Probleme de pub internet

sa ne marche pas sa me mai erreur !!!

ya pas outils dans spybot et ya pas un moyen de faire plus simple ????

non il ny est pas

voila le dosier bloc note :

Search Navipromo version 3.6.9 commencé le 07/12/2008 à 18:54:11,15

!!! Attention,ce rapport peut indiquer des fichiers/programmes légitimes!!!
!!! Postez ce rapport sur le forum pour le faire analyser !!!
!!! Ne lancez pas la partie désinfection sans l'avis d'un spécialiste !!!

Outil exécuté depuis C:\Program Files\navilog1
Session actuelle : "Andy"

Mise à jour le 05.11.2008 à 21h00 par IL-MAFIOSO

Microsoft Windows Vista 6.0.6001
Internet Explorer : 7.0.6001.18000
Système de fichiers :

Recherche executé en mode normal

*** Recherche Programmes installés ***


*** Recherche dossiers dans "C:\Windows" ***


*** Recherche dossiers dans "C:\Program Files" ***


*** Recherche dossiers dans "c:\progra~2\micros~1\windows\startm~1\programs" ***

...\MessengerSkinner trouvé !

*** Recherche dossiers dans "c:\progra~2\micros~1\windows\startm~1" ***


*** Recherche dossiers dans "C:\ProgramData" ***


*** Recherche dossiers dans "c:\users\andy\appdata\roaming\micros~1\windows\startm~1\programs" ***


*** Recherche dossiers dans "C:\Users\Andy\AppData\Local\virtualstore\Program Files" ***


*** Recherche dossiers dans "C:\Users\Andy\AppData\Roaming" ***


*** Recherche avec Catchme-rootkit/stealth malware detector par gmer ***
pour + d'infos : http://www.gmer.net

Scan Catchme non réalisé.
Droits limités sur la session actuelle.

*** Recherche avec GenericNaviSearch ***
!!! Tous ces résultats peuvent révéler des fichiers légitimes !!!
!!! A vérifier impérativement avant toute suppression manuelle !!!

* Recherche dans "C:\Windows\system32" *

* Recherche dans "C:\Users\Andy\AppData\Local\Microsoft" *

* Recherche dans "C:\Users\Andy\AppData\Local" *



*** Recherche fichiers ***

la suite dsl :



*** Recherche clés spécifiques dans le Registre ***




*** Module de Recherche complémentaire ***
(Recherche fichiers spécifiques)

1)Recherche nouveaux fichiers Instant Access :


2)Recherche Heuristique :

* Dans "C:\Windows\system32" :


* Dans "C:\Users\Andy\AppData\Local\Microsoft" :


* Dans "C:\Users\Andy\AppData\Local" :

guiissg.exe trouvé !
guiissg.dat trouvé !
guiissg_nav.dat trouvé !
guiissg_navps.dat trouvé !
smsme.exe trouvé !
smsme.dat trouvé !
smsme_nav.dat trouvé !
smsme_navps.dat trouvé !

3)Recherche Certificats :

Certificat Egroup trouvé !
Certificat Electronic-Group trouvé !
Certificat Montorgueil absent !
Certificat OOO-Favorit trouvé !
Certificat Sunny-Day-Design-Ltd absent !

4)Recherche fichiers connus :



*** Analyse terminée le 07/12/2008 à 18:55:00,82 ***

c'est sa ou pas je suis pas sur ? :

Set menu: MSBLWindowClassM
Lock status changed: 2
Login challenge result: 0
Lock status changed: 4
Login challenge result: -2130704555
Login challenge result: -2130704555
Set menu: IMWindowClassI
Set menu: MSBLWindowClassM
Lock status changed: 4
Set menu: MSBLWindowClassM
Lock status changed: 2
Login challenge result: 0
Lock status changed: 4
Login challenge result: -2130704555
Login challenge result: -2130704555
Set menu: IMWindowClassI
Set menu: IMWindowClassI
Set menu: MSBLWindowClassM
Set menu: MSBLWindowClassM
Set menu: MSBLWindowClassM
Set menu: MSBLWindowClassM
Set menu: MSBLWindowClassM
Set menu: MSBLWindowClassM
Set menu: MSBLWindowClassM
Set menu: MSBLWindowClassM
Set menu: MSBLWindowClassM
Set menu: MSBLWindowClassM
Menu id: 40166
Menu id: 40166
Set menu: MSBLWindowClassM
Set menu: IMWindowClassI
Set menu: MSBLWindowClassM
Set menu: MSBLWindowClassM
Set menu: MSBLWindowClassM
Set menu: MSBLWindowClassM
Set menu: MSBLWindowClassM
Set menu: MSBLWindowClassM
Set menu: MSBLWindowClassM
Set menu: MSBLWindowClassM
Set menu: MSBLWindowClassM
Menu id: 40166
Set menu: MSBLWindowClassM
Set menu: MSBLWindowClassM
Set menu: IMWindowClassI
Set menu: IMWindowClassI
Set menu: MSBLWindowClassM
Set menu: MSBLWindowClassM
Menu id: 40166
Set menu: MSBLWindowClassM
Set menu: IMWindowClassI
Set menu: MSBLWindowClassM
Menu id: 40166
Set menu: MSBLWindowClassM
Set menu: MSBLWindowClassM
Set menu: MSBLWindowClassM
Set menu: MSBLWindowClassM
Set menu: MSBLWindowClassM
Set menu: IMWindowClassI
Set menu: IMWindowClassI
Set menu: MSBLWindowClassM
Set menu: MSBLWindowClassM
Set menu: MSBLWindowClassM
Set menu: MSBLWindowClassM
Set menu: IMWindowClassI
Set menu: IMWindowClassI
Set menu: IMWindowClassI
Set menu: IMWindowClassI
Set menu: MSBLWindowClassM
Set menu: MSBLWindowClassM
Set menu: MSBLWindowClassM
Set menu: MSBLWindowClassM
Lock status changed: 4
Set menu: MSBLWindowClassM
Lock status changed: 2
Login challenge result: 0
Lock status changed: 4
Login challenge result: -2130704555
Login challenge result: -2130704555
Set menu: IMWindowClassI
Set menu: MSBLWindowClassM
Set menu: IMWindowClassI
Set menu: IMWindowClassI
Set menu: IMWindowClassI
Set menu: MSBLWindowClassM
Set menu: MSBLWindowClassM
Set menu: IMWindowClassI
Menu id: 40156
Lock status changed: 4
Lock status changed: 4

sa ne marche pas je fait entrer et apré sa quitte tout !!!!!

non c'est bon c'est qu'il fallait le faire en mode sans ehec voila le rapport :


Clean Navipromo version 3.6.9 commencé le 07/12/2008 à 19:10:48,49

Outil exécuté depuis C:\Program Files\navilog1
Session actuelle : "Andy"

Mise à jour le 05.11.2008 à 21h00 par IL-MAFIOSO

Microsoft Windows Vista 6.0.6001
Internet Explorer : 7.0.6001.18000
Système de fichiers :

Mode suppression automatique
avec prise en charge résultats Catchme et GNS


Nettoyage executé en mode sans échec


*** fsbl1.txt non trouvé ***
(Assurez-vous que Catchme n'avait rien trouvé lors de la recherche)


*** Suppression avec sauvegardes résultats GenericNaviSearch ***

* Suppression dans "C:\Windows\System32" *


* Suppression dans "C:\Users\Andy\AppData\Local\Microsoft" *


* Suppression dans "C:\Users\Andy\AppData\Local" *



*** Suppression dossiers dans "C:\Windows" ***


*** Suppression dossiers dans "C:\Program Files" ***


*** Suppression dossiers dans "c:\progra~2\micros~1\windows\startm~1\programs" ***

...\MessengerSkinner ...suppression...
...\MessengerSkinner supprimé !


*** Suppression dossiers dans "c:\progra~2\micros~1\windows\startm~1" ***


*** Suppression dossiers dans "C:\ProgramData" ***


*** Suppression dossiers dans c:\users\andy\appdata\roaming\micros~1\windows\startm~1\programs ***


*** Suppression dossiers dans "C:\Users\Andy\AppData\Local\virtualstore\Program Files" ***


*** Suppression dossiers dans "C:\Users\Andy\AppData\Roaming" ***



*** Suppression fichiers ***


*** Suppression fichiers temporaires ***

Nettoyage contenu C:\Windows\Temp effectué !
Nettoyage contenu C:\Users\Andy\AppData\Local\Temp effectué !

*** Traitement Recherche complémentaire ***
(Recherche fichiers spécifiques)

1)Suppression avec sauvegardes nouveaux fichiers Instant Access :

2)Recherche, création sauvegardes et suppression Heuristique :


* Dans "C:\Windows\system32" *


* Dans "C:\Users\Andy\AppData\Local\Microsoft" *


* Dans "C:\Users\Andy\AppData\Local" *


guiissg.exe trouvé !
Copie guiissg.exe réalisée avec succès !
guiissg.exe supprimé !

guiissg.dat trouvé !
Copie guiissg.dat réalisée avec succès !
guiissg.dat supprimé !

guiissg_nav.dat trouvé !
Copie guiissg_nav.dat réalisée avec succès !
guiissg_nav.dat supprimé !

guiissg_navps.dat trouvé !
Copie guiissg_navps.dat réalisée avec succès !
guiissg_navps.dat supprimé !

smsme.exe trouvé !
Copie smsme.exe réalisée avec succès !
smsme.exe supprimé !

smsme.dat trouvé !
Copie smsme.dat réalisée avec succès !
smsme.dat supprimé !

smsme_nav.dat trouvé !
Copie smsme_nav.dat réalisée avec succès !
smsme_nav.dat supprimé !

smsme_navps.dat trouvé !
Copie smsme_navps.dat réalisée avec succès !
smsme_navps.dat supprimé !


*** Sauvegarde du Registre vers dossier Safebackup ***

sauvegarde du Registre réalisée avec succès !

