Virus ou ver qui detraque msn pour le moment

bah j'ai fais tout
la je suis au scan de msnfix.bat
mais il me met
scan ......
_ (qui clignote)

je fais quoi ?

quand je le télécharge avast me met
Kage\AppData\Local\Temp\rpe_qP3u.zip.part\MSNFix\incl\Hostsclean.exe
Win32:Trojan-gen {Other}
Virus/Ver
donc je ne peux pas le télécharger

ya pas de problème t'es sur ?
si c'est pour mettre un autre virus sur mon pc pour virer le précédent

lorsque je le fais, j'extrait le msnfix.zip
j'ai juste un fichier.bat
a l'interieur j'ai hostcleaner.exe, c 'est tout
donc je lance msnfix.bat, je dis francais, puis rechercher
et il me dis acces refusé, donc ca fait rien
voilà

oui, c'est tout ce qu'il me dit
j'ai desactivé avast pendant le scan aussi, il me dis juste accès refusé, 7 fois

ah ok
tea timer ?

il m'a fait tout ca
mais au moment de quitter apres avoir créé le rapport, il m'a fait un bluescreen
les details sont la au cas ou

Signature du problème :
Nom d’événement de problème: BlueScreen
Version du système: 6.0.6001.2.1.0.768.3
Identificateur de paramètres régionaux: 1036

Informations supplémentaires sur le problème :
BCCode: 19
BCP1: 00000020
BCP2: 84776000
BCP3: 84776480
BCP4: 18900000
OS Version: 6_0_6001
Service Pack: 1_0
Product: 768_1

Fichiers aidant à décrire le problème :
C:\Windows\Minidump\Mini111108-01.dmp
C:\Windows\Temp\WER-43250-0.sysdata.xml
C:\Windows\Temp\WER7CCC.tmp.version.txt

ensuite le rapport de combofix :

ComboFix 08-11-10.01 - Letithord Kage 2008-11-11 14:28:20.1 - NTFSx86
Microsoft® Windows Vista™ Édition Familiale Premium 6.0.6001.1.1252.1.1036.18.1321 [GMT 1:00]
Lancé depuis: C:\Users\Letithord Kage\Desktop\ComboFix.exe
* Un nouveau point de restauration a été créé
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\install.exe
C:\Users\Letithord Kage\AppData\Local\oicce.dat
C:\Users\Letithord Kage\AppData\Local\oicce_nav.dat
C:\Users\Letithord Kage\AppData\Local\oicce_navps.dat
C:\Windows\admintxt.txt
C:\Windows\service.exe
C:\Windows\System32\BaGMlRqr.ini
C:\Windows\System32\BaGMlRqr.ini2
C:\Windows\system32\cesogbqj.ini
C:\Windows\system32\djdielwu.ini
C:\Windows\system32\vvwHRXbc.ini
C:\Windows\System32\vvwHRXbc.ini2
C:\Windows\System32\wGNXyGgh.ini
C:\Windows\System32\wGNXyGgh.ini2
C:\Windows\system32\xqmjhmwh.ini

.
((((((((((((((((((((((((((((((((((((((( Pilotes/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_NPF


((((((((((((((((((((((((((((( Fichiers créés du 2008-10-11 au 2008-11-11 ))))))))))))))))))))))))))))))))))))
.

2008-11-11 13:53 . 2008-11-11 13:53 <REP> d-------- C:\Users\Letithord Kage\MSNFix
2008-11-11 08:32 . 2008-11-11 08:32 <REP> d-------- C:\Program Files\Trend Micro
2008-11-11 08:31 . 2008-11-11 08:32 812,344 --a------ C:\Users\Letithord Kage\HJTInstall.exe
2008-11-10 22:30 . 2008-11-10 22:30 <REP> d-------- C:\VundoFix Backups
2008-11-10 16:31 . 2008-11-10 16:31 <REP> d-------- C:\Program Files\CCleaner
2008-11-09 19:47 . 2008-11-09 19:47 <REP> d-------- C:\Program Files\EA GAMES
2008-11-07 19:05 . 2008-11-07 19:05 <REP> d-------- C:\Program Files\Panasonic
2008-11-07 19:05 . 2006-02-27 11:45 36,864 --a------ C:\Windows\System32\SDDEVMGR.dll
2008-11-04 18:00 . 2008-11-04 18:00 <REP> d-------- C:\Program Files\GTASACenter
2008-11-04 13:15 . 2008-11-04 13:15 <REP> d-------- C:\Users\Letithord Kage\AppData\Roaming\SPORE
2008-11-04 13:06 . 2008-11-04 13:06 <REP> d-------- C:\Program Files\Electronic Arts
2008-11-04 12:34 . 2008-11-04 12:34 <REP> d-------- C:\Users\All Users\Spore
2008-11-04 12:34 . 2008-11-04 12:34 <REP> d-------- C:\ProgramData\Spore
2008-11-03 23:47 . 2008-11-03 23:47 <REP> d-------- C:\Users\Letithord Kage\AppData\Roaming\SporeCreatureCreator
2008-11-03 20:11 . 2008-08-05 10:49 428,544 --a------ C:\Windows\System32\EncDec.dll
2008-11-03 20:11 . 2008-08-05 10:49 293,376 --a------ C:\Windows\System32\psisdecd.dll
2008-11-03 20:11 . 2008-08-05 10:48 217,088 --a------ C:\Windows\System32\psisrndr.ax
2008-11-03 20:11 . 2008-08-05 10:48 177,664 --a------ C:\Windows\System32\mpg2splt.ax
2008-11-03 20:11 . 2008-08-05 10:48 80,896 --a------ C:\Windows\System32\MSNP.ax
2008-11-03 00:20 . 2008-11-03 13:04 43,520 --a------ C:\Windows\System32\CmdLineExt03.dll
2008-10-28 22:56 . 2008-08-12 04:39 443,392 --a------ C:\Windows\System32\win32spl.dll
2008-10-28 22:56 . 2008-09-18 05:56 147,456 --a------ C:\Windows\System32\Faultrep.dll
2008-10-28 22:56 . 2008-09-18 05:56 125,952 --a------ C:\Windows\System32\wersvc.dll
2008-10-25 15:57 . 2008-10-25 15:57 <REP> d-------- C:\Program Files\Common Files\PCSuite
2008-10-25 15:57 . 2008-10-25 15:57 <REP> d-------- C:\Program Files\Common Files\Nokia
2008-10-25 10:22 . 2007-09-17 14:53 21,632 --a------ C:\Windows\System32\drivers\pccsmcfd.sys
2008-10-25 10:21 . 2008-10-25 10:21 <REP> d-------- C:\Program Files\PC Connectivity Solution
2008-10-25 07:24 . 2008-10-29 12:58 <REP> d-------- C:\World of Warcraft
2008-10-24 23:32 . 2008-10-25 07:24 <REP> d-------- C:\Program Files\Common Files\Blizzard Entertainment
2008-10-17 16:39 . 2008-09-03 04:59 468,992 --a------ C:\Windows\System32\newdev.dll
2008-10-17 16:39 . 2008-09-03 04:58 74,752 --a------ C:\Windows\System32\newdev.exe
2008-10-17 16:38 . 2008-09-18 06:09 3,601,464 --a------ C:\Windows\System32\ntkrnlpa.exe
2008-10-17 16:38 . 2008-09-18 06:09 3,549,240 --a------ C:\Windows\System32\ntoskrnl.exe
2008-10-17 16:38 . 2008-09-18 03:16 2,032,640 --a------ C:\Windows\System32\win32k.sys
2008-10-17 16:38 . 2008-10-02 02:32 1,383,424 --a------ C:\Windows\System32\mshtml.tlb
2008-10-17 16:38 . 2008-10-02 04:49 827,392 --a------ C:\Windows\System32\wininet.dll
2008-10-17 16:38 . 2008-08-27 02:06 288,768 --a------ C:\Windows\System32\drivers\srv.sys

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-11-11 12:52 --------- d-----w C:\ProgramData\Spybot - Search & Destroy
2008-11-10 22:32 --------- d-----w C:\Users\Letithord Kage\AppData\Roaming\OpenOffice.org2
2008-11-09 18:59 138,464 ----a-w C:\Windows\system32\drivers\PnkBstrK.sys
2008-11-09 18:47 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-11-09 13:18 --------- d-----w C:\Program Files\Rockstar Games
2008-11-09 11:31 --------- d-----w C:\Users\Letithord Kage\AppData\Roaming\Skype
2008-11-09 11:29 --------- d-----w C:\Users\Letithord Kage\AppData\Roaming\skypePM
2008-11-07 17:48 --------- d-----w C:\Users\Letithord Kage\AppData\Roaming\PC Suite
2008-11-04 16:56 --------- d-----w C:\ProgramData\NVIDIA
2008-11-03 01:16 --------- d-----w C:\Program Files\Warcraft III
2008-10-25 14:57 --------- d-----w C:\Program Files\Nokia
2008-10-25 09:20 --------- d-----w C:\ProgramData\Installations
2008-10-24 01:07 --------- d-----w C:\Program Files\Microsoft Silverlight
2008-10-17 16:08 --------- d-----w C:\Program Files\Windows Mail
2008-10-12 08:55 --------- d-----w C:\Users\Letithord Kage\AppData\Roaming\gtk-2.0
2008-10-10 20:19 --------- d-----w C:\Program Files\Spybot - Search & Destroy
2008-09-14 17:16 --------- d-----w C:\Users\Letithord Kage\AppData\Roaming\Audacity
2008-03-15 21:51 174 --sha-w C:\Program Files\desktop.ini
2008-01-18 20:37 32 ----a-w C:\Users\All Users\ezsid.dat
2008-01-18 20:37 32 ----a-w C:\ProgramData\ezsid.dat
2008-01-12 21:34 278,528 ----a-w C:\Program Files\Common Files\FDEUnInstaller.exe
.

((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{2C688203-7EB3-4327-9995-1CB417BA23F9}"= "C:\Program Files\BS.Player ControlBar\BSToolbar.dll" [2008-08-11 15:11 757192]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{2C688203-7EB3-4327-9995-1CB417BA23F9}"= "C:\Program Files\BS.Player ControlBar\BSToolbar.dll" [2008-08-11 15:11 757192]

[HKEY_CLASSES_ROOT\clsid\{2c688203-7eb3-4327-9995-1cb417ba23f9}]
[HKEY_CLASSES_ROOT\BSToolbar.ToolBandObj.1]
[HKEY_CLASSES_ROOT\TypeLib\{1FC79FB5-E4BD-48c8-B2E9-B8E74DB2C3A9}]
[HKEY_CLASSES_ROOT\BSToolbar.ToolBandObj]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray.exe"="C:\Windows\ehome\ehTray.exe" [2008-01-19 08:33 125952]
"RocketDock"="C:\Program Files\RocketDock\RocketDock.exe" [2007-09-02 12:58 495616]
"AlcoholAutomount"="C:\Program Files\Alcohol Soft\Alcohol 52\axcmd.exe" [2008-03-20 17:39 216520]
"msnmsgr"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe" [2008-04-24 11:29 5724184]
"WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [2008-01-19 08:33 202240]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 03:27 144784]
"ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [2005-02-16 15:15 81920]
"LogitechCommunicationsManager"="C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe" [2008-02-13 12:02 564496]
"LogitechQuickCamRibbon"="C:\Program Files\Logitech\QuickCam\Quickcam.exe" [2008-02-13 12:06 2196240]
"NvCplDaemon"="C:\Windows\system32\NvCpl.dll" [2008-06-12 00:53 13535776]
"NvMediaCenter"="C:\Windows\system32\NvMcTray.dll" [2008-06-12 00:53 92704]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)

[HKLM\~\startupfolder\C:^Users^Letithord Kage^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Galactic Civilizations II Launcher.lnk]
path=C:\Users\Letithord Kage\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Galactic Civilizations II Launcher.lnk
backup=C:\Windows\pss\Galactic Civilizations II Launcher.lnk.Startup
backupExtension=.Startup

