السلام عليكم
هدا هو التقرير
وشكرااااااااااااااااااا جزيــــــــــــــــــــــــــــــــــلاً
k:
k:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16:47:57, on 22/12/2010
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\cisvc.exe
C:\WINDOWS\system32\FsUsbExService.Exe
C:\WINDOWS\Explorer.exe
C:\Documents and Settings\user\12914771802120.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\CyberLink\PowerDVD9\PDVD9Serv.exe
C:\WINDOWS\system32\vujovootap.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Samsung\Samsung New PC Studio\NPSAgent.exe
C:\Documents and Settings\user\wincdsvn.exe
C:\Documents and Settings\user\Application Data\Microsoft-Update-Service-2568-6479-5400\winrsnmgr.exe
C:\Program Files\McAfee Security Scan\2.0.181\SSScheduler.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\Documents and Settings\user\Application Data\S-2535-6853-2745\winrcsnc.exe
C:\Documents and Settings\user\Application Data\S-2535-6853-2745\winrsvn.exe
C:\Documents and Settings\user\Application Data\D-2785-7947-8747\wincdsvn.exe
C:\Documents and Settings\user\Application Data\msnl.exe
C:\DOCUME~1\user\LOCALS~1\Temp\g0dllrp.exe
C:\WINDOWS\system32\MSPRFLE.EXE
C:\Documents and Settings\user\Application Data\C-76947-8457-2745\wincdrkfk.exe
C:\Documents and Settings\user\12914771802120.exe
C:\WINDOWS\system32\cidaemon.exe
C:\Documents and Settings\user\Bureau\Zyzoom_HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = wmplayer.exe //ICWLaunch
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=127.0.0.1:60727
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: (no name) - {4daac69c-cba7-45e2-9bc8-1044483d3352} - (no file)
F2 - REG:system.ini: Shell=Explorer.exe C:\Documents and Settings\user\12914771802120.exe
F3 - REG:win.ini: load=C:\Documents and Settings\user\12914771802120.exe
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\Documents and Settings\user\12914771802120.exe
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O3 - Toolbar: (no name) - {4daac69c-cba7-45e2-9bc8-1044483d3352} - (no file)
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [RemoteControl9] "C:\Program Files\CyberLink\PowerDVD9\PDVD9Serv.exe"
O4 - HKLM\..\Run: [PDVD9LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD9\Language\Language.exe"
O4 - HKLM\..\Run: [Windows System Guard] C:\Documents and Settings\user\Application Data\msnl.exe
O4 - HKLM\..\Run: [javou] C:\WINDOWS\system32\vujovootap.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Fichiers communs\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [cihoo] C:\WINDOWS\system32\vujovootap.exe
O4 - HKLM\..\Run: [g0dllr] C:\DOCUME~1\user\LOCALS~1\Temp\g0dllrp.exe
O4 - HKLM\..\Run: [g0dll] C:\Documents and Settings\user\12914771802120.exe
O4 - HKLM\..\Run: [MsPrfle] MSPRFLE.EXE
O4 - HKLM\..\Run: [bsf] "bsf.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [AutoStartNPSAgent] C:\Program Files\Samsung\Samsung New PC Studio\NPSAgent.exe
