مشاكل عند تشغيل الجهاز بطئ تقرير هايجاك

[mehrez01]

مشاكل عند تشغيل الجهاز بطئ
تقرير هايجاك
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:44:08, on 26/03/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16791)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\winsersec.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\Windows Live\Contacts\wlcomm.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Administrateur\Bureau\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [USB Antivirus] C:\Program Files\USB Disk Security\USBGuard.exe
O4 - HKLM\..\Run: [SDaemon] C:\WINDOWS\sdaemon.exe
O4 - HKLM\..\Run: [SWd] C:\WINDOWS\winwd.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [IncrediMail] C:\Program Files\IncrediMail\bin\IncMail.exe /c
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RESEAU')
O4 - HKUS\S-1-5-20\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'SERVICE RESEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'Default user')
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~1\Office12\EXCEL.EXE/3000
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) -

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) -

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: winser - Unknown owner - C:\WINDOWS\system32\winsersec.exe

--
End of file - 6084 bytes

 

[mehrez01]

ن

 

[PrinceOfPersia]

السلام عليكم ورحمة الله وبركاته

التقرير لايبين شئ خطير أو مشكلة في البرامج

امسح القيمة التالية فقط

O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)

 

[mehrez01]

لكن عندما وضعت تقرير الهايجاك في احد المواقع لفحص التقارير بين لي بأن هناك قيم بالون الاحمر خطيرة يجب حذفها

 

[PrinceOfPersia]

أنا اعتمدت موقع ال hijack
hijackthis.de

الصق التقرير هناك

 

[البتال]

كما أخبرك أخي الفاضل ليس لديك إلا قيمة واحدة تحتاج حذف وهي التي ذكرها وأتمنى دخول الموضوع التالي وإن شاء الله تنفع معك الخطوات

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

أخوكم​

 

[mehrez01]

لو تكرمتو اعيدو الفحص وستجدون ان هناك قيمة باللون الاحمر
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:06:36, on 26/03/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16791)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\winsersec.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\Windows Live\Contacts\wlcomm.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\USB Disk Security\USBGuard.exe
C:\WINDOWS\sdaemon.exe
C:\WINDOWS\winwd.exe
C:\Documents and Settings\Administrateur\Bureau\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [USB Antivirus] C:\Program Files\USB Disk Security\USBGuard.exe
O4 - HKLM\..\Run: [SDaemon] C:\WINDOWS\sdaemon.exe
O4 - HKLM\..\Run: [SWd] C:\WINDOWS\winwd.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [IncrediMail] C:\Program Files\IncrediMail\bin\IncMail.exe /c
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RESEAU')
O4 - HKUS\S-1-5-20\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'SERVICE RESEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'Default user')
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~1\Office12\EXCEL.EXE/3000
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) -

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) -

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: winser - Unknown owner - C:\WINDOWS\system32\winsersec.exe

--
End of file - 6105 bytes

 

[PrinceOfPersia]

بالفعل

أزل القيمة
C:\WINDOWS\winwd.exe
من الهايجاك نفسه

هل تعرف البرنامج؟

 

[mehrez01]

لا

 

[mehrez01]

كيف افعل ذلك

 

[MAAX]

ما تفضل به الاخوان صحيح
اعمل التالي

عطل برامج الحماية عن العمل
ثم
حمل الاداة التالية واحفظها على سطح المكتب

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

عند تشغيلها بتظهر لك رسالة ,, اضغط على >> Yes
بعدها بتظهر لك رساله ثانيه ,, اضغط على >> Yes
اثناء الفحص ممكن يعاد تشغيل الجهاز
وبعد اعادة التشغيل ,, سوف تبدأ الاداة بالفحص مرره ثانيه
لا تقم بتشغيل اي برنامج ،، ومهما طالت عملية الفحص انتظر حتى تنتهي
انتظر حتى يظهر لك تقرير ،،انسخه والصقه بمشاركتك القادمة

 

[mehrez01]

الرابط لا يعمل

 

[mehrez01]

رابط الاداة لايعمل

 

[MAAX]

عطل برامج الحماية اولاا حتى يعمل الرابط

 

[mehrez01]

عطلت برنامج الحماية ولكن الرابط لم يعمل

 

[mehrez01]

Not Found

The requested URL /ComboFix.exe was not found on this server.