[HKLM\~\startupfolder\C:^Users^Letithord Kage^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OpenOffice.org 2.3.lnk]
path=C:\Users\Letithord Kage\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 2.3.lnk
backup=C:\Windows\pss\OpenOffice.org 2.3.lnk.Startup
backupExtension=.Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
--a------ 2008-01-11 21:16 39792 C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
--a------ 2008-04-01 10:39 486856 C:\Program Files\DAEMON Tools Lite\daemon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
--a------ 2008-04-24 11:29 5724184 C:\Program Files\Windows Live\Messenger\msnmsgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--a------ 2006-01-12 15:40 155648 C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
-ra------ 2008-07-23 13:11 21738792 C:\Program Files\Skype\Phone\Skype.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\XboxStat]
--a------ 2007-09-26 18:05 734264 c:\Program Files\Microsoft Xbox 360 Accessories\XBoxStat.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"SerialNumber"="A109A-K13-3ZXD-BAP5-TE"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{F7A9DD2F-757F-4505-9CFF-0445FC293D58}"= C:\Program Files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
"{831702F2-99EF-40A7-A831-A58834641E25}"= UDP:C:\Program Files\Pcsx2_0.9.4\pcsx2.exe:Pcsx2 0.9.4
"{499B009B-655B-4A9D-A3EE-68B6C3A7C2A2}"= TCP:C:\Program Files\Pcsx2_0.9.4\pcsx2.exe:Pcsx2 0.9.4
"TCP Query User{76A3CF8E-0BCE-4916-8350-BEF4DB369EEF}C:\\program files\\microsoft games\\halo\\halo.exe"= UDP:C:\program files\microsoft games\halo\halo.exe:Halo
"UDP Query User{C7CB7D95-8891-448E-AD02-97A62AB009E9}C:\\program files\\microsoft games\\halo\\halo.exe"= TCP:C:\program files\microsoft games\halo\halo.exe:Halo
"{8EC4B903-BDD6-4A02-A429-69FEF77E6B5E}"= UDP:C:\Program Files\Warcraft III\Warcraft III.exe:Warcraft III
"{C65922AC-96D8-4D5B-A6A6-4AF283DBABAF}"= TCP:C:\Program Files\Warcraft III\Warcraft III.exe:Warcraft III
"{91CF21D0-F9FE-4345-A13E-68289C1BEA3A}"= UDP:C:\Program Files\Warcraft III\Frozen Throne.exe:Warcraft III - The Frozen Throne
"{BC154180-43AC-40C1-9FFF-D17A19B8DE91}"= TCP:C:\Program Files\Warcraft III\Frozen Throne.exe:Warcraft III - The Frozen Throne
"{8E20DC2B-E8EA-42FF-8D36-45FD02E7F9AF}"= UDP:6112:6112
"TCP Query User{37882B2F-B44C-4DB0-A856-A6F9ECF14546}C:\\program files\\warcraft iii\\war3.exe"= UDP:C:\program files\warcraft iii\war3.exe:Warcraft III
"UDP Query User{172EAFF2-FBA8-4D04-BEE5-1402D4F02B83}C:\\program files\\warcraft iii\\war3.exe"= TCP:C:\program files\warcraft iii\war3.exe:Warcraft III
"TCP Query User{1CC8A0A4-7BAE-44D3-9667-A9AF57221FD5}C:\\program files\\thq\\titan quest\\titan quest.exe"= UDP:C:\program files\thq\titan quest\titan quest.exe:Titan Quest
"UDP Query User{67C5BAD8-61CA-4BA3-9030-37B9683A3FC5}C:\\program files\\thq\\titan quest\\titan quest.exe"= TCP:C:\program files\thq\titan quest\titan quest.exe:Titan Quest
"{DBAB7ECB-9344-4CE3-903D-97E80C995398}"= UDP:C:\Program Files\EasyPHP 2.0b1\EasyPHP.exe:EasyPHP
"{89404B6A-C626-42EB-9CEF-22D83AADC3C3}"= TCP:C:\Program Files\EasyPHP 2.0b1\EasyPHP.exe:EasyPHP
"{F59058D5-E0E3-47ED-9F90-05B49106D888}"= UDP:C:\Program Files\Alwil Software\Avast4\ashAvast.exe:avast! Antivirus
"{2FD46D87-A418-427C-A646-F3CCE2579184}"= TCP:C:\Program Files\Alwil Software\Avast4\ashAvast.exe:avast! Antivirus
"{EEAE432C-5EAE-4422-A3DB-433B04AB05B2}"= UDP:C:\Program Files\Hamachi\hamachi.exe:Hamachi
"{7AF132B0-84A2-40F3-9350-CF6421CA4616}"= TCP:C:\Program Files\Hamachi\hamachi.exe:Hamachi
"TCP Query User{430D4882-2C13-49D1-B74B-C4620EA630C7}C:\\program files\\nfsmw\\speed.exe"= UDP:C:\program files\nfsmw\speed.exe:speed
"UDP Query User{070C2F6C-05F9-475F-A22B-96EF92BD0C72}C:\\program files\\nfsmw\\speed.exe"= TCP:C:\program files\nfsmw\speed.exe:speed
"{F8C7BD91-B227-4D4F-9D09-7204B57ED265}"= UDP:80:80
"{BA5C3A4A-87BF-4306-8ABA-905576AE652F}"= UDP:13505:13505
"{8E85C849-CD6E-45F8-8BBE-C300B0B183F3}"= UDP:30900:30900
"{2C3171EB-93CF-4E9C-823D-F2B988733372}"= UDP:30999:30999
"{E2B87042-F4B0-43DA-9597-A0D36934A1D7}"= TCP:3658:3658
"TCP Query User{E78BFAF3-722D-4948-8955-826945507301}C:\\thq\\dawn of war\\w40k.exe"= UDP:C:\thq\dawn of war\w40k.exe:W40K
"UDP Query User{4CEE3435-6EBA-4DC1-A8F0-B1000EC414FE}C:\\thq\\dawn of war\\w40k.exe"= TCP:C:\thq\dawn of war\w40k.exe:W40K
"TCP Query User{E99883FE-7957-4A13-9C61-90C5AE3813B0}C:\\thq\\dawn of war - dark crusade\\darkcrusade.exe"= UDP:C:\thq\dawn of war - dark crusade\darkcrusade.exe:DarkCrusade
"UDP Query User{A2510365-8FB5-4948-B0D7-3DF5FBB1F22E}C:\\thq\\dawn of war - dark crusade\\darkcrusade.exe"= TCP:C:\thq\dawn of war - dark crusade\darkcrusade.exe:DarkCrusade
"{DC32645A-5EC2-4C5B-8AFC-FB39ABF44750}"= UDP:22277:BitComet 22277 TCP
"{97645D43-9DAA-42CC-898C-63A22A1843A0}"= TCP:22277:BitComet 22277 UDP
"TCP Query User{02842E36-A96D-4935-BD82-C8A86ADD19BC}C:\\program files\\bitcomet\\bitcomet.exe"= UDP:C:\program files\bitcomet\bitcomet.exe:BitComet - a BitTorrent Client
"UDP Query User{1EAA2460-39FB-4621-AD49-CB4F242B5CA6}C:\\program files\\bitcomet\\bitcomet.exe"= TCP:C:\program files\bitcomet\bitcomet.exe:BitComet - a BitTorrent Client
"TCP Query User{4DCAAF6A-8940-4457-BBAD-3D8DC74C8733}C:\\ravenshield\\system\\ravenshield.exe"= UDP:C:\ravenshield\system\ravenshield.exe:ravenshield
"UDP Query User{945B5131-CBCC-4E97-A5B0-56D13CE31CF9}C:\\ravenshield\\system\\ravenshield.exe"= TCP:C:\ravenshield\system\ravenshield.exe:ravenshield
"{106195F1-1DE6-4DC2-AEF1-7A5D05BD86D8}"= UDP:C:\Program Files\Firaxis Games\Sid Meier's Civilization 4\Civilization4.exe:Sid Meier's Civilization 4
"{C2E62223-8D4E-4F4D-8959-1911E77BE4AA}"= TCP:C:\Program Files\Firaxis Games\Sid Meier's Civilization 4\Civilization4.exe:Sid Meier's Civilization 4
"{A616B91A-0F51-43AC-B0EB-07F36C6AE87C}"= UDP:C:\Program Files\Firaxis Games\Sid Meier's Civilization 4\Beyond the Sword\Civ4BeyondSword.exe:Sid Meier's Civilization 4 Beyond the Sword
"{02608683-5A86-4D81-96A9-AEA068A7086B}"= TCP:C:\Program Files\Firaxis Games\Sid Meier's Civilization 4\Beyond the Sword\Civ4BeyondSword.exe:Sid Meier's Civilization 4 Beyond the Sword
"{C6C307FF-16F2-48F9-8056-28CAAA233545}"= UDP:C:\Program Files\Firaxis Games\Sid Meier's Civilization 4\Beyond the Sword\Civ4BeyondSword_PitBoss.exe:Sid Meier's Civilization 4 Beyond the Sword Pitboss
"{6F034754-7A8D-4D7D-8663-B6052CCCC01E}"= TCP:C:\Program Files\Firaxis Games\Sid Meier's Civilization 4\Beyond the Sword\Civ4BeyondSword_PitBoss.exe:Sid Meier's Civilization 4 Beyond the Sword Pitboss
"TCP Query User{F3D6670D-046A-4D4B-BD7D-7BBC9B58652C}C:\\program files\\warcraft iii\\war3.exe"= UDP:C:\program files\warcraft iii\war3.exe:Warcraft III
"UDP Query User{28C9CD1A-3CD5-4333-B506-D0332FBC9C31}C:\\program files\\warcraft iii\\war3.exe"= TCP:C:\program files\warcraft iii\war3.exe:Warcraft III
"{AAA3D80E-02B3-4735-AC9B-2EE67705A73C}"= UDP:C:\Program Files\THQ\Gas Powered Games\Supreme Commander\bin\SupremeCommander.exe:Supreme Commander
"{45497A36-F542-4515-BC42-3235DE91BC69}"= TCP:C:\Program Files\THQ\Gas Powered Games\Supreme Commander\bin\SupremeCommander.exe:Supreme Commander
"{6FF1CAA2-5D5B-4D25-ABC6-34F562E82881}"= UDP:C:\Program Files\THQ\Gas Powered Games\Supreme Commander - Forged Alliance\bin\ForgedAlliance.exe:Supreme Commander - Forged Alliance
"{C20B0560-E4FB-4148-8F80-E77246DC2A2D}"= TCP:C:\Program Files\THQ\Gas Powered Games\Supreme Commander - Forged Alliance\bin\ForgedAlliance.exe:Supreme Commander - Forged Alliance
"{E4C3EA37-0A7A-4E48-8E65-1D7E39EA4A73}"= UDP:C:\Program Files\THQ\Gas Powered Games\GPGNet\GPG.Multiplayer.Client.exe:GPGNet - Supreme Commander - Forged Alliance
"{33EA71C0-FE69-4506-8C51-287F0BBC02C5}"= TCP:C:\Program Files\THQ\Gas Powered Games\GPGNet\GPG.Multiplayer.Client.exe:GPGNet - Supreme Commander - Forged Alliance
"TCP Query User{3E03B037-785A-4DA4-A7E5-629A05AEFA60}C:\\program files\\nokia\\nokia software updater\\nsu_ui_client.exe"= UDP:C:\program files\nokia\nokia software updater\nsu_ui_client.exe:Nokia Software Updater
"UDP Query User{29758925-3793-43CA-81FB-8DB0E08D5FB2}C:\\program files\\nokia\\nokia software updater\\nsu_ui_client.exe"= TCP:C:\program files\nokia\nokia software updater\nsu_ui_client.exe:Nokia Software Updater
"TCP Query User{486499C6-4F2B-4F6E-B733-37AAA518097A}C:\\program files\\common files\\nokia\\service layer\\a\\nsl_host_process.exe"= UDP:C:\program files\common files\nokia\service layer\a\nsl_host_process.exe:Nokia Service Layer Host Process
"UDP Query User{C6473F7D-52B8-4DA1-A3E6-0F4D3965BD12}C:\\program files\\common files\\nokia\\service layer\\a\\nsl_host_process.exe"= TCP:C:\program files\common files\nokia\service layer\a\nsl_host_process.exe:Nokia Service Layer Host Process
"TCP Query User{C38FD9CD-6816-4173-85CC-E70AEC6DC5F6}C:\\windows\\system32\\dplaysvr.exe"= UDP:C:\windows\system32\dplaysvr.exe:Application d'assistance Microsoft DirectPlay
"UDP Query User{BB307391-D2BE-410E-81C7-69D9A267333A}C:\\windows\\system32\\dplaysvr.exe"= TCP:C:\windows\system32\dplaysvr.exe:Application d'assistance Microsoft DirectPlay
"TCP Query User{BB3E7CFC-F441-4D4F-823E-031F8220AAA1}C:\\program files\\the moon project\\themoonproject.exe"= UDP:C:\program files\the moon project\themoonproject.exe:The Moon Project
"UDP Query User{9051A86F-BF71-4508-B2BB-03EFA6BA81DE}C:\\program files\\the moon project\\themoonproject.exe"= TCP:C:\program files\the moon project\themoonproject.exe:The Moon Project
"{5F8FEC43-6276-4F25-BBE8-DC347214A0E5}"= Disabled:TCP:2300:Moon
"{BE763E76-C85A-4552-914C-7BA75D253A87}"= Disabled:TCP:2400:Moon
"{7C8667C5-1561-4FFA-B771-A51E50DBEF23}"= Disabled:TCP:47624:Moon
"{9562B99E-F26B-40D1-8CFC-FC84FB51D5D2}"= C:\Program Files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
"TCP Query User{7FD63B5A-4F4E-42F3-827B-4B5CFA839BDA}C:\\program files\\skype\\phone\\skype.exe"= Disabled:UDP:C:\program files\skype\phone\skype.exe:Skype. Take a deep breath
"UDP Query User{A17DFC34-64D8-4727-979C-1E2E0C0FCC0A}C:\\program files\\skype\\phone\\skype.exe"= Disabled:TCP:C:\program files\skype\phone\skype.exe:Skype. Take a deep breath
"TCP Query User{29496DE4-48EB-4A88-AAEE-098F4C43A068}C:\\program files\\microsoft games\\mechwarrior vengeance\\mw4.icd"= UDP:C:\program files\microsoft games\mechwarrior vengeance\mw4.icd:MechWarrior IV
"UDP Query User{651048D6-B193-4CC3-AA06-1E958876C008}C:\\program files\\microsoft games\\mechwarrior vengeance\\mw4.icd"= TCP:C:\program files\microsoft games\mechwarrior vengeance\mw4.icd:MechWarrior IV
"TCP Query User{389E7E14-308C-4CF5-B61C-7A7B72F36256}C:\\program files\\microsoft games\\mechwarrior vengeance\\mw4.exe"= UDP:C:\program files\microsoft games\mechwarrior vengeance\mw4.exe:MechWarrior IV
"UDP Query User{4AF34CC7-A712-4E9B-B5A3-118F1BE17627}C:\\program files\\microsoft games\\mechwarrior vengeance\\mw4.exe"= TCP:C:\program files\microsoft games\mechwarrior vengeance\mw4.exe:MechWarrior IV
"TCP Query User{BD78AF70-86BA-44CD-976F-062C54DD3594}C:\\windows\\system32\\dplaysvr.exe"= UDP:C:\windows\system32\dplaysvr.exe:Application d'assistance Microsoft DirectPlay
"UDP Query User{97405AFE-9784-44EB-B652-E242B898EEE7}C:\\windows\\system32\\dplaysvr.exe"= TCP:C:\windows\system32\dplaysvr.exe:Application d'assistance Microsoft DirectPlay
"TCP Query User{BCB09E2B-874B-4297-B071-5FE6B5F018C9}C:\\program files\\microsoft games\\mechwarrior mercenaries downloadable trial\\mw4mercs.exe"= UDP:C:\program files\microsoft games\mechwarrior mercenaries downloadable trial\mw4mercs.exe:MechWarrior IV
"UDP Query User{8B119306-7D49-4FBD-9A7B-D68E3CB70298}C:\\program files\\microsoft games\\mechwarrior mercenaries downloadable trial\\mw4mercs.exe"= TCP:C:\program files\microsoft games\mechwarrior mercenaries downloadable trial\mw4mercs.exe:MechWarrior IV
"{9E1FAA0D-7C40-438A-B7CC-83051CDB5DEC}"= Disabled:UDP:22277:BitComet 22277 TCP
"{939FABBE-61CB-459B-A01E-44EDD760A2DD}"= Disabled:TCP:22277:BitComet 22277 UDP
"TCP Query User{EDAB4D68-C921-4874-8DF4-653119C08EA9}C:\\windows\\temp\\navbrowser.exe"= UDP:C:\windows\temp\navbrowser.exe:navbrowser.exe
"UDP Query User{35B34BE5-EB62-4832-BF03-F104C3EB4259}C:\\windows\\temp\\navbrowser.exe"= TCP:C:\windows\temp\navbrowser.exe:navbrowser.exe
"TCP Query User{AF91D7A3-42A1-4F90-B0A4-FF2CE13F6C77}C:\\program files\\lucasarts\\star wars empire at war forces of corruption\\swfoc.exe"= UDP:C:\program files\lucasarts\star wars empire at war forces of corruption\swfoc.exe:Star Wars(R): Empire at War(TM): Forces of Corruption(TM)
"UDP Query User{5F27EAFD-E75F-4BC1-A24B-500053A24301}C:\\program files\\lucasarts\\star wars empire at war forces of corruption\\swfoc.exe"= TCP:C:\program files\lucasarts\star wars empire at war forces of corruption\swfoc.exe:Star Wars(R): Empire at War(TM): Forces of Corruption(TM)
"TCP Query User{3612ED3A-172B-4335-9172-166BB24A8BBF}C:\\program files\\tmnationsforever\\tmforever.exe"= UDP:C:\program files\tmnationsforever\tmforever.exe:TmForever
"UDP Query User{5282ABD4-7FC0-4132-9756-4239380BF800}C:\\program files\\tmnationsforever\\tmforever.exe"= TCP:C:\program files\tmnationsforever\tmforever.exe:TmForever
"TCP Query User{D9902B56-2D20-4B5B-94DD-D261BA674648}C:\\program files\\tmnationsforever\\tmforever.exe"= UDP:C:\program files\tmnationsforever\tmforever.exe:TmForever
"UDP Query User{5554D996-FDE2-4BC4-A146-67CB53618FB1}C:\\program files\\tmnationsforever\\tmforever.exe"= TCP:C:\program files\tmnationsforever\tmforever.exe:TmForever
"TCP Query User{271563E0-892B-4E33-B222-FE5089064CED}C:\\users\\letithord kage\\desktop\\dl\\gba\\vbalink180b0\\visualboyadvance.exe"= UDP:C:\users\letithord kage\desktop\dl\gba\vbalink180b0\visualboyadvance.exe:visualboyadvance.exe
"UDP Query User{EBBBBA28-2159-4429-BC11-78425508A2D4}C:\\users\\letithord kage\\desktop\\dl\\gba\\vbalink180b0\\visualboyadvance.exe"= TCP:C:\users\letithord kage\desktop\dl\gba\vbalink180b0\visualboyadvance.exe:visualboyadvance.exe
"{B6E40033-D6A8-43DB-BEF5-20B45B19EB96}"= C:\Program Files\Electronic Arts\Command & Conquer 3\RetailExe\1.0\cnc3game.dat:Command & Conquer 3 Les guerres du Tiberium™
"TCP Query User{110AA43B-C68F-4DCE-9646-E6FABA716DDE}C:\\program files\\electronic arts\\command & conquer 3\\retailexe\\1.9\\cnc3game.dat"= UDP:C:\program files\electronic arts\command & conquer 3\retailexe\1.9\cnc3game.dat:Command and Conquer 3 Tiberium Wars™
"UDP Query User{CA42B659-4BD8-4D69-AF9F-0AAC14DCFF92}C:\\program files\\electronic arts\\command & conquer 3\\retailexe\\1.9\\cnc3game.dat"= TCP:C:\program files\electronic arts\command & conquer 3\retailexe\1.9\cnc3game.dat:Command and Conquer 3 Tiberium Wars™
"TCP Query User{91E08067-1C72-4360-BFE6-CBC0992D5BAD}C:\\windows\\system32\\dpnsvr.exe"= UDP:C:\windows\system32\dpnsvr.exe:Serveur Microsoft DirectPlay 8
"UDP Query User{D8C00C59-8AE8-41C6-8CE3-C6776ACC830C}C:\\windows\\system32\\dpnsvr.exe"= TCP:C:\windows\system32\dpnsvr.exe:Serveur Microsoft DirectPlay 8
"{957811DF-D12C-4155-B6F2-37B726CAC072}"= Disabled:UDP:5425:viet
"{BF638E02-2C0A-4F55-9BF4-CC12427B8311}"= Disabled:TCP:5425:viet2
"TCP Query User{C8DAF7AF-55ED-44F5-96C0-495348B6B7A1}C:\\cs source lan\\hl2.exe"= UDP:C:\cs source lan\hl2.exe:hl2
"UDP Query User{2A06D448-F980-4DA3-9B51-D4C5432A3971}C:\\cs source lan\\hl2.exe"= TCP:C:\cs source lan\hl2.exe:hl2
"TCP Query User{779670B5-57B4-4BA1-86E1-328575518D56}C:\\program files\\aoe 2\\empires2.exe"= UDP:C:\program files\aoe 2\empires2.exe:Age of Empires II
"UDP Query User{E7316308-34C5-4F0A-A13A-FDCEC4F00CAE}C:\\program files\\aoe 2\\empires2.exe"= TCP:C:\program files\aoe 2\empires2.exe:Age of Empires II
"TCP Query User{713A2EAA-D50D-4C17-B582-42C1B051C4D7}C:\\jeux\\warcraft iii\\war3.exe"= UDP:C:\jeux\warcraft iii\war3.exe:Warcraft III
"UDP Query User{19731751-C0C0-4217-ADB3-F8066C75DC12}C:\\jeux\\warcraft iii\\war3.exe"= TCP:C:\jeux\warcraft iii\war3.exe:Warcraft III
"{93E84C9F-C76C-4738-8957-EC8A08FD6A4E}"= UDP:C:\Jeux\Ghost Recon Advanced Warfighter 2\graw2.exe:Ghost Recon Advanced Warfighter® 2
"{574D977A-A8E0-40F5-8832-2B883CF0BF28}"= TCP:C:\Jeux\Ghost Recon Advanced Warfighter 2\graw2.exe:Ghost Recon Advanced Warfighter® 2
"{90A9789C-9747-4ADE-8B05-11DF5B3CECC2}"= UDP:C:\Jeux\Ghost Recon Advanced Warfighter 2\graw2_dedicated.exe:Ghost Recon Advanced Warfighter® 2 Dedicated Server
"{9AF4FB48-4A24-4898-8A83-B9C3FE8F25A2}"= TCP:C:\Jeux\Ghost Recon Advanced Warfighter 2\graw2_dedicated.exe:Ghost Recon Advanced Warfighter® 2 Dedicated Server
"TCP Query User{99C7C7B8-7919-4CAD-9AE6-431ADBBEA2D7}C:\\jeux\\ghost recon advanced warfighter 2\\graw2.exe"= UDP:C:\jeux\ghost recon advanced warfighter 2\graw2.exe:Ghost Recon Advanced Warfighter® 2
"UDP Query User{7047792A-2695-4157-A0C5-BA0E53DDE8ED}C:\\jeux\\ghost recon advanced warfighter 2\\graw2.exe"= TCP:C:\jeux\ghost recon advanced warfighter 2\graw2.exe:Ghost Recon Advanced Warfighter® 2
"TCP Query User{315F084A-9A4E-4872-A3C9-1A98F52F0292}C:\\jeux\\aoe 2\\empires2.exe"= UDP:C:\jeux\aoe 2\empires2.exe:Age of Empires II
"UDP Query User{061684EA-1BEA-43AE-8E65-2C89CC3BD52B}C:\\jeux\\aoe 2\\empires2.exe"= TCP:C:\jeux\aoe 2\empires2.exe:Age of Empires II
"TCP Query User{79090F94-B451-4DCC-94FD-EA41503EFCAA}C:\\jeux\\aoe 2\\age2_x1.exe"= UDP:C:\jeux\aoe 2\age2_x1.exe:Age of Empires II Expansion
"UDP Query User{4D58975C-DD72-466E-A3E2-07CBF4E31700}C:\\jeux\\aoe 2\\age2_x1.exe"= TCP:C:\jeux\aoe 2\age2_x1.exe:Age of Empires II Expansion
"TCP Query User{377044CA-6A90-4A86-A70E-FB0B59A6BD78}C:\\jeux\\halo\\halo.exe"= UDP:C:\jeux\halo\halo.exe:Halo
"UDP Query User{DF923D03-E3D2-43EE-A55F-0AE6DC91022A}C:\\jeux\\halo\\halo.exe"= TCP:C:\jeux\halo\halo.exe:Halo
"TCP Query User{732879AE-0813-4FD8-A318-8A8ED2FAD662}C:\\jeux\\tmnationsforever\\tmforever.exe"= UDP:C:\jeux\tmnationsforever\tmforever.exe:TmForever
"UDP Query User{BAE5F8E4-F731-4F25-BF1A-0CE9ECF68355}C:\\jeux\\tmnationsforever\\tmforever.exe"= TCP:C:\jeux\tmnationsforever\tmforever.exe:TmForever
"{EC835658-2629-4B24-AFFF-33571363E152}"= Disabled:UDP:C:\Program Files\Skype\Phone\Skype.exe:Skype
"{76C831C5-2DB9-4180-9372-728ED31BE941}"= TCP:C:\Program Files\Skype\Phone\Skype.exe:Skype
"TCP Query User{D7753373-B4B0-46A3-B1A6-4F684F95D307}C:\\jeux\\mechwarrior vengeance\\mw4.exe"= UDP:C:\jeux\mechwarrior vengeance\mw4.exe:MechWarrior IV
"UDP Query User{FB639808-D5F4-41B1-AB8D-F7890117C692}C:\\jeux\\mechwarrior vengeance\\mw4.exe"= TCP:C:\jeux\mechwarrior vengeance\mw4.exe:MechWarrior IV
"TCP Query User{7D37A4A1-45E3-44FA-AD8D-B8CBB61AFA2A}C:\\jeux\\mechwarrior 4 vengeance\\mw4.icd"= UDP:C:\jeux\mechwarrior 4 vengeance\mw4.icd:MechWarrior IV
"UDP Query User{EC61E3B4-6BF7-475C-83E4-3B1C694EBFB7}C:\\jeux\\mechwarrior 4 vengeance\\mw4.icd"= TCP:C:\jeux\mechwarrior 4 vengeance\mw4.icd:MechWarrior IV
"TCP Query User{F638A824-4E7C-4FB3-8B06-C4F4E2EFF429}C:\\program files\\mozilla firefox\\firefox.exe"= UDP:C:\program files\mozilla firefox\firefox.exe:Firefox
"UDP Query User{63204CF9-84BC-41FA-8D76-A980353B2577}C:\\program files\\mozilla firefox\\firefox.exe"= TCP:C:\program files\mozilla firefox\firefox.exe:Firefox
"TCP Query User{83876B16-B086-4ED3-BC16-C848CB3EBA96}C:\\jeux\\microsoft games\\halo\\halo.exe"= UDP:C:\jeux\microsoft games\halo\halo.exe:Halo
"UDP Query User{D5C25B31-E760-4109-BB48-48C4FA3FDA7D}C:\\jeux\\microsoft games\\halo\\halo.exe"= TCP:C:\jeux\microsoft games\halo\halo.exe:Halo
"TCP Query User{D6C07E4F-35F2-4EEE-A42B-4EB767F7B74C}C:\\jeux\\microsoft games\\halo\\halo.exe"= UDP:C:\jeux\microsoft games\halo\halo.exe:Halo
"UDP Query User{6DA5077B-48DA-4D98-B224-C6AD22C13BA0}C:\\jeux\\microsoft games\\halo\\halo.exe"= TCP:C:\jeux\microsoft games\halo\halo.exe:Halo
"TCP Query User{A9A60803-26D1-4D28-BA4C-786017C97DF0}C:\\jeux\\mechwarrior 4 vengeance_mien\\mw4.icd"= UDP:C:\jeux\mechwarrior 4 vengeance_mien\mw4.icd:MechWarrior IV
"UDP Query User{201F5DA2-47D3-407B-BFC1-806349F92CF6}C:\\jeux\\mechwarrior 4 vengeance_mien\\mw4.icd"= TCP:C:\jeux\mechwarrior 4 vengeance_mien\mw4.icd:MechWarrior IV
"TCP Query User{4B8ACE34-1182-431C-B43F-48B6F68E8641}C:\\jeux\\ut2004\\system\\ut2004.exe"= UDP:C:\jeux\ut2004\system\ut2004.exe:UT2004
"UDP Query User{9B2F6961-E4B6-4286-940A-FFCCC640477A}C:\\jeux\\ut2004\\system\\ut2004.exe"= TCP:C:\jeux\ut2004\system\ut2004.exe:UT2004
"TCP Query User{95BB6740-A6B1-4353-AC56-93C6CA849ED2}C:\\jeux\\mechwarrior vengeance\\mw4.exe"= UDP:C:\jeux\mechwarrior vengeance\mw4.exe:MechWarrior IV
"UDP Query User{0AD0E531-E48F-4424-9059-972CE0AEC61B}C:\\jeux\\mechwarrior vengeance\\mw4.exe"= TCP:C:\jeux\mechwarrior vengeance\mw4.exe:MechWarrior IV
"TCP Query User{962CF2FB-AC74-425B-A564-E0555AFA3762}C:\\program files\\vietcong\\vcded.exe"= UDP:C:\program files\vietcong\vcded.exe:vcded
"UDP Query User{E9416829-3CDF-45D5-8C8E-47911B81CCAC}C:\\program files\\vietcong\\vcded.exe"= TCP:C:\program files\vietcong\vcded.exe:vcded
"TCP Query User{0DE30B83-41B2-47EB-823F-6612DAC5F1EE}C:\\program files\\atari\\act of war - high treason\\actofwar_hightreason.exe"= Disabled:UDP:C:\program files\atari\act of war - high treason\actofwar_hightreason.exe:ActOfWar_HighTreason
"UDP Query User{C4AE5877-EFFA-41D7-89A4-F63301CE18BD}C:\\program files\\atari\\act of war - high treason\\actofwar_hightreason.exe"= Disabled:TCP:C:\program files\atari\act of war - high treason\actofwar_hightreason.exe:ActOfWar_HighTreason
"TCP Query User{981B2437-A3AB-47A0-A730-0CEB7FEBA9BA}C:\\jeux\\aoe 2\\age2_x1.exe"= Disabled:UDP:C:\jeux\aoe 2\age2_x1.exe:Age of Empires II Expansion
"UDP Query User{0804D55E-40D3-4EBB-98B0-684A1591ECAC}C:\\jeux\\aoe 2\\age2_x1.exe"= Disabled:TCP:C:\jeux\aoe 2\age2_x1.exe:Age of Empires II Expansion
"{09C3BA40-6E53-43A6-91FF-8B1A5CC8647A}"= Disabled:UDP:C:\Program Files\EA GAMES\Battlefield 2 Demo\BF2.exe:Battlefield 2
"{C6695074-C4D1-4B16-9910-C5A5BC2B6FFB}"= Disabled:TCP:C:\Program Files\EA GAMES\Battlefield 2 Demo\BF2.exe:Battlefield 2
"TCP Query User{B6B1E37F-B358-4C61-B053-D85619BC293C}C:\\program files\\bitcomet\\bitcomet.exe"= Disabled:UDP:C:\program files\bitcomet\bitcomet.exe:BitComet - a BitTorrent Client
"UDP Query User{41A535E8-0D95-4B91-9C7B-F251EA6DC89C}C:\\program files\\bitcomet\\bitcomet.exe"= Disabled:TCP:C:\program files\bitcomet\bitcomet.exe:BitComet - a BitTorrent Client
"TCP Query User{0E9DD281-7898-4CD3-A95B-E6C04C61C4C0}C:\\world of warcraft\\wow-1.12.0-frfr-downloader.exe"= Disabled:UDP:C:\world of warcraft\wow-1.12.0-frfr-downloader.exe:Blizzard Downloader
"UDP Query User{CE42406A-ABF8-4DFC-B20C-89286DFE0B94}C:\\world of warcraft\\wow-1.12.0-frfr-downloader.exe"= Disabled:TCP:C:\world of warcraft\wow-1.12.0-frfr-downloader.exe:Blizzard Downloader
"TCP Query User{0046D547-1A99-4F02-A464-8C212D8F0C85}C:\\thq\\dawn of war - dark crusade\\darkcrusade.exe"= Disabled:UDP:C:\thq\dawn of war - dark crusade\darkcrusade.exe:DarkCrusade
"UDP Query User{780859C6-984D-4C0D-9E97-81C40424D900}C:\\thq\\dawn of war - dark crusade\\darkcrusade.exe"= Disabled:TCP:C:\thq\dawn of war - dark crusade\darkcrusade.exe:DarkCrusade
"TCP Query User{66C1C061-409F-487B-94CC-29EBE9DB0FD7}C:\\jeux\\thq\\dawn of war - dark crusade\\darkcrusade.exe"= Disabled:UDP:C:\jeux\thq\dawn of war - dark crusade\darkcrusade.exe:DarkCrusade
"UDP Query User{650B0A75-F068-4BEF-AC4F-60011B50E23A}C:\\jeux\\thq\\dawn of war - dark crusade\\darkcrusade.exe"= Disabled:TCP:C:\jeux\thq\dawn of war - dark crusade\darkcrusade.exe:DarkCrusade
"TCP Query User{BF5ACD23-5E1C-472D-9D31-5AAD69050E2B}C:\\jeux\\sierra\\empire earth - the art of conquest\\ee-aoc.exe"= Disabled:UDP:C:\jeux\sierra\empire earth - the art of conquest\ee-aoc.exe:EE-AOC
"UDP Query User{4986A969-1C13-4B7C-BFE9-6011DC811749}C:\\jeux\\sierra\\empire earth - the art of conquest\\ee-aoc.exe"= Disabled:TCP:C:\jeux\sierra\empire earth - the art of conquest\ee-aoc.exe:EE-AOC
"{C4F1C24F-4ECE-48FA-82A7-66986757D775}"= Disabled:UDP:C:\Users\Letithord Kage\AppData\Local\F4\ClientUpdater\ClientUpdater.exe:F4 Game Client Updater
"{69DC1FC5-19CC-4A8E-83BC-224C9EBEEBB6}"= Disabled:TCP:C:\Users\Letithord Kage\AppData\Local\F4\ClientUpdater\ClientUpdater.exe:F4 Game Client Updater
"TCP Query User{FB51C873-60BD-4814-99DE-60835E3D8480}C:\\cs source lan\\hl2.exe"= Disabled:UDP:C:\cs source lan\hl2.exe:hl2
"UDP Query User{ECB457A2-06E0-4EDC-B26F-A9EC46C1677A}C:\\cs source lan\\hl2.exe"= Disabled:TCP:C:\cs source lan\hl2.exe:hl2
"TCP Query User{8E2F3CB3-121B-4B7E-BC52-716DCFE4FA49}C:\\jeux\\cs source lan\\hl2.exe"= Disabled:UDP:C:\jeux\cs source lan\hl2.exe:hl2
"UDP Query User{75A07CD4-FD33-46FA-87DC-52CC96234519}C:\\jeux\\cs source lan\\hl2.exe"= Disabled:TCP:C:\jeux\cs source lan\hl2.exe:hl2
"TCP Query User{C4EDDADA-28F1-4B93-BF5A-BDACC02F649E}C:\\program files\\capcom\\lost_planet_trial_dx9\\lostplanetdx9.exe"= Disabled:UDP:C:\program files\capcom\lost_planet_trial_dx9\lostplanetdx9.exe:LostPlanetDX9
"UDP Query User{EDA1EF4E-9018-4886-94F8-397120DBF7FF}C:\\program files\\capcom\\lost_planet_trial_dx9\\lostplanetdx9.exe"= Disabled:TCP:C:\program files\capcom\lost_planet_trial_dx9\lostplanetdx9.exe:LostPlanetDX9
"TCP Query User{10D1F8DE-C26C-41A2-A2AF-050C1D0203BD}C:\\jeux\\metin2\\metin2.bin"= Disabled:UDP:C:\jeux\metin2\metin2.bin:metin2.bin
"UDP Query User{566844A8-0540-4FFF-9B71-291584A0D73D}C:\\jeux\\metin2\\metin2.bin"= Disabled:TCP:C:\jeux\metin2\metin2.bin:metin2.bin
"TCP Query User{4D2DB451-1A2B-4D9A-AA3A-4CABDA57274B}C:\\ravenshield\\system\\ravenshield.exe"= Disabled:UDP:C:\ravenshield\system\ravenshield.exe:ravenshield
"UDP Query User{1BD409A5-20D3-45D3-A212-A1FEB091F44B}C:\\ravenshield\\system\\ravenshield.exe"= Disabled:TCP:C:\ravenshield\system\ravenshield.exe:ravenshield
"{72146751-240A-4475-B71D-5E0AB48C6D8B}"= Disabled:UDP:C:\Program Files\Firaxis Games\Sid Meier's Civilization 4\Civilization4.exe:Sid Meier's Civilization 4
"{F47997E7-1139-47C8-A8AD-B7AE961AC140}"= Disabled:TCP:C:\Program Files\Firaxis Games\Sid Meier's Civilization 4\Civilization4.exe:Sid Meier's Civilization 4
"{136C31A7-9936-4D63-AA65-111FD9525FF8}"= Disabled:UDP:C:\Program Files\Firaxis Games\Sid Meier's Civilization 4\Beyond the Sword\Civ4BeyondSword.exe:Sid Meier's Civilization 4 Beyond the Sword
"{EE94CA85-B07F-425E-AF05-D270216F917F}"= Disabled:TCP:C:\Program Files\Firaxis Games\Sid Meier's Civilization 4\Beyond the Sword\Civ4BeyondSword.exe:Sid Meier's Civilization 4 Beyond the Sword
"{B5026598-26EE-4360-B582-75C5FEAB82D6}"= Disabled:UDP:C:\Program Files\Firaxis Games\Sid Meier's Civilization 4\Beyond the Sword\Civ4BeyondSword_PitBoss.exe:Sid Meier's Civilization 4 Beyond the Sword Pitboss
"{F6918672-982E-4ECE-B1DC-7D6A4E9E4A5B}"= Disabled:TCP:C:\Program Files\Firaxis Games\Sid Meier's Civilization 4\Beyond the Sword\Civ4BeyondSword_PitBoss.exe:Sid Meier's Civilization 4 Beyond the Sword Pitboss
"TCP Query User{E514806B-6287-4478-A2AC-9726A1251B88}C:\\program files\\nfsmw\\speed.exe"= Disabled:UDP:C:\program files\nfsmw\speed.exe:speed
"UDP Query User{CBE2AA87-DD61-45E3-9E41-6641DCCC6E16}C:\\program files\\nfsmw\\speed.exe"= Disabled:TCP:C:\program files\nfsmw\speed.exe:speed
"TCP Query User{39319FE0-0408-49AE-8AF2-F90DD58DD665}C:\\program files\\the moon project\\themoonproject.exe"= Disabled:UDP:C:\program files\the moon project\themoonproject.exe:The Moon Project
"UDP Query User{68D1E121-7B52-4B4C-A08B-0E7EC0B2E92C}C:\\program files\\the moon project\\themoonproject.exe"= Disabled:TCP:C:\program files\the moon project\themoonproject.exe:The Moon Project
"TCP Query User{A476A237-C92C-4887-99B5-147058AFD9DF}C:\\jeux\\ut2004\\system\\ut2004.exe"= Disabled:UDP:C:\jeux\ut2004\system\ut2004.exe:UT2004
"UDP Query User{58F3CC32-03EF-454F-84ED-E2E3372FDCE5}C:\\jeux\\ut2004\\system\\ut2004.exe"= Disabled:TCP:C:\jeux\ut2004\system\ut2004.exe:UT2004
"TCP Query User{6242C0D9-D95F-406E-B523-2F614456F009}C:\\vietcong\\vietcong.exe"= Disabled:UDP:C:\vietcong\vietcong.exe:vietcong
"UDP Query User{391EC572-F676-4CE3-8C71-3F662E9FE88D}C:\\vietcong\\vietcong.exe"= Disabled:TCP:C:\vietcong\vietcong.exe:vietcong
"TCP Query User{C95F4D3E-2E17-45E8-BF03-4E96A0420FA2}C:\\program files\\jeux\\vietcong\\vietcong.exe"= Disabled:UDP:C:\program files\jeux\vietcong\vietcong.exe:vietcong
"UDP Query User{63380E8E-4D95-4E8D-A88C-621F71FFD126}C:\\program files\\jeux\\vietcong\\vietcong.exe"= Disabled:TCP:C:\program files\jeux\vietcong\vietcong.exe:vietcong
"TCP Query User{6E9D2A88-B1A4-4B13-8310-C5A3BC44EDD1}C:\\users\\letithord kage\\desktop\\dl\\gba\\vbalink180b0\\visualboyadvance.exe"= Disabled:UDP:C:\users\letithord kage\desktop\dl\gba\vbalink180b0\visualboyadvance.exe:visualboyadvance.exe
"UDP Query User{4F39DFB8-8F05-4985-8BE8-612554DF1867}C:\\users\\letithord kage\\desktop\\dl\\gba\\vbalink180b0\\visualboyadvance.exe"= Disabled:TCP:C:\users\letithord kage\desktop\dl\gba\vbalink180b0\visualboyadvance.exe:visualboyadvance.exe