*** Nettoyage Registre ***

Nettoyage Registre Ok


*** Certificats ***

Certificat Egroup supprimé !
Certificat Electronic-Group supprimé !
Certificat Montorgueil absent !
Certificat OOO-Favorit supprimé !
Certificat Sunny-Day-Design-Ltdt absent !


*** Nettoyage terminé le 07/12/2008 à 19:11:55,82 ***

voila le raporrt :


--------- Logfile of AD-Remover 1.0.6.5 by C_XX ---------

# START at: 20:18:19 | Sun 07/12/2008 ON Microsoft® Windows Vista ™ v6.0.6001
# BOOT MODE: Normal
(!) - UAC is disable

# OPTION: Scan
# EXECUTED FROM: C:\Program Files\Ad-remover\AD-Remover.bat

# PC: PC-DE-ANDY | USER: Andy ( Current user is an administrator )

# DRIVE(S): C:\ D:\ E:\ F:\ G:\ H:\ I:\ J:\ K:\
# Systemdrive: C:\ ()
# Internet Explorer v7.0.6001.18000

--------- [ RUNNING PROCESSES: 55 ] ---------

C:\Windows\System32\smss.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\wininit.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\winlogon.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\nvvsvc.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\rundll32.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe
C:\Program Files\Bonjour\mDNSResponder.exe
J:\Programmes files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\Windows\system32\IoctlSvc.exe
C:\Windows\system32\PnkBstrA.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\WUDFHost.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Hercules\WiFi Station\WiFiStation.exe
C:\Windows\System32\mobsync.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Program Files\uTorrent\uTorrent.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\system32\conime.exe
C:\Windows\system32\ntvdm.exe

-----------------------------------


+-----------------------| Boonty/Boonty Games Elements found..

.

+-----------------------| Eorezo Elements found..

"HKEY_CLASSES_ROOT\EoRezoBHO.EoBho"
"HKEY_CLASSES_ROOT\EoRezoBHO.EoBho.1"
"HKEY_CLASSES_ROOT\Interface\{B0D071A1-36B3-4757-A126-14C89C56013A}"
"HKEY_CLASSES_ROOT\Typelib\{B4C656C9-F2E9-4E77-B3F4-443DF2BD778F}"
"HKEY_CURRENT_USER\SOFTWARE\EoRezo"
"HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{64F56FC1-1272-44CD-BA6E-39723696E350}"
"HKEY_LOCAL_MACHINE\SOFTWARE\EoRezo"
"HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{64F56FC1-1272-44CD-BA6E-39723696E350}"
"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\EoEngine"
"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{64F56FC1-1272-44CD-BA6E-39723696E350}"
"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\run" /v "EoEngine"
"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\run" /v "EoWeather"
.
[07/12/2008 20:16|d--------] C:\Program Files\EoRezo
[07/12/2008 20:16|d--------] C:\Users\Andy\AppData\Roaming\EoRezo

+-----------------------| Everest Poker Elements found..

.

+-----------------------| FunWebProducts/MyWay/MyWebSearch/MyGlobalSearch Elements found..

"HKEY_CLASSES_ROOT\CLSID\{147a976f-eee1-4377-8ea7-4716e4cdd239}"
"HKEY_CLASSES_ROOT\CLSID\{9afb8248-617f-460d-9366-d71cdeda3179}"
.

+-----------------------| Messenger Skinner Elements found..

"HKEY_CURRENT_USER\SOFTWARE\MessengerSkinner"
.

+-----------------------| Sweetim Elements found..

.

+-----------------------| ADDED SCAN ..

+--[HKEY_CURRENT_USER\..\Run]

MsnMsgr REG_SZ "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
SpybotSD TeaTimer REG_SZ C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

+--[HKEY_LOCAL_MACHINE\..\Run]

Windows Defender REG_EXPAND_SZ %ProgramFiles%\Windows Defender\MSASCui.exe -hide
EoWeather REG_SZ
AVP REG_SZ "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe"
EoEngine REG_SZ

+--[HKEY_USERS\.DEFAULT\..\Run]


+--[HKEY_CURRENT_USER\..\Internet Explorer\MAIN]

Start Page : hxxp://www.google.fr/

+--[HKEY_LOCAL_MACHINE\..\Internet Explorer\MAIN]

Start Page : hxxp://go.microsoft.com/fwlink/?LinkId=69157

+---------------------------------------------------------------------------+

- "C:\AD-report-07.12.2008.log" (5207 octets)

[ END at: 20:18:38 | 07/12/2008 ] - [ Time elapsed: 18.8 seconds ]

+---------------------------------------------------------------------------+
+------------------------------- [ E.O.F - 130 lines ]
+---------------------------------------------------------------------------+

voila le rapport :



--------- Logfile of AD-Remover 1.0.6.5 by C_XX ---------

*** Limited to ***

Boonty/BoontyGames
Eorezo
Everest Poker
Funwebproduct/MyWay/MyWebsearch
Messenger Skinner
Sweetim

******************

# START at: 20:52:06 | Sun 07/12/2008 ON Microsoft® Windows Vista ™ v6.0.6001
# BOOT MODE: Normal
(!) - UAC is disable

# OPTION: Scan
# EXECUTED FROM: C:\Program Files\Ad-remover\AD-Remover.bat

# PC: PC-DE-ANDY | USER: Andy ( Current user is an administrator )

# DRIVE(S): C:\ D:\ E:\ F:\ G:\ H:\ I:\ J:\ K:\
# Systemdrive: C:\ ()
# Internet Explorer v7.0.6001.18000

--------- [ RUNNING PROCESSES: 52 ] ---------

C:\Windows\System32\smss.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\wininit.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\winlogon.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\nvvsvc.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\rundll32.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe
C:\Program Files\Bonjour\mDNSResponder.exe
J:\Programmes files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\Windows\system32\IoctlSvc.exe
C:\Windows\system32\PnkBstrA.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\WUDFHost.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Hercules\WiFi Station\WiFiStation.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Program Files\uTorrent\uTorrent.exe
C:\Windows\system32\conime.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Windows\System32\mobsync.exe
C:\Windows\system32\ntvdm.exe

-----------------------------------

(!) ---- IE start pages reset

+-----------------------| Boonty/Boonty Games Elements Deleted..

.

+-----------------------| Eorezo Elements Deleted..

"HKEY_CLASSES_ROOT\EoRezoBHO.EoBho"
"HKEY_CLASSES_ROOT\EoRezoBHO.EoBho.1"
"HKEY_CLASSES_ROOT\Interface\{B0D071A1-36B3-4757-A126-14C89C56013A}"
"HKEY_CLASSES_ROOT\Typelib\{B4C656C9-F2E9-4E77-B3F4-443DF2BD778F}"
"HKEY_CURRENT_USER\SOFTWARE\EoRezo"
"HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{64F56FC1-1272-44CD-BA6E-39723696E350}"
"HKEY_LOCAL_MACHINE\SOFTWARE\EoRezo"
"HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{64F56FC1-1272-44CD-BA6E-39723696E350}"
"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\EoEngine"
"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{64F56FC1-1272-44CD-BA6E-39723696E350}"
"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\run" /v "EoEngine"
"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\run" /v "EoWeather"
.
[07/12/2008 20:16|d--------] C:\Program Files\EoRezo
[07/12/2008 20:16|d--------] C:\Users\Andy\AppData\Roaming\EoRezo

+-----------------------| Everest Poker Elements Deleted..

.

+-----------------------| FunWebProducts/MyWay/MyWebSearch/MyGlobalSearch Elements Deleted..

"HKEY_CLASSES_ROOT\CLSID\{147a976f-eee1-4377-8ea7-4716e4cdd239}"
"HKEY_CLASSES_ROOT\CLSID\{9afb8248-617f-460d-9366-d71cdeda3179}"
.

+-----------------------| Messenger Skinner Elements Deleted..

"HKEY_CURRENT_USER\SOFTWARE\MessengerSkinner"
.

+-----------------------| Sweetim Elements Deleted..

.

(!) ---- Temp files deleted.
(!) ---- Recycle bin emptied in all drives.


+---------------------------------------------------------------------------+
+------------------------------- ADDED SCAN ..
+---------------------------------------------------------------------------+

+--[HKEY_CURRENT_USER\..\Run]

MsnMsgr REG_SZ "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
SpybotSD TeaTimer REG_SZ C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

+--[HKEY_LOCAL_MACHINE\..\Run]

Windows Defender REG_EXPAND_SZ %ProgramFiles%\Windows Defender\MSASCui.exe -hide
AVP REG_SZ "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe"

+--[HKEY_USERS\.DEFAULT\..\Run]


+--[HKEY_CURRENT_USER\..\Internet Explorer\MAIN]

Start Page : hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome

+--[HKEY_LOCAL_MACHINE\..\Internet Explorer\MAIN]

Start Page : hxxp://fr.msn.com/

+---------------------------------------------------------------------------+

- "C:\AD-report-07.12.2008.log" (5489 octets)

[ END at: 20:53:57 | 07/12/2008 ] - [ Time elapsed: 1 minute, 50 seconds ]

+---------------------------------------------------------------------------+
+------------------------------- [ E.O.F - 142 lines ]
+---------------------------------------------------------------------------+

log :