 

[MAAX]

جرب هذا

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

 

[mehrez01]

شكرا لقد تم تحميل الاداة وساستعملها وأوفيك بالتقرير

 

[PrinceOfPersia]

ما تفضل به الاخوان صحيح
اعمل التالي

عطل برامج الحماية عن العمل
ثم
حمل الاداة التالية واحفظها على سطح المكتب

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

عند تشغيلها بتظهر لك رسالة ,, اضغط على >> Yes
بعدها بتظهر لك رساله ثانيه ,, اضغط على >> Yes
اثناء الفحص ممكن يعاد تشغيل الجهاز
وبعد اعادة التشغيل ,, سوف تبدأ الاداة بالفحص مرره ثانيه
لا تقم بتشغيل اي برنامج ،، ومهما طالت عملية الفحص انتظر حتى تنتهي
انتظر حتى يظهر لك تقرير ،،انسخه والصقه بمشاركتك القادمة

عطلت برنامج الحماية ولكن الرابط لم يعمل

أخي الحبيب
جربته

​

 

[mehrez01]

هذا التقرير
ComboFix 09-03-25.04 - Administrateur 2009-03-26 19:36:16.1 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.3.1256.966.1036.18.478.154 [GMT 1:00]
Running from: c:\documents and settings\Administrateur\Bureau\ComboFix.exe
AV: avast! antivirus 4.8.1335 [VPS 090325-0] *On-access scanning disabled* (Updated)
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\mswinsck.dll
c:\windows\system32\pthreadGC2.dll

.
((((((((((((((((((((((((( Files Created from 2009-02-26 to 2009-03-26 )))))))))))))))))))))))))))))))
.

