Sujet Précédent Sujet Suivant

Dyrhuboa.dll

Fermé
yevgi Messages postés 78 Date d'inscription jeudi 21 février 2008 Statut Membre Dernière intervention 5 août 2009 - 1 mars 2008 à 20:20
yevgi Messages postés 78 Date d'inscription jeudi 21 février 2008 Statut Membre Dernière intervention 5 août 2009 - 12 mai 2008 à 12:43
Bonjour,
j'ai un probleme avec mon vista depuis quelques jours,
a chaque fois que je demare mon PC a l'entrée a Windows j'ai le message suivant qui s'affiche:
"erreur dans c:\users\yevgi\appdata\local\temp\dyrhuboa.dll
entrée manquente : run"
ceci a pour effet que a chaque ouverture d'une fenetre quelconque (poste de travail,raccourci a des fichier divers...)
windows quitte la fenetre et il y a une sorte d'actualisation d'explorer qui des fois m'oblige a aller dans le gestionnaire des taches de windows et lancer explorer.exe en tant que nouvelle application.
que faire afin de resoudre cce probleme?s'agit-il d'un virus?
merci d'avance

25 réponses

  • 1
  • 2
Réponse 1 / 25
green day Messages postés 26371 Date d'inscription vendredi 30 septembre 2005 Statut Modérateur, Contributeur sécurité Dernière intervention 27 décembre 2019 2 162
1 mars 2008 à 20:23
Salut

cette dll a tous les aspects pour un trojan voir in rootkit !

Télécharge ceci :

Lien : http://www.commentcamarche.net/telecharger/telecharger 159 hijackthis

Démo : http://pageperso.aol.fr/balltrap34/demohijack.htm

Choisir l'option "do a scan and a logfile", et faire un copier/coller du rapport ainsi générer sur le forum.

++

PS : je demande aux modos de déplacer ton message dans le forum virus/sécu !

0
Réponse 2 / 25
yevgi Messages postés 78 Date d'inscription jeudi 21 février 2008 Statut Membre Dernière intervention 5 août 2009 6
1 mars 2008 à 20:32
merci pour la reponse rapide
je vais esseyer.
0
yevgi Messages postés 78 Date d'inscription jeudi 21 février 2008 Statut Membre Dernière intervention 5 août 2009 6
5 mars 2008 à 10:48
salut,
j'ai installé le programme et j'ai pu m'en debarasser mais le probleme perciste...
a chaque fois que j'ouvre un fichier explorer fait une sorte d'actualisation...
c'est lourd!
si quelqu'un a d'autres idées...
0
Réponse 3 / 25
green day Messages postés 26371 Date d'inscription vendredi 30 septembre 2005 Statut Modérateur, Contributeur sécurité Dernière intervention 27 décembre 2019 2 162
5 mars 2008 à 17:18
Salut

poste le rapport !!

++
0
Réponse 4 / 25
yevgi Messages postés 78 Date d'inscription jeudi 21 février 2008 Statut Membre Dernière intervention 5 août 2009 6
19 mars 2008 à 16:10
je ne sais pas comment faire... ^^
0

Vous n’avez pas trouvé la réponse que vous recherchez ?

Posez votre question
Réponse 5 / 25
green day Messages postés 26371 Date d'inscription vendredi 30 septembre 2005 Statut Modérateur, Contributeur sécurité Dernière intervention 27 décembre 2019 2 162
19 mars 2008 à 18:35
Regarde la démo ! cf poste 1 !

++
0
Réponse 6 / 25
yevgi Messages postés 78 Date d'inscription jeudi 21 février 2008 Statut Membre Dernière intervention 5 août 2009 6
22 mars 2008 à 19:12
dac merci
alor voila le rapport:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 22:19:35, on 16/03/2008
Platform: Windows Vista (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16609)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Sigmatel\C-Major Audio\WDM\sttray.exe
C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe
C:\Windows\WindowsMobile\wmdc.exe
C:\Program Files\Java\jre1.6.0\bin\jusched.exe
C:\Windows\System32\ico.exe
C:\Windows\System32\Pmxmiced.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
C:\Program Files\McAfee\MSK\mskagent.exe
C:\Program Files\Common Files\Intel\IntelDH\NMS\Support\IntelHCTAgent.exe
C:\Program Files\Intel\IntelDH\CCU\CCU_TrayIcon.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\WinTV\EPG Services\System\EPGClient.exe
C:\Program Files\Dell Support Center\bin\sprtcmd.exe
C:\Program Files\Intel\IntelDH\CCU\CCU_Engine.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Windows Mail\WinMail.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\WinTV\Ir.exe
C:\Games\Heroes3\Register\Remind32.exe
C:\Games\Heroes3\RegisterSOD\Remind32.exe
c:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\Program Files\McAfee\MPS\mpsevh.exe
C:\Program Files\Windows Media Player\wmplayer.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Windows Media Player\WMPSideShowGadget.exe
C:\Program Files\Windows Mail\WindowsMailGadget.exe
c:\program files\mcafee\msc\mcuimgr.exe
C:\Program Files\WinRAR\WinRAR.exe
C:\Windows\explorer.exe
C:\Program Files\Alcohol Soft\Alcohol 52\Alcohol.exe
J:\setup.exe
C:\Users\Yevgi\AppData\Local\Temp\is-GOJ38.tmp\is-839QO.tmp
C:\Program Files\Winamp\winamp.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.google.fr
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
O1 - Hosts: ::1 localhost
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - c:\Program Files\Java\jre1.6.0\bin\ssv.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - c:\program files\mcafee\virusscan\scriptcl.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\Dell\BAE\BAE.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [ECenter] C:\Dell\E-Center\EULALauncher.exe
O4 - HKLM\..\Run: [SigmatelSysTrayApp] C:\Program Files\SigmaTel\C-Major Audio\WDM\sttray.exe
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Windows Mobile Device Center] %windir%\WindowsMobile\wmdc.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "c:\Program Files\Java\jre1.6.0\bin\jusched.exe"
O4 - HKLM\..\Run: [PMX Daemon] ICO.EXE
O4 - HKLM\..\Run: [IAAnotif] "C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe"
O4 - HKLM\..\Run: [MskAgentexe] C:\Program Files\McAfee\MSK\MskAgent.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [NMSSupport] "C:\Program Files\Common Files\Intel\IntelDH\NMS\Support\IntelHCTAgent.exe" /startup
O4 - HKLM\..\Run: [CCUTRAYICON] "C:\Program Files\Intel\IntelDH\CCU\CCU_TrayIcon.exe"
O4 - HKLM\..\Run: [dscactivate] "C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe"
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [MSServer] rundll32.exe C:\Windows\system32\ljhgh.dll,#1
O4 - HKLM\..\Run: [EPGServiceTool] C:\PROGRA~1\WinTV\EPG Services\System\EPGClient.exe
O4 - HKCU\..\Run: [DellSupportCenter] "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCenter
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [badb843f] rundll32.exe "C:\Users\Yevgi\AppData\Local\Temp\wpwiqkwx.dll",b
O4 - HKCU\..\Run: [MSServer] rundll32.exe C:\Users\Yevgi\AppData\Local\Temp\efcbb.dll,#1
O4 - HKCU\..\Run: [cmds] rundll32.exe C:\Users\Yevgi\AppData\Local\Temp\awvuv.dll,c
O4 - HKCU\..\Run: [BMb9e8b7a3] Rundll32.exe "C:\Users\Yevgi\AppData\Local\Temp\yitpoyxe.dll",s
O4 - HKCU\..\Run: [MS Juan] rundll32 "C:\Users\Yevgi\AppData\Local\Temp\dyrhuboa.dll",run
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-21-31434581-3181455718-583861208-1000\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'IUSR_NMPR')
O4 - Startup: 3DO Registration.lnk = C:\Games\Heroes3\Register\Remind32.exe
O4 - Startup: H3 The Shadow of Death(TM).lnk = C:\Games\Heroes3\RegisterSOD\Remind32.exe
O4 - Global Startup: AutoStart IR.lnk = C:\Program Files\WinTV\Ir.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - c:\Program Files\Java\jre1.6.0\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - c:\Program Files\Java\jre1.6.0\bin\ssv.dll
O9 - Extra button: @C:\Windows\WindowsMobile\INetRepl.dll,-222 - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra 'Tools' menuitem: @C:\Windows\WindowsMobile\INetRepl.dll,-223 - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O13 - Gopher Prefix:
O17 - HKLM\System\CCS\Services\Tcpip\..\{7A02E051-227A-459C-932E-817F1D4AAB89}: NameServer = 192.168.1.1
O23 - Service: Intel(R) Alert Service (AlertService) - Intel(R) Corporation - C:\Program Files\Intel\IntelDH\CCU\AlertService.exe
O23 - Service: Intel(R) DHTrace Controller (DHTRACE) - Intel(R) Corporation - C:\Program Files\Common Files\Intel\IntelDH\bin\DHTraceController.exe
O23 - Service: DQLWinService - Unknown owner - C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe
O23 - Service: McAfee E-mail Proxy (Emproxy) - McAfee, Inc. - C:\PROGRA~1\COMMON~1\McAfee\EmProxy\emproxy.exe
O23 - Service: EPGService - Hauppauge Computer Works - C:\PROGRA~1\WinTV\EPG Services\System\EPGService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: HauppaugeTVServer - Hauppauge Computer Works - C:\PROGRA~1\WinTV\HCWTVS~1.EXE
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Intel(R) Software Services Manager (ISSM) - Intel(R) Corporation - C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\ISSM.exe
O23 - Service: Intel(R) Viiv(TM) Media Server (M1 Server) - Unknown owner - C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\mediaserver.exe
O23 - Service: McAfee HackerWatch Service - McAfee, Inc. - C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe
O23 - Service: Intel(R) Application Tracker (MCLServiceATL) - Intel(R) Corporation - C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\MCLServiceATL.exe
O23 - Service: McAfee Update Manager (mcmispupdmgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcupdmgr.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\program files\common files\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
O23 - Service: McAfee Protection Manager (mcpromgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcpromgr.exe
O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
O23 - Service: McAfee Redirector Service (McRedirector) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\redirsvc\redirsvc.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
O23 - Service: McAfee Privacy Service (MPS9) - McAfee, Inc. - C:\PROGRA~1\McAfee\MPS\mps.exe
O23 - Service: McAfee SpamKiller Service (MSK80Service) - McAfee Inc. - C:\Program Files\McAfee\MSK\MskSrver.exe
O23 - Service: Intel(R) NMSCore (NMSCore) - Intel(R) Corporation - C:\Program Files\Common Files\Intel\IntelDH\NMS\NMSCore\NMSCore.exe
O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe
O23 - Service: PnkBstrB - Unknown owner - C:\Windows\system32\PnkBstrB.exe
O23 - Service: Intel(R) Quality Manager (QualityManager) - Intel(R) Corporation - C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\qualitymanager.exe
O23 - Service: Intel(R) Remoting Service (Remote UI Service) - Intel(R) Corporation - C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\Remote UI Service.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: SupportSoft Sprocket Service (dellsupportcenter) (sprtsvc_dellsupportcenter) - SupportSoft, Inc. - C:\Program Files\Dell Support Center\bin\sprtsvc.exe
O23 - Service: SigmaTel Audio Service (STacSV) - SigmaTel, Inc. - C:\Windows\system32\STacSV.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe
0
Réponse 7 / 25
green day Messages postés 26371 Date d'inscription vendredi 30 septembre 2005 Statut Modérateur, Contributeur sécurité Dernière intervention 27 décembre 2019 2 162
23 mars 2008 à 10:22
Salut

