Dyrhuboa.dll

yevgi -  
Bonjour,
j'ai un probleme avec mon vista depuis quelques jours,
a chaque fois que je demare mon PC a l'entrée a Windows j'ai le message suivant qui s'affiche:
"erreur dans c:\users\yevgi\appdata\local\temp\dyrhuboa.dll
entrée manquente : run"
ceci a pour effet que a chaque ouverture d'une fenetre quelconque (poste de travail,raccourci a des fichier divers...)
windows quitte la fenetre et il y a une sorte d'actualisation d'explorer qui des fois m'oblige a aller dans le gestionnaire des taches de windows et lancer explorer.exe en tant que nouvelle application.
que faire afin de resoudre cce probleme?s'agit-il d'un virus?
merci d'avance

--
tout les animaux sont egaux,mais certain sont plus egaux que d'autre

25 réponses

Résumé de la discussion

Des symptômes récurrents indiquent un problème de démarrage sous Windows Vista lié à une DLL manquante dans le répertoire temporaire, provoquant la fermeture des fenêtres et l'actualisation d'Explorateur. Des premiers éléments de réponse pointent vers une infection par un cheval de Troie, notamment Trojan.Vundo, et la liste des chemins et clés modifiés figurant dans les rapports d'analyse. Pour remédier, des outils de sécurité ont été recommandés, notamment Malwarebytes Anti-Malware et HijackThis, avec suppression/quarantaine des éléments malveillants, suppression des entrées Run malveillantes et nettoyage des fichiers temporaires. D'autres détails techniques apparaissent dans les rapports, comme les fichiers DLL et les clés de registre touchées, et montrent l'ampleur des éléments d'infection à traiter.

Bobot (l’IA à votre service)
  1. green day Modérateur
    Salut

    cette dll a tous les aspects pour un trojan voir in rootkit !

    Télécharge ceci :

    Lien : http://www.commentcamarche.net/telecharger/telecharger 159 hijackthis

    Démo : http://pageperso.aol.fr/balltrap34/demohijack.htm

    Choisir l'option "do a scan and a logfile", et faire un copier/coller du rapport ainsi générer sur le forum.

    ++

    PS : je demande aux modos de déplacer ton message dans le forum virus/sécu !

    1. yevgi Auteur
      merci pour la reponse rapide
      je vais esseyer.
      1. yevgi Auteur
        salut,
        j'ai installé le programme et j'ai pu m'en debarasser mais le probleme perciste...
        a chaque fois que j'ouvre un fichier explorer fait une sorte d'actualisation...
        c'est lourd!
        si quelqu'un a d'autres idées...
    6. yevgi Auteur
      dac merci
      alor voila le rapport:

      Logfile of Trend Micro HijackThis v2.0.2
      Scan saved at 22:19:35, on 16/03/2008
      Platform: Windows Vista (WinNT 6.00.1904)
      MSIE: Internet Explorer v7.00 (7.00.6000.16609)
      Boot mode: Normal

      Running processes:
      C:\Windows\system32\Dwm.exe
      C:\Program Files\Windows Defender\MSASCui.exe
      C:\Program Files\Sigmatel\C-Major Audio\WDM\sttray.exe
      C:\Windows\System32\rundll32.exe
      C:\Windows\System32\rundll32.exe
      C:\Windows\WindowsMobile\wmdc.exe
      C:\Program Files\Java\jre1.6.0\bin\jusched.exe
      C:\Windows\System32\ico.exe
      C:\Windows\System32\Pmxmiced.exe
      C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
      C:\Program Files\McAfee\MSK\mskagent.exe
      C:\Program Files\Common Files\Intel\IntelDH\NMS\Support\IntelHCTAgent.exe
      C:\Program Files\Intel\IntelDH\CCU\CCU_TrayIcon.exe
      C:\Program Files\Winamp\winampa.exe
      C:\Program Files\WinTV\EPG Services\System\EPGClient.exe
      C:\Program Files\Dell Support Center\bin\sprtcmd.exe
      C:\Program Files\Intel\IntelDH\CCU\CCU_Engine.exe
      C:\Program Files\Windows Media Player\wmpnscfg.exe
      C:\Windows\System32\rundll32.exe
      C:\Program Files\Windows Mail\WinMail.exe
      C:\Windows\System32\rundll32.exe
      C:\Program Files\WinTV\Ir.exe
      C:\Games\Heroes3\Register\Remind32.exe
      C:\Games\Heroes3\RegisterSOD\Remind32.exe
      c:\PROGRA~1\mcafee.com\agent\mcagent.exe
      C:\Program Files\McAfee\MPS\mpsevh.exe
      C:\Program Files\Windows Media Player\wmplayer.exe
      C:\Windows\system32\taskeng.exe
      C:\Program Files\Windows Media Player\WMPSideShowGadget.exe
      C:\Program Files\Windows Mail\WindowsMailGadget.exe
      c:\program files\mcafee\msc\mcuimgr.exe
      C:\Program Files\WinRAR\WinRAR.exe
      C:\Windows\explorer.exe
      C:\Program Files\Alcohol Soft\Alcohol 52\Alcohol.exe
      J:\setup.exe
      C:\Users\Yevgi\AppData\Local\Temp\is-GOJ38.tmp\is-839QO.tmp
      C:\Program Files\Winamp\winamp.exe
      C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
      R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.google.fr
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
      R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
      R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
      R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
      O1 - Hosts: ::1 localhost
      O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
      O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - c:\Program Files\Java\jre1.6.0\bin\ssv.dll
      O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - c:\program files\mcafee\virusscan\scriptcl.dll
      O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
      O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
      O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
      O2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\Dell\BAE\BAE.dll
      O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
      O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
      O4 - HKLM\..\Run: [ECenter] C:\Dell\E-Center\EULALauncher.exe
      O4 - HKLM\..\Run: [SigmatelSysTrayApp] C:\Program Files\SigmaTel\C-Major Audio\WDM\sttray.exe
      O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
      O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
      O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
      O4 - HKLM\..\Run: [Windows Mobile Device Center] %windir%\WindowsMobile\wmdc.exe
      O4 - HKLM\..\Run: [SunJavaUpdateSched] "c:\Program Files\Java\jre1.6.0\bin\jusched.exe"
      O4 - HKLM\..\Run: [PMX Daemon] ICO.EXE
      O4 - HKLM\..\Run: [IAAnotif] "C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe"
      O4 - HKLM\..\Run: [MskAgentexe] C:\Program Files\McAfee\MSK\MskAgent.exe
      O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
      O4 - HKLM\..\Run: [NMSSupport] "C:\Program Files\Common Files\Intel\IntelDH\NMS\Support\IntelHCTAgent.exe" /startup
      O4 - HKLM\..\Run: [CCUTRAYICON] "C:\Program Files\Intel\IntelDH\CCU\CCU_TrayIcon.exe"
      O4 - HKLM\..\Run: [dscactivate] "C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe"
      O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
      O4 - HKLM\..\Run: [MSServer] rundll32.exe C:\Windows\system32\ljhgh.dll,#1
      O4 - HKLM\..\Run: [EPGServiceTool] C:\PROGRA~1\WinTV\EPG Services\System\EPGClient.exe
      O4 - HKCU\..\Run: [DellSupportCenter] "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCenter
      O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
      O4 - HKCU\..\Run: [badb843f] rundll32.exe "C:\Users\Yevgi\AppData\Local\Temp\wpwiqkwx.dll",b
      O4 - HKCU\..\Run: [MSServer] rundll32.exe C:\Users\Yevgi\AppData\Local\Temp\efcbb.dll,#1
      O4 - HKCU\..\Run: [cmds] rundll32.exe C:\Users\Yevgi\AppData\Local\Temp\awvuv.dll,c
      O4 - HKCU\..\Run: [BMb9e8b7a3] Rundll32.exe "C:\Users\Yevgi\AppData\Local\Temp\yitpoyxe.dll",s
      O4 - HKCU\..\Run: [MS Juan] rundll32 "C:\Users\Yevgi\AppData\Local\Temp\dyrhuboa.dll",run
      O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
      O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
      O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
      O4 - HKUS\S-1-5-21-31434581-3181455718-583861208-1000\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'IUSR_NMPR')
      O4 - Startup: 3DO Registration.lnk = C:\Games\Heroes3\Register\Remind32.exe
      O4 - Startup: H3 The Shadow of Death(TM).lnk = C:\Games\Heroes3\RegisterSOD\Remind32.exe
      O4 - Global Startup: AutoStart IR.lnk = C:\Program Files\WinTV\Ir.exe
      O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
      O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - c:\Program Files\Java\jre1.6.0\bin\ssv.dll
      O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - c:\Program Files\Java\jre1.6.0\bin\ssv.dll
      O9 - Extra button: @C:\Windows\WindowsMobile\INetRepl.dll,-222 - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
      O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
      O9 - Extra 'Tools' menuitem: @C:\Windows\WindowsMobile\INetRepl.dll,-223 - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
      O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
      O13 - Gopher Prefix:
      O17 - HKLM\System\CCS\Services\Tcpip\..\{7A02E051-227A-459C-932E-817F1D4AAB89}: NameServer = 192.168.1.1
      O23 - Service: Intel(R) Alert Service (AlertService) - Intel(R) Corporation - C:\Program Files\Intel\IntelDH\CCU\AlertService.exe
      O23 - Service: Intel(R) DHTrace Controller (DHTRACE) - Intel(R) Corporation - C:\Program Files\Common Files\Intel\IntelDH\bin\DHTraceController.exe
      O23 - Service: DQLWinService - Unknown owner - C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe
      O23 - Service: McAfee E-mail Proxy (Emproxy) - McAfee, Inc. - C:\PROGRA~1\COMMON~1\McAfee\EmProxy\emproxy.exe
      O23 - Service: EPGService - Hauppauge Computer Works - C:\PROGRA~1\WinTV\EPG Services\System\EPGService.exe
      O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
      O23 - Service: HauppaugeTVServer - Hauppauge Computer Works - C:\PROGRA~1\WinTV\HCWTVS~1.EXE
      O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
      O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
      O23 - Service: Intel(R) Software Services Manager (ISSM) - Intel(R) Corporation - C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\ISSM.exe
      O23 - Service: Intel(R) Viiv(TM) Media Server (M1 Server) - Unknown owner - C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\mediaserver.exe
      O23 - Service: McAfee HackerWatch Service - McAfee, Inc. - C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe
      O23 - Service: Intel(R) Application Tracker (MCLServiceATL) - Intel(R) Corporation - C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\MCLServiceATL.exe
      O23 - Service: McAfee Update Manager (mcmispupdmgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcupdmgr.exe
      O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
      O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\program files\common files\mcafee\mna\mcnasvc.exe
      O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
      O23 - Service: McAfee Protection Manager (mcpromgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcpromgr.exe
      O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
      O23 - Service: McAfee Redirector Service (McRedirector) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\redirsvc\redirsvc.exe
      O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
      O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
      O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
      O23 - Service: McAfee Privacy Service (MPS9) - McAfee, Inc. - C:\PROGRA~1\McAfee\MPS\mps.exe
      O23 - Service: McAfee SpamKiller Service (MSK80Service) - McAfee Inc. - C:\Program Files\McAfee\MSK\MskSrver.exe
      O23 - Service: Intel(R) NMSCore (NMSCore) - Intel(R) Corporation - C:\Program Files\Common Files\Intel\IntelDH\NMS\NMSCore\NMSCore.exe
      O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe
      O23 - Service: PnkBstrB - Unknown owner - C:\Windows\system32\PnkBstrB.exe
      O23 - Service: Intel(R) Quality Manager (QualityManager) - Intel(R) Corporation - C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\qualitymanager.exe
      O23 - Service: Intel(R) Remoting Service (Remote UI Service) - Intel(R) Corporation - C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\Remote UI Service.exe
      O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
      O23 - Service: SupportSoft Sprocket Service (dellsupportcenter) (sprtsvc_dellsupportcenter) - SupportSoft, Inc. - C:\Program Files\Dell Support Center\bin\sprtsvc.exe
      O23 - Service: SigmaTel Audio Service (STacSV) - SigmaTel, Inc. - C:\Windows\system32\STacSV.exe
      O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe
      1. green day Modérateur
        Salut

        * Désactiver le contrôle des comptes utilisateurs (le réactiver à la fin de la désinfection) :
        * Aller dans démarrer puis panneau de configuration
        * Double Cliquer sur l'icône Comptes d'utilisateurs
        * Cliquer ensuite sur désactiver et valider.

