Virus msn + analyse Hijackthis

Bonjour bonjour,

Me voilà donc après avoir suivis les bon conseils de Geofrey (de Trooz :p)

Donc je m'explique, une amie a chopé un virus msn que je vais vous décrire & je me présente comme son "porte-parole" ( elle n'y connait au grand rien a l'informatique ) , par contre l'analyse Hijackthis est pour mon pc personnel ( rien avoir avec mon amie ) j'appréande d'avoir quelque saleté incrusté dans des coins.

Voici un copier-coller d'une partie de mon texte décrivant le virus msn sur Comment-ca-marche.

Il s'agit d'un virus msn au fonctionnement classique , tu recois un liens (ton_adresse.picfriendz.com , de mémoire), tu clique puis, peu après tu renvois ce liens a tes contacts (petite particularité il envois ces liens même sans que l'on soit connecté) .
Je lui ai donc fait télécharger SpyBot, Antivir & MsnFix (utilisé dans cet ordre), SpyBot a detecté un spyware avec messenger dans le nom ( pas plus de détail de la part de mon amie malheureusement ), mais elle ne pouvais pas le supprimer (corriger).. j'ai trouvé cela plutôt louche. Antivir n'a rien donné ( m'enfin elle a un antivirus maintenant, c'est déjà ca :p ) & MsnFix non plus (rien de detecté). J'ai pris de ces nouvelles aujourd'hui après que le week end soit passé.. Elle a toujours le virus. Que faire, que faire?

Et voici mon rapport d'Hijackthis ;

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:20:34, on 12/08/2008
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal
Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Windows\RtHDVCpl.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\Google\Google Updater\GoogleUpdater.exe
C:\Program Files\D-Link\D-Link RangeBooster N 650 DWA-547\wirelesscm.exe
C:\Program Files\Common Files\Logitech\KhalShared\KHALMNPR.EXE
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\Windows Media Player\wmplayer.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Windows\system32\conime.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://ecolevirtuelle.prov-liege.be/portal/page/portal/ECOV2/ENTREE
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
F2 - REG:system.ini: Shell=
F2 - REG:system.ini: UserInit=
O1 - Hosts: ::1 localhost
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.1119.1736\swg.dll
O2 - BHO: FDMIECookiesBHO Class - {CC59E0F9-7E43-44FA-9FAA-8377850BF205} - C:\Program Files\Free Download Manager\iefdm2.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [JMB36X IDE Setup] C:\Windows\RaidTool\xInsIDE.exe
O4 - HKLM\..\Run: [JMB36X Configure] C:\Windows\system32\JMRaidTool.exe boot
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
O4 - Global Startup: Outil de mise à jour Google.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe
O4 - Global Startup: Wireless Connection Manager.lnk = C:\Program Files\D-Link\D-Link RangeBooster N 650 DWA-547\wirelesscm.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~1\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Tout télécharger avec Free Download Manager - file://C:\Program Files\Free Download Manager\dlall.htm
O8 - Extra context menu item: Télécharger avec Free Download Manager - file://C:\Program Files\Free Download Manager\dllink.htm
O8 - Extra context menu item: Télécharger la sélection avec Free Download Manager - file://C:\Program Files\Free Download Manager\dlselected.htm
O8 - Extra context menu item: Télécharger la vidéo avec Free Download Manager - file://C:\Program Files\Free Download Manager\dlfvideo.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\JRE16~3.0_0\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\JRE16~3.0_0\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\Office12\REFIEBAR.DLL
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Programs\PartyGaming\PartyPoker\RunApp.exe (file missing)
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Programs\PartyGaming\PartyPoker\RunApp.exe (file missing)
O13 - Gopher Prefix:
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://appldnld.apple.com.edgesuite.net/content.info.apple.com/QuickTime/qtactivex/qtplugin.cab
O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} - http://fichiers.touslesdrivers.com/fichiers/hardwaredetection/hardwaredetection_3_0_0_32.cab
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~3\GOEC62~1.DLL
O23 - Service: Atheros Configuration Service (ACS) - Atheros - C:\Program Files\D-Link\D-Link RangeBooster N 650 DWA-547\acs.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Google Desktop Manager 5.7.802.22438 (GoogleDesktopManager-022208-143751) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe
O23 - Service: @%SystemRoot%\System32\TuneUpDefragService.exe,-1 (TuneUp.Defrag) - TuneUp Software GmbH - C:\Windows\System32\TuneUpDefragService.exe
--
End of file - 8862 bytes



Merci d'avance

En effet ton amis semble être infecter :

demande lui de suivre ces instructions:

Il faut imprimé ces instruction car tout devre etre fermé!!




Telcharge MBAM

http://www.commentcamarche.net/telecharger/telecharger-34055379-malwarebyte-s-anti-malware
1.1 met le a jour

1.2 fais une recherche COMPLETE

1.3 a la fin du scan click sur "afficher le resultat"

1.5 nettoit tout

1.6 poste le rapport sur ce forum.

Salut !!

Pour les virus msn, il est recommandé de suivre la procédure que j ai écrite à cette adresse :

http://forum-aide-contre-virus.be/virus%20msn.html

il faudra poster les rapports générés par les programmes pour les vérifier

Ok, je vais tout lire demain au taf puis agir en retrant (vers 15h). Donc Chefpunky ce que tu me conseil de faire c'est par rapport au log de Hijackthis ou bien a la description du virus ? Que je ne me trompe pas ^^

A demain merci

Hijackthis.
bonne soiré

Ola,

C'est con mais je ne parviens pas a reboot mon pc en mode sans échec avec Vista

Je presse bien f8, il m'ouvre le menu du Bios par contre. J'ai un peu regarder dans le menu du Bios mais de peur de toucher à quelque chose qu'il ne faut pas je préfère vous demander.

Voici déjà ( seulement ? :p ) mon analyse combofix, le reste arrive au plus vite que je peux ^^

=>

ComboFix 08-08-12.01 - Beni 2008-08-13 17:42:11.1 - NTFSx86
Microsoft® Windows Vista™ Professionnel 6.0.6001.1.1252.1.1036.18.1034 [GMT 2:00]
Endroit: C:\\\\Users\\\\Beni\\\\Desktop\\\\ComboFix.exe
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\\\\Windows\\\\hosts

.
((((((((((((((((((((((((((((( Fichiers créés 2008-07-13 to 2008-08-13 ))))))))))))))))))))))))))))))))))))
.

