Sujet Précédent Sujet Suivant

Probleme avec TR/Crypt.XPACK.Gen

Fermé
KiraDu72 Messages postés 5 Date d'inscription dimanche 8 juin 2008 Statut Membre Dernière intervention 9 juin 2008 - 8 juin 2008 à 22:35
ep44 Messages postés 7393 Date d'inscription samedi 10 novembre 2007 Statut Contributeur Dernière intervention 11 novembre 2010 - 10 juin 2008 à 00:04
Bonsoir , je suis infecter par ce trojan , Antivir n'arrive pas à le supprimer il revient tout le temps .

Je suis vous Vista .

Pouvez vous m'indiquer la démarche à suivre pour l'éradiquer de mon pc merci .

8 réponses

Réponse 1 / 8
ep44 Messages postés 7393 Date d'inscription samedi 10 novembre 2007 Statut Contributeur Dernière intervention 11 novembre 2010 3
8 juin 2008 à 23:00
Bonsoir

commence par ceci

Télécharge sur le Bureau HijackThis

ftp://ftp.commentcamarche.com/download/HJTInstall.exe

= Double-clic dessus pour l'installer
= Clic Do a system scan and save the log
= Colle le rapport
si problème voir l'aide
http://perso.orange.fr/rginformatique/section%20virus/demohijack.htm

@+
0
Réponse 2 / 8
KiraDu72 Messages postés 5 Date d'inscription dimanche 8 juin 2008 Statut Membre Dernière intervention 9 juin 2008
8 juin 2008 à 23:07
Merci voila le log :



Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 23:05:44, on 08/06/2008
Platform: Windows Vista (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16643)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
C:\Windows\system32\wuauclt.exe
C:\Windows\system32\rundll32.exe
C:\Windows\system32\rundll32.exe
C:\Windows\system32\rundll32.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Windows\system32\rundll32.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {1CB20BF0-BBAE-40A7-93F4-6435FF3D0411} - C:\PROGRA~1\Crawler\Toolbar\ctbr.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~2\MEGAUP~1.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: MegaIEMn - {bf00e119-21a3-4fd1-b178-3b8537e75c92} - C:\Program Files\Megaupload\Mega Manager\MegaIEMn.dll
O3 - Toolbar: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~2\MEGAUP~1.DLL
O3 - Toolbar: Barre d'outils &Crawler - {4B3803EA-5230-4DC3-A7FC-33638F3D3542} - C:\PROGRA~1\Crawler\Toolbar\ctbr.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [SpywareTerminator] "C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe"
O4 - HKLM\..\Run: [SoundTray] C:\Program Files\Analog Devices\SoundMAX\SoundTray.exe
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [OODefragTray] C:\Windows\system32\oodtray.exe
O4 - HKLM\..\Run: [LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD\Language\Language.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"
O4 - HKLM\..\Run: [ATICustomerCare] "C:\Program Files\ATI\ATICustomerCare\ATICustomerCare.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [NVIDIA nTune] "C:\Program Files\NVIDIA Corporation\nTune\nTuneCmd.exe" clear
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKCU\..\Run: [AtiTrayTools] "C:\Program Files\Ray Adams\ATI Tray Tools\atitray.exe"
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [MSServer] rundll32.exe C:\Users\Kira\AppData\Local\Temp\awttusQJ.dll,#1
O4 - HKCU\..\Run: [cmds] rundll32.exe C:\Users\Kira\AppData\Local\Temp\hgGayxVl.dll,c
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: Crawler Search - tbr:iemenu
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\Windows\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\Windows\bdoscandel.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O13 - Gopher Prefix:
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.systemrequirementslab.com/sysreqlab2.cab
O16 - DPF: {6A060448-60F9-11D5-A6CD-0002B31F7455} (ExentInf Class) -
O16 - DPF: {8167C273-DF59-4416-B647-C8BB2C7EE83E} (WebSDev Control) - http://liveupdate.msi.com.tw/autobios/LOnline/install.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O18 - Protocol: tbr - {4D25FB7A-8902-4291-960E-9ADA051CFBBF} - C:\PROGRA~1\Crawler\Toolbar\ctbr.dll
O22 - SharedTaskScheduler: Windows DreamScene - {E31004D1-A431-41B8-826F-E902F9D95C81} - C:\Windows\System32\DreamScene.dll
O23 - Service: Andrea ADI Filters Service (AEADIFilters) - Andrea Electronics Corporation - C:\Windows\system32\AEADISRV.EXE
O23 - Service: Avira AntiVir Personal – Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal – Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: nTune Service (nTuneService) - NVIDIA - C:\Program Files\NVIDIA Corporation\nTune\nTuneService.exe
O23 - Service: O&O Defrag - O&O Software GmbH - C:\Windows\system32\oodag.exe
O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe
O23 - Service: PnkBstrB - Unknown owner - C:\Windows\system32\PnkBstrB.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared files\RichVideo.exe
O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - C:\Program Files\Spyware Terminator\sp_rsser.exe
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files\Common Files\Steam\SteamService.exe
0
Réponse 3 / 8
ep44 Messages postés 7393 Date d'inscription samedi 10 novembre 2007 Statut Contributeur Dernière intervention 11 novembre 2010 3
8 juin 2008 à 23:11
Très bien ;-)

Recherche dans ajout et suppression de programmes, via le Panneau de configuration
et dans C:\Program Files en suivant ce chemin: Démarrer > Poste de travail > Disque C: > Program Files

Crawler Toolbar

ensuite

Télécharge Combofix http://download.bleepingcomputer.com/sUBs/ComboFix.exe
et sauvegarde le sur ton bureau et pas ailleurs!
=>/!\ déconnecte toi d'internet et ferme toutes tes applications./!\
=> /!\désactive tes protections (antivirus, parefeu,antispyware)/!\
=> Double-clic sur combofix,
=> Ne touche à rien tant que le scan n'est pas terminé.Attention, n'utilise pas ta souris ni ton clavier (ni un autre système de pointage) pendant que le programme tourne. Cela pourrait figer l'ordi.
=> Attends que combofix ait terminé, un rapport sera créé.
=> réactive ton parefeu, ton antivirus, la garde de ton antispyware
=> copie/colle le rapport C:\ComboFix.txt





0
Réponse 4 / 8
KiraDu72 Messages postés 5 Date d'inscription dimanche 8 juin 2008 Statut Membre Dernière intervention 9 juin 2008
8 juin 2008 à 23:35
Ok j'ai désinstaller Crawler Toolbar

Voici le rapport de combo.fix :


ComboFix 08-06-08.1 - Kira 2008-06-08 23:24:34.1 - NTFSx86
Microsoft® Windows Vista™ Ultimate 6.0.6000.0.1252.1.1033.18.1374 [GMT 2:00]
Running from: C:\Users\Kira\Desktop\ComboFix.exe
* Created a new restore point
.

