP:C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\mediaserver.exe:Intel(R) Viiv(TM) Media Server
      "{206771A1-0D66-4FBB-A661-7CE1036D1722}"= Disabled:TCP:C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\mediaserver.exe:Intel(R) Viiv(TM) Media Server
      "{472FEFB9-5F97-4631-892C-71F522C8F352}"= Disabled:TCP:9442:127.0.0.1:Intel(R) Viiv(TM) Media Server Discovery
      "{92BE3A66-C0EC-41AC-BF6B-5B3C7E54399D}"= Disabled:TCP:1900:LocalSubnet:LocalSubnet:Intel(R) Viiv(TM) Media Server UPnP Discovery
      "{DE066973-A17E-4EE6-A6DE-205B134FF5F8}"= Disabled:UDP:C:\Games\Kane and Lynch Dead Men\kaneandlynch.exe:Kane & Lynch: Dead Men
      "{637E9979-5AC3-4C24-891F-EFD122252082}"= Disabled:TCP:C:\Games\Kane and Lynch Dead Men\kaneandlynch.exe:Kane & Lynch: Dead Men
      "{61A1497C-72BF-49D6-9E8B-DCA183CB9E65}"= Disabled:UDP:C:\Program Files\Common Files\McAfee\MNA\McNASvc.exe:McAfee Network Agent
      "{4706CD56-9A34-43AA-98CC-B608D0CD77E4}"= Disabled:TCP:C:\Program Files\Common Files\McAfee\MNA\McNASvc.exe:McAfee Network Agent
      "{7535E2C1-FB0F-415B-8E83-96EE9B86C122}"= Disabled:UDP:C:\Program Files\Orb Networks\Orb\bin\Orb.exe:Orb
      "{6376B9CC-1226-4DFD-9F9F-5D4378212C80}"= Disabled:TCP:C:\Program Files\Orb Networks\Orb\bin\Orb.exe:Orb
      "{75E9ED74-4BE8-4728-883E-4D478C9C0536}"= Disabled:UDP:C:\Program Files\Orb Networks\Orb\bin\OrbStreamerClient.exe:Orb Stream Client
      "{03B74D9B-52D6-4E44-8D77-6DD3D6120827}"= Disabled:TCP:C:\Program Files\Orb Networks\Orb\bin\OrbStreamerClient.exe:Orb Stream Client
      "{2A6F5EE6-0678-4B91-A9A7-899B8A27EDB0}"= Disabled:UDP:C:\Program Files\Orb Networks\Orb\bin\OrbChannelScan.exe:OrbChannelScan
      "{06D38823-7317-4CD0-AE6F-AABCB3FFF20A}"= Disabled:TCP:C:\Program Files\Orb Networks\Orb\bin\OrbChannelScan.exe:OrbChannelScan
      "{B288497A-CCFC-46DF-ABDB-716CB0799157}"= Disabled:UDP:C:\Program Files\Orb Networks\Orb\bin\OrbTray.exe:OrbTray
      "{9A2EB351-E5FA-43A6-928C-A22EF79749C9}"= Disabled:TCP:C:\Program Files\Orb Networks\Orb\bin\OrbTray.exe:OrbTray
      "{5ACEED7A-407C-4AB4-A571-29C73B3307E1}"= Disabled:UDP:C:\Program Files\Orb Networks\Orb\bin\OrbIR.exe:OrbTray
      "{107FF459-B3C1-4C55-952E-125C85289A91}"= Disabled:TCP:C:\Program Files\Orb Networks\Orb\bin\OrbIR.exe:OrbTray
      "{871C11DA-C0AE-4D3A-AFF5-825D3D59483E}"= Disabled:UDP:C:\Windows\System32\PnkBstrA.exe:PnkBstrA
      "{FEC8ED3C-AEA4-4CB6-B9D9-E5F0B6AD1AE4}"= Disabled:TCP:C:\Windows\System32\PnkBstrA.exe:PnkBstrA
      "{2C5B71BA-CA9F-4329-A9AB-3C2EB7C172CC}"= Disabled:UDP:C:\Windows\System32\PnkBstrB.exe:PnkBstrB
      "{FC6FF96E-8C6F-4699-B3CC-FC5E792F42F1}"= Disabled:TCP:C:\Windows\System32\PnkBstrB.exe:PnkBstrB
      "{EC4D42F4-5C2E-4D94-B341-F61ED5299CFD}"= Disabled:UDP:C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\TSHWMDTCP.exe:SPCM
      "{B3ACCF04-F864-4239-8BE9-ED6FB40335A5}"= Disabled:TCP:C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\TSHWMDTCP.exe:SPCM
      "{B20F75E6-6BFB-4DBA-B617-CB43214D6FFE}"= Disabled:C:\Program Files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
      "{D6AFAE1A-1E04-4756-A005-32BF671684B1}"= UDP:C:\Games\Unreal Tournament 3\Binaries\UT3.exe:Unreal Tournament 3
      "{85645E76-807A-42CF-8F29-92E2E372B6A6}"= TCP:C:\Games\Unreal Tournament 3\Binaries\UT3.exe:Unreal Tournament 3
      "{290A071E-AA96-4F92-8E57-1468269FC951}"= UDP:C:\Games\S.T.A.L.K.E.R\bin\XR_3DA.exe:S.T.A.L.K.E.R. (CLI)
      "{8E121631-EA0B-4727-B481-8F9812E24E72}"= TCP:C:\Games\S.T.A.L.K.E.R\bin\XR_3DA.exe:S.T.A.L.K.E.R. (CLI)
      "{E01ED21F-5185-4BE9-8BC7-BF974054547A}"= UDP:C:\Games\S.T.A.L.K.E.R\bin\dedicated\XR_3DA.exe:S.T.A.L.K.E.R. (SRV)
      "{09B819DD-E041-405C-9433-312ED4C05E25}"= TCP:C:\Games\S.T.A.L.K.E.R\bin\dedicated\XR_3DA.exe:S.T.A.L.K.E.R. (SRV)

      [HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile]
      "DoNotAllowExceptions"= 1 (0x1)

      [HKLM\~\services\sharedaccess\parameters\firewallpolicy\RestrictedServices\Static\System]
      "DFSR-1"= RPort=5722|UDP:%SystemRoot%\system32\svchost.exe|Svc=DFSR:Allow inbound TCP traffic|

      [HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile]
      "EnableFirewall"= 0 (0x0)