R1 aswSP;avast! Self Protection;C:\Windows\system32\drivers\aswSP.sys [2008-07-19 15:35 78416]
R2 aswFsBlk;aswFsBlk;C:\Windows\system32\DRIVERS\aswFsBlk.sys [2008-07-19 15:37 20560]
R2 aswMonFlt;aswMonFlt;C:\Windows\system32\DRIVERS\aswMonFlt.sys [2008-07-19 15:36 51280]
R2 SBSDWSCService;SBSD Security Center Service;C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe [2008-07-07 08:42 809296]
S3 xusb20;Xbox 360 Wireless Receiver for Windows Driver Service;C:\Windows\system32\DRIVERS\xusb20.sys [2006-10-13 14:48 50048]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\E]
\shell\AutoRun\command - E:\Installer.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{980af117-e5de-11dc-b88f-001e8c60e4ae}]
\shell\AutoRun\command - K:\LaunchRC.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{d922242c-c14a-11dc-8c42-806e6f6e6963}]
\shell\AutoRun\command - E:\install.exe /autorun
\shell\directx\command - E:\DirectX\dxsetup.exe
\shell\dxinfo\command - E:\goodies\DirectX\dxinfo.exe
\shell\dxtool\command - E:\goodies\DirectX\dxtool.exe
\shell\log\command - E:\goodies\machine\machine.exe -l
\shell\machine\command - E:\goodies\machine\machine.exe
\shell\setup\command - E:\install.exe /autorun
.
Contenu du dossier 'Tâches planifiées'

2008-11-10 C:\Windows\Tasks\User_Feed_Synchronization-{7AD1E35B-4B30-4627-AA79-5749D00897EE}.job
- C:\Windows\system32\msfeedssync.exe [2008-01-19 08:33]
.
- - - - ORPHELINS SUPPRIMES - - - -

URLSearchHooks-{ecdee021-0d17-467f-a1ff-c7a115230949} - (no file)
BHO-{A9A741EF-CB16-46AA-A845-3EE944847209} - (no file)
Toolbar-{ecdee021-0d17-467f-a1ff-c7a115230949} - (no file)
WebBrowser-{ECDEE021-0D17-467F-A1FF-C7A115230949} - (no file)
HKCU-Run-ISUSPM Startup - C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe
HKLM-Run-MSServer - C:\Windows\system32\wvUlIYsT.dll
ShellExecuteHooks-{9950772D-AF73-4AEA-80B6-C251EC40EA30} - C:\Windows\system32\ljjgHaAS.dll
ShellExecuteHooks-{3CCDF8CE-C339-4DD6-AD4F-CA7230C7E2F2} - C:\Windows\system32\wvUlIYsT.dll
MSConfigStartUp-hpjksm - c:\users\letithord kage\appdata\local\hpjksm.exe
MSConfigStartUp-Nokia - C:\Program Files\Nokia\Nokia PC Suite 6\PCSync2.exe
MSConfigStartUp-ogamc - c:\users\letithord kage\appdata\local\ogamc.exe


.
------- Examen supplémentaire -------
.
FireFox -: Profile - C:\Users\Letithord Kage\AppData\Roaming\Mozilla\Firefox\Profiles\sab6u4pm.default\
FireFox -: prefs.js - STARTUP.HOMEPAGE - google.fr
FF -: plugin - C:\Program Files\DivX\DivX Content Uploader\npUpload.dll
FF -: plugin - c:\Program Files\Microsoft Silverlight\2.0.31005.0\npctrl.1.0.30716.0.dll
FF -: plugin - c:\Program Files\Microsoft Silverlight\2.0.31005.0\npctrl.dll
.

voilà

Search Navipromo version 3.6.9 commencé le 2008-11-11 à 15:36:21.04

!!! Attention,ce rapport peut indiquer des fichiers/programmes légitimes!!!
!!! Postez ce rapport sur le forum pour le faire analyser !!!
!!! Ne lancez pas la partie désinfection sans l'avis d'un spécialiste !!!