((((((((((((((((((((((((( Files Created from 2008-05-08 to 2008-06-08 )))))))))))))))))))))))))))))))
.

2008-06-08 23:03 . 2008-06-08 23:03 <REP> d-------- C:\Program Files\Trend Micro
2008-06-01 23:19 . 2008-06-02 02:22 <REP> d-------- C:\Users\Kira\AppData\Roaming\Command & Conquer(tm) 3 La Fureur de Kane
2008-06-01 14:54 . 2008-06-01 14:54 <REP> d-------- C:\Users\Kira\Nouveau dossier
2008-05-30 12:24 . 2008-05-30 12:24 <REP> d-------- C:\Program Files\KONAMI
2008-05-27 15:15 . 2008-05-27 15:15 <REP> d-------- C:\Program Files\Common Files\xing shared
2008-05-27 15:15 . 2008-05-27 15:15 348,160 --a------ C:\Windows\System32\msvcr71.dll
2008-05-26 14:35 . 2008-05-26 14:35 <REP> d-------- C:\Users\All Users\ATI
2008-05-26 14:35 . 2008-05-26 14:35 <REP> d-------- C:\PROGRA~2\ATI
2008-05-26 14:18 . 2008-05-26 14:21 <REP> d-------- C:\Program Files\ATI Technologies
2008-05-26 14:18 . 2008-05-26 14:22 <REP> d-------- C:\Program Files\ATI
2008-05-18 13:57 . 2008-05-18 13:57 549 --a------ C:\Windows\eReg.dat
2008-05-16 07:37 . 2008-05-16 07:37 <REP> d-------- C:\Users\Kira\AppData\Roaming\ZOO Digital Publishing
2008-05-13 19:30 . 2008-05-13 19:30 <REP> d-------- C:\Program Files\Maxis
2008-05-13 14:05 . 2008-05-26 14:29 <REP> d-------- C:\Users\All Users\Codemasters
2008-05-13 14:05 . 2008-05-26 14:29 <REP> d-------- C:\PROGRA~2\Codemasters
2008-05-13 14:04 . 2008-03-05 15:56 3,786,760 --a------ C:\Windows\System32\D3DX9_37.dll
2008-05-13 14:04 . 2008-03-05 15:56 1,420,824 --a------ C:\Windows\System32\D3DCompiler_37.dll
2008-05-13 14:04 . 2008-04-28 12:29 805,400 -ra------ C:\Windows\System32\tmp7555.tmp
2008-05-13 14:04 . 2008-04-28 12:29 805,400 -ra------ C:\Windows\System32\tmp74C8.tmp
2008-05-13 14:04 . 2008-03-05 16:03 479,752 --a------ C:\Windows\System32\XAudio2_0.dll
2008-05-13 14:04 . 2008-02-05 23:07 462,864 --a------ C:\Windows\System32\d3dx10_37.dll
2008-05-13 14:04 . 2008-03-05 16:03 238,088 --a------ C:\Windows\System32\xactengine3_0.dll
2008-05-13 14:04 . 2008-03-05 16:00 25,608 --a------ C:\Windows\System32\X3DAudio1_3.dll
2008-05-13 00:58 . 2008-05-13 00:59 <REP> d-------- C:\Program Files\Sega Cue Maker
2008-05-13 00:48 . 2008-05-13 00:48 <REP> d-------- C:\Program Files\Free Audio Pack
2008-05-12 18:30 . 2008-05-12 18:30 3,592,704 --a------ C:\Windows\System32\drivers\atikmdag.sys
2008-05-12 17:56 . 2008-05-12 17:56 397,312 --a------ C:\Windows\System32\ATIDEMGX.dll
2008-05-12 17:55 . 2008-05-12 17:55 327,680 --a------ C:\Windows\System32\atipdlxx.dll
2008-05-12 17:55 . 2008-05-12 17:55 266,240 --a------ C:\Windows\System32\Ati2evxx.dll
2008-05-12 17:55 . 2008-05-12 17:55 262,144 --a------ C:\Windows\System32\Oemdspif.dll
2008-05-12 17:55 . 2008-05-12 17:55 159,744 --a------ C:\Windows\System32\atitmmxx.dll
2008-05-12 17:55 . 2008-05-12 17:55 43,520 --a------ C:\Windows\System32\ati2edxx.dll
2008-05-12 17:53 . 2008-05-12 17:53 675,840 --a------ C:\Windows\System32\Ati2evxx.exe
2008-05-12 17:45 . 2008-05-12 17:45 1,554,944 --a------ C:\Windows\System32\atidxx32.dll
2008-05-12 17:40 . 2008-05-12 17:40 3,101,184 --a------ C:\Windows\System32\atiumdag.dll
2008-05-12 17:26 . 2008-05-12 17:26 9,994,240 --a------ C:\Windows\System32\atioglxx.dll
2008-05-12 17:23 . 2008-05-12 17:23 4,291,584 --a------ C:\Windows\System32\atiumdva.dll
2008-05-12 17:23 . 2008-05-12 17:23 3,107,788 --a------ C:\Windows\System32\atiumdva.dat
2008-05-12 17:11 . 2008-05-12 17:11 48,640 --a------ C:\Windows\System32\amdpcom32.dll
2008-05-12 17:11 . 2008-05-12 17:11 19,968 --a------ C:\Windows\System32\atiadlxx.dll
2008-05-12 16:56 . 2008-05-12 16:56 49,152 --a------ C:\Windows\System32\drivers\ati2erec.dll
2008-05-11 11:49 . 2008-05-11 11:49 <REP> d-------- C:\Users\All Users\Avira
2008-05-11 11:49 . 2008-05-11 11:49 <REP> d-------- C:\Program Files\Avira
2008-05-11 11:49 . 2008-05-11 11:49 <REP> d-------- C:\PROGRA~2\Avira
2008-05-10 22:12 . 2008-05-10 22:12 <REP> d-------- C:\WESTWOOD
2008-05-10 22:12 . 2008-05-10 22:12 5,371 --a------ C:\Windows\system\VWWSD.386
2008-05-10 20:38 . 2008-05-10 20:42 <REP> d-------- C:\shit
2008-05-10 17:38 . 2008-05-10 19:29 <REP> d-------- C:\Program Files\Navilog1
2008-05-10 17:36 . 2008-06-02 13:53 <REP> d-------- C:\Muestras
2008-05-10 16:57 . 2008-06-08 22:20 <REP> d-------- C:\Users\Kira\AppData\Roaming\Spyware Terminator
2008-05-10 16:57 . 2008-06-08 12:31 <REP> d-------- C:\Users\All Users\Spyware Terminator
2008-05-10 16:57 . 2008-06-08 23:19 <REP> d-------- C:\Program Files\Spyware Terminator
2008-05-10 16:57 . 2008-06-08 12:31 <REP> d-------- C:\PROGRA~2\Spyware Terminator
2008-05-10 16:57 . 2008-05-10 16:57 141,312 --a------ C:\Windows\System32\drivers\sp_rsdrv2.sys
2008-05-10 16:08 . 2008-05-26 14:31 <REP> d-------- C:\Program Files\Panda Security
2008-05-10 16:08 . 2008-05-10 16:08 1,847 --a------ C:\Windows\mozver.dat
2008-05-10 14:52 . 2008-05-10 14:52 <REP> d-------- C:\Windows\System32\Kaspersky Lab
2008-05-10 12:43 . 2008-05-10 13:17 <REP> d-------- C:\Windows\BDOSCAN8
2008-05-10 12:35 . 2008-05-10 12:35 <REP> d-------- C:\Program Files\CCleaner
2008-05-10 11:52 . 2008-05-10 11:52 <REP> d-------- C:\Users\Kira\.mp3splt-gtk
2008-05-10 11:52 . 2008-05-10 11:52 <REP> d-------- C:\Program Files\mp3splt-gtk
2008-05-09 14:14 . 1997-11-19 14:49 303,616 --a------ C:\Windows\IsUninst.exe
2008-05-09 12:20 . 2008-05-09 12:21 <REP> d-------- C:\Fraps