2013-09-08 13:18 . 2013-09-08 13:18 81,920 --a------ c:\windows\system32\W32N50.dll
2009-03-26 12:17 . 2009-01-09 20:19 1,089,883 -----c--- c:\windows\system32\DllCache\ntprint.cat
2009-03-25 13:29 . 2009-03-25 13:29 <REP> d-------- C:\3ff82e791d943cdbf8ce9798cb65cfbc
2009-03-25 13:28 . 2009-03-25 13:28 <REP> d-------- c:\windows\system32\XPSViewer
2009-03-25 13:28 . 2009-03-25 13:28 <REP> d-------- c:\program files\Reference Assemblies
2009-03-25 13:28 . 2009-03-25 13:28 <REP> d-------- C:\1fd71a3583bda325f656edea6e31c871
2009-03-25 13:28 . 2008-07-06 13:06 1,676,288 --------- c:\windows\system32\xpssvcs.dll
2009-03-25 13:28 . 2008-07-06 13:06 1,676,288 -----c--- c:\windows\system32\DllCache\xpssvcs.dll
2009-03-25 13:28 . 2008-07-06 11:50 597,504 -----c--- c:\windows\system32\DllCache\printfilterpipelinesvc.exe
2009-03-25 13:28 . 2008-07-06 13:06 575,488 --------- c:\windows\system32\xpsshhdr.dll
2009-03-25 13:28 . 2008-07-06 13:06 575,488 -----c--- c:\windows\system32\DllCache\xpsshhdr.dll
2009-03-25 13:28 . 2008-07-06 13:06 117,760 --------- c:\windows\system32\prntvpt.dll
2009-03-25 13:28 . 2008-07-06 13:06 89,088 -----c--- c:\windows\system32\DllCache\filterpipelineprintproc.dll
2009-03-25 13:25 . 2009-03-25 13:25 <REP> d--hs---- c:\documents and settings\NetworkService\IETldCache
2009-03-25 13:15 . 2009-03-25 13:15 <REP> d--hs---- c:\documents and settings\Administrateur\PrivacIE
2009-03-25 13:14 . 2009-03-25 13:14 <REP> d-------- C:\Temp
2009-03-25 13:12 . 2009-03-25 18:32 <REP> d-------- c:\program files\DOC Regenerator
2009-03-25 11:53 . 2009-03-25 11:53 <REP> d--hs---- c:\documents and settings\Administrateur\IETldCache
2009-03-24 19:37 . 2009-03-24 19:37 20 --a------ c:\windows\security.INI
2009-03-24 19:25 . 2009-03-26 13:08 <REP> d-------- c:\windows\ie8updates
2009-03-24 19:22 . 2008-04-14 03:33 81,920 --a------ c:\windows\system32\ieencode.dll
2009-03-24 19:22 . 2007-08-13 18:45 78,336 --a------ c:\windows\system32\DllCache\ieencode.dll
2009-03-24 13:33 . 2008-12-20 23:46 6,066,688 --a--c--- c:\windows\system32\DllCache\ieframe.dll
2009-03-24 13:33 . 2007-04-17 10:32 2,455,488 --a--c--- c:\windows\system32\DllCache\ieapfltr.dat
2009-03-24 13:33 . 2007-03-08 06:10 1,048,576 --a--c--- c:\windows\system32\DllCache\ieframe.dll.mui
2009-03-24 13:33 . 2008-12-20 23:46 459,264 --a--c--- c:\windows\system32\DllCache\msfeeds.dll
2009-03-24 13:33 . 2008-12-20 23:46 383,488 --a--c--- c:\windows\system32\DllCache\ieapfltr.dll
2009-03-24 13:33 . 2008-12-20 23:46 267,776 --a--c--- c:\windows\system32\DllCache\iertutil.dll
2009-03-24 13:33 . 2008-12-20 23:46 63,488 --a--c--- c:\windows\system32\DllCache\icardie.dll
2009-03-24 13:33 . 2008-12-20 23:46 52,224 --a--c--- c:\windows\system32\DllCache\msfeedsbs.dll
2009-03-24 13:33 . 2008-12-19 10:10 13,824 -----c--- c:\windows\system32\DllCache\ieudinit.exe
2009-03-23 19:22 . 2009-03-23 19:28 598 --a------ c:\windows\wininit.ini
2009-03-22 19:00 . 2009-03-24 19:42 282 --a------ c:\windows\itlog.dat
2009-03-22 19:00 . 2009-03-26 19:04 231 --a------ c:\windows\winsc32.ini
2009-03-22 18:59 . 2009-03-22 18:59 <REP> d-------- c:\program files\security
2009-03-22 18:59 . 2009-03-26 19:04 244 --a------ c:\windows\gercescp.dvr
2009-03-22 18:59 . 2009-03-22 19:02 60 --------- c:\windows\dwpces23.dru
2009-03-22 18:23 . 2009-03-22 18:23 47 --a------ c:\windows\unlock.bat
2009-03-22 17:58 . 2009-03-22 17:58 <REP> d-------- C:\PCTAP
2009-03-22 17:58 . 2009-03-22 18:00 348 --a------ c:\windows\PCTAP.ini
2009-03-22 17:38 . 2009-03-22 17:39 <REP> d-------- c:\program files\Traduce Gratis
2009-03-22 17:33 . 2009-03-22 17:34 <REP> d-------- c:\program files\USB Disk Security
2009-03-22 17:27 . 2009-03-22 17:30 30,001 --a------ c:\windows\gktemp.wat
2009-03-22 17:21 . 2007-06-02 16:20 71,680 --a------ c:\windows\ST5UNST.EXE
2009-03-22 17:21 . 2007-06-02 16:21 29,696 --a------ c:\windows\system32\VB5StKit.dll
2009-03-22 16:40 . 2009-03-22 16:40 <REP> d-------- c:\documents and settings\All Users\Application Data\ParetoLogic
2009-03-22 16:40 . 2009-03-22 17:04 <REP> d-------- c:\documents and settings\All Users\Application Data\DriverCure
2009-03-22 16:40 . 2009-03-22 16:40 <REP> d-------- c:\documents and settings\Administrateur\Application Data\DriverCure
2009-03-22 16:34 . 2003-04-23 19:25 61,440 --a------ c:\windows\system32\ZDTRLib.DLL
2009-03-22 16:34 . 2002-10-29 17:35 61,440 --a------ c:\windows\system32\ZDN50.dll
2009-03-22 16:34 . 2003-04-23 19:25 49,152 --a------ c:\windows\system32\ZD12APP.dll
2009-03-22 16:34 . 2003-03-14 12:24 24,576 --a------ c:\windows\system32\ZyDelReg.exe
2009-03-22 16:34 . 2002-10-30 11:43 16,157 --a------ c:\windows\system32\ZDNDIS5.sys
2009-03-22 14:23 . 2009-03-17 23:25 140,288 --a------ c:\windows\system32\COMDLG32.OCX
2009-03-22 14:23 . 2000-10-02 00:00 119,568 --a------ c:\windows\system32\VB6FR.DLL
2009-03-22 14:02 . 2009-03-25 11:53 <REP> d-------- c:\program files\Google
2009-03-22 10:56 . 2009-03-22 10:56 <REP> d-------- c:\program files\Microsoft Office Outlook Connector
2009-03-22 10:55 . 2009-03-22 10:55 <REP> d-------- c:\program files\MSECache
2009-03-22 10:26 . 2009-03-22 10:26 <REP> d-------- c:\documents and settings\All Users\Application Data\Messenger Plus!
2009-03-21 22:52 . 2009-03-21 22:52 <REP> d-------- c:\documents and settings\Administrateur\Application Data\Thinstall
2009-03-21 22:47 . 2008-02-29 16:27 676,224 --a------ c:\windows\system32\OGACheckControl.dll
2009-03-21 22:39 . 2009-03-21 22:39 <REP> d-------- c:\program files\Messenger Plus! Live