Outil exécuté depuis C:\Program Files\navilog1
Session actuelle : "Letithord Kage"

Mise à jour le 05.11.2008 à 21h00 par IL-MAFIOSO

Microsoft Windows Vista 6.0.6001
Internet Explorer : 7.0.6001.18000
Système de fichiers : NTFS

Recherche executé en mode normal

*** Recherche Programmes installés ***


*** Recherche dossiers dans "C:\Windows" ***


*** Recherche dossiers dans "C:\Program Files" ***


*** Recherche dossiers dans "c:\progra~2\micros~1\windows\startm~1\programs" ***


*** Recherche dossiers dans "c:\progra~2\micros~1\windows\startm~1" ***


*** Recherche dossiers dans "C:\ProgramData" ***


*** Recherche dossiers dans "c:\users\letith~1\appdata\roaming\micros~1\windows\startm~1\programs" ***


*** Recherche dossiers dans "C:\Users\Letithord Kage\AppData\Local\virtualstore\Program Files" ***


*** Recherche dossiers dans "C:\Users\Letithord Kage\AppData\Roaming" ***


*** Recherche avec Catchme-rootkit/stealth malware detector par gmer ***
pour + d'infos : http://www.gmer.net



*** Recherche avec GenericNaviSearch ***
!!! Tous ces résultats peuvent révéler des fichiers légitimes !!!
!!! A vérifier impérativement avant toute suppression manuelle !!!

* Recherche dans "C:\Windows\system32" *

* Recherche dans "C:\Users\Letithord Kage\AppData\Local\Microsoft" *

* Recherche dans "C:\Users\Letithord Kage\AppData\Local" *



*** Recherche fichiers ***



*** Recherche clés spécifiques dans le Registre ***


*** Module de Recherche complémentaire ***
(Recherche fichiers spécifiques)

1)Recherche nouveaux fichiers Instant Access :


2)Recherche Heuristique :

* Dans "C:\Windows\system32" :


* Dans "C:\Users\Letithord Kage\AppData\Local\Microsoft" :


* Dans "C:\Users\Letithord Kage\AppData\Local" :


3)Recherche Certificats :

Certificat Egroup absent !
Certificat Electronic-Group trouvé !
Certificat Montorgueil absent !
Certificat OOO-Favorit trouvé !
Certificat Sunny-Day-Design-Ltd absent !

4)Recherche fichiers connus :



*** Analyse terminée le 2008-11-11 à 15:44:29.12 ***

Clean Navipromo version 3.6.9 commencé le 2008-11-11 à 15:53:08.70

Outil exécuté depuis C:\Program Files\navilog1
Session actuelle : "Letithord Kage"

Mise à jour le 05.11.2008 à 21h00 par IL-MAFIOSO

Microsoft Windows Vista 6.0.6001
Internet Explorer : 7.0.6001.18000
Système de fichiers : NTFS

Mode suppression automatique
avec prise en charge résultats Catchme et GNS


Nettoyage exécuté au redémarrage de l'ordinateur


*** fsbl1.txt non trouvé ***
(Assurez-vous que Catchme n'avait rien trouvé lors de la recherche)


*** Suppression avec sauvegardes résultats GenericNaviSearch ***

* Suppression dans "C:\Windows\System32" *


* Suppression dans "C:\Users\Letithord Kage\AppData\Local\Microsoft" *


* Suppression dans "C:\Users\Letithord Kage\AppData\Local" *



*** Suppression dossiers dans "C:\Windows" ***


*** Suppression dossiers dans "C:\Program Files" ***


*** Suppression dossiers dans "c:\progra~2\micros~1\windows\startm~1\programs" ***


*** Suppression dossiers dans "c:\progra~2\micros~1\windows\startm~1" ***


*** Suppression dossiers dans "C:\ProgramData" ***


*** Suppression dossiers dans c:\users\letith~1\appdata\roaming\micros~1\windows\startm~1\programs ***


*** Suppression dossiers dans "C:\Users\Letithord Kage\AppData\Local\virtualstore\Program Files" ***


*** Suppression dossiers dans "C:\Users\Letithord Kage\AppData\Roaming" ***



*** Suppression fichiers ***


*** Suppression fichiers temporaires ***

Nettoyage contenu C:\Windows\Temp effectué !
Nettoyage contenu C:\Users\LETITH~1\AppData\Local\Temp effectué !

*** Traitement Recherche complémentaire ***
(Recherche fichiers spécifiques)

1)Suppression avec sauvegardes nouveaux fichiers Instant Access :

2)Recherche, création sauvegardes et suppression Heuristique :


* Dans "C:\Windows\system32" *


* Dans "C:\Users\Letithord Kage\AppData\Local\Microsoft" *


* Dans "C:\Users\Letithord Kage\AppData\Local" *


*** Sauvegarde du Registre vers dossier Safebackup ***

sauvegarde du Registre réalisée avec succès !

*** Nettoyage Registre ***

Nettoyage Registre Ok


*** Certificats ***

Certificat Egroup absent !
Certificat Electronic-Group supprimé !
Certificat Montorgueil absent !
Certificat OOO-Favorit supprimé !
Certificat Sunny-Day-Design-Ltdt absent !


*** Nettoyage terminé le 2008-11-11 à 15:56:17.19 ***

le toolbar est en route, mais il bloque depuis tout à l'heure sur roaming/downld

un message de windows s'affiche disant que :

Utilitaire (QGREP) de recherche de chaines de caractères a cessé de fonctionner
Un prolbème a fait que le programme a cessé de fonctionner correctement. Windows va fermer ce programme et vous indiquer si une solution est disponible

il a passé roaming/dwnld
la il est sur roaming/exefnd

ca risque de prendre encore très longtemps

je préfère laisser
je pars vers 19h au bahut
j'espère que ca sera fini d'ici la
sinon, vendredi soir, je devrais me résigner

le rapport de usbfix



-------------- UsbFix V2.402 ---------------

* User : Letithord Kage - SHADOW
* Outils mis a jours le 10/11/2008 par Chiquitine29 et Chimay8
* Recherche effectuée à 17:38:11 le 2008-11-11
* Windows Vista - Internet Explorer 7.0.6001.18000


--------------- [ Processus actifs ] ----------------


C:\Windows\System32\smss.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\wininit.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\winlogon.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\nvvsvc.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\LogonUI.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\rundll32.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Windows\system32\DllHost.exe
C:\Windows\system32\userinit.exe
C:\Windows\system32\Dwm.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\DllHost.exe
C:\Users\LETITH~1\AppData\Local\Temp\5AA3.tmp\b2e.exe
C:\Windows\system32\DllHost.exe
C:\Program Files\Alwil Software\Avast4\setup\avast.setup
C:\Windows\system32\taskeng.exe
C:\Windows\system32\rundll32.exe

--------------- [ Informations lecteurs ] ----------------

C: - Lecteur fixe
D: - Lecteur fixe
G: - Lecteur amovible
L: - Lecteur fixe

--------------- [ Registre / Startup ] ----------------


HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
SunJavaUpdateSched REG_SZ "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
ISUSScheduler REG_SZ "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
LogitechCommunicationsManager REG_SZ "C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe"
LogitechQuickCamRibbon REG_SZ "C:\Program Files\Logitech\QuickCam\Quickcam.exe" /hide
NvCplDaemon REG_SZ RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
NvMediaCenter REG_SZ RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
MSServer REG_SZ rundll32.exe C:\Windows\system32\wvUlIYsT.dll,#1

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\OptionalComponents

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
ISUSPM Startup REG_SZ C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
ehTray.exe REG_SZ C:\Windows\ehome\ehTray.exe
RocketDock REG_SZ "C:\Program Files\RocketDock\RocketDock.exe"
AlcoholAutomount REG_SZ "C:\Program Files\Alcohol Soft\Alcohol 52\axcmd.exe" /automount
msnmsgr REG_SZ "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
WMPNSCFG REG_SZ C:\Program Files\Windows Media Player\WMPNSCFG.exe


--------------- [ Registre / Mountpoint2 ] ----------------

Supprimé ! - HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\E\Shell\AutoRun\command
Supprimé ! - HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{980af117-e5de-11dc-b88f-001e8c60e4ae}\Shell\AutoRun\command
Supprimé ! - HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{d922242c-c14a-11dc-8c42-806e6f6e6963}\Shell\AutoRun\command

--------------- [ Nettoyage des disques ] ----------------


--------------- [ Listing des fichiers présents ] ----------------

-> /!\ Le resultat doit etre interprété par un spécialiste /!\

[2006-09-18 22:43][--a------] C:\autoexec.bat
[2007-11-07 07:00][--ah-----] C:\globdata.ini
[2007-11-07 07:00][--ah-----] C:\install.ini
[2005-06-07 18:13][--a------] L:\battlefield2demo_JeuxVideo.com_10157.exe

--------------- [ Vaccination ] ----------------

C:\autorun.inf - Dossier autorun.inf crée par UsbFix !
D:\autorun.inf - Dossier autorun.inf crée par UsbFix !
G:\autorun.inf - Dossier autorun.inf crée par UsbFix !
L:\autorun.inf - Dossier autorun.inf crée par UsbFix !

--------------- ! Fin du rapport ! ----------------

E: est mon lecteur dvd

au bout d'une heure de scan, juste avant d'avoir presque fini, vu qu'il examinait L, le dernier lecteur, il ne réponds plus
donc, je vais laisser tout allumé, et on verra vendredi si ca a avancé
je posterais tout ce jour la
merci pour l'aide, et a bientot

j'ai relancé un scan de mon lecteur L: (mon disque dur externe, et il plante a chaque fois dessus)
donc, je vais refaire un scan de tout le pc sauf DDE, et je posterais le rapport
mais je pense formater demain, enfin si je peux éliminer ce virus sans ca, tant mieux

Malwarebytes' Anti-Malware 1.30
Version de la base de données: 1383
Windows 6.0.6001 Service Pack 1

2008-11-14 20:38:02
mbam-log-2008-11-14 (20-38-02).txt

Type de recherche: Examen complet (C:\|D:\|)
Eléments examinés: 160237
Temps écoulé: 1 hour(s), 13 minute(s), 30 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 1
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 0

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Valeur(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MSServer (Trojan.Agent) -> Quarantined and deleted successfully.

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
(Aucun élément nuisible détecté)


j'ai supprimé le Trojan.Agent que j'avais

Malwarebytes' Anti-Malware 1.30
Version de la base de données: 1383
Windows 6.0.6001 Service Pack 1

2008-11-15 17:54:30
mbam-log-2008-11-15 (17-54-30).txt

Type de recherche: Examen complet (C:\|D:\|)
Eléments examinés: 161635
Temps écoulé: 1 hour(s), 1 minute(s), 36 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 0

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
(Aucun élément nuisible détecté)

log.txt

Logfile of random's system information tool 1.04 (written by random/random)
Run by Letithord Kage at 2008-11-15 18:50:25
Microsoft® Windows Vista™ Édition Familiale Premium Service Pack 1
System drive C: has 183 GB (57%) free of 323 GB
Total RAM: 2047 MB (52% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:50, on 2008-11-15
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskeng.exe
C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe
C:\Windows\System32\rundll32.exe
C:\Windows\ehome\ehtray.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\RocketDock\RocketDock.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\Common Files\Logishrd\LQCVFX\COCIManager.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Alwil Software\Avast4\ashDisp.exe
C:\Program Files\Windows Media Player\wmplayer.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Users\Letithord Kage\Desktop\RSIT.exe
C:\Program Files\Trend Micro\HijackThis\Letithord Kage.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: (no name) - {ecdee021-0d17-467f-a1ff-c7a115230949} - (no file)
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: IeCatch5 Class - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\PROGRA~1\FlashGet\jccatch.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: (no name) - {A9A741EF-CB16-46AA-A845-3EE944847209} - (no file)
O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\fgiebar.dll
O3 - Toolbar: BS.Player ControlBar - {2C688203-7EB3-4327-9995-1CB417BA23F9} - C:\Program Files\BS.Player ControlBar\BSToolbar.dll
O3 - Toolbar: (no name) - {ecdee021-0d17-467f-a1ff-c7a115230949} - (no file)
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe"
O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "C:\Program Files\Logitech\QuickCam\Quickcam.exe" /hide
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKCU\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [RocketDock] "C:\Program Files\RocketDock\RocketDock.exe"
O4 - HKCU\..\Run: [AlcoholAutomount] "C:\Program Files\Alcohol Soft\Alcohol 52\axcmd.exe" /automount
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
O8 - Extra context menu item: Télécharger avec FlashGet - C:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: Télécharger tout avec FlashGet - C:\Program Files\FlashGet\jc_all.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\JRE16~3.0_0\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\JRE16~3.0_0\bin\ssv.dll
O9 - Extra button: Run WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - C:\Program Files\WinHTTrack\WinHTTrackIEBar.dll
O9 - Extra 'Tools' menuitem: Launch WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - C:\Program Files\WinHTTrack\WinHTTrackIEBar.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe
O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O13 - Gopher Prefix:
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: C-DillaCdaC11BA - C-Dilla Ltd - C:\Windows\system32\drivers\CDAC11BA.EXE
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: LVCOMSer - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\SrvLnch\SrvLnch.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 52\StarWind\StarWindServiceAE.exe

Antivirus Version Dernière mise à jour Résultat
AhnLab-V3 2008.11.14.3 2008.11.15 -
AntiVir 7.9.0.31 2008.11.14 -
Authentium 5.1.0.4 2008.11.15 -
Avast 4.8.1281.0 2008.11.16 -
AVG 8.0.0.199 2008.11.15 -
BitDefender 7.2 2008.11.16 -
CAT-QuickHeal 10.00 2008.11.15 -
ClamAV 0.94.1 2008.11.15 -
DrWeb 4.44.0.09170 2008.11.16 -
eSafe 7.0.17.0 2008.11.13 -
eTrust-Vet 31.6.6209 2008.11.14 -
Ewido 4.0 2008.11.15 -
F-Prot 4.4.4.56 2008.11.15 -
F-Secure 8.0.14332.0 2008.11.16 -
Fortinet 3.117.0.0 2008.11.15 -
GData 19 2008.11.16 -
Ikarus T3.1.1.45.0 2008.11.16 -
K7AntiVirus 7.10.526 2008.11.15 -
Kaspersky 7.0.0.125 2008.11.16 -
McAfee 5435 2008.11.15 -
Microsoft 1.4104 2008.11.16 -
NOD32 3615 2008.11.15 -
Norman 5.80.02 2008.11.14 -
Panda 9.0.0.4 2008.11.15 -
PCTools 4.4.2.0 2008.11.15 -
Prevx1 V2 2008.11.16 -
Rising 21.03.42.00 2008.11.14 -
SecureWeb-Gateway 6.7.6 2008.11.14 -
Sophos 4.35.0 2008.11.16 -
Sunbelt 3.1.1801.2 2008.11.14 -
Symantec 10 2008.11.16 -
TheHacker 6.3.1.1.155 2008.11.15 -
TrendMicro 8.700.0.1004 2008.11.14 -
VBA32 3.12.8.9 2008.11.15 -
ViRobot 2008.11.15.1470 2008.11.15 -
VirusBuster 4.5.11.0 2008.11.15 -
Information additionnelle
File size: 318976 bytes
MD5...: 206031193f3955ba118c054c03d681e1
SHA1..: d7060a99ce2d10793378b54f48c67abe5c30f59f
SHA256: d0c9835103df318c171c79dc2436ad07b4f5d8f322e7db463b703604debbb48f
SHA512: 8f1f5ece34604922261a45eb9f63e108fc376ba97622f7d7d42fa840f2c7962b
5842fb0a261d1317bd6b28c5d47ea92da4dfcf229f01d9e502f2a1dc0fa45857
PEiD..: -
TrID..: File type identification
Win32 Executable MS Visual C++ (generic) (65.2%)
Win32 Executable Generic (14.7%)
Win32 Dynamic Link Library (generic) (13.1%)
Generic Win/DOS Executable (3.4%)
DOS Executable Generic (3.4%)
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x4ad09797
timedatestamp.....: 0x47918bde (Sat Jan 19 05:34:22 2008)
machinetype.......: 0x14c (I386)

( 4 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0x22340 0x22400 6.62 be85250250f32b72ee44fb7374cb1d65
.data 0x24000 0x1c8ec 0x1ca00 0.17 d10c8a04a14a8cc52ad73d873ab5743f
.rsrc 0x41000 0xcec8 0xd000 5.94 71c9fdd7cc38dc520c0c98455f25ef00
.reloc 0x4e000 0x1ad4 0x1c00 6.68 dee72bfe3939acba7e2250e0186e00db