Logfile of random's system information tool 1.04 (written by random/random)
Run by Andy at 2008-12-07 21:08:49
Microsoft® Windows Vista™ Édition Intégrale Service Pack 1
System drive C: has 10 GB (33%) free of 31 GB
Total RAM: 2047 MB (51% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:08:58, on 07/12/2008
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Hercules\WiFi Station\WiFiStation.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\uTorrent\uTorrent.exe
C:\Windows\system32\conime.exe
C:\Windows\explorer.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Users\Andy\Downloads\RSIT.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Program Files\Trend Micro\HijackThis\Andy.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://actus.sfr.fr
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://actus.sfr.fr
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://actus.sfr.fr
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = https://actus.sfr.fr
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = andy.rateau@neuf.fr:80
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O1 - Hosts: ::1 localhost
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - J:\Programmes files\ms office 07\Office12\GrooveShellExtensions.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: FDMIECookiesBHO Class - {CC59E0F9-7E43-44FA-9FAA-8377850BF205} - C:\Program Files\Free Download Manager\iefdm2.dll (file missing)
O2 - BHO: Ask Toolbar BHO - {FE063DB1-4EC0-403e-8DD8-394C54984B2C} - C:\Program Files\AskTBar\bar\1.bin\ASKTBAR.DLL
O3 - Toolbar: DAEMON Tools Toolbar - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll
O3 - Toolbar: Ask Toolbar - {FE063DB9-4EC0-403e-8DD8-394C54984B2C} - C:\Program Files\AskTBar\bar\1.bin\ASKTBAR.DLL
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe"
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
O4 - Global Startup: WiFi Station.lnk = C:\Program Files\Hercules\WiFi Station\WiFiStation.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://D:\PROGRA~1\MICROS~1\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Tout télécharger avec Free Download Manager - file://C:\Program Files\Free Download Manager\dlall.htm
O8 - Extra context menu item: Télécharger avec Free Download Manager - file://C:\Program Files\Free Download Manager\dllink.htm
O8 - Extra context menu item: Télécharger la sélection avec Free Download Manager - file://C:\Program Files\Free Download Manager\dlselected.htm
O8 - Extra context menu item: Télécharger la vidéo avec Free Download Manager - file://C:\Program Files\Free Download Manager\dlfvideo.htm
O9 - Extra button: Statistiques d’Anti-Virus Internet - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\SCIEPlgn.dll
O9 - Extra button: Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - J:\PROGRA~1\MSOFFI~1\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: &Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - J:\PROGRA~1\MSOFFI~1\Office12\ONBttnIE.dll
O9 - Extra button: Add to VideoGet - {88CFA58B-A63F-4A94-9C54-0C7A58E3333E} - C:\PROGRA~1\NUCLEA~1\VideoGet\Plugins\VIDEOG~1.DLL
O9 - Extra 'Tools' menuitem: Add to &VideoGet - {88CFA58B-A63F-4A94-9C54-0C7A58E3333E} - C:\PROGRA~1\NUCLEA~1\VideoGet\Plugins\VIDEOG~1.DLL
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - J:\PROGRA~1\MICROS~1\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O13 - Gopher Prefix:
O16 - DPF: CabBuilder - http://kiw.imgag.com/imgag/kiw/toolbar/download/InstallerControl.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - J:\Programmes files\ms office 07\Office12\GrooveSystemServices.dll
O20 - AppInit_DLLs: C:\PROGRA~1\KASPER~1\KASPER~1.0\r3hook.dll
O22 - SharedTaskScheduler: Windows DreamScene - {E31004D1-A431-41B8-826F-E902F9D95C81} - C:\Windows\System32\DreamScene.dll
O23 - Service: Acronis OS Selector Reinstall Service (AcronisOSSReinstallSvc) - Unknown owner - C:\Program Files\Common Files\Acronis\Partition Suite\oss_reinstall_svc.exe (file missing)
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Kaspersky Anti-Virus 7.0 (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NBService - Unknown owner - D:\Programmes files\Nero 7\Nero BackItUp\NBService.exe (file missing)
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - J:\Programmes files\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc. - C:\Windows\system32\IoctlSvc.exe
O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe

log :


Logfile of random's system information tool 1.04 (written by random/random)
Run by Andy at 2008-12-07 21:08:49
Microsoft® Windows Vista™ Édition Intégrale Service Pack 1
System drive C: has 10 GB (33%) free of 31 GB
Total RAM: 2047 MB (51% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:08:58, on 07/12/2008
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Hercules\WiFi Station\WiFiStation.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\uTorrent\uTorrent.exe
C:\Windows\system32\conime.exe
C:\Windows\explorer.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Users\Andy\Downloads\RSIT.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Program Files\Trend Micro\HijackThis\Andy.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://actus.sfr.fr
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://actus.sfr.fr
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://recherche.neuf.fr/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = https://actus.sfr.fr
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = andy.rateau@neuf.fr:80
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O1 - Hosts: ::1 localhost
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - J:\Programmes files\ms office 07\Office12\GrooveShellExtensions.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: FDMIECookiesBHO Class - {CC59E0F9-7E43-44FA-9FAA-8377850BF205} - C:\Program Files\Free Download Manager\iefdm2.dll (file missing)
O2 - BHO: Ask Toolbar BHO - {FE063DB1-4EC0-403e-8DD8-394C54984B2C} - C:\Program Files\AskTBar\bar\1.bin\ASKTBAR.DLL
O3 - Toolbar: DAEMON Tools Toolbar - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll
O3 - Toolbar: Ask Toolbar - {FE063DB9-4EC0-403e-8DD8-394C54984B2C} - C:\Program Files\AskTBar\bar\1.bin\ASKTBAR.DLL
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe"
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
O4 - Global Startup: WiFi Station.lnk = C:\Program Files\Hercules\WiFi Station\WiFiStation.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://D:\PROGRA~1\MICROS~1\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Tout télécharger avec Free Download Manager - file://C:\Program Files\Free Download Manager\dlall.htm
O8 - Extra context menu item: Télécharger avec Free Download Manager - file://C:\Program Files\Free Download Manager\dllink.htm
O8 - Extra context menu item: Télécharger la sélection avec Free Download Manager - file://C:\Program Files\Free Download Manager\dlselected.htm
O8 - Extra context menu item: Télécharger la vidéo avec Free Download Manager - file://C:\Program Files\Free Download Manager\dlfvideo.htm
O9 - Extra button: Statistiques d’Anti-Virus Internet - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\SCIEPlgn.dll
O9 - Extra button: Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - J:\PROGRA~1\MSOFFI~1\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: &Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - J:\PROGRA~1\MSOFFI~1\Office12\ONBttnIE.dll
O9 - Extra button: Add to VideoGet - {88CFA58B-A63F-4A94-9C54-0C7A58E3333E} - C:\PROGRA~1\NUCLEA~1\VideoGet\Plugins\VIDEOG~1.DLL
O9 - Extra 'Tools' menuitem: Add to &VideoGet - {88CFA58B-A63F-4A94-9C54-0C7A58E3333E} - C:\PROGRA~1\NUCLEA~1\VideoGet\Plugins\VIDEOG~1.DLL
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - J:\PROGRA~1\MICROS~1\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O13 - Gopher Prefix:
O16 - DPF: CabBuilder - http://kiw.imgag.com/imgag/kiw/toolbar/download/InstallerControl.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - J:\Programmes files\ms office 07\Office12\GrooveSystemServices.dll
O20 - AppInit_DLLs: C:\PROGRA~1\KASPER~1\KASPER~1.0\r3hook.dll
O22 - SharedTaskScheduler: Windows DreamScene - {E31004D1-A431-41B8-826F-E902F9D95C81} - C:\Windows\System32\DreamScene.dll
O23 - Service: Acronis OS Selector Reinstall Service (AcronisOSSReinstallSvc) - Unknown owner - C:\Program Files\Common Files\Acronis\Partition Suite\oss_reinstall_svc.exe (file missing)
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Kaspersky Anti-Virus 7.0 (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NBService - Unknown owner - D:\Programmes files\Nero 7\Nero BackItUp\NBService.exe (file missing)
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - J:\Programmes files\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc. - C:\Windows\system32\IoctlSvc.exe
O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe

ta u le rapport ou pas sa deconne

a tu msn ou pas parceque sa veu pas se poster le raport ou alors c mon ordi qui déconne !!!!

nan je serer la

-----------\\ ToolBar S&D 1.2.6 XP/Vista

Microsoft® Windows Vista™ Édition Intégrale ( v6.0.6001 ) Service Pack 1
X86-based PC ( Multiprocessor Free : AMD Athlon(tm) 64 X2 Dual Core Processor 4800+ )
BIOS : BIOS Date: 09/13/07 11:13:56 Ver: 08.00.12
USER : Andy ( Administrator )
BOOT : Normal boot
Antivirus : Kaspersky Anti-Virus 7.0.1.325 (Activated)
C:\ (Local Disk) - NTFS - Total:30 Go (Free:9 Go)
D:\ (Local Disk) - NTFS - Total:104 Go (Free:19 Go)
E:\ (CD or DVD)
F:\ (USB)
G:\ (USB)
H:\ (USB)
I:\ (USB)
J:\ (Local Disk) - NTFS - Total:97 Go (Free:36 Go)
K:\ (CD or DVD)

"C:\ToolBar SD" ( MAJ : 04-12-2008|20:40 )
Option : [2] ( 07/12/2008|21:47 )

[ UAC => 1 ]

-----------\\ SUPPRESSION

Echec ! - C:\Program Files\AskTBar\bar
Echec ! - C:\Program Files\AskTBar\bar\1.bin
Echec ! - C:\Program Files\AskTBar\bar\1.bin\ASKTBAR.DLL
Supprime! - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll
Supprime! - C:\Program Files\DAEMON Tools Toolbar\Resources
Supprime! - C:\Program Files\DAEMON Tools Toolbar\uninst.exe
Supprime! - C:\Program Files\DAEMON Tools Toolbar\_DTLite.xml
Echec ! - C:\Program Files\AskTBar
Supprime! - C:\Program Files\DAEMON Tools Toolbar

-----------\\ DEUXIEME PASSAGE

Echec ! - C:\Program Files\AskTBar\bar
Echec ! - C:\Program Files\AskTBar\bar\1.bin
Echec ! - C:\Program Files\AskTBar\bar\1.bin\ASKTBAR.DLL
Echec ! - C:\Program Files\AskTBar

-----------\\ Recherche de Fichiers / Dossiers ...