2008-08-13 16:23 . 2008-08-13 16:36 d-------- C:\\\\SDFix
2008-08-08 17:55 . 2008-08-08 17:55 268 --ah----- C:\\\\sqmdata00.sqm
2008-08-08 17:55 . 2008-08-08 17:55 244 --ah----- C:\\\\sqmnoopt00.sqm
2008-08-07 20:22 . 2008-08-07 20:22 d-------- C:\\\\Program Files\\\\Trend Micro
2008-08-07 20:04 . 2008-08-07 20:04 d-------- C:\\\\Users\\\\All Users\\\\Avira
2008-08-07 20:04 . 2008-08-07 20:04 d-------- C:\\\\ProgramData\\\\Avira
2008-08-07 20:04 . 2008-08-07 20:04 d-------- C:\\\\Program Files\\\\Avira
2008-08-07 19:33 . 2008-08-07 19:33 0 --ah----- C:\\\\Users\\\\Default.LOG2
2008-08-07 19:33 . 2008-08-07 19:33 0 --ah----- C:\\\\Users\\\\Default.LOG1
2008-08-07 19:33 . 2008-08-07 19:33 0 --ah----- C:\\\\ProgramData.LOG2
2008-08-07 19:33 . 2008-08-07 19:33 0 --ah----- C:\\\\ProgramData.LOG1
2008-08-02 09:57 . 2008-08-02 09:57 d-------- C:\\\\Program Files\\\\Sun
2008-08-01 23:31 . 2008-08-01 23:31 319 --a------ C:\\\\Windows\\\\game.ini
2008-08-01 23:08 . 2008-08-01 23:08 d-------- C:\\\\Program Files\\\\Activision
2008-08-01 21:22 . 2008-08-01 21:22 d-------- C:\\\\Windows\\\\5888428E699C4E71BF7194EE06B497DA.TMP
2008-07-25 14:51 . 2008-07-25 14:51 d-------- C:\\\\Users\\\\All Users\\\\Google
2008-07-25 14:28 . 2008-07-25 17:27 d-------- C:\\\\Users\\\\Beni\\\\AppData\\\\Roaming\\\\Apple Computer
2008-07-25 13:47 . 2008-06-26 03:45 12,240,896 --a------ C:\\\\Windows\\\\System32\\\\NlsLexicons0007.dll
2008-07-25 13:47 . 2008-06-26 03:45 2,644,480 --a------ C:\\\\Windows\\\\System32\\\\NlsLexicons0009.dll
2008-07-25 13:46 . 2008-06-26 05:29 801,280 --a------ C:\\\\Windows\\\\System32\\\\NaturalLanguage6.dll

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-08-13 14:38 --------- d-----w C:\\\\Users\\\\Beni\\\\AppData\\\\Roaming\\\\Free Download Manager
2008-08-13 14:12 --------- d-----w C:\\\\ProgramData\\\\Google Updater
2008-08-12 17:43 136,888 ----a-w C:\\\\Windows\\\\system32\\\\drivers\\\\PnkBstrK.sys
2008-08-12 17:42 111,928 ----a-w C:\\\\Windows\\\\System32\\\\PnkBstrB.exe
2008-08-12 12:57 --------- d-----w C:\\\\Program Files\\\\Spybot - Search & Destroy
2008-08-11 14:16 --------- d-----w C:\\\\ProgramData\\\\Spybot - Search & Destroy
2008-08-08 15:26 --------- d-----w C:\\\\Program Files\\\\Warcraft III
2008-08-02 14:42 --------- d--h--w C:\\\\Program Files\\\\InstallShield Installation Information
2008-08-02 07:57 --------- d-----w C:\\\\Program Files\\\\Java
2008-08-01 22:02 66,872 ----a-w C:\\\\Windows\\\\System32\\\\PnkBstrA.exe
2008-08-01 21:31 22,328 ----a-w C:\\\\Users\\\\Beni\\\\AppData\\\\Roaming\\\\PnkBstrK.sys
2008-08-01 21:02 --------- d-----w C:\\\\Users\\\\Beni\\\\AppData\\\\Roaming\\\\PokerAcademyPro2
2008-08-01 21:01 --------- d-----w C:\\\\ProgramData\\\\ma-config.com
2008-08-01 21:01 --------- d-----w C:\\\\Program Files\\\\ma-config.com
2008-08-01 21:00 --------- d-----w C:\\\\ProgramData\\\\Symantec
2008-08-01 21:00 --------- d-----w C:\\\\Program Files\\\\Common Files\\\\Symantec Shared
2008-08-01 20:44 --------- d-----w C:\\\\Program Files\\\\MagicISO
2008-08-01 18:58 --------- d-----w C:\\\\ProgramData\\\\Apple Computer
2008-07-25 12:51 --------- d-----w C:\\\\Program Files\\\\Google
2008-07-25 11:52 --------- d-----w C:\\\\ProgramData\\\\Microsoft Help
2008-07-25 11:43 --------- d-----w C:\\\\Program Files\\\\World of Warcraft
2008-07-09 12:32 --------- d-----w C:\\\\Program Files\\\\Windows Mail
2008-07-08 18:51 355,584 ----a-w C:\\\\Windows\\\\System32\\\\TuneUpDefragService.exe
2008-07-08 18:51 --------- d-----w C:\\\\Program Files\\\\TuneUp Utilities 2008
2008-06-22 20:11 0 ---ha-w C:\\\\Windows\\\\system32\\\\drivers\\\\Msft_User_WpdFs_01_00_00.Wdf
2008-06-20 15:55 --------- d-----w C:\\\\ProgramData\\\\NVIDIA
2008-06-20 15:45 174 --sha-w C:\\\\Program Files\\\\desktop.ini
2008-06-20 15:31 --------- d-----w C:\\\\Program Files\\\\Windows Sidebar
2008-06-20 15:31 --------- d-----w C:\\\\Program Files\\\\Windows Photo Gallery
2008-06-20 15:31 --------- d-----w C:\\\\Program Files\\\\Windows Journal
2008-06-20 15:31 --------- d-----w C:\\\\Program Files\\\\Windows Defender
2008-06-20 15:31 --------- d-----w C:\\\\Program Files\\\\Windows Collaboration
2008-06-20 15:31 --------- d-----w C:\\\\Program Files\\\\Windows Calendar
2008-06-20 15:12 82,432 ----a-w C:\\\\Windows\\\\System32\\\\axaltocm.dll
2008-06-20 15:12 101,888 ----a-w C:\\\\Windows\\\\System32\\\\ifxcardm.dll
2008-06-18 18:38 --------- d-----w C:\\\\ProgramData\\\\TrackMania
2008-06-18 17:34 --------- d-----w C:\\\\Program Files\\\\Western Digital Technologies
2008-06-15 17:22 --------- d-----w C:\\\\Program Files\\\\TmNationsForever
2008-05-29 07:28 28,416 ----a-w C:\\\\Windows\\\\System32\\\\uxtuneup.dll
2008-05-29 07:28 16,640 ----a-w C:\\\\Windows\\\\System32\\\\authuitu.dll
2008-05-27 19:17 1,700,352 ----a-w C:\\\\Windows\\\\System32\\\\gdiplus.dll
2008-01-24 17:37 32 ----a-w C:\\\\Users\\\\All Users\\\\ezsid.dat
2008-01-24 17:37 32 ----a-w C:\\\\ProgramData\\\\ezsid.dat
2007-10-14 14:08 2,154,496 ----a-w C:\\\\Users\\\\Beni\\\\AppData\\\\Roaming\\\\sa3125_02_fus_eng.exe
2006-06-22 23:48 32,768 ----a-r C:\\\\Windows\\\\inf\\\\UpdateUSB.exe
2007-11-12 16:50 16,384 --sha-w C:\\\\Windows\\\\ServiceProfiles\\\\LocalService\\\\AppData\\\\Local\\\\Microsoft\\\\Windows\\\\History\\\\History.IE5\\\\index.dat
2007-11-12 16:50 32,768 --sha-w C:\\\\Windows\\\\ServiceProfiles\\\\LocalService\\\\AppData\\\\Local\\\\Microsoft\\\\Windows\\\\Temporary Internet Files\\\\Content.IE5\\\\index.dat
2007-11-12 16:50 16,384 --sha-w C:\\\\Windows\\\\ServiceProfiles\\\\LocalService\\\\AppData\\\\Roaming\\\\Microsoft\\\\Windows\\\\Cookies\\\\index.dat
.