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-06-07 17:40 --------- d-----w C:\Users\Kira\AppData\Roaming\uTorrent
2008-06-05 16:04 --------- d---a-w C:\PROGRA~2\TEMP
2008-06-01 21:06 --------- d-----w C:\Program Files\Electronic Arts
2008-05-30 10:30 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-05-27 13:15 --------- d-----w C:\Program Files\Common Files\Real
2008-05-26 13:47 --------- d-----w C:\Program Files\RivaTuner v2.07
2008-05-26 12:31 --------- d-----w C:\Program Files\Oxin's Style!
2008-05-26 12:30 --------- d-----w C:\Program Files\Codemasters
2008-05-26 12:09 --------- d-----w C:\Program Files\ATITool
2008-05-13 12:04 444,952 ----a-w C:\Windows\System32\wrap_oal.dll
2008-05-13 12:04 109,080 ----a-w C:\Windows\System32\OpenAL32.dll
2008-05-13 12:04 --------- d-----w C:\Program Files\OpenAL
2008-05-12 22:58 286,720 ------w C:\Windows\Setup1.exe
2008-05-11 09:54 --------- d-----w C:\Program Files\Winamp
2008-05-10 14:39 --------- d-----w C:\Program Files\Spybot - Search & Destroy
2008-05-10 14:38 --------- d-----w C:\PROGRA~2\Spybot - Search & Destroy
2008-05-10 12:09 --------- d-----w C:\Program Files\SpeedFan
2008-05-10 11:34 --------- d-----w C:\Program Files\BitComet
2008-05-09 12:15 --------- d-----w C:\Program Files\Rockstar Games
2008-05-06 10:56 --------- d-----w C:\Users\Kira\AppData\Roaming\Ubisoft
2008-05-06 10:44 --------- d-----w C:\Program Files\Ubisoft
2008-05-05 14:59 --------- d-----w C:\PROGRA~2\Ubisoft
2008-05-05 14:58 66,872 ----a-w C:\Windows\System32\PnkBstrA.exe
2008-05-05 14:58 22,328 ----a-w C:\Windows\system32\drivers\PnkBstrK.sys
2008-05-05 14:58 22,328 ----a-w C:\Users\Kira\AppData\Roaming\PnkBstrK.sys
2008-05-05 14:58 2,337,865 ----a-w C:\Windows\System32\pbsvc.exe
2008-05-05 14:58 107,832 ----a-w C:\Windows\System32\PnkBstrB.exe
2008-05-05 13:58 --------- d-----w C:\Program Files\Common Files\SWF Studio
2008-05-05 13:48 --------- d-----w C:\Program Files\Eidos
2008-05-05 11:28 --------- d-----w C:\Program Files\Microsoft Games
2008-05-04 02:58 15,600 ----a-w C:\Windows\gdrv.sys
2008-05-03 09:06 --------- d-----w C:\Program Files\ASUS
2008-04-30 09:29 --------- d-----w C:\Program Files\MSN Messenger
2008-04-30 09:29 --------- d-----w C:\Program Files\Messenger Plus! Live
2008-04-26 21:37 --------- d-----w C:\Program Files\VPLauncher
2008-04-20 10:46 --------- d-----w C:\PROGRA~2\TrackMania
2008-04-20 10:32 --------- d-----w C:\Program Files\TmNationsForever
2008-04-14 12:29 --------- d-----w C:\Program Files\Okoker All Video Splitter
2008-04-14 12:21 --------- d-----w C:\Users\Kira\AppData\Roaming\Download Manager
2008-04-12 09:45 --------- d-----w C:\Program Files\PMG
2008-04-11 15:23 38,400 ----a-w C:\Windows\System32\SoundSchemes.exe
2008-04-10 21:46 --------- d-----w C:\Users\Kira\AppData\Roaming\Bioshock
2008-04-09 13:59 --------- d-----w C:\PROGRA~2\Microsoft Help
2008-04-09 13:58 --------- d-----w C:\Program Files\Microsoft Works
2008-04-09 13:56 --------- d-----w C:\Program Files\Microsoft.NET
2008-04-09 08:10 --------- d-----w C:\Program Files\Common Files\Steam
2008-03-24 14:32 5,632 ----a-w C:\Windows\System32\BReWErS.dll
2007-09-15 02:11 174 --sha-w C:\Program Files\desktop.ini
2008-01-03 20:24 16,384 --sha-w C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
2008-01-03 20:24 32,768 --sha-w C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
2008-01-03 20:24 16,384 --sha-w C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="C:\Program Files\Windows Sidebar\sidebar.exe" [2008-01-09 02:06 1232896]
"NVIDIA nTune"="C:\Program Files\NVIDIA Corporation\nTune\nTuneCmd.exe" [2007-04-04 15:20 81920]
"ehTray.exe"="C:\Windows\ehome\ehTray.exe" [2006-11-02 14:34 125440]
"DAEMON Tools"="C:\Program Files\DAEMON Tools\daemon.exe" [2007-08-29 17:09 171464]
"AtiTrayTools"="C:\Program Files\Ray Adams\ATI Tray Tools\atitray.exe" [2007-05-22 11:04 521128]
"WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [2006-11-02 14:33 201728]
"cmds"="C:\Users\Kira\AppData\Local\Temp\hgGayxVl.dll" [2008-06-08 21:42 346624]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 05:25 144784]
"SpywareTerminator"="C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe" [2008-05-10 16:57 1817600]
"SoundTray"="C:\Program Files\Analog Devices\SoundMAX\SoundTray.exe" [2007-05-21 15:53 49152]
"SoundMAXPnP"="C:\Program Files\Analog Devices\Core\smax4pnp.exe" [2007-06-06 08:35 1261568]
"RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2005-12-07 22:57 30208]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-02-01 00:13 385024]
"OODefragTray"="C:\Windows\system32\oodtray.exe" [2007-05-11 02:08 2512392]
"LanguageShortcut"="C:\Program Files\CyberLink\PowerDVD\Language\Language.exe" [2006-04-13 11:09 49152]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-02-19 14:10 267048]
"avgnt"="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-02-12 10:06 262401]
"StartCCC"="C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-01-21 12:17 61440]
"ATICustomerCare"="C:\Program Files\ATI\ATICustomerCare\ATICustomerCare.exe" [2007-10-04 18:38 307200]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2008-05-27 15:15 185896]

