نتيجة تقريري الهايجاك وكومبوفيكس لجهاز السيبر الرئيسي
بسم الله الرحمن الرحيم
أخي الكريم/ فارس الملاك
تم تطبيق ما ذكرته بمشاركتك رقم 5 على جهازي الخاص وجهاز السيبر الرئيسي
وها هو تقرير الهايجاك لجهاز السيبر الرئيسي أولا:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 09:46:43, on 27/07/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0011)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\CNAB4RPK.EXE
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\Unlocker\UnlockerAssistant.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
C:\Documents and Settings\SERVEUR\Bureau\Zyzoom_HijackThis.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Favoris
O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files\Internet Download Manager\IDMIECC.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [UnlockerAssistant] "C:\Program Files\Unlocker\UnlockerAssistant.exe"
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: Add to Anti-Banner - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\ie_banner_deny.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Web Anti-Virus statistics - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\SCIEPlgn.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{953000FA-AB54-4DC6-A3F2-D5B2436EC6CD}: NameServer = 212.217.0.1,192.168.2.1
O20 - Winlogon Notify: Antiwpa - C:\WINDOWS\SYSTEM32\antiwpa.dll
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Kaspersky Internet Security 7.0 (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
--
End of file - 4810 bytes
وهذا هو تقرير كومبوفيكس لجهاز السيبر الرئيسي أيضا:
ComboFix 08-07-26.1 - SERVEUR 2008-07-27 9:23:56.1 -
FAT32x86
Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.220 [GMT 0:00]
Endroit: C:\Documents and Settings\SERVEUR\Bureau\ComboFix.exe
* Création d'un nouveau point de restauration
AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !!
.
((((((((((((((((((((((((((((( Fichiers cr‚‚s 2008-06-27 to 2008-07-27 ))))))))))))))))))))))))))))))))))))
.
2008-07-27 08:21 . 2004-08-03 23:01 25,856 --a------ C:\WINDOWS\system32\drivers\usbprint.sys
2008-07-27 08:21 . 2004-08-03 23:01 25,856 --a------ C:\WINDOWS\system32\dllcache\usbprint.sys
2008-07-27 08:20 . 2005-03-27 15:00 135,168 --------- C:\WINDOWS\system32\CNAB4EMU.DLL
2008-07-27 08:20 . 2005-03-27 15:00 65,536 --------- C:\WINDOWS\system32\CNAB4SMK.DLL
2008-07-27 08:20 . 2005-03-27 15:00 57,344 --------- C:\WINDOWS\system32\CNAB4RPK.EXE
2008-07-27 08:20 . 2005-03-27 15:00 28,672 --------- C:\WINDOWS\system32\CNAB4PTU.DLL
2008-07-27 08:20 . 2005-03-27 15:00 28,672 --------- C:\WINDOWS\system32\CNAB4LMK.DLL
2008-07-27 08:16 . 2008-07-27 08:16 <REP> d-------- C:\Program Files\Internet Download Manager
2008-07-27 08:16 . 2008-07-27 08:16 <REP> d-------- C:\Documents and Settings\SERVEUR\Application Data\IDM
2008-07-27 08:16 . 2008-07-27 08:16 <REP> d-------- C:\Documents and Settings\SERVEUR\Application Data\DMCache
2008-07-27 08:14 . 2008-07-27 08:14 203,776 --a------ C:\WINDOWS\system32\clrviddc.dll
2008-07-27 08:12 . 2008-07-27 08:12 <REP> d-------- C:\Program Files\Fichiers communs\xing shared
2008-07-27 08:04 . 2008-07-27 08:04 <REP> d-------- C:\Program Files\Fichiers communs\Real
2008-07-27 08:03 . 2008-07-27 08:03 <REP> d-------- C:\Program Files\Real
2008-07-26 19:41 . 2008-07-26 19:41 <REP> d-------- C:\Documents and Settings\SERVEUR\Application Data\Grisoft
2008-07-26 19:37 . 2008-07-26 19:37 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
2008-07-26 19:37 . 2007-05-30 12:10 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
2008-07-26 17:57 . 2008-07-26 17:57 <REP> d-------- C:\zPharaoh.dat
2008-07-26 17:57 . 2008-07-26 17:57 <REP> d-------- C:\Documents and Settings\tazebama.dll