((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés

[HKEY_CURRENT_USER\\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run]
"MsnMsgr"="C:\\\\Program Files\\\\Windows Live\\\\Messenger\\\\MsnMsgr.Exe" [2007-10-18 11:34 5724184]
"swg"="C:\\\\Program Files\\\\Google\\\\GoogleToolbarNotifier\\\\GoogleToolbarNotifier.exe" [2008-01-05 15:46 68856]
"WMPNSCFG"="C:\\\\Program Files\\\\Windows Media Player\\\\WMPNSCFG.exe" [2008-01-19 09:33 202240]

[HKEY_LOCAL_MACHINE\\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run]
"SunJavaUpdateSched"="C:\\\\Program Files\\\\Java\\\\jre1.6.0_07\\\\bin\\\\jusched.exe" [2008-06-10 04:27 144784]
"JMB36X IDE Setup"="C:\\\\Windows\\\\RaidTool\\\\xInsIDE.exe" [2007-03-20 15:36 36864]
"JMB36X Configure"="C:\\\\Windows\\\\system32\\\\JMRaidTool.exe" [2006-08-14 04:51 352256]
"TkBellExe"="C:\\\\Program Files\\\\Common Files\\\\Real\\\\Update_OB\\\\realsched.exe" [2007-11-29 20:47 185896]
"Adobe Reader Speed Launcher"="C:\\\\Program Files\\\\Adobe\\\\Reader 8.0\\\\Reader\\\\Reader_sl.exe" [2008-01-11 23:16 39792]
"QuickTime Task"="C:\\\\Program Files\\\\QuickTime\\\\QTTask.exe" [2008-05-27 10:50 413696]
"NvSvc"="C:\\\\Windows\\\\system32\\\\nvsvc.dll" [2007-10-04 17:14 86016]
"NvCplDaemon"="C:\\\\Windows\\\\system32\\\\NvCpl.dll" [2007-10-04 17:14 8497696]
"NvMediaCenter"="C:\\\\Windows\\\\system32\\\\NvMcTray.dll" [2007-10-04 17:14 81920]
"Google Desktop Search"="C:\\\\Program Files\\\\Google\\\\Google Desktop Search\\\\GoogleDesktop.exe" [2008-07-25 14:51 29744]
"avgnt"="C:\\\\Program Files\\\\Avira\\\\AntiVir PersonalEdition Classic\\\\avgnt.exe" [2008-06-12 14:28 266497]
"RtHDVCpl"="RtHDVCpl.exe" [2006-10-23 09:48 3801088 C:\\\\Windows\\\\RtHDVCpl.exe]
"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2007-04-11 16:32 56080 C:\\\\Windows\\\\KHALMNPR.Exe]
"Logitech Hardware Abstraction Layer"="KHALMNPR.EXE" [2007-04-11 16:32 56080 C:\\\\Windows\\\\KHALMNPR.Exe]

C:\\\\\\\\ProgramData\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\Start Menu\\\\\\\\Programs\\\\\\\\Startup\\\\\\\\
Logitech
Desktop Messenger.lnk - C:\\\\\\\\Program Files\\\\\\\\Logitech\\\\\\\\Desktop
Messenger\\\\\\\\8876480\\\\\\\\Program\\\\\\\\LogitechDesktopMessenger.exe
[2008-02-15 16:35:20 67128]
Logitech SetPoint.lnk - C:\\\\\\\\Program Files\\\\\\\\Logitech\\\\\\\\SetPoint\\\\\\\\SetPoint.exe [2008-02-15 16:29:37 692224]
Outil
de mise … jour Google.lnk - C:\\\\\\\\Program Files\\\\\\\\Google\\\\\\\\Google
Updater\\\\\\\\GoogleUpdater.exe [2008-01-05 15:46:04 125624]
Wireless
Connection Manager.lnk - C:\\\\\\\\Program Files\\\\\\\\D-Link\\\\\\\\D-Link
RangeBooster N 650 DWA-547\\\\\\\\wirelesscm.exe [2007-11-17 13:05:50
11354112]

[HKEY_LOCAL_MACHINE\\\\\\\\software\\\\\\\\microsoft\\\\\\\\windows\\\\\\\\currentversion\\\\\\\\policies\\\\\\\\system]
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\\\\\\\\software\\\\\\\\microsoft\\\\\\\\windows nt\\\\\\\\currentversion\\\\\\\\windows]
"AppInit_DLLs"=C:\\\\\\\\PROGRA~1\\\\\\\\Google\\\\\\\\GOOGLE~3\\\\\\\\GOEC62~1.DLL