O4 - HKCU\..\Run: [KOO9RV9K4Z] C:\DOCUME~1\user\LOCALS~1\Temp\Dxd.exe
O4 - HKCU\..\Run: [Windows Boot Control] C:\Documents and Settings\user\Application Data\S-2535-6853-2745\winrsvn.exe
O4 - HKCU\..\Run: [WinCtrlSrvc] C:\Documents and Settings\user\Application Data\S-2535-6853-2745\winrcsnc.exe
O4 - HKCU\..\Run: [WinMSDNControl] C:\Documents and Settings\user\Application Data\D-2785-7947-8747\wincdsvn.exe
O4 - HKCU\..\Run: [WindowsDriverControl] C:\Documents and Settings\user\Application Data\C-76947-8457-2745\wincdrkfk.exe
O4 - HKCU\..\Run: [MicrosoftDriverSetup] C:\Documents and Settings\user\wincdsvn.exe
O4 - HKCU\..\Run: [MNTK1K67YO] C:\WINDOWS\Dbecec.exe
O4 - HKCU\..\Run: [WindowsLiveUpdateServices] C:\Documents and Settings\user\Application Data\Microsoft-Update-Service-2568-6479-5400\winrsnmgr.exe
O4 - HKCU\..\RunOnce: [MsPrfle] MSPRFLE.EXE
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: 0081ij6.exe
O4 - Startup: 03a5gmx.exe
O4 - Startup: 0eekgbr.exe
O4 - Startup: 0fbb81s.exe
O4 - Startup: 0pvfqbs.exe
O4 - Startup: 0ty86qg.exe
O4 - Startup: 1a2hm3i.exe
O4 - Startup: 1ijo83a.exe
O4 - Startup: 1llbrsn.exe
O4 - Startup: 1mns81e.exe
O4 - Startup: 1n2jzav.exe
O4 - Startup: 1ozavb2.exe
O4 - Startup: 1qrw81t.exe
O4 - Startup: 1r70yyo.exe
O4 - Startup: 1sty3u0.exe
O4 - Startup: 1wm81e3.exe
O4 - Startup: 2lmhity.exe
O4 - Startup: 2nyjo2p.exe
O4 - Startup: 2zv8ghn.exe
O4 - Startup: 3cxnojz.exe
O4 - Startup: 3upfgbr.exe
O4 - Startup: 4lrrnyo.exe
O4 - Startup: 5cc3ojp.exe
O4 - Startup: 60vq1m3.exe
O4 - Startup: 66k81w3.exe
O4 - Startup: 66u3gbr.exe
O4 - Startup: 6i81ufg.exe
O4 - Startup: 6s81epg.exe
O4 - Startup: 703g1x7.exe
O4 - Startup: 703q0rh.exe
O4 - Startup: 75q6m97.exe
O4 - Startup: 81epg1r.exe
O4 - Startup: 81sdezf.exe
O4 - Startup: 8m5te1a.exe
O4 - Startup: 970871v.exe
O4 - Startup: aa1rxc86j.exe
O4 - Startup: aarhs1ijo86.exe
O4 - Startup: aflwxdnjeu.exe
O4 - Startup: alrcxi5y1.exe
O4 - Startup: aqg0hxd2jf.exe
O4 - Startup: avb60djtpk.exe
O4 - Startup: b2hittjk.exe
O4 - Startup: c6xo1efk.exe
O4 - Startup: chn6dzuva8.exe
O4 - Startup: cs1zjfaq1h.exe
O4 - Startup: cstouu91.exe
O4 - Startup: d2u5plgh.exe
O4 - Startup: d65553no.exe
O4 - Startup: dezf60hcdi8.exe
O4 - Startup: dezf6rw86i.exe
O4 - Startup: dozavb60d.exe
O4 - Startup: e1uavb2hdd.exe
O4 - Startup: e3qlr66ote.exe
O4 - Startup: efk3m1cs1o.exe
O4 - Startup: ezpqlbssij.exe
O4 - Startup: fabgrns81e.exe
O4 - Startup: fagb83iyj.exe
O4 - Startup: faq0rhs870.exe
O4 - Startup: fbb2hid0jff.exe
O4 - Startup: ffgb081i.exe
O4 - Startup: fplgw0xy5j.exe
O4 - Startup: fqlmnyoeuv.exe
O4 - Startup: fvlhcyyoe6.exe
O4 - Startup: fvvlhhxd6.exe
O4 - Startup: gbcxyteu.exe
O4 - Startup: gbm5ns86e8.exe
O4 - Startup: gghn21oza.exe
O4 - Startup: ggmxi875q6g.exe
O4 - Startup: glwny1op.exe
O4 - Startup: glwx6jzz.exe
O4 - Startup: gmcs1zjfaq.exe