C:\PROGRA~2\MICROS~1\Windows\STARTM~1\Programs\Startup\
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 22:05:26 29696]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.YV12"= yv12vfw.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-1770490974-3222413304-2682626772-1000]
"EnableNotificationsRef"=dword:00000005

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{FD67889C-2E3F-45CA-8330-04788942CE70}"= C:\Program Files\MSN Messenger\livecall.exe:Windows Live Messenger 8.1 (Phone)
"{AB417836-9E01-46B5-86C5-D1364874A2B9}"= UDP:C:\Windows\System32\PnkBstrA.exe:PnkBstrA
"{93C6E83F-1D31-4643-9753-E812FB8F4D82}"= TCP:C:\Windows\System32\PnkBstrA.exe:PnkBstrA
"{D9DB706B-7F10-4569-B6A9-62CE9594064E}"= UDP:C:\Windows\System32\PnkBstrB.exe:PnkBstrB
"{19A31D11-72E1-4C55-A707-46556D304A2B}"= TCP:C:\Windows\System32\PnkBstrB.exe:PnkBstrB
"TCP Query User{C9B0E386-1E6B-4C3F-97F1-0DCFC535DA08}C:\\program files\\bitcomet\\bitcomet.exe"= UDP:C:\program files\bitcomet\bitcomet.exe:BitComet - a BitTorrent Client
"UDP Query User{BEC02409-C05F-451E-B304-C87A259B646A}C:\\program files\\bitcomet\\bitcomet.exe"= TCP:C:\program files\bitcomet\bitcomet.exe:BitComet - a BitTorrent Client
"TCP Query User{169EDEC9-1076-41BB-9060-30CF1A829226}C:\\users\\kira\\documents\\jeux pc\\guilty gear xx reload\\ggxx.exe"= UDP:C:\users\kira\documents\jeux pc\guilty gear xx reload\ggxx.exe:ggxx.exe
"UDP Query User{026FD9B8-8542-4FDB-B6DD-E786B2AEB567}C:\\users\\kira\\documents\\jeux pc\\guilty gear xx reload\\ggxx.exe"= TCP:C:\users\kira\documents\jeux pc\guilty gear xx reload\ggxx.exe:ggxx.exe
"TCP Query User{10FE3CFA-4677-4B3C-B2BE-D43C4B8B9853}F:\\nico\\emule\\emule.exe"= UDP:F:\nico\emule\emule.exe:eMule
"UDP Query User{2CC4E624-373D-441F-B2FC-06BF32DAF78B}F:\\nico\\emule\\emule.exe"= TCP:F:\nico\emule\emule.exe:eMule
"TCP Query User{884288C0-6E67-4086-A8C5-D3DDACB42436}C:\\program files\\emule\\emule.exe"= UDP:C:\program files\emule\emule.exe:eMule
"UDP Query User{34111953-1CD2-47AA-9FCA-0587A9E3B4E1}C:\\program files\\emule\\emule.exe"= TCP:C:\program files\emule\emule.exe:eMule
"TCP Query User{E919DDDC-C9F3-48F2-8B2E-233DCCCB364E}C:\\program files\\codemasters\\dirt\\dirt.exe"= UDP:C:\program files\codemasters\dirt\dirt.exe:DiRT Executable
"UDP Query User{AE527F44-D77B-42E1-9795-93E4920DC7BC}C:\\program files\\codemasters\\dirt\\dirt.exe"= TCP:C:\program files\codemasters\dirt\dirt.exe:DiRT Executable
"TCP Query User{07FEFFBE-5E03-46F8-8332-5410FB6208D3}C:\\program files\\atari\\test drive unlimited\\testdriveunlimited.exe"= UDP:C:\program files\atari\test drive unlimited\testdriveunlimited.exe:Test Drive Unlimited
"UDP Query User{3CDD2955-C31C-4DC5-A437-D98ADA3DD647}C:\\program files\\atari\\test drive unlimited\\testdriveunlimited.exe"= TCP:C:\program files\atari\test drive unlimited\testdriveunlimited.exe:Test Drive Unlimited
"TCP Query User{536DC1CA-086A-4E13-9DCB-F2A92C4E56D0}C:\\program files\\k-lite codec pack\\media player classic\\mplayerc.exe"= UDP:C:\program files\k-lite codec pack\media player classic\mplayerc.exe:Media Player Classic
"UDP Query User{11061E32-88A3-451E-B380-79A5EB76D7C3}C:\\program files\\k-lite codec pack\\media player classic\\mplayerc.exe"= TCP:C:\program files\k-lite codec pack\media player classic\mplayerc.exe:Media Player Classic
"TCP Query User{566CBDB7-6BCF-4671-A1FF-7FD83DE1D40E}C:\\program files\\atari\\boiling point\\xenus.exe"= UDP:C:\program files\atari\boiling point\xenus.exe:Xenus
"UDP Query User{579D12A7-7FFD-465D-A859-321F1163B359}C:\\program files\\atari\\boiling point\\xenus.exe"= TCP:C:\program files\atari\boiling point\xenus.exe:Xenus
"TCP Query User{5BF379DD-145A-4810-8363-A032009A4601}C:\\program files\\ubisoft\\tom clancy's splinter cell double agent\\scda-offline\\system\\splintercell4.exe"= UDP:C:\program files\ubisoft\tom clancy's splinter cell double agent\scda-offline\system\splintercell4.exe:SplinterCell4
"UDP Query User{0E4C4CE9-2D9B-4023-9C21-6A89D5534B81}C:\\program files\\ubisoft\\tom clancy's splinter cell double agent\\scda-offline\\system\\splintercell4.exe"= TCP:C:\program files\ubisoft\tom clancy's splinter cell double agent\scda-offline\system\splintercell4.exe:SplinterCell4
"TCP Query User{A6639D93-FBF3-4F2E-8296-A822CF47CCF6}C:\\program files\\midway home entertainment\\stranglehold demo\\binaries\\retail-stranglehold.exe"= UDP:C:\program files\midway home entertainment\stranglehold demo\binaries\retail-stranglehold.exe:Stranglehold
"UDP Query User{5BFF7B21-D78A-4523-AA98-09EC8AB3B219}C:\\program files\\midway home entertainment\\stranglehold demo\\binaries\\retail-stranglehold.exe"= TCP:C:\program files\midway home entertainment\stranglehold demo\binaries\retail-stranglehold.exe:Stranglehold
"{5F26ED53-7DD1-4C60-97B9-7B3E96C7F094}"= UDP:C:\Program Files\Sega\SEGA Rally\SEGA Rally.exe:SEGA Rally
"{486386FB-D031-41C4-A73F-8CD423EB46AC}"= TCP:C:\Program Files\Sega\SEGA Rally\SEGA Rally.exe:SEGA Rally
"{2AE563D0-BDEB-452B-976E-6288E7EC677C}"= UDP:C:\Program Files\Sega\SEGA Rally\SEGA Rally_SSE1.exe:SEGA Rally