( 4 imports )
> ADVAPI32.dll: RevertToSelf, SaferRecordEventLogEntry, ImpersonateLoggedOnUser, SaferCloseLevel, SaferComputeTokenFromLevel, SaferIdentifyLevel, RegCloseKey, RegQueryValueExW, RegOpenKeyExW, RegEnumKeyW, RegDeleteValueW, RegOpenKeyW, RegDeleteKeyW, RegSetValueW, CreateProcessAsUserW, RegSetValueExW, RegCreateKeyExW, LookupAccountSidW, GetSecurityDescriptorOwner, GetFileSecurityW
> KERNEL32.dll: SetFilePointer, lstrcmpW, lstrcmpiW, HeapFree, GetProcessHeap, MultiByteToWideChar, ReadFile, SetThreadLocale, GetProcAddress, GetModuleHandleW, VirtualQuery, HeapAlloc, CloseHandle, WriteConsoleW, FillConsoleOutputCharacterW, SetConsoleCursorPosition, ReadConsoleW, GetConsoleScreenBufferInfo, GetStdHandle, GetFileType, GetLastError, WideCharToMultiByte, GetFileSize, FlushConsoleInputBuffer, GetCPInfo, GetConsoleOutputCP, CreateFileW, FindClose, FindNextFileW, FindFirstFileW, GetFullPathNameW, GetUserDefaultLCID, SetLocalTime, SystemTimeToFileTime, GetSystemTime, FileTimeToSystemTime, GetLocaleInfoW, GetDateFormatW, FileTimeToLocalFileTime, GetTimeFormatW, GetLocalTime, FreeEnvironmentStringsW, GetEnvironmentStringsW, SetEnvironmentVariableW, SetEnvironmentStringsW, SetConsoleMode, GetConsoleMode, GetCommandLineW, GetEnvironmentVariableW, SetErrorMode, SetLastError, ReadProcessMemory, LoadLibraryW, GetConsoleWindow, CreateProcessW, GetStartupInfoW, DeleteProcThreadAttributeList, UpdateProcThreadAttribute, InitializeProcThreadAttributeList, GetBinaryTypeW, NeedCurrentDirectoryForExePathW, GetFileAttributesW, GetConsoleTitleW, MoveFileExW, LocalFree, SetConsoleTitleW, MoveFileW, SetFilePointerEx, WriteFile, SearchPathW, GetVolumeInformationW, LeaveCriticalSection, EnterCriticalSection, CancelSynchronousIo, ExpandEnvironmentStringsW, GetModuleFileNameW, GetVersion, GetWindowsDirectoryW, SetConsoleCtrlHandler, InitializeCriticalSection, GetDriveTypeW, GetFileAttributesExW, HeapSetInformation, OpenThread, GetCurrentThreadId, VirtualFree, VirtualAlloc, HeapSize, HeapReAlloc, FlushFileBuffers, DuplicateHandle, FormatMessageW, ScrollConsoleScreenBufferW, SetConsoleTextAttribute, FillConsoleOutputAttribute, CreateDirectoryW, SetFileTime, DeleteFileW, SetEndOfFile, SetFileAttributesW, CopyFileW, GetExitCodeProcess, WaitForSingleObject, TerminateProcess, SetCurrentDirectoryW, GetCurrentDirectoryW, RemoveDirectoryW, CompareFileTime, GetDiskFreeSpaceExW, FindNextStreamW, FindFirstStreamW, DeviceIoControl, ResumeThread, SetProcessAffinityMask, GetSystemInfo, GetThreadLocale, GetVolumePathNameW, CreateSymbolicLinkW, CreateHardLinkW, RaiseException, LoadLibraryA, FreeLibrary, LocalAlloc, UnhandledExceptionFilter, GetCurrentProcess, GetSystemTimeAsFileTime, GetCurrentProcessId, GetTickCount, QueryPerformanceCounter, GetModuleHandleA, SetUnhandledExceptionFilter, InterlockedCompareExchange, Sleep, InterlockedExchange, GetVDMCurrentDirectories, CmdBatNotification
> msvcrt.dll: _wpopen, _wcsupr, setlocale, realloc, towlower, fprintf, _iob, printf, memcpy, wcsrchr, rand, iswalpha, wcstoul, _errno, _local_unwind4, wcsstr, _setjmp3, exit, fflush, srand, time, _wtol, iswxdigit, wcsncmp, _setmode, _pipe, _ultoa, swscanf, _close, _open_osfhandle, _dup, _dup2, qsort, _wcslwr, free, ferror, __getmainargs, _cexit, _exit, _XcptFilter, _initterm, _amsg_exit, __setusermatherr, _adjust_fdiv, __p__commode, __p__fmode, __set_app_type, _except_handler4_common, _terminate@@YAXXZ, _controlfp, feof, _pclose, memmove, wcschr, _tell, iswspace, memset, wcsspn, towupper, longjmp, _wcsnicmp, _wcsicmp, _vsnwprintf, _get_osfhandle, _getch, iswdigit, wcstol, calloc, fgets
> ntdll.dll: RtlDosPathNameToNtPathName_U, NtFsControlFile, RtlFreeHeap, NtQueryInformationProcess, NtSetInformationProcess, RtlNtStatusToDosError, NtQueryInformationToken, NtClose, NtOpenProcessToken, NtOpenThreadToken

( 0 exports )

ComboFix 08-11-14.01 - Letithord Kage 2008-11-16 10:48:47.2 - NTFSx86
Microsoft® Windows Vista™ Édition Familiale Premium 6.0.6001.1.1252.1.1036.18.1005 [GMT 1:00]
Lancé depuis: c:\users\Letithord Kage\Desktop\ComboFix.exe
Commutateurs utilisés :: c:\users\Letithord Kage\Desktop\CFScript.txt
* Un nouveau point de restauration a été créé

FILE ::
c:\windows\SWXCACLS.exe
c:\windows\system32\5f734dbd-.txt
c:\windows\system32\drivers\ajuzivrq.sys
c:\windows\system32\drivers\am187edw.sys
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\SWXCACLS.exe
c:\windows\system32\5f734dbd-.txt
.
---- Previous Run -------
.
C:\install.exe
c:\users\Letithord Kage\AppData\Local\oicce.dat
c:\users\Letithord Kage\AppData\Local\oicce_nav.dat
c:\users\Letithord Kage\AppData\Local\oicce_navps.dat
c:\windows\admintxt.txt
c:\windows\service.exe
c:\windows\System32\BaGMlRqr.ini
c:\windows\System32\BaGMlRqr.ini2
c:\windows\system32\cesogbqj.ini
c:\windows\system32\djdielwu.ini
c:\windows\system32\vvwHRXbc.ini
c:\windows\System32\vvwHRXbc.ini2
c:\windows\System32\wGNXyGgh.ini
c:\windows\System32\wGNXyGgh.ini2
c:\windows\system32\xqmjhmwh.ini

.
((((((((((((((((((((((((((((((((((((((( Pilotes/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_NPF


((((((((((((((((((((((((((((( Fichiers créés du 2008-10-16 au 2008-11-16 ))))))))))))))))))))))))))))))))))))
.

2008-11-15 18:50 . 2008-11-15 18:50 <REP> d-------- C:\rsit
2008-11-14 16:42 . 2008-09-05 06:14 1,191,936 --a------ c:\windows\System32\msxml3.dll
2008-11-14 16:42 . 2008-08-27 02:05 212,480 --a------ c:\windows\System32\drivers\mrxsmb10.sys
2008-11-14 16:41 . 2008-09-10 04:40 1,334,272 --a------ c:\windows\System32\msxml6.dll
2008-11-11 18:00 . 2008-11-11 18:00 <REP> d-------- c:\users\Letithord Kage\AppData\Roaming\Malwarebytes
2008-11-11 18:00 . 2008-11-11 18:00 <REP> d-------- c:\users\All Users\Malwarebytes
2008-11-11 18:00 . 2008-11-11 18:00 <REP> d-------- c:\programdata\Malwarebytes
2008-11-11 18:00 . 2008-11-11 18:00 <REP> d-------- c:\program files\Malwarebytes' Anti-Malware
2008-11-11 18:00 . 2008-10-22 16:10 38,496 --a------ c:\windows\System32\drivers\mbamswissarmy.sys
2008-11-11 18:00 . 2008-10-22 16:10 15,504 --a------ c:\windows\System32\drivers\mbam.sys
2008-11-11 17:34 . 2008-11-14 18:22 <REP> d-------- c:\program files\UsbFix
2008-11-11 15:58 . 2008-11-11 15:59 <REP> d-------- C:\ToolBar SD
2008-11-11 15:35 . 2008-11-11 15:56 <REP> d-------- c:\program files\Navilog1
2008-11-11 14:39 . 2008-11-11 14:39 236,804,769 --a------ c:\windows\MEMORY.DMP
2008-11-11 08:32 . 2008-11-11 08:32 <REP> d-------- c:\program files\Trend Micro
2008-11-11 08:31 . 2008-11-11 08:32 812,344 --a------ c:\users\Letithord Kage\HJTInstall.exe
2008-11-10 16:31 . 2008-11-10 16:31 <REP> d-------- c:\program files\CCleaner
2008-11-09 19:47 . 2008-11-09 19:47 <REP> d-------- c:\program files\EA GAMES
2008-11-07 19:05 . 2008-11-07 19:05 <REP> d-------- c:\program files\Panasonic
2008-11-07 19:05 . 2006-02-27 11:45 36,864 --a------ c:\windows\System32\SDDEVMGR.dll
2008-11-04 18:00 . 2008-11-04 18:00 <REP> d-------- c:\program files\GTASACenter
2008-11-04 13:15 . 2008-11-04 13:15 <REP> d-------- c:\users\Letithord Kage\AppData\Roaming\SPORE
2008-11-04 13:06 . 2008-11-04 13:06 <REP> d-------- c:\program files\Electronic Arts
2008-11-04 12:34 . 2008-11-04 12:34 <REP> d-------- c:\users\All Users\Spore
2008-11-04 12:34 . 2008-11-04 12:34 <REP> d-------- c:\programdata\Spore
2008-11-03 23:47 . 2008-11-03 23:47 <REP> d-------- c:\users\Letithord Kage\AppData\Roaming\SporeCreatureCreator
2008-11-03 20:11 . 2008-08-05 10:49 428,544 --a------ c:\windows\System32\EncDec.dll
2008-11-03 20:11 . 2008-08-05 10:49 293,376 --a------ c:\windows\System32\psisdecd.dll
2008-11-03 20:11 . 2008-08-05 10:48 217,088 --a------ c:\windows\System32\psisrndr.ax
2008-11-03 20:11 . 2008-08-05 10:48 177,664 --a------ c:\windows\System32\mpg2splt.ax
2008-11-03 20:11 . 2008-08-05 10:48 80,896 --a------ c:\windows\System32\MSNP.ax
2008-11-03 00:20 . 2008-11-03 13:04 43,520 --a------ c:\windows\System32\CmdLineExt03.dll
2008-10-28 22:56 . 2008-08-12 04:39 443,392 --a------ c:\windows\System32\win32spl.dll
2008-10-28 22:56 . 2008-09-18 05:56 147,456 --a------ c:\windows\System32\Faultrep.dll
2008-10-28 22:56 . 2008-09-18 05:56 125,952 --a------ c:\windows\System32\wersvc.dll
2008-10-25 15:57 . 2008-10-25 15:57 <REP> d-------- c:\program files\Common Files\PCSuite
2008-10-25 15:57 . 2008-10-25 15:57 <REP> d-------- c:\program files\Common Files\Nokia
2008-10-25 10:22 . 2007-09-17 14:53 21,632 --a------ c:\windows\System32\drivers\pccsmcfd.sys
2008-10-25 10:21 . 2008-10-25 10:21 <REP> d-------- c:\program files\PC Connectivity Solution
2008-10-25 07:24 . 2008-11-14 23:05 <REP> d-------- C:\World of Warcraft
2008-10-24 23:32 . 2008-10-25 07:24 <REP> d-------- c:\program files\Common Files\Blizzard Entertainment
2008-10-17 16:39 . 2008-09-03 04:59 468,992 --a------ c:\windows\System32\newdev.dll
2008-10-17 16:39 . 2008-09-03 04:58 74,752 --a------ c:\windows\System32\newdev.exe
2008-10-17 16:38 . 2008-09-18 06:09 3,601,464 --a------ c:\windows\System32\ntkrnlpa.exe
2008-10-17 16:38 . 2008-09-18 06:09 3,549,240 --a------ c:\windows\System32\ntoskrnl.exe
2008-10-17 16:38 . 2008-09-18 03:16 2,032,640 --a------ c:\windows\System32\win32k.sys
2008-10-17 16:38 . 2008-10-02 02:32 1,383,424 --a------ c:\windows\System32\mshtml.tlb
2008-10-17 16:38 . 2008-10-02 04:49 827,392 --a------ c:\windows\System32\wininet.dll
2008-10-17 16:38 . 2008-08-27 02:06 288,768 --a------ c:\windows\System32\drivers\srv.sys

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-11-15 17:48 --------- d-----w c:\users\Letithord Kage\AppData\Roaming\OpenOffice.org2
2008-11-15 13:51 --------- d-----w c:\users\Letithord Kage\AppData\Roaming\Skype
2008-11-15 08:12 --------- d-----w c:\users\Letithord Kage\AppData\Roaming\skypePM
2008-11-14 22:41 --------- d-----w c:\programdata\Messenger Plus!
2008-11-14 18:34 --------- d-----w c:\programdata\WLInstaller
2008-11-11 12:52 --------- d-----w c:\programdata\Spybot - Search & Destroy
2008-11-09 20:56 183,128 ----a-w c:\windows\System32\PnkBstrB.exe
2008-11-09 18:59 138,464 ----a-w c:\windows\system32\drivers\PnkBstrK.sys
2008-11-09 18:47 --------- d--h--w c:\program files\InstallShield Installation Information
2008-11-09 13:18 --------- d-----w c:\program files\Rockstar Games
2008-11-07 17:48 --------- d-----w c:\users\Letithord Kage\AppData\Roaming\PC Suite
2008-11-04 16:56 --------- d-----w c:\programdata\NVIDIA
2008-11-03 18:44 107,888 ----a-w c:\windows\System32\CmdLineExt.dll
2008-11-03 01:16 --------- d-----w c:\program files\Warcraft III
2008-10-25 14:57 --------- d-----w c:\program files\Nokia
2008-10-25 09:20 --------- d-----w c:\programdata\Installations
2008-10-24 01:07 --------- d-----w c:\program files\Microsoft Silverlight
2008-10-17 16:08 --------- d-----w c:\program files\Windows Mail
2008-10-12 08:55 --------- d-----w c:\users\Letithord Kage\AppData\Roaming\gtk-2.0
2008-10-10 20:19 --------- d-----w c:\program files\Spybot - Search & Destroy
2008-09-30 15:43 1,286,152 ----a-w c:\windows\System32\msxml4.dll
2008-08-22 23:35 768,544 ----a-w c:\windows\System32\nvcplui.exe
2008-08-22 23:35 453,152 ----a-w c:\windows\System32\NVUNINST.EXE
2008-08-22 23:35 313,888 ----a-w c:\windows\System32\nvexpbar.dll
2008-08-22 23:35 122,880 ----a-w c:\windows\System32\nvcod134.dll
2008-08-22 23:35 1,079,840 ----a-w c:\windows\System32\nvcpluir.dll
2008-08-21 17:01 4,608 ----a-w c:\windows\System32\w95inf32.dll
2008-08-21 17:01 2,272 ----a-w c:\windows\System32\w95inf16.dll
2008-03-15 21:51 174 --sha-w c:\program files\desktop.ini
2008-01-18 20:37 32 ----a-w c:\users\All Users\ezsid.dat
2008-01-18 20:37 32 ----a-w c:\programdata\ezsid.dat
2008-01-12 21:34 278,528 ----a-w c:\program files\Common Files\FDEUnInstaller.exe
.