      R0 pe3ajtsb;Stalker (Pro) Environment Driver (pe3ajtsb);C:\Windows\system32\drivers\pe3ajtsb.sys [2007-03-05 15:58]
      R0 ps6ajtsb;Stalker (Pro) Synchronization Driver (ps6ajtsb);C:\Windows\system32\drivers\ps6ajtsb.sys [2007-03-05 15:57]
      R2 DQLWinService;DQLWinService;"C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe" [2007-02-12 12:46]
      R2 EPGService;EPGService;C:\PROGRA~1\WinTV\EPG Services\System\EPGService.exe [2007-09-05 17:46]
      R2 NMSCore;Intel(R) NMSCore;"C:\Program Files\Common Files\Intel\IntelDH\NMS\NMSCore\NMSCore.exe" [2007-06-27 11:14]
      R2 nmsunidr;UniDriver for NMS;C:\Windows\system32\DRIVERS\nmsunidr.sys [2007-02-18 21:34]
      R2 QualityManager;Intel(R) Quality Manager;"C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\qualitymanager.exe" [2007-06-27 11:17]
      R2 RapiMgr;Windows Mobile-based device connectivity;C:\Windows\system32\svchost.exe [2006-11-02 10:45]
      R2 sprtsvc_dellsupportcenter;SupportSoft Sprocket Service (dellsupportcenter);C:\Program Files\Dell Support Center\bin\sprtsvc.exe [2007-11-15 10:23]
      R2 WcesComm;Windows Mobile-2003-based device connectivity;C:\Windows\system32\svchost.exe [2006-11-02 10:45]
      R3 HCW88BDA;Hauppauge WinTV 88x DVB Tuner/Demod;C:\Windows\system32\drivers\hcw88bda.sys [2007-01-23 19:25]
      R3 hcw88rc5;Hauppauge WinTV 88x IR Decoder;C:\Windows\system32\Drivers\hcw88rc5.sys [2007-01-23 19:26]
      R3 HCW88TSE;Hauppauge WinTV 88x MPEG/TS Capture;C:\Windows\system32\drivers\hcw88tse.sys [2007-01-23 19:36]
      R3 hcw88vid;Hauppauge WinTV 88x Video;C:\Windows\system32\drivers\hcw88vid.sys [2007-01-23 19:36]
      R3 IntelDH;IntelDH Driver;C:\Windows\system32\Drivers\IntelDH.sys [2008-01-16 14:41]
      R3 pmxmouse;PMXMOUSE;C:\Windows\system32\DRIVERS\pmxmouse.sys [2007-06-01 14:41]
      R3 pmxusblf;PMXUSBLF;C:\Windows\system32\DRIVERS\pmxusblf.sys [2007-05-24 17:44]
      S2 pr2ajtsb;Stalker (Pro) Drivers Auto Removal (pr2ajtsb);C:\Windows\system32\pr2ajtsb.exe svc []
      S3 DHTRACE;Intel(R) DHTrace Controller;C:\Program Files\Common Files\Intel\IntelDH\bin\DHTraceController.exe [2007-06-27 11:15]
      S3 HauppaugeTVServer;HauppaugeTVServer;C:\PROGRA~1\WinTV\HCWTVS~1.EXE [2007-02-20 15:11]
      S3 R300;R300;C:\Windows\system32\DRIVERS\atikmdag.sys [2006-11-02 08:36]

      [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
      bthsvcs REG_MULTI_SZ BthServ
      WindowsMobile REG_MULTI_SZ wcescomm rapimgr
      LocalServiceRestricted REG_MULTI_SZ WcesComm RapiMgr

      [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{5fb81c2c-d978-11dc-9157-001d0924fd9a}]
      \shell\AutoRun\command - J:\autoplay.exe

      .
      Contenu du dossier 'Scheduled Tasks/Tƒches planifi‚es'
      "2008-01-16 13:44:15 C:\Windows\Tasks\McDefragTask.job"
      - c:\program files\mcafee\mqc\QcConsol.exe'
      "2008-03-01 00:00:02 C:\Windows\Tasks\McQcTask.job"
      - c:\program files\mcafee\mqc\QcConsol.exe
      .
      **************************************************************************

      catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
      Rootkit scan 2008-03-25 23:46:36
      Windows 6.0.6000 NTFS

      Balayage processus cach‚s ...

      Balayage cach‚ autostart entries ...

      Balayage des fichiers cach‚s ...

      Scan termin‚ avec succŠs
      Les fichiers cach‚s: 0

      **************************************************************************
      .
      --------------------- DLLs a charg‚ sous des processus courants ---------------------

      PROCESS: C:\Windows\system32\winlogon.exe
      -> C:\Windows\system32\hgggd.dll
      .
      ------------------------ Other Running Processes ------------------------
      .
      C:\Windows\system32\WUDFHost.exe
      C:\Program Files\Intel\IntelDH\CCU\AlertService.exe
      C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
      C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe
      C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
      c:\program files\common files\mcafee\mna\mcnasvc.exe
      C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
      C:\PROGRA~1\McAfee\MSC\mcpromgr.exe
      c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
      c:\PROGRA~1\COMMON~1\mcafee\redirsvc\redirsvc.exe
      C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
      C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
      C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
      C:\Program Files\McAfee\MPF\MPFSrv.exe
      C:\PROGRA~1\McAfee\MPS\mps.exe
      C:\Program Files\McAfee\MSK\MskSrver.exe
      C:\Windows\system32\PnkBstrA.exe
      C:\Windows\system32\PnkBstrB.exe
      C:\Program Files\McAfee\MPS\mpsevh.exe
      C:\Windows\system32\STacSV.exe
      C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\ISSM.exe
      C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\MCLServiceATL.exe
      C:\Windows\system32\WUDFHost.exe
      C:\PROGRA~1\McAfee\MSC\mcregist.exe
      C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\mediaserver.exe
      C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\Remote UI Service.exe
      C:\Windows\system32\conime.exe
      C:\Windows\System32\rundll32.exe
      C:\Windows\System32\rundll32.exe
      C:\Windows\WindowsMobile\wmdc.exe
      C:\Program Files\Windows Media Player\WMPSideShowGadget.exe
      C:\Windows\System32\Pmxmiced.exe
      C:\Program Files\Windows Mail\WindowsMailGadget.exe
      C:\Program Files\Windows Media Player\wmplayer.exe
      C:\Program Files\Windows Mail\WinMail.exe
      C:\Program Files\Intel\IntelDH\CCU\CCU_Engine.exe
      C:\Program Files\WinTV\EPG Services\System\EPGClient.exe
      C:\Program Files\Windows Media Player\WMPNSCFG.exe
      C:\Program Files\Windows Media Player\wmpnetwk.exe
      C:\Program Files\WinTV\Ir.exe
      C:\Games\Heroes3\Register\Remind32.exe
      c:\PROGRA~1\mcafee.com\agent\mcagent.exe
      C:\Program Files\Dell Support Center\gs_agent\dsc.exe
      .
      **************************************************************************
      .
      Temps d'accomplissement: 2008-03-25 23:49:40 - machine was rebooted
      ComboFix-quarantined-files.txt 2008-03-25 22:49:35
      .
      2008-02-27 02:09:03 --- E O F ---


      en gros j'ai plus le bug mais la j'ai des APPCRASH sur certain jeu et meme windows au demarage...
      il y a un example du APPCRASH sur Dungeon lords dans un autre discution que j'ai commancer...
      0
  11. green day Messages postés 26374 Date d'inscription   Statut Modérateur, Contributeur sécurité Dernière intervention   2 166
     
    Salut

    il reste encore des saletés !