* Désactiver le contrôle des comptes utilisateurs (le réactiver à la fin de la désinfection) :
* Aller dans démarrer puis panneau de configuration
* Double Cliquer sur l'icône Comptes d'utilisateurs
* Cliquer ensuite sur désactiver et valider.


Télécharger ComboFix sur le Bureau : http://download.bleepingcomputer.com/sUBs/ComboFix.exe
* Démarrer en mode sans échec
* Faire un clic-droit sur combofix présent sur le bureau et choisir Exécuter en tant qu'administrateur
* Double cliquer sur combofix.exe.
* Appuyer sur la touche Y (Yes) pour démarrer le scan
* Le rapport sera crée dans: C:\Combofix.txt

==> poste le rapport stp

++
0
yevgi Messages postés 78 Date d'inscription jeudi 21 février 2008 Statut Membre Dernière intervention 5 août 2009 6
23 mars 2008 à 11:35
d'accord merci je vais esseyer
le probleme est que je ne peut pas ouvrir les fichier car ca entraine le refresh d'explorer est donc la fermeture du fichier,
ce refresh s'active au bout de 15 sec maxi...
mais bon je vais voir et je te tiendrai au courant...
0
Réponse 8 / 25
yevgi Messages postés 78 Date d'inscription jeudi 21 février 2008 Statut Membre Dernière intervention 5 août 2009 6
4 avril 2008 à 18:28
reussi ^^
tu veux que je le publi comme il est?
c'est un peu long...
0
Réponse 9 / 25
green day Messages postés 26371 Date d'inscription vendredi 30 septembre 2005 Statut Modérateur, Contributeur sécurité Dernière intervention 27 décembre 2019 2 162
4 avril 2008 à 18:29
Salut

oui, colle tout stp

++
0
yevgi Messages postés 78 Date d'inscription jeudi 21 février 2008 Statut Membre Dernière intervention 5 août 2009 6
5 avril 2008 à 20:47
dac,
le voila:

ComboFix 08-03-24.2 - Yevgi 2008-03-25 23:41:09.1 - NTFSx86
Microsoft® Windows Vista™ Édition Familiale Premium 6.0.6000.0.1252.1.1036.18.1236 [GMT 1:00]
Endroit: C:\Users\Yevgi\Desktop\ComboFix.exe
* Création d'un nouveau point de restauration
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Users\Yevgi\AppData\Local\Temp\awvuv.dll
C:\Windows\pskt.ini

.
((((((((((((((((((((((((((((( Fichiers cr‚‚s 2008-02-25 to 2008-03-25 ))))))))))))))))))))))))))))))))))))
.

2008-03-25 23:46 . 2008-01-30 13:48 39,424 --a------ C:\Windows\System32\hgggd.dll
2008-03-25 16:38 . 2008-01-30 13:48 39,424 --a------ C:\Windows\System32\cbxut.dll
2008-03-22 15:37 . 2008-03-22 15:37 665 --a------ C:\Windows\eReg.dat
2008-03-22 15:17 . 2008-03-22 15:17 <REP> d-------- C:\Kama sutra
2008-03-22 15:13 . 2008-03-22 15:13 <REP> d-------- C:\Program Files\Ubisoft
2008-03-22 15:13 . 2003-10-27 14:06 505,104 --a------ C:\Windows\System32\msxml.dll
2008-03-22 15:13 . 2003-10-27 14:06 89,360 --a------ C:\Windows\System32\VB5DB.DLL
2008-03-22 15:13 . 2003-10-27 14:06 69,632 --a------ C:\Windows\System32\xmltok.dll
2008-03-22 15:13 . 2003-10-27 14:06 36,864 --a------ C:\Windows\System32\xmlparse.dll
2008-03-22 15:13 . 2003-10-27 14:06 35,840 --a------ C:\Windows\System32\comdlg32.oca
2008-03-22 15:13 . 2003-10-27 14:06 29,184 --a------ C:\Windows\System32\MSINET.oca
2008-03-22 15:13 . 2003-10-27 14:06 28,432 --a------ C:\Windows\System32\msxmlr.dll
2008-03-22 15:13 . 2003-10-27 14:06 26,096 --a------ C:\Windows\System32\xmlinst.exe
2008-03-22 15:13 . 2003-10-27 14:06 24,576 --a------ C:\Windows\System32\msxml3a.dll
2008-03-22 11:52 . 2008-03-22 11:52 <REP> d-------- C:\Users\Yevgi\AppData\Roaming\Ubisoft
2008-03-22 11:52 . 2008-03-22 11:52 <REP> d-------- C:\Users\All Users\Ubisoft
2008-03-22 11:52 . 2008-03-22 11:52 <REP> d-------- C:\ProgramData\Ubisoft
2008-03-19 20:53 . 2008-03-21 17:15 16 --a------ C:\Windows\popcinfo.dat
2008-03-17 21:25 . 2008-03-17 21:25 <REP> d-------- C:\Users\Yevgi\AppData\Roaming\Microsoft Games
2008-03-16 22:37 . 2008-03-16 22:37 <REP> d-------- C:\NVIDIA
2008-03-16 22:36 . 2008-03-16 22:36 <REP> d-------- C:\Program Files\GSC World Publishing
2008-03-09 22:07 . 2008-03-09 22:07 <REP> d-------- C:\Users\Yevgi\AppData\Roaming\InstallShield Installation Information
2008-03-09 21:46 . 2008-03-09 21:46 <REP> d-------- C:\Windows\System32\AGEIA
2008-03-09 21:46 . 2008-03-09 21:46 <REP> d-------- C:\Program Files\AGEIA Technologies
2008-03-06 18:50 . 2008-03-06 18:50 <REP> dr-hs---- C:\_Backup.RC
2008-03-06 18:50 . 2008-03-06 18:50 <REP> d--h----- C:\_Backup
2008-03-06 18:49 . 2008-03-06 18:49 <REP> d-------- C:\Users\Yevgi\AppData\Roaming\VCOM
2008-03-06 18:49 . 2008-03-06 18:49 <REP> d-------- C:\Users\All Users\VCOM
2008-03-06 18:49 . 2008-03-06 18:49 <REP> d-------- C:\ProgramData\VCOM
2008-03-06 18:49 . 2008-03-06 18:49 <REP> d-------- C:\Program Files\VCOM
2008-03-06 18:48 . 2008-03-15 19:26 <REP> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2008-03-05 23:26 . 2008-03-24 21:26 <REP> d-------- C:\Series
2008-03-02 22:07 . 2008-03-02 22:07 <REP> d-------- C:\Program Files\Trend Micro
2008-02-27 19:58 . 2008-02-27 19:58 1,158 --a------ C:\Windows\mozver.dat
2008-02-27 17:31 . 2008-03-16 22:48 108,144 --a------ C:\Windows\System32\CmdLineExt.dll
2008-02-27 03:08 . 2008-02-27 03:08 194,560 --a------ C:\Windows\System32\WebClnt.dll
2008-02-27 03:08 . 2008-02-27 03:08 110,080 --a------ C:\Windows\System32\drivers\mrxdav.sys
2008-02-27 03:06 . 2008-02-27 03:06 806,400 --a------ C:\Windows\System32\drivers\tcpip.sys
2008-02-27 03:06 . 2008-02-27 03:06 217,144 --a------ C:\Windows\System32\drivers\netio.sys
2008-02-27 03:06 . 2008-02-27 03:06 167,424 --a------ C:\Windows\System32\tcpipcfg.dll
2008-02-27 03:06 . 2008-02-27 03:06 24,064 --a------ C:\Windows\System32\netcfg.exe
2008-02-27 03:06 . 2008-02-27 03:06 22,016 --a------ C:\Windows\System32\netiougc.exe
2008-02-27 03:05 . 2008-02-27 03:05 1,327,104 --a------ C:\Windows\System32\quartz.dll
2008-02-27 03:05 . 2008-02-27 03:05 223,232 --a------ C:\Windows\System32\WMASF.DLL
2008-02-27 03:05 . 2008-02-27 03:05 130,048 --a------ C:\Windows\System32\drivers\srv2.sys
2008-02-27 03:05 . 2008-02-27 03:05 101,888 --a------ C:\Windows\System32\drivers\mrxsmb.sys
2008-02-27 03:05 . 2008-02-27 03:05 84,992 --a------ C:\Windows\System32\drivers\srvnet.sys
2008-02-27 03:05 . 2008-02-27 03:05 58,368 --a------ C:\Windows\System32\drivers\mrxsmb20.sys
2008-02-27 03:05 . 2008-02-27 03:05 11,776 --a------ C:\Windows\System32\sbunattend.exe
2008-02-27 03:05 . 2008-02-27 03:05 9,728 --a------ C:\Windows\System32\LAPRXY.DLL
2008-02-27 03:05 . 2008-02-27 03:05 2,048 --a------ C:\Windows\System32\asferror.dll
2008-02-27 03:04 . 2008-02-27 03:04 <REP> d-------- C:\Program Files\MSXML 4.0
2008-02-27 03:04 . 2008-02-27 03:04 3,504,824 --a------ C:\Windows\System32\ntkrnlpa.exe
2008-02-27 03:04 . 2008-02-27 03:04 3,470,520 --a------ C:\Windows\System32\ntoskrnl.exe
2008-02-27 03:03 . 2008-02-27 03:03 2,048 --a------ C:\Windows\System32\tzres.dll
2008-02-26 22:09 . 2008-02-27 22:14 <REP> d-------- C:\War III Ced
2008-02-26 21:43 . 2008-02-26 21:43 283 --a------ C:\Windows\game.ini
2008-02-26 19:32 . 2008-02-26 19:32 1,712,984 --a------ C:\Windows\System32\wuaueng.dll
2008-02-26 19:32 . 2008-02-26 19:32 1,524,224 --a------ C:\Windows\System32\wucltux.dll
2008-02-26 19:32 . 2008-02-26 19:32 53,080 --a------ C:\Windows\System32\wuauclt.exe
2008-02-26 19:32 . 2008-02-26 19:32 43,352 --a------ C:\Windows\System32\wups2.dll
2008-02-26 19:31 . 2008-02-26 19:31 549,720 --a------ C:\Windows\System32\wuapi.dll
2008-02-26 19:31 . 2008-02-26 19:31 163,000 --a------ C:\Windows\System32\wuwebv.dll
2008-02-26 19:31 . 2008-02-26 19:31 80,896 --a------ C:\Windows\System32\wudriver.dll
2008-02-26 19:31 . 2008-02-26 19:31 33,624 --a------ C:\Windows\System32\wups.dll
2008-02-26 19:31 . 2008-02-26 19:31 31,232 --a------ C:\Windows\System32\wuapp.exe
2008-02-26 19:11 . 2008-02-26 19:26 <REP> d--hsc--- C:\Program Files\Common Files\WindowsLiveInstaller
2008-02-26 19:10 . 2008-02-26 19:10 <REP> d-------- C:\Users\All Users\WLInstaller
2008-02-26 19:10 . 2008-02-26 19:10 <REP> d-------- C:\ProgramData\WLInstaller
2008-02-26 19:10 . 2008-02-26 19:26 <REP> d-------- C:\Program Files\Windows Live
2008-02-26 19:04 . 2008-02-26 19:04 0 --a------ C:\Windows\nsreg.dat
2008-02-25 21:36 . 2008-02-25 21:36 <REP> d-------- C:\Program Files\JoWooD

