تفضل التقرير
ComboFix 08-11-12.01 - 11/13/2008 21:25:11.2 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.2.1256.213.1036.18.565 [GMT 1:00]
Running from: c:\documents and settings\omoumama\Bureau\ComboFix.exe
* Created a new restore point
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\windows\system32\agsaame.dll
c:\windows\system32\ALOAudioFile2.dll
c:\windows\system32\ALOAVIFile.dll
c:\windows\system32\ALOQuickTimeFile.dll
c:\windows\system32\ALOVideoCoreM.dll
c:\windows\system32\ALOWMAFile2.dll
c:\windows\system32\kakle.dll
c:\windows\system32\MCL16.dll
c:\windows\system32\winitn.dll
.
((((((((((((((((((((((((( Files Created from 2008-10-13 to 2008-11-13 )))))))))))))))))))))))))))))))
.
No new files created in this timespan
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-11-13 20:27 --------- d-----w c:\documents and settings\omoumama\Application Data\DMCache
2008-11-13 20:04 --------- d-----w c:\documents and settings\omoumama\Application Data\Skype
2008-11-13 19:04 --------- d-----w c:\documents and settings\omoumama\Application Data\skypePM
2008-11-13 08:07 --------- d-----w c:\program files\DSL Speed
2008-11-12 15:42 --------- d-----w c:\program files\TheWorld 2.0
2008-11-10 17:19 --------- d-----w c:\program files\All To Real Converter
2008-11-10 16:58 --------- d-----w c:\program files\Real
2008-11-09 17:29 --------- d-----w c:\program files\Opera
2008-11-08 22:24 --------- d-----w c:\program files\Ashkon Software
2008-11-08 21:56 --------- d-----w c:\documents and settings\omoumama\Application Data\Meda MP3 Joiner 1.2
2008-11-08 20:44 --------- d-----w c:\program files\MediaJoin
2008-11-08 20:44 --------- d-----w c:\documents and settings\All Users\Application Data\{27ED786F-D773-47F8-93EB-8A249414AD30}
2008-11-08 20:38 --------- d-----w c:\documents and settings\omoumama\Application Data\Seven Zip
2008-11-08 20:02 --------- d-----w c:\program files\Absolute MP3 Splitter
2008-11-08 17:59 --------- d-----w c:\program files\Any Audio Converter
2008-11-07 17:37 --------- d-----w c:\program files\Beyluxe Messenger
2008-11-07 16:37 --------- d-----w c:\documents and settings\omoumama\Application Data\Paltalk
2008-11-07 10:54 --------- d-----w c:\documents and settings\omoumama\Application Data\IDM
2008-11-07 09:54 --------- d-----w c:\documents and settings\omoumama\Application Data\IEPro
2008-11-07 09:50 --------- d-----w c:\documents and settings\omoumama\Application Data\ATI
2008-11-07 09:48 --------- d-----w c:\program files\ONSPEED
2008-11-07 09:47 --------- d-----w c:\documents and settings\omoumama\Application Data\SlipStream
2008-11-07 09:08 --------- d---a-w c:\documents and settings\All Users\Application Data\TEMP
2008-11-06 19:10 --------- d-----w c:\program files\Alt CDA to MP3 Converter
2008-11-06 18:07 --------- d-----w c:\program files\Streambox
2008-11-05 21:51 --------- d-----w c:\program files\Speed4WEB
2008-11-05 20:59 26 ----a-w c:\windows\system32\drivers\adidsl.cfg
2008-11-05 20:59 --------- d--h--w c:\program files\InstallShield Installation Information
2008-11-05 20:59 --------- d-----w c:\program files\Huawei Technologies
2008-11-05 09:34 --------- d-----w c:\program files\All2Chat
2008-11-05 08:48 410,976 ----a-w c:\windows\system32\deploytk.dll
2008-11-05 08:48 --------- d-----w c:\program files\Java
2008-11-04 20:20 --------- d-----w c:\program files\BitComet
2008-11-03 18:17 --------- d-----w c:\documents and settings\omoumama\Application Data\Thinstall
2008-11-01 22:08 --------- d-----w c:\program files\IEPro
2008-11-01 17:29 --------- d-----w c:\documents and settings\omoumama\Application Data\WinPatrol
2008-10-31 15:30 --------- d-----w c:\program files\Salaf_Guide
2008-10-30 18:58 --------- d--h--w c:\program files\GLF1B.tmp
2008-10-29 19:52 90,112 ----a-w c:\windows\system32\agsaami.dll
2008-10-29 19:52 610,304 ----a-w c:\windows\system32\agsaamg.dll
2008-10-29 19:52 372,736 ----a-w c:\windows\system32\agsaamc.dll
2008-10-29 19:52 2,535,424 ----a-w c:\windows\system32\agsaamj.dll
2008-10-29 19:52 196,608 ----a-w c:\windows\system32\maag.dll
2008-10-29 19:52 1,986,560 ----a-w c:\windows\system32\akll.dll
2008-10-29 19:52 1,245,184 ----a-w c:\windows\system32\bkll.dll