C:\Program Files\AskTBar
C:\Program Files\AskTBar\bar
C:\Program Files\AskTBar\bar\1.bin
C:\Program Files\AskTBar\bar\1.bin\ASKTBAR.DLL

-----------\\ [..\Internet Explorer\Main]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Local Page"="C:\\Windows\\system32\\blank.htm"
"Search Page"="https://actus.sfr.fr"
"Start Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome"
"Search Bar"="https://actus.sfr.fr"
"Url"="https://www.msn.com/fr-fr/actualite/"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
"Start Page"="https://www.msn.com/fr-fr/"
"Default_Page_URL"="https://www.msn.com/fr-fr/?ocid=iehp"
"Default_Search_URL"="https://actus.sfr.fr"
"Search Page"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"


--------------------\\ Recherche d'autres infections

--------------------\\ ROOTKIT !!

Rootkit Tibs ! .. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_TDSSSERV.SYS]
Rootkit Tibs ! .. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet014\Enum\Root\LEGACY_TDSSSERV.SYS]
Rootkit Tibs ! .. [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_TDSSSERV.SYS]

--------------------\\ ROGUES ..

C:\Users\Andy\AppData\Roaming\VirusRemover2008

--------------------\\ Cracks & Keygens ..

C:\Users\Andy\AppData\Local\Shareaza\Incomplete\Microsoft Office 2007 Crack.rar
C:\Users\Andy\AppData\Roaming\uTorrent\FAR CRY 2 With Working Crack.torrent
C:\Users\Andy\AppData\Roaming\uTorrent\Microsoft Office 2007 Activation Crack With Serial - POLPP.torrent
C:\Users\Andy\AppData\Roaming\uTorrent\Microsoft Office Keygen.exe.torrent
C:\Users\Andy\AppData\Roaming\uTorrent\Need For Speed Undercover incl CrAcK.torrent
C:\Users\Andy\AppData\Roaming\uTorrent\Windows 2007 Office Ultimate + Crack + Serials_NoFear.rar.torrent
C:\Users\Andy\AppData\Roaming\uTorrent\[PC]POSTAL.2.SHARE.THE.PAIN.+.APOCALYPSE.WEEKEND.+.CRACK.+.PATCH.&.CHEAT.by.DARK.SHADOW.zip.torrent
C:\Users\Andy\Documents\Windows 2007 Office Ultimate + Crack + Serials_NoFear
C:\Users\Andy\Documents\Shareaza Downloads\Metadata\CD Rip 2007 crack office.rar.xml
C:\Users\Andy\Documents\Shareaza Downloads\Metadata\cl‚ d activation office 2007 crack(no cd).zip.xml
C:\Users\Andy\Documents\Shareaza Downloads\Metadata\Crack - Microsoft Office 2007 Serial Keygen.rar.xml
C:\Users\Andy\Documents\Shareaza Downloads\Metadata\crack microsoft office 07 professionnel.Crack.All.Version.zip.xml
C:\Users\Andy\Documents\Windows 2007 Office Ultimate + Crack + Serials_NoFear\Crack
C:\Users\Andy\Documents\Windows 2007 Office Ultimate + Crack + Serials_NoFear\Serials
C:\Users\Andy\Documents\Windows 2007 Office Ultimate + Crack + Serials_NoFear\Crack\Crack
C:\Users\Andy\Documents\Windows 2007 Office Ultimate + Crack + Serials_NoFear\Crack\Crack\2.jpg
C:\Users\Andy\Documents\Windows 2007 Office Ultimate + Crack + Serials_NoFear\Crack\Crack\Office 2007 Crack
C:\Users\Andy\Documents\Windows 2007 Office Ultimate + Crack + Serials_NoFear\Crack\Crack\Thumbs.db
C:\Users\Andy\Documents\Windows 2007 Office Ultimate + Crack + Serials_NoFear\Crack\Crack\Office 2007 Crack\Crack.exe
C:\Users\Andy\Documents\Windows 2007 Office Ultimate + Crack + Serials_NoFear\Crack\Crack\Office 2007 Crack\install.bat
C:\Users\Andy\Documents\Windows 2007 Office Ultimate + Crack + Serials_NoFear\Crack\Crack\Office 2007 Crack\Instructions.txt
C:\Users\Andy\Documents\Windows 2007 Office Ultimate + Crack + Serials_NoFear\Crack\Crack\Office 2007 Crack\OGACheckControl.dll
C:\Users\Andy\Documents\Windows 2007 Office Ultimate + Crack + Serials_NoFear\Crack\Crack\Office 2007 Crack\Thumbs.db
C:\Users\Andy\Documents\Windows 2007 Office Ultimate + Crack + Serials_NoFear\Crack\Crack\Office 2007 Crack\uninstall.bat
C:\Users\Andy\Documents\Windows 2007 Office Ultimate + Crack + Serials_NoFear\Serials\Cd Keys
C:\Users\Andy\Documents\Windows 2007 Office Ultimate + Crack + Serials_NoFear\Serials\Cd Keys\Cd Keys.txt
C:\Users\Andy\Downloads\GTA_IV_PC_Version_and_Crack_[mininova].torrent
C:\Users\Andy\Downloads\eMule\Incoming\2_farcry keygen serial francko59(1).txt
C:\Users\Andy\Downloads\eMule\Incoming\2_farcry keygen serial francko59(2).txt
C:\Users\Andy\Downloads\eMule\Incoming\2_farcry keygen serial francko59.txt


[ UAC => 1 ]


1 - "C:\ToolBar SD\TB_1.txt" - 07/12/2008|21:22 - Option : [1]
2 - "C:\ToolBar SD\TB_2.txt" - 07/12/2008|21:48 - Option : [2]

-----------\\ Fin du rapport a 21:48:35,37

c bon ais le raport s'affiche pas tu la vu ou pas ?

voila le raport :

Malwarebytes' Anti-Malware 1.31
Version de la base de données: 1471
Windows 6.0.6001 Service Pack 1

08/12/2008 06:03:21
mbam-log-2008-12-08 (06-03-21).txt

Type de recherche: Examen complet (C:\|D:\|J:\|)
Eléments examinés: 178155
Temps écoulé: 1 hour(s), 4 minute(s), 2 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 7
Valeur(s) du Registre infectée(s): 1
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 2
Fichier(s) infecté(s): 6

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
HKEY_CLASSES_ROOT\CLSID\{6d794cb4-c7cd-4c6f-bfdc-9b77afbdc02c} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\tdssdata (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\tdss (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\MS Juan (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\contim (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\dslcnnct (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\MS Track System (Trojan.Vundo) -> Quarantined and deleted successfully.

Valeur(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{6d794cb4-c7cd-4c6f-bfdc-9b77afbdc02c} (Trojan.Vundo) -> Quarantined and deleted successfully.

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
C:\Users\Andy\AppData\Roaming\VirusRemover2008 (Rogue.VirusRemover) -> Quarantined and deleted successfully.
C:\Users\Andy\AppData\Roaming\VirusRemover2008\Logs (Rogue.VirusRemover) -> Quarantined and deleted successfully.

Fichier(s) infecté(s):
C:\Users\Andy\AppData\Local\Temp\TDSSe74e.tmp (Trojan.TDSS) -> Quarantined and deleted successfully.
C:\Windows\System32\TDSScrrx.dll (Trojan.TDSS) -> Delete on reboot.
C:\Windows\System32\TDSSntlv.dll (Trojan.TDSS) -> Delete on reboot.
C:\Users\Andy\AppData\Roaming\VirusRemover2008\Logs\scns.log (Rogue.VirusRemover) -> Quarantined and deleted successfully.
C:\Windows\System32\TDSSfopt.dll (Rootkit.Agent) -> Delete on reboot.
C:\Windows\System32\drivers\TDSSnbcb.sys (Rootkit.Agent) -> Delete on reboot.

il y en a encore beaucoup de chose a fair ou pas ????? parceque la c bon j'ais plus de pub sur le net

ok je continu je le fait maitenent

ComboFix 08-12-09.03 - Andy 2008-12-10 16:35:45.1 - NTFSx86
Microsoft® Windows Vista™ Édition Intégrale 6.0.6001.1.1252.1.1036.18.1151 [GMT 1:00]
Lancé depuis: c:\users\Andy\Downloads\ComboFix.exe
* Un nouveau point de restauration a été créé
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\program files\Windows Live\Messenger\msimg32.dll
c:\programdata\Microsoft\Network\Downloader\qmgr0.dat
c:\programdata\Microsoft\Network\Downloader\qmgr1.dat
c:\users\Andy\AppData\Roaming\Adobe\crc.dat
c:\windows\system32\drivers\npf.sys
c:\windows\system32\packet.dll
c:\windows\system32\TDSSwqsc.dat
c:\windows\system32\wpcap.dll

----- BITS: Il y a peut-être des sites infectés -----

hxxp://78.157.143.163
hxxp://78.157.143.198
.
((((((((((((((((((((((((((((((((((((((( Pilotes/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_TDSSSERV.SYS
-------\Service_NPF
-------\Service_TDSSserv.sys


((((((((((((((((((((((((((((( Fichiers créés du 2008-11-10 au 2008-12-10 ))))))))))))))))))))))))))))))))))))
.