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-03-25 22:46 --------- d-----w C:\Program Files\WinTV
2008-03-22 14:06 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-03-11 23:07 --------- d-----w C:\Program Files\Privé
2008-02-27 03:54 --------- d-----w C:\Program Files\Windows Sidebar
2008-02-27 02:07 54,784 ----a-w C:\Windows\system32\drivers\i8042prt.sys
2008-02-27 02:07 495,160 ----a-w C:\Windows\system32\drivers\Wdf01000.sys
2008-02-27 02:07 35,384 ----a-w C:\Windows\system32\drivers\WdfLdr.sys
2008-02-27 02:07 35,384 ----a-w C:\Windows\system32\drivers\kbdclass.sys
2008-02-27 02:07 34,360 ----a-w C:\Windows\system32\drivers\mouclass.sys
2008-02-27 02:07 19,968 ----a-w C:\Windows\system32\drivers\sermouse.sys
2008-02-27 02:07 15,872 ----a-w C:\Windows\system32\drivers\mouhid.sys
2008-02-27 02:07 15,872 ----a-w C:\Windows\system32\drivers\kbdhid.sys
2008-02-27 02:02 52,736 ----a-w C:\Windows\AppPatch\iebrshim.dll
2008-02-26 21:12 --------- d-----w C:\ProgramData\Dell
2008-02-26 20:43 22,328 ----a-w C:\Windows\system32\drivers\PnkBstrK.sys
2008-02-26 20:43 22,328 ----a-w C:\Users\Yevgi\AppData\Roaming\PnkBstrK.sys
2008-02-25 18:40 --------- d-----w C:\Users\Yevgi\AppData\Roaming\La Bataille pour la Terre du Milieu
2008-02-24 22:24 --------- d-----w C:\Users\Yevgi\AppData\Roaming\PeerNetworking
2008-02-24 20:51 --------- d-----w C:\Users\Yevgi\AppData\Roaming\InstallShield
2008-02-22 14:17 --------- d-----w C:\Program Files\Activision Value
2008-02-22 14:15 --------- d-----w C:\ProgramData\Media Center Programs
2008-02-14 21:49 --------- d-----w C:\Program Files\3DO
2008-02-14 15:43 --------- d-----w C:\ProgramData\OrbNetworks
2008-02-14 15:42 --------- d-----w C:\Program Files\Orb Networks
2008-02-13 16:31 --------- d-----w C:\Program Files\vtplus
2008-02-13 16:31 --------- d-----w C:\Program Files\Common Files\IviSDK
2008-02-12 15:02 278,984 ----a-w C:\Windows\system32\drivers\atksgt.sys
2008-02-12 14:41 --------- d-----w C:\Program Files\Alcohol Soft
2008-02-12 14:38 715,248 ----a-w C:\Windows\system32\drivers\sptd.sys
2008-02-11 20:04 --------- d-----w C:\Program Files\OpenAL
2008-02-11 15:38 --------- d-----w C:\Program Files\WinAce
2008-01-25 12:10 --------- d-----w C:\Program Files\Google
2008-01-16 21:14 537,600 ----a-w C:\Windows\AppPatch\AcLayers.dll
2008-01-16 21:14 449,536 ----a-w C:\Windows\AppPatch\AcSpecfc.dll
2008-01-16 21:14 2,144,256 ----a-w C:\Windows\AppPatch\AcGenral.dll
2008-01-16 21:14 173,056 ----a-w C:\Windows\AppPatch\AcXtrnal.dll
2008-01-16 13:26 174 --sha-w C:\Program Files\desktop.ini
.