2009-03-21 22:17 . 2009-03-21 22:17 <REP> d-------- c:\documents and settings\Administrateur\Application Data\ATI
2009-03-21 21:21 . 2008-10-16 14:06 268,648 --a------ c:\windows\system32\mucltui.dll
2009-03-21 21:21 . 2008-10-16 14:06 27,496 --a------ c:\windows\system32\mucltui.dll.mui
2009-03-21 18:16 . 2008-08-22 05:44 66,082 --a------ c:\windows\system32\c_10021.nls
2009-03-21 18:16 . 2008-08-22 05:44 6,144 -ra------ c:\windows\system32\kbdth3.dll
2009-03-21 18:16 . 2008-08-22 05:44 6,144 -ra------ c:\windows\system32\kbdth2.dll
2009-03-21 18:16 . 2008-08-22 05:44 6,144 --a------ c:\windows\system32\ftlx041e.dll
2009-03-21 18:16 . 2008-08-22 05:44 5,632 -ra------ c:\windows\system32\kbdth1.dll
2009-03-21 18:16 . 2008-08-22 05:44 5,632 -ra------ c:\windows\system32\kbdth0.dll
2009-03-21 18:12 . 2001-09-28 14:00 162,850 --a------ c:\windows\system32\c_10001.nls
2009-03-21 18:12 . 2001-09-28 14:00 28,288 --a------ c:\windows\system32\xjis.nls
2009-03-21 18:12 . 2001-08-23 17:47 8,704 --a------ c:\windows\system32\kbdjpn.dll
2009-03-21 18:12 . 2001-08-23 17:47 8,192 --a------ c:\windows\system32\kbdkor.dll
2009-03-21 18:12 . 2008-04-14 03:31 6,144 --a------ c:\windows\system32\kbd106.dll
2009-03-21 18:12 . 2001-08-17 22:55 6,144 --a------ c:\windows\system32\kbd101c.dll
2009-03-21 18:12 . 2001-08-17 22:55 6,144 --a------ c:\windows\system32\kbd101b.dll
2009-03-21 18:12 . 2001-08-17 22:55 5,632 --a------ c:\windows\system32\kbd103.dll
2009-03-21 18:07 . 2009-03-26 19:34 <REP> d-------- c:\documents and settings\Administrateur\Tracing
2009-03-21 18:01 . 2009-03-21 18:01 <REP> d-------- c:\program files\Microsoft SQL Server Compact Edition
2009-03-21 18:01 . 2006-11-29 13:06 3,426,072 --a------ c:\windows\system32\d3dx9_32.dll
2009-03-21 18:00 . 2009-03-21 18:00 <REP> d-------- c:\program files\Windows Live SkyDrive
2009-03-21 18:00 . 2009-03-21 18:05 <REP> d-------- c:\program files\Windows Live
2009-03-21 18:00 . 2009-03-21 18:00 <REP> d-------- c:\program files\Microsoft
2009-03-21 17:58 . 2009-03-21 17:58 0 --a------ c:\windows\nsreg.dat
2009-03-21 17:47 . 2009-03-21 17:47 <REP> d-------- c:\program files\Fichiers communs\Windows Live
2009-03-21 17:38 . 2009-03-21 17:38 <REP> d-------- c:\documents and settings\Administrateur\Application Data\Media Player Classic
2009-03-21 17:35 . 2009-03-21 17:35 <REP> d-------- c:\program files\K-Lite Codec Pack
2009-03-21 17:33 . 2009-01-16 21:15 3,594,752 --a--c--- c:\windows\system32\DllCache\mshtml.dll
2009-03-21 17:33 . 2008-08-14 14:23 2,191,232 -----c--- c:\windows\system32\DllCache\ntoskrnl.exe
2009-03-21 17:33 . 2008-08-14 14:23 2,147,328 -----c--- c:\windows\system32\DllCache\ntkrnlmp.exe
2009-03-21 17:33 . 2008-08-14 14:23 2,068,096 -----c--- c:\windows\system32\DllCache\ntkrnlpa.exe
2009-03-21 17:33 . 2008-08-14 14:23 2,025,984 -----c--- c:\windows\system32\DllCache\ntkrpamp.exe
2009-03-21 17:33 . 2008-10-24 12:21 455,296 -----c--- c:\windows\system32\DllCache\mrxsmb.sys
2009-03-21 17:33 . 2008-05-08 15:02 203,136 -----c--- c:\windows\system32\DllCache\rmcast.sys
2009-03-21 17:32 . 2008-09-04 18:16 1,106,944 -----c--- c:\windows\system32\DllCache\msxml3.dll
2009-03-21 17:32 . 2008-04-11 20:05 691,712 -----c--- c:\windows\system32\DllCache\inetcomm.dll
2009-03-21 17:32 . 2008-10-15 17:35 337,408 -----c--- c:\windows\system32\DllCache\netapi32.dll
2009-03-21 17:32 . 2008-12-11 11:57 333,952 -----c--- c:\windows\system32\DllCache\srv.sys
2009-03-21 17:32 . 2008-05-01 15:36 331,776 -----c--- c:\windows\system32\DllCache\msadce.dll
2009-03-21 17:30 . 2009-03-21 17:30 <REP> d-------- c:\windows\system32\xircom
2009-03-21 17:30 . 2009-03-21 17:30 <REP> d-------- c:\program files\microsoft frontpage
2009-03-21 17:24 . 2009-03-21 17:24 <REP> d-------- c:\program files\Windows Media Connect 2
2009-03-21 17:22 . 2009-03-21 17:22 <REP> d-------- c:\windows\system32\LogFiles
2009-03-21 17:22 . 2009-03-21 17:23 <REP> d-------- c:\windows\system32\drivers\UMDF
2009-03-21 17:13 . 2009-03-26 13:08 <REP> d-------- c:\windows\system32\fr-fr
2009-03-21 17:13 . 2009-03-21 17:13 <REP> d-------- c:\windows\system32\fr
2009-03-21 17:13 . 2009-03-21 17:13 <REP> d-------- c:\windows\system32\bits
2009-03-21 17:13 . 2009-03-21 17:13 <REP> d-------- c:\windows\l2schemas
2009-03-21 17:11 . 2009-03-21 17:13 <REP> d-------- c:\windows\ServicePackFiles
2009-03-21 17:00 . 2004-08-04 00:38 327,168 --------- c:\windows\system32\drivers\ati2mtaa.sys
2009-03-21 16:41 . 2009-03-21 16:41 <REP> d-------- c:\documents and settings\All Users\Application Data\IM
2009-03-21 16:40 . 2009-03-21 16:41 <REP> d-------- c:\program files\IncrediMail
2009-03-21 16:40 . 2009-03-21 16:40 <REP> d-------- c:\documents and settings\All Users\Application Data\IncrediMail
2009-03-21 16:33 . 2009-03-26 12:23 <REP> d--h----- c:\windows\$hf_mig$
2009-03-21 16:33 . 2009-01-07 18:21 26,144 --a------ c:\windows\system32\spupdsvc.exe
2009-03-21 16:29 . 2008-10-16 14:09 43,544 --a------ c:\windows\system32\wups2.dll
2009-03-21 16:29 . 2008-10-16 14:09 35,864 --a------ c:\windows\system32\wucltui.dll.mui
2009-03-21 16:29 . 2008-10-16 14:08 27,672 --a------ c:\windows\system32\wuaucpl.cpl.mui
2009-03-21 16:29 . 2008-10-16 14:08 27,672 --a------ c:\windows\system32\wuapi.dll.mui
2009-03-21 16:29 . 2008-10-16 14:07 19,992 --a------ c:\windows\system32\wuaueng.dll.mui
2009-03-21 16:28 . 2009-03-21 16:28 <REP> d--hs---- c:\documents and settings\Administrateur\UserData
2009-03-21 13:04 . 2009-03-21 13:04 <REP> d-------- c:\program files\Microsoft Works
2009-03-21 13:03 . 2009-03-25 13:28 <REP> d-------- c:\program files\MSBuild