2008-12-10 15:57 . 2008-10-22 02:22 2,048 --a------ c:\windows\System32\tzres.dll
2008-12-10 09:54 . 2008-10-21 06:25 296,960 --a------ c:\windows\System32\gdi32.dll
2008-12-10 09:53 . 2008-11-01 02:21 4,240,384 --a------ c:\windows\System32\GameUXLegacyGDFs.dll
2008-12-10 09:53 . 2008-11-01 04:44 28,672 --a------ c:\windows\System32\Apphlpdm.dll
2008-12-07 23:39 . 2008-12-07 23:39 <REP> d-------- c:\users\Andy\AppData\Roaming\Malwarebytes
2008-12-07 23:39 . 2008-12-07 23:39 <REP> d-------- c:\users\All Users\Malwarebytes
2008-12-07 23:39 . 2008-12-07 23:39 <REP> d-------- c:\programdata\Malwarebytes
2008-12-07 23:39 . 2008-12-07 23:39 <REP> d-------- c:\program files\Malwarebytes' Anti-Malware
2008-12-07 23:39 . 2008-12-03 19:52 38,496 --a------ c:\windows\System32\drivers\mbamswissarmy.sys
2008-12-07 23:39 . 2008-12-03 19:52 15,504 --a------ c:\windows\System32\drivers\mbam.sys
2008-12-07 21:21 . 2008-12-07 21:48 <REP> d-------- C:\ToolBar SD
2008-12-07 21:08 . 2008-12-07 21:09 <REP> d-------- C:\rsit
2008-12-07 20:17 . 2008-12-07 21:20 <REP> d-------- c:\program files\Ad-remover
2008-12-07 18:52 . 2008-12-07 21:20 <REP> d-------- c:\program files\Navilog1
2008-12-07 17:53 . 2008-12-07 17:53 <REP> d-------- c:\program files\Trend Micro
2008-12-03 14:38 . 2008-12-03 14:38 <REP> d-------- c:\program files\Full Pack Codecs
2008-12-03 01:43 . 2008-10-16 22:13 1,809,944 --a------ c:\windows\System32\wuaueng.dll
2008-12-03 01:43 . 2008-10-16 21:56 1,524,736 --a------ c:\windows\System32\wucltux.dll
2008-12-03 01:43 . 2008-10-16 22:12 561,688 --a------ c:\windows\System32\wuapi.dll
2008-12-03 01:43 . 2008-10-16 14:08 162,064 --a------ c:\windows\System32\wuwebv.dll
2008-12-03 01:43 . 2008-10-16 21:55 83,456 --a------ c:\windows\System32\wudriver.dll
2008-12-03 01:43 . 2008-10-16 22:09 51,224 --a------ c:\windows\System32\wuauclt.exe
2008-12-03 01:43 . 2008-10-16 22:09 43,544 --a------ c:\windows\System32\wups2.dll
2008-12-03 01:43 . 2008-10-16 22:08 34,328 --a------ c:\windows\System32\wups.dll
2008-12-03 01:43 . 2008-10-16 13:56 31,232 --a------ c:\windows\System32\wuapp.exe
2008-12-01 19:22 . 2008-12-02 06:43 <REP> d-------- c:\program files\MessengerDiscovery
2008-12-01 19:22 . 2004-03-09 01:00 609,824 --a------ c:\windows\System32\COMCTL32.ocx
2008-12-01 19:22 . 2004-03-08 23:00 152,848 --a------ c:\windows\System32\comdlg32.OCX
2008-12-01 19:22 . 2004-03-09 01:00 124,688 --a------ c:\windows\System32\MSWINSCK.ocx
2008-11-30 17:09 . 2008-12-07 18:07 <REP> d-------- c:\users\All Users\Spybot - Search & Destroy
2008-11-30 17:09 . 2008-12-07 18:07 <REP> d-------- c:\programdata\Spybot - Search & Destroy
2008-11-30 17:09 . 2008-11-30 17:13 <REP> d-------- c:\program files\Spybot - Search & Destroy
2008-11-29 11:24 . 2008-11-29 11:24 9,512 --a------ c:\windows\Ascd_tmp.ini
2008-11-29 08:19 . 2008-11-29 08:30 2 --a------ C:\109247794
2008-11-28 19:36 . 2008-12-03 19:25 <REP> d-a------ c:\users\All Users\TEMP
2008-11-28 19:36 . 2008-12-03 19:25 <REP> d-a------ c:\programdata\TEMP
2008-11-26 14:16 . 2008-10-21 06:25 1,645,568 --a------ c:\windows\System32\connect.dll
2008-11-26 14:16 . 2008-08-28 04:40 712,704 --a------ c:\windows\System32\WindowsCodecs.dll
2008-11-26 14:16 . 2008-08-28 04:40 425,472 --a------ c:\windows\System32\PhotoMetadataHandler.dll
2008-11-26 14:16 . 2008-08-28 04:40 347,136 --a------ c:\windows\System32\WindowsCodecsExt.dll
2008-11-26 14:16 . 2008-10-22 04:57 241,152 --a------ c:\windows\System32\PortableDeviceApi.dll
2008-11-23 17:08 . 2008-11-23 17:08 <REP> d-------- c:\program files\CCleaner
2008-11-20 20:11 . 2008-11-20 20:11 <REP> d-------- c:\users\Andy\AppData\Roaming\HiYo
2008-11-20 20:11 . 2008-11-20 20:11 <REP> d-------- c:\users\All Users\HiYo
2008-11-20 20:11 . 2008-11-20 20:11 <REP> d-------- c:\programdata\HiYo
2008-11-20 20:11 . 2008-11-20 20:11 <REP> d-------- c:\program files\HiYo
2008-11-16 10:08 . 2008-11-29 10:14 <REP> d-------- c:\users\Andy\AppData\Roaming\Free Download Manager
2008-11-15 19:57 . 2008-11-15 19:57 59 --a------ c:\windows\wininit.ini
2008-11-15 19:15 . 2008-11-15 19:19 <REP> d-------- c:\windows\System32\Samsung_USB_Drivers
2008-11-15 19:15 . 2005-08-13 05:06 22,486 -ra------ c:\windows\System32\UnInstall_Driver.ico
2008-11-13 18:31 . 2008-09-10 04:40 1,334,272 --a------ c:\windows\System32\msxml6.dll
2008-11-13 18:31 . 2008-09-05 06:14 1,191,936 --a------ c:\windows\System32\msxml3.dll
2008-11-13 18:31 . 2008-08-27 02:05 212,480 --a------ c:\windows\System32\drivers\mrxsmb10.sys

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-12-10 15:38 2,256,020 --sha-w c:\windows\system32\drivers\fidbox.idx
2008-12-10 15:38 168,286,752 --sha-w c:\windows\system32\drivers\fidbox.dat
2008-12-10 15:34 --------- d-----w c:\programdata\Kaspersky Lab
2008-12-10 15:30 --------- d-----w c:\users\Andy\AppData\Roaming\uTorrent
2008-12-10 15:28 --------- d-----w c:\programdata\Microsoft Help
2008-12-10 15:01 --------- d-----w c:\program files\Windows Mail
2008-12-10 12:23 --------- d-----w c:\program files\Yahoo!
2008-12-07 20:18 --------- d-----w c:\program files\Windows Live Safety Center
2008-12-07 18:20 --------- d-----w c:\program files\uTorrent
2008-12-03 16:08 22,328 ----a-w c:\windows\system32\drivers\PnkBstrK.sys
2008-11-30 12:57 --------- d-----w c:\program files\K-Lite Codec Pack
2008-11-29 10:45 --------- d-----w c:\program files\Analog Devices
2008-11-29 10:44 --------- d--h--w c:\program files\InstallShield Installation Information
2008-11-26 19:46 --------- d-----w c:\users\Andy\AppData\Roaming\OpenOffice.org2
2008-11-05 16:30 295,961 ----a-w c:\windows\Clean.exe
2008-11-01 14:14 --------- d-----w c:\users\Andy\AppData\Roaming\agi
2008-11-01 14:14 --------- d-----w c:\programdata\agi
2008-11-01 14:14 --------- d-----w c:\program files\AGI
2008-11-01 03:44 541,696 ----a-w c:\windows\AppPatch\AcLayers.dll
2008-11-01 03:44 52,736 ----a-w c:\windows\AppPatch\iebrshim.dll
2008-11-01 03:44 460,288 ----a-w c:\windows\AppPatch\AcSpecfc.dll
2008-11-01 03:44 2,154,496 ----a-w c:\windows\AppPatch\AcGenral.dll
2008-11-01 03:44 173,056 ----a-w c:\windows\AppPatch\AcXtrnal.dll
2008-10-29 14:10 --------- d-----w c:\program files\Messenger Plus! Live
2008-10-29 13:04 --------- d-----w c:\programdata\Messenger Plus!
2008-10-29 08:03 --------- d-----w c:\programdata\NVIDIA
2008-10-29 06:29 2,927,104 ----a-w c:\windows\explorer.exe
2008-10-28 10:41 22,328 ----a-w c:\users\Andy\AppData\Roaming\PnkBstrK.sys
2008-10-27 13:29 --------- d--h--r c:\users\Andy\AppData\Roaming\SecuROM
2008-10-23 17:30 --------- d-----w c:\program files\Microsoft Silverlight
2008-10-11 14:55 --------- d-----w c:\program files\MSBuild
2008-10-11 14:52 --------- d-----w c:\program files\Microsoft Visual Studio 8
2008-10-10 18:42 --------- d-----w c:\program files\Audacity
2008-08-17 12:27 174 --sha-w c:\program files\desktop.ini
2008-01-18 21:33 929,792 --sh--r c:\windows\System32\tdvhost.exe
2008-01-18 21:33 929,792 --sh--r c:\windows\System32\wsnhost.exe
.