    Télécharge SDFix sur ton bureau

    http://downloads.andymanchesta.com/RemovalTools/SDFix.exe

    Double clique sur SDFix.exe et choisis Install pour l'extraire dans un dossier dédié sur le Bureau.
    Redémarre ton ordinateur en mode sans échec
    Ouvre le dossier SDFix qui vient d'être créé sur le Bureau et double clique sur RunThis.cmd pour lancer le script.
    Appuie sur Y pour commencer le processus de nettoyage.
    Il va supprimer les services et les entrées du Registre de certains trojans trouvés puis te demandera d'appuyer sur une touche pour redémarrer.
    Appuie sur une touche pour redémarrer le PC.
    Ton système sera plus long pour redémarrer qu'à l'accoutumée car l'outil va continuer à s'exécuter et supprimer des fichiers.
    Après le chargement du Bureau, l'outil terminera son travail et affichera Finished.
    Appuie sur une touche pour finir l'exécution du script et charger les icônes de ton Bureau.
    Les icônes du Bureau affichées, le rapport SDFix s'ouvrira à l'écran et s'enregistrera aussi dans le dossier SDFix sous le nom Report.txt.
    Enfin, copie/colle le contenu du fichier Report.txt dans ta prochaine réponse sur le forum, avec un nouveau log Hijackthis !

    ++
    0
    1. yevgi Messages postés 78 Statut Membre 7
       
      dac
      mais au redemarage aprés l'operation est-ce qu'il faut que je le redemare encore en mode sans echec ou ce n'est plus obligatoire?
      0
  12. green day Messages postés 26374 Date d'inscription   Statut Modérateur, Contributeur sécurité Dernière intervention   2 166
     
    Salut

    après l'opération redémarre en mode normal et poste le rapport stp

    ++
    0
    1. yevgi Messages postés 78 Statut Membre 7
       
      voila le raport de SDfix:

      catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
      Rootkit scan 2008-04-07 22:20:17
      Windows 6.0.6000 NTFS

      scanning hidden processes ...

      scanning hidden services & system hive ...

      [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg]
      "s1"=dword:2df9c43f
      "s2"=dword:110480d0
      "h0"=dword:00000001

      [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04]
      "p0"="C:\Program Files\Alcohol Soft\Alcohol 52\"
      "h0"=dword:00000000
      "ujdew"=hex:a4,47,2e,4e,47,9e,83,cf,3a,98,1a,df,9d,89,40,b1,95,92,33,e2,f8,..
      [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04]
      "p0"="C:\Program Files\Alcohol Soft\Alcohol 52\"
      "h0"=dword:00000000
      "ujdew"=hex:a4,47,2e,4e,47,9e,83,cf,3a,98,1a,df,9d,89,40,b1,95,92,33,e2,f8,..

      scanning hidden registry entries ...

      scanning hidden files ...

      C:\ProgramData\Microsoft\Windows\GameExplorer\{3F8ADF37-A217-4A9E-9EE6-E99C9594CE83}\SupportTasks\0\Visiter le site officiel de Hellgate : London.lnk 612 bytes hidden from API

      scan completed successfully
      hidden processes: 0
      hidden services: 0
      hidden files: 1

      file zipped: C:\ProgramData\Microsoft\Windows\GameExplorer\{3F8ADF37-A217-4A9E-9EE6-E99C9594CE83}\SupportTasks\0\Visiter le site officiel de Hellgate : London.lnk -> catchme.zip -> London.lnk ( 612 bytes )


      est-ce que c'est normal qu'il parle de "catchme"?


      voila le raport de hijackthis:

      Logfile of Trend Micro HijackThis v2.0.2
      Scan saved at 22:27:14, on 07/04/2008
      Platform: Windows Vista (WinNT 6.00.1904)
      MSIE: Internet Explorer v7.00 (7.00.6000.16609)
      Boot mode: Normal

      Running processes:
      C:\Windows\system32\Dwm.exe
      C:\Windows\system32\taskeng.exe
      c:\PROGRA~1\mcafee.com\agent\mcagent.exe
      C:\Program Files\McAfee\MPS\mpsevh.exe
      C:\Program Files\Windows Defender\MSASCui.exe
      C:\Program Files\Sigmatel\C-Major Audio\WDM\sttray.exe
      C:\Windows\System32\rundll32.exe
      C:\Windows\System32\rundll32.exe
      C:\Windows\WindowsMobile\wmdc.exe
      C:\Program Files\Java\jre1.6.0\bin\jusched.exe
      c:\PROGRA~1\mcafee\VIRUSS~1\mcvsshld.exe
      C:\Windows\System32\ico.exe
      C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
      C:\Windows\System32\Pmxmiced.exe
      C:\Program Files\McAfee\MSK\mskagent.exe
      C:\Program Files\Common Files\Intel\IntelDH\NMS\Support\IntelHCTAgent.exe
      C:\PROGRA~1\McAfee\MSC\mcregist.exe
      C:\Program Files\Winamp\winampa.exe
      C:\Program Files\Windows Mail\WinMail.exe
      C:\Program Files\Dell Support Center\bin\sprtcmd.exe
      C:\Program Files\WinTV\Ir.exe
      C:\Windows\Explorer.exe
      C:\Windows\System32\mobsync.exe
      C:\Program Files\Windows Media Player\wmplayer.exe
      C:\Program Files\Windows Media Player\WMPSideShowGadget.exe
      C:\Program Files\Windows Mail\WindowsMailGadget.exe
      C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
      C:\Program Files\Windows Media Player\WMPNSCFG.exe