2008-10-29 19:52 1,212,416 ----a-w c:\windows\system32\ckll.dll
2008-10-29 19:52 --------- d-----w c:\program files\Real_SC
2008-10-29 19:28 --------- d-----w c:\program files\NCH Swift Sound
2008-10-29 19:23 --------- d-----w c:\program files\Winamp
2008-10-29 15:53 --------- d-----w c:\program files\MP3 WAV Converter
2008-10-29 13:12 90,112 ----a-w c:\windows\system32\ALOAudioFormatSettings3.dll
2008-10-29 13:12 780,288 ----a-w c:\windows\system32\ALOVideoCompress.dll
2008-10-29 13:12 778,240 ----a-w c:\windows\system32\ALOAudioCompress2.dll
2008-10-29 13:12 626,688 ----a-w c:\windows\system32\agsaamh.dll
2008-10-29 13:12 544,256 ----a-w c:\windows\system32\agsaamd.dll
2008-10-29 13:12 538,624 ----a-w c:\windows\system32\agsaamb.dll
2008-10-29 13:12 331,776 ----a-w c:\windows\system32\agsaama.dll
2008-10-29 13:12 215,552 ----a-w c:\windows\system32\ALOWMVFile.dll
2008-10-29 13:12 2,846,720 ----a-w c:\windows\system32\ALOAudioCompress3.dll
2008-10-29 13:12 188,416 ----a-w c:\windows\system32\ALOVideoFile.dll
2008-10-28 22:59 --------- d-----w c:\program files\WheresJames
2008-10-28 20:03 --------- d-----w c:\program files\Internet Download Manager
2008-10-26 11:57 --------- d-----w c:\program files\BitSpirit
2008-10-26 07:24 --------- d-----w c:\documents and settings\omoumama\Application Data\BitSpirit
2008-10-25 16:04 --------- d-----w c:\documents and settings\omoumama\Application Data\inSpeak
2008-10-22 08:40 --------- d-----w c:\program files\أحكام التجويد
2008-10-21 09:30 --------- d-----w c:\program files\Yahoo!
2008-10-21 09:29 --------- d-----w c:\documents and settings\All Users\Application Data\Yahoo!
2008-10-19 20:18 --------- d-----w c:\documents and settings\All Users\Application Data\WinZip
2008-10-17 20:23 --------- d-----w c:\program files\Readiris Pro 11 Mr.Underground Edition
2008-10-17 14:46 --------- d-----w c:\program files\Unlocker
2008-10-17 10:40 --------- d-----w c:\documents and settings\omoumama\Application Data\Stilesoft
2008-10-17 08:46 --------- d-----w c:\documents and settings\omoumama\Application Data\Desktopicon
2008-10-16 19:05 --------- d-----w c:\program files\الموسوعة الطبية
2008-10-16 19:04 737,280 ----a-w c:\windows\iun6002.exe
2008-10-16 08:24 --------- d-----w c:\program files\Ashkon Technology
2008-10-15 17:11 --------- d-----w c:\program files\Photo Resize Magic
2008-10-14 07:53 --------- d-----w c:\program files\IrfanView
2008-10-13 18:31 --------- d-----w c:\program files\Paltalk Messenger
2008-10-12 16:12 --------- d-----w c:\program files\FairStars Recorder
2008-10-12 16:01 --------- d-----w c:\program files\Advanced Mp3 Wma Recorder and Editor
2008-10-12 15:48 --------- d-----w c:\program files\Admiresoft
2008-10-12 15:43 --------- d-----w c:\program files\FormatFactory
2008-10-12 15:42 --------- d-----w c:\documents and settings\omoumama\Application Data\Free Audio Editor
2008-10-10 10:53 --------- d-----w c:\documents and settings\All Users\Application Data\Microsoft Help
2008-10-10 07:48 --------- d-----w c:\program files\NCH Software
2008-10-10 07:47 --------- d-----w c:\documents and settings\All Users\Application Data\NCH Swift Sound
2008-10-10 07:39 --------- d-----w c:\program files\Vimicro
2008-10-08 18:15 --------- d-----w c:\documents and settings\omoumama\Application Data\Avant Profiles
2008-10-08 17:16 --------- d-----w c:\program files\ATI Technologies
2008-10-07 17:58 --------- d-----w c:\program files\BillP Studios
2008-10-07 17:02 --------- d-----w c:\documents and settings\omoumama\Application Data\CyberScrub
2008-10-07 17:02 --------- d-----w c:\documents and settings\omoumama\Application Data\cleaner
2008-10-06 18:55 --------- d-----w c:\program files\Fichiers communs\InstallShield
2008-10-04 19:07 --------- d-----w c:\program files\Superhunter
2008-10-04 11:31 --------- d-----w c:\program files\HiFisoftware
2008-10-04 11:03 73,216 ----a-w c:\windows\ST6UNST.EXE
2008-10-04 11:03 249,856 ------w c:\windows\Setup1.exe
2008-10-04 08:11 --------- d-----w c:\documents and settings\omoumama\Application Data\FairStars Audio Converter
2008-10-04 08:09 --------- d-----w c:\program files\FairStars Audio Converter
.