"{6C40F592-0CC8-449A-BBEB-1E66BA67F670}"= TCP:C:\Program Files\Sega\SEGA Rally\SEGA Rally_SSE1.exe:SEGA Rally
"{E4686658-691C-4268-B18D-5547F6E5C0C2}"= UDP:C:\Program Files\MSN Messenger\msnmsgr.exe:MSN Messenger 7.5
"{E858877D-C11F-4669-A7A1-9EFDEB32EA32}"= TCP:C:\Program Files\MSN Messenger\msnmsgr.exe:MSN Messenger 7.5
"{E7C3F9CB-C5FE-46CB-85F9-8AFCC4352A3E}"= UDP:C:\Program Files\MSN Messenger\msnmsgr.exe:MSN Messenger 7.5
"{B1840B1B-1970-4A46-BAB2-FED96D64C0BA}"= TCP:C:\Program Files\MSN Messenger\msnmsgr.exe:MSN Messenger 7.5
"{3BA5C38D-207C-47A8-9C94-077DE42B8403}"= UDP:C:\Program Files\Midway Home Entertainment\Stranglehold\Binaries\Retail-Stranglehold.exe:Stranglehold
"{A6909079-7A65-4ED7-8C96-FAD762F1482F}"= TCP:C:\Program Files\Midway Home Entertainment\Stranglehold\Binaries\Retail-Stranglehold.exe:Stranglehold
"TCP Query User{E27DFB3F-916B-4544-895D-B356F3C9962E}C:\\bmw m3 challenge\\bmw.exe"= UDP:C:\bmw m3 challenge\bmw.exe:BMW M3 Challenge
"UDP Query User{35E979CB-B73A-4448-ADFF-5FB01BE339D2}C:\\bmw m3 challenge\\bmw.exe"= TCP:C:\bmw m3 challenge\bmw.exe:BMW M3 Challenge
"TCP Query User{1EF4DCCD-45FE-4FC3-9E9E-D28BF5ADC964}C:\\program files\\real\\realplayer\\realplay.exe"= UDP:C:\program files\real\realplayer\realplay.exe:RealPlayer
"UDP Query User{C3B8E030-DAE5-42CB-ACE7-12EBE8F40C43}C:\\program files\\real\\realplayer\\realplay.exe"= TCP:C:\program files\real\realplayer\realplay.exe:RealPlayer
"TCP Query User{F48BA445-E0B8-44BE-B30B-6655A9F69D6C}C:\\program files\\konami\\pro evolution soccer 2008\\pes2008.exe"= UDP:C:\program files\konami\pro evolution soccer 2008\pes2008.exe:Pro Evolution Soccer 2008
"UDP Query User{53DB8752-8544-4E4A-BC27-7E08D5B47CD2}C:\\program files\\konami\\pro evolution soccer 2008\\pes2008.exe"= TCP:C:\program files\konami\pro evolution soccer 2008\pes2008.exe:Pro Evolution Soccer 2008
"TCP Query User{31EE4251-3B24-457D-8DD1-72A8EAE59C3E}C:\\program files\\sega\\outrun2006 coast 2 coast\\or2006c2c.exe"= UDP:C:\program files\sega\outrun2006 coast 2 coast\or2006c2c.exe:OR2006C2C
"UDP Query User{FF16673B-C0CE-4901-BCCA-91A29DC5D140}C:\\program files\\sega\\outrun2006 coast 2 coast\\or2006c2c.exe"= TCP:C:\program files\sega\outrun2006 coast 2 coast\or2006c2c.exe:OR2006C2C
"TCP Query User{CC272861-6BB8-4A66-9179-4567626EC7D2}C:\\program files\\utorrent\\utorrent.exe"= UDP:C:\program files\utorrent\utorrent.exe:uTorrent
"UDP Query User{6ED8ED50-651D-4C59-851D-4CB5BD1B457E}C:\\program files\\utorrent\\utorrent.exe"= TCP:C:\program files\utorrent\utorrent.exe:uTorrent
"TCP Query User{4D11E449-2E44-44C5-A2CD-C2C2049D1704}C:\\program files\\rockstar games\\gta2\\gta2.exe"= UDP:C:\program files\rockstar games\gta2\gta2.exe:GTA2 main executable
"UDP Query User{81FEC985-60C5-4DA2-8EC0-5322F240B836}C:\\program files\\rockstar games\\gta2\\gta2.exe"= TCP:C:\program files\rockstar games\gta2\gta2.exe:GTA2 main executable
"TCP Query User{F74F8D77-A17B-4932-BE3D-57FA9F514BA2}C:\\windows\\system32\\dplaysvr.exe"= UDP:C:\windows\system32\dplaysvr.exe:Microsoft DirectPlay Helper
"UDP Query User{7CBE04F5-E302-4F1C-ADEF-4BF0F575BF55}C:\\windows\\system32\\dplaysvr.exe"= TCP:C:\windows\system32\dplaysvr.exe:Microsoft DirectPlay Helper
"TCP Query User{43067B24-C242-416A-A902-89507FA9EE52}C:\\users\\kira\\documents\\el2walker\\l2w_all.exe"= UDP:C:\users\kira\documents\el2walker\l2w_all.exe:l2w_all.exe
"UDP Query User{D370E3FA-59FF-402D-A32B-DE1E92296171}C:\\users\\kira\\documents\\el2walker\\l2w_all.exe"= TCP:C:\users\kira\documents\el2walker\l2w_all.exe:l2w_all.exe
"{AB2309F2-CB95-4A07-9CC1-6304036BAC69}"= UDP:C:\Program Files\Electronic Arts\Crytek\Crysis\Bin32\Crysis.exe:Crysis_32
"{CEEC5F0C-301B-4E74-B1E0-6076C0DD97CC}"= TCP:C:\Program Files\Electronic Arts\Crytek\Crysis\Bin32\Crysis.exe:Crysis_32
"{B31E99EC-CAE3-4CDD-BB64-E920AF342922}"= UDP:C:\Program Files\Electronic Arts\Crytek\Crysis\Bin32\CrysisDedicatedServer.exe:CrysisDedicatedServer_32
"{BCEB793F-3D0E-4429-BFD7-420212E6880F}"= TCP:C:\Program Files\Electronic Arts\Crytek\Crysis\Bin32\CrysisDedicatedServer.exe:CrysisDedicatedServer_32
"{F3E5DD32-16D7-4363-84C3-0D9E95014F77}"= UDP:C:\Program Files\THQ\Gas Powered Games\GPGNet\GPG.Multiplayer.Client.exe:GPGNet - Supreme Commander - Forged Alliance
"{14B601CA-B7A9-4FF3-9E8C-01C6A24A5821}"= TCP:C:\Program Files\THQ\Gas Powered Games\GPGNet\GPG.Multiplayer.Client.exe:GPGNet - Supreme Commander - Forged Alliance
"{EBA1BBCC-EAAF-458D-A0ED-E12EA96EF481}"= UDP:C:\Program Files\Atari\Neverwinter Nights 2\nwn2main.exe:Neverwinter Nights 2 Main
"{DCBA0595-B156-49A4-B845-0CFD9587CDFC}"= TCP:C:\Program Files\Atari\Neverwinter Nights 2\nwn2main.exe:Neverwinter Nights 2 Main
"{3DBDFA62-92DF-4C26-9231-0451C3EFDAAA}"= UDP:C:\Program Files\Atari\Neverwinter Nights 2\nwn2main_amdxp.exe:Neverwinter Nights 2 AMD
"{3FAAC30A-1620-4148-8F61-85F9C2D6E2A0}"= TCP:C:\Program Files\Atari\Neverwinter Nights 2\nwn2main_amdxp.exe:Neverwinter Nights 2 AMD