      R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
      R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
      O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
      O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - c:\Program Files\Java\jre1.6.0\bin\ssv.dll
      O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - c:\program files\mcafee\virusscan\scriptcl.dll
      O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
      O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
      O2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\Dell\BAE\BAE.dll
      O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
      O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
      O4 - HKLM\..\Run: [ECenter] C:\Dell\E-Center\EULALauncher.exe
      O4 - HKLM\..\Run: [SigmatelSysTrayApp] C:\Program Files\SigmaTel\C-Major Audio\WDM\sttray.exe
      O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
      O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
      O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
      O4 - HKLM\..\Run: [Windows Mobile Device Center] %windir%\WindowsMobile\wmdc.exe
      O4 - HKLM\..\Run: [SunJavaUpdateSched] "c:\Program Files\Java\jre1.6.0\bin\jusched.exe"
      O4 - HKLM\..\Run: [PMX Daemon] ICO.EXE
      O4 - HKLM\..\Run: [IAAnotif] "C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe"
      O4 - HKLM\..\Run: [MskAgentexe] C:\Program Files\McAfee\MSK\MskAgent.exe
      O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
      O4 - HKLM\..\Run: [MSServer] rundll32.exe C:\Windows\system32\tuvsq.dll,#1
      O4 - HKLM\..\Run: [NMSSupport] "C:\Program Files\Common Files\Intel\IntelDH\NMS\Support\IntelHCTAgent.exe" /startup
      O4 - HKLM\..\Run: [CCUTRAYICON] "C:\Program Files\Intel\IntelDH\CCU\CCU_TrayIcon.exe"
      O4 - HKLM\..\Run: [dscactivate] "C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe"
      O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
      O4 - HKLM\..\Run: [EPGServiceTool] C:\PROGRA~1\WinTV\EPG Services\System\EPGClient.exe
      O4 - HKCU\..\Run: [DellSupportCenter] "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCenter
      O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
      O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
      O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
      O4 - HKUS\S-1-5-21-31434581-3181455718-583861208-1000\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'IUSR_NMPR')
      O4 - Global Startup: AutoStart IR.lnk = C:\Program Files\WinTV\Ir.exe
      O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
      O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - c:\Program Files\Java\jre1.6.0\bin\ssv.dll
      O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - c:\Program Files\Java\jre1.6.0\bin\ssv.dll
      O9 - Extra button: @C:\Windows\WindowsMobile\INetRepl.dll,-222 - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
      O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
      O9 - Extra 'Tools' menuitem: @C:\Windows\WindowsMobile\INetRepl.dll,-223 - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
      O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
      O13 - Gopher Prefix:
      O17 - HKLM\System\CCS\Services\Tcpip\..\{7A02E051-227A-459C-932E-817F1D4AAB89}: NameServer = 192.168.1.1
      O23 - Service: Intel(R) Alert Service (AlertService) - Intel(R) Corporation - C:\Program Files\Intel\IntelDH\CCU\AlertService.exe
      O23 - Service: Intel(R) DHTrace Controller (DHTRACE) - Intel(R) Corporation - C:\Program Files\Common Files\Intel\IntelDH\bin\DHTraceController.exe
      O23 - Service: DQLWinService - Unknown owner - C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe
      O23 - Service: McAfee E-mail Proxy (Emproxy) - McAfee, Inc. - C:\PROGRA~1\COMMON~1\McAfee\EmProxy\emproxy.exe
      O23 - Service: EPGService - Hauppauge Computer Works - C:\PROGRA~1\WinTV\EPG Services\System\EPGService.exe
      O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
      O23 - Service: HauppaugeTVServer - Hauppauge Computer Works - C:\PROGRA~1\WinTV\HCWTVS~1.EXE
      O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
      O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
      O23 - Service: Intel(R) Software Services Manager (ISSM) - Intel(R) Corporation - C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\ISSM.exe
      O23 - Service: Intel(R) Viiv(TM) Media Server (M1 Server) - Unknown owner - C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\mediaserver.exe
      O23 - Service: McAfee HackerWatch Service - McAfee, Inc. - C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe
      O23 - Service: Intel(R) Application Tracker (MCLServiceATL) - Intel(R) Corporation - C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\MCLServiceATL.exe
      O23 - Service: McAfee Update Manager (mcmispupdmgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcupdmgr.exe
      O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
      O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\program files\common files\mcafee\mna\mcnasvc.exe
      O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
      O23 - Service: McAfee Protection Manager (mcpromgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcpromgr.exe
      O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
      O23 - Service: McAfee Redirector Service (McRedirector) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\redirsvc\redirsvc.exe
      O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
      O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
      O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
      O23 - Service: McAfee Privacy Service (MPS9) - McAfee, Inc. - C:\PROGRA~1\McAfee\MPS\mps.exe
      O23 - Service: McAfee SpamKiller Service (MSK80Service) - McAfee Inc. - C:\Program Files\McAfee\MSK\MskSrver.exe
      O23 - Service: Intel(R) NMSCore (NMSCore) - Intel(R) Corporation - C:\Program Files\Common Files\Intel\IntelDH\NMS\NMSCore\NMSCore.exe
      O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe
      O23 - Service: PnkBstrB - Unknown owner - C:\Windows\system32\PnkBstrB.exe
      O23 - Service: Intel(R) Quality Manager (QualityManager) - Intel(R) Corporation - C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\qualitymanager.exe
      O23 - Service: Intel(R) Remoting Service (Remote UI Service) - Intel(R) Corporation - C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\Remote UI Service.exe
      O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
      O23 - Service: SupportSoft Sprocket Service (dellsupportcenter) (sprtsvc_dellsupportcenter) - SupportSoft, Inc. - C:\Program Files\Dell Support Center\bin\sprtsvc.exe
      O23 - Service: SigmaTel Audio Service (STacSV) - SigmaTel, Inc. - C:\Windows\system32\STacSV.exe
      O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe
      0
  13. green day Messages postés 26374 Date d'inscription   Statut Modérateur, Contributeur sécurité Dernière intervention   2 166
     
    oui, normal

    où en sont tes soucis ??

    ++
    0
  14. yevgi Messages postés 78 Statut Membre 7
     
    bah en fait lu bug qui a tout commancer est disparu ^^
    mais... (y a toujours un mais ^^)
    pendant un court moment j'au eu un crash de Windows a chaque fois que j'allumer le pc.
    j'ai pris la signature du probleme:

    Nom d’événement de problème: APPCRASH
    Nom de l’application: Explorer.EXE
    Version de l’application: 6.0.6000.16386
    Horodatage de l'application: 4549b091
    Nom du module par défaut: hggge.dll
    Version du module par défaut: 0.0.0.0
    Horodateur du module par défaut: 475d72a4
    Code de l’exception: c0000005
    Décalage de l’exception: 000036b2
    Version du système: 6.0.6000.2.0.0.768.3
    Identificateur de paramètres régionaux: 1036
    Information supplémentaire n° 1: 8d13
    Information supplémentaire n° 2: cdca9b1d21d12b77d84f02df48e34311
    Information supplémentaire n° 3: 8d13
    Information supplémentaire n° 4: cdca9b1d21d12b77d84f02df48e34311

    en ce moment je l'ai plus avec windows mais il contiue de me le faire sur certain jeux (Dungeon lords (voir discution lancer avec la signature du probleme), assassins creed (j'ai la version en anglais)).
    sinon j'ai retrouvé un ancien probleme que j'ai pas vu depuis un moment
    tout le temps j'ai un message qui s'affiche.
    il s'agit de la fenetre rectanculaire ou il est ecrit :
    "aucune connexion a internet n'est disponible actuellement.
    pour afficher le contenu internet enregistré sur votre ordinateur, cliquer sur travailler hors connexion
    cliquer sur recommencer pour tenter de vous reconecter"

    et donc je clique sur "travailler hors connection " et je continue mon activité mais une heure aprés (a 5 min prés) cette fenetre revient et ainsi de suite...