O4 - Startup: grns81epq.exe
O4 - Startup: gwxi3eeu.exe
O4 - Startup: h0di86u81gw.exe
O4 - Startup: h0xteofgbr.exe
O4 - Startup: h5xtopu81g.exe
O4 - Startup: hh870jp6f.exe
O4 - Startup: hid081k3wr.exe
O4 - Startup: hm86jufk86.exe
O4 - Startup: hn66e870.exe
O4 - Startup: i0ppqlr6.exe
O4 - Startup: i87kabg81.exe
O4 - Startup: i9kkab0wc1.exe
O4 - Startup: id0871vg3cn.exe
O4 - Startup: id1zfk81.exe
O4 - Startup: injeu0vrr.exe
O4 - Startup: j083ggxcy.exe
O4 - Startup: j70qqgw0xn.exe
O4 - Startup: jj2pv2bcx.exe
O4 - Startup: jkfl3m1dy1u.exe
O4 - Startup: jkfvwrhidj2.exe
O4 - Startup: jkfvwrhn.exe
O4 - Startup: jkqvmhn2.exe
O4 - Startup: ju1klq87.exe
O4 - Startup: jzavb2hs.exe
O4 - Startup: k2bbcxnojp6.exe
O4 - Startup: kvwrhidzzk.exe
O4 - Startup: l0rrhidtk1.exe
O4 - Startup: l70hxd60fl.exe
O4 - Startup: lbbrx66o8.exe
O4 - Startup: lgwxxi87.exe
O4 - Startup: lmh0iteju5.exe
O4 - Startup: lrbxit087.exe
O4 - Startup: m5idezvv.exe
O4 - Startup: m5te1a0l.exe
O4 - Startup: mdteeuk1.exe
O4 - Startup: mhxytjkll6.exe
O4 - Startup: mhxytz66.exe
O4 - Startup: mxytz2agg3.exe
O4 - Startup: nd66k875m7.exe
O4 - Startup: nize881r70.exe
O4 - Startup: nyj0uvllhh2.exe
O4 - Startup: nyytzvv2.exe
O4 - Startup: oeu0vrwh.exe
O4 - Startup: p70wwrsnde.exe
O4 - Startup: pkfwwmsn.exe
O4 - Startup: pqvmhn21.exe
O4 - Startup: pu3wr6hd.exe
O4 - Startup: pu81g9703o.exe
O4 - Startup: q81c8103k.exe
O4 - Startup: q81w2xno.exe
O4 - Startup: qrs6ty80.exe
O4 - Startup: r1ctju5f.exe
O4 - Startup: rc5xtoe5agw.exe
O4 - Startup: rhs6noeuv.exe
O4 - Startup: s81uulbm1.exe
O4 - Startup: syt03k1b.exe
O4 - Startup: ttja1qrw.exe
O4 - Startup: u3qrhn2tjk.exe
O4 - Startup: u870rns81ep.exe
O4 - Startup: uka0rrhidt.exe
O4 - Startup: uupqlr66.exe
O4 - Startup: uuqvrh3ydt.exe
O4 - Startup: vrhcdye6u81.exe
O4 - Startup: whhs81pkl.exe
O4 - Startup: wsn006gbr2.exe
O4 - Startup: x1t703a89.exe
O4 - Startup: x81y9fk8.exe
O4 - Startup: xd0ze86q81.exe
O4 - Startup: xy6epvvgrc.exe
O4 - Startup: y1ozavlmh.exe
O4 - Startup: ypfqqghm.exe
O4 - Startup: yt0kkfgbmxy.exe
O4 - Startup: ytpufvb2i1y.exe
O4 - Startup: yyekq65d.exe
O4 - Startup: z2fgb081.exe
O4 - Startup: ze81qbcx.exe
O4 - Startup: zkvm1cs1o.exe
O4 - Startup: zu3qlbs96dz.exe
O4 - Startup: zvqqhxxt.exe
O4 - Global Startup: McAfee Security Scan Plus.lnk = ?
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O20 - Winlogon Notify: cryptnet32 - cryptnet32.dll (file missing)
O23 - Service: FsUsbExService - Teruten - C:\WINDOWS\system32\FsUsbExService.Exe
O23 - Service: Winferno Subscription Service (guiyoeuywau) - Unknown owner - C:\WINDOWS\system32\quecijougoow.exe
O23 - Service: McAfee Security Scan Component Host Service (McComponentHostService) - McAfee, Inc. - C:\Program Files\McAfee Security Scan\2.0.181\McCHSvc.exe
O23 - Service: AOL Antivirus Update Service (oocwkyukasy) - Unknown owner - C:\WINDOWS\system32\coore.exe
--
End of file - 11118 bytes