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-03-20 22:03 --------- d-----w c:\program files\Services en ligne
2009-02-09 18:56 67,584 ----a-w c:\windows\system32\ff_vfw.dll
2009-02-09 14:05 1,846,912 ----a-w c:\windows\system32\win32k.sys
2009-02-06 18:39 308,600 ----a-w c:\windows\WLXPGSS.SCR
2009-02-06 17:52 49,504 ----a-w c:\windows\system32\sirenacm.dll
2009-01-07 17:20 265,720 ----a-w c:\windows\system32\msdbg2.dll
2009-01-07 17:20 26,112 ----a-w c:\windows\system32\idndl.dll
2009-01-07 17:20 24,576 ----a-w c:\windows\system32\nlsdl.dll
2009-01-07 17:20 23,552 ----a-w c:\windows\system32\normaliz.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"IncrediMail"="c:\program files\IncrediMail\bin\IncMail.exe" [2009-02-25 251264]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-02-06 3885408]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ATICCC"="c:\program files\ATI Technologies\ATI.ACE\cli.exe" [2006-01-02 45056]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-02-05 81000]
"SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2006-05-01 843776]
"IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2008-04-13 208952]
"MSPY2002"="c:\windows\system32\IME\PINTLGNT\ImScInst.exe" [2008-04-13 59392]
"PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2008-04-13 455168]
"PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2008-04-13 455168]
"USB Antivirus"="c:\program files\USB Disk Security\USBGuard.exe" [2008-09-23 798720]
"SDaemon"="c:\windows\sdaemon.exe" [2005-04-18 111104]
"SWd"="c:\windows\winwd.exe" [2005-04-18 26624]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"tscuninstall"="c:\windows\system32\tscupgrd.exe" [2004-08-04 44544]
"nLite"="c:\windows\inf\nlite.cmd" [2004-08-25 385]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"ForceClassicControlPanel"= 1 (0x1)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\IncrediMail\\bin\\IncMail.exe"=
"c:\\Program Files\\IncrediMail\\bin\\ImApp.exe"=
"c:\\Program Files\\IncrediMail\\bin\\ImpCnt.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=