((((((((((((((((((((((((((((( snapshot@2008-11-11_14.37.01.52 )))))))))))))))))))))))))))))))))))))))))
.
+ 2008-11-14 15:46:12 32,768 ----a-r c:\windows\Installer\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}\icon.exe
- 2008-03-15 21:54:31 29,926 ----a-r c:\windows\Installer\{BADF6744-3787-48F6-B8C9-4C4995401D65}\MsblIco.Exe
+ 2008-11-14 18:47:27 29,926 ----a-r c:\windows\Installer\{BADF6744-3787-48F6-B8C9-4C4995401D65}\MsblIco.Exe
+ 2008-11-14 17:26:14 2,048 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
+ 2008-11-14 17:26:14 2,048 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
- 2008-11-11 13:34:06 262,144 --sha-w c:\windows\ServiceProfiles\LocalService\NTUSER.DAT
+ 2008-11-15 15:17:50 262,144 --sha-w c:\windows\ServiceProfiles\LocalService\NTUSER.DAT
+ 2008-11-15 15:17:50 262,144 ---ha-w c:\windows\ServiceProfiles\LocalService\ntuser.dat.LOG1
- 2008-11-11 13:34:06 262,144 --sha-w c:\windows\ServiceProfiles\NetworkService\NTUSER.DAT
+ 2008-11-14 17:27:35 262,144 --sha-w c:\windows\ServiceProfiles\NetworkService\NTUSER.DAT
+ 2008-11-14 17:27:35 262,144 ---ha-w c:\windows\ServiceProfiles\NetworkService\ntuser.dat.LOG1
- 2008-11-11 13:22:36 16,384 --sha-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2008-11-16 06:25:14 16,384 --sha-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2008-11-11 13:22:36 32,768 --sha-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2008-11-16 06:25:14 32,768 --sha-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2008-11-11 13:22:36 16,384 --sha-w c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2008-11-16 06:25:14 16,384 --sha-w c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2008-11-11 13:28:13 262,144 ----a-w c:\windows\System32\config\systemprofile\ntuser.dat
+ 2008-11-16 09:48:08 262,144 ----a-w c:\windows\System32\config\systemprofile\ntuser.dat
- 2008-10-07 19:19:40 16,721,856 ----a-w c:\windows\System32\mrt.exe
+ 2008-11-04 00:10:25 17,318,336 ----a-w c:\windows\System32\mrt.exe
- 2008-11-11 08:01:51 101,052 ----a-w c:\windows\System32\perfc009.dat
+ 2008-11-15 12:55:12 101,052 ----a-w c:\windows\System32\perfc009.dat
- 2008-11-11 08:01:51 123,350 ----a-w c:\windows\System32\perfc00C.dat
+ 2008-11-15 12:55:12 123,350 ----a-w c:\windows\System32\perfc00C.dat
- 2008-11-11 08:01:51 586,980 ----a-w c:\windows\System32\perfh009.dat
+ 2008-11-15 12:55:12 586,980 ----a-w c:\windows\System32\perfh009.dat
- 2008-11-11 08:01:51 669,328 ----a-w c:\windows\System32\perfh00C.dat
+ 2008-11-15 12:55:12 669,328 ----a-w c:\windows\System32\perfh00C.dat
- 2008-11-03 19:46:02 6,291,456 ----a-w c:\windows\System32\SMI\Store\Machine\SCHEMA.DAT
+ 2008-11-14 17:21:42 6,291,456 ----a-w c:\windows\System32\SMI\Store\Machine\SCHEMA.DAT
- 2008-11-09 18:52:44 8,220 ----a-w c:\windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-4189690765-15781457-2219080216-1000_UserData.bin
+ 2008-11-11 16:39:57 8,418 ----a-w c:\windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-4189690765-15781457-2219080216-1000_UserData.bin
- 2008-11-09 18:52:43 66,380 ----a-w c:\windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin
+ 2008-11-11 16:39:57 66,840 ----a-w c:\windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin
- 2008-11-10 13:52:18 37,460 ----a-w c:\windows\System32\WDI\ShutdownPerformanceDiagnostics_SystemData.bin
+ 2008-11-11 14:57:23 37,460 ----a-w c:\windows\System32\WDI\ShutdownPerformanceDiagnostics_SystemData.bin
- 2008-11-03 19:10:14 133,830,789 ----a-w c:\windows\winsxs\ManifestCache\6.0.6001.18000_001c50b5_blobs.bin
+ 2008-11-14 15:46:19 134,790,805 ----a-w c:\windows\winsxs\ManifestCache\6.0.6001.18000_001c50b5_blobs.bin
+ 2008-09-05 04:48:28 1,194,496 ----a-w c:\windows\winsxs\x86_microsoft-windows-msxml30_31bf3856ad364e35_6.0.6000.16745_none_8661c59c99cb7ce9\msxml3.dll
+ 2008-09-05 04:45:14 2,048 ----a-w c:\windows\winsxs\x86_microsoft-windows-msxml30_31bf3856ad364e35_6.0.6000.16745_none_8661c59c99cb7ce9\msxml3r.dll
+ 2008-09-05 04:47:44 1,194,496 ----a-w c:\windows\winsxs\x86_microsoft-windows-msxml30_31bf3856ad364e35_6.0.6000.20910_none_8706d29fb2d54754\msxml3.dll
+ 2008-09-05 04:47:44 2,048 ----a-w c:\windows\winsxs\x86_microsoft-windows-msxml30_31bf3856ad364e35_6.0.6000.20910_none_8706d29fb2d54754\msxml3r.dll
+ 2008-09-05 05:14:05 1,191,936 ----a-w c:\windows\winsxs\x86_microsoft-windows-msxml30_31bf3856ad364e35_6.0.6001.18136_none_8853d47896e90b40\msxml3.dll
+ 2006-11-02 09:41:09 2,048 ----a-w c:\windows\winsxs\x86_microsoft-windows-msxml30_31bf3856ad364e35_6.0.6001.18136_none_8853d47896e90b40\msxml3r.dll
+ 2008-09-05 05:08:23 1,191,936 ----a-w c:\windows\winsxs\x86_microsoft-windows-msxml30_31bf3856ad364e35_6.0.6001.22258_none_88c9d1ffb015159a\msxml3.dll
+ 2008-09-05 05:04:53 2,048 ----a-w c:\windows\winsxs\x86_microsoft-windows-msxml30_31bf3856ad364e35_6.0.6001.22258_none_88c9d1ffb015159a\msxml3r.dll
+ 2008-09-10 03:25:00 1,341,440 ----a-w c:\windows\winsxs\x86_microsoft-windows-msxml60_31bf3856ad364e35_6.0.6000.16747_none_866381d899c9fc7a\msxml6.dll
+ 2008-09-10 03:21:24 2,048 ----a-w c:\windows\winsxs\x86_microsoft-windows-msxml60_31bf3856ad364e35_6.0.6000.16747_none_866381d899c9fc7a\msxml6r.dll
+ 2008-09-10 03:26:42 1,341,440 ----a-w c:\windows\winsxs\x86_microsoft-windows-msxml60_31bf3856ad364e35_6.0.6000.20913_none_87098f25b2d2e03c\msxml6.dll
+ 2008-09-10 03:26:42 2,048 ----a-w c:\windows\winsxs\x86_microsoft-windows-msxml60_31bf3856ad364e35_6.0.6000.20913_none_87098f25b2d2e03c\msxml6r.dll
+ 2008-09-10 03:40:14 1,334,272 ----a-w c:\windows\winsxs\x86_microsoft-windows-msxml60_31bf3856ad364e35_6.0.6001.18138_none_885590b496e78ad1\msxml6.dll
+ 2006-11-02 09:41:09 2,048 ----a-w c:\windows\winsxs\x86_microsoft-windows-msxml60_31bf3856ad364e35_6.0.6001.18138_none_885590b496e78ad1\msxml6r.dll
+ 2008-09-10 03:27:55 1,334,272 ----a-w c:\windows\winsxs\x86_microsoft-windows-msxml60_31bf3856ad364e35_6.0.6001.22261_none_88b7bbb5b023cd0d\msxml6.dll
+ 2008-09-10 03:23:55 2,048 ----a-w c:\windows\winsxs\x86_microsoft-windows-msxml60_31bf3856ad364e35_6.0.6001.22261_none_88b7bbb5b023cd0d\msxml6r.dll
+ 2008-09-15 22:27:41 2,413,072 ----a-w c:\windows\winsxs\x86_microsoft-windows-oespamfilter-dat_31bf3856ad364e35_6.0.6000.16764_none_f064ff046e80cc5f\OESpamFilter.dat
+ 2008-09-15 22:27:41 2,413,072 ----a-w c:\windows\winsxs\x86_microsoft-windows-oespamfilter-dat_31bf3856ad364e35_6.0.6000.20937_none_f1120e5787836182\OESpamFilter.dat
+ 2008-09-15 22:27:41 2,413,072 ----a-w c:\windows\winsxs\x86_microsoft-windows-oespamfilter-dat_31bf3856ad364e35_6.0.6001.18157_none_f2590e746b9c8d64\OESpamFilter.dat
+ 2008-09-15 22:27:41 2,413,072 ----a-w c:\windows\winsxs\x86_microsoft-windows-oespamfilter-dat_31bf3856ad364e35_6.0.6001.22288_none_f2c33bc584d19a58\OESpamFilter.dat
+ 2008-08-26 01:11:59 211,456 ----a-w c:\windows\winsxs\x86_microsoft-windows-smb10-minirdr_31bf3856ad364e35_6.0.6000.16738_none_86a5e1554e593846\mrxsmb10.sys
+ 2008-08-27 00:48:36 211,968 ----a-w c:\windows\winsxs\x86_microsoft-windows-smb10-minirdr_31bf3856ad364e35_6.0.6000.20904_none_874beea267621c08\mrxsmb10.sys
+ 2008-08-27 01:05:41 212,480 ----a-w c:\windows\winsxs\x86_microsoft-windows-smb10-minirdr_31bf3856ad364e35_6.0.6001.18130_none_88841dab4b86fe7f\mrxsmb10.sys
+ 2008-08-27 00:52:38 212,480 ----a-w c:\windows\winsxs\x86_microsoft-windows-smb10-minirdr_31bf3856ad364e35_6.0.6001.22252_none_88fa1b3264b308d9\mrxsmb10.sys
+ 2008-11-14 15:46:12 1,286,152 ----a-w c:\windows\winsxs\x86_microsoft.msxml2_6bd6b9abf345378f_4.20.9870.0_none_b7e00e6c7b30b69b\msxml4.dll
+ 2008-11-14 15:46:16 91,656 ----a-w c:\windows\winsxs\x86_microsoft.msxml2r_6bd6b9abf345378f_4.1.1.0_none_365945b9da656e4d\msxml4r.dll
.
-- Instantané actualisé --
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{2C688203-7EB3-4327-9995-1CB417BA23F9}"= "c:\program files\BS.Player ControlBar\BSToolbar.dll" [2008-08-11 757192]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{2C688203-7EB3-4327-9995-1CB417BA23F9}"= "c:\program files\BS.Player ControlBar\BSToolbar.dll" [2008-08-11 757192]

[HKEY_CLASSES_ROOT\clsid\{2c688203-7eb3-4327-9995-1cb417ba23f9}]
[HKEY_CLASSES_ROOT\BSToolbar.ToolBandObj.1]
[HKEY_CLASSES_ROOT\TypeLib\{1FC79FB5-E4BD-48c8-B2E9-B8E74DB2C3A9}]
[HKEY_CLASSES_ROOT\BSToolbar.ToolBandObj]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ISUSPM Startup"="c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [BU]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-19 125952]
"RocketDock"="c:\program files\RocketDock\RocketDock.exe" [2007-09-02 495616]
"AlcoholAutomount"="c:\program files\Alcohol Soft\Alcohol 52\axcmd.exe" [2008-03-20 216520]
"msnmsgr"="c:\program files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 5724184]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-19 202240]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]
"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2005-02-16 81920]
"LogitechCommunicationsManager"="c:\program files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe" [2008-02-13 564496]
"LogitechQuickCamRibbon"="c:\program files\Logitech\QuickCam\Quickcam.exe" [2008-02-13 2196240]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-06-12 13535776]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-06-12 92704]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{9950772D-AF73-4AEA-80B6-C251EC40EA30}"= "c:\windows\system32\ljjgHaAS.dll" [BU]
"{3CCDF8CE-C339-4DD6-AD4F-CA7230C7E2F2}"= "c:\windows\system32\wvUlIYsT.dll" [BU]

[HKLM\~\startupfolder\C:^Users^Letithord Kage^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Galactic Civilizations II Launcher.lnk]
path=c:\users\Letithord Kage\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Galactic Civilizations II Launcher.lnk
backup=c:\windows\pss\Galactic Civilizations II Launcher.lnk.Startup
backupExtension=.Startup