        Télécharger ComboFix sur le Bureau : http://download.bleepingcomputer.com/sUBs/ComboFix.exe
        * Démarrer en mode sans échec
        * Faire un clic-droit sur combofix présent sur le bureau et choisir Exécuter en tant qu'administrateur
        * Double cliquer sur combofix.exe.
        * Appuyer sur la touche Y (Yes) pour démarrer le scan
        * Le rapport sera crée dans: C:\Combofix.txt

        ==> poste le rapport stp

        ++
        1. yevgi Auteur
          d'accord merci je vais esseyer
          le probleme est que je ne peut pas ouvrir les fichier car ca entraine le refresh d'explorer est donc la fermeture du fichier,
          ce refresh s'active au bout de 15 sec maxi...
          mais bon je vais voir et je te tiendrai au courant...
      2. yevgi Auteur
        reussi ^^
        tu veux que je le publi comme il est?
        c'est un peu long...
        1. green day Modérateur
          Salut

          oui, colle tout stp

          ++
          1. yevgi Auteur
            dac,
            le voila:

            ComboFix 08-03-24.2 - Yevgi 2008-03-25 23:41:09.1 - NTFSx86
            Microsoft® Windows Vista™ Édition Familiale Premium 6.0.6000.0.1252.1.1036.18.1236 [GMT 1:00]
            Endroit: C:\Users\Yevgi\Desktop\ComboFix.exe
            * Création d'un nouveau point de restauration
            .

            (((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
            .

            C:\Users\Yevgi\AppData\Local\Temp\awvuv.dll
            C:\Windows\pskt.ini

            .
            ((((((((((((((((((((((((((((( Fichiers cr‚‚s 2008-02-25 to 2008-03-25 ))))))))))))))))))))))))))))))))))))
            .

            2008-03-25 23:46 . 2008-01-30 13:48 39,424 --a------ C:\Windows\System32\hgggd.dll
            2008-03-25 16:38 . 2008-01-30 13:48 39,424 --a------ C:\Windows\System32\cbxut.dll
            2008-03-22 15:37 . 2008-03-22 15:37 665 --a------ C:\Windows\eReg.dat
            2008-03-22 15:17 . 2008-03-22 15:17 <REP> d-------- C:\Kama sutra
            2008-03-22 15:13 . 2008-03-22 15:13 <REP> d-------- C:\Program Files\Ubisoft
            2008-03-22 15:13 . 2003-10-27 14:06 505,104 --a------ C:\Windows\System32\msxml.dll
            2008-03-22 15:13 . 2003-10-27 14:06 89,360 --a------ C:\Windows\System32\VB5DB.DLL
            2008-03-22 15:13 . 2003-10-27 14:06 69,632 --a------ C:\Windows\System32\xmltok.dll
            2008-03-22 15:13 . 2003-10-27 14:06 36,864 --a------ C:\Windows\System32\xmlparse.dll
            2008-03-22 15:13 . 2003-10-27 14:06 35,840 --a------ C:\Windows\System32\comdlg32.oca
            2008-03-22 15:13 . 2003-10-27 14:06 29,184 --a------ C:\Windows\System32\MSINET.oca
            2008-03-22 15:13 . 2003-10-27 14:06 28,432 --a------ C:\Windows\System32\msxmlr.dll
            2008-03-22 15:13 . 2003-10-27 14:06 26,096 --a------ C:\Windows\System32\xmlinst.exe
            2008-03-22 15:13 . 2003-10-27 14:06 24,576 --a------ C:\Windows\System32\msxml3a.dll
            2008-03-22 11:52 . 2008-03-22 11:52 <REP> d-------- C:\Users\Yevgi\AppData\Roaming\Ubisoft
            2008-03-22 11:52 . 2008-03-22 11:52 <REP> d-------- C:\Users\All Users\Ubisoft
            2008-03-22 11:52 . 2008-03-22 11:52 <REP> d-------- C:\ProgramData\Ubisoft
            2008-03-19 20:53 . 2008-03-21 17:15 16 --a------ C:\Windows\popcinfo.dat
            2008-03-17 21:25 . 2008-03-17 21:25 <REP> d-------- C:\Users\Yevgi\AppData\Roaming\Microsoft Games
            2008-03-16 22:37 . 2008-03-16 22:37 <REP> d-------- C:\NVIDIA
            2008-03-16 22:36 . 2008-03-16 22:36 <REP> d-------- C:\Program Files\GSC World Publishing
            2008-03-09 22:07 . 2008-03-09 22:07 <REP> d-------- C:\Users\Yevgi\AppData\Roaming\InstallShield Installation Information
            2008-03-09 21:46 . 2008-03-09 21:46 <REP> d-------- C:\Windows\System32\AGEIA
            2008-03-09 21:46 . 2008-03-09 21:46 <REP> d-------- C:\Program Files\AGEIA Technologies
            2008-03-06 18:50 . 2008-03-06 18:50 <REP> dr-hs---- C:\_Backup.RC
            2008-03-06 18:50 . 2008-03-06 18:50 <REP> d--h----- C:\_Backup
            2008-03-06 18:49 . 2008-03-06 18:49 <REP> d-------- C:\Users\Yevgi\AppData\Roaming\VCOM
            2008-03-06 18:49 . 2008-03-06 18:49 <REP> d-------- C:\Users\All Users\VCOM
            2008-03-06 18:49 . 2008-03-06 18:49 <REP> d-------- C:\ProgramData\VCOM
            2008-03-06 18:49 . 2008-03-06 18:49 <REP> d-------- C:\Program Files\VCOM
            2008-03-06 18:48 . 2008-03-15 19:26 <REP> d-------- C:\Program Files\Common Files\Wise Installation Wizard
            2008-03-05 23:26 . 2008-03-24 21:26 <REP> d-------- C:\Series
            2008-03-02 22:07 . 2008-03-02 22:07 <REP> d-------- C:\Program Files\Trend Micro
            2008-02-27 19:58 . 2008-02-27 19:58 1,158 --a------ C:\Windows\mozver.dat
            2008-02-27 17:31 . 2008-03-16 22:48 108,144 --a------ C:\Windows\System32\CmdLineExt.dll
            2008-02-27 03:08 . 2008-02-27 03:08 194,560 --a------ C:\Windows\System32\WebClnt.dll
            2008-02-27 03:08 . 2008-02-27 03:08 110,080 --a------ C:\Windows\System32\drivers\mrxdav.sys
            2008-02-27 03:06 . 2008-02-27 03:06 806,400 --a------ C:\Windows\System32\drivers\tcpip.sys
            2008-02-27 03:06 . 2008-02-27 03:06 217,144 --a------ C:\Windows\System32\drivers\netio.sys
            2008-02-27 03:06 . 2008-02-27 03:06 167,424 --a------ C:\Windows\System32\tcpipcfg.dll
            2008-02-27 03:06 . 2008-02-27 03:06 24,064 --a------ C:\Windows\System32\netcfg.exe
            2008-02-27 03:06 . 2008-02-27 03:06 22,016 --a------ C:\Windows\System32\netiougc.exe
            2008-02-27 03:05 . 2008-02-27 03:05 1,327,104 --a------ C:\Windows\System32\quartz.dll
            2008-02-27 03:05 . 2008-02-27 03:05 223,232 --a------ C:\Windows\System32\WMASF.DLL
            2008-02-27 03:05 . 2008-02-27 03:05 130,048 --a------ C:\Windows\System32\drivers\srv2.sys
            2008-02-27 03:05 . 2008-02-27 03:05 101,888 --a------ C:\Windows\System32\drivers\mrxsmb.sys
            2008-02-27 03:05 . 2008-02-27 03:05 84,992 --a------ C:\Windows\System32\drivers\srvnet.sys
            2008-02-27 03:05 . 2008-02-27 03:05 58,368 --a------ C:\Windows\System32\drivers\mrxsmb20.sys
            2008-02-27 03:05 . 2008-02-27 03:05 11,776 --a------ C:\Windows\System32\sbunattend.exe
            2008-02-27 03:05 . 2008-02-27 03:05 9,728 --a------ C:\Windows\System32\LAPRXY.DLL
            2008-02-27 03:05 . 2008-02-27 03:05 2,048 --a------ C:\Windows\System32\asferror.dll
            2008-02-27 03:04 . 2008-02-27 03:04 <REP> d-------- C:\Program Files\MSXML 4.0
            2008-02-27 03:04 . 2008-02-27 03:04 3,504,824 --a------ C:\Windows\System32\ntkrnlpa.exe
            2008-02-27 03:04 . 2008-02-27 03:04 3,470,520 --a------ C:\Windows\System32\ntoskrnl.exe
            2008-02-27 03:03 . 2008-02-27 03:03 2,048 --a------ C:\Windows\System32\tzres.dll
            2008-02-26 22:09 . 2008-02-27 22:14 <REP> d-------- C:\War III Ced
            2008-02-26 21:43 . 2008-02-26 21:43 283 --a------ C:\Windows\game.ini
            2008-02-26 19:32 . 2008-02-26 19:32 1,712,984 --a------ C:\Windows\System32\wuaueng.dll
            2008-02-26 19:32 . 2008-02-26 19:32 1,524,224 --a------ C:\Windows\System32\wucltux.dll
            2008-02-26 19:32 . 2008-02-26 19:32 53,080 --a------ C:\Windows\System32\wuauclt.exe
            2008-02-26 19:32 . 2008-02-26 19:32 43,352 --a------ C:\Windows\System32\wups2.dll
            2008-02-26 19:31 . 2008-02-26 19:31 549,720 --a------ C:\Windows\System32\wuapi.dll
            2008-02-26 19:31 . 2008-02-26 19:31 163,000 --a------ C:\Windows\System32\wuwebv.dll
            2008-02-26 19:31 . 2008-02-26 19:31 80,896 --a------ C:\Windows\System32\wudriver.dll
            2008-02-26 19:31 . 2008-02-26 19:31 33,624 --a------ C:\Windows\System32\wups.dll
            2008-02-26 19:31 . 2008-02-26 19:31 31,232 --a------ C:\Windows\System32\wuapp.exe
            2008-02-26 19:11 . 2008-02-26 19:26 <REP> d--hsc--- C:\Program Files\Common Files\WindowsLiveInstaller
            2008-02-26 19:10 . 2008-02-26 19:10 <REP> d-------- C:\Users\All Users\WLInstaller
            2008-02-26 19:10 . 2008-02-26 19:10 <REP> d-------- C:\ProgramData\WLInstaller
            2008-02-26 19:10 . 2008-02-26 19:26 <REP> d-------- C:\Program Files\Windows Live
            2008-02-26 19:04 . 2008-02-26 19:04 0 --a------ C:\Windows\nsreg.dat
            2008-02-25 21:36 . 2008-02-25 21:36 <REP> d-------- C:\Program Files\JoWooD