((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MsnMsgr"="c:\program files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 5724184]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2008-07-07 2156368]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HiYo"="c:\program files\HiYo\bin\HiYo.exe" [2008-10-23 300336]
"AVP"="c:\program files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe" [2008-02-08 227856]

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
WiFi Station.lnk - c:\program files\Hercules\WiFi Station\WiFiStation.exe [2008-08-25 98304]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"FilterAdministratorToken"= 1 (0x1)
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\progra~1\KASPER~1\KASPER~1.0\r3hook.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.i420"= i420vfw.dll

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Adobe Gamma Loader.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Gamma Loader.lnk
backup=c:\windows\pss\Adobe Gamma Loader.lnk.CommonStartup
backupExtension=.CommonStartup

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=c:\windows\pss\Adobe Reader Speed Launch.lnk.CommonStartup
backupExtension=.CommonStartup

[HKLM\~\startupfolder\C:^Users^Andy^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OneNote 2007 - Capture d'écran et lancement.lnk]
path=c:\users\Andy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 - Capture d'écran et lancement.lnk
backup=c:\windows\pss\OneNote 2007 - Capture d'écran et lancement.lnk.Startup
backupExtension=.Startup

[HKLM\~\startupfolder\C:^Users^Andy^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OpenOffice.org 2.0.lnk]
path=c:\users\Andy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 2.0.lnk
backup=c:\windows\pss\OpenOffice.org 2.0.lnk.Startup
backupExtension=.Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
--a------ 2008-07-17 13:20 490952 c:\program files\DAEMON Tools Lite\daemon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ehTray.exe]
--a------ 2008-01-18 22:33 125952 c:\windows\ehome\ehtray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor]
--a------ 2007-08-24 06:00 33648 j:\programmes files\ms office 07\Office12\GrooveMonitor.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HiYo]
--a------ 2008-10-23 17:27 300336 c:\program files\HiYo\Bin\HiYo.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NBKeyScan]
--a------ 2008-02-18 15:29 2221352 j:\programmes files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
--a------ 2008-09-17 23:55 13580832 c:\windows\System32\nvcpl.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
--a------ 2008-09-17 23:55 92704 c:\windows\System32\nvmctray.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a------ 2008-01-31 22:13 385024 c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Shareaza]
--a------ 2008-01-01 16:49 4739072 c:\program files\Shareaza\Shareaza.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMAXPnP]
--a------ 2006-12-18 14:34 868352 c:\program files\Analog Devices\Core\smax4pnp.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinSys2]
--a------ 2006-06-01 06:21 53248 c:\windows\System32\startup.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UacDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"TCP Query User{4063DC1C-5F29-4EE3-9DC7-AB93834F5337}d:\\programmes files\\test drive unlimited\\testdriveunlimited.exe"= UDP:d:\programmes files\test drive unlimited\testdriveunlimited.exe:Test Drive Unlimited
"UDP Query User{D69BF16E-E3AF-4BBE-9CC6-2362F192AB88}d:\\programmes files\\test drive unlimited\\testdriveunlimited.exe"= TCP:d:\programmes files\test drive unlimited\testdriveunlimited.exe:Test Drive Unlimited
"TCP Query User{08CBC18A-AEE6-4B23-9458-E3850BF52D81}d:\\programmes files\\call of duty\\codmp.exe"= UDP:d:\programmes files\call of duty\codmp.exe:CoDMP
"UDP Query User{E30F93F7-BC8A-45F1-8C1B-A063FFC51A68}d:\\programmes files\\call of duty\\codmp.exe"= TCP:d:\programmes files\call of duty\codmp.exe:CoDMP
"{C2A2D8FD-D82C-43D7-AF24-D8D626CB3618}"= UDP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour
"{D0D7E113-0723-4B0A-A9A6-E3F3D4920988}"= TCP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour
"{F0963958-C815-43DC-8961-4E2CB1E823FC}"= UDP:d:\programmes files\iTunes\iTunes.exe:iTunes
"{08D90277-449F-4E88-879B-A4C8D393C944}"= TCP:d:\programmes files\iTunes\iTunes.exe:iTunes
"TCP Query User{1A73FE8B-0F23-4502-8C06-6893D0CE688A}d:\\programmes files\\codemasters\\dirt\\dirt.exe"= UDP:d:\programmes files\codemasters\dirt\dirt.exe:DiRT Executable
"UDP Query User{3515FBF8-BD5D-4B6F-BFC0-00684259B39C}d:\\programmes files\\codemasters\\dirt\\dirt.exe"= TCP:d:\programmes files\codemasters\dirt\dirt.exe:DiRT Executable
"{BB1D62D8-A1E2-4608-B5D9-69614EBA0E25}"= UDP:d:\programmes files\juiced 2\Juiced2_HIN.exe:Juiced2_HIN
"{D0DED429-A950-46D1-A8C7-8358C506B3E2}"= TCP:d:\programmes files\juiced 2\Juiced2_HIN.exe:Juiced2_HIN
"{1C2750C7-EC57-4646-9FA5-CB4621B043F6}"= UDP:d:\programmes files\Codemasters\Race driver grid\GRID.exe:GRID
"{02A5A5DC-0C4A-4959-9190-2F542014AD12}"= TCP:d:\programmes files\Codemasters\Race driver grid\GRID.exe:GRID
"TCP Query User{676055FF-5267-4D49-A640-99E762B27BA3}d:\\programmes files\\emule\\emule.exe"= UDP:d:\programmes files\emule\emule.exe:eMule
"UDP Query User{1421C564-E409-46C2-88BA-AB497CF5A694}d:\\programmes files\\emule\\emule.exe"= TCP:d:\programmes files\emule\emule.exe:eMule
"{C3275FC8-481C-4809-A9D2-ADC643B9D221}"= c:\program files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
"TCP Query User{3EC8955F-E7F7-4FCE-A6D9-421FD203A8D9}d:\\programmes files\\itstv\\itstv.exe"= UDP:d:\programmes files\itstv\itstv.exe:Application MFC ITSWebTV
"UDP Query User{FE0116EA-5A79-4CB7-8887-8AAE92EEE851}d:\\programmes files\\itstv\\itstv.exe"= TCP:d:\programmes files\itstv\itstv.exe:Application MFC ITSWebTV
"TCP Query User{F58BAD13-4468-4218-A80E-2C04FAB6B404}c:\\program files\\shareaza\\shareaza.exe"= UDP:c:\program files\shareaza\shareaza.exe:Shareaza Ultimate File Sharing
"UDP Query User{96EAD5A3-9F16-4147-8167-E0DA78242F2B}c:\\program files\\shareaza\\shareaza.exe"= TCP:c:\program files\shareaza\shareaza.exe:Shareaza Ultimate File Sharing
"TCP Query User{2053D062-C0B2-4FD7-81AC-02AEB63AF099}c:\\program files\\utorrent\\utorrent.exe"= UDP:c:\program files\utorrent\utorrent.exe:µTorrent
"UDP Query User{717939E8-3039-45C0-BEBA-BC49E7DB9BA8}c:\\program files\\utorrent\\utorrent.exe"= TCP:c:\program files\utorrent\utorrent.exe:µTorrent
"TCP Query User{121E8690-C798-473E-A6E0-217C1B6746C7}d:\\programmes files\\codemasters\\race driver grid\\grid.exe"= UDP:d:\programmes files\codemasters\race driver grid\grid.exe:GRID Executable
"UDP Query User{E74CCED0-8CA3-4534-A952-B5A49338FD25}d:\\programmes files\\codemasters\\race driver grid\\grid.exe"= TCP:d:\programmes files\codemasters\race driver grid\grid.exe:GRID Executable
"TCP Query User{AB15AEFC-8DCE-4392-B080-C39B00423AF3}c:\\program files\\shareaza\\shareaza.exe"= UDP:c:\program files\shareaza\shareaza.exe:Shareaza Ultimate File Sharing
"UDP Query User{918841EA-7B17-45BE-AB97-F36C375C19A9}c:\\program files\\shareaza\\shareaza.exe"= TCP:c:\program files\shareaza\shareaza.exe:Shareaza Ultimate File Sharing
"{03A9A802-A913-424D-BD86-02109D0058F3}"= Disabled:UDP:c:\users\Andy\AppData\Local\Temp\ImInstaller\incredimail_installer.exe:IncrediMail Installer
"{3335234C-5608-473C-A746-3BAFDC6330C2}"= Disabled:TCP:c:\users\Andy\AppData\Local\Temp\ImInstaller\incredimail_installer.exe:IncrediMail Installer
"TCP Query User{CE5ABA7C-E6B6-423D-8476-2723FBF150CA}d:\\programmes files\\emule\\emule.exe"= UDP:d:\programmes files\emule\emule.exe:eMule
"UDP Query User{B02A6F6F-37D0-44CD-B266-FD2407BD1FD4}d:\\programmes files\\emule\\emule.exe"= TCP:d:\programmes files\emule\emule.exe:eMule
"{BF60B65D-EB39-4D8A-83B5-2CB68142658C}"= UDP:4661:emule
"{24FF9C7F-7C78-4276-9A1D-F2804E3AB1AF}"= UDP:c:\program files\uTorrent\uTorrent.exe:µTorrent (TCP-In)
"{8D1A5660-75E6-41EB-B556-EEAEB46CCC0E}"= TCP:c:\program files\uTorrent\uTorrent.exe:µTorrent (UDP-In)
"TCP Query User{E9CBD288-DCBD-4F4D-9DE3-F1F21AD0CF60}c:\\program files\\internet explorer\\iexplore.exe"= UDP:c:\program files\internet explorer\iexplore.exe:Internet Explorer
"UDP Query User{0704A923-CB1B-4C6E-B128-B669BD38E4D7}c:\\program files\\internet explorer\\iexplore.exe"= TCP:c:\program files\internet explorer\iexplore.exe:Internet Explorer
"TCP Query User{A540A792-7F44-43DA-9165-93DDDDCB976E}d:\\programmes files\\call of duty\\codmp.exe"= UDP:d:\programmes files\call of duty\codmp.exe:CoDMP
"UDP Query User{1F98EA5A-5CA1-440E-A619-7F224489A432}d:\\programmes files\\call of duty\\codmp.exe"= TCP:d:\programmes files\call of duty\codmp.exe:CoDMP
"TCP Query User{439188CC-2CC0-4763-BAD6-2249C5EBD964}c:\\program files\\utorrent\\utorrent.exe"= UDP:c:\program files\utorrent\utorrent.exe:µTorrent
"UDP Query User{8ADAE0F0-E36F-4EAD-82A8-D8A718E0F9C1}c:\\program files\\utorrent\\utorrent.exe"= TCP:c:\program files\utorrent\utorrent.exe:µTorrent
"TCP Query User{8682EE21-6A12-4572-84CF-DE31B55D8960}d:\\programmes files\\savavgames\\flatout2\\flatout2.exe"= UDP:d:\programmes files\savavgames\flatout2\flatout2.exe:FlatOut2
"UDP Query User{5C54AF5E-07BE-4DE9-84DB-6968214EF167}d:\\programmes files\\savavgames\\flatout2\\flatout2.exe"= TCP:d:\programmes files\savavgames\flatout2\flatout2.exe:FlatOut2
"TCP Query User{9A2BB26A-6687-4888-AB40-D52F289554B2}d:\\programmes files\\test drive unlimited\\testdriveunlimited.exe"= UDP:d:\programmes files\test drive unlimited\testdriveunlimited.exe:Test Drive Unlimited
"UDP Query User{84E4AF78-18E5-4156-8C0D-8A86B5CCF34C}d:\\programmes files\\test drive unlimited\\testdriveunlimited.exe"= TCP:d:\programmes files\test drive unlimited\testdriveunlimited.exe:Test Drive Unlimited
"TCP Query User{3EC8FF64-45CE-430B-A2BC-92804ED41C14}j:\\programmes files\\emule\\emule.exe"= UDP:j:\programmes files\emule\emule.exe:eMule
"UDP Query User{9751D2BB-2118-4520-AEF1-31EE8D0D76D7}j:\\programmes files\\emule\\emule.exe"= TCP:j:\programmes files\emule\emule.exe:eMule
"TCP Query User{6F79180F-98C4-48B0-B88D-104ECA965523}j:\\programmes files\\nero\\nero8\\nero home\\nerohome.exe"= UDP:j:\programmes files\nero\nero8\nero home\nerohome.exe:Nero Home