[HKLM\~\startupfolder\C:^Users^Letithord Kage^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OpenOffice.org 2.3.lnk]
path=c:\users\Letithord Kage\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 2.3.lnk
backup=c:\windows\pss\OpenOffice.org 2.3.lnk.Startup
backupExtension=.Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
--a------ 2008-01-11 21:16 39792 c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
--a------ 2008-04-01 10:39 486856 c:\program files\DAEMON Tools Lite\daemon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\hpjksm]
c:\users\letithord kage\appdata\local\hpjksm.exe [BU]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
--a------ 2007-10-18 11:34 5724184 c:\program files\Windows Live\Messenger\msnmsgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--a------ 2006-01-12 15:40 155648 c:\program files\Common Files\Ahead\Lib\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Nokia.PCSync]
c:\program files\Nokia\Nokia PC Suite 6\PCSync2.exe [BU]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ogamc]
c:\users\letithord kage\appdata\local\ogamc.exe [BU]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
-ra------ 2008-07-23 13:11 21738792 c:\program files\Skype\Phone\Skype.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\XboxStat]
--a------ 2007-09-26 18:05 734264 c:\program files\Microsoft Xbox 360 Accessories\XBoxStat.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"SerialNumber"="A109A-K13-3ZXD-BAP5-TE"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{F7A9DD2F-757F-4505-9CFF-0445FC293D58}"= c:\program files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
"{831702F2-99EF-40A7-A831-A58834641E25}"= UDP:c:\program files\Pcsx2_0.9.4\pcsx2.exe:Pcsx2 0.9.4
"{499B009B-655B-4A9D-A3EE-68B6C3A7C2A2}"= TCP:c:\program files\Pcsx2_0.9.4\pcsx2.exe:Pcsx2 0.9.4
"TCP Query User{76A3CF8E-0BCE-4916-8350-BEF4DB369EEF}c:\\program files\\microsoft games\\halo\\halo.exe"= UDP:c:\program files\microsoft games\halo\halo.exe:Halo
"UDP Query User{C7CB7D95-8891-448E-AD02-97A62AB009E9}c:\\program files\\microsoft games\\halo\\halo.exe"= TCP:c:\program files\microsoft games\halo\halo.exe:Halo
"{8EC4B903-BDD6-4A02-A429-69FEF77E6B5E}"= UDP:c:\program files\Warcraft III\Warcraft III.exe:Warcraft III
"{C65922AC-96D8-4D5B-A6A6-4AF283DBABAF}"= TCP:c:\program files\Warcraft III\Warcraft III.exe:Warcraft III
"{91CF21D0-F9FE-4345-A13E-68289C1BEA3A}"= UDP:c:\program files\Warcraft III\Frozen Throne.exe:Warcraft III - The Frozen Throne
"{BC154180-43AC-40C1-9FFF-D17A19B8DE91}"= TCP:c:\program files\Warcraft III\Frozen Throne.exe:Warcraft III - The Frozen Throne
"{8E20DC2B-E8EA-42FF-8D36-45FD02E7F9AF}"= UDP:6112:6112
"TCP Query User{37882B2F-B44C-4DB0-A856-A6F9ECF14546}c:\\program files\\warcraft iii\\war3.exe"= UDP:c:\program files\warcraft iii\war3.exe:Warcraft III
"UDP Query User{172EAFF2-FBA8-4D04-BEE5-1402D4F02B83}c:\\program files\\warcraft iii\\war3.exe"= TCP:c:\program files\warcraft iii\war3.exe:Warcraft III
"TCP Query User{1CC8A0A4-7BAE-44D3-9667-A9AF57221FD5}c:\\program files\\thq\\titan quest\\titan quest.exe"= UDP:c:\program files\thq\titan quest\titan quest.exe:Titan Quest
"UDP Query User{67C5BAD8-61CA-4BA3-9030-37B9683A3FC5}c:\\program files\\thq\\titan quest\\titan quest.exe"= TCP:c:\program files\thq\titan quest\titan quest.exe:Titan Quest
"{DBAB7ECB-9344-4CE3-903D-97E80C995398}"= UDP:c:\program files\EasyPHP 2.0b1\EasyPHP.exe:EasyPHP
"{89404B6A-C626-42EB-9CEF-22D83AADC3C3}"= TCP:c:\program files\EasyPHP 2.0b1\EasyPHP.exe:EasyPHP
"{F59058D5-E0E3-47ED-9F90-05B49106D888}"= UDP:c:\program files\Alwil Software\Avast4\ashAvast.exe:avast! Antivirus
"{2FD46D87-A418-427C-A646-F3CCE2579184}"= TCP:c:\program files\Alwil Software\Avast4\ashAvast.exe:avast! Antivirus
"{EEAE432C-5EAE-4422-A3DB-433B04AB05B2}"= UDP:c:\program files\Hamachi\hamachi.exe:Hamachi
"{7AF132B0-84A2-40F3-9350-CF6421CA4616}"= TCP:c:\program files\Hamachi\hamachi.exe:Hamachi
"TCP Query User{430D4882-2C13-49D1-B74B-C4620EA630C7}c:\\program files\\nfsmw\\speed.exe"= UDP:c:\program files\nfsmw\speed.exe:speed
"UDP Query User{070C2F6C-05F9-475F-A22B-96EF92BD0C72}c:\\program files\\nfsmw\\speed.exe"= TCP:c:\program files\nfsmw\speed.exe:speed
"{F8C7BD91-B227-4D4F-9D09-7204B57ED265}"= UDP:80:80
"{BA5C3A4A-87BF-4306-8ABA-905576AE652F}"= UDP:13505:13505
"{8E85C849-CD6E-45F8-8BBE-C300B0B183F3}"= UDP:30900:30900
"{2C3171EB-93CF-4E9C-823D-F2B988733372}"= UDP:30999:30999
"{E2B87042-F4B0-43DA-9597-A0D36934A1D7}"= TCP:3658:3658
"TCP Query User{E78BFAF3-722D-4948-8955-826945507301}c:\\thq\\dawn of war\\w40k.exe"= UDP:c:\thq\dawn of war\w40k.exe:W40K
"UDP Query User{4CEE3435-6EBA-4DC1-A8F0-B1000EC414FE}c:\\thq\\dawn of war\\w40k.exe"= TCP:c:\thq\dawn of war\w40k.exe:W40K
"TCP Query User{E99883FE-7957-4A13-9C61-90C5AE3813B0}c:\\thq\\dawn of war - dark crusade\\darkcrusade.exe"= UDP:c:\thq\dawn of war - dark crusade\darkcrusade.exe:DarkCrusade
"UDP Query User{A2510365-8FB5-4948-B0D7-3DF5FBB1F22E}c:\\thq\\dawn of war - dark crusade\\darkcrusade.exe"= TCP:c:\thq\dawn of war - dark crusade\darkcrusade.exe:DarkCrusade
"{DC32645A-5EC2-4C5B-8AFC-FB39ABF44750}"= UDP:22277:BitComet 22277 TCP
"{97645D43-9DAA-42CC-898C-63A22A1843A0}"= TCP:22277:BitComet 22277 UDP
"TCP Query User{02842E36-A96D-4935-BD82-C8A86ADD19BC}c:\\program files\\bitcomet\\bitcomet.exe"= UDP:c:\program files\bitcomet\bitcomet.exe:BitComet - a BitTorrent Client
"UDP Query User{1EAA2460-39FB-4621-AD49-CB4F242B5CA6}c:\\program files\\bitcomet\\bitcomet.exe"= TCP:c:\program files\bitcomet\bitcomet.exe:BitComet - a BitTorrent Client
"TCP Query User{4DCAAF6A-8940-4457-BBAD-3D8DC74C8733}c:\\ravenshield\\system\\ravenshield.exe"= UDP:c:\ravenshield\system\ravenshield.exe:ravenshield
"UDP Query User{945B5131-CBCC-4E97-A5B0-56D13CE31CF9}c:\\ravenshield\\system\\ravenshield.exe"= TCP:c:\ravenshield\system\ravenshield.exe:ravenshield
"{106195F1-1DE6-4DC2-AEF1-7A5D05BD86D8}"= UDP:c:\program files\Firaxis Games\Sid Meier's Civilization 4\Civilization4.exe:Sid Meier's Civilization 4
"{C2E62223-8D4E-4F4D-8959-1911E77BE4AA}"= TCP:c:\program files\Firaxis Games\Sid Meier's Civilization 4\Civilization4.exe:Sid Meier's Civilization 4
"{A616B91A-0F51-43AC-B0EB-07F36C6AE87C}"= UDP:c:\program files\Firaxis Games\Sid Meier's Civilization 4\Beyond the Sword\Civ4BeyondSword.exe:Sid Meier's Civilization 4 Beyond the Sword
"{02608683-5A86-4D81-96A9-AEA068A7086B}"= TCP:c:\program files\Firaxis Games\Sid Meier's Civilization 4\Beyond the Sword\Civ4BeyondSword.exe:Sid Meier's Civilization 4 Beyond the Sword
"{C6C307FF-16F2-48F9-8056-28CAAA233545}"= UDP:c:\program files\Firaxis Games\Sid Meier's Civilization 4\Beyond the Sword\Civ4BeyondSword_PitBoss.exe:Sid Meier's Civilization 4 Beyond the Sword Pitboss
"{6F034754-7A8D-4D7D-8663-B6052CCCC01E}"= TCP:c:\program files\Firaxis Games\Sid Meier's Civilization 4\Beyond the Sword\Civ4BeyondSword_PitBoss.exe:Sid Meier's Civilization 4 Beyond the Sword Pitboss
"TCP Query User{F3D6670D-046A-4D4B-BD7D-7BBC9B58652C}c:\\program files\\warcraft iii\\war3.exe"= UDP:c:\program files\warcraft iii\war3.exe:Warcraft III
"UDP Query User{28C9CD1A-3CD5-4333-B506-D0332FBC9C31}c:\\program files\\warcraft iii\\war3.exe"= TCP:c:\program files\warcraft iii\war3.exe:Warcraft III
"{AAA3D80E-02B3-4735-AC9B-2EE67705A73C}"= UDP:c:\program files\THQ\Gas Powered Games\Supreme Commander\bin\SupremeCommander.exe:Supreme Commander
"{45497A36-F542-4515-BC42-3235DE91BC69}"= TCP:c:\program files\THQ\Gas Powered Games\Supreme Commander\bin\SupremeCommander.exe:Supreme Commander
"{6FF1CAA2-5D5B-4D25-ABC6-34F562E82881}"= UDP:c:\program files\THQ\Gas Powered Games\Supreme Commander - Forged Alliance\bin\ForgedAlliance.exe:Supreme Commander - Forged Alliance
"{C20B0560-E4FB-4148-8F80-E77246DC2A2D}"= TCP:c:\program files\THQ\Gas Powered Games\Supreme Commander - Forged Alliance\bin\ForgedAlliance.exe:Supreme Commander - Forged Alliance
"{E4C3EA37-0A7A-4E48-8E65-1D7E39EA4A73}"= UDP:c:\program files\THQ\Gas Powered Games\GPGNet\GPG.Multiplayer.Client.exe:GPGNet - Supreme Commander - Forged Alliance
"{33EA71C0-FE69-4506-8C51-287F0BBC02C5}"= TCP:c:\program files\THQ\Gas Powered Games\GPGNet\GPG.Multiplayer.Client.exe:GPGNet - Supreme Commander - Forged Alliance
"TCP Query User{3E03B037-785A-4DA4-A7E5-629A05AEFA60}c:\\program files\\nokia\\nokia software updater\\nsu_ui_client.exe"= UDP:c:\program files\nokia\nokia software updater\nsu_ui_client.exe:Nokia Software Updater
"UDP Query User{29758925-3793-43CA-81FB-8DB0E08D5FB2}c:\\program files\\nokia\\nokia software updater\\nsu_ui_client.exe"= TCP:c:\program files\nokia\nokia software updater\nsu_ui_client.exe:Nokia Software Updater
"TCP Query User{486499C6-4F2B-4F6E-B733-37AAA518097A}c:\\program files\\common files\\nokia\\service layer\\a\\nsl_host_process.exe"= UDP:c:\program files\common files\nokia\service layer\a\nsl_host_process.exe:Nokia Service Layer Host Process
"UDP Query User{C6473F7D-52B8-4DA1-A3E6-0F4D3965BD12}c:\\program files\\common files\\nokia\\service layer\\a\\nsl_host_process.exe"= TCP:c:\program files\common files\nokia\service layer\a\nsl_host_process.exe:Nokia Service Layer Host Process
"TCP Query User{C38FD9CD-6816-4173-85CC-E70AEC6DC5F6}c:\\windows\\system32\\dplaysvr.exe"= UDP:c:\windows\system32\dplaysvr.exe:Application d'assistance Microsoft DirectPlay
"UDP Query User{BB307391-D2BE-410E-81C7-69D9A267333A}c:\\windows\\system32\\dplaysvr.exe"= TCP:c:\windows\system32\dplaysvr.exe:Application d'assistance Microsoft DirectPlay
"TCP Query User{BB3E7CFC-F441-4D4F-823E-031F8220AAA1}c:\\program files\\the moon project\\themoonproject.exe"= UDP:c:\program files\the moon project\themoonproject.exe:The Moon Project
"UDP Query User{9051A86F-BF71-4508-B2BB-03EFA6BA81DE}c:\\program files\\the moon project\\themoonproject.exe"= TCP:c:\program files\the moon project\themoonproject.exe:The Moon Project
"{5F8FEC43-6276-4F25-BBE8-DC347214A0E5}"= Disabled:TCP:2300:Moon
"{BE763E76-C85A-4552-914C-7BA75D253A87}"= Disabled:TCP:2400:Moon
"{7C8667C5-1561-4FFA-B771-A51E50DBEF23}"= Disabled:TCP:47624:Moon
"{9562B99E-F26B-40D1-8CFC-FC84FB51D5D2}"= c:\program files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
"TCP Query User{7FD63B5A-4F4E-42F3-827B-4B5CFA839BDA}c:\\program files\\skype\\phone\\skype.exe"= Disabled:UDP:c:\program files\skype\phone\skype.exe:Skype. Take a deep breath
"UDP Query User{A17DFC34-64D8-4727-979C-1E2E0C0FCC0A}c:\\program files\\skype\\phone\\skype.exe"= Disabled:TCP:c:\program files\skype\phone\skype.exe:Skype. Take a deep breath
"TCP Query User{29496DE4-48EB-4A88-AAEE-098F4C43A068}c:\\program files\\microsoft games\\mechwarrior vengeance\\mw4.icd"= UDP:c:\program files\microsoft games\mechwarrior vengeance\mw4.icd:MechWarrior IV
"UDP Query User{651048D6-B193-4CC3-AA06-1E958876C008}c:\\program files\\microsoft games\\mechwarrior vengeance\\mw4.icd"= TCP:c:\program files\microsoft games\mechwarrior vengeance\mw4.icd:MechWarrior IV
"TCP Query User{389E7E14-308C-4CF5-B61C-7A7B72F36256}c:\\program files\\microsoft games\\mechwarrior vengeance\\mw4.exe"= UDP:c:\program files\microsoft games\mechwarrior vengeance\mw4.exe:MechWarrior IV
"UDP Query User{4AF34CC7-A712-4E9B-B5A3-118F1BE17627}c:\\program files\\microsoft games\\mechwarrior vengeance\\mw4.exe"= TCP:c:\program files\microsoft games\mechwarrior vengeance\mw4.exe:MechWarrior IV
"TCP Query User{BD78AF70-86BA-44CD-976F-062C54DD3594}c:\\windows\\system32\\dplaysvr.exe"= UDP:c:\windows\system32\dplaysvr.exe:Application d'assistance Microsoft DirectPlay
"UDP Query User{97405AFE-9784-44EB-B652-E242B898EEE7}c:\\windows\\system32\\dplaysvr.exe"= TCP:c:\windows\system32\dplaysvr.exe:Application d'assistance Microsoft DirectPlay
"TCP Query User{BCB09E2B-874B-4297-B071-5FE6B5F018C9}c:\\program files\\microsoft games\\mechwarrior mercenaries downloadable trial\\mw4mercs.exe"= UDP:c:\program files\microsoft games\mechwarrior mercenaries downloadable trial\mw4mercs.exe:MechWarrior IV
"UDP Query User{8B119306-7D49-4FBD-9A7B-D68E3CB70298}c:\\program files\\microsoft games\\mechwarrior mercenaries downloadable trial\\mw4mercs.exe"= TCP:c:\program files\microsoft games\mechwarrior mercenaries downloadable trial\mw4mercs.exe:MechWarrior IV
"{9E1FAA0D-7C40-438A-B7CC-83051CDB5DEC}"= Disabled:UDP:22277:BitComet 22277 TCP
"{939FABBE-61CB-459B-A01E-44EDD760A2DD}"= Disabled:TCP:22277:BitComet 22277 UDP
"TCP Query User{EDAB4D68-C921-4874-8DF4-653119C08EA9}c:\\windows\\temp\\navbrowser.exe"= UDP:c:\windows\temp\navbrowser.exe:navbrowser.exe
"UDP Query User{35B34BE5-EB62-4832-BF03-F104C3EB4259}c:\\windows\\temp\\navbrowser.exe"= TCP:c:\windows\temp\navbrowser.exe:navbrowser.exe
"TCP Query User{AF91D7A3-42A1-4F90-B0A4-FF2CE13F6C77}c:\\program files\\lucasarts\\star wars empire at war forces of corruption\\swfoc.exe"= UDP:c:\program files\lucasarts\star wars empire at war forces of corruption\swfoc.exe:Star Wars(R): Empire at War(TM): Forces of Corruption(TM)
"UDP Query User{5F27EAFD-E75F-4BC1-A24B-500053A24301}c:\\program files\\lucasarts\\star wars empire at war forces of corruption\\swfoc.exe"= TCP:c:\program files\lucasarts\star wars empire at war forces of corruption\swfoc.exe:Star Wars(R): Empire at War(TM): Forces of Corruption(TM)
"TCP Query User{3612ED3A-172B-4335-9172-166BB24A8BBF}c:\\program files\\tmnationsforever\\tmforever.exe"= UDP:c:\program files\tmnationsforever\tmforever.exe:TmForever
"UDP Query User{5282ABD4-7FC0-4132-9756-4239380BF800}c:\\program files\\tmnationsforever\\tmforever.exe"= TCP:c:\program files\tmnationsforever\tmforever.exe:TmForever
"TCP Query User{D9902B56-2D20-4B5B-94DD-D261BA674648}c:\\program files\\tmnationsforever\\tmforever.exe"= UDP:c:\program files\tmnationsforever\tmforever.exe:TmForever
"UDP Query User{5554D996-FDE2-4BC4-A146-67CB53618FB1}c:\\program files\\tmnationsforever\\tmforever.exe"= TCP:c:\program files\tmnationsforever\tmforever.exe:TmForever
"TCP Query User{271563E0-892B-4E33-B222-FE5089064CED}c:\\users\\letithord kage\\desktop\\dl\\gba\\vbalink180b0\\visualboyadvance.exe"= UDP:c:\users\letithord kage\desktop\dl\gba\vbalink180b0\visualboyadvance.exe:visualboyadvance.exe
"UDP Query User{EBBBBA28-2159-4429-BC11-78425508A2D4}c:\\users\\letithord kage\\desktop\\dl\\gba\\vbalink180b0\\visualboyadvance.exe"= TCP:c:\users\letithord kage\desktop\dl\gba\vbalink180b0\visualboyadvance.exe:visualboyadvance.exe
"{B6E40033-D6A8-43DB-BEF5-20B45B19EB96}"= c:\program files\Electronic Arts\Command & Conquer 3\RetailExe\1.0\cnc3game.dat:Command & Conquer 3 Les guerres du Tiberium™
"TCP Query User{110AA43B-C68F-4DCE-9646-E6FABA716DDE}c:\\program files\\electronic arts\\command & conquer 3\\retailexe\\1.9\\cnc3game.dat"= UDP:c:\program files\electronic arts\command & conquer 3\retailexe\1.9\cnc3game.dat:Command and Conquer 3 Tiberium Wars™
"UDP Query User{CA42B659-4BD8-4D69-AF9F-0AAC14DCFF92}c:\\program files\\electronic arts\\command & conquer 3\\retailexe\\1.9\\cnc3game.dat"= TCP:c:\program files\electronic arts\command & conquer 3\retailexe\1.9\cnc3game.dat:Command and Conquer 3 Tiberium Wars™
"TCP Query User{91E08067-1C72-4360-BFE6-CBC0992D5BAD}c:\\windows\\system32\\dpnsvr.exe"= UDP:c:\windows\system32\dpnsvr.exe:Serveur Microsoft DirectPlay 8
"UDP Query User{D8C00C59-8AE8-41C6-8CE3-C6776ACC830C}c:\\windows\\system32\\dpnsvr.exe"= TCP:c:\windows\system32\dpnsvr.exe:Serveur Microsoft DirectPlay 8
"{957811DF-D12C-4155-B6F2-37B726CAC072}"= Disabled:UDP:5425:viet
"{BF638E02-2C0A-4F55-9BF4-CC12427B8311}"= Disabled:TCP:5425:viet2
"TCP Query User{C8DAF7AF-55ED-44F5-96C0-495348B6B7A1}c:\\cs source lan\\hl2.exe"= UDP:c:\cs source lan\hl2.exe:hl2
"UDP Query User{2A06D448-F980-4DA3-9B51-D4C5432A3971}c:\\cs source lan\\hl2.exe"= TCP:c:\cs source lan\hl2.exe:hl2
"TCP Query User{779670B5-57B4-4BA1-86E1-328575518D56}c:\\program files\\aoe 2\\empires2.exe"= UDP:c:\program files\aoe 2\empires2.exe:Age of Empires II
"UDP Query User{E7316308-34C5-4F0A-A13A-FDCEC4F00CAE}c:\\program files\\aoe 2\\empires2.exe"= TCP:c:\program files\aoe 2\empires2.exe:Age of Empires II
"TCP Query User{713A2EAA-D50D-4C17-B582-42C1B051C4D7}c:\\jeux\\warcraft iii\\war3.exe"= UDP:c:\jeux\warcraft iii\war3.exe:Warcraft III
"UDP Query User{19731751-C0C0-4217-ADB3-F8066C75DC12}c:\\jeux\\warcraft iii\\war3.exe"= TCP:c:\jeux\warcraft iii\war3.exe:Warcraft III
"{93E84C9F-C76C-4738-8957-EC8A08FD6A4E}"= UDP:c:\jeux\Ghost Recon Advanced Warfighter 2\graw2.exe:Ghost Recon Advanced Warfighter® 2
"{574D977A-A8E0-40F5-8832-2B883CF0BF28}"= TCP:c:\jeux\Ghost Recon Advanced Warfighter 2\graw2.exe:Ghost Recon Advanced Warfighter® 2
"{90A9789C-9747-4ADE-8B05-11DF5B3CECC2}"= UDP:c:\jeux\Ghost Recon Advanced Warfighter 2\graw2_dedicated.exe:Ghost Recon Advanced Warfighter® 2 Dedicated Server
"{9AF4FB48-4A24-4898-8A83-B9C3FE8F25A2}"= TCP:c:\jeux\Ghost Recon Advanced Warfighter 2\graw2_dedicated.exe:Ghost Recon Advanced Warfighter® 2 Dedicated Server
"TCP Query User{99C7C7B8-7919-4CAD-9AE6-431ADBBEA2D7}c:\\jeux\\ghost recon advanced warfighter 2\\graw2.exe"= UDP:c:\jeux\ghost recon advanced warfighter 2\graw2.exe:Ghost Recon Advanced Warfighter® 2
"UDP Query User{7047792A-2695-4157-A0C5-BA0E53DDE8ED}c:\\jeux\\ghost recon advanced warfighter 2\\graw2.exe"= TCP:c:\jeux\ghost recon advanced warfighter 2\graw2.exe:Ghost Recon Advanced Warfighter® 2
"TCP Query User{315F084A-9A4E-4872-A3C9-1A98F52F0292}c:\\jeux\\aoe 2\\empires2.exe"= UDP:c:\jeux\aoe 2\empires2.exe:Age of Empires II
"UDP Query User{061684EA-1BEA-43AE-8E65-2C89CC3BD52B}c:\\jeux\\aoe 2\\empires2.exe"= TCP:c:\jeux\aoe 2\empires2.exe:Age of Empires II
"TCP Query User{79090F94-B451-4DCC-94FD-EA41503EFCAA}c:\\jeux\\aoe 2\\age2_x1.exe"= UDP:c:\jeux\aoe 2\age2_x1.exe:Age of Empires II Expansion
"UDP Query User{4D58975C-DD72-466E-A3E2-07CBF4E31700}c:\\jeux\\aoe 2\\age2_x1.exe"= TCP:c:\jeux\aoe 2\age2_x1.exe:Age of Empires II Expansion
"TCP Query User{377044CA-6A90-4A86-A70E-FB0B59A6BD78}c:\\jeux\\halo\\halo.exe"= UDP:c:\jeux\halo\halo.exe:Halo
"UDP Query User{DF923D03-E3D2-43EE-A55F-0AE6DC91022A}c:\\jeux\\halo\\halo.exe"= TCP:c:\jeux\halo\halo.exe:Halo
"TCP Query User{732879AE-0813-4FD8-A318-8A8ED2FAD662}c:\\jeux\\tmnationsforever\\tmforever.exe"= UDP:c:\jeux\tmnationsforever\tmforever.exe:TmForever
"UDP Query User{BAE5F8E4-F731-4F25-BF1A-0CE9ECF68355}c:\\jeux\\tmnationsforever\\tmforever.exe"= TCP:c:\jeux\tmnationsforever\tmforever.exe:TmForever
"{EC835658-2629-4B24-AFFF-33571363E152}"= Disabled:UDP:c:\program files\Skype\Phone\Skype.exe:Skype
"{76C831C5-2DB9-4180-9372-728ED31BE941}"= TCP:c:\program files\Skype\Phone\Skype.exe:Skype
"TCP Query User{D7753373-B4B0-46A3-B1A6-4F684F95D307}c:\\jeux\\mechwarrior vengeance\\mw4.exe"= UDP:c:\jeux\mechwarrior vengeance\mw4.exe:MechWarrior IV
"UDP Query User{FB639808-D5F4-41B1-AB8D-F7890117C692}c:\\jeux\\mechwarrior vengeance\\mw4.exe"= TCP:c:\jeux\mechwarrior vengeance\mw4.exe:MechWarrior IV
"TCP Query User{7D37A4A1-45E3-44FA-AD8D-B8CBB61AFA2A}c:\\jeux\\mechwarrior 4 vengeance\\mw4.icd"= UDP:c:\jeux\mechwarrior 4 vengeance\mw4.icd:MechWarrior IV
"UDP Query User{EC61E3B4-6BF7-475C-83E4-3B1C694EBFB7}c:\\jeux\\mechwarrior 4 vengeance\\mw4.icd"= TCP:c:\jeux\mechwarrior 4 vengeance\mw4.icd:MechWarrior IV
"TCP Query User{F638A824-4E7C-4FB3-8B06-C4F4E2EFF429}c:\\program files\\mozilla firefox\\firefox.exe"= UDP:c:\program files\mozilla firefox\firefox.exe:Firefox
"UDP Query User{63204CF9-84BC-41FA-8D76-A980353B2577}c:\\program files\\mozilla firefox\\firefox.exe"= TCP:c:\program files\mozilla firefox\firefox.exe:Firefox
"TCP Query User{83876B16-B086-4ED3-BC16-C848CB3EBA96}c:\\jeux\\microsoft games\\halo\\halo.exe"= UDP:c:\jeux\microsoft games\halo\halo.exe:Halo
"UDP Query User{D5C25B31-E760-4109-BB48-48C4FA3FDA7D}c:\\jeux\\microsoft games\\halo\\halo.exe"= TCP:c:\jeux\microsoft games\halo\halo.exe:Halo
"TCP Query User{D6C07E4F-35F2-4EEE-A42B-4EB767F7B74C}c:\\jeux\\microsoft games\\halo\\halo.exe"= UDP:c:\jeux\microsoft games\halo\halo.exe:Halo
"UDP Query User{6DA5077B-48DA-4D98-B224-C6AD22C13BA0}c:\\jeux\\microsoft games\\halo\\halo.exe"= TCP:c:\jeux\microsoft games\halo\halo.exe:Halo
"TCP Query User{A9A60803-26D1-4D28-BA4C-786017C97DF0}c:\\jeux\\mechwarrior 4 vengeance_mien\\mw4.icd"= UDP:c:\jeux\mechwarrior 4 vengeance_mien\mw4.icd:MechWarrior IV
"UDP Query User{201F5DA2-47D3-407B-BFC1-806349F92CF6}c:\\jeux\\mechwarrior 4 vengeance_mien\\mw4.icd"= TCP:c:\jeux\mechwarrior 4 vengeance_mien\mw4.icd:MechWarrior IV
"TCP Query User{4B8ACE34-1182-431C-B43F-48B6F68E8641}c:\\jeux\\ut2004\\system\\ut2004.exe"= UDP:c:\jeux\ut2004\system\ut2004.exe:UT2004
"UDP Query User{9B2F6961-E4B6-4286-940A-FFCCC640477A}c:\\jeux\\ut2004\\system\\ut2004.exe"= TCP:c:\jeux\ut2004\system\ut2004.exe:UT2004
"TCP Query User{95BB6740-A6B1-4353-AC56-93C6CA849ED2}c:\\jeux\\mechwarrior vengeance\\mw4.exe"= UDP:c:\jeux\mechwarrior vengeance\mw4.exe:MechWarrior IV
"UDP Query User{0AD0E531-E48F-4424-9059-972CE0AEC61B}c:\\jeux\\mechwarrior vengeance\\mw4.exe"= TCP:c:\jeux\mechwarrior vengeance\mw4.exe:MechWarrior IV
"TCP Query User{962CF2FB-AC74-425B-A564-E0555AFA3762}c:\\program files\\vietcong\\vcded.exe"= UDP:c:\program files\vietcong\vcded.exe:vcded
"UDP Query User{E9416829-3CDF-45D5-8C8E-47911B81CCAC}c:\\program files\\vietcong\\vcded.exe"= TCP:c:\program files\vietcong\vcded.exe:vcded
"TCP Query User{0DE30B83-41B2-47EB-823F-6612DAC5F1EE}c:\\program files\\atari\\act of war - high treason\\actofwar_hightreason.exe"= Disabled:UDP:c:\program files\atari\act of war - high treason\actofwar_hightreason.exe:ActOfWar_HighTreason
"UDP Query User{C4AE5877-EFFA-41D7-89A4-F63301CE18BD}c:\\program files\\atari\\act of war - high treason\\actofwar_hightreason.exe"= Disabled:TCP:c:\program files\atari\act of war - high treason\actofwar_hightreason.exe:ActOfWar_HighTreason
"TCP Query User{981B2437-A3AB-47A0-A730-0CEB7FEBA9BA}c:\\jeux\\aoe 2\\age2_x1.exe"= Disabled:UDP:c:\jeux\aoe 2\age2_x1.exe:Age of Empires II Expansion
"UDP Query User{0804D55E-40D3-4EBB-98B0-684A1591ECAC}c:\\jeux\\aoe 2\\age2_x1.exe"= Disabled:TCP:c:\jeux\aoe 2\age2_x1.exe:Age of Empires II Expansion
"{09C3BA40-6E53-43A6-91FF-8B1A5CC8647A}"= Disabled:UDP:c:\program files\EA GAMES\Battlefield 2 Demo\BF2.exe:Battlefield 2
"{C6695074-C4D1-4B16-9910-C5A5BC2B6FFB}"= Disabled:TCP:c:\program files\EA GAMES\Battlefield 2 Demo\BF2.exe:Battlefield 2
"TCP Query User{B6B1E37F-B358-4C61-B053-D85619BC293C}c:\\program files\\bitcomet\\bitcomet.exe"= Disabled:UDP:c:\program files\bitcomet\bitcomet.exe:BitComet - a BitTorrent Client
"UDP Query User{41A535E8-0D95-4B91-9C7B-F251EA6DC89C}c:\\program files\\bitcomet\\bitcomet.exe"= Disabled:TCP:c:\program files\bitcomet\bitcomet.exe:BitComet - a BitTorrent Client
"TCP Query User{0E9DD281-7898-4CD3-A95B-E6C04C61C4C0}c:\\world of warcraft\\wow-1.12.0-frfr-downloader.exe"= Disabled:UDP:c:\world of warcraft\wow-1.12.0-frfr-downloader.exe:Blizzard Downloader
"UDP Query User{CE42406A-ABF8-4DFC-B20C-89286DFE0B94}c:\\world of warcraft\\wow-1.12.0-frfr-downloader.exe"= Disabled:TCP:c:\world of warcraft\wow-1.12.0-frfr-downloader.exe:Blizzard Downloader
"TCP Query User{0046D547-1A99-4F02-A464-8C212D8F0C85}c:\\thq\\dawn of war - dark crusade\\darkcrusade.exe"= Disabled:UDP:c:\thq\dawn of war - dark crusade\darkcrusade.exe:DarkCrusade
"UDP Query User{780859C6-984D-4C0D-9E97-81C40424D900}c:\\thq\\dawn of war - dark crusade\\darkcrusade.exe"= Disabled:TCP:c:\thq\dawn of war - dark crusade\darkcrusade.exe:DarkCrusade
"TCP Query User{66C1C061-409F-487B-94CC-29EBE9DB0FD7}c:\\jeux\\thq\\dawn of war - dark crusade\\darkcrusade.exe"= Disabled:UDP:c:\jeux\thq\dawn of war - dark crusade\darkcrusade.exe:DarkCrusade
"UDP Query User{650B0A75-F068-4BEF-AC4F-60011B50E23A}c:\\jeux\\thq\\dawn of war - dark crusade\\darkcrusade.exe"= Disabled:TCP:c:\jeux\thq\dawn of war - dark crusade\darkcrusade.exe:DarkCrusade
"TCP Query User{BF5ACD23-5E1C-472D-9D31-5AAD69050E2B}c:\\jeux\\sierra\\empire earth - the art of conquest\\ee-aoc.exe"= Disabled:UDP:c:\jeux\sierra\empire earth - the art of conquest\ee-aoc.exe:EE-AOC
"UDP Query User{4986A969-1C13-4B7C-BFE9-6011DC811749}c:\\jeux\\sierra\\empire earth - the art of conquest\\ee-aoc.exe"= Disabled:TCP:c:\jeux\sierra\empire earth - the art of conquest\ee-aoc.exe:EE-AOC
"{C4F1C24F-4ECE-48FA-82A7-66986757D775}"= Disabled:UDP:c:\users\Letithord Kage\AppData\Local\F4\ClientUpdater\ClientUpdater.exe:F4 Game Client Updater
"{69DC1FC5-19CC-4A8E-83BC-224C9EBEEBB6}"= Disabled:TCP:c:\users\Letithord Kage\AppData\Local\F4\ClientUpdater\ClientUpdater.exe:F4 Game Client Updater
"TCP Query User{FB51C873-60BD-4814-99DE-60835E3D8480}c:\\cs source lan\\hl2.exe"= Disabled:UDP:c:\cs source lan\hl2.exe:hl2
"UDP Query User{ECB457A2-06E0-4EDC-B26F-A9EC46C1677A}c:\\cs source lan\\hl2.exe"= Disabled:TCP:c:\cs source lan\hl2.exe:hl2
"TCP Query User{8E2F3CB3-121B-4B7E-BC52-716DCFE4FA49}c:\\jeux\\cs source lan\\hl2.exe"= Disabled:UDP:c:\jeux\cs source lan\hl2.exe:hl2
"UDP Query User{75A07CD4-FD33-46FA-87DC-52CC96234519}c:\\jeux\\cs source lan\\hl2.exe"= Disabled:TCP:c:\jeux\cs source lan\hl2.exe:hl2
"TCP Query User{C4EDDADA-28F1-4B93-BF5A-BDACC02F649E}c:\\program files\\capcom\\lost_planet_trial_dx9\\lostplanetdx9.exe"= Disabled:UDP:c:\program files\capcom\lost_planet_trial_dx9\lostplanetdx9.exe:LostPlanetDX9
"UDP Query User{EDA1EF4E-9018-4886-94F8-397120DBF7FF}c:\\program files\\capcom\\lost_planet_trial_dx9\\lostplanetdx9.exe"= Disabled:TCP:c:\program files\capcom\lost_planet_trial_dx9\lostplanetdx9.exe:LostPlanetDX9
"TCP Query User{10D1F8DE-C26C-41A2-A2AF-050C1D0203BD}c:\\jeux\\metin2\\metin2.bin"= Disabled:UDP:c:\jeux\metin2\metin2.bin:metin2.bin
"UDP Query User{566844A8-0540-4FFF-9B71-291584A0D73D}c:\\jeux\\metin2\\metin2.bin"= Disabled:TCP:c:\jeux\metin2\metin2.bin:metin2.bin
"TCP Query User{4D2DB451-1A2B-4D9A-AA3A-4CABDA57274B}c:\\ravenshield\\system\\ravenshield.exe"= Disabled:UDP:c:\ravenshield\system\ravenshield.exe:ravenshield
"UDP Query User{1BD409A5-20D3-45D3-A212-A1FEB091F44B}c:\\ravenshield\\system\\ravenshield.exe"= Disabled:TCP:c:\ravenshield\system\ravenshield.exe:ravenshield
"{72146751-240A-4475-B71D-5E0AB48C6D8B}"= Disabled:UDP:c:\program files\Firaxis Games\Sid Meier's Civilization 4\Civilization4.exe:Sid Meier's Civilization 4
"{F47997E7-1139-47C8-A8AD-B7AE961AC140}"= Disabled:TCP:c:\program files\Firaxis Games\Sid Meier's Civilization 4\Civilization4.exe:Sid Meier's Civilization 4
"{136C31A7-9936-4D63-AA65-111FD9525FF8}"= Disabled:UDP:c:\program files\Firaxis Games\Sid Meier's Civilization 4\Beyond the Sword\Civ4BeyondSword.exe:Sid Meier's Civilization 4 Beyond the Sword
"{EE94CA85-B07F-425E-AF05-D270216F917F}"= Disabled:TCP:c:\program files\Firaxis Games\Sid Meier's Civilization 4\Beyond the Sword\Civ4BeyondSword.exe:Sid Meier's Civilization 4 Beyond the Sword
"{B5026598-26EE-4360-B582-75C5FEAB82D6}"= Disabled:UDP:c:\program files\Firaxis Games\Sid Meier's Civilization 4\Beyond the Sword\Civ4BeyondSword_PitBoss.exe:Sid Meier's Civilization 4 Beyond the Sword Pitboss
"{F6918672-982E-4ECE-B1DC-7D6A4E9E4A5B}"= Disabled:TCP:c:\program files\Firaxis Games\Sid Meier's Civilization 4\Beyond the Sword\Civ4BeyondSword_PitBoss.exe:Sid Meier's Civilization 4 Beyond the Sword Pitboss
"TCP Query User{E514806B-6287-4478-A2AC-9726A1251B88}c:\\program files\\nfsmw\\speed.exe"= Disabled:UDP:c:\program files\nfsmw\speed.exe:speed
"UDP Query User{CBE2AA87-DD61-45E3-9E41-6641DCCC6E16}c:\\program files\\nfsmw\\speed.exe"= Disabled:TCP:c:\program files\nfsmw\speed.exe:speed
"TCP Query User{39319FE0-0408-49AE-8AF2-F90DD58DD665}c:\\program files\\the moon project\\themoonproject.exe"= Disabled:UDP:c:\program files\the moon project\themoonproject.exe:The Moon Project
"UDP Query User{68D1E121-7B52-4B4C-A08B-0E7EC0B2E92C}c:\\program files\\the moon project\\themoonproject.exe"= Disabled:TCP:c:\program files\the moon project\themoonproject.exe:The Moon Project
"TCP Query User{A476A237-C92C-4887-99B5-147058AFD9DF}c:\\jeux\\ut2004\\system\\ut2004.exe"= Disabled:UDP:c:\jeux\ut2004\system\ut2004.exe:UT2004
"UDP Query User{58F3CC32-03EF-454F-84ED-E2E3372FDCE5}c:\\jeux\\ut2004\\system\\ut2004.exe"= Disabled:TCP:c:\jeux\ut2004\system\ut2004.exe:UT2004
"TCP Query User{6242C0D9-D95F-406E-B523-2F614456F009}c:\\vietcong\\vietcong.exe"= Disabled:UDP:c:\vietcong\vietcong.exe:vietcong
"UDP Query User{391EC572-F676-4CE3-8C71-3F662E9FE88D}c:\\vietcong\\vietcong.exe"= Disabled:TCP:c:\vietcong\vietcong.exe:vietcong
"TCP Query User{C95F4D3E-2E17-45E8-BF03-4E96A0420FA2}c:\\program files\\jeux\\vietcong\\vietcong.exe"= Disabled:UDP:c:\program files\jeux\vietcong\vietcong.exe:vietcong
"UDP Query User{63380E8E-4D95-4E8D-A88C-621F71FFD126}c:\\program files\\jeux\\vietcong\\vietcong.exe"= Disabled:TCP:c:\program files\jeux\vietcong\vietcong.exe:vietcong
"TCP Query User{6E9D2A88-B1A4-4B13-8310-C5A3BC44EDD1}c:\\users\\letithord kage\\desktop\\dl\\gba\\vbalink180b0\\visualboyadvance.exe"= Disabled:UDP:c:\users\letithord kage\desktop\dl\gba\vbalink180b0\visualboyadvance.exe:visualboyadvance.exe
"UDP Query User{4F39DFB8-8F05-4985-8BE8-612554DF1867}c:\\users\\letithord kage\\desktop\\dl\\gba\\vbalink180b0\\visualboyadvance.exe"= Disabled:TCP:c:\users\letithord kage\desktop\dl\gba\vbalink180b0\visualboyadvance.exe:visualboyadvance.exe
"{540C2101-7926-4DF9-ACE5-B935F9F4E15D}"= c:\program files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)