            .
            (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
            .
            2008-03-25 22:46 --------- d-----w C:\Program Files\WinTV
            2008-03-22 14:06 --------- d--h--w C:\Program Files\InstallShield Installation Information
            2008-03-11 23:07 --------- d-----w C:\Program Files\Privé
            2008-02-27 03:54 --------- d-----w C:\Program Files\Windows Sidebar
            2008-02-27 02:07 54,784 ----a-w C:\Windows\system32\drivers\i8042prt.sys
            2008-02-27 02:07 495,160 ----a-w C:\Windows\system32\drivers\Wdf01000.sys
            2008-02-27 02:07 35,384 ----a-w C:\Windows\system32\drivers\WdfLdr.sys
            2008-02-27 02:07 35,384 ----a-w C:\Windows\system32\drivers\kbdclass.sys
            2008-02-27 02:07 34,360 ----a-w C:\Windows\system32\drivers\mouclass.sys
            2008-02-27 02:07 19,968 ----a-w C:\Windows\system32\drivers\sermouse.sys
            2008-02-27 02:07 15,872 ----a-w C:\Windows\system32\drivers\mouhid.sys
            2008-02-27 02:07 15,872 ----a-w C:\Windows\system32\drivers\kbdhid.sys
            2008-02-27 02:02 52,736 ----a-w C:\Windows\AppPatch\iebrshim.dll
            2008-02-26 21:12 --------- d-----w C:\ProgramData\Dell
            2008-02-26 20:43 22,328 ----a-w C:\Windows\system32\drivers\PnkBstrK.sys
            2008-02-26 20:43 22,328 ----a-w C:\Users\Yevgi\AppData\Roaming\PnkBstrK.sys
            2008-02-25 18:40 --------- d-----w C:\Users\Yevgi\AppData\Roaming\La Bataille pour la Terre du Milieu
            2008-02-24 22:24 --------- d-----w C:\Users\Yevgi\AppData\Roaming\PeerNetworking
            2008-02-24 20:51 --------- d-----w C:\Users\Yevgi\AppData\Roaming\InstallShield
            2008-02-22 14:17 --------- d-----w C:\Program Files\Activision Value
            2008-02-22 14:15 --------- d-----w C:\ProgramData\Media Center Programs
            2008-02-14 21:49 --------- d-----w C:\Program Files\3DO
            2008-02-14 15:43 --------- d-----w C:\ProgramData\OrbNetworks
            2008-02-14 15:42 --------- d-----w C:\Program Files\Orb Networks
            2008-02-13 16:31 --------- d-----w C:\Program Files\vtplus
            2008-02-13 16:31 --------- d-----w C:\Program Files\Common Files\IviSDK
            2008-02-12 15:02 278,984 ----a-w C:\Windows\system32\drivers\atksgt.sys
            2008-02-12 14:41 --------- d-----w C:\Program Files\Alcohol Soft
            2008-02-12 14:38 715,248 ----a-w C:\Windows\system32\drivers\sptd.sys
            2008-02-11 20:04 --------- d-----w C:\Program Files\OpenAL
            2008-02-11 15:38 --------- d-----w C:\Program Files\WinAce
            2008-01-25 12:10 --------- d-----w C:\Program Files\Google
            2008-01-16 21:14 537,600 ----a-w C:\Windows\AppPatch\AcLayers.dll
            2008-01-16 21:14 449,536 ----a-w C:\Windows\AppPatch\AcSpecfc.dll
            2008-01-16 21:14 2,144,256 ----a-w C:\Windows\AppPatch\AcGenral.dll
            2008-01-16 21:14 173,056 ----a-w C:\Windows\AppPatch\AcXtrnal.dll
            2008-01-16 13:26 174 --sha-w C:\Program Files\desktop.ini
            .

            ((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
            .
            .
            REGEDIT4
            *Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s

            [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
            "DellSupportCenter"="C:\Program Files\Dell Support Center\bin\sprtcmd.exe" [2007-11-15 10:23 202544]

            [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
            "Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [2008-01-16 22:12 1006264]
            "ECenter"="C:\Dell\E-Center\EULALauncher.exe" [2007-05-25 07:03 17920]
            "SigmatelSysTrayApp"="C:\Program Files\SigmaTel\C-Major Audio\WDM\sttray.exe" [2007-09-12 09:40 405504]
            "NvSvc"="C:\Windows\system32\nvsvc.dll" [2007-10-25 05:52 86016]
            "NvCplDaemon"="C:\Windows\system32\NvCpl.dll" [2007-10-25 05:52 8530464]
            "NvMediaCenter"="C:\Windows\system32\NvMcTray.dll" [2007-10-25 05:52 81920]
            "Windows Mobile Device Center"="%windir%\WindowsMobile\wmdc.exe" [ ]
            "SunJavaUpdateSched"="c:\Program Files\Java\jre1.6.0\bin\jusched.exe" [2008-01-16 14:35 77824]
            "PMX Daemon"="ICO.EXE" [2006-11-08 16:01 49152 C:\Windows\System32\ico.exe]
            "IAAnotif"="C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe" [2007-07-26 20:03 178712]
            "MskAgentexe"="C:\Program Files\McAfee\MSK\MskAgent.exe" [2007-01-17 18:30 152144]
            "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 04:06 40048]
            "MSServer"="C:\Windows\system32\hgggd.dll" [2008-01-30 13:48 39424]
            "NMSSupport"="C:\Program Files\Common Files\Intel\IntelDH\NMS\Support\IntelHCTAgent.exe" [2007-06-27 11:14 439512]
            "CCUTRAYICON"="C:\Program Files\Intel\IntelDH\CCU\CCU_TrayIcon.exe" [2007-06-27 11:18 215256]
            "dscactivate"="C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe" [2007-11-15 10:24 16384]
            "WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2007-05-14 23:22 35328]
            "EPGServiceTool"="C:\PROGRA~1\WinTV\EPG Services\System\EPGClient.exe" [2007-08-01 04:26 675840]

            [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
            "EnableLUA"= 0 (0x0)

            [hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
            "{89A1E40D-0254-4F99-B9AE-B60A2D8754A9}"= C:\Windows\system32\hgggd.dll [2008-01-30 13:48 39424]

            [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Orb]
            --a------ 2007-01-20 01:50 253952 C:\Program Files\Orb Networks\Orb\bin\OrbTray.exe

            [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiSpyware]
            "DisableMonitoring"=dword:00000001

            [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]
            "DisableMonitoring"=dword:00000001

            [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall]
            "DisableMonitoring"=dword:00000001

            [HKLM\~\services\sharedaccess\parameters\firewallpolicy\DomainProfile]
            "EnableFirewall"= 0 (0x0)