    le truc c'est que sur le pc concerner j'ai pas internet alors je sai pas quoi faire pour l'arreter...snif

    merci bcp pour ton aide
    0
  15. green day Messages postés 26374 Date d'inscription   Statut Modérateur, Contributeur sécurité Dernière intervention   2 166
     
    Salut

    une petite vérif :

    télécharge ceci : http://www.commentcamarche.net/telecharger/telecharger 34055379 malwarebyte s anti malware
    * Installez le programme sur le bureau :
    o S'il manque le fichier COMCTL32.OCX, vous pourrez le télécharger ici
    * Faites les mises à jour (clic sur Mises à jour puis Recherche de mises à jour)
    * Démarrez en mode sans échec
    * Lancez le MalwareByte's Anti-Malware, cliquez sur Exécuter un examen complet puis Rechercher et sélectionnez tous tes disques durs
    * Une fois le scan terminé, cliquez sur supprimer (si un message demande à redémarrer le PC, acceptez !)
    * Un rapport sera généré, enregistrez le de manière à le retrouver

    ==> poste le stp !

    ++
    0
    1. yevgi Messages postés 78 Statut Membre 7
       
      que veut tu dire par les mise a jours?
      l'ordinateur concerné n'a pas de connexion internet alor pour les faire ca serrai assez difficile...
      0
  16. green day Messages postés 26374 Date d'inscription   Statut Modérateur, Contributeur sécurité Dernière intervention   2 166
     
    Salut

    sur l'ordi où tu le télécharge, suffit de faire la mise à jour

    ++
    0
  17. yevgi Messages postés 78 Statut Membre 7
     
    voila le rapport :

    Malwarebytes' Anti-Malware 1.12
    Version de la base de données: 729

    Type de recherche: Examen complet (C:\|D:\|)
    Eléments examinés: 195023
    Temps écoulé: 41 minute(s), 14 second(s)

    Processus mémoire infecté(s): 0
    Module(s) mémoire infecté(s): 0
    Clé(s) du Registre infectée(s): 7
    Valeur(s) du Registre infectée(s): 6
    Elément(s) de données du Registre infecté(s): 0
    Dossier(s) infecté(s): 0
    Fichier(s) infecté(s): 104

    Processus mémoire infecté(s):
    (Aucun élément nuisible détecté)

    Module(s) mémoire infecté(s):
    (Aucun élément nuisible détecté)

    Clé(s) du Registre infectée(s):
    HKEY_CLASSES_ROOT\CLSID\{89a1e40d-0254-4f99-b9ae-b60a2d8754a9} (Trojan.Vundo) -> No action taken.
    HKEY_CURRENT_USER\Software\Microsoft\affri (Malware.Trace) -> No action taken.
    HKEY_CURRENT_USER\Software\Microsoft\affltid (Malware.Trace) -> No action taken.
    HKEY_CURRENT_USER\Software\Microsoft\rdfa (Trojan.Vundo) -> No action taken.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\affltid (Malware.Trace) -> No action taken.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\affri (Malware.Trace) -> No action taken.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Juan (Malware.Trace) -> No action taken.

    Valeur(s) du Registre infectée(s):
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MSServer (Trojan.Vundo) -> No action taken.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cmds (Trojan.Vundo) -> No action taken.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\badb843f (Trojan.Vundo) -> No action taken.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MSServer (Trojan.Vundo) -> No action taken.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{89a1e40d-0254-4f99-b9ae-b60a2d8754a9} (Trojan.Vundo) -> No action taken.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\BMb9e8b7a3 (Trojan.Agent) -> No action taken.

    Elément(s) de données du Registre infecté(s):
    (Aucun élément nuisible détecté)

    Dossier(s) infecté(s):
    (Aucun élément nuisible détecté)