R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2008-04-01 78416]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\DRIVERS\aswFsBlk.sys [2008-04-01 20560]
R2 aswMonFlt;aswMonFlt;c:\windows\system32\DRIVERS\aswMonFlt.sys [2008-01-13 51280]
R2 SBSDWSCService;SBSD Security Center Service;c:\program files\Spybot - Search & Destroy\SDWinSec.exe [2008-10-10 809296]
S3 xusb20;Xbox 360 Wireless Receiver for Windows Driver Service;c:\windows\system32\DRIVERS\xusb20.sys [2006-10-13 50048]
.
Contenu du dossier 'Tâches planifiées'

2008-11-15 c:\windows\Tasks\User_Feed_Synchronization-{7AD1E35B-4B30-4627-AA79-5749D00897EE}.job
- c:\windows\system32\msfeedssync.exe [2008-01-19 08:33]
.
- - - - ORPHELINS SUPPRIMES - - - -

URLSearchHooks-{ecdee021-0d17-467f-a1ff-c7a115230949} - (no file)
BHO-{A9A741EF-CB16-46AA-A845-3EE944847209} - (no file)
Toolbar-{ecdee021-0d17-467f-a1ff-c7a115230949} - (no file)
WebBrowser-{ECDEE021-0D17-467F-A1FF-C7A115230949} - (no file)



**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-11-16 10:51:36
Windows 6.0.6001 Service Pack 1 NTFS

Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

Recherche de fichiers cachés ...

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************
.
Heure de fin: 2008-11-16 10:52:43
ComboFix-quarantined-files.txt 2008-11-16 09:52:40

Avant-CF: 191,839,244,288 octets libres
Après-CF: 191,859,347,456 octets libres

465 --- E O F --- 2008-11-14 15:47:39


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:53:43, on 16/11/2008
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe
C:\Windows\ehome\ehtray.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\RocketDock\RocketDock.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\Common Files\Logishrd\LQCVFX\COCIManager.exe
C:\Program Files\Alwil Software\Avast4\ashDisp.exe
C:\Program Files\Windows Media Player\wmplayer.exe
C:\Windows\system32\notepad.exe
C:\Windows\Explorer.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: IeCatch5 Class - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\PROGRA~1\FlashGet\jccatch.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\fgiebar.dll
O3 - Toolbar: BS.Player ControlBar - {2C688203-7EB3-4327-9995-1CB417BA23F9} - C:\Program Files\BS.Player ControlBar\BSToolbar.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe"
O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "C:\Program Files\Logitech\QuickCam\Quickcam.exe" /hide
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKCU\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [RocketDock] "C:\Program Files\RocketDock\RocketDock.exe"
O4 - HKCU\..\Run: [AlcoholAutomount] "C:\Program Files\Alcohol Soft\Alcohol 52\axcmd.exe" /automount
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
O8 - Extra context menu item: Télécharger avec FlashGet - C:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: Télécharger tout avec FlashGet - C:\Program Files\FlashGet\jc_all.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\JRE16~3.0_0\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\JRE16~3.0_0\bin\ssv.dll
O9 - Extra button: Run WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - C:\Program Files\WinHTTrack\WinHTTrackIEBar.dll
O9 - Extra 'Tools' menuitem: Launch WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - C:\Program Files\WinHTTrack\WinHTTrackIEBar.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe
O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O13 - Gopher Prefix:
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: C-DillaCdaC11BA - C-Dilla Ltd - C:\Windows\system32\drivers\CDAC11BA.EXE
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: LVCOMSer - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\SrvLnch\SrvLnch.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 52\StarWind\StarWindServiceAE.exe

-----------\\ ToolBar S&D 1.2.4 XP/Vista

Microsoft® Windows Vista™ Édition Familiale Premium ( v6.0.6001 ) Service Pack 1
X86-based PC ( Multiprocessor Free : Intel(R) Core(TM)2 Quad CPU Q6600 @ 2.40GHz )
BIOS : BIOS Date: 11/21/07 Ver: 08.00.14
USER : Letithord Kage ( Administrator )
BOOT : Normal boot
Antivirus : avast! antivirus 4.8.1229 [VPS 081115-1] 4.8.1229 (Activated)
C:\ (Local Disk) - NTFS - Total:315 Go (Free:176 Go)
D:\ (Local Disk) - FAT32 - Total:20 Go (Free:15 Go)
E:\ (CD or DVD)
F:\ (USB)
G:\ (USB)
H:\ (USB)
I:\ (CD or DVD) - UDF - Total:2 Go (Free:0 Go)
K:\ (CD or DVD)

"C:\ToolBar SD" ( MAJ : 27-10-2008|09:25 )
Option : [1] ( 16/11/2008|18:22 )

[ UAC => 0 ]

-----------\\ Recherche de Fichiers / Dossiers ...


-----------\\ [..\Internet Explorer\Main]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Local Page"="C:\\Windows\\system32\\blank.htm"
"Search Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
"Url"="https://www.msn.com/fr-fr/actualite/"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
"Start Page"="https://www.msn.com/fr-fr/?ocid=iehp"
"Default_Page_URL"="https://www.msn.com/fr-fr/?ocid=iehp"
"Default_Search_URL"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
"Search Page"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"


--------------------\\ Recherche d'autres infections


Aucune autre infection trouvée !

[ UAC => 1 ]


1 - "C:\ToolBar SD\TB_1.txt" - 18/11/2008|20:35 - Option : [1]

-----------\\ Fin du rapport a 20:35:13,02