            [HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
            "{6AAD1578-915F-4998-BDA1-52BFA57029CF}"= UDP:Profile=Private:LocalSubnet:LocalSubnet|C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\TSHWMDTCP.exe:SPCM
            "{18AC111E-2A35-40DF-9C7F-DD1C2DE51374}"= TCP:Profile=Private:LocalSubnet:LocalSubnet|C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\TSHWMDTCP.exe:SPCM
            "{A7DED6C4-07F0-45A6-9996-070565830F4C}"= UDP:Profile=Private:LocalSubnet:LocalSubnet|C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\Remote UI Service.exe:Intel(R) Remoting Service
            "{54A17BD3-500D-4B5F-8527-6F9AC998C6B2}"= TCP:Profile=Private:LocalSubnet:LocalSubnet|C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\Remote UI Service.exe:Intel(R) Remoting Service
            "{B6BCF073-E804-4B7C-8052-6941137F6B2C}"= UDP:Profile=Private:LocalSubnet:LocalSubnet|C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\mediaserver.exe:Intel(R) Viiv(TM) Media Server
            "{4A78A54D-0354-43C7-808E-576081A84C4B}"= TCP:Profile=Private:LocalSubnet:LocalSubnet|C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\mediaserver.exe:Intel(R) Viiv(TM) Media Server
            "{96E2687C-5A4C-484B-B4B9-B33BF1F9A28B}"= TCP:Profile=Private|9442:127.0.0.1:Intel(R) Viiv(TM) Media Server Discovery
            "{4181C01B-F7E9-442F-866F-F261BF4CB017}"= TCP:Profile=Private|1900:LocalSubnet:LocalSubnet:Intel(R) Viiv(TM) Media Server UPnP Discovery
            "{576B83F1-55B7-4E5C-B759-DA22FD58BA3D}"= Profile=Private|C:\Program Files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
            "{39274DBA-3908-4088-9106-01CF744A4DC5}"= Disabled:UDP:C:\Games\Call of Duty 4\iw3mp.exe:Call of Duty(R) 4 - Modern Warfare(TM)
            "{A19363A0-21C0-46F2-B6BF-0ABE464704FC}"= Disabled:TCP:C:\Games\Call of Duty 4\iw3mp.exe:Call of Duty(R) 4 - Modern Warfare(TM)
            "{3ACB499E-D69E-4353-94A8-E12CDC3A11ED}"= Disabled:UDP:C:\Games\Crysis\Bin32\Crysis.exe:Crysis_32
            "{14107EEC-276D-4160-B14A-3838E5DFDCD2}"= Disabled:TCP:C:\Games\Crysis\Bin32\Crysis.exe:Crysis_32
            "{8FDC5EBC-FA74-4128-86FF-836DEA7F819B}"= Disabled:UDP:C:\Games\Crysis\Bin32\CrysisDedicatedServer.exe:CrysisDedicatedServer_32
            "{4834F166-A192-4A8C-BC63-7E7B292E395A}"= Disabled:TCP:C:\Games\Crysis\Bin32\CrysisDedicatedServer.exe:CrysisDedicatedServer_32
            "{A08E7197-2161-4CC6-82C7-0EA363F8CAA9}"= Disabled:UDP:C:\Games\Hellgate London\Launcher.exe:Hellgate : London
            "{F38AA40C-0FEA-4CAF-9886-E56E244A87A7}"= Disabled:TCP:C:\Games\Hellgate London\Launcher.exe:Hellgate : London
            "{C7A61758-6BFE-4512-AD95-FBC7A186726B}"= Disabled:UDP:C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\Remote UI Service.exe:Intel(R) Remoting Service
            "{7E17D8F2-5EFF-407C-8425-D1AAC2FBA291}"= Disabled:TCP:C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\Remote UI Service.exe:Intel(R) Remoting Service
            "{728C4C0C-2F7C-4907-B744-EAFAD898565C}"= Disabled:UDP:C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\mediaserver.exe:Intel(R) Viiv(TM) Media Server
            "{206771A1-0D66-4FBB-A661-7CE1036D1722}"= Disabled:TCP:C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\mediaserver.exe:Intel(R) Viiv(TM) Media Server
            "{472FEFB9-5F97-4631-892C-71F522C8F352}"= Disabled:TCP:9442:127.0.0.1:Intel(R) Viiv(TM) Media Server Discovery
            "{92BE3A66-C0EC-41AC-BF6B-5B3C7E54399D}"= Disabled:TCP:1900:LocalSubnet:LocalSubnet:Intel(R) Viiv(TM) Media Server UPnP Discovery
            "{DE066973-A17E-4EE6-A6DE-205B134FF5F8}"= Disabled:UDP:C:\Games\Kane and Lynch Dead Men\kaneandlynch.exe:Kane & Lynch: Dead Men
            "{637E9979-5AC3-4C24-891F-EFD122252082}"= Disabled:TCP:C:\Games\Kane and Lynch Dead Men\kaneandlynch.exe:Kane & Lynch: Dead Men
            "{61A1497C-72BF-49D6-9E8B-DCA183CB9E65}"= Disabled:UDP:C:\Program Files\Common Files\McAfee\MNA\McNASvc.exe:McAfee Network Agent
            "{4706CD56-9A34-43AA-98CC-B608D0CD77E4}"= Disabled:TCP:C:\Program Files\Common Files\McAfee\MNA\McNASvc.exe:McAfee Network Agent
            "{7535E2C1-FB0F-415B-8E83-96EE9B86C122}"= Disabled:UDP:C:\Program Files\Orb Networks\Orb\bin\Orb.exe:Orb
            "{6376B9CC-1226-4DFD-9F9F-5D4378212C80}"= Disabled:TCP:C:\Program Files\Orb Networks\Orb\bin\Orb.exe:Orb
            "{75E9ED74-4BE8-4728-883E-4D478C9C0536}"= Disabled:UDP:C:\Program Files\Orb Networks\Orb\bin\OrbStreamerClient.exe:Orb Stream Client
            "{03B74D9B-52D6-4E44-8D77-6DD3D6120827}"= Disabled:TCP:C:\Program Files\Orb Networks\Orb\bin\OrbStreamerClient.exe:Orb Stream Client
            "{2A6F5EE6-0678-4B91-A9A7-899B8A27EDB0}"= Disabled:UDP:C:\Program Files\Orb Networks\Orb\bin\OrbChannelScan.exe:OrbChannelScan
            "{06D38823-7317-4CD0-AE6F-AABCB3FFF20A}"= Disabled:TCP:C:\Program Files\Orb Networks\Orb\bin\OrbChannelScan.exe:OrbChannelScan
            "{B288497A-CCFC-46DF-ABDB-716CB0799157}"= Disabled:UDP:C:\Program Files\Orb Networks\Orb\bin\OrbTray.exe:OrbTray
            "{9A2EB351-E5FA-43A6-928C-A22EF79749C9}"= Disabled:TCP:C:\Program Files\Orb Networks\Orb\bin\OrbTray.exe:OrbTray
            "{5ACEED7A-407C-4AB4-A571-29C73B3307E1}"= Disabled:UDP:C:\Program Files\Orb Networks\Orb\bin\OrbIR.exe:OrbTray
            "{107FF459-B3C1-4C55-952E-125C85289A91}"= Disabled:TCP:C:\Program Files\Orb Networks\Orb\bin\OrbIR.exe:OrbTray
            "{871C11DA-C0AE-4D3A-AFF5-825D3D59483E}"= Disabled:UDP:C:\Windows\System32\PnkBstrA.exe:PnkBstrA
            "{FEC8ED3C-AEA4-4CB6-B9D9-E5F0B6AD1AE4}"= Disabled:TCP:C:\Windows\System32\PnkBstrA.exe:PnkBstrA
            "{2C5B71BA-CA9F-4329-A9AB-3C2EB7C172CC}"= Disabled:UDP:C:\Windows\System32\PnkBstrB.exe:PnkBstrB
            "{FC6FF96E-8C6F-4699-B3CC-FC5E792F42F1}"= Disabled:TCP:C:\Windows\System32\PnkBstrB.exe:PnkBstrB
            "{EC4D42F4-5C2E-4D94-B341-F61ED5299CFD}"= Disabled:UDP:C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\TSHWMDTCP.exe:SPCM
            "{B3ACCF04-F864-4239-8BE9-ED6FB40335A5}"= Disabled:TCP:C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\TSHWMDTCP.exe:SPCM
            "{B20F75E6-6BFB-4DBA-B617-CB43214D6FFE}"= Disabled:C:\Program Files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
            "{D6AFAE1A-1E04-4756-A005-32BF671684B1}"= UDP:C:\Games\Unreal Tournament 3\Binaries\UT3.exe:Unreal Tournament 3
            "{85645E76-807A-42CF-8F29-92E2E372B6A6}"= TCP:C:\Games\Unreal Tournament 3\Binaries\UT3.exe:Unreal Tournament 3
            "{290A071E-AA96-4F92-8E57-1468269FC951}"= UDP:C:\Games\S.T.A.L.K.E.R\bin\XR_3DA.exe:S.T.A.L.K.E.R. (CLI)
            "{8E121631-EA0B-4727-B481-8F9812E24E72}"= TCP:C:\Games\S.T.A.L.K.E.R\bin\XR_3DA.exe:S.T.A.L.K.E.R. (CLI)
            "{E01ED21F-5185-4BE9-8BC7-BF974054547A}"= UDP:C:\Games\S.T.A.L.K.E.R\bin\dedicated\XR_3DA.exe:S.T.A.L.K.E.R. (SRV)
            "{09B819DD-E041-405C-9433-312ED4C05E25}"= TCP:C:\Games\S.T.A.L.K.E.R\bin\dedicated\XR_3DA.exe:S.T.A.L.K.E.R. (SRV)

            [HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile]
            "DoNotAllowExceptions"= 1 (0x1)

            [HKLM\~\services\sharedaccess\parameters\firewallpolicy\RestrictedServices\Static\System]
            "DFSR-1"= RPort=5722|UDP:%SystemRoot%\system32\svchost.exe|Svc=DFSR:Allow inbound TCP traffic|

            [HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile]
            "EnableFirewall"= 0 (0x0)

            R0 pe3ajtsb;Stalker (Pro) Environment Driver (pe3ajtsb);C:\Windows\system32\drivers\pe3ajtsb.sys [2007-03-05 15:58]
            R0 ps6ajtsb;Stalker (Pro) Synchronization Driver (ps6ajtsb);C:\Windows\system32\drivers\ps6ajtsb.sys [2007-03-05 15:57]
            R2 DQLWinService;DQLWinService;"C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe" [2007-02-12 12:46]
            R2 EPGService;EPGService;C:\PROGRA~1\WinTV\EPG Services\System\EPGService.exe [2007-09-05 17:46]
            R2 NMSCore;Intel(R) NMSCore;"C:\Program Files\Common Files\Intel\IntelDH\NMS\NMSCore\NMSCore.exe" [2007-06-27 11:14]
            R2 nmsunidr;UniDriver for NMS;C:\Windows\system32\DRIVERS\nmsunidr.sys [2007-02-18 21:34]
            R2 QualityManager;Intel(R) Quality Manager;"C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\qualitymanager.exe" [2007-06-27 11:17]
            R2 RapiMgr;Windows Mobile-based device connectivity;C:\Windows\system32\svchost.exe [2006-11-02 10:45]
            R2 sprtsvc_dellsupportcenter;SupportSoft Sprocket Service (dellsupportcenter);C:\Program Files\Dell Support Center\bin\sprtsvc.exe [2007-11-15 10:23]
            R2 WcesComm;Windows Mobile-2003-based device connectivity;C:\Windows\system32\svchost.exe [2006-11-02 10:45]
            R3 HCW88BDA;Hauppauge WinTV 88x DVB Tuner/Demod;C:\Windows\system32\drivers\hcw88bda.sys [2007-01-23 19:25]
            R3 hcw88rc5;Hauppauge WinTV 88x IR Decoder;C:\Windows\system32\Drivers\hcw88rc5.sys [2007-01-23 19:26]
            R3 HCW88TSE;Hauppauge WinTV 88x MPEG/TS Capture;C:\Windows\system32\drivers\hcw88tse.sys [2007-01-23 19:36]
            R3 hcw88vid;Hauppauge WinTV 88x Video;C:\Windows\system32\drivers\hcw88vid.sys [2007-01-23 19:36]
            R3 IntelDH;IntelDH Driver;C:\Windows\system32\Drivers\IntelDH.sys [2008-01-16 14:41]
            R3 pmxmouse;PMXMOUSE;C:\Windows\system32\DRIVERS\pmxmouse.sys [2007-06-01 14:41]
            R3 pmxusblf;PMXUSBLF;C:\Windows\system32\DRIVERS\pmxusblf.sys [2007-05-24 17:44]
            S2 pr2ajtsb;Stalker (Pro) Drivers Auto Removal (pr2ajtsb);C:\Windows\system32\pr2ajtsb.exe svc []
            S3 DHTRACE;Intel(R) DHTrace Controller;C:\Program Files\Common Files\Intel\IntelDH\bin\DHTraceController.exe [2007-06-27 11:15]
            S3 HauppaugeTVServer;HauppaugeTVServer;C:\PROGRA~1\WinTV\HCWTVS~1.EXE [2007-02-20 15:11]
            S3 R300;R300;C:\Windows\system32\DRIVERS\atikmdag.sys [2006-11-02 08:36]

            [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
            bthsvcs REG_MULTI_SZ BthServ
            WindowsMobile REG_MULTI_SZ wcescomm rapimgr
            LocalServiceRestricted REG_MULTI_SZ WcesComm RapiMgr

            [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{5fb81c2c-d978-11dc-9157-001d0924fd9a}]
            \shell\AutoRun\command - J:\autoplay.exe

            .
            Contenu du dossier 'Scheduled Tasks/Tƒches planifi‚es'
            "2008-01-16 13:44:15 C:\Windows\Tasks\McDefragTask.job"
            - c:\program files\mcafee\mqc\QcConsol.exe'
            "2008-03-01 00:00:02 C:\Windows\Tasks\McQcTask.job"
            - c:\program files\mcafee\mqc\QcConsol.exe
            .
            **************************************************************************

            catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
            Rootkit scan 2008-03-25 23:46:36
            Windows 6.0.6000 NTFS

            Balayage processus cach‚s ...

            Balayage cach‚ autostart entries ...

            Balayage des fichiers cach‚s ...