((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DellSupportCenter"="C:\Program Files\Dell Support Center\bin\sprtcmd.exe" [2007-11-15 10:23 202544]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [2008-01-16 22:12 1006264]
"ECenter"="C:\Dell\E-Center\EULALauncher.exe" [2007-05-25 07:03 17920]
"SigmatelSysTrayApp"="C:\Program Files\SigmaTel\C-Major Audio\WDM\sttray.exe" [2007-09-12 09:40 405504]
"NvSvc"="C:\Windows\system32\nvsvc.dll" [2007-10-25 05:52 86016]
"NvCplDaemon"="C:\Windows\system32\NvCpl.dll" [2007-10-25 05:52 8530464]
"NvMediaCenter"="C:\Windows\system32\NvMcTray.dll" [2007-10-25 05:52 81920]
"Windows Mobile Device Center"="%windir%\WindowsMobile\wmdc.exe" [ ]
"SunJavaUpdateSched"="c:\Program Files\Java\jre1.6.0\bin\jusched.exe" [2008-01-16 14:35 77824]
"PMX Daemon"="ICO.EXE" [2006-11-08 16:01 49152 C:\Windows\System32\ico.exe]
"IAAnotif"="C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe" [2007-07-26 20:03 178712]
"MskAgentexe"="C:\Program Files\McAfee\MSK\MskAgent.exe" [2007-01-17 18:30 152144]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 04:06 40048]
"MSServer"="C:\Windows\system32\hgggd.dll" [2008-01-30 13:48 39424]
"NMSSupport"="C:\Program Files\Common Files\Intel\IntelDH\NMS\Support\IntelHCTAgent.exe" [2007-06-27 11:14 439512]
"CCUTRAYICON"="C:\Program Files\Intel\IntelDH\CCU\CCU_TrayIcon.exe" [2007-06-27 11:18 215256]
"dscactivate"="C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe" [2007-11-15 10:24 16384]
"WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2007-05-14 23:22 35328]
"EPGServiceTool"="C:\PROGRA~1\WinTV\EPG Services\System\EPGClient.exe" [2007-08-01 04:26 675840]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{89A1E40D-0254-4F99-B9AE-B60A2D8754A9}"= C:\Windows\system32\hgggd.dll [2008-01-30 13:48 39424]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Orb]
--a------ 2007-01-20 01:50 253952 C:\Program Files\Orb Networks\Orb\bin\OrbTray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiSpyware]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\DomainProfile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{6AAD1578-915F-4998-BDA1-52BFA57029CF}"= UDP:Profile=Private:LocalSubnet:LocalSubnet|C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\TSHWMDTCP.exe:SPCM
"{18AC111E-2A35-40DF-9C7F-DD1C2DE51374}"= TCP:Profile=Private:LocalSubnet:LocalSubnet|C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\TSHWMDTCP.exe:SPCM
"{A7DED6C4-07F0-45A6-9996-070565830F4C}"= UDP:Profile=Private:LocalSubnet:LocalSubnet|C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\Remote UI Service.exe:Intel(R) Remoting Service
"{54A17BD3-500D-4B5F-8527-6F9AC998C6B2}"= TCP:Profile=Private:LocalSubnet:LocalSubnet|C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\Remote UI Service.exe:Intel(R) Remoting Service
"{B6BCF073-E804-4B7C-8052-6941137F6B2C}"= UDP:Profile=Private:LocalSubnet:LocalSubnet|C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\mediaserver.exe:Intel(R) Viiv(TM) Media Server
"{4A78A54D-0354-43C7-808E-576081A84C4B}"= TCP:Profile=Private:LocalSubnet:LocalSubnet|C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\mediaserver.exe:Intel(R) Viiv(TM) Media Server
"{96E2687C-5A4C-484B-B4B9-B33BF1F9A28B}"= TCP:Profile=Private|9442:127.0.0.1:Intel(R) Viiv(TM) Media Server Discovery
"{4181C01B-F7E9-442F-866F-F261BF4CB017}"= TCP:Profile=Private|1900:LocalSubnet:LocalSubnet:Intel(R) Viiv(TM) Media Server UPnP Discovery
"{576B83F1-55B7-4E5C-B759-DA22FD58BA3D}"= Profile=Private|C:\Program Files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
"{39274DBA-3908-4088-9106-01CF744A4DC5}"= Disabled:UDP:C:\Games\Call of Duty 4\iw3mp.exe:Call of Duty(R) 4 - Modern Warfare(TM)
"{A19363A0-21C0-46F2-B6BF-0ABE464704FC}"= Disabled:TCP:C:\Games\Call of Duty 4\iw3mp.exe:Call of Duty(R) 4 - Modern Warfare(TM)
"{3ACB499E-D69E-4353-94A8-E12CDC3A11ED}"= Disabled:UDP:C:\Games\Crysis\Bin32\Crysis.exe:Crysis_32
"{14107EEC-276D-4160-B14A-3838E5DFDCD2}"= Disabled:TCP:C:\Games\Crysis\Bin32\Crysis.exe:Crysis_32
"{8FDC5EBC-FA74-4128-86FF-836DEA7F819B}"= Disabled:UDP:C:\Games\Crysis\Bin32\CrysisDedicatedServer.exe:CrysisDedicatedServer_32
"{4834F166-A192-4A8C-BC63-7E7B292E395A}"= Disabled:TCP:C:\Games\Crysis\Bin32\CrysisDedicatedServer.exe:CrysisDedicatedServer_32
"{A08E7197-2161-4CC6-82C7-0EA363F8CAA9}"= Disabled:UDP:C:\Games\Hellgate London\Launcher.exe:Hellgate : London
"{F38AA40C-0FEA-4CAF-9886-E56E244A87A7}"= Disabled:TCP:C:\Games\Hellgate London\Launcher.exe:Hellgate : London
"{C7A61758-6BFE-4512-AD95-FBC7A186726B}"= Disabled:UDP:C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\Remote UI Service.exe:Intel(R) Remoting Service
"{7E17D8F2-5EFF-407C-8425-D1AAC2FBA291}"= Disabled:TCP:C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\Remote UI Service.exe:Intel(R) Remoting Service
"{728C4C0C-2F7C-4907-B744-EAFAD898565C}"= Disabled:UDP:C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\mediaserver.exe:Intel(R) Viiv(TM) Media Server
"{206771A1-0D66-4FBB-A661-7CE1036D1722}"= Disabled:TCP:C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\mediaserver.exe:Intel(R) Viiv(TM) Media Server
"{472FEFB9-5F97-4631-892C-71F522C8F352}"= Disabled:TCP:9442:127.0.0.1:Intel(R) Viiv(TM) Media Server Discovery
"{92BE3A66-C0EC-41AC-BF6B-5B3C7E54399D}"= Disabled:TCP:1900:LocalSubnet:LocalSubnet:Intel(R) Viiv(TM) Media Server UPnP Discovery
"{DE066973-A17E-4EE6-A6DE-205B134FF5F8}"= Disabled:UDP:C:\Games\Kane and Lynch Dead Men\kaneandlynch.exe:Kane & Lynch: Dead Men
"{637E9979-5AC3-4C24-891F-EFD122252082}"= Disabled:TCP:C:\Games\Kane and Lynch Dead Men\kaneandlynch.exe:Kane & Lynch: Dead Men
"{61A1497C-72BF-49D6-9E8B-DCA183CB9E65}"= Disabled:UDP:C:\Program Files\Common Files\McAfee\MNA\McNASvc.exe:McAfee Network Agent
"{4706CD56-9A34-43AA-98CC-B608D0CD77E4}"= Disabled:TCP:C:\Program Files\Common Files\McAfee\MNA\McNASvc.exe:McAfee Network Agent
"{7535E2C1-FB0F-415B-8E83-96EE9B86C122}"= Disabled:UDP:C:\Program Files\Orb Networks\Orb\bin\Orb.exe:Orb
"{6376B9CC-1226-4DFD-9F9F-5D4378212C80}"= Disabled:TCP:C:\Program Files\Orb Networks\Orb\bin\Orb.exe:Orb
"{75E9ED74-4BE8-4728-883E-4D478C9C0536}"= Disabled:UDP:C:\Program Files\Orb Networks\Orb\bin\OrbStreamerClient.exe:Orb Stream Client
"{03B74D9B-52D6-4E44-8D77-6DD3D6120827}"= Disabled:TCP:C:\Program Files\Orb Networks\Orb\bin\OrbStreamerClient.exe:Orb Stream Client
"{2A6F5EE6-0678-4B91-A9A7-899B8A27EDB0}"= Disabled:UDP:C:\Program Files\Orb Networks\Orb\bin\OrbChannelScan.exe:OrbChannelScan
"{06D38823-7317-4CD0-AE6F-AABCB3FFF20A}"= Disabled:TCP:C:\Program Files\Orb Networks\Orb\bin\OrbChannelScan.exe:OrbChannelScan
"{B288497A-CCFC-46DF-ABDB-716CB0799157}"= Disabled:UDP:C:\Program Files\Orb Networks\Orb\bin\OrbTray.exe:OrbTray
"{9A2EB351-E5FA-43A6-928C-A22EF79749C9}"= Disabled:TCP:C:\Program Files\Orb Networks\Orb\bin\OrbTray.exe:OrbTray
"{5ACEED7A-407C-4AB4-A571-29C73B3307E1}"= Disabled:UDP:C:\Program Files\Orb Networks\Orb\bin\OrbIR.exe:OrbTray
"{107FF459-B3C1-4C55-952E-125C85289A91}"= Disabled:TCP:C:\Program Files\Orb Networks\Orb\bin\OrbIR.exe:OrbTray
"{871C11DA-C0AE-4D3A-AFF5-825D3D59483E}"= Disabled:UDP:C:\Windows\System32\PnkBstrA.exe:PnkBstrA
"{FEC8ED3C-AEA4-4CB6-B9D9-E5F0B6AD1AE4}"= Disabled:TCP:C:\Windows\System32\PnkBstrA.exe:PnkBstrA
"{2C5B71BA-CA9F-4329-A9AB-3C2EB7C172CC}"= Disabled:UDP:C:\Windows\System32\PnkBstrB.exe:PnkBstrB
"{FC6FF96E-8C6F-4699-B3CC-FC5E792F42F1}"= Disabled:TCP:C:\Windows\System32\PnkBstrB.exe:PnkBstrB
"{EC4D42F4-5C2E-4D94-B341-F61ED5299CFD}"= Disabled:UDP:C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\TSHWMDTCP.exe:SPCM
"{B3ACCF04-F864-4239-8BE9-ED6FB40335A5}"= Disabled:TCP:C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\TSHWMDTCP.exe:SPCM
"{B20F75E6-6BFB-4DBA-B617-CB43214D6FFE}"= Disabled:C:\Program Files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
"{D6AFAE1A-1E04-4756-A005-32BF671684B1}"= UDP:C:\Games\Unreal Tournament 3\Binaries\UT3.exe:Unreal Tournament 3
"{85645E76-807A-42CF-8F29-92E2E372B6A6}"= TCP:C:\Games\Unreal Tournament 3\Binaries\UT3.exe:Unreal Tournament 3
"{290A071E-AA96-4F92-8E57-1468269FC951}"= UDP:C:\Games\S.T.A.L.K.E.R\bin\XR_3DA.exe:S.T.A.L.K.E.R. (CLI)
"{8E121631-EA0B-4727-B481-8F9812E24E72}"= TCP:C:\Games\S.T.A.L.K.E.R\bin\XR_3DA.exe:S.T.A.L.K.E.R. (CLI)
"{E01ED21F-5185-4BE9-8BC7-BF974054547A}"= UDP:C:\Games\S.T.A.L.K.E.R\bin\dedicated\XR_3DA.exe:S.T.A.L.K.E.R. (SRV)
"{09B819DD-E041-405C-9433-312ED4C05E25}"= TCP:C:\Games\S.T.A.L.K.E.R\bin\dedicated\XR_3DA.exe:S.T.A.L.K.E.R. (SRV)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile]
"DoNotAllowExceptions"= 1 (0x1)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\RestrictedServices\Static\System]
"DFSR-1"= RPort=5722|UDP:%SystemRoot%\system32\svchost.exe|Svc=DFSR:Allow inbound TCP traffic|

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile]
"EnableFirewall"= 0 (0x0)

R0 pe3ajtsb;Stalker (Pro) Environment Driver (pe3ajtsb);C:\Windows\system32\drivers\pe3ajtsb.sys [2007-03-05 15:58]
R0 ps6ajtsb;Stalker (Pro) Synchronization Driver (ps6ajtsb);C:\Windows\system32\drivers\ps6ajtsb.sys [2007-03-05 15:57]
R2 DQLWinService;DQLWinService;"C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe" [2007-02-12 12:46]
R2 EPGService;EPGService;C:\PROGRA~1\WinTV\EPG Services\System\EPGService.exe [2007-09-05 17:46]
R2 NMSCore;Intel(R) NMSCore;"C:\Program Files\Common Files\Intel\IntelDH\NMS\NMSCore\NMSCore.exe" [2007-06-27 11:14]
R2 nmsunidr;UniDriver for NMS;C:\Windows\system32\DRIVERS\nmsunidr.sys [2007-02-18 21:34]
R2 QualityManager;Intel(R) Quality Manager;"C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\qualitymanager.exe" [2007-06-27 11:17]
R2 RapiMgr;Windows Mobile-based device connectivity;C:\Windows\system32\svchost.exe [2006-11-02 10:45]
R2 sprtsvc_dellsupportcenter;SupportSoft Sprocket Service (dellsupportcenter);C:\Program Files\Dell Support Center\bin\sprtsvc.exe [2007-11-15 10:23]
R2 WcesComm;Windows Mobile-2003-based device connectivity;C:\Windows\system32\svchost.exe [2006-11-02 10:45]
R3 HCW88BDA;Hauppauge WinTV 88x DVB Tuner/Demod;C:\Windows\system32\drivers\hcw88bda.sys [2007-01-23 19:25]
R3 hcw88rc5;Hauppauge WinTV 88x IR Decoder;C:\Windows\system32\Drivers\hcw88rc5.sys [2007-01-23 19:26]
R3 HCW88TSE;Hauppauge WinTV 88x MPEG/TS Capture;C:\Windows\system32\drivers\hcw88tse.sys [2007-01-23 19:36]
R3 hcw88vid;Hauppauge WinTV 88x Video;C:\Windows\system32\drivers\hcw88vid.sys [2007-01-23 19:36]
R3 IntelDH;IntelDH Driver;C:\Windows\system32\Drivers\IntelDH.sys [2008-01-16 14:41]
R3 pmxmouse;PMXMOUSE;C:\Windows\system32\DRIVERS\pmxmouse.sys [2007-06-01 14:41]
R3 pmxusblf;PMXUSBLF;C:\Windows\system32\DRIVERS\pmxusblf.sys [2007-05-24 17:44]
S2 pr2ajtsb;Stalker (Pro) Drivers Auto Removal (pr2ajtsb);C:\Windows\system32\pr2ajtsb.exe svc []
S3 DHTRACE;Intel(R) DHTrace Controller;C:\Program Files\Common Files\Intel\IntelDH\bin\DHTraceController.exe [2007-06-27 11:15]
S3 HauppaugeTVServer;HauppaugeTVServer;C:\PROGRA~1\WinTV\HCWTVS~1.EXE [2007-02-20 15:11]
S3 R300;R300;C:\Windows\system32\DRIVERS\atikmdag.sys [2006-11-02 08:36]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bthsvcs REG_MULTI_SZ BthServ
WindowsMobile REG_MULTI_SZ wcescomm rapimgr
LocalServiceRestricted REG_MULTI_SZ WcesComm RapiMgr