[HKEY_LOCAL_MACHINE\\\\\\\\software\\\\\\\\microsoft\\\\\\\\security center]
"UacDisableNotify"=dword:00000001
"InternetSettingsDisableNotify"=dword:00000001
"AutoUpdateDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\\\\\\\\software\\\\\\\\microsoft\\\\\\\\security center\\\\\\\\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\\\\\\\\software\\\\\\\\microsoft\\\\\\\\security center\\\\\\\\Monitoring\\\\\\\\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\\\\\\\\software\\\\\\\\microsoft\\\\\\\\security center\\\\\\\\Monitoring\\\\\\\\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\\\\\\\\~\\\\\\\\services\\\\\\\\sharedaccess\\\\\\\\parameters\\\\\\\\firewallpolicy\\\\\\\\FirewallRules]
"{3A228CB9-6248-4AC8-B701-EBD16748C04D}"= UDP:C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\PnkBstrA.exe:PnkBstrA
"{E0DCFBBC-E49F-4CE9-BB80-77815DA5704D}"= TCP:C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\PnkBstrA.exe:PnkBstrA
"{518AA376-9808-4642-904D-6C20230C736F}"= UDP:C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\PnkBstrB.exe:PnkBstrB
"{FD7208DA-4098-4254-8EF5-05C563169D04}"= TCP:C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\PnkBstrB.exe:PnkBstrB
"{6D4458CE-B8D9-4340-BBB1-5CA1E28BAB33}"=
UDP:C:\\\\\\\\Program Files\\\\\\\\id Software\\\\\\\\Enemy Territory - QUAKE
Wars\\\\\\\\etqwded.exe:etqwded.exe
"{C26B0C9F-BD46-449E-8D1E-0B63F84EA086}"=
TCP:C:\\\\\\\\Program Files\\\\\\\\id Software\\\\\\\\Enemy Territory - QUAKE
Wars\\\\\\\\etqwded.exe:etqwded.exe
"{27B09905-1903-4364-96D1-E34F8654A4B9}"=
UDP:C:\\\\\\\\Program Files\\\\\\\\id Software\\\\\\\\Enemy Territory - QUAKE
Wars\\\\\\\\etqw.exe:Enemy Territory - QUAKE Wars(TM)
"{F3703CC9-14B7-4319-AD92-F6EA4D49CDD6}"=
TCP:C:\\\\\\\\Program Files\\\\\\\\id Software\\\\\\\\Enemy Territory - QUAKE
Wars\\\\\\\\etqw.exe:Enemy Territory - QUAKE Wars(TM)
"{996FEB36-B89F-4B83-AB16-CC268EEC796E}"= UDP:C:\\\\\\\\Program Files\\\\\\\\World of Warcraft\\\\\\\\Launcher.exe:World of Warcraft
"{F38454BC-A387-4387-9C0D-6527C7AD2D6E}"= TCP:C:\\\\\\\\Program Files\\\\\\\\World of Warcraft\\\\\\\\Launcher.exe:World of Warcraft
"{B0348B6B-507F-4246-9BB7-59FA777DDFC4}"=
UDP:C:\\\\\\\\Program Files\\\\\\\\World of
Warcraft\\\\\\\\BackgroundDownloader.exe:BackgroundDownloader
"{3E906D72-E1EA-40C5-8ADE-E9AF3FFD089F}"=
TCP:C:\\\\\\\\Program Files\\\\\\\\World of
Warcraft\\\\\\\\BackgroundDownloader.exe:BackgroundDownloader
"{A41B0368-39F5-40E4-AF34-32F7459442E5}"= UDP:C:\\\\\\\\Program Files\\\\\\\\uTorrent\\\\\\\\uTorrent.exe:µTorrent
"{7BC721BD-6D8B-471D-ACCD-9B88E8B51B67}"= TCP:C:\\\\\\\\Program Files\\\\\\\\uTorrent\\\\\\\\uTorrent.exe:µTorrent
"{CF187D3B-D7FA-4F80-B54D-BEB0AA72770A}"=
TCP:6004|C:\\\\\\\\Program Files\\\\\\\\Microsoft
Office\\\\\\\\Office12\\\\\\\\outlook.exe:Microsoft Office Outlook
"{687D1889-1DD9-4827-A59E-87C36976583C}"= UDP:C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\PnkBstrA.exe:PnkBstrA
"{82533C90-0A16-4788-8B8C-EBD5AF599FC8}"= TCP:C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\PnkBstrA.exe:PnkBstrA
"{4A25D06A-C620-45DC-87EF-4D1150EC0F96}"= UDP:C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\PnkBstrB.exe:PnkBstrB
"{167BD1AD-6BD7-44AE-A62C-9240209E975D}"= TCP:C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\PnkBstrB.exe:PnkBstrB
"{14C2DFA0-D278-4965-80DA-CC7EAC665370}"=
UDP:C:\\\\\\\\Program Files\\\\\\\\Logitech\\\\\\\\Desktop
Messenger\\\\\\\\8876480\\\\\\\\Program\\\\\\\\LogitechDesktopMessenger.exe:Logitech
Desktop Messenger
"{7C488747-5ED1-4670-A331-85D5339B310C}"=
TCP:C:\\\\\\\\Program Files\\\\\\\\Logitech\\\\\\\\Desktop
Messenger\\\\\\\\8876480\\\\\\\\Program\\\\\\\\LogitechDesktopMessenger.exe:Logitech
Desktop Messenger
"{96358B7A-6B83-41ED-A829-02B9074CC6E6}"=
UDP:C:\\\\\\\\Program Files\\\\\\\\Logitech\\\\\\\\Desktop
Messenger\\\\\\\\8876480\\\\\\\\Program\\\\\\\\LogitechDesktopMessenger.exe:Logitech
Desktop Messenger
"{DA448EA0-5308-41F7-9D8C-EA93F0FF8B53}"=
TCP:C:\\\\\\\\Program Files\\\\\\\\Logitech\\\\\\\\Desktop
Messenger\\\\\\\\8876480\\\\\\\\Program\\\\\\\\LogitechDesktopMessenger.exe:Logitech
Desktop Messenger
"{D4800320-692C-4BEC-8A0C-DD9B3062F3B6}"=
UDP:C:\\\\\\\\Program Files\\\\\\\\Activision\\\\\\\\Call of Duty 4 - Modern
Warfare\\\\\\\\iw3mp.exe:Call of Duty(R) 4 - Modern Warfare(TM)
"{6850FAFA-8FE6-4162-B2DE-8BAB8627ED06}"=
TCP:C:\\\\\\\\Program Files\\\\\\\\Activision\\\\\\\\Call of Duty 4 - Modern
Warfare\\\\\\\\iw3mp.exe:Call of Duty(R) 4 - Modern Warfare(TM)
"TCP
Query User{B03A8CDB-F8D9-4927-B7E5-7D9EB44D2BAA}C:\\\\\\\\\\\\\\\\program
files\\\\\\\\\\\\\\\\logitech\\\\\\\\\\\\\\\\desktop
messenger\\\\\\\\\\\\\\\\8876480\\\\\\\\\\\\\\\\program\\\\\\\\\\\\\\\\logitechdesktopmessenger.exe"=
UDP:C:\\\\\\\\program files\\\\\\\\logitech\\\\\\\\desktop
messenger\\\\\\\\8876480\\\\\\\\program\\\\\\\\logitechdesktopmessenger.exe:Logitech
Desktop Messenger
"UDP Query
User{90BCF0BC-06F8-42A3-85FC-38BCCA2D1F74}C:\\\\\\\\\\\\\\\\program
files\\\\\\\\\\\\\\\\logitech\\\\\\\\\\\\\\\\desktop
messenger\\\\\\\\\\\\\\\\8876480\\\\\\\\\\\\\\\\program\\\\\\\\\\\\\\\\logitechdesktopmessenger.exe"=
TCP:C:\\\\\\\\program files\\\\\\\\logitech\\\\\\\\desktop