"{C9CEF2FD-79F5-476E-88DA-365785C3E2D1}"= UDP:C:\Program Files\Atari\Neverwinter Nights 2\nwupdate.exe:Neverwinter Nights 2 Updater
"{C9CF85E4-128A-4BB8-9ABE-30922A748C20}"= TCP:C:\Program Files\Atari\Neverwinter Nights 2\nwupdate.exe:Neverwinter Nights 2 Updater
"{433E154D-DCB6-44CE-A6FC-039B3ECB75C2}"= UDP:C:\Program Files\Atari\Neverwinter Nights 2\nwn2server.exe:Neverwinter Nights 2 Server
"{97D4F8BA-7FC4-4CCD-80FD-56E65EDB01C3}"= TCP:C:\Program Files\Atari\Neverwinter Nights 2\nwn2server.exe:Neverwinter Nights 2 Server
"TCP Query User{0C69F764-0B47-4E7F-82DF-118EAA54070D}C:\\program files\\midway home entertainment\\stranglehold\\binaries\\retail-stranglehold.exe"= UDP:C:\program files\midway home entertainment\stranglehold\binaries\retail-stranglehold.exe:Stranglehold
"UDP Query User{9759CFC3-32F1-4BC9-A0E9-B3F1967A90EC}C:\\program files\\midway home entertainment\\stranglehold\\binaries\\retail-stranglehold.exe"= TCP:C:\program files\midway home entertainment\stranglehold\binaries\retail-stranglehold.exe:Stranglehold
"TCP Query User{53417500-31FC-4839-880B-5BE9716E3857}C:\\program files\\codemasters\\dirt\\dirt.exe"= UDP:C:\program files\codemasters\dirt\dirt.exe:DiRT Executable
"UDP Query User{44B478FD-9508-4AFA-9701-B0EE84E1796C}C:\\program files\\codemasters\\dirt\\dirt.exe"= TCP:C:\program files\codemasters\dirt\dirt.exe:DiRT Executable
"TCP Query User{9ED7E1FB-F5CE-49F2-B864-C3B98D359E3E}C:\\program files\\gamespy arcade\\aphex.exe"= UDP:C:\program files\gamespy arcade\aphex.exe:GameSpy Arcade 1.0, Public Beta 4
"UDP Query User{9A341C87-C0C8-4D07-8780-8EBE607B0E0E}C:\\program files\\gamespy arcade\\aphex.exe"= TCP:C:\program files\gamespy arcade\aphex.exe:GameSpy Arcade 1.0, Public Beta 4
"TCP Query User{328908B2-7C48-4D6D-9098-E8912032C9D1}C:\\program files\\anno 1701\\anno1701.exe"= UDP:C:\program files\anno 1701\anno1701.exe:Anno 1701
"UDP Query User{2D515BC6-3B7C-4E0B-9E03-1F2FE0A65456}C:\\program files\\anno 1701\\anno1701.exe"= TCP:C:\program files\anno 1701\anno1701.exe:Anno 1701
"{0984231D-48F4-4878-9AB1-5318467BD3BE}"= UDP:C:\Program Files\iTunes\iTunes.exe:iTunes
"{77F1F5C4-3674-4B29-8D93-C371396B2614}"= TCP:C:\Program Files\iTunes\iTunes.exe:iTunes
"{7A1276F4-6349-40B8-83C1-91CAB92BF09C}"= C:\Program Files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
"TCP Query User{99CB6DC2-3ADD-466E-A1D7-B29E48C5736D}C:\\program files\\unreal tournament 3\\binaries\\ut3.exe"= UDP:C:\program files\unreal tournament 3\binaries\ut3.exe:UT3
"UDP Query User{DB6EB52E-35FE-44A8-B932-F8BFA0120B89}C:\\program files\\unreal tournament 3\\binaries\\ut3.exe"= TCP:C:\program files\unreal tournament 3\binaries\ut3.exe:UT3
"TCP Query User{0AE95D1D-2FB2-487E-AB21-BF8D82C24973}C:\\program files\\steam\\steamapps\\kiradu72\\half-life 2 deathmatch\\hl2.exe"= UDP:C:\program files\steam\steamapps\kiradu72\half-life 2 deathmatch\hl2.exe:hl2
"UDP Query User{DA267FF0-9C10-4E0E-837B-51C6673C436A}C:\\program files\\steam\\steamapps\\kiradu72\\half-life 2 deathmatch\\hl2.exe"= TCP:C:\program files\steam\steamapps\kiradu72\half-life 2 deathmatch\hl2.exe:hl2
"{53AC3C3D-8F14-4FFB-85E0-A8DAF577C957}"= TCP:6004|C:\Program Files\Microsoft Office\Office12\outlook.exe:Microsoft Office Outlook
"TCP Query User{FE40AE8B-37AA-4440-B40C-E16F95C1A65A}C:\\program files\\tmnationsforever\\tmforever.exe"= UDP:C:\program files\tmnationsforever\tmforever.exe:TmForever
"UDP Query User{A387CB31-6D4C-4E27-B6AC-4AA7148DA6DA}C:\\program files\\tmnationsforever\\tmforever.exe"= TCP:C:\program files\tmnationsforever\tmforever.exe:TmForever
"{A59F8EFC-7B26-4C82-A4AB-682E70EA4920}"= UDP:C:\Program Files\Ubisoft\Tom Clancy's Rainbow Six Vegas 2\Binaries\R6Vegas2_Game.exe:Tom Clancy's Rainbow Six Vegas 2
"{58867742-5F86-44F9-85F1-E7323D4FA0F6}"= TCP:C:\Program Files\Ubisoft\Tom Clancy's Rainbow Six Vegas 2\Binaries\R6Vegas2_Game.exe:Tom Clancy's Rainbow Six Vegas 2
"{E2B49174-8BC3-40B7-92B4-EFAF9CD39C7C}"= UDP:C:\Program Files\Ubisoft\Tom Clancy's Rainbow Six Vegas 2\Binaries\R6Vegas2_Launcher.exe:Tom Clancy's Rainbow Six Vegas 2 Update
"{026C6BC4-1E69-4A67-8AA9-B62DF85F498E}"= TCP:C:\Program Files\Ubisoft\Tom Clancy's Rainbow Six Vegas 2\Binaries\R6Vegas2_Launcher.exe:Tom Clancy's Rainbow Six Vegas 2 Update
"{AB96EDB1-86CA-4202-B3B6-42EBCAA59D63}"= UDP:C:\Program Files\Ubisoft\Assassin's Creed\AssassinsCreed_Dx9.exe:Assassin's Creed Dx9
"{2A0E08EF-7BDA-447A-8F48-3D2B578E6086}"= TCP:C:\Program Files\Ubisoft\Assassin's Creed\AssassinsCreed_Dx9.exe:Assassin's Creed Dx9
"{3B3DB97E-4A2E-425E-A5E5-1E0C590E2FB2}"= UDP:C:\Program Files\Ubisoft\Assassin's Creed\AssassinsCreed_Dx10.exe:Assassin's Creed Dx10
"{8EEC3C82-166D-4769-BAF3-13392D3C3380}"= TCP:C:\Program Files\Ubisoft\Assassin's Creed\AssassinsCreed_Dx10.exe:Assassin's Creed Dx10
"{33ABE204-437F-49D6-92F5-56A9381B3B03}"= UDP:C:\Program Files\Ubisoft\Assassin's Creed\AssassinsCreed_Launcher.exe:Assassin's Creed Update
"{86DC82F0-828F-4B3C-B6F6-81EE96792F30}"= TCP:C:\Program Files\Ubisoft\Assassin's Creed\AssassinsCreed_Launcher.exe:Assassin's Creed Update