2008-07-26 17:57 . 2008-07-26 17:57 <REP> d-------- C:\Documents and Settings\tazebama.dl_
2008-07-26 17:57 . 2008-07-26 17:57 <REP> d-------- C:\Documents and Settings\hook.dl_
2008-07-26 17:14 . 2008-07-22 08:01 105,472 -ra------ C:\WINDOWS\system32\en.sergiwa.com.exe
2008-07-26 17:06 . 2008-07-26 17:06 <REP> d-------- C:\Documents and Settings\SERVEUR\Application Data\Canon
2008-07-26 17:06 . 2004-08-03 22:58 15,104 --a------ C:\WINDOWS\system32\drivers\usbscan.sys
2008-07-26 17:06 . 2004-08-03 22:58 15,104 --a------ C:\WINDOWS\system32\dllcache\usbscan.sys
2008-07-26 17:03 . 2004-08-03 23:08 26,496 --a------ C:\WINDOWS\system32\dllcache\usbstor.sys
2008-07-26 16:57 . 2008-07-26 16:57 <REP> d-------- C:\WINDOWS\system32\fr-fr
2008-07-26 16:49 . 2008-07-26 16:49 <REP> d-------- C:\WINDOWS\LastGood
2008-07-26 16:49 . 2008-07-26 16:49 <REP> d--h----- C:\WINDOWS\$hf_mig$
2008-07-26 16:33 . 2008-07-26 16:33 <REP> d--hs---- C:\FOUND.000
2008-07-26 16:21 . 2008-07-26 16:21 268 --ah----- C:\sqmdata00.sqm
2008-07-26 16:21 . 2008-07-26 16:21 244 --ah----- C:\sqmnoopt00.sqm
2008-07-26 16:18 . 2008-07-26 16:18 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Yahoo!
2008-07-26 09:14 . 2008-07-26 09:14 <REP> d-------- C:\Program Files\Fichiers communs\Adobe
2008-07-26 09:05 . 2008-07-26 09:05 <REP> d-------- C:\Documents and Settings\All Users\Application Data\WinZip
2008-07-26 08:59 . 2008-07-26 08:59 <REP> d-------- C:\Program Files\Yahoo!
2008-07-26 08:58 . 2008-07-26 08:58 <REP> d-------- C:\Program Files\Unlocker
2008-07-26 08:58 . 2008-07-26 08:58 <REP> d-------- C:\Program Files\TeraCopy
2008-07-26 08:58 . 2008-07-26 08:58 <REP> d-------- C:\Documents and Settings\SERVEUR\Application Data\TeraCopy
2008-07-26 08:50 . 2008-07-26 08:50 <REP> d-------- C:\Program Files\MultiTranse
2008-07-26 08:49 . 2008-07-26 08:49 <REP> d--hs---- C:\Documents and Settings\SERVEUR\UserData
2008-07-26 08:06 . 2008-07-26 08:06 49 --a------ C:\WINDOWS\NeroDigital.ini
2008-07-26 08:03 . 2008-07-26 08:03 <REP> d-------- C:\Documents and Settings\SERVEUR\Contacts
2008-07-26 07:59 . 2008-07-26 07:59 <REP> d-------- C:\WINDOWS\system32\DRVSTORE
2008-07-26 07:58 . 2008-07-26 07:58 <REP> d-------- C:\Program Files\Windows Live
2008-07-26 07:45 . 2008-07-26 07:45 <REP> d-------- C:\Program Files\Canon
2008-07-26 07:44 . 2008-07-26 07:44 <REP> d--h----- C:\Program Files\InstallShield Installation Information
2008-07-26 07:44 . 2008-07-26 07:44 <REP> d-------- C:\Program Files\Fichiers communs\InstallShield
2008-07-26 07:44 . 2008-07-26 07:44 <REP> d--h----- C:\CanoScan
2008-07-26 07:44 . 2005-03-28 19:20 352,256 --a------ C:\WINDOWS\system32\CNQL1213.DLL
2008-07-26 07:44 . 2005-02-28 13:20 57,344 --a------ C:\WINDOWS\system32\CNQU110.DLL
2008-07-26 07:40 . 2002-12-27 10:26 243,712 -ra------ C:\WINDOWS\system32\drivers\sncp106.sys
2008-07-26 07:35 . 2008-07-26 07:35 <REP> d-------- C:\Program Files\Fichiers communs\Ahead
2008-07-26 07:35 . 2001-07-06 14:41 569,344 --------- C:\WINDOWS\system32\imagr5.dll
2008-07-26 07:35 . 2001-07-06 12:44 544,768 --------- C:\WINDOWS\system32\imagx5.dll
2008-07-26 07:35 . 2001-07-06 18:24 283,920 --------- C:\WINDOWS\system32\ImagXpr5.dll
2008-07-26 07:35 . 2001-07-09 11:50 155,648 --a------ C:\WINDOWS\system32\NeroCheck.exe
2008-07-26 07:35 . 2000-06-26 11:45 106,496 --a------ C:\WINDOWS\system32\TwnLib20.dll
2008-07-26 07:35 . 2001-06-26 08:15 38,912 --------- C:\WINDOWS\system32\picn20.dll
2008-07-26 07:34 . 2008-07-26 07:34 <REP> d-------- C:\Program Files\Ahead
2008-07-26 07:30 . 2008-07-26 07:30 385 --a------ C:\WINDOWS\ODBC.INI
2008-07-26 07:29 . 2003-06-19 01:31 17,920 --a------ C:\WINDOWS\system32\mdimon.dll