    Fichier(s) infecté(s):
    C:\Users\Yevgi\AppData\Local\Temp\sstqo.dll (Trojan.Vundo) -> No action taken.
    C:\Users\Yevgi\AppData\Local\Temp\jkkli.dll (Trojan.Vundo) -> No action taken.
    C:\Users\Yevgi\AppData\Local\Temp\ojjooowl.dll (Trojan.Vundo) -> No action taken.
    C:\Windows\System32\mljih.dll (Trojan.Vundo) -> No action taken.
    C:\Users\Yevgi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6KIGWFXK\css4[1] (Trojan.Vundo) -> No action taken.
    C:\Users\Yevgi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\NUYQRQY2\kriv[1] (Trojan.Vundo) -> No action taken.
    C:\Users\Yevgi\AppData\Local\Temp\byvsq.dll (Trojan.Vundo) -> No action taken.
    C:\Users\Yevgi\AppData\Local\Temp\byxvt.dll (Trojan.Vundo) -> No action taken.
    C:\Users\Yevgi\AppData\Local\Temp\byxxu.dll (Trojan.Vundo) -> No action taken.
    C:\Users\Yevgi\AppData\Local\Temp\byxxx.dll (Trojan.Vundo) -> No action taken.
    C:\Users\Yevgi\AppData\Local\Temp\ddabb.dll (Trojan.Vundo) -> No action taken.
    C:\Users\Yevgi\AppData\Local\Temp\ddccd.dll (Trojan.Vundo) -> No action taken.
    C:\Users\Yevgi\AppData\Local\Temp\efebb.dll (Trojan.Vundo) -> No action taken.
    C:\Users\Yevgi\AppData\Local\Temp\efeca.dll (Trojan.Vundo) -> No action taken.
    C:\Users\Yevgi\AppData\Local\Temp\fccdd.dll (Trojan.Vundo) -> No action taken.
    C:\Users\Yevgi\AppData\Local\Temp\fcyvw.dll (Trojan.Vundo) -> No action taken.
    C:\Users\Yevgi\AppData\Local\Temp\fcywu.dll (Trojan.Vundo) -> No action taken.
    C:\Users\Yevgi\AppData\Local\Temp\gebaw.dll (Trojan.Vundo) -> No action taken.
    C:\Users\Yevgi\AppData\Local\Temp\geeed.dll (Trojan.Vundo) -> No action taken.
    C:\Users\Yevgi\AppData\Local\Temp\jkhfg.dll (Trojan.Vundo) -> No action taken.
    C:\Users\Yevgi\AppData\Local\Temp\jkhhf.dll (Trojan.Vundo) -> No action taken.
    C:\Users\Yevgi\AppData\Local\Temp\khhec.dll (Trojan.Vundo) -> No action taken.
    C:\Users\Yevgi\AppData\Local\Temp\ljhgf.dll (Trojan.Vundo) -> No action taken.
    C:\Users\Yevgi\AppData\Local\Temp\ljjge.dll (Trojan.Vundo) -> No action taken.
    C:\Users\Yevgi\AppData\Local\Temp\mljge.dll (Trojan.Vundo) -> No action taken.
    C:\Users\Yevgi\AppData\Local\Temp\mllii.dll (Trojan.Vundo) -> No action taken.
    C:\Users\Yevgi\AppData\Local\Temp\opnmn.dll (Trojan.Vundo) -> No action taken.
    C:\Users\Yevgi\AppData\Local\Temp\opnoo.dll (Trojan.Vundo) -> No action taken.
    C:\Users\Yevgi\AppData\Local\Temp\pmkii.dll (Trojan.Vundo) -> No action taken.
    C:\Users\Yevgi\AppData\Local\Temp\pmkjh.dll (Trojan.Vundo) -> No action taken.
    C:\Users\Yevgi\AppData\Local\Temp\pmnlk.dll (Trojan.Vundo) -> No action taken.
    C:\Users\Yevgi\AppData\Local\Temp\qomjj.dll (Trojan.Vundo) -> No action taken.
    C:\Users\Yevgi\AppData\Local\Temp\qomkl.dll (Trojan.Vundo) -> No action taken.
    C:\Users\Yevgi\AppData\Local\Temp\rqoml.dll (Trojan.Vundo) -> No action taken.
    C:\Users\Yevgi\AppData\Local\Temp\rqrss.dll (Trojan.Vundo) -> No action taken.
    C:\Users\Yevgi\AppData\Local\Temp\sstts.dll (Trojan.Vundo) -> No action taken.
    C:\Users\Yevgi\AppData\Local\Temp\tmp00006076 (Trojan.Vundo) -> No action taken.
    C:\Users\Yevgi\AppData\Local\Temp\tmp0000624a (Trojan.Vundo) -> No action taken.
    C:\Users\Yevgi\AppData\Local\Temp\tmp000063f0 (Trojan.Vundo) -> No action taken.
    C:\Users\Yevgi\AppData\Local\Temp\tmp00006805 (Trojan.Vundo) -> No action taken.
    C:\Users\Yevgi\AppData\Local\Temp\tmp00006853 (Trojan.Vundo) -> No action taken.
    C:\Users\Yevgi\AppData\Local\Temp\tmp0000695c (Trojan.Vundo) -> No action taken.
    C:\Users\Yevgi\AppData\Local\Temp\tmp000069aa (Trojan.Vundo) -> No action taken.
    C:\Users\Yevgi\AppData\Local\Temp\tmp00006a65 (Trojan.Vundo) -> No action taken.
    C:\Users\Yevgi\AppData\Local\Temp\tmp00006ae2 (Trojan.Vundo) -> No action taken.
    C:\Users\Yevgi\AppData\Local\Temp\tmp00006b40 (Trojan.Vundo) -> No action taken.
    C:\Users\Yevgi\AppData\Local\Temp\tmp00006c97 (Trojan.Vundo) -> No action taken.
    C:\Users\Yevgi\AppData\Local\Temp\tmp00006d71 (Trojan.Vundo) -> No action taken.
    C:\Users\Yevgi\AppData\Local\Temp\tmp00006db0 (Trojan.Vundo) -> No action taken.
    C:\Users\Yevgi\AppData\Local\Temp\tmp00006ee8 (Trojan.Vundo) -> No action taken.
    C:\Users\Yevgi\AppData\Local\Temp\tmp00006ef7 (Trojan.Vundo) -> No action taken.
    C:\Users\Yevgi\AppData\Local\Temp\tmp00006f26 (Trojan.Vundo) -> No action taken.
    C:\Users\Yevgi\AppData\Local\Temp\tmp00007010 (Trojan.Vundo) -> No action taken.
    C:\Users\Yevgi\AppData\Local\Temp\tmp000070fa (Trojan.Vundo) -> No action taken.
    C:\Users\Yevgi\AppData\Local\Temp\tmp000072fd (Trojan.Vundo) -> No action taken.
    C:\Users\Yevgi\AppData\Local\Temp\tmp000073e7 (Trojan.Vundo) -> No action taken.
    C:\Users\Yevgi\AppData\Local\Temp\tmp00007464 (Trojan.Vundo) -> No action taken.
    C:\Users\Yevgi\AppData\Local\Temp\tmp00007483 (Trojan.Vundo) -> No action taken.
    C:\Users\Yevgi\AppData\Local\Temp\tmp0000753e (Trojan.Vundo) -> No action taken.
    C:\Users\Yevgi\AppData\Local\Temp\tmp00007722 (Trojan.Vundo) -> No action taken.
    C:\Users\Yevgi\AppData\Local\Temp\tmp0000782b (Trojan.Vundo) -> No action taken.
    C:\Users\Yevgi\AppData\Local\Temp\tmp00007c40 (Trojan.Vundo) -> No action taken.
    C:\Users\Yevgi\AppData\Local\Temp\tmp00007c7f (Trojan.Vundo) -> No action taken.
    C:\Users\Yevgi\AppData\Local\Temp\tmp00007d69 (Trojan.Vundo) -> No action taken.
    C:\Users\Yevgi\AppData\Local\Temp\tmp00007e72 (Trojan.Vundo) -> No action taken.
    C:\Users\Yevgi\AppData\Local\Temp\tmp00007e81 (Trojan.Vundo) -> No action taken.
    C:\Users\Yevgi\AppData\Local\Temp\tmp00007f0e (Trojan.Vundo) -> No action taken.
    C:\Users\Yevgi\AppData\Local\Temp\tmp00007f7b (Trojan.Vundo) -> No action taken.
    C:\Users\Yevgi\AppData\Local\Temp\tmp00008084 (Trojan.Vundo) -> No action taken.
    C:\Users\Yevgi\AppData\Local\Temp\tmp0000819d (Trojan.Vundo) -> No action taken.
    C:\Users\Yevgi\AppData\Local\Temp\tmp000081cc (Trojan.Vundo) -> No action taken.
    C:\Users\Yevgi\AppData\Local\Temp\tmp0000821a (Trojan.Vundo) -> No action taken.
    C:\Users\Yevgi\AppData\Local\Temp\tmp00008304 (Trojan.Vundo) -> No action taken.
    C:\Users\Yevgi\AppData\Local\Temp\tmp00008361 (Trojan.Vundo) -> No action taken.
    C:\Users\Yevgi\AppData\Local\Temp\tmp00008600 (Trojan.Vundo) -> No action taken.
    C:\Users\Yevgi\AppData\Local\Temp\tmp00008729 (Trojan.Vundo) -> No action taken.
    C:\Users\Yevgi\AppData\Local\Temp\tmp00008748 (Trojan.Vundo) -> No action taken.
    C:\Users\Yevgi\AppData\Local\Temp\tmp000088dd (Trojan.Vundo) -> No action taken.
    C:\Users\Yevgi\AppData\Local\Temp\tmp000089c7 (Trojan.Vundo) -> No action taken.
    C:\Users\Yevgi\AppData\Local\Temp\tmp00008a15 (Trojan.Vundo) -> No action taken.
    C:\Users\Yevgi\AppData\Local\Temp\tmp00008a35 (Trojan.Vundo) -> No action taken.
    C:\Users\Yevgi\AppData\Local\Temp\tmp00008c18 (Trojan.Vundo) -> No action taken.
    C:\Users\Yevgi\AppData\Local\Temp\tmp00008d50 (Trojan.Vundo) -> No action taken.
    C:\Users\Yevgi\AppData\Local\Temp\tmp00008dbd (Trojan.Vundo) -> No action taken.
    C:\Users\Yevgi\AppData\Local\Temp\tmp000094a0 (Trojan.Vundo) -> No action taken.
    C:\Users\Yevgi\AppData\Local\Temp\tmp0000951d (Trojan.Vundo) -> No action taken.
    C:\Users\Yevgi\AppData\Local\Temp\tmp0000952d (Trojan.Vundo) -> No action taken.
    C:\Users\Yevgi\AppData\Local\Temp\tmp00009cbb (Trojan.Vundo) -> No action taken.
    C:\Users\Yevgi\AppData\Local\Temp\tmp0000a39e (Trojan.Vundo) -> No action taken.
    C:\Users\Yevgi\AppData\Local\Temp\tmp0000a67b (Trojan.Vundo) -> No action taken.
    C:\Users\Yevgi\AppData\Local\Temp\tmp0000d7f6 (Trojan.Vundo) -> No action taken.
    C:\Users\Yevgi\AppData\Local\Temp\tmp00011dbc (Trojan.Vundo) -> No action taken.
    C:\Users\Yevgi\AppData\Local\Temp\urqnl.dll (Trojan.Vundo) -> No action taken.
    C:\Users\Yevgi\AppData\Local\Temp\wvuro.dll (Trojan.Vundo) -> No action taken.
    C:\Users\Yevgi\AppData\Local\Temp\wvuut.dll (Trojan.Vundo) -> No action taken.
    C:\Users\Yevgi\AppData\Local\Temp\wvwvt.dll (Trojan.Vundo) -> No action taken.
    C:\Users\Yevgi\AppData\Local\Temp\xxwvt.dll (Trojan.Vundo) -> No action taken.
    C:\Users\Yevgi\AppData\Local\Temp\xxyvv.dll (Trojan.Vundo) -> No action taken.
    C:\Users\Yevgi\AppData\Local\Temp\yayya.dll (Trojan.Vundo) -> No action taken.
    C:\Windows\System32\cbxus.dll (Trojan.Vundo) -> No action taken.
    C:\Windows\System32\cbxut.dll (Trojan.Vundo) -> No action taken.
    C:\Windows\System32\ddcyw.dll (Trojan.Vundo) -> No action taken.
    C:\Windows\System32\wvutu.dll (Trojan.Vundo) -> No action taken.
    C:\Users\Yevgi\AppData\Local\Temp\pguxuopq.dll (Trojan.Agent) -> No action taken.