R0 atiide;atiide;c:\windows\system32\drivers\atiide.sys [2009-03-21 3456]
R0 WINSEC;WINSEC;c:\windows\system32\drivers\winsec.sys [2005-04-18 20352]
R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2009-03-21 114768]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2009-03-21 20560]
R2 winser;winser;c:\windows\system32\winsersec.exe [2005-04-13 53248]
S3 ZDCndis5;ZDCndis5 Protocol Driver;\??\c:\windows\system32\ZDCndis5.SYS --> c:\windows\system32\ZDCndis5.SYS [?]
.
- - - - ORPHANS REMOVED - - - -

HKLM-Run-ZDConfig - (no file)


.
------- Supplementary Scan -------
.
uStart Page = hxxp://mystart.incredimail.com/french/
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uSearchURL,(Default) = hxxp://www.google.com/search/?q=%s
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~1\Office12\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\Administrateur\Application Data\Mozilla\Firefox\Profiles\6q7m4dok.default\
FF - prefs.js: browser.startup.homepage - hxxp://fr.msn.com/
FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,

يجب عليك تسجيل الدخول او تسجيل لمشاهدة الرابط المخفي

Rootkit scan 2009-03-26 19:37:55
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2009-03-26 19:38:56
ComboFix-quarantined-files.txt 2009-03-26 18:38:54

Pre-Run: 146 554 376 192 octets libres
Post-Run: 146,658,390,016 octets libres

Current=1 Default=1 Failed=0 LastKnownGood=4 Sets=1,2,3,4
225 --- E O F --- 2009-03-26 12:39:05