"UDP Query User{2D45E9BC-B2FC-4156-9C95-969CEE4865CF}j:\\programmes files\\nero\\nero8\\nero home\\nerohome.exe"= TCP:j:\programmes files\nero\nero8\nero home\nerohome.exe:Nero Home
"{CFC755B7-3686-4884-9C13-681A5DFD52E0}"= TCP:6004|j:\programmes files\microsoft office 07\Office12\outlook.exe:Microsoft Office Outlook
"TCP Query User{60036BBA-3BA8-4CD4-B831-7AEB71FB339A}j:\\programmes files\\call of duty\\codmp.exe"= UDP:j:\programmes files\call of duty\codmp.exe:CoDMP
"UDP Query User{469DBC57-D28F-425B-A9EB-B6056AD08B21}j:\\programmes files\\call of duty\\codmp.exe"= TCP:j:\programmes files\call of duty\codmp.exe:CoDMP
"TCP Query User{674E5F7E-695A-4F65-85B6-EC167AADB1DF}j:\\programmes files\\test drive unlimited\\testdriveunlimited.exe"= UDP:j:\programmes files\test drive unlimited\testdriveunlimited.exe:Test Drive Unlimited
"UDP Query User{C04D2C71-EA54-410C-BD70-D7A5DDF61BE5}j:\\programmes files\\test drive unlimited\\testdriveunlimited.exe"= TCP:j:\programmes files\test drive unlimited\testdriveunlimited.exe:Test Drive Unlimited
"TCP Query User{44F35800-6665-42AB-A13A-D30F8FACC1C7}j:\\programmes files\\codemasters\\race driver grid\\grid.exe"= UDP:j:\programmes files\codemasters\race driver grid\grid.exe:GRID Executable
"UDP Query User{70B7ACB3-BA13-4BD0-9F61-EE2CF8C4C88E}j:\\programmes files\\codemasters\\race driver grid\\grid.exe"= TCP:j:\programmes files\codemasters\race driver grid\grid.exe:GRID Executable
"TCP Query User{5FBCAF4A-B584-4F29-BBFD-0C56A090E3A8}c:\\program files\\analogx\\proxy\\proxy.exe"= UDP:c:\program files\analogx\proxy\proxy.exe:proxy
"UDP Query User{0984DB46-B42F-4B21-BAD9-FD6888C807C0}c:\\program files\\analogx\\proxy\\proxy.exe"= TCP:c:\program files\analogx\proxy\proxy.exe:proxy
"TCP Query User{1C0F7F3E-2AD0-476D-8B41-E0AC3B52501B}c:\\programdata\\kaspersky lab setup files\\kaspersky internet security 2009\\french\\setup.exe"= UDP:c:\programdata\kaspersky lab setup files\kaspersky internet security 2009\french\setup.exe:Programme d'installation de Kaspersky Internet Security 2009
"UDP Query User{5F2D3A94-F48F-4ED6-9E1D-7280776AC447}c:\\programdata\\kaspersky lab setup files\\kaspersky internet security 2009\\french\\setup.exe"= TCP:c:\programdata\kaspersky lab setup files\kaspersky internet security 2009\french\setup.exe:Programme d'installation de Kaspersky Internet Security 2009
"TCP Query User{41BFF1D2-5A4A-4409-8AC6-637E6C0F4E24}c:\\programdata\\kaspersky lab setup files\\kaspersky internet security 7.0.1.325\\french\\setup.exe"= UDP:c:\programdata\kaspersky lab setup files\kaspersky internet security 7.0.1.325\french\setup.exe:Programme d'installation de Kaspersky Internet Security 7.0
"UDP Query User{E3728FA7-46E1-4B7B-B0BD-146025129BB0}c:\\programdata\\kaspersky lab setup files\\kaspersky internet security 7.0.1.325\\french\\setup.exe"= TCP:c:\programdata\kaspersky lab setup files\kaspersky internet security 7.0.1.325\french\setup.exe:Programme d'installation de Kaspersky Internet Security 7.0
"TCP Query User{06D96D28-663E-40F8-991A-2F6AA0AC0420}c:\\programdata\\kaspersky lab setup files\\kaspersky anti-virus 7.0.1.325\\french\\setup.exe"= UDP:c:\programdata\kaspersky lab setup files\kaspersky anti-virus 7.0.1.325\french\setup.exe:Programme d'installation de Kaspersky Anti-Virus 7.0
"UDP Query User{E2782FB0-DBBC-4D26-B98B-66CD92E642CA}c:\\programdata\\kaspersky lab setup files\\kaspersky anti-virus 7.0.1.325\\french\\setup.exe"= TCP:c:\programdata\kaspersky lab setup files\kaspersky anti-virus 7.0.1.325\french\setup.exe:Programme d'installation de Kaspersky Anti-Virus 7.0
"{AD8DA306-367A-4E65-A26C-AD4B29A62667}"= Disabled:UDP:c:\program files\IncrediMail\bin\IncMail.exe:IncrediMail
"{34EB3890-C88D-4AF3-825D-1243A3154C6A}"= Disabled:TCP:c:\program files\IncrediMail\bin\IncMail.exe:IncrediMail
"{608AAA13-1C43-4662-98C8-DA6FDB263137}"= Disabled:UDP:c:\program files\IncrediMail\bin\ImApp.exe:IncrediMail
"{E92388F3-F05E-46F0-BCC7-A01D2B4C4B32}"= Disabled:TCP:c:\program files\IncrediMail\bin\ImApp.exe:IncrediMail
"{8997E666-7A61-432F-8915-4B63B78ED354}"= Disabled:UDP:c:\program files\IncrediMail\bin\ImpCnt.exe:IncrediMail
"{CE492619-D619-469B-A324-FD29F00026EC}"= Disabled:TCP:c:\program files\IncrediMail\bin\ImpCnt.exe:IncrediMail
"{A950C6E6-AFA1-43AE-BEB4-A87F221EFE77}"= TCP:6004|j:\programmes files\ms office 07\Office12\outlook.exe:Microsoft Office Outlook
"{2E2648E6-68EC-49F3-A3D0-55FBBE2CD833}"= UDP:j:\programmes files\ms office 07\Office12\GROOVE.EXE:Microsoft Office Groove
"{F73FA123-F10D-46F8-A0CB-8D1799C44526}"= TCP:j:\programmes files\ms office 07\Office12\GROOVE.EXE:Microsoft Office Groove
"{0BCCA4A1-5F7C-49AB-968C-86CA3062743E}"= UDP:j:\programmes files\ms office 07\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{111748A3-511C-4A10-87B1-8D739CAF2EB1}"= TCP:j:\programmes files\ms office 07\Office12\ONENOTE.EXE:Microsoft Office OneNote
"TCP Query User{A0A800BF-EB99-4377-B5C5-3F2FB34FD80C}j:\\programmes files\\ea games\\need for speed carbon\\nfsc.exe"= UDP:j:\programmes files\ea games\need for speed carbon\nfsc.exe:NFSC
"UDP Query User{2A3B8953-0787-4A93-A1FE-E3844BA6A176}j:\\programmes files\\ea games\\need for speed carbon\\nfsc.exe"= TCP:j:\programmes files\ea games\need for speed carbon\nfsc.exe:NFSC
"TCP Query User{73B99687-BD48-4CF4-85E4-FAB96F583BC4}j:\\programmes files\\savavgames\\flatout2\\flatout2.exe"= UDP:j:\programmes files\savavgames\flatout2\flatout2.exe:FlatOut2
"UDP Query User{F4E7CCDA-4285-44A7-9F29-67FAE957B327}j:\\programmes files\\savavgames\\flatout2\\flatout2.exe"= TCP:j:\programmes files\savavgames\flatout2\flatout2.exe:FlatOut2
"TCP Query User{7371D0AC-5431-4800-856F-D228D9A4EA68}c:\\program files\\windows sidebar\\sidebar.exe"= UDP:c:\program files\windows sidebar\sidebar.exe:Volet Windows
"UDP Query User{3A397181-1D98-4DBA-B119-C091E5C9248C}c:\\program files\\windows sidebar\\sidebar.exe"= TCP:c:\program files\windows sidebar\sidebar.exe:Volet Windows
"{ED1B122B-EE80-4AF5-AB4C-39D2FA3E7D22}"= UDP:j:\programmes files\farcry 2\Far Cry 2\bin\FarCry2.exe:Far Cry 2
"{9069F7DF-008F-406F-95C6-837F9B800B59}"= TCP:j:\programmes files\farcry 2\Far Cry 2\bin\FarCry2.exe:Far Cry 2
"{2020C912-27F7-4511-8512-537AD94AAFB6}"= UDP:j:\programmes files\farcry 2\Far Cry 2\bin\FC2Launcher.exe:Far Cry 2 Updater
"{97D02E4D-549A-4833-A67C-FBE3528FD8FC}"= TCP:j:\programmes files\farcry 2\Far Cry 2\bin\FC2Launcher.exe:Far Cry 2 Updater
"{BA04039D-5746-41FE-8E59-FC003C1836C2}"= UDP:j:\programmes files\farcry 2\Far Cry 2\bin\FC2Editor.exe:Editeur
"{03D8E5A9-FE60-4371-9A0C-BE805D2638E7}"= TCP:j:\programmes files\farcry 2\Far Cry 2\bin\FC2Editor.exe:Editeur
"{AB9D697A-2C0E-418C-9339-3FB329C91F5C}"= UDP:c:\windows\System32\PnkBstrA.exe:PnkBstrA
"{1E08301D-01B8-40D6-84E1-AFC255ED834F}"= TCP:c:\windows\System32\PnkBstrA.exe:PnkBstrA
"{DDD68074-C86E-43CB-AE71-460E7FAEE4E4}"= UDP:c:\windows\System32\PnkBstrB.exe:PnkBstrB
"{A1C7CDBE-8FBF-4776-AB59-8F70AD995E83}"= TCP:c:\windows\System32\PnkBstrB.exe:PnkBstrB
"{758C69FE-E467-46B5-8C1A-1925DBDA98AB}"= UDP:j:\programmes files\Activision\Call of duty 4 modern warfare\iw3mp.exe:Call of Duty(R) 4 - Modern Warfare(TM)
"{C35C8324-975D-4A73-B979-248B33161EF6}"= TCP:j:\programmes files\Activision\Call of duty 4 modern warfare\iw3mp.exe:Call of Duty(R) 4 - Modern Warfare(TM)
"TCP Query User{44D16D09-9E4F-48A2-9C3D-C66077288144}j:\\programmes files\\codemasters\\race driver grid\\grid.exe"= UDP:j:\programmes files\codemasters\race driver grid\grid.exe:GRID Executable
"UDP Query User{2292F4E4-66B0-4EE8-823A-33508D420611}j:\\programmes files\\codemasters\\race driver grid\\grid.exe"= TCP:j:\programmes files\codemasters\race driver grid\grid.exe:GRID Executable
"TCP Query User{2CB4B53D-7AF9-4C48-A411-F1F3DB0C8611}j:\\programmes files\\activision\\call of duty 4 modern warfare\\iw3mp.exe"= UDP:j:\programmes files\activision\call of duty 4 modern warfare\iw3mp.exe:iw3mp
"UDP Query User{30916027-4E98-4AD1-AFA8-54C47BFBC75B}j:\\programmes files\\activision\\call of duty 4 modern warfare\\iw3mp.exe"= TCP:j:\programmes files\activision\call of duty 4 modern warfare\iw3mp.exe:iw3mp
"TCP Query User{A9BA53B9-50B7-48F3-9FFB-BCFD5ADA6DFD}j:\\programmes files\\farcry 2\\far cry 2\\bin\\farcry2.exe"= UDP:j:\programmes files\farcry 2\far cry 2\bin\farcry2.exe:Far Cry® 2
"UDP Query User{EC65E14C-F280-4663-A50F-6C9DA2EE2D61}j:\\programmes files\\farcry 2\\far cry 2\\bin\\farcry2.exe"= TCP:j:\programmes files\farcry 2\far cry 2\bin\farcry2.exe:Far Cry® 2
"TCP Query User{87733A02-FA9F-41F6-A54D-1A456FF790B5}c:\\users\\andy\\downloads\\wow-frfr-installer-downloader.exe"= UDP:c:\users\andy\downloads\wow-frfr-installer-downloader.exe:wow-frfr-installer-downloader.exe
"UDP Query User{19649813-0219-466C-9557-D1B0B1B32DF9}c:\\users\\andy\\downloads\\wow-frfr-installer-downloader.exe"= TCP:c:\users\andy\downloads\wow-frfr-installer-downloader.exe:wow-frfr-installer-downloader.exe
"TCP Query User{ED941CF1-64F7-4330-BCD3-B8E9A022EA69}c:\\program files\\free download manager\\fdm.exe"= UDP:c:\program files\free download manager\fdm.exe:Free Download Manager
"UDP Query User{59E8ACB8-C849-4B47-A88D-72701AC64953}c:\\program files\\free download manager\\fdm.exe"= TCP:c:\program files\free download manager\fdm.exe:Free Download Manager
"TCP Query User{5ACC80B3-CB62-4594-A48C-67E6D2AC89E8}c:\\program files\\free download manager\\fdm.exe"= UDP:c:\program files\free download manager\fdm.exe:Free Download Manager
"UDP Query User{8ED687A0-B32F-4594-8015-AF205EFEECCC}c:\\program files\\free download manager\\fdm.exe"= TCP:c:\program files\free download manager\fdm.exe:Free Download Manager
"TCP Query User{B1AB54E7-7D37-4FD0-8383-52BD77548E1A}c:\\program files\\messengerdiscovery\\messengerdiscovery live.exe"= UDP:c:\program files\messengerdiscovery\messengerdiscovery live.exe:MessengerDiscovery Live the Windows Live Messenger addon
"UDP Query User{1E0E2E08-BFF5-4B0B-B15A-7E1D9063FA99}c:\\program files\\messengerdiscovery\\messengerdiscovery live.exe"= TCP:c:\program files\messengerdiscovery\messengerdiscovery live.exe:MessengerDiscovery Live the Windows Live Messenger addon