    je les ai tous mis en quarantaine...
    0
  18. green day Messages postés 26374 Date d'inscription   Statut Modérateur, Contributeur sécurité Dernière intervention   2 166
     
    Salut

    No action taken.

    refais le et supprime tout ce qu'il te trouve !

    ++
    0
  19. yevgi Messages postés 78 Statut Membre 7
     
    dac
    est-ce qu'il faudrai que je poste un autre rapport apres?
    0
  20. green day Messages postés 26374 Date d'inscription   Statut Modérateur, Contributeur sécurité Dernière intervention   2 166
     
    oui !
    0
  21. yevgi Messages postés 78 Statut Membre 7
     
    Malwarebytes' Anti-Malware 1.12
    Version de la base de données: 729

    Type de recherche: Examen complet (C:\|D:\|)
    Eléments examinés: 195023
    Temps écoulé: 41 minute(s), 14 second(s)

    Processus mémoire infecté(s): 0
    Module(s) mémoire infecté(s): 0
    Clé(s) du Registre infectée(s): 7
    Valeur(s) du Registre infectée(s): 6
    Elément(s) de données du Registre infecté(s): 0
    Dossier(s) infecté(s): 0
    Fichier(s) infecté(s): 104

    Processus mémoire infecté(s):
    (Aucun élément nuisible détecté)

    Module(s) mémoire infecté(s):
    (Aucun élément nuisible détecté)

    Clé(s) du Registre infectée(s):
    HKEY_CLASSES_ROOT\CLSID\{89a1e40d-0254-4f99-b9ae-b60a2d8754a9} (Trojan.Vundo) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\Software\Microsoft\affri (Malware.Trace) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\Software\Microsoft\affltid (Malware.Trace) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\Software\Microsoft\rdfa (Trojan.Vundo) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\affltid (Malware.Trace) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\affri (Malware.Trace) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Juan (Malware.Trace) -> Quarantined and deleted successfully.

    Valeur(s) du Registre infectée(s):
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MSServer (Trojan.Vundo) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cmds (Trojan.Vundo) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\badb843f (Trojan.Vundo) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MSServer (Trojan.Vundo) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{89a1e40d-0254-4f99-b9ae-b60a2d8754a9} (Trojan.Vundo) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\BMb9e8b7a3 (Trojan.Agent) -> Quarantined and deleted successfully.