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{5fb81c2c-d978-11dc-9157-001d0924fd9a}]
\shell\AutoRun\command - J:\autoplay.exe

.
Contenu du dossier 'Scheduled Tasks/Tƒches planifi‚es'
"2008-01-16 13:44:15 C:\Windows\Tasks\McDefragTask.job"
- c:\program files\mcafee\mqc\QcConsol.exe'
"2008-03-01 00:00:02 C:\Windows\Tasks\McQcTask.job"
- c:\program files\mcafee\mqc\QcConsol.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-03-25 23:46:36
Windows 6.0.6000 NTFS

Balayage processus cach‚s ...

Balayage cach‚ autostart entries ...

Balayage des fichiers cach‚s ...

Scan termin‚ avec succŠs
Les fichiers cach‚s: 0

**************************************************************************
.
--------------------- DLLs a charg‚ sous des processus courants ---------------------

PROCESS: C:\Windows\system32\winlogon.exe
-> C:\Windows\system32\hgggd.dll
.
------------------------ Other Running Processes ------------------------
.
C:\Windows\system32\WUDFHost.exe
C:\Program Files\Intel\IntelDH\CCU\AlertService.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
c:\program files\common files\mcafee\mna\mcnasvc.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
C:\PROGRA~1\McAfee\MSC\mcpromgr.exe
c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
c:\PROGRA~1\COMMON~1\mcafee\redirsvc\redirsvc.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\McAfee\MPF\MPFSrv.exe
C:\PROGRA~1\McAfee\MPS\mps.exe
C:\Program Files\McAfee\MSK\MskSrver.exe
C:\Windows\system32\PnkBstrA.exe
C:\Windows\system32\PnkBstrB.exe
C:\Program Files\McAfee\MPS\mpsevh.exe
C:\Windows\system32\STacSV.exe
C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\ISSM.exe
C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\MCLServiceATL.exe
C:\Windows\system32\WUDFHost.exe
C:\PROGRA~1\McAfee\MSC\mcregist.exe
C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\mediaserver.exe
C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\Remote UI Service.exe
C:\Windows\system32\conime.exe
C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe
C:\Windows\WindowsMobile\wmdc.exe
C:\Program Files\Windows Media Player\WMPSideShowGadget.exe
C:\Windows\System32\Pmxmiced.exe
C:\Program Files\Windows Mail\WindowsMailGadget.exe
C:\Program Files\Windows Media Player\wmplayer.exe
C:\Program Files\Windows Mail\WinMail.exe
C:\Program Files\Intel\IntelDH\CCU\CCU_Engine.exe
C:\Program Files\WinTV\EPG Services\System\EPGClient.exe
C:\Program Files\Windows Media Player\WMPNSCFG.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Program Files\WinTV\Ir.exe
C:\Games\Heroes3\Register\Remind32.exe
c:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\Program Files\Dell Support Center\gs_agent\dsc.exe
.
**************************************************************************
.
Temps d'accomplissement: 2008-03-25 23:49:40 - machine was rebooted
ComboFix-quarantined-files.txt 2008-03-25 22:49:35
.
2008-02-27 02:09:03 --- E O F ---


en gros j'ai plus le bug mais la j'ai des APPCRASH sur certain jeu et meme windows au demarage...
il y a un example du APPCRASH sur Dungeon lords dans un autre discution que j'ai commancer...
0
Réponse 10 / 25
green day Messages postés 26371 Date d'inscription vendredi 30 septembre 2005 Statut Modérateur, Contributeur sécurité Dernière intervention 27 décembre 2019 2 162
5 avril 2008 à 20:55
Salut

il reste encore des saletés !

Télécharge SDFix sur ton bureau

http://downloads.andymanchesta.com/RemovalTools/SDFix.exe

Double clique sur SDFix.exe et choisis Install pour l'extraire dans un dossier dédié sur le Bureau.
Redémarre ton ordinateur en mode sans échec
Ouvre le dossier SDFix qui vient d'être créé sur le Bureau et double clique sur RunThis.cmd pour lancer le script.
Appuie sur Y pour commencer le processus de nettoyage.
Il va supprimer les services et les entrées du Registre de certains trojans trouvés puis te demandera d'appuyer sur une touche pour redémarrer.
Appuie sur une touche pour redémarrer le PC.
Ton système sera plus long pour redémarrer qu'à l'accoutumée car l'outil va continuer à s'exécuter et supprimer des fichiers.
Après le chargement du Bureau, l'outil terminera son travail et affichera Finished.
Appuie sur une touche pour finir l'exécution du script et charger les icônes de ton Bureau.
Les icônes du Bureau affichées, le rapport SDFix s'ouvrira à l'écran et s'enregistrera aussi dans le dossier SDFix sous le nom Report.txt.
Enfin, copie/colle le contenu du fichier Report.txt dans ta prochaine réponse sur le forum, avec un nouveau log Hijackthis !

++
0
yevgi Messages postés 78 Date d'inscription jeudi 21 février 2008 Statut Membre Dernière intervention 5 août 2009 6
5 avril 2008 à 23:57
dac
mais au redemarage aprés l'operation est-ce qu'il faut que je le redemare encore en mode sans echec ou ce n'est plus obligatoire?
0
Réponse 11 / 25
green day Messages postés 26371 Date d'inscription vendredi 30 septembre 2005 Statut Modérateur, Contributeur sécurité Dernière intervention 27 décembre 2019 2 162
6 avril 2008 à 16:46
Salut

après l'opération redémarre en mode normal et poste le rapport stp

++
0
yevgi Messages postés 78 Date d'inscription jeudi 21 février 2008 Statut Membre Dernière intervention 5 août 2009 6
14 avril 2008 à 23:15
voila le raport de SDfix:

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-04-07 22:20:17
Windows 6.0.6000 NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg]
"s1"=dword:2df9c43f
"s2"=dword:110480d0
"h0"=dword:00000001

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04]
"p0"="C:\Program Files\Alcohol Soft\Alcohol 52\"
"h0"=dword:00000000
"ujdew"=hex:a4,47,2e,4e,47,9e,83,cf,3a,98,1a,df,9d,89,40,b1,95,92,33,e2,f8,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04]
"p0"="C:\Program Files\Alcohol Soft\Alcohol 52\"
"h0"=dword:00000000
"ujdew"=hex:a4,47,2e,4e,47,9e,83,cf,3a,98,1a,df,9d,89,40,b1,95,92,33,e2,f8,..

scanning hidden registry entries ...

scanning hidden files ...

C:\ProgramData\Microsoft\Windows\GameExplorer\{3F8ADF37-A217-4A9E-9EE6-E99C9594CE83}\SupportTasks\0\Visiter le site officiel de Hellgate : London.lnk 612 bytes hidden from API

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 1

file zipped: C:\ProgramData\Microsoft\Windows\GameExplorer\{3F8ADF37-A217-4A9E-9EE6-E99C9594CE83}\SupportTasks\0\Visiter le site officiel de Hellgate : London.lnk -> catchme.zip -> London.lnk ( 612 bytes )


est-ce que c'est normal qu'il parle de "catchme"?