            Scan termin‚ avec succŠs
            Les fichiers cach‚s: 0

            **************************************************************************
            .
            --------------------- DLLs a charg‚ sous des processus courants ---------------------

            PROCESS: C:\Windows\system32\winlogon.exe
            -> C:\Windows\system32\hgggd.dll
            .
            ------------------------ Other Running Processes ------------------------
            .
            C:\Windows\system32\WUDFHost.exe
            C:\Program Files\Intel\IntelDH\CCU\AlertService.exe
            C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
            C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe
            C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
            c:\program files\common files\mcafee\mna\mcnasvc.exe
            C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
            C:\PROGRA~1\McAfee\MSC\mcpromgr.exe
            c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
            c:\PROGRA~1\COMMON~1\mcafee\redirsvc\redirsvc.exe
            C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
            C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
            C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
            C:\Program Files\McAfee\MPF\MPFSrv.exe
            C:\PROGRA~1\McAfee\MPS\mps.exe
            C:\Program Files\McAfee\MSK\MskSrver.exe
            C:\Windows\system32\PnkBstrA.exe
            C:\Windows\system32\PnkBstrB.exe
            C:\Program Files\McAfee\MPS\mpsevh.exe
            C:\Windows\system32\STacSV.exe
            C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\ISSM.exe
            C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\MCLServiceATL.exe
            C:\Windows\system32\WUDFHost.exe
            C:\PROGRA~1\McAfee\MSC\mcregist.exe
            C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\mediaserver.exe
            C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\Remote UI Service.exe
            C:\Windows\system32\conime.exe
            C:\Windows\System32\rundll32.exe
            C:\Windows\System32\rundll32.exe
            C:\Windows\WindowsMobile\wmdc.exe
            C:\Program Files\Windows Media Player\WMPSideShowGadget.exe
            C:\Windows\System32\Pmxmiced.exe
            C:\Program Files\Windows Mail\WindowsMailGadget.exe
            C:\Program Files\Windows Media Player\wmplayer.exe
            C:\Program Files\Windows Mail\WinMail.exe
            C:\Program Files\Intel\IntelDH\CCU\CCU_Engine.exe
            C:\Program Files\WinTV\EPG Services\System\EPGClient.exe
            C:\Program Files\Windows Media Player\WMPNSCFG.exe
            C:\Program Files\Windows Media Player\wmpnetwk.exe
            C:\Program Files\WinTV\Ir.exe
            C:\Games\Heroes3\Register\Remind32.exe
            c:\PROGRA~1\mcafee.com\agent\mcagent.exe
            C:\Program Files\Dell Support Center\gs_agent\dsc.exe
            .
            **************************************************************************
            .
            Temps d'accomplissement: 2008-03-25 23:49:40 - machine was rebooted
            ComboFix-quarantined-files.txt 2008-03-25 22:49:35
            .
            2008-02-27 02:09:03 --- E O F ---

            en gros j'ai plus le bug mais la j'ai des APPCRASH sur certain jeu et meme windows au demarage...
            il y a un example du APPCRASH sur Dungeon lords dans un autre discution que j'ai commancer...
        2. green day Modérateur
          Salut

          il reste encore des saletés !

          Télécharge SDFix sur ton bureau

          http://downloads.andymanchesta.com/RemovalTools/SDFix.exe

          Double clique sur SDFix.exe et choisis Install pour l'extraire dans un dossier dédié sur le Bureau.
          Redémarre ton ordinateur en mode sans échec
          Ouvre le dossier SDFix qui vient d'être créé sur le Bureau et double clique sur RunThis.cmd pour lancer le script.
          Appuie sur Y pour commencer le processus de nettoyage.
          Il va supprimer les services et les entrées du Registre de certains trojans trouvés puis te demandera d'appuyer sur une touche pour redémarrer.
          Appuie sur une touche pour redémarrer le PC.
          Ton système sera plus long pour redémarrer qu'à l'accoutumée car l'outil va continuer à s'exécuter et supprimer des fichiers.
          Après le chargement du Bureau, l'outil terminera son travail et affichera Finished.
          Appuie sur une touche pour finir l'exécution du script et charger les icônes de ton Bureau.
          Les icônes du Bureau affichées, le rapport SDFix s'ouvrira à l'écran et s'enregistrera aussi dans le dossier SDFix sous le nom Report.txt.
          Enfin, copie/colle le contenu du fichier Report.txt dans ta prochaine réponse sur le forum, avec un nouveau log Hijackthis !

          ++
          1. yevgi Auteur
            dac
            mais au redemarage aprés l'operation est-ce qu'il faut que je le redemare encore en mode sans echec ou ce n'est plus obligatoire?
        3. green day Modérateur
          Salut

          après l'opération redémarre en mode normal et poste le rapport stp

          ++
          1. yevgi Auteur
            voila le raport de SDfix:

            catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
            Rootkit scan 2008-04-07 22:20:17
            Windows 6.0.6000 NTFS

            scanning hidden processes ...

            scanning hidden services & system hive ...

            [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg]
            "s1"=dword:2df9c43f
            "s2"=dword:110480d0
            "h0"=dword:00000001

            [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04]
            "p0"="C:\Program Files\Alcohol Soft\Alcohol 52\"
            "h0"=dword:00000000
            "ujdew"=hex:a4,47,2e,4e,47,9e,83,cf,3a,98,1a,df,9d,89,40,b1,95,92,33,e2,f8,..
            [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04]
            "p0"="C:\Program Files\Alcohol Soft\Alcohol 52\"
            "h0"=dword:00000000
            "ujdew"=hex:a4,47,2e,4e,47,9e,83,cf,3a,98,1a,df,9d,89,40,b1,95,92,33,e2,f8,..

            scanning hidden registry entries ...

            scanning hidden files ...

            C:\ProgramData\Microsoft\Windows\GameExplorer\{3F8ADF37-A217-4A9E-9EE6-E99C9594CE83}\SupportTasks\0\Visiter le site officiel de Hellgate : London.lnk 612 bytes hidden from API

            scan completed successfully
            hidden processes: 0
            hidden services: 0
            hidden files: 1

            file zipped: C:\ProgramData\Microsoft\Windows\GameExplorer\{3F8ADF37-A217-4A9E-9EE6-E99C9594CE83}\SupportTasks\0\Visiter le site officiel de Hellgate : London.lnk -> catchme.zip -> London.lnk ( 612 bytes )

            est-ce que c'est normal qu'il parle de "catchme"?

            voila le raport de hijackthis:

            Logfile of Trend Micro HijackThis v2.0.2
            Scan saved at 22:27:14, on 07/04/2008
            Platform: Windows Vista (WinNT 6.00.1904)
            MSIE: Internet Explorer v7.00 (7.00.6000.16609)
            Boot mode: Normal

            Running processes:
            C:\Windows\system32\Dwm.exe
            C:\Windows\system32\taskeng.exe
            c:\PROGRA~1\mcafee.com\agent\mcagent.exe
            C:\Program Files\McAfee\MPS\mpsevh.exe
            C:\Program Files\Windows Defender\MSASCui.exe
            C:\Program Files\Sigmatel\C-Major Audio\WDM\sttray.exe
            C:\Windows\System32\rundll32.exe
            C:\Windows\System32\rundll32.exe
            C:\Windows\WindowsMobile\wmdc.exe
            C:\Program Files\Java\jre1.6.0\bin\jusched.exe
            c:\PROGRA~1\mcafee\VIRUSS~1\mcvsshld.exe
            C:\Windows\System32\ico.exe
            C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
            C:\Windows\System32\Pmxmiced.exe
            C:\Program Files\McAfee\MSK\mskagent.exe
            C:\Program Files\Common Files\Intel\IntelDH\NMS\Support\IntelHCTAgent.exe
            C:\PROGRA~1\McAfee\MSC\mcregist.exe
            C:\Program Files\Winamp\winampa.exe
            C:\Program Files\Windows Mail\WinMail.exe
            C:\Program Files\Dell Support Center\bin\sprtcmd.exe
            C:\Program Files\WinTV\Ir.exe
            C:\Windows\Explorer.exe
            C:\Windows\System32\mobsync.exe
            C:\Program Files\Windows Media Player\wmplayer.exe
            C:\Program Files\Windows Media Player\WMPSideShowGadget.exe
            C:\Program Files\Windows Mail\WindowsMailGadget.exe
            C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
            C:\Program Files\Windows Media Player\WMPNSCFG.exe

            R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr
            R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
            R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
            R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
            R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
            O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
            O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - c:\Program Files\Java\jre1.6.0\bin\ssv.dll
            O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - c:\program files\mcafee\virusscan\scriptcl.dll
            O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
            O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
            O2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\Dell\BAE\BAE.dll
            O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
            O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
            O4 - HKLM\..\Run: [ECenter] C:\Dell\E-Center\EULALauncher.exe
            O4 - HKLM\..\Run: [SigmatelSysTrayApp] C:\Program Files\SigmaTel\C-Major Audio\WDM\sttray.exe
            O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
            O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
            O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
            O4 - HKLM\..\Run: [Windows Mobile Device Center] %windir%\WindowsMobile\wmdc.exe
            O4 - HKLM\..\Run: [SunJavaUpdateSched] "c:\Program Files\Java\jre1.6.0\bin\jusched.exe"
            O4 - HKLM\..\Run: [PMX Daemon] ICO.EXE
            O4 - HKLM\..\Run: [IAAnotif] "C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe"
            O4 - HKLM\..\Run: [MskAgentexe] C:\Program Files\McAfee\MSK\MskAgent.exe
            O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
            O4 - HKLM\..\Run: [MSServer] rundll32.exe C:\Windows\system32\tuvsq.dll,#1
            O4 - HKLM\..\Run: [NMSSupport] "C:\Program Files\Common Files\Intel\IntelDH\NMS\Support\IntelHCTAgent.exe" /startup
            O4 - HKLM\..\Run: [CCUTRAYICON] "C:\Program Files\Intel\IntelDH\CCU\CCU_TrayIcon.exe"
            O4 - HKLM\..\Run: [dscactivate] "C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe"
            O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
            O4 - HKLM\..\Run: [EPGServiceTool] C:\PROGRA~1\WinTV\EPG Services\System\EPGClient.exe
            O4 - HKCU\..\Run: [DellSupportCenter] "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCenter
            O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
            O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
            O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
            O4 - HKUS\S-1-5-21-31434581-3181455718-583861208-1000\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'IUSR_NMPR')
            O4 - Global Startup: AutoStart IR.lnk = C:\Program Files\WinTV\Ir.exe
            O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
            O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - c:\Program Files\Java\jre1.6.0\bin\ssv.dll
            O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - c:\Program Files\Java\jre1.6.0\bin\ssv.dll
            O9 - Extra button: @C:\Windows\WindowsMobile\INetRepl.dll,-222 - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
            O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
            O9 - Extra 'Tools' menuitem: @C:\Windows\WindowsMobile\INetRepl.dll,-223 - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
            O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
            O13 - Gopher Prefix:
            O17 - HKLM\System\CCS\Services\Tcpip\..\{7A02E051-227A-459C-932E-817F1D4AAB89}: NameServer = 192.168.1.1
            O23 - Service: Intel(R) Alert Service (AlertService) - Intel(R) Corporation - C:\Program Files\Intel\IntelDH\CCU\AlertService.exe
            O23 - Service: Intel(R) DHTrace Controller (DHTRACE) - Intel(R) Corporation - C:\Program Files\Common Files\Intel\IntelDH\bin\DHTraceController.exe
            O23 - Service: DQLWinService - Unknown owner - C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe
            O23 - Service: McAfee E-mail Proxy (Emproxy) - McAfee, Inc. - C:\PROGRA~1\COMMON~1\McAfee\EmProxy\emproxy.exe
            O23 - Service: EPGService - Hauppauge Computer Works - C:\PROGRA~1\WinTV\EPG Services\System\EPGService.exe
            O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
            O23 - Service: HauppaugeTVServer - Hauppauge Computer Works - C:\PROGRA~1\WinTV\HCWTVS~1.EXE
            O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
            O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
            O23 - Service: Intel(R) Software Services Manager (ISSM) - Intel(R) Corporation - C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\ISSM.exe
            O23 - Service: Intel(R) Viiv(TM) Media Server (M1 Server) - Unknown owner - C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\mediaserver.exe
            O23 - Service: McAfee HackerWatch Service - McAfee, Inc. - C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe
            O23 - Service: Intel(R) Application Tracker (MCLServiceATL) - Intel(R) Corporation - C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\MCLServiceATL.exe
            O23 - Service: McAfee Update Manager (mcmispupdmgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcupdmgr.exe
            O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
            O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\program files\common files\mcafee\mna\mcnasvc.exe
            O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
            O23 - Service: McAfee Protection Manager (mcpromgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcpromgr.exe
            O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
            O23 - Service: McAfee Redirector Service (McRedirector) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\redirsvc\redirsvc.exe
            O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
            O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
            O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
            O23 - Service: McAfee Privacy Service (MPS9) - McAfee, Inc. - C:\PROGRA~1\McAfee\MPS\mps.exe
            O23 - Service: McAfee SpamKiller Service (MSK80Service) - McAfee Inc. - C:\Program Files\McAfee\MSK\MskSrver.exe
            O23 - Service: Intel(R) NMSCore (NMSCore) - Intel(R) Corporation - C:\Program Files\Common Files\Intel\IntelDH\NMS\NMSCore\NMSCore.exe
            O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe
            O23 - Service: PnkBstrB - Unknown owner - C:\Windows\system32\PnkBstrB.exe
            O23 - Service: Intel(R) Quality Manager (QualityManager) - Intel(R) Corporation - C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\qualitymanager.exe
            O23 - Service: Intel(R) Remoting Service (Remote UI Service) - Intel(R) Corporation - C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\Remote UI Service.exe
            O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
            O23 - Service: SupportSoft Sprocket Service (dellsupportcenter) (sprtsvc_dellsupportcenter) - SupportSoft, Inc. - C:\Program Files\Dell Support Center\bin\sprtsvc.exe
            O23 - Service: SigmaTel Audio Service (STacSV) - SigmaTel, Inc. - C:\Windows\system32\STacSV.exe
            O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe
        5. yevgi Auteur
          bah en fait lu bug qui a tout commancer est disparu ^^
          mais... (y a toujours un mais ^^)
          pendant un court moment j'au eu un crash de Windows a chaque fois que j'allumer le pc.
          j'ai pris la signature du probleme:

          Nom d’événement de problème: APPCRASH
          Nom de l’application: Explorer.EXE
          Version de l’application: 6.0.6000.16386
          Horodatage de l'application: 4549b091
          Nom du module par défaut: hggge.dll
          Version du module par défaut: 0.0.0.0
          Horodateur du module par défaut: 475d72a4
          Code de l’exception: c0000005
          Décalage de l’exception: 000036b2
          Version du système: 6.0.6000.2.0.0.768.3
          Identificateur de paramètres régionaux: 1036
          Information supplémentaire n° 1: 8d13
          Information supplémentaire n° 2: cdca9b1d21d12b77d84f02df48e34311
          Information supplémentaire n° 3: 8d13
          Information supplémentaire n° 4: cdca9b1d21d12b77d84f02df48e34311

          en ce moment je l'ai plus avec windows mais il contiue de me le faire sur certain jeux (Dungeon lords (voir discution lancer avec la signature du probleme), assassins creed (j'ai la version en anglais)).
          sinon j'ai retrouvé un ancien probleme que j'ai pas vu depuis un moment
          tout le temps j'ai un message qui s'affiche.
          il s'agit de la fenetre rectanculaire ou il est ecrit :
          "aucune connexion a internet n'est disponible actuellement.
          pour afficher le contenu internet enregistré sur votre ordinateur, cliquer sur travailler hors connexion
          cliquer sur recommencer pour tenter de vous reconecter"

          et donc je clique sur "travailler hors connection " et je continue mon activité mais une heure aprés (a 5 min prés) cette fenetre revient et ainsi de suite...

          le truc c'est que sur le pc concerner j'ai pas internet alors je sai pas quoi faire pour l'arreter...snif

          merci bcp pour ton aide
          1. green day Modérateur
            Salut

            une petite vérif :

            télécharge ceci : http://www.commentcamarche.net/telecharger/telecharger 34055379 malwarebyte s anti malware
            * Installez le programme sur le bureau :
            o S'il manque le fichier COMCTL32.OCX, vous pourrez le télécharger ici
            * Faites les mises à jour (clic sur Mises à jour puis Recherche de mises à jour)
            * Démarrez en mode sans échec
            * Lancez le MalwareByte's Anti-Malware, cliquez sur Exécuter un examen complet puis Rechercher et sélectionnez tous tes disques durs
            * Une fois le scan terminé, cliquez sur supprimer (si un message demande à redémarrer le PC, acceptez !)
            * Un rapport sera généré, enregistrez le de manière à le retrouver

            ==> poste le stp !

            ++
            1. yevgi Auteur
              que veut tu dire par les mise a jours?
              l'ordinateur concerné n'a pas de connexion internet alor pour les faire ca serrai assez difficile...
          2. green day Modérateur
            Salut

            sur l'ordi où tu le télécharge, suffit de faire la mise à jour

            ++
            1. yevgi Auteur
              voila le rapport :

              Malwarebytes' Anti-Malware 1.12
              Version de la base de données: 729

              Type de recherche: Examen complet (C:\|D:\|)
              Eléments examinés: 195023
              Temps écoulé: 41 minute(s), 14 second(s)

              Processus mémoire infecté(s): 0
              Module(s) mémoire infecté(s): 0
              Clé(s) du Registre infectée(s): 7
              Valeur(s) du Registre infectée(s): 6
              Elément(s) de données du Registre infecté(s): 0
              Dossier(s) infecté(s): 0
              Fichier(s) infecté(s): 104

              Processus mémoire infecté(s):
              (Aucun élément nuisible détecté)

              Module(s) mémoire infecté(s):
              (Aucun élément nuisible détecté)

              Clé(s) du Registre infectée(s):
              HKEY_CLASSES_ROOT\CLSID\{89a1e40d-0254-4f99-b9ae-b60a2d8754a9} (Trojan.Vundo) -> No action taken.
              HKEY_CURRENT_USER\Software\Microsoft\affri (Malware.Trace) -> No action taken.
              HKEY_CURRENT_USER\Software\Microsoft\affltid (Malware.Trace) -> No action taken.
              HKEY_CURRENT_USER\Software\Microsoft\rdfa (Trojan.Vundo) -> No action taken.
              HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\affltid (Malware.Trace) -> No action taken.
              HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\affri (Malware.Trace) -> No action taken.
              HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Juan (Malware.Trace) -> No action taken.

              Valeur(s) du Registre infectée(s):
              HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MSServer (Trojan.Vundo) -> No action taken.
              HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cmds (Trojan.Vundo) -> No action taken.
              HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\badb843f (Trojan.Vundo) -> No action taken.
              HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MSServer (Trojan.Vundo) -> No action taken.
              HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{89a1e40d-0254-4f99-b9ae-b60a2d8754a9} (Trojan.Vundo) -> No action taken.
              HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\BMb9e8b7a3 (Trojan.Agent) -> No action taken.

              Elément(s) de données du Registre infecté(s):
              (Aucun élément nuisible détecté)

              Dossier(s) infecté(s):
              (Aucun élément nuisible détecté)