R1 KLIM6;Kaspersky Anti-Virus NDIS 6 Filter;c:\windows\system32\DRIVERS\klim6.sys [2007-10-16 20496]
R3 rt61x86;802.11g Wireless Driver RT61;c:\windows\system32\DRIVERS\netr61.sys [2008-08-25 286208]
S2 AcronisOSSReinstallSvc;Acronis OS Selector Reinstall Service;"c:\program files\Common Files\Acronis\Partition Suite\oss_reinstall_svc.exe" []

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{7070D8E0-650A-46b3-B03C-9497582E6A74}]
%SystemRoot%\system32\soundschemes.exe /AddRegistration

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{B3688A53-AB2A-4b1d-8CEF-8F93D8C51C24}]
%SystemRoot%\system32\soundschemes2.exe /AddRegistration
.
- - - - ORPHELINS SUPPRIMES - - - -

ShellExecuteHooks-{FBFF3B36-BE67-4561-99A4-5477B0BFC5FA} - (no file)
MSConfigStartUp-0682fd9d - c:\users\Andy\AppData\Local\Temp\xhqstpie.dll
MSConfigStartUp-Adobe Photo Downloader - d:\programmes files\Adobe Photoshope lightroom\apdproxy.exe
MSConfigStartUp-BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA} - c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe
MSConfigStartUp-BM05b1ce01 - c:\users\Andy\AppData\Local\Temp\wpdgkrrd.dll
MSConfigStartUp-cmds - c:\users\Andy\AppData\Local\Temp\ssqOeBtU.dll
MSConfigStartUp-ItsTV - d:\programmes files\ItsTV\ItsTV.exe
MSConfigStartUp-iTunesHelper - d:\programmes files\iTunes\iTunesHelper.exe
MSConfigStartUp-MSServer - c:\users\Andy\AppData\Local\Temp\gEWQKASM.dll
MSConfigStartUp-NeroFilterCheck - c:\program files\Common Files\Ahead\Lib\NeroCheck.exe
MSConfigStartUp-zzz_ImInstaller_IncrediMail - c:\users\Andy\AppData\Local\Temp\ImInstaller\IncrediMail\incredimail_install.exe


.
------- Examen supplémentaire -------
.
uStart Page = hxxp://www.google.fr/
mWindow Title =
uInternet Settings,ProxyOverride = *.local
uInternet Settings,ProxyServer = andy.rateau@neuf.fr:80
IE: E&xporter vers Microsoft Excel - d:\progra~1\MICROS~1\Office12\EXCEL.EXE/3000
IE: Tout télécharger avec Free Download Manager - file://c:\program files\Free Download Manager\dlall.htm
IE: Télécharger avec Free Download Manager - file://c:\program files\Free Download Manager\dllink.htm
IE: Télécharger la sélection avec Free Download Manager - file://c:\program files\Free Download Manager\dlselected.htm
IE: Télécharger la vidéo avec Free Download Manager - file://c:\program files\Free Download Manager\dlfvideo.htm
IE: {{88CFA58B-A63F-4A94-9C54-0C7A58E3333E} - {17A84966-F1E9-4645-AA9E-5E771EE1C859} - c:\progra~1\NUCLEA~1\VideoGet\Plugins\VIDEOG~1.DLL

c:\windows\Downloaded Program Files\InstallerControl.dll - O16 -: CabBuilder
hxxp://kiw.imgag.com/imgag/kiw/toolbar/download/InstallerControl.cab
c:\windows\Downloaded Program Files\OSDC5.OSD
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-12-10 16:39:47
Windows 6.0.6001 Service Pack 1 NTFS

Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

Recherche de fichiers cachés ...

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************
.
------------------------ Autres processus actifs ------------------------
.
c:\windows\System32\nvvsvc.exe
c:\windows\System32\audiodg.exe
c:\windows\System32\rundll32.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
j:\programmes files\Nero\Nero8\Nero BackItUp\NBService.exe
c:\windows\System32\IoctlSvc.exe
c:\windows\System32\PnkBstrA.exe
c:\windows\System32\WUDFHost.exe
c:\windows\System32\conime.exe
c:\windows\System32\wbem\WMIADAP.exe
.
**************************************************************************
.
Heure de fin: 2008-12-10 16:43:21 - La machine a redémarré
ComboFix-quarantined-files.txt 2008-12-10 15:43:05

Avant-CF: 11 578 089 472 octets libres
Après-CF: 11,139,301,376 octets libres

356 --- E O F --- 2008-12-10 15:00:55