voila le raport de hijackthis:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 22:27:14, on 07/04/2008
Platform: Windows Vista (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16609)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
c:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\Program Files\McAfee\MPS\mpsevh.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Sigmatel\C-Major Audio\WDM\sttray.exe
C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe
C:\Windows\WindowsMobile\wmdc.exe
C:\Program Files\Java\jre1.6.0\bin\jusched.exe
c:\PROGRA~1\mcafee\VIRUSS~1\mcvsshld.exe
C:\Windows\System32\ico.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
C:\Windows\System32\Pmxmiced.exe
C:\Program Files\McAfee\MSK\mskagent.exe
C:\Program Files\Common Files\Intel\IntelDH\NMS\Support\IntelHCTAgent.exe
C:\PROGRA~1\McAfee\MSC\mcregist.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\Windows Mail\WinMail.exe
C:\Program Files\Dell Support Center\bin\sprtcmd.exe
C:\Program Files\WinTV\Ir.exe
C:\Windows\Explorer.exe
C:\Windows\System32\mobsync.exe
C:\Program Files\Windows Media Player\wmplayer.exe
C:\Program Files\Windows Media Player\WMPSideShowGadget.exe
C:\Program Files\Windows Mail\WindowsMailGadget.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\Program Files\Windows Media Player\WMPNSCFG.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - c:\Program Files\Java\jre1.6.0\bin\ssv.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - c:\program files\mcafee\virusscan\scriptcl.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\Dell\BAE\BAE.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [ECenter] C:\Dell\E-Center\EULALauncher.exe
O4 - HKLM\..\Run: [SigmatelSysTrayApp] C:\Program Files\SigmaTel\C-Major Audio\WDM\sttray.exe
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Windows Mobile Device Center] %windir%\WindowsMobile\wmdc.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "c:\Program Files\Java\jre1.6.0\bin\jusched.exe"
O4 - HKLM\..\Run: [PMX Daemon] ICO.EXE
O4 - HKLM\..\Run: [IAAnotif] "C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe"
O4 - HKLM\..\Run: [MskAgentexe] C:\Program Files\McAfee\MSK\MskAgent.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [MSServer] rundll32.exe C:\Windows\system32\tuvsq.dll,#1
O4 - HKLM\..\Run: [NMSSupport] "C:\Program Files\Common Files\Intel\IntelDH\NMS\Support\IntelHCTAgent.exe" /startup
O4 - HKLM\..\Run: [CCUTRAYICON] "C:\Program Files\Intel\IntelDH\CCU\CCU_TrayIcon.exe"
O4 - HKLM\..\Run: [dscactivate] "C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe"
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [EPGServiceTool] C:\PROGRA~1\WinTV\EPG Services\System\EPGClient.exe
O4 - HKCU\..\Run: [DellSupportCenter] "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCenter
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-21-31434581-3181455718-583861208-1000\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'IUSR_NMPR')
O4 - Global Startup: AutoStart IR.lnk = C:\Program Files\WinTV\Ir.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - c:\Program Files\Java\jre1.6.0\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - c:\Program Files\Java\jre1.6.0\bin\ssv.dll
O9 - Extra button: @C:\Windows\WindowsMobile\INetRepl.dll,-222 - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra 'Tools' menuitem: @C:\Windows\WindowsMobile\INetRepl.dll,-223 - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O13 - Gopher Prefix:
O17 - HKLM\System\CCS\Services\Tcpip\..\{7A02E051-227A-459C-932E-817F1D4AAB89}: NameServer = 192.168.1.1
O23 - Service: Intel(R) Alert Service (AlertService) - Intel(R) Corporation - C:\Program Files\Intel\IntelDH\CCU\AlertService.exe
O23 - Service: Intel(R) DHTrace Controller (DHTRACE) - Intel(R) Corporation - C:\Program Files\Common Files\Intel\IntelDH\bin\DHTraceController.exe
O23 - Service: DQLWinService - Unknown owner - C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe
O23 - Service: McAfee E-mail Proxy (Emproxy) - McAfee, Inc. - C:\PROGRA~1\COMMON~1\McAfee\EmProxy\emproxy.exe
O23 - Service: EPGService - Hauppauge Computer Works - C:\PROGRA~1\WinTV\EPG Services\System\EPGService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: HauppaugeTVServer - Hauppauge Computer Works - C:\PROGRA~1\WinTV\HCWTVS~1.EXE
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Intel(R) Software Services Manager (ISSM) - Intel(R) Corporation - C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\ISSM.exe
O23 - Service: Intel(R) Viiv(TM) Media Server (M1 Server) - Unknown owner - C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\mediaserver.exe
O23 - Service: McAfee HackerWatch Service - McAfee, Inc. - C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe
O23 - Service: Intel(R) Application Tracker (MCLServiceATL) - Intel(R) Corporation - C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\MCLServiceATL.exe
O23 - Service: McAfee Update Manager (mcmispupdmgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcupdmgr.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\program files\common files\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
O23 - Service: McAfee Protection Manager (mcpromgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcpromgr.exe
O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
O23 - Service: McAfee Redirector Service (McRedirector) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\redirsvc\redirsvc.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
O23 - Service: McAfee Privacy Service (MPS9) - McAfee, Inc. - C:\PROGRA~1\McAfee\MPS\mps.exe
O23 - Service: McAfee SpamKiller Service (MSK80Service) - McAfee Inc. - C:\Program Files\McAfee\MSK\MskSrver.exe
O23 - Service: Intel(R) NMSCore (NMSCore) - Intel(R) Corporation - C:\Program Files\Common Files\Intel\IntelDH\NMS\NMSCore\NMSCore.exe
O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe
O23 - Service: PnkBstrB - Unknown owner - C:\Windows\system32\PnkBstrB.exe
O23 - Service: Intel(R) Quality Manager (QualityManager) - Intel(R) Corporation - C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\qualitymanager.exe
O23 - Service: Intel(R) Remoting Service (Remote UI Service) - Intel(R) Corporation - C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\Remote UI Service.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: SupportSoft Sprocket Service (dellsupportcenter) (sprtsvc_dellsupportcenter) - SupportSoft, Inc. - C:\Program Files\Dell Support Center\bin\sprtsvc.exe
O23 - Service: SigmaTel Audio Service (STacSV) - SigmaTel, Inc. - C:\Windows\system32\STacSV.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe
0
Réponse 12 / 25
green day Messages postés 26371 Date d'inscription vendredi 30 septembre 2005 Statut Modérateur, Contributeur sécurité Dernière intervention 27 décembre 2019 2 162
14 avril 2008 à 23:25
oui, normal

où en sont tes soucis ??

++
0
Réponse 13 / 25
yevgi Messages postés 78 Date d'inscription jeudi 21 février 2008 Statut Membre Dernière intervention 5 août 2009 6
15 avril 2008 à 11:31
bah en fait lu bug qui a tout commancer est disparu ^^
mais... (y a toujours un mais ^^)
pendant un court moment j'au eu un crash de Windows a chaque fois que j'allumer le pc.
j'ai pris la signature du probleme:

Nom d’événement de problème: APPCRASH
Nom de l’application: Explorer.EXE
Version de l’application: 6.0.6000.16386
Horodatage de l'application: 4549b091
Nom du module par défaut: hggge.dll
Version du module par défaut: 0.0.0.0
Horodateur du module par défaut: 475d72a4
Code de l’exception: c0000005
Décalage de l’exception: 000036b2
Version du système: 6.0.6000.2.0.0.768.3
Identificateur de paramètres régionaux: 1036
Information supplémentaire n° 1: 8d13
Information supplémentaire n° 2: cdca9b1d21d12b77d84f02df48e34311
Information supplémentaire n° 3: 8d13
Information supplémentaire n° 4: cdca9b1d21d12b77d84f02df48e34311



en ce moment je l'ai plus avec windows mais il contiue de me le faire sur certain jeux (Dungeon lords (voir discution lancer avec la signature du probleme), assassins creed (j'ai la version en anglais)).
sinon j'ai retrouvé un ancien probleme que j'ai pas vu depuis un moment
tout le temps j'ai un message qui s'affiche.
il s'agit de la fenetre rectanculaire ou il est ecrit :
"aucune connexion a internet n'est disponible actuellement.
pour afficher le contenu internet enregistré sur votre ordinateur, cliquer sur travailler hors connexion
cliquer sur recommencer pour tenter de vous reconecter"

et donc je clique sur "travailler hors connection " et je continue mon activité mais une heure aprés (a 5 min prés) cette fenetre revient et ainsi de suite...

le truc c'est que sur le pc concerner j'ai pas internet alors je sai pas quoi faire pour l'arreter...snif


merci bcp pour ton aide
0
Réponse 14 / 25
green day Messages postés 26371 Date d'inscription vendredi 30 septembre 2005 Statut Modérateur, Contributeur sécurité Dernière intervention 27 décembre 2019 2 162
15 avril 2008 à 19:28
Salut

une petite vérif :

télécharge ceci : http://www.commentcamarche.net/telecharger/telecharger 34055379 malwarebyte s anti malware
* Installez le programme sur le bureau :
o S'il manque le fichier COMCTL32.OCX, vous pourrez le télécharger ici
* Faites les mises à jour (clic sur Mises à jour puis Recherche de mises à jour)
* Démarrez en mode sans échec
* Lancez le MalwareByte's Anti-Malware, cliquez sur Exécuter un examen complet puis Rechercher et sélectionnez tous tes disques durs
* Une fois le scan terminé, cliquez sur supprimer (si un message demande à redémarrer le PC, acceptez !)
* Un rapport sera généré, enregistrez le de manière à le retrouver

==> poste le stp !

++
0
yevgi Messages postés 78 Date d'inscription jeudi 21 février 2008 Statut Membre Dernière intervention 5 août 2009 6
16 avril 2008 à 00:33
que veut tu dire par les mise a jours?
l'ordinateur concerné n'a pas de connexion internet alor pour les faire ca serrai assez difficile...
0
Réponse 15 / 25
green day Messages postés 26371 Date d'inscription vendredi 30 septembre 2005 Statut Modérateur, Contributeur sécurité Dernière intervention 27 décembre 2019 2 162
17 avril 2008 à 20:23
Salut

sur l'ordi où tu le télécharge, suffit de faire la mise à jour

++
0
Réponse 16 / 25
yevgi Messages postés 78 Date d'inscription jeudi 21 février 2008 Statut Membre Dernière intervention 5 août 2009 6
7 mai 2008 à 23:44
voila le rapport :

Malwarebytes' Anti-Malware 1.12
Version de la base de données: 729

Type de recherche: Examen complet (C:\|D:\|)
Eléments examinés: 195023
Temps écoulé: 41 minute(s), 14 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 7
Valeur(s) du Registre infectée(s): 6
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 104

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
HKEY_CLASSES_ROOT\CLSID\{89a1e40d-0254-4f99-b9ae-b60a2d8754a9} (Trojan.Vundo) -> No action taken.
HKEY_CURRENT_USER\Software\Microsoft\affri (Malware.Trace) -> No action taken.
HKEY_CURRENT_USER\Software\Microsoft\affltid (Malware.Trace) -> No action taken.
HKEY_CURRENT_USER\Software\Microsoft\rdfa (Trojan.Vundo) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\affltid (Malware.Trace) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\affri (Malware.Trace) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Juan (Malware.Trace) -> No action taken.

Valeur(s) du Registre infectée(s):
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MSServer (Trojan.Vundo) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cmds (Trojan.Vundo) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\badb843f (Trojan.Vundo) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MSServer (Trojan.Vundo) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{89a1e40d-0254-4f99-b9ae-b60a2d8754a9} (Trojan.Vundo) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\BMb9e8b7a3 (Trojan.Agent) -> No action taken.