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\RestrictedServices\Static\System]
"DFSR-1"= RPort=5722|UDP:%SystemRoot%\system32\svchost.exe|Svc=DFSR:Allow inbound TCP traffic|

R1 atitray;atitray;C:\Program Files\Ray Adams\ATI Tray Tools\atitray.sys [2007-05-22 11:04]
R1 sp_rsdrv2;Spyware Terminator Driver 2;C:\Windows\system32\drivers\sp_rsdrv2.sys [2008-05-10 16:57]
R2 AEADIFilters;Andrea ADI Filters Service;C:\Windows\system32\AEADISRV.EXE [2007-06-07 01:41]
R3 atikmdag;atikmdag;C:\Windows\system32\DRIVERS\atikmdag.sys [2008-05-12 18:30]
R3 SaiH5F0D;SaiH5F0D;C:\Windows\system32\DRIVERS\SaiH5F0D.sys [2006-02-28 12:52]
R3 SaiU5F0D;SaiU5F0D;C:\Windows\system32\DRIVERS\SaiU5F0D.sys [2006-02-28 12:52]
S0 OemBiosDevice;Royalty OEM Bios Extension;C:\Windows\system32\drivers\royal.sys [2007-09-14 17:04]
S3 CrystalSysInfo;CrystalSysInfo;C:\Program Files\OCCT\SysInfo.sys [2007-09-25 23:59]
S3 gdrv;gdrv;C:\Windows\gdrv.sys [2008-05-04 04:58]
S3 Steam Client Service;Steam Client Service;C:\Program Files\Common Files\Steam\SteamService.exe [2008-04-07 22:39]
S3 yukonwlh;NDIS6.0 Miniport Driver for Marvell Yukon Ethernet Controller;C:\Windows\system32\DRIVERS\yk60x86.sys [2007-05-24 11:15]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\D]
\shell\AutoRun\command - D:\.\Bin\ASSETUP.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\E]
\shell\AutoRun\command - E:\Run.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{2f250b52-62d0-11dc-81b9-806e6f6e6963}]
\shell\AutoRun\command - D:\Autorun.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{31a1e40f-638f-11dc-819e-0019db271c66}]
\shell\AutoRun\command - G:\autorun.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{31a1e411-638f-11dc-819e-0019db271c66}]
\shell\AutoRun\command - H:\autorun.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{9cb3af3f-1985-11dd-8c48-806e6f6e6963}]
\shell\AutoRun\command - D:\RunGame.exe


[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{7070D8E0-650A-46b3-B03C-9497582E6A74}]
%SystemRoot%\system32\soundschemes.exe /AddRegistration
.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-08 23:28:09
Windows 6.0.6000 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

PROCESS: C:\Windows\Explorer.exe
-> C:\Users\Kira\AppData\Local\Temp\hgGayxVl.dll
.
Completion time: 2008-06-08 23:29:56
ComboFix-quarantined-files.txt 2008-06-08 21:29:50

Pre-Run: 59,969,224,704 octets libres
Post-Run: 59,934,146,560 octets libres

299 --- E O F --- 2008-05-08 08:47:44
0

Vous n’avez pas trouvé la réponse que vous recherchez ?