((((((((((((((((((((((((((((( snapshot@Mon 11-10-2008_17.00.41.06 )))))))))))))))))))))))))))))))))))))))))
.
+ 2005-10-20 19:02:28 163,328 ----a-w c:\windows\ERDNT\subs\ERDNT.EXE
+ 2001-08-29 18:57:40 155,648 ----a-w c:\windows\system32\addurl41.DLL
+ 1996-10-15 08:53:16 78,848 ----a-w c:\windows\system32\INLOADER.DLL
+ 2001-07-10 13:43:16 18,432 ----a-w c:\windows\system32\winwatch.DLL
+ 2008-11-13 20:29:23 16,384 ----atw c:\windows\Temp\Perflib_Perfdata_5f8.dat
+ 2008-11-13 20:29:24 16,384 ----atw c:\windows\Temp\Perflib_Perfdata_b0.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{1b53182f-27cf-4e9e-8efb-8d75d84a244a}"= "c:\program files\Salaf_Guide\tbSala.dll" [09/15/2008 06:47 AM 1784856]
[HKEY_CLASSES_ROOT\clsid\{1b53182f-27cf-4e9e-8efb-8d75d84a244a}]
[HKEY_LOCAL_MACHINE\~\Browser Helper s\{1b53182f-27cf-4e9e-8efb-8d75d84a244a}]
09/15/2008 06:47 AM 1784856 --a------ c:\program files\Salaf_Guide\tbSala.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{1b53182f-27cf-4e9e-8efb-8d75d84a244a}"= "c:\program files\Salaf_Guide\tbSala.dll" [09/15/2008 06:47 AM 1784856]
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{1B53182F-27CF-4E9E-8EFB-8D75D84A244A}"= "c:\program files\Salaf_Guide\tbSala.dll" [09/15/2008 06:47 AM 1784856]
[HKEY_CLASSES_ROOT\clsid\{1b53182f-27cf-4e9e-8efb-8d75d84a244a}]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [08/04/2004 05:54 AM 15360]
"googletalk"="c:\program files\Google\Google Talk\googletalk.exe" [01/01/2007 10:22 PM 3739648]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [08/04/2004 12:07 AM 1667584]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [08/04/2004 03:32 AM 208952]
"PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [08/04/2004 03:32 AM 455168]
"PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [08/04/2004 03:32 AM 455168]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [10/26/2006 11:47 PM 31016]
"HPDJ Taskbar Utility"="c:\windows\system32\spool\drivers\w32x86\3\hpztsb04.exe" [10/12/2001 10:13 AM 196608]
"USB Antivirus"="c:\program files\USB Disk Security\USBGuard.exe" [04/22/2008 03:35 PM 798720]
"BigDogPath"="c:\windows\VM_STI.EXE" [02/28/2005 04:53 PM 53248]
"WinPatrol"="c:\program files\BillP Studios\WinPatrol\winpatrol.exe" [09/19/2008 04:59 AM 333120]
"ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [02/22/2005 08:05 PM 339968]
"ATICCC"="c:\program files\ATI Technologies\ATI.ACE\cli.exe" [02/22/2005 09:21 PM 32768]
"UnlockerAssistant"="c:\program files\Unlocker\UnlockerAssistant.exe" [05/02/2008 05:15 AM 15872]
"!AVG Anti-Spyware"="c:\program files\Grisoft\AVG Anti-Spyware 7.5\zyzoom.exe" [11/03/2007 03:50 AM 6731312]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [11/05/2008 09:48 AM 136600]
"SkyTel"="SkyTel.EXE" [05/16/2006 11:04 AM 2879488 c:\windows\SkyTel.exe]
"RTHDCPL"="RTHDCPL.EXE" [12/19/2006 04:12 AM 16062464 c:\windows\RTHDCPL.EXE]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [08/04/2004 05:54 AM 15360]
"ATICCC"="c:\program files\ATI Technologies\ATI.ACE\cli.exe" [02/22/2005 09:21 PM 32768]
c:\documents and settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
ATI CATALYST System Tray.lnk - c:\program files\ATI Technologies\ATI.ACE\CLI.exe [2005-02-22 32768]
DSLMON.lnk - c:\program files\Huawei Technologies\Huawei SmartAX MT810\dslmon.exe [2008-11-05 929870]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoRecentDocsNetHood"= 0 (0x0)
"NoLogOff"= 0 (0x0)
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.l3acm"= l3codecp.acm
"msacm.speex32"= speex32.acm
"vidc.DIV3"= DIVXc32.dll
"vidc.DIV4"= DIVXc32f.dll
"msacm.divxa32"= DivXa32.acm