messenger\\\\\\\\8876480\\\\\\\\program\\\\\\\\logitechdesktopmessenger.exe:Logitech
Desktop Messenger
"TCP Query
User{7564B542-15AC-4A22-AF43-9FA741DF7589}C:\\\\\\\\\\\\\\\\program
files\\\\\\\\\\\\\\\\internet explorer\\\\\\\\\\\\\\\\iexplore.exe"= UDP:C:\\\\\\\\program
files\\\\\\\\internet explorer\\\\\\\\iexplore.exe:Internet Explorer
"UDP
Query User{80869146-0BE5-483C-9D50-0C1D158BB458}C:\\\\\\\\\\\\\\\\program
files\\\\\\\\\\\\\\\\internet explorer\\\\\\\\\\\\\\\\iexplore.exe"= TCP:C:\\\\\\\\program
files\\\\\\\\internet explorer\\\\\\\\iexplore.exe:Internet Explorer
"{8997908F-6BD4-4B6E-B56C-CC9C19099E5C}"=
C:\\\\\\\\Program Files\\\\\\\\Windows
Live\\\\\\\\Messenger\\\\\\\\livecall.exe:Windows Live Messenger (Phone)
"{8DAEF14A-8DE9-4AB4-83A0-ADAF9ADA30B1}"=
C:\\\\\\\\Program Files\\\\\\\\Electronic Arts\\\\\\\\Command & Conquer(tm) 3
La Fureur de Kane\\\\\\\\RetailExe\\\\\\\\1.0\\\\\\\\cnc3ep1.dat:Command &
Conquer(tm) 3 : La Fureur de Kane
"TCP Query
User{B86B63D3-51E5-4479-9876-DF5F3D98BCAA}C:\\\\\\\\\\\\\\\\program
files\\\\\\\\\\\\\\\\real\\\\\\\\\\\\\\\\realplayer\\\\\\\\\\\\\\\\recordingmanager.exe"=
UDP:C:\\\\\\\\program
files\\\\\\\\real\\\\\\\\realplayer\\\\\\\\recordingmanager.exe:RealNetworks
Download and Record Manager
"UDP Query
User{0AD36307-27D7-43E4-897A-01CBA307ECF2}C:\\\\\\\\\\\\\\\\program
files\\\\\\\\\\\\\\\\real\\\\\\\\\\\\\\\\realplayer\\\\\\\\\\\\\\\\recordingmanager.exe"=
TCP:C:\\\\\\\\program
files\\\\\\\\real\\\\\\\\realplayer\\\\\\\\recordingmanager.exe:RealNetworks
Download and Record Manager
"TCP Query
User{CB09A2D2-147F-4686-9F4E-28ABAA1CF165}H:\\\\\\\\\\\\\\\\zhao for guly
cod2\\\\\\\\\\\\\\\\call of duty 2\\\\\\\\\\\\\\\\cod2mp_s.exe"= UDP:H:\\\\\\\\zhao for
guly cod2\\\\\\\\call of duty 2\\\\\\\\cod2mp_s.exe:CoD2MP_s
"UDP Query
User{CC8522AD-B5E7-4DE9-A5AA-4878BE5B63B6}H:\\\\\\\\\\\\\\\\zhao for guly
cod2\\\\\\\\\\\\\\\\call of duty 2\\\\\\\\\\\\\\\\cod2mp_s.exe"= TCP:H:\\\\\\\\zhao for
guly cod2\\\\\\\\call of duty 2\\\\\\\\cod2mp_s.exe:CoD2MP_s
"TCP Query
User{8FAAAD31-D806-4501-8E66-DB129CB7D832}C:\\\\\\\\\\\\\\\\program
files\\\\\\\\\\\\\\\\tmnationsforever\\\\\\\\\\\\\\\\tmforever.exe"= UDP:C:\\\\\\\\program
files\\\\\\\\tmnationsforever\\\\\\\\tmforever.exe:TmForever
"UDP Query
User{AA9A0B9E-430A-464F-84DD-E2B68FD6BC33}C:\\\\\\\\\\\\\\\\program
files\\\\\\\\\\\\\\\\tmnationsforever\\\\\\\\\\\\\\\\tmforever.exe"= TCP:C:\\\\\\\\program
files\\\\\\\\tmnationsforever\\\\\\\\tmforever.exe:TmForever
"TCP Query
User{CC43D334-048E-445B-B08D-41375586E8FB}H:\\\\\\\\\\\\\\\\team fortress
2\\\\\\\\\\\\\\\\hl2.exe"= UDP:H:\\\\\\\\team fortress 2\\\\\\\\hl2.exe:hl2
"UDP
Query User{62842662-E209-4D5F-AC89-133B377C3779}H:\\\\\\\\\\\\\\\\team fortress
2\\\\\\\\\\\\\\\\hl2.exe"= TCP:H:\\\\\\\\team fortress 2\\\\\\\\hl2.exe:hl2
"TCP
Query
User{128DB4C8-0F3A-4405-9471-43D505104266}C:\\\\\\\\\\\\\\\\users\\\\\\\\\\\\\\\\beni\\\\\\\\\\\\\\\\desktop\\\\\\\\\\\\\\\\team
fortress 2\\\\\\\\\\\\\\\\hl2.exe"= UDP:C:\\\\\\\\users\\\\\\\\beni\\\\\\\\desktop\\\\\\\\team
fortress 2\\\\\\\\hl2.exe:hl2.exe
"UDP Query
User{636B0BBA-590F-48B2-9CFA-E111344FDD0D}C:\\\\\\\\\\\\\\\\users\\\\\\\\\\\\\\\\beni\\\\\\\\\\\\\\\\desktop\\\\\\\\\\\\\\\\team
fortress 2\\\\\\\\\\\\\\\\hl2.exe"= TCP:C:\\\\\\\\users\\\\\\\\beni\\\\\\\\desktop\\\\\\\\team
fortress 2\\\\\\\\hl2.exe:hl2.exe
"TCP Query
User{D4D03B05-EF45-4227-B24B-2DE75DD6188F}C:\\\\\\\\\\\\\\\\users\\\\\\\\\\\\\\\\beni\\\\\\\\\\\\\\\\desktop\\\\\\\\\\\\\\\\wow-2.4.1.8125-to-0.4.2.8209-frfr-downloader.exe"=
UDP:C:\\\\\\\\users\\\\\\\\beni\\\\\\\\desktop\\\\\\\\wow-2.4.1.8125-to-0.4.2.8209-frfr-downloader.exe:wow-2.4.1.8125-to-0.4.2.8209-frfr-downloader.exe
"UDP
Query
User{15CB02D1-EA54-4658-ACE8-17ADF1C6F094}C:\\\\\\\\\\\\\\\\users\\\\\\\\\\\\\\\\beni\\\\\\\\\\\\\\\\desktop\\\\\\\\\\\\\\\\wow-2.4.1.8125-to-0.4.2.8209-frfr-downloader.exe"=
TCP:C:\\\\\\\\users\\\\\\\\beni\\\\\\\\desktop\\\\\\\\wow-2.4.1.8125-to-0.4.2.8209-frfr-downloader.exe:wow-2.4.1.8125-to-0.4.2.8209-frfr-downloader.exe
"TCP
Query User{55173FDD-9DB2-4F32-92C1-F0964391D591}C:\\\\\\\\\\\\\\\\program
files\\\\\\\\\\\\\\\\bitcomet\\\\\\\\\\\\\\\\bitcomet.exe"= UDP:C:\\\\\\\\program
files\\\\\\\\bitcomet\\\\\\\\bitcomet.exe:BitComet - a BitTorrent Client
"UDP
Query User{995F0984-ED6E-4FC7-ADD5-1B201686C355}C:\\\\\\\\\\\\\\\\program
files\\\\\\\\\\\\\\\\bitcomet\\\\\\\\\\\\\\\\bitcomet.exe"= TCP:C:\\\\\\\\program
files\\\\\\\\bitcomet\\\\\\\\bitcomet.exe:BitComet - a BitTorrent Client
"TCP
Query User{74AC6C3A-5BE3-4B73-AF65-6961619A83AF}C:\\\\\\\\\\\\\\\\program
files\\\\\\\\\\\\\\\\free download manager\\\\\\\\\\\\\\\\fdm.exe"= UDP:C:\\\\\\\\program
files\\\\\\\\free download manager\\\\\\\\fdm.exe:Free Download Manager
"UDP
Query User{2CCFBB8C-0D4B-4648-A3FB-0B1C3641B038}C:\\\\\\\\\\\\\\\\program
files\\\\\\\\\\\\\\\\free download manager\\\\\\\\\\\\\\\\fdm.exe"= TCP:C:\\\\\\\\program
files\\\\\\\\free download manager\\\\\\\\fdm.exe:Free Download Manager
"TCP
Query User{7E56BCAF-7594-4DD0-81C1-457456E6D7D2}C:\\\\\\\\\\\\\\\\program
files\\\\\\\\\\\\\\\\bitcomet\\\\\\\\\\\\\\\\bitcomet.exe"= UDP:C:\\\\\\\\program
files\\\\\\\\bitcomet\\\\\\\\bitcomet.exe:BitComet - a BitTorrent Client