Posez votre question
Réponse 5 / 8
KiraDu72 Messages postés 5 Date d'inscription dimanche 8 juin 2008 Statut Membre Dernière intervention 9 juin 2008
9 juin 2008 à 12:40
Petit up ^-^
0
Réponse 6 / 8
ep44 Messages postés 7393 Date d'inscription samedi 10 novembre 2007 Statut Contributeur Dernière intervention 11 novembre 2010 3
9 juin 2008 à 21:05
Bonsoir

Excuse moi ... le boulot :-(

Refais un hijack stp
@+
0
Réponse 7 / 8
KiraDu72 Messages postés 5 Date d'inscription dimanche 8 juin 2008 Statut Membre Dernière intervention 9 juin 2008
9 juin 2008 à 23:23
C'est déja bien beau que tu m'aide ^^



Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 23:05:44, on 08/06/2008
Platform: Windows Vista (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16643)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
C:\Windows\system32\wuauclt.exe
C:\Windows\system32\rundll32.exe
C:\Windows\system32\rundll32.exe
C:\Windows\system32\rundll32.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Windows\system32\rundll32.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {1CB20BF0-BBAE-40A7-93F4-6435FF3D0411} - C:\PROGRA~1\Crawler\Toolbar\ctbr.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~2\MEGAUP~1.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: MegaIEMn - {bf00e119-21a3-4fd1-b178-3b8537e75c92} - C:\Program Files\Megaupload\Mega Manager\MegaIEMn.dll
O3 - Toolbar: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~2\MEGAUP~1.DLL
O3 - Toolbar: Barre d'outils &Crawler - {4B3803EA-5230-4DC3-A7FC-33638F3D3542} - C:\PROGRA~1\Crawler\Toolbar\ctbr.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [SpywareTerminator] "C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe"
O4 - HKLM\..\Run: [SoundTray] C:\Program Files\Analog Devices\SoundMAX\SoundTray.exe
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [OODefragTray] C:\Windows\system32\oodtray.exe
O4 - HKLM\..\Run: [LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD\Language\Language.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"
O4 - HKLM\..\Run: [ATICustomerCare] "C:\Program Files\ATI\ATICustomerCare\ATICustomerCare.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [NVIDIA nTune] "C:\Program Files\NVIDIA Corporation\nTune\nTuneCmd.exe" clear
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKCU\..\Run: [AtiTrayTools] "C:\Program Files\Ray Adams\ATI Tray Tools\atitray.exe"
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [MSServer] rundll32.exe C:\Users\Kira\AppData\Local\Temp\awttusQJ.dll,#1
O4 - HKCU\..\Run: [cmds] rundll32.exe C:\Users\Kira\AppData\Local\Temp\hgGayxVl.dll,c
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: Crawler Search - tbr:iemenu
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\Windows\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\Windows\bdoscandel.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O13 - Gopher Prefix:
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.systemrequirementslab.com/sysreqlab2.cab
O16 - DPF: {6A060448-60F9-11D5-A6CD-0002B31F7455} (ExentInf Class) -
O16 - DPF: {8167C273-DF59-4416-B647-C8BB2C7EE83E} (WebSDev Control) - http://liveupdate.msi.com.tw/autobios/LOnline/install.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O18 - Protocol: tbr - {4D25FB7A-8902-4291-960E-9ADA051CFBBF} - C:\PROGRA~1\Crawler\Toolbar\ctbr.dll
O22 - SharedTaskScheduler: Windows DreamScene - {E31004D1-A431-41B8-826F-E902F9D95C81} - C:\Windows\System32\DreamScene.dll
O23 - Service: Andrea ADI Filters Service (AEADIFilters) - Andrea Electronics Corporation - C:\Windows\system32\AEADISRV.EXE
O23 - Service: Avira AntiVir Personal – Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal – Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: nTune Service (nTuneService) - NVIDIA - C:\Program Files\NVIDIA Corporation\nTune\nTuneService.exe
O23 - Service: O&O Defrag - O&O Software GmbH - C:\Windows\system32\oodag.exe
O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe
O23 - Service: PnkBstrB - Unknown owner - C:\Windows\system32\PnkBstrB.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared files\RichVideo.exe
O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - C:\Program Files\Spyware Terminator\sp_rsser.exe
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files\Common Files\Steam\SteamService.exe
0
Réponse 8 / 8
ep44 Messages postés 7393 Date d'inscription samedi 10 novembre 2007 Statut Contributeur Dernière intervention 11 novembre 2010 3
10 juin 2008 à 00:04
Relance hijack et clique sur "Do a system scan only"
Ensuite recherche ces lignes et coches les cases

O2 - BHO: (no name) - {1CB20BF0-BBAE-40A7-93F4-6435FF3D0411} - C:\PROGRA~1\Crawler\Toolbar\ctbr.dll
O3 - Toolbar: Barre d'outils &Crawler - {4B3803EA-5230-4DC3-A7FC-33638F3D3542} - C:\PROGRA~1\Crawler\Toolbar\ctbr.dll
O4 - HKCU\..\Run: [MSServer] rundll32.exe C:\Users\Kira\AppData\Local\Temp\awttusQJ.dll,#1
O4 - HKCU\..\Run: [cmds] rundll32.exe C:\Users\Kira\AppData\Local\Temp\hgGayxVl.dll,c
O16 - DPF: {6A060448-60F9-11D5-A6CD-0002B31F7455} (ExentInf Class) -
O18 - Protocol: tbr - {4D25FB7A-8902-4291-960E-9ADA051CFBBF} - C:\PROGRA~1\Crawler\Toolbar\ctbr.dll

Ensuite clique sur "Fix checked"


Ensuite

Télécharge OTMoveIt (de OldTimer) sur ton Bureau.
http://download.bleepingcomputer.com/oldtimer/OTMoveIt2.exe
clic double sur OTMoveIt.exe pour le lancer.
copie la liste qui se trouve en citation ci-dessous,
et colle-la dans le cadre de gauche de OTMoveIt :
Paste List of Files/Folders to be moved.

c:\program files\crawler\toolbar\ctbr.dll
c:\users\kira\appdata\local\temp\awttusqj.dll
c:\users\kira\appdata\local\temp\hggayxvl.dll
EmptyTemp

clique sur MoveIt! pour lancer la suppression.
le résultat apparaîtra dans le cadre Results.
clique sur Exit pour fermer.
poste le rapport situé dans C:\_OTMoveIt\MovedFiles.

il te sera peut-être demandé de faire redémarrer le PC pour achever la suppression.


@+


0

Discussions similaires

casque sans fil Sennheiser TR 4200 ne fonctionne plus
jcb83400 -
DIY -

3 réponses
Sa veux dire koi??Subject: FW: Tr :FW: TR: TR
france22 -
ghano0666545160 -

12 réponses
TR/Crypt.XPACK.Gen Trojan
Mordan33 -
Utilisateur anonyme -

63 réponses
"Bip-bip" intempestif dans mon casque Sennheiser RR 4200"
Pierre -
baladur13 -

1 réponse
Signification "TR"
andromeid -
matrix4422 -

3 réponses