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^PalTalk.lnk]
path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\PalTalk.lnk
backup=c:\windows\pss\PalTalk.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^WinZip Quick Pick.lnk]
path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\WinZip Quick Pick.lnk
backup=c:\windows\pss\WinZip Quick Pick.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^omoumama^Menu Démarrer^Programmes^Démarrage^OneNote 2007 Screen Clipper and Launcher.lnk]
path=c:\documents and settings\omoumama\Menu Démarrer\Programmes\Démarrage\OneNote 2007 Screen Clipper and Launcher.lnk
backup=c:\windows\pss\OneNote 2007 Screen Clipper and Launcher.lnkStartup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\!AVG Anti-Spyware]
--a------ 11/03/2007 03:50 AM 6731312 c:\program files\Grisoft\AVG Anti-Spyware 7.5\zyzoom.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
--a------ 01/11/2008 09:16 PM 39792 c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdobeUpdater]
--a------ 11/08/2008 10:30 AM 2356088 c:\program files\Fichiers communs\Adobe\Updater5\AdobeUpdater.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
--------- 08/04/2004 12:07 AM 1667584 c:\program files\Messenger\msmsgs.exe
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Paltalk Messenger\\paltalk.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\Google\\Google Talk\\googletalk.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Windows Media Player\\wmplayer.exe"=
"c:\\Program Files\\IEPro\\MiniDM.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"7744:TCP"= 7744:TCP:BitComet 7744 TCP
"7744:UDP"= 7744:UDP:BitComet 7744 UDP
R0 videX32;videX32;c:\windows\system32\DRIVERS\videX32.sys [10/17/2006 01:22 PM 9216]
R0 xfilt;VIA SATA IDE Hot-plug Driver;c:\windows\system32\DRIVERS\xfilt.sys [10/18/2006 10:39 AM 17920]
R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [07/19/2008 03:35 PM 78416]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\DRIVERS\aswFsBlk.sys [07/19/2008 03:37 PM 20560]
R3 adiusbae;USB ADSL LAN Adapter;c:\windows\system32\DRIVERS\adiusbae.sys [12/01/2003 09:36 AM 117785]
S3 ASPI;Advanced SCSI Programming Interface Driver;c:\windows\System32\DRIVERS\ASPI32.sys [07/17/2002 08:05 AM 16512]
.
.
------- Supplementary Scan -------
.
FireFox -: Profile - c:\documents and settings\omoumama\Application Data\Mozilla\Firefox\Profiles\cpc3mrup.default\
FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://google.atcomet.com/b/
FF -: plugin - c:\program files\Java\jre6\bin\new_plugin\npdeploytk.dll
FF -: plugin - c:\program files\Java\jre6\bin\new_plugin\npjp2.dll
FF -: plugin - c:\program files\Mozilla Firefox\plugins\npdeploytk.dll
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
Rootkit scan 2008-11-13 21:29:49
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
PROCESS: c:\windows\explorer.exe
-> c:\program files\Unlocker\UnlockerHook.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\ati2evxx.exe
c:\program files\Alwil Software\Avast4\aswUpdSv.exe
c:\program files\Alwil Software\Avast4\ashServ.exe
c:\program files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\windows\system32\ati2evxx.exe
c:\program files\Alwil Software\Avast4\ashMaiSv.exe
c:\program files\Alwil Software\Avast4\ashWebSv.exe
c:\program files\Speed4WEB\speed4web.exe
.
**************************************************************************
.
Completion time: 11/13/2008 21:32:17 - machine was rebooted
ComboFix-quarantined-files.txt 2008-11-13 20:32:08
ComboFix2.txt 2008-11-10 16:01:16
Pre-Run: 44,367,724,544 octets libres
Post-Run: 44,376,563,712 octets libres
265