2008-07-26 07:24 . 2008-07-26 07:24 <REP> d-------- C:\WINDOWS\SHELLNEW
2008-07-26 07:24 . 2008-07-26 07:25 <REP> d-------- C:\Program Files\Microsoft Works
2008-07-26 07:18 . 2008-07-26 07:18 1,740 --a------ C:\WINDOWS\system32\d3d8caps.dat
2008-07-26 07:15 . 2008-07-26 07:15 <REP> d-------- C:\Program Files\Windows Media Connect 2
2008-07-26 07:15 . 2004-08-19 16:09 221,184 --a------ C:\WINDOWS\system32\wmpns.dll
2008-07-26 07:11 . 2008-07-26 07:11 <REP> d-------- C:\WINDOWS\system32\LogFiles
2008-07-26 07:11 . 2008-07-26 07:11 <REP> d-------- C:\WINDOWS\system32\drivers\UMDF
2008-07-26 07:11 . 2006-09-25 17:58 23,856 --a------ C:\WINDOWS\system32\spupdsvc.exe
2008-07-26 07:10 . 2008-07-26 07:10 <REP> d-------- C:\WINDOWS\LastGood.Tmp
2008-07-26 07:00 . 2008-06-10 02:32 73,728 --a------ C:\WINDOWS\system32\javacpl.cpl
2008-07-26 06:57 . 2008-07-26 06:57 <REP> d-------- C:\Program Files\Java
2008-07-26 06:49 . 2008-07-26 06:49 <REP> d-------- C:\Program Files\Fichiers communs\Java
2008-07-26 06:46 . 2008-07-26 06:46 0 --a------ C:\WINDOWS\nsreg.dat
2008-07-26 06:45 . 2008-07-26 06:45 <REP> d-------- C:\Documents and Settings\SERVEUR\Application Data\DeskSoft
2008-07-26 06:44 . 2008-07-26 06:44 <REP> d-------- C:\Program Files\FastFolders
2008-07-26 06:43 . 2008-07-26 06:43 <REP> d-------- C:\Program Files\PowerShell-XP3
2008-07-26 06:37 . 2008-07-26 06:37 382,716 --a------ C:\WINDOWS\system32\cdky1.reg
2008-07-26 06:37 . 2006-07-22 23:49 5,376 --a------ C:\WINDOWS\system32\antiwpa.dll
2008-07-26 06:37 . 2008-07-26 06:37 346 --a------ C:\WINDOWS\system32\cdky2.reg
2008-07-26 06:36 . 2008-07-26 06:36 <REP> d--h----- C:\zwga
2008-07-26 01:31 . 2008-07-26 01:44 96,559 --a------ C:\WINDOWS\system32\drivers\klin.dat
2008-07-26 01:31 . 2008-07-26 01:44 87,855 --a------ C:\WINDOWS\system32\drivers\klick.dat
2008-07-26 01:27 . 2008-07-26 01:27 <REP> d-------- C:\Program Files\Kaspersky Lab
2008-07-26 01:27 . 2008-07-26 01:27 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2008-07-26 01:27 . 2008-07-27 09:31 32 --ahs---- C:\WINDOWS\system32\drivers\fidbox2.idx
2008-07-26 01:27 . 2008-07-27 09:31 32 --ahs---- C:\WINDOWS\system32\drivers\fidbox2.dat
2008-07-26 01:27 . 2008-07-27 09:31 32 --ahs---- C:\WINDOWS\system32\drivers\fidbox.idx
2008-07-26 01:27 . 2008-07-27 09:31 32 --ahs---- C:\WINDOWS\system32\drivers\fidbox.dat
2008-07-26 01:01 . 2008-07-26 01:01 <REP> d--hs---- C:\Recycled
2008-07-26 01:00 . 2008-07-25 23:12 <REP> d--h----- C:\Documents and Settings\SERVEUR\Voisinage r‚seau
2008-07-26 01:00 . 2008-07-25 23:12 <REP> d--h----- C:\Documents and Settings\SERVEUR\Voisinage d'impression
2008-07-26 01:00 . 2008-07-25 23:12 <REP> d--h----- C:\Documents and Settings\SERVEUR\ModŠles
2008-07-26 01:00 . 2008-07-26 16:59 <REP> dr------- C:\Documents and Settings\SERVEUR\Mes documents
2008-07-26 01:00 . 2008-07-25 23:12 <REP> dr------- C:\Documents and Settings\SERVEUR\Menu D‚marrer
2008-07-26 01:00 . 2008-07-26 01:00 <REP> dr------- C:\Documents and Settings\SERVEUR\Favoris
2008-07-26 01:00 . 2008-07-25 23:12 <REP> d-------- C:\Documents and Settings\SERVEUR\Bureau
2008-07-26 01:00 . 2008-07-26 01:00 <REP> d-------- C:\Documents and Settings\SERVEUR
2008-07-26 00:03 . 2001-09-28 11:00 66,594 --a------ C:\WINDOWS\system32\dllcache\c_864.nls
2008-07-14 10:37 . 2008-07-09 14:34 206,256 --a------ C:\WINDOWS\system32\idmmbc.dll
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-07-27 08:10 499,712 ----a-w C:\WINDOWS\system32\msvcp71.dll
2008-07-26 01:44 112,144 ----a-w C:\WINDOWS\system32\drivers\kl1.sys
2008-07-25 23:28 --------- d-----w C:\Program Files\microsoft frontpage
2008-07-25 23:25 --------- d-----w C:\Program Files\Services en ligne
.