              Fichier(s) infecté(s):
              C:\Users\Yevgi\AppData\Local\Temp\sstqo.dll (Trojan.Vundo) -> No action taken.
              C:\Users\Yevgi\AppData\Local\Temp\jkkli.dll (Trojan.Vundo) -> No action taken.
              C:\Users\Yevgi\AppData\Local\Temp\ojjooowl.dll (Trojan.Vundo) -> No action taken.
              C:\Windows\System32\mljih.dll (Trojan.Vundo) -> No action taken.
              C:\Users\Yevgi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6KIGWFXK\css4[1] (Trojan.Vundo) -> No action taken.
              C:\Users\Yevgi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\NUYQRQY2\kriv[1] (Trojan.Vundo) -> No action taken.
              C:\Users\Yevgi\AppData\Local\Temp\byvsq.dll (Trojan.Vundo) -> No action taken.
              C:\Users\Yevgi\AppData\Local\Temp\byxvt.dll (Trojan.Vundo) -> No action taken.
              C:\Users\Yevgi\AppData\Local\Temp\byxxu.dll (Trojan.Vundo) -> No action taken.
              C:\Users\Yevgi\AppData\Local\Temp\byxxx.dll (Trojan.Vundo) -> No action taken.
              C:\Users\Yevgi\AppData\Local\Temp\ddabb.dll (Trojan.Vundo) -> No action taken.
              C:\Users\Yevgi\AppData\Local\Temp\ddccd.dll (Trojan.Vundo) -> No action taken.
              C:\Users\Yevgi\AppData\Local\Temp\efebb.dll (Trojan.Vundo) -> No action taken.
              C:\Users\Yevgi\AppData\Local\Temp\efeca.dll (Trojan.Vundo) -> No action taken.
              C:\Users\Yevgi\AppData\Local\Temp\fccdd.dll (Trojan.Vundo) -> No action taken.
              C:\Users\Yevgi\AppData\Local\Temp\fcyvw.dll (Trojan.Vundo) -> No action taken.
              C:\Users\Yevgi\AppData\Local\Temp\fcywu.dll (Trojan.Vundo) -> No action taken.
              C:\Users\Yevgi\AppData\Local\Temp\gebaw.dll (Trojan.Vundo) -> No action taken.
              C:\Users\Yevgi\AppData\Local\Temp\geeed.dll (Trojan.Vundo) -> No action taken.
              C:\Users\Yevgi\AppData\Local\Temp\jkhfg.dll (Trojan.Vundo) -> No action taken.
              C:\Users\Yevgi\AppData\Local\Temp\jkhhf.dll (Trojan.Vundo) -> No action taken.
              C:\Users\Yevgi\AppData\Local\Temp\khhec.dll (Trojan.Vundo) -> No action taken.
              C:\Users\Yevgi\AppData\Local\Temp\ljhgf.dll (Trojan.Vundo) -> No action taken.
              C:\Users\Yevgi\AppData\Local\Temp\ljjge.dll (Trojan.Vundo) -> No action taken.
              C:\Users\Yevgi\AppData\Local\Temp\mljge.dll (Trojan.Vundo) -> No action taken.
              C:\Users\Yevgi\AppData\Local\Temp\mllii.dll (Trojan.Vundo) -> No action taken.
              C:\Users\Yevgi\AppData\Local\Temp\opnmn.dll (Trojan.Vundo) -> No action taken.
              C:\Users\Yevgi\AppData\Local\Temp\opnoo.dll (Trojan.Vundo) -> No action taken.
              C:\Users\Yevgi\AppData\Local\Temp\pmkii.dll (Trojan.Vundo) -> No action taken.
              C:\Users\Yevgi\AppData\Local\Temp\pmkjh.dll (Trojan.Vundo) -> No action taken.
              C:\Users\Yevgi\AppData\Local\Temp\pmnlk.dll (Trojan.Vundo) -> No action taken.
              C:\Users\Yevgi\AppData\Local\Temp\qomjj.dll (Trojan.Vundo) -> No action taken.
              C:\Users\Yevgi\AppData\Local\Temp\qomkl.dll (Trojan.Vundo) -> No action taken.
              C:\Users\Yevgi\AppData\Local\Temp\rqoml.dll (Trojan.Vundo) -> No action taken.
              C:\Users\Yevgi\AppData\Local\Temp\rqrss.dll (Trojan.Vundo) -> No action taken.
              C:\Users\Yevgi\AppData\Local\Temp\sstts.dll (Trojan.Vundo) -> No action taken.
              C:\Users\Yevgi\AppData\Local\Temp\tmp00006076 (Trojan.Vundo) -> No action taken.
              C:\Users\Yevgi\AppData\Local\Temp\tmp0000624a (Trojan.Vundo) -> No action taken.
              C:\Users\Yevgi\AppData\Local\Temp\tmp000063f0 (Trojan.Vundo) -> No action taken.
              C:\Users\Yevgi\AppData\Local\Temp\tmp00006805 (Trojan.Vundo) -> No action taken.
              C:\Users\Yevgi\AppData\Local\Temp\tmp00006853 (Trojan.Vundo) -> No action taken.
              C:\Users\Yevgi\AppData\Local\Temp\tmp0000695c (Trojan.Vundo) -> No action taken.
              C:\Users\Yevgi\AppData\Local\Temp\tmp000069aa (Trojan.Vundo) -> No action taken.
              C:\Users\Yevgi\AppData\Local\Temp\tmp00006a65 (Trojan.Vundo) -> No action taken.
              C:\Users\Yevgi\AppData\Local\Temp\tmp00006ae2 (Trojan.Vundo) -> No action taken.
              C:\Users\Yevgi\AppData\Local\Temp\tmp00006b40 (Trojan.Vundo) -> No action taken.
              C:\Users\Yevgi\AppData\Local\Temp\tmp00006c97 (Trojan.Vundo) -> No action taken.
              C:\Users\Yevgi\AppData\Local\Temp\tmp00006d71 (Trojan.Vundo) -> No action taken.
              C:\Users\Yevgi\AppData\Local\Temp\tmp00006db0 (Trojan.Vundo) -> No action taken.
              C:\Users\Yevgi\AppData\Local\Temp\tmp00006ee8 (Trojan.Vundo) -> No action taken.
              C:\Users\Yevgi\AppData\Local\Temp\tmp00006ef7 (Trojan.Vundo) -> No action taken.
              C:\Users\Yevgi\AppData\Local\Temp\tmp00006f26 (Trojan.Vundo) -> No action taken.
              C:\Users\Yevgi\AppData\Local\Temp\tmp00007010 (Trojan.Vundo) -> No action taken.
              C:\Users\Yevgi\AppData\Local\Temp\tmp000070fa (Trojan.Vundo) -> No action taken.
              C:\Users\Yevgi\AppData\Local\Temp\tmp000072fd (Trojan.Vundo) -> No action taken.
              C:\Users\Yevgi\AppData\Local\Temp\tmp000073e7 (Trojan.Vundo) -> No action taken.
              C:\Users\Yevgi\AppData\Local\Temp\tmp00007464 (Trojan.Vundo) -> No action taken.
              C:\Users\Yevgi\AppData\Local\Temp\tmp00007483 (Trojan.Vundo) -> No action taken.
              C:\Users\Yevgi\AppData\Local\Temp\tmp0000753e (Trojan.Vundo) -> No action taken.
              C:\Users\Yevgi\AppData\Local\Temp\tmp00007722 (Trojan.Vundo) -> No action taken.
              C:\Users\Yevgi\AppData\Local\Temp\tmp0000782b (Trojan.Vundo) -> No action taken.
              C:\Users\Yevgi\AppData\Local\Temp\tmp00007c40 (Trojan.Vundo) -> No action taken.
              C:\Users\Yevgi\AppData\Local\Temp\tmp00007c7f (Trojan.Vundo) -> No action taken.
              C:\Users\Yevgi\AppData\Local\Temp\tmp00007d69 (Trojan.Vundo) -> No action taken.
              C:\Users\Yevgi\AppData\Local\Temp\tmp00007e72 (Trojan.Vundo) -> No action taken.
              C:\Users\Yevgi\AppData\Local\Temp\tmp00007e81 (Trojan.Vundo) -> No action taken.
              C:\Users\Yevgi\AppData\Local\Temp\tmp00007f0e (Trojan.Vundo) -> No action taken.
              C:\Users\Yevgi\AppData\Local\Temp\tmp00007f7b (Trojan.Vundo) -> No action taken.
              C:\Users\Yevgi\AppData\Local\Temp\tmp00008084 (Trojan.Vundo) -> No action taken.
              C:\Users\Yevgi\AppData\Local\Temp\tmp0000819d (Trojan.Vundo) -> No action taken.
              C:\Users\Yevgi\AppData\Local\Temp\tmp000081cc (Trojan.Vundo) -> No action taken.
              C:\Users\Yevgi\AppData\Local\Temp\tmp0000821a (Trojan.Vundo) -> No action taken.
              C:\Users\Yevgi\AppData\Local\Temp\tmp00008304 (Trojan.Vundo) -> No action taken.
              C:\Users\Yevgi\AppData\Local\Temp\tmp00008361 (Trojan.Vundo) -> No action taken.
              C:\Users\Yevgi\AppData\Local\Temp\tmp00008600 (Trojan.Vundo) -> No action taken.
              C:\Users\Yevgi\AppData\Local\Temp\tmp00008729 (Trojan.Vundo) -> No action taken.
              C:\Users\Yevgi\AppData\Local\Temp\tmp00008748 (Trojan.Vundo) -> No action taken.
              C:\Users\Yevgi\AppData\Local\Temp\tmp000088dd (Trojan.Vundo) -> No action taken.
              C:\Users\Yevgi\AppData\Local\Temp\tmp000089c7 (Trojan.Vundo) -> No action taken.
              C:\Users\Yevgi\AppData\Local\Temp\tmp00008a15 (Trojan.Vundo) -> No action taken.
              C:\Users\Yevgi\AppData\Local\Temp\tmp00008a35 (Trojan.Vundo) -> No action taken.
              C:\Users\Yevgi\AppData\Local\Temp\tmp00008c18 (Trojan.Vundo) -> No action taken.
              C:\Users\Yevgi\AppData\Local\Temp\tmp00008d50 (Trojan.Vundo) -> No action taken.
              C:\Users\Yevgi\AppData\Local\Temp\tmp00008dbd (Trojan.Vundo) -> No action taken.
              C:\Users\Yevgi\AppData\Local\Temp\tmp000094a0 (Trojan.Vundo) -> No action taken.
              C:\Users\Yevgi\AppData\Local\Temp\tmp0000951d (Trojan.Vundo) -> No action taken.
              C:\Users\Yevgi\AppData\Local\Temp\tmp0000952d (Trojan.Vundo) -> No action taken.
              C:\Users\Yevgi\AppData\Local\Temp\tmp00009cbb (Trojan.Vundo) -> No action taken.
              C:\Users\Yevgi\AppData\Local\Temp\tmp0000a39e (Trojan.Vundo) -> No action taken.
              C:\Users\Yevgi\AppData\Local\Temp\tmp0000a67b (Trojan.Vundo) -> No action taken.
              C:\Users\Yevgi\AppData\Local\Temp\tmp0000d7f6 (Trojan.Vundo) -> No action taken.
              C:\Users\Yevgi\AppData\Local\Temp\tmp00011dbc (Trojan.Vundo) -> No action taken.
              C:\Users\Yevgi\AppData\Local\Temp\urqnl.dll (Trojan.Vundo) -> No action taken.
              C:\Users\Yevgi\AppData\Local\Temp\wvuro.dll (Trojan.Vundo) -> No action taken.
              C:\Users\Yevgi\AppData\Local\Temp\wvuut.dll (Trojan.Vundo) -> No action taken.
              C:\Users\Yevgi\AppData\Local\Temp\wvwvt.dll (Trojan.Vundo) -> No action taken.
              C:\Users\Yevgi\AppData\Local\Temp\xxwvt.dll (Trojan.Vundo) -> No action taken.
              C:\Users\Yevgi\AppData\Local\Temp\xxyvv.dll (Trojan.Vundo) -> No action taken.
              C:\Users\Yevgi\AppData\Local\Temp\yayya.dll (Trojan.Vundo) -> No action taken.
              C:\Windows\System32\cbxus.dll (Trojan.Vundo) -> No action taken.
              C:\Windows\System32\cbxut.dll (Trojan.Vundo) -> No action taken.
              C:\Windows\System32\ddcyw.dll (Trojan.Vundo) -> No action taken.
              C:\Windows\System32\wvutu.dll (Trojan.Vundo) -> No action taken.
              C:\Users\Yevgi\AppData\Local\Temp\pguxuopq.dll (Trojan.Agent) -> No action taken.

              je les ai tous mis en quarantaine...
              1. green day Modérateur
                Salut

                No action taken.

                refais le et supprime tout ce qu'il te trouve !

                ++
                3. yevgi Auteur
                  Malwarebytes' Anti-Malware 1.12
                  Version de la base de données: 729

                  Type de recherche: Examen complet (C:\|D:\|)
                  Eléments examinés: 195023
                  Temps écoulé: 41 minute(s), 14 second(s)

                  Processus mémoire infecté(s): 0
                  Module(s) mémoire infecté(s): 0
                  Clé(s) du Registre infectée(s): 7
                  Valeur(s) du Registre infectée(s): 6
                  Elément(s) de données du Registre infecté(s): 0
                  Dossier(s) infecté(s): 0
                  Fichier(s) infecté(s): 104

                  Processus mémoire infecté(s):
                  (Aucun élément nuisible détecté)

                  Module(s) mémoire infecté(s):
                  (Aucun élément nuisible détecté)

                  Clé(s) du Registre infectée(s):
                  HKEY_CLASSES_ROOT\CLSID\{89a1e40d-0254-4f99-b9ae-b60a2d8754a9} (Trojan.Vundo) -> Quarantined and deleted successfully.
                  HKEY_CURRENT_USER\Software\Microsoft\affri (Malware.Trace) -> Quarantined and deleted successfully.
                  HKEY_CURRENT_USER\Software\Microsoft\affltid (Malware.Trace) -> Quarantined and deleted successfully.
                  HKEY_CURRENT_USER\Software\Microsoft\rdfa (Trojan.Vundo) -> Quarantined and deleted successfully.
                  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\affltid (Malware.Trace) -> Quarantined and deleted successfully.
                  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\affri (Malware.Trace) -> Quarantined and deleted successfully.
                  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Juan (Malware.Trace) -> Quarantined and deleted successfully.

                  Valeur(s) du Registre infectée(s):
                  HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MSServer (Trojan.Vundo) -> Quarantined and deleted successfully.
                  HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cmds (Trojan.Vundo) -> Quarantined and deleted successfully.
                  HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\badb843f (Trojan.Vundo) -> Quarantined and deleted successfully.
                  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MSServer (Trojan.Vundo) -> Quarantined and deleted successfully.
                  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{89a1e40d-0254-4f99-b9ae-b60a2d8754a9} (Trojan.Vundo) -> Quarantined and deleted successfully.
                  HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\BMb9e8b7a3 (Trojan.Agent) -> Quarantined and deleted successfully.