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
C:\Users\Yevgi\AppData\Local\Temp\sstqo.dll (Trojan.Vundo) -> No action taken.
C:\Users\Yevgi\AppData\Local\Temp\jkkli.dll (Trojan.Vundo) -> No action taken.
C:\Users\Yevgi\AppData\Local\Temp\ojjooowl.dll (Trojan.Vundo) -> No action taken.
C:\Windows\System32\mljih.dll (Trojan.Vundo) -> No action taken.
C:\Users\Yevgi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6KIGWFXK\css4[1] (Trojan.Vundo) -> No action taken.
C:\Users\Yevgi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\NUYQRQY2\kriv[1] (Trojan.Vundo) -> No action taken.
C:\Users\Yevgi\AppData\Local\Temp\byvsq.dll (Trojan.Vundo) -> No action taken.
C:\Users\Yevgi\AppData\Local\Temp\byxvt.dll (Trojan.Vundo) -> No action taken.
C:\Users\Yevgi\AppData\Local\Temp\byxxu.dll (Trojan.Vundo) -> No action taken.
C:\Users\Yevgi\AppData\Local\Temp\byxxx.dll (Trojan.Vundo) -> No action taken.
C:\Users\Yevgi\AppData\Local\Temp\ddabb.dll (Trojan.Vundo) -> No action taken.
C:\Users\Yevgi\AppData\Local\Temp\ddccd.dll (Trojan.Vundo) -> No action taken.
C:\Users\Yevgi\AppData\Local\Temp\efebb.dll (Trojan.Vundo) -> No action taken.
C:\Users\Yevgi\AppData\Local\Temp\efeca.dll (Trojan.Vundo) -> No action taken.
C:\Users\Yevgi\AppData\Local\Temp\fccdd.dll (Trojan.Vundo) -> No action taken.
C:\Users\Yevgi\AppData\Local\Temp\fcyvw.dll (Trojan.Vundo) -> No action taken.
C:\Users\Yevgi\AppData\Local\Temp\fcywu.dll (Trojan.Vundo) -> No action taken.
C:\Users\Yevgi\AppData\Local\Temp\gebaw.dll (Trojan.Vundo) -> No action taken.
C:\Users\Yevgi\AppData\Local\Temp\geeed.dll (Trojan.Vundo) -> No action taken.
C:\Users\Yevgi\AppData\Local\Temp\jkhfg.dll (Trojan.Vundo) -> No action taken.
C:\Users\Yevgi\AppData\Local\Temp\jkhhf.dll (Trojan.Vundo) -> No action taken.
C:\Users\Yevgi\AppData\Local\Temp\khhec.dll (Trojan.Vundo) -> No action taken.
C:\Users\Yevgi\AppData\Local\Temp\ljhgf.dll (Trojan.Vundo) -> No action taken.
C:\Users\Yevgi\AppData\Local\Temp\ljjge.dll (Trojan.Vundo) -> No action taken.
C:\Users\Yevgi\AppData\Local\Temp\mljge.dll (Trojan.Vundo) -> No action taken.
C:\Users\Yevgi\AppData\Local\Temp\mllii.dll (Trojan.Vundo) -> No action taken.
C:\Users\Yevgi\AppData\Local\Temp\opnmn.dll (Trojan.Vundo) -> No action taken.
C:\Users\Yevgi\AppData\Local\Temp\opnoo.dll (Trojan.Vundo) -> No action taken.
C:\Users\Yevgi\AppData\Local\Temp\pmkii.dll (Trojan.Vundo) -> No action taken.
C:\Users\Yevgi\AppData\Local\Temp\pmkjh.dll (Trojan.Vundo) -> No action taken.
C:\Users\Yevgi\AppData\Local\Temp\pmnlk.dll (Trojan.Vundo) -> No action taken.
C:\Users\Yevgi\AppData\Local\Temp\qomjj.dll (Trojan.Vundo) -> No action taken.
C:\Users\Yevgi\AppData\Local\Temp\qomkl.dll (Trojan.Vundo) -> No action taken.
C:\Users\Yevgi\AppData\Local\Temp\rqoml.dll (Trojan.Vundo) -> No action taken.
C:\Users\Yevgi\AppData\Local\Temp\rqrss.dll (Trojan.Vundo) -> No action taken.
C:\Users\Yevgi\AppData\Local\Temp\sstts.dll (Trojan.Vundo) -> No action taken.
C:\Users\Yevgi\AppData\Local\Temp\tmp00006076 (Trojan.Vundo) -> No action taken.
C:\Users\Yevgi\AppData\Local\Temp\tmp0000624a (Trojan.Vundo) -> No action taken.
C:\Users\Yevgi\AppData\Local\Temp\tmp000063f0 (Trojan.Vundo) -> No action taken.
C:\Users\Yevgi\AppData\Local\Temp\tmp00006805 (Trojan.Vundo) -> No action taken.
C:\Users\Yevgi\AppData\Local\Temp\tmp00006853 (Trojan.Vundo) -> No action taken.
C:\Users\Yevgi\AppData\Local\Temp\tmp0000695c (Trojan.Vundo) -> No action taken.
C:\Users\Yevgi\AppData\Local\Temp\tmp000069aa (Trojan.Vundo) -> No action taken.
C:\Users\Yevgi\AppData\Local\Temp\tmp00006a65 (Trojan.Vundo) -> No action taken.
C:\Users\Yevgi\AppData\Local\Temp\tmp00006ae2 (Trojan.Vundo) -> No action taken.
C:\Users\Yevgi\AppData\Local\Temp\tmp00006b40 (Trojan.Vundo) -> No action taken.
C:\Users\Yevgi\AppData\Local\Temp\tmp00006c97 (Trojan.Vundo) -> No action taken.
C:\Users\Yevgi\AppData\Local\Temp\tmp00006d71 (Trojan.Vundo) -> No action taken.
C:\Users\Yevgi\AppData\Local\Temp\tmp00006db0 (Trojan.Vundo) -> No action taken.
C:\Users\Yevgi\AppData\Local\Temp\tmp00006ee8 (Trojan.Vundo) -> No action taken.
C:\Users\Yevgi\AppData\Local\Temp\tmp00006ef7 (Trojan.Vundo) -> No action taken.
C:\Users\Yevgi\AppData\Local\Temp\tmp00006f26 (Trojan.Vundo) -> No action taken.
C:\Users\Yevgi\AppData\Local\Temp\tmp00007010 (Trojan.Vundo) -> No action taken.
C:\Users\Yevgi\AppData\Local\Temp\tmp000070fa (Trojan.Vundo) -> No action taken.
C:\Users\Yevgi\AppData\Local\Temp\tmp000072fd (Trojan.Vundo) -> No action taken.
C:\Users\Yevgi\AppData\Local\Temp\tmp000073e7 (Trojan.Vundo) -> No action taken.
C:\Users\Yevgi\AppData\Local\Temp\tmp00007464 (Trojan.Vundo) -> No action taken.
C:\Users\Yevgi\AppData\Local\Temp\tmp00007483 (Trojan.Vundo) -> No action taken.
C:\Users\Yevgi\AppData\Local\Temp\tmp0000753e (Trojan.Vundo) -> No action taken.
C:\Users\Yevgi\AppData\Local\Temp\tmp00007722 (Trojan.Vundo) -> No action taken.
C:\Users\Yevgi\AppData\Local\Temp\tmp0000782b (Trojan.Vundo) -> No action taken.
C:\Users\Yevgi\AppData\Local\Temp\tmp00007c40 (Trojan.Vundo) -> No action taken.
C:\Users\Yevgi\AppData\Local\Temp\tmp00007c7f (Trojan.Vundo) -> No action taken.
C:\Users\Yevgi\AppData\Local\Temp\tmp00007d69 (Trojan.Vundo) -> No action taken.
C:\Users\Yevgi\AppData\Local\Temp\tmp00007e72 (Trojan.Vundo) -> No action taken.
C:\Users\Yevgi\AppData\Local\Temp\tmp00007e81 (Trojan.Vundo) -> No action taken.
C:\Users\Yevgi\AppData\Local\Temp\tmp00007f0e (Trojan.Vundo) -> No action taken.
C:\Users\Yevgi\AppData\Local\Temp\tmp00007f7b (Trojan.Vundo) -> No action taken.
C:\Users\Yevgi\AppData\Local\Temp\tmp00008084 (Trojan.Vundo) -> No action taken.
C:\Users\Yevgi\AppData\Local\Temp\tmp0000819d (Trojan.Vundo) -> No action taken.
C:\Users\Yevgi\AppData\Local\Temp\tmp000081cc (Trojan.Vundo) -> No action taken.
C:\Users\Yevgi\AppData\Local\Temp\tmp0000821a (Trojan.Vundo) -> No action taken.
C:\Users\Yevgi\AppData\Local\Temp\tmp00008304 (Trojan.Vundo) -> No action taken.
C:\Users\Yevgi\AppData\Local\Temp\tmp00008361 (Trojan.Vundo) -> No action taken.
C:\Users\Yevgi\AppData\Local\Temp\tmp00008600 (Trojan.Vundo) -> No action taken.
C:\Users\Yevgi\AppData\Local\Temp\tmp00008729 (Trojan.Vundo) -> No action taken.
C:\Users\Yevgi\AppData\Local\Temp\tmp00008748 (Trojan.Vundo) -> No action taken.
C:\Users\Yevgi\AppData\Local\Temp\tmp000088dd (Trojan.Vundo) -> No action taken.
C:\Users\Yevgi\AppData\Local\Temp\tmp000089c7 (Trojan.Vundo) -> No action taken.
C:\Users\Yevgi\AppData\Local\Temp\tmp00008a15 (Trojan.Vundo) -> No action taken.
C:\Users\Yevgi\AppData\Local\Temp\tmp00008a35 (Trojan.Vundo) -> No action taken.
C:\Users\Yevgi\AppData\Local\Temp\tmp00008c18 (Trojan.Vundo) -> No action taken.
C:\Users\Yevgi\AppData\Local\Temp\tmp00008d50 (Trojan.Vundo) -> No action taken.
C:\Users\Yevgi\AppData\Local\Temp\tmp00008dbd (Trojan.Vundo) -> No action taken.
C:\Users\Yevgi\AppData\Local\Temp\tmp000094a0 (Trojan.Vundo) -> No action taken.
C:\Users\Yevgi\AppData\Local\Temp\tmp0000951d (Trojan.Vundo) -> No action taken.
C:\Users\Yevgi\AppData\Local\Temp\tmp0000952d (Trojan.Vundo) -> No action taken.
C:\Users\Yevgi\AppData\Local\Temp\tmp00009cbb (Trojan.Vundo) -> No action taken.
C:\Users\Yevgi\AppData\Local\Temp\tmp0000a39e (Trojan.Vundo) -> No action taken.
C:\Users\Yevgi\AppData\Local\Temp\tmp0000a67b (Trojan.Vundo) -> No action taken.
C:\Users\Yevgi\AppData\Local\Temp\tmp0000d7f6 (Trojan.Vundo) -> No action taken.
C:\Users\Yevgi\AppData\Local\Temp\tmp00011dbc (Trojan.Vundo) -> No action taken.
C:\Users\Yevgi\AppData\Local\Temp\urqnl.dll (Trojan.Vundo) -> No action taken.
C:\Users\Yevgi\AppData\Local\Temp\wvuro.dll (Trojan.Vundo) -> No action taken.
C:\Users\Yevgi\AppData\Local\Temp\wvuut.dll (Trojan.Vundo) -> No action taken.
C:\Users\Yevgi\AppData\Local\Temp\wvwvt.dll (Trojan.Vundo) -> No action taken.
C:\Users\Yevgi\AppData\Local\Temp\xxwvt.dll (Trojan.Vundo) -> No action taken.
C:\Users\Yevgi\AppData\Local\Temp\xxyvv.dll (Trojan.Vundo) -> No action taken.
C:\Users\Yevgi\AppData\Local\Temp\yayya.dll (Trojan.Vundo) -> No action taken.
C:\Windows\System32\cbxus.dll (Trojan.Vundo) -> No action taken.
C:\Windows\System32\cbxut.dll (Trojan.Vundo) -> No action taken.
C:\Windows\System32\ddcyw.dll (Trojan.Vundo) -> No action taken.
C:\Windows\System32\wvutu.dll (Trojan.Vundo) -> No action taken.
C:\Users\Yevgi\AppData\Local\Temp\pguxuopq.dll (Trojan.Agent) -> No action taken.