((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-19 14:09 15360]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 04:27 144784]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50 155648]
"UnlockerAssistant"="C:\Program Files\Unlocker\UnlockerAssistant.exe" [2008-03-01 05:10 15872]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 09:25 6731312]
"TkBellExe"="C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" [2008-07-27 08:10 185896]
"AVP"="C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe" [2007-12-18 00:43 227856]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-19 14:09 15360]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoSMBalloonTip"= 0 (0x0)
"NoResolveTrack"= 1 (0x1)
"NoResolveSearch"= 1 (0x1)
"NoUserNameInStartMenu"= 0 (0x0)
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\Antiwpa]
2006-07-22 23:49 5376 C:\WINDOWS\system32\antiwpa.dll
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
"C:\\WINDOWS\\System32\\CNAB4RPK.EXE"=
R3 G200;G200;C:\WINDOWS\system32\DRIVERS\G200m.sys [2001-08-23 17:18]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;C:\WINDOWS\system32\DRIVERS\klim5.sys [2007-12-13 13:28]
S3 SNCP106;PC Camera (6009 CIF);C:\WINDOWS\system32\DRIVERS\sncp106.sys [2002-12-27 10:26]
.
.
------- Supplementary Scan -------
.
R0 -: HKCU-Main,SearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
R1 -: HKCU-SearchURL,(Default) = hxxp://www.google.com/keyword/%s
O17 -: HKLM\CCS\Interface\{953000FA-AB54-4DC6-A3F2-D5B2436EC6CD}: NameServer = 212.217.0.1,192.168.2.1
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
Rootkit scan 2008-07-27 09:33:44
Windows 5.1.2600 Service Pack 2 FAT NTAPI
Balayage processus cach‚s ...
Balayage cach‚ autostart entries ...
Balayage des fichiers cach‚s ...
Scan termin‚ avec succŠs
Les fichiers cach‚s: 0
**************************************************************************
.
--------------------- DLLs a charg‚ sous des processus courants ---------------------
PROCESS: C:\WINDOWS\explorer.exe
-> C:\Program Files\Unlocker\UnlockerHook.dll
.
------------------------ Other Running Processes ------------------------
.
C:\PROGRAM FILES\GRISOFT\AVG ANTI-SPYWARE 7.5\GUARD.EXE
C:\PROGRAM FILES\FICHIERS COMMUNS\MICROSOFT SHARED\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\CNAB4RPK.EXE
C:\PROGRAM FILES\ADOBE\ACROBAT 7.0\READER\READER_SL.EXE
.
**************************************************************************
.
Temps d'accomplissement: 2008-07-27 9:37:18 - machine was rebooted
ComboFix-quarantined-files.txt 2008-07-27 09:37:08
Pre-Run: 12,145,025,024 octets libres
Post-Run: 12,181,536,768 octets libres
194
وتم تجربة الجهاز بسرعة ولم تظهر أي مشاكل... وسأعمل عليه اليوم وأي ملاحظة ستظهر سأوافيك بها
تقبل منى كل الشكر والتحية، وجزاك الله كل الخير
والسلام عليكم ورحمة الله تعالى وبركاته
[/url]
[/url]
[/url]
[/url]
[/url]
[/url]
[/url]
[/url]
[/url]
[/url]
[/url]
[/url]
[/url]