    Elément(s) de données du Registre infecté(s):
    (Aucun élément nuisible détecté)

    Dossier(s) infecté(s):
    (Aucun élément nuisible détecté)

    Fichier(s) infecté(s):
    C:\Users\Yevgi\AppData\Local\Temp\sstqo.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\Users\Yevgi\AppData\Local\Temp\jkkli.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\Users\Yevgi\AppData\Local\Temp\ojjooowl.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\Windows\System32\mljih.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\Users\Yevgi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6KIGWFXK\css4[1] (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\Users\Yevgi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\NUYQRQY2\kriv[1] (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\Users\Yevgi\AppData\Local\Temp\byvsq.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\Users\Yevgi\AppData\Local\Temp\byxvt.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\Users\Yevgi\AppData\Local\Temp\byxxu.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\Users\Yevgi\AppData\Local\Temp\byxxx.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\Users\Yevgi\AppData\Local\Temp\ddabb.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\Users\Yevgi\AppData\Local\Temp\ddccd.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\Users\Yevgi\AppData\Local\Temp\efebb.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\Users\Yevgi\AppData\Local\Temp\efeca.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\Users\Yevgi\AppData\Local\Temp\fccdd.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\Users\Yevgi\AppData\Local\Temp\fcyvw.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\Users\Yevgi\AppData\Local\Temp\fcywu.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\Users\Yevgi\AppData\Local\Temp\gebaw.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\Users\Yevgi\AppData\Local\Temp\geeed.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\Users\Yevgi\AppData\Local\Temp\jkhfg.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\Users\Yevgi\AppData\Local\Temp\jkhhf.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\Users\Yevgi\AppData\Local\Temp\khhec.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\Users\Yevgi\AppData\Local\Temp\ljhgf.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\Users\Yevgi\AppData\Local\Temp\ljjge.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\Users\Yevgi\AppData\Local\Temp\mljge.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\Users\Yevgi\AppData\Local\Temp\mllii.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\Users\Yevgi\AppData\Local\Temp\opnmn.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\Users\Yevgi\AppData\Local\Temp\opnoo.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\Users\Yevgi\AppData\Local\Temp\pmkii.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\Users\Yevgi\AppData\Local\Temp\pmkjh.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\Users\Yevgi\AppData\Local\Temp\pmnlk.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\Users\Yevgi\AppData\Local\Temp\qomjj.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\Users\Yevgi\AppData\Local\Temp\qomkl.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\Users\Yevgi\AppData\Local\Temp\rqoml.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\Users\Yevgi\AppData\Local\Temp\rqrss.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\Users\Yevgi\AppData\Local\Temp\sstts.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\Users\Yevgi\AppData\Local\Temp\tmp00006076 (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\Users\Yevgi\AppData\Local\Temp\tmp0000624a (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\Users\Yevgi\AppData\Local\Temp\tmp000063f0 (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\Users\Yevgi\AppData\Local\Temp\tmp00006805 (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\Users\Yevgi\AppData\Local\Temp\tmp00006853 (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\Users\Yevgi\AppData\Local\Temp\tmp0000695c (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\Users\Yevgi\AppData\Local\Temp\tmp000069aa (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\Users\Yevgi\AppData\Local\Temp\tmp00006a65 (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\Users\Yevgi\AppData\Local\Temp\tmp00006ae2 (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\Users\Yevgi\AppData\Local\Temp\tmp00006b40 (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\Users\Yevgi\AppData\Local\Temp\tmp00006c97 (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\Users\Yevgi\AppData\Local\Temp\tmp00006d71 (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\Users\Yevgi\AppData\Local\Temp\tmp00006db0 (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\Users\Yevgi\AppData\Local\Temp\tmp00006ee8 (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\Users\Yevgi\AppData\Local\Temp\tmp00006ef7 (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\Users\Yevgi\AppData\Local\Temp\tmp00006f26 (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\Users\Yevgi\AppData\Local\Temp\tmp00007010 (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\Users\Yevgi\AppData\Local\Temp\tmp000070fa (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\Users\Yevgi\AppData\Local\Temp\tmp000072fd (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\Users\Yevgi\AppData\Local\Temp\tmp000073e7 (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\Users\Yevgi\AppData\Local\Temp\tmp00007464 (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\Users\Yevgi\AppData\Local\Temp\tmp00007483 (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\Users\Yevgi\AppData\Local\Temp\tmp0000753e (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\Users\Yevgi\AppData\Local\Temp\tmp00007722 (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\Users\Yevgi\AppData\Local\Temp\tmp0000782b (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\Users\Yevgi\AppData\Local\Temp\tmp00007c40 (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\Users\Yevgi\AppData\Local\Temp\tmp00007c7f (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\Users\Yevgi\AppData\Local\Temp\tmp00007d69 (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\Users\Yevgi\AppData\Local\Temp\tmp00007e72 (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\Users\Yevgi\AppData\Local\Temp\tmp00007e81 (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\Users\Yevgi\AppData\Local\Temp\tmp00007f0e (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\Users\Yevgi\AppData\Local\Temp\tmp00007f7b (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\Users\Yevgi\AppData\Local\Temp\tmp00008084 (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\Users\Yevgi\AppData\Local\Temp\tmp0000819d (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\Users\Yevgi\AppData\Local\Temp\tmp000081cc (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\Users\Yevgi\AppData\Local\Temp\tmp0000821a (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\Users\Yevgi\AppData\Local\Temp\tmp00008304 (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\Users\Yevgi\AppData\Local\Temp\tmp00008361 (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\Users\Yevgi\AppData\Local\Temp\tmp00008600 (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\Users\Yevgi\AppData\Local\Temp\tmp00008729 (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\Users\Yevgi\AppData\Local\Temp\tmp00008748 (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\Users\Yevgi\AppData\Local\Temp\tmp000088dd (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\Users\Yevgi\AppData\Local\Temp\tmp000089c7 (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\Users\Yevgi\AppData\Local\Temp\tmp00008a15 (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\Users\Yevgi\AppData\Local\Temp\tmp00008a35 (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\Users\Yevgi\AppData\Local\Temp\tmp00008c18 (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\Users\Yevgi\AppData\Local\Temp\tmp00008d50 (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\Users\Yevgi\AppData\Local\Temp\tmp00008dbd (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\Users\Yevgi\AppData\Local\Temp\tmp000094a0 (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\Users\Yevgi\AppData\Local\Temp\tmp0000951d (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\Users\Yevgi\AppData\Local\Temp\tmp0000952d (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\Users\Yevgi\AppData\Local\Temp\tmp00009cbb (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\Users\Yevgi\AppData\Local\Temp\tmp0000a39e (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\Users\Yevgi\AppData\Local\Temp\tmp0000a67b (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\Users\Yevgi\AppData\Local\Temp\tmp0000d7f6 (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\Users\Yevgi\AppData\Local\Temp\tmp00011dbc (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\Users\Yevgi\AppData\Local\Temp\urqnl.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\Users\Yevgi\AppData\Local\Temp\wvuro.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\Users\Yevgi\AppData\Local\Temp\wvuut.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\Users\Yevgi\AppData\Local\Temp\wvwvt.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\Users\Yevgi\AppData\Local\Temp\xxwvt.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\Users\Yevgi\AppData\Local\Temp\xxyvv.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\Users\Yevgi\AppData\Local\Temp\yayya.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\Windows\System32\cbxus.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\Windows\System32\cbxut.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\Windows\System32\ddcyw.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\Windows\System32\wvutu.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\Users\Yevgi\AppData\Local\Temp\pguxuopq.dll (Trojan.Agent) -> Quarantined and deleted successfully.
    0
  • 1
  • 2