"UDP
Query User{8E4A683B-DFFC-4F4E-906E-5BB1AEC14BBD}C:\\\\\\\\\\\\\\\\program
files\\\\\\\\\\\\\\\\bitcomet\\\\\\\\\\\\\\\\bitcomet.exe"= TCP:C:\\\\\\\\program
files\\\\\\\\bitcomet\\\\\\\\bitcomet.exe:BitComet - a BitTorrent Client
"{1BCF0497-FCCA-4C4B-B41B-3AFCC6C125C9}"= UDP:48113:LocalSubnet:LocalSubnet:maconfig_tcp
"{DA505BC8-68E8-4425-877F-B68209DE121E}"= TCP:48113:LocalSubnet:LocalSubnet:maconfig_udp
"{39FEE998-E139-4907-AA54-C4A897FC1418}"=
UDP:C:\\\\\\\\Program
Files\\\\\\\\ma-config.com\\\\\\\\maconfservice.exe:maconfservice
"{59B500F8-DD54-4B02-9647-892622187593}"=
TCP:C:\\\\\\\\Program
Files\\\\\\\\ma-config.com\\\\\\\\maconfservice.exe:maconfservice
"TCP
Query User{20C31E05-9A10-4C2E-86A2-3EAA288623A9}C:\\\\\\\\\\\\\\\\program
files\\\\\\\\\\\\\\\\counter-strike source lan edition\\\\\\\\\\\\\\\\hl2.exe"=
UDP:C:\\\\\\\\program files\\\\\\\\counter-strike source lan
edition\\\\\\\\hl2.exe:hl2
"UDP Query
User{32986A3A-9ADD-4462-B189-7EB7DACD6B1C}C:\\\\\\\\\\\\\\\\program
files\\\\\\\\\\\\\\\\counter-strike source lan edition\\\\\\\\\\\\\\\\hl2.exe"=
TCP:C:\\\\\\\\program files\\\\\\\\counter-strike source lan
edition\\\\\\\\hl2.exe:hl2
"TCP Query
User{5C7F27F4-6104-4A1A-AC4D-57C43505F87E}C:\\\\\\\\\\\\\\\\program
files\\\\\\\\\\\\\\\\tmnationsforever\\\\\\\\\\\\\\\\tmforever.exe"= UDP:C:\\\\\\\\program
files\\\\\\\\tmnationsforever\\\\\\\\tmforever.exe:TmForever
"UDP Query
User{131D74A7-1686-40A7-8CED-5F1BD696F510}C:\\\\\\\\\\\\\\\\program
files\\\\\\\\\\\\\\\\tmnationsforever\\\\\\\\\\\\\\\\tmforever.exe"= TCP:C:\\\\\\\\program
files\\\\\\\\tmnationsforever\\\\\\\\tmforever.exe:TmForever
"TCP Query
User{5D4130AE-6C39-417E-A1A6-0CC6A8C46089}C:\\\\\\\\\\\\\\\\users\\\\\\\\\\\\\\\\beni\\\\\\\\\\\\\\\\desktop\\\\\\\\\\\\\\\\useless\\\\\\\\\\\\\\\\team
fortress 2\\\\\\\\\\\\\\\\hl2.exe"=
UDP:C:\\\\\\\\users\\\\\\\\beni\\\\\\\\desktop\\\\\\\\useless\\\\\\\\team fortress
2\\\\\\\\hl2.exe:hl2.exe
"UDP Query
User{3E104799-0596-4FAA-908A-3A13738BFE44}C:\\\\\\\\\\\\\\\\users\\\\\\\\\\\\\\\\beni\\\\\\\\\\\\\\\\desktop\\\\\\\\\\\\\\\\useless\\\\\\\\\\\\\\\\team
fortress 2\\\\\\\\\\\\\\\\hl2.exe"=
TCP:C:\\\\\\\\users\\\\\\\\beni\\\\\\\\desktop\\\\\\\\useless\\\\\\\\team fortress
2\\\\\\\\hl2.exe:hl2.exe
"TCP Query
User{D1BAD247-5A9D-4C69-A150-D6ACC918BEEC}C:\\\\\\\\\\\\\\\\users\\\\\\\\\\\\\\\\beni\\\\\\\\\\\\\\\\desktop\\\\\\\\\\\\\\\\team
fortress 2\\\\\\\\\\\\\\\\hl2.exe"= UDP:C:\\\\\\\\users\\\\\\\\beni\\\\\\\\desktop\\\\\\\\team
fortress 2\\\\\\\\hl2.exe:hl2.exe
"UDP Query
User{3A3FB755-A5E7-4EF5-9A84-3FACA4B08364}C:\\\\\\\\\\\\\\\\users\\\\\\\\\\\\\\\\beni\\\\\\\\\\\\\\\\desktop\\\\\\\\\\\\\\\\team
fortress 2\\\\\\\\\\\\\\\\hl2.exe"= TCP:C:\\\\\\\\users\\\\\\\\beni\\\\\\\\desktop\\\\\\\\team
fortress 2\\\\\\\\hl2.exe:hl2.exe
"{F0F4432D-9F64-443B-859D-09FCD30E4EE0}"=
C:\\\\\\\\Program Files\\\\\\\\Windows
Live\\\\\\\\Messenger\\\\\\\\livecall.exe:Windows Live Messenger (Phone)
"{039F97CD-A5F0-4B2A-BD43-81ABF1D8F544}"=
C:\\\\\\\\Program Files\\\\\\\\Electronic Arts\\\\\\\\Command & Conquer
3\\\\\\\\RetailExe\\\\\\\\1.9\\\\\\\\cnc3game.dat:Command & Conquer 3 Les
guerres du Tiberium™
"TCP Query
User{F34E7256-FE86-4B6D-9A2E-8981D18E9B8E}C:\\\\\\\\\\\\\\\\users\\\\\\\\\\\\\\\\beni\\\\\\\\\\\\\\\\desktop\\\\\\\\\\\\\\\\useless\\\\\\\\\\\\\\\\team
fortress 2\\\\\\\\\\\\\\\\hl2.exe"=
UDP:C:\\\\\\\\users\\\\\\\\beni\\\\\\\\desktop\\\\\\\\useless\\\\\\\\team fortress
2\\\\\\\\hl2.exe:hl2.exe
"UDP Query
User{5FF3E388-AD24-4607-B4E9-D508CE260B20}C:\\\\\\\\\\\\\\\\users\\\\\\\\\\\\\\\\beni\\\\\\\\\\\\\\\\desktop\\\\\\\\\\\\\\\\useless\\\\\\\\\\\\\\\\team
fortress 2\\\\\\\\\\\\\\\\hl2.exe"=
TCP:C:\\\\\\\\users\\\\\\\\beni\\\\\\\\desktop\\\\\\\\useless\\\\\\\\team fortress
2\\\\\\\\hl2.exe:hl2.exe
"{27E199ED-64CB-4C43-AEDF-5076EF2A99BF}"=
UDP:C:\\\\\\\\Program Files\\\\\\\\Activision\\\\\\\\Call of Duty 4 - Modern
Warfare\\\\\\\\iw3mp.exe:Call of Duty(R) 4 - Modern Warfare(TM)
"{D608B4D1-A7ED-40E0-8D50-BF035370A3F8}"=
TCP:C:\\\\\\\\Program Files\\\\\\\\Activision\\\\\\\\Call of Duty 4 - Modern
Warfare\\\\\\\\iw3mp.exe:Call of Duty(R) 4 - Modern Warfare(TM)
"TCP
Query User{C76020CA-F287-4FC2-AC26-BE8B123D4640}C:\\\\\\\\\\\\\\\\program
files\\\\\\\\\\\\\\\\electronic arts\\\\\\\\\\\\\\\\command & conquer(tm) 3 la
fureur de kane\\\\\\\\\\\\\\\\retailexe\\\\\\\\\\\\\\\\1.0\\\\\\\\\\\\\\\\cnc3ep1.dat"=
UDP:C:\\\\\\\\program files\\\\\\\\electronic arts\\\\\\\\command & conquer(tm)
3 la fureur de kane\\\\\\\\retailexe\\\\\\\\1.0\\\\\\\\cnc3ep1.dat:Command and
Conquer™ 3 Kane's Wrath
"UDP Query
User{194939F6-E7F3-42AE-93A9-F9A6B97DF009}C:\\\\\\\\\\\\\\\\program
files\\\\\\\\\\\\\\\\electronic arts\\\\\\\\\\\\\\\\command & conquer(tm) 3 la
fureur de kane\\\\\\\\\\\\\\\\retailexe\\\\\\\\\\\\\\\\1.0\\\\\\\\\\\\\\\\cnc3ep1.dat"=
TCP:C:\\\\\\\\program files\\\\\\\\electronic arts\\\\\\\\command & conquer(tm)
3 la fureur de kane\\\\\\\\retailexe\\\\\\\\1.0\\\\\\\\cnc3ep1.dat:Command and
Conquer™ 3 Kane's Wrath
"TCP Query
User{AB314A23-97E7-43AF-9BA8-1EB0838180FD}C:\\\\\\\\\\\\\\\\program
files\\\\\\\\\\\\\\\\warcraft iii\\\\\\\\\\\\\\\\war3.exe"= UDP:C:\\\\\\\\program
files\\\\\\\\warcraft iii\\\\\\\\war3.exe:Warcraft III
"UDP Query
User{7D54C2A2-2F8A-423E-8207-B5076D588E5E}C:\\\\\\\\\\\\\\\\program
files\\\\\\\\\\\\\\\\warcraft iii\\\\\\\\\\\\\\\\war3.exe"= TCP:C:\\\\\\\\program
files\\\\\\\\warcraft iii\\\\\\\\war3.exe:Warcraft III