                  Elément(s) de données du Registre infecté(s):
                  (Aucun élément nuisible détecté)

                  Dossier(s) infecté(s):
                  (Aucun élément nuisible détecté)

                  Fichier(s) infecté(s):
                  C:\Users\Yevgi\AppData\Local\Temp\sstqo.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
                  C:\Users\Yevgi\AppData\Local\Temp\jkkli.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
                  C:\Users\Yevgi\AppData\Local\Temp\ojjooowl.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
                  C:\Windows\System32\mljih.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
                  C:\Users\Yevgi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6KIGWFXK\css4[1] (Trojan.Vundo) -> Quarantined and deleted successfully.
                  C:\Users\Yevgi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\NUYQRQY2\kriv[1] (Trojan.Vundo) -> Quarantined and deleted successfully.
                  C:\Users\Yevgi\AppData\Local\Temp\byvsq.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
                  C:\Users\Yevgi\AppData\Local\Temp\byxvt.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
                  C:\Users\Yevgi\AppData\Local\Temp\byxxu.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
                  C:\Users\Yevgi\AppData\Local\Temp\byxxx.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
                  C:\Users\Yevgi\AppData\Local\Temp\ddabb.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
                  C:\Users\Yevgi\AppData\Local\Temp\ddccd.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
                  C:\Users\Yevgi\AppData\Local\Temp\efebb.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
                  C:\Users\Yevgi\AppData\Local\Temp\efeca.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
                  C:\Users\Yevgi\AppData\Local\Temp\fccdd.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
                  C:\Users\Yevgi\AppData\Local\Temp\fcyvw.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
                  C:\Users\Yevgi\AppData\Local\Temp\fcywu.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
                  C:\Users\Yevgi\AppData\Local\Temp\gebaw.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
                  C:\Users\Yevgi\AppData\Local\Temp\geeed.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
                  C:\Users\Yevgi\AppData\Local\Temp\jkhfg.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
                  C:\Users\Yevgi\AppData\Local\Temp\jkhhf.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
                  C:\Users\Yevgi\AppData\Local\Temp\khhec.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
                  C:\Users\Yevgi\AppData\Local\Temp\ljhgf.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
                  C:\Users\Yevgi\AppData\Local\Temp\ljjge.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
                  C:\Users\Yevgi\AppData\Local\Temp\mljge.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
                  C:\Users\Yevgi\AppData\Local\Temp\mllii.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
                  C:\Users\Yevgi\AppData\Local\Temp\opnmn.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
                  C:\Users\Yevgi\AppData\Local\Temp\opnoo.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
                  C:\Users\Yevgi\AppData\Local\Temp\pmkii.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
                  C:\Users\Yevgi\AppData\Local\Temp\pmkjh.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
                  C:\Users\Yevgi\AppData\Local\Temp\pmnlk.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
                  C:\Users\Yevgi\AppData\Local\Temp\qomjj.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
                  C:\Users\Yevgi\AppData\Local\Temp\qomkl.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
                  C:\Users\Yevgi\AppData\Local\Temp\rqoml.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
                  C:\Users\Yevgi\AppData\Local\Temp\rqrss.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
                  C:\Users\Yevgi\AppData\Local\Temp\sstts.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
                  C:\Users\Yevgi\AppData\Local\Temp\tmp00006076 (Trojan.Vundo) -> Quarantined and deleted successfully.
                  C:\Users\Yevgi\AppData\Local\Temp\tmp0000624a (Trojan.Vundo) -> Quarantined and deleted successfully.
                  C:\Users\Yevgi\AppData\Local\Temp\tmp000063f0 (Trojan.Vundo) -> Quarantined and deleted successfully.
                  C:\Users\Yevgi\AppData\Local\Temp\tmp00006805 (Trojan.Vundo) -> Quarantined and deleted successfully.
                  C:\Users\Yevgi\AppData\Local\Temp\tmp00006853 (Trojan.Vundo) -> Quarantined and deleted successfully.
                  C:\Users\Yevgi\AppData\Local\Temp\tmp0000695c (Trojan.Vundo) -> Quarantined and deleted successfully.
                  C:\Users\Yevgi\AppData\Local\Temp\tmp000069aa (Trojan.Vundo) -> Quarantined and deleted successfully.
                  C:\Users\Yevgi\AppData\Local\Temp\tmp00006a65 (Trojan.Vundo) -> Quarantined and deleted successfully.
                  C:\Users\Yevgi\AppData\Local\Temp\tmp00006ae2 (Trojan.Vundo) -> Quarantined and deleted successfully.
                  C:\Users\Yevgi\AppData\Local\Temp\tmp00006b40 (Trojan.Vundo) -> Quarantined and deleted successfully.
                  C:\Users\Yevgi\AppData\Local\Temp\tmp00006c97 (Trojan.Vundo) -> Quarantined and deleted successfully.
                  C:\Users\Yevgi\AppData\Local\Temp\tmp00006d71 (Trojan.Vundo) -> Quarantined and deleted successfully.
                  C:\Users\Yevgi\AppData\Local\Temp\tmp00006db0 (Trojan.Vundo) -> Quarantined and deleted successfully.
                  C:\Users\Yevgi\AppData\Local\Temp\tmp00006ee8 (Trojan.Vundo) -> Quarantined and deleted successfully.
                  C:\Users\Yevgi\AppData\Local\Temp\tmp00006ef7 (Trojan.Vundo) -> Quarantined and deleted successfully.
                  C:\Users\Yevgi\AppData\Local\Temp\tmp00006f26 (Trojan.Vundo) -> Quarantined and deleted successfully.
                  C:\Users\Yevgi\AppData\Local\Temp\tmp00007010 (Trojan.Vundo) -> Quarantined and deleted successfully.
                  C:\Users\Yevgi\AppData\Local\Temp\tmp000070fa (Trojan.Vundo) -> Quarantined and deleted successfully.
                  C:\Users\Yevgi\AppData\Local\Temp\tmp000072fd (Trojan.Vundo) -> Quarantined and deleted successfully.
                  C:\Users\Yevgi\AppData\Local\Temp\tmp000073e7 (Trojan.Vundo) -> Quarantined and deleted successfully.
                  C:\Users\Yevgi\AppData\Local\Temp\tmp00007464 (Trojan.Vundo) -> Quarantined and deleted successfully.
                  C:\Users\Yevgi\AppData\Local\Temp\tmp00007483 (Trojan.Vundo) -> Quarantined and deleted successfully.
                  C:\Users\Yevgi\AppData\Local\Temp\tmp0000753e (Trojan.Vundo) -> Quarantined and deleted successfully.
                  C:\Users\Yevgi\AppData\Local\Temp\tmp00007722 (Trojan.Vundo) -> Quarantined and deleted successfully.
                  C:\Users\Yevgi\AppData\Local\Temp\tmp0000782b (Trojan.Vundo) -> Quarantined and deleted successfully.
                  C:\Users\Yevgi\AppData\Local\Temp\tmp00007c40 (Trojan.Vundo) -> Quarantined and deleted successfully.
                  C:\Users\Yevgi\AppData\Local\Temp\tmp00007c7f (Trojan.Vundo) -> Quarantined and deleted successfully.
                  C:\Users\Yevgi\AppData\Local\Temp\tmp00007d69 (Trojan.Vundo) -> Quarantined and deleted successfully.
                  C:\Users\Yevgi\AppData\Local\Temp\tmp00007e72 (Trojan.Vundo) -> Quarantined and deleted successfully.
                  C:\Users\Yevgi\AppData\Local\Temp\tmp00007e81 (Trojan.Vundo) -> Quarantined and deleted successfully.
                  C:\Users\Yevgi\AppData\Local\Temp\tmp00007f0e (Trojan.Vundo) -> Quarantined and deleted successfully.
                  C:\Users\Yevgi\AppData\Local\Temp\tmp00007f7b (Trojan.Vundo) -> Quarantined and deleted successfully.
                  C:\Users\Yevgi\AppData\Local\Temp\tmp00008084 (Trojan.Vundo) -> Quarantined and deleted successfully.
                  C:\Users\Yevgi\AppData\Local\Temp\tmp0000819d (Trojan.Vundo) -> Quarantined and deleted successfully.
                  C:\Users\Yevgi\AppData\Local\Temp\tmp000081cc (Trojan.Vundo) -> Quarantined and deleted successfully.
                  C:\Users\Yevgi\AppData\Local\Temp\tmp0000821a (Trojan.Vundo) -> Quarantined and deleted successfully.
                  C:\Users\Yevgi\AppData\Local\Temp\tmp00008304 (Trojan.Vundo) -> Quarantined and deleted successfully.
                  C:\Users\Yevgi\AppData\Local\Temp\tmp00008361 (Trojan.Vundo) -> Quarantined and deleted successfully.
                  C:\Users\Yevgi\AppData\Local\Temp\tmp00008600 (Trojan.Vundo) -> Quarantined and deleted successfully.
                  C:\Users\Yevgi\AppData\Local\Temp\tmp00008729 (Trojan.Vundo) -> Quarantined and deleted successfully.
                  C:\Users\Yevgi\AppData\Local\Temp\tmp00008748 (Trojan.Vundo) -> Quarantined and deleted successfully.
                  C:\Users\Yevgi\AppData\Local\Temp\tmp000088dd (Trojan.Vundo) -> Quarantined and deleted successfully.
                  C:\Users\Yevgi\AppData\Local\Temp\tmp000089c7 (Trojan.Vundo) -> Quarantined and deleted successfully.
                  C:\Users\Yevgi\AppData\Local\Temp\tmp00008a15 (Trojan.Vundo) -> Quarantined and deleted successfully.
                  C:\Users\Yevgi\AppData\Local\Temp\tmp00008a35 (Trojan.Vundo) -> Quarantined and deleted successfully.
                  C:\Users\Yevgi\AppData\Local\Temp\tmp00008c18 (Trojan.Vundo) -> Quarantined and deleted successfully.
                  C:\Users\Yevgi\AppData\Local\Temp\tmp00008d50 (Trojan.Vundo) -> Quarantined and deleted successfully.
                  C:\Users\Yevgi\AppData\Local\Temp\tmp00008dbd (Trojan.Vundo) -> Quarantined and deleted successfully.
                  C:\Users\Yevgi\AppData\Local\Temp\tmp000094a0 (Trojan.Vundo) -> Quarantined and deleted successfully.
                  C:\Users\Yevgi\AppData\Local\Temp\tmp0000951d (Trojan.Vundo) -> Quarantined and deleted successfully.
                  C:\Users\Yevgi\AppData\Local\Temp\tmp0000952d (Trojan.Vundo) -> Quarantined and deleted successfully.
                  C:\Users\Yevgi\AppData\Local\Temp\tmp00009cbb (Trojan.Vundo) -> Quarantined and deleted successfully.
                  C:\Users\Yevgi\AppData\Local\Temp\tmp0000a39e (Trojan.Vundo) -> Quarantined and deleted successfully.
                  C:\Users\Yevgi\AppData\Local\Temp\tmp0000a67b (Trojan.Vundo) -> Quarantined and deleted successfully.
                  C:\Users\Yevgi\AppData\Local\Temp\tmp0000d7f6 (Trojan.Vundo) -> Quarantined and deleted successfully.
                  C:\Users\Yevgi\AppData\Local\Temp\tmp00011dbc (Trojan.Vundo) -> Quarantined and deleted successfully.
                  C:\Users\Yevgi\AppData\Local\Temp\urqnl.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
                  C:\Users\Yevgi\AppData\Local\Temp\wvuro.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
                  C:\Users\Yevgi\AppData\Local\Temp\wvuut.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
                  C:\Users\Yevgi\AppData\Local\Temp\wvwvt.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
                  C:\Users\Yevgi\AppData\Local\Temp\xxwvt.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
                  C:\Users\Yevgi\AppData\Local\Temp\xxyvv.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
                  C:\Users\Yevgi\AppData\Local\Temp\yayya.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
                  C:\Windows\System32\cbxus.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
                  C:\Windows\System32\cbxut.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
                  C:\Windows\System32\ddcyw.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
                  C:\Windows\System32\wvutu.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
                  C:\Users\Yevgi\AppData\Local\Temp\pguxuopq.dll (Trojan.Agent) -> Quarantined and deleted successfully.
                  • 1
                  • 2