je les ai tous mis en quarantaine...
0
Réponse 17 / 25
green day Messages postés 26371 Date d'inscription vendredi 30 septembre 2005 Statut Modérateur, Contributeur sécurité Dernière intervention 27 décembre 2019 2 162
8 mai 2008 à 10:36
Salut

No action taken.

refais le et supprime tout ce qu'il te trouve !

++
0
Réponse 18 / 25
yevgi Messages postés 78 Date d'inscription jeudi 21 février 2008 Statut Membre Dernière intervention 5 août 2009 6
8 mai 2008 à 10:40
dac
est-ce qu'il faudrai que je poste un autre rapport apres?
0
Réponse 19 / 25
green day Messages postés 26371 Date d'inscription vendredi 30 septembre 2005 Statut Modérateur, Contributeur sécurité Dernière intervention 27 décembre 2019 2 162
8 mai 2008 à 10:43
oui !
0
Réponse 20 / 25
yevgi Messages postés 78 Date d'inscription jeudi 21 février 2008 Statut Membre Dernière intervention 5 août 2009 6
9 mai 2008 à 12:24
Malwarebytes' Anti-Malware 1.12
Version de la base de données: 729

Type de recherche: Examen complet (C:\|D:\|)
Eléments examinés: 195023
Temps écoulé: 41 minute(s), 14 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 7
Valeur(s) du Registre infectée(s): 6
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 104

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
HKEY_CLASSES_ROOT\CLSID\{89a1e40d-0254-4f99-b9ae-b60a2d8754a9} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Microsoft\affri (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Microsoft\affltid (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Microsoft\rdfa (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\affltid (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\affri (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Juan (Malware.Trace) -> Quarantined and deleted successfully.

Valeur(s) du Registre infectée(s):
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MSServer (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cmds (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\badb843f (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MSServer (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{89a1e40d-0254-4f99-b9ae-b60a2d8754a9} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\BMb9e8b7a3 (Trojan.Agent) -> Quarantined and deleted successfully.

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
C:\Users\Yevgi\AppData\Local\Temp\sstqo.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Users\Yevgi\AppData\Local\Temp\jkkli.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Users\Yevgi\AppData\Local\Temp\ojjooowl.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Windows\System32\mljih.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Users\Yevgi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6KIGWFXK\css4[1] (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Users\Yevgi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\NUYQRQY2\kriv[1] (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Users\Yevgi\AppData\Local\Temp\byvsq.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Users\Yevgi\AppData\Local\Temp\byxvt.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Users\Yevgi\AppData\Local\Temp\byxxu.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Users\Yevgi\AppData\Local\Temp\byxxx.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Users\Yevgi\AppData\Local\Temp\ddabb.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Users\Yevgi\AppData\Local\Temp\ddccd.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Users\Yevgi\AppData\Local\Temp\efebb.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Users\Yevgi\AppData\Local\Temp\efeca.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Users\Yevgi\AppData\Local\Temp\fccdd.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Users\Yevgi\AppData\Local\Temp\fcyvw.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Users\Yevgi\AppData\Local\Temp\fcywu.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Users\Yevgi\AppData\Local\Temp\gebaw.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Users\Yevgi\AppData\Local\Temp\geeed.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Users\Yevgi\AppData\Local\Temp\jkhfg.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Users\Yevgi\AppData\Local\Temp\jkhhf.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Users\Yevgi\AppData\Local\Temp\khhec.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Users\Yevgi\AppData\Local\Temp\ljhgf.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Users\Yevgi\AppData\Local\Temp\ljjge.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Users\Yevgi\AppData\Local\Temp\mljge.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Users\Yevgi\AppData\Local\Temp\mllii.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Users\Yevgi\AppData\Local\Temp\opnmn.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Users\Yevgi\AppData\Local\Temp\opnoo.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Users\Yevgi\AppData\Local\Temp\pmkii.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Users\Yevgi\AppData\Local\Temp\pmkjh.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Users\Yevgi\AppData\Local\Temp\pmnlk.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Users\Yevgi\AppData\Local\Temp\qomjj.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Users\Yevgi\AppData\Local\Temp\qomkl.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Users\Yevgi\AppData\Local\Temp\rqoml.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Users\Yevgi\AppData\Local\Temp\rqrss.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Users\Yevgi\AppData\Local\Temp\sstts.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Users\Yevgi\AppData\Local\Temp\tmp00006076 (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Users\Yevgi\AppData\Local\Temp\tmp0000624a (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Users\Yevgi\AppData\Local\Temp\tmp000063f0 (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Users\Yevgi\AppData\Local\Temp\tmp00006805 (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Users\Yevgi\AppData\Local\Temp\tmp00006853 (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Users\Yevgi\AppData\Local\Temp\tmp0000695c (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Users\Yevgi\AppData\Local\Temp\tmp000069aa (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Users\Yevgi\AppData\Local\Temp\tmp00006a65 (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Users\Yevgi\AppData\Local\Temp\tmp00006ae2 (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Users\Yevgi\AppData\Local\Temp\tmp00006b40 (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Users\Yevgi\AppData\Local\Temp\tmp00006c97 (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Users\Yevgi\AppData\Local\Temp\tmp00006d71 (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Users\Yevgi\AppData\Local\Temp\tmp00006db0 (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Users\Yevgi\AppData\Local\Temp\tmp00006ee8 (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Users\Yevgi\AppData\Local\Temp\tmp00006ef7 (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Users\Yevgi\AppData\Local\Temp\tmp00006f26 (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Users\Yevgi\AppData\Local\Temp\tmp00007010 (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Users\Yevgi\AppData\Local\Temp\tmp000070fa (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Users\Yevgi\AppData\Local\Temp\tmp000072fd (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Users\Yevgi\AppData\Local\Temp\tmp000073e7 (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Users\Yevgi\AppData\Local\Temp\tmp00007464 (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Users\Yevgi\AppData\Local\Temp\tmp00007483 (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Users\Yevgi\AppData\Local\Temp\tmp0000753e (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Users\Yevgi\AppData\Local\Temp\tmp00007722 (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Users\Yevgi\AppData\Local\Temp\tmp0000782b (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Users\Yevgi\AppData\Local\Temp\tmp00007c40 (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Users\Yevgi\AppData\Local\Temp\tmp00007c7f (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Users\Yevgi\AppData\Local\Temp\tmp00007d69 (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Users\Yevgi\AppData\Local\Temp\tmp00007e72 (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Users\Yevgi\AppData\Local\Temp\tmp00007e81 (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Users\Yevgi\AppData\Local\Temp\tmp00007f0e (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Users\Yevgi\AppData\Local\Temp\tmp00007f7b (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Users\Yevgi\AppData\Local\Temp\tmp00008084 (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Users\Yevgi\AppData\Local\Temp\tmp0000819d (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Users\Yevgi\AppData\Local\Temp\tmp000081cc (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Users\Yevgi\AppData\Local\Temp\tmp0000821a (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Users\Yevgi\AppData\Local\Temp\tmp00008304 (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Users\Yevgi\AppData\Local\Temp\tmp00008361 (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Users\Yevgi\AppData\Local\Temp\tmp00008600 (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Users\Yevgi\AppData\Local\Temp\tmp00008729 (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Users\Yevgi\AppData\Local\Temp\tmp00008748 (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Users\Yevgi\AppData\Local\Temp\tmp000088dd (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Users\Yevgi\AppData\Local\Temp\tmp000089c7 (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Users\Yevgi\AppData\Local\Temp\tmp00008a15 (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Users\Yevgi\AppData\Local\Temp\tmp00008a35 (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Users\Yevgi\AppData\Local\Temp\tmp00008c18 (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Users\Yevgi\AppData\Local\Temp\tmp00008d50 (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Users\Yevgi\AppData\Local\Temp\tmp00008dbd (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Users\Yevgi\AppData\Local\Temp\tmp000094a0 (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Users\Yevgi\AppData\Local\Temp\tmp0000951d (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Users\Yevgi\AppData\Local\Temp\tmp0000952d (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Users\Yevgi\AppData\Local\Temp\tmp00009cbb (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Users\Yevgi\AppData\Local\Temp\tmp0000a39e (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Users\Yevgi\AppData\Local\Temp\tmp0000a67b (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Users\Yevgi\AppData\Local\Temp\tmp0000d7f6 (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Users\Yevgi\AppData\Local\Temp\tmp00011dbc (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Users\Yevgi\AppData\Local\Temp\urqnl.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Users\Yevgi\AppData\Local\Temp\wvuro.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Users\Yevgi\AppData\Local\Temp\wvuut.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Users\Yevgi\AppData\Local\Temp\wvwvt.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Users\Yevgi\AppData\Local\Temp\xxwvt.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Users\Yevgi\AppData\Local\Temp\xxyvv.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Users\Yevgi\AppData\Local\Temp\yayya.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Windows\System32\cbxus.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Windows\System32\cbxut.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Windows\System32\ddcyw.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Windows\System32\wvutu.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Users\Yevgi\AppData\Local\Temp\pguxuopq.dll (Trojan.Agent) -> Quarantined and deleted successfully.
0