R2 UxTuneUp;TuneUp Extension de thème;C:\\\\Windows\\\\System32\\\\svchost.exe [2008-01-19 09:33]
R3
AtcL001;NDIS Miniport Driver for Attansic L1 Gigabit Ethernet
Adapter;C:\\\\Windows\\\\system32\\\\DRIVERS\\\\atl01_xp.sys [2006-08-22 07:36]
S3 Alpham1;Ideazon ZBoard USB Human Interface Device;C:\\\\Windows\\\\system32\\\\DRIVERS\\\\Alpham1.sys [2007-07-23 08:56]
S3 Alpham2;Ideazon ZBoard MM USB Human Interface Device;C:\\\\Windows\\\\system32\\\\DRIVERS\\\\Alpham2.sys [2007-03-20 12:49]
S3
GoogleDesktopManager-022208-143751;Google Desktop Manager
5.7.802.22438;C:\\\\Program Files\\\\Google\\\\Google Desktop
Search\\\\GoogleDesktop.exe [2008-07-25 14:51]
S3 TuneUp.Defrag;TuneUp Drive Defrag Service;C:\\\\Windows\\\\System32\\\\TuneUpDefragService.exe [2008-07-08 20:51]
S3 WSIMD;wsimd Service;C:\\\\Windows\\\\system32\\\\DRIVERS\\\\wsimd.sys [2006-05-26 09:29]

[HKEY_LOCAL_MACHINE\\\\software\\\\microsoft\\\\windows nt\\\\currentversion\\\\svchost]
LocalServiceNoNetwork REG_MULTI_SZ PLA DPS BFE mpssvc

HKEY_LOCAL_MACHINE\\\\SOFTWARE\\\\Microsoft\\\\Windows NT\\\\CurrentVersion\\\\Svchost - NetSvcs
UxTuneUp

[HKEY_CURRENT_USER\\\\software\\\\microsoft\\\\windows\\\\currentversion\\\\explorer\\\\mountpoints2\\\\{2ad25b6c-1924-11dd-812e-001a926f427e}]
\\\\shell\\\\AutoRun\\\\command - 6qe.com
\\\\shell\\\\explore\\\\Command - 6qe.com
\\\\shell\\\\open\\\\Command - 6qe.com

[HKEY_CURRENT_USER\\\\software\\\\microsoft\\\\windows\\\\currentversion\\\\explorer\\\\mountpoints2\\\\{4bec6a3c-d6ee-11dc-8b97-001a926f427e}]
\\\\shell\\\\AutoRun\\\\command - I:\\\\LaunchU3.exe -a

[HKEY_CURRENT_USER\\\\software\\\\microsoft\\\\windows\\\\currentversion\\\\explorer\\\\mountpoints2\\\\{b596dc77-3d59-11dd-a19f-001a926f427e}]
\\\\shell\\\\AutoRun\\\\command - H:\\\\wd_windows_tools\\\\setup.exe

*Newly Created Service* - CATCHME
*Newly Created Service* - PROCEXP90
.
Contenu du dossier 'Scheduled Tasks/Tâches planifiées'

2008-08-08 C:\\\\Windows\\\\Tasks\\\\Maintenance en 1 clic.job
- C:\\\\Program Files\\\\TuneUp Utilities 2008\\\\OneClick.exe [2008-06-20 09:23]

2008-08-13 C:\\\\Windows\\\\Tasks\\\\User_Feed_Synchronization-{8EEB2E74-50C9-4455-8B9F-3ADFC0D42260}.job
- C:\\\\Windows\\\\system32\\\\msfeedssync.exe [2008-01-19 09:33]
.
.
------- Supplementary Scan -------
.
FireFox -: Profile - C:\\\\Users\\\\Beni\\\\AppData\\\\Roaming\\\\Mozilla\\\\Firefox\\\\Profiles\\\\w9ptuazc.default\\\\
FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://www.google.be/


**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-08-13 17:46:55
Windows 6.0.6001 Service Pack 1 NTFS

Balayage processus cachés ...

Balayage caché autostart entries ...

Balayage des fichiers cachés ...

Scan terminé avec succès
Les fichiers cachés: 0

**************************************************************************
.
Temps d'accomplissement: 2008-08-13 17:48:06
ComboFix-quarantined-files.txt 2008-08-13 15:48:03

Pre-Run: 2,006,581,248 octets libres
Post-Run: 1,856,671,744 octets libres

246 --- E O F --- 2008-08-08 10:34:59

Désolé pour les 3 placradages c'étais trop long pour entrer dans un seul message.. Si vous avez un moyen plus pratique de vous communiquer mes résultats je suis preneur ^^

L'analyse Malware n'a rien trouver ( je ne poste donc pas le rapport comme préciser sur le liens de geoffrey )

Salut !!

Continue la procédure pour les virus msn, je vais m occuper du probleme...Je vais augmenter la taille pour les message..

J attends tes rapports..

ok benito

Bonjour bonjour

Voici le rapport d'analyse d'MsnFix qui m'a marquer : infection absente.

MSNFix 1.742

C:\Users\Beni\Desktop\MSNFix\MSNFix
Fix exécuté le ven. 15/08/2008 - 13:01:52,38 By Beni
mode normal

************************ Recherche les fichiers présents

Aucun Fichier trouvé

************************ Recherche les dossiers présents

Aucun dossier trouvé




************************ Hostsclean

Cleanhosts v 0.1.0.7 By Laurent

-- Backup : C:\Windows\system32\drivers\etc\hosts-20080815133659
-- original size 0.74 Kb / 20 lines
-- Start cleaning Hosts file ....



-- final size 0.74 Kb / 20 lines
-- entry Found : 0 / Entry check : 310

End .............................. 6.63 Secondes



************************ Fichiers suspects

/!\ ces fichiers nécessitent un avis expérimenté avant toute intervention

[C:\Windows\system32\secinit.exe] 32956A36844093FB99EAE0AEC66916FB

==> SVP merci d'envoyer le fichier C:\Users\Beni\Desktop\Upload_Me.zip sur http://upload.changelog.fr



************************ HKLM\...\Winlogon\Userinit

Userinit = C:\Windows\system32\userinit.exe,

------------------------------------------------------------------------
Auteur : !aur3n7 Contact: http://changelog.fr
------------------------------------------------------------------------

--------------------------------------------- END ---------------------------------------------



Pour ma question a propos du redémarage en mode sans échec sous vista, comment fait-on ? ^^ ( Pour SDFix en fait )

Salut benito !!

pour redémarrer en mode sans échec : au démarrage de ton pc, tu dois tapoter la touche F8 jusquà l apparition du menu des options avancées, et ensuite tu sélectionnes à l aide des flèches de ton clavier "mode sans échec" qui est normalement le premier de la liste tout au dessus..

Salut,

Ben c'est exactement ce que j'ai fait (j'ai suivis les instruction sur la page que tu m'avais link) mais ca m'ouvre le menu du Bios & je n'ai pas la fenetre toute simple ou y a le mode sans echec . Avec mon ancien pc j'y arrivais mais avec celui ci bo.. je sais pas si c'est du au fait que j'etais sous xp et maintenant sous vista ou rien avoir.. ?

Salut !!

Tu commence peut etre à tapoter la touche F8 trop tot...

Tu dois normalement commencer apres la premiere image avec la marque de ton pc..

Si tu n y arrives toujours pas, il y a un autre moyen d y accéder par msconfig...voici un lien qui t expliquera tout pour y arriver :

http://membres.multimania.fr/realbeaulieu/echec.html

J'ai enfin réussi a le lancer en mode sans échec ( pas la méthode du f8, j'y arrive toujours pas :s m'enfin soit ^^ )

Par contre SDFix ne se lance pas, je voit la fenetre "DOS" apparaitre un instant puis disparait..

J'ai refait des analyse ccleaner, malwarebyte, spybot.. il ne detecte plus rien. C'est peut etre bon non ?

Salut !!

refais un nouveau rapport hijackthis pour vérifier stp