Alfatron won't start
Solved
itmaoui1
Posted messages
113
Status
Member
-
itmaoui1 Posted messages 113 Status Member -
itmaoui1 Posted messages 113 Status Member -
Hello,
I have a PC brand ALFATRON, I neglected to protect it and now I've encountered many problems; the PC refuses to start even with F8, it displays the following message:
Windows could not start because the following file is missing or corrupt:
<Windows Root>\system32\hal.dll.
Please reinstall a copy of the above file.
And using F8 the computer generates the same problem.
Additionally, the PC is a small laptop, it does not contain a CD or DVD drive, how can I solve the problem?
Thank you in advance
I have a PC brand ALFATRON, I neglected to protect it and now I've encountered many problems; the PC refuses to start even with F8, it displays the following message:
Windows could not start because the following file is missing or corrupt:
<Windows Root>\system32\hal.dll.
Please reinstall a copy of the above file.
And using F8 the computer generates the same problem.
Additionally, the PC is a small laptop, it does not contain a CD or DVD drive, how can I solve the problem?
Thank you in advance
Configuration: Windows XP Internet Explorer 7.0
16 answers
-
Buy a USB CD player and repair Windows.
-
Hello;
thank you for the tip, I managed to install Windows XP on the machine but the PC is so infected that it won't let me install an antivirus, only the Hijackthis seems to work, here's its report
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:55:49, on 05/10/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINDOWS1\System32\smss.exe
C:\WINDOWS1\system32\winlogon.exe
C:\WINDOWS1\system32\services.exe
C:\WINDOWS1\system32\lsass.exe
C:\WINDOWS1\System32\svchost.exe
C:\WINDOWS1\system32\svchost.exe
C:\WINDOWS1\system32\spoolsv.exe
C:\WINDOWS1\system32\svchost.exe
C:\WINDOWS1\system32\wscntfy.exe
C:\WINDOWS1\Explorer.EXE
C:\WINDOWS1\system32\CTFMON.EXE
C:\Documents and Settings\tazebama.dl_
C:\WINDOWS1\service.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Links
O4 - HKLM\..\Run: [Windows Services] service.exe
O4 - HKLM\..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS1\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS1\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS1\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS1\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS1\system32\CTFMON.EXE (User 'Default user')
O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
--
End of file - 1757 bytes
PLEASE tell me what I should do
Thank you-
Good evening
For a more complete report, please do this:
1- Download and install the HijackThis software:
https://www.commentcamarche.net/telecharger/securite/11747-hijackthis/
or here http://www.trendsecure.com/portal/en-US/_download/HJTInstall.exe
or here https://www.clubic.com/telecharger-fiche17891-hijackthis.html
--> Click on the setup to start the installation: follow the prompts and do not change the installation settings.
At the end of the installation, the program launches automatically: close it by clicking on the red cross.
In the end, you should have a shortcut on your desktop and also a path like:
"C:\ program files\Trend Micro\HijackThis\HijackThis.exe " .
(Do not launch this program for now and proceed with the next step...)
2- Download Random's System Information Tool (RSIT) from random/random and save the executable on your Desktop.
-> http://images.malwareremoval.com/random/RSIT.exe
! Disconnect and close all your running applications!
Double-click on " RSIT.exe " to launch it.
Right-click under VISTA (run as...)
-> A first window opens with the title: " Disclaimer of warranty " .
* In front of the option "List files/folders created ...", choose: 2 months
* then click on " Continue " to start the scan ...
-> Let the scan do its job and do not touch the PC ...
When the analysis is finished, two text files will open (probably with Notepad).
Post the content of " log.txt " (the one that appears on the screen), as well as " info.txt " (which you will see in the taskbar), for analysis and wait for the next steps...
Important: post one report, then the other in the next reply...
If you try to post both at the same time, it may take too long for the forum...
( And if "log.txt" alone does not go through either, do it in two parts... thank you... )
( Note: the reports will also be saved in this folder -> C:\rsit )
Thank you
--
We all were once beginners at something.
But knowledge is the reward for diligence.
-
-
Hi;
here is the log report of log.txt
info.txt logfile of random's system information tool 1.06 2009-10-05 20:59:39
======Uninstall list======
-->rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS1\INF\PCHealth.inf
HijackThis 2.0.2-->"C:\Program Files\Trend Micro\HijackThis\HijackThis.exe" /uninstall
Malwarebytes' Anti-Malware-->"C:\Program Files\Malwarebytes' Anti-Malware\unins000.exe"
======System event log======
Computer Name: BENHAMZA-A363EC
Event Code: 60054
Message: The installer successfully installed Windows version 2600.
Record Number: 5
Source Name: Setup
Time Written: 20091005193826.000000+120
Event Type: Information
User:
Computer Name: BENHAMZA-A363EC
Event Code: 15007
Message: The reservation of the namespace identified by the URL prefix http://*:2869/ has been successfully added.
Record Number: 4
Source Name: HTTP
Time Written: 20091005193212.000000+120
Event Type: Information
User:
Computer Name: BENHAMZA-A363EC
Event Code: 6011
Message: The NetBIOS name and the DNS hostname of this computer have been changed from MACHINENAME to BENHAMZA-A363EC.
Record Number: 3
Source Name: EventLog
Time Written: 20091005192745.000000+120
Event Type: Information
User:
Computer Name: MACHINENAME
Event Code: 6005
Message: The Event Registration service has started.
Record Number: 2
Source Name: EventLog
Time Written: 20091005212046.000000+120
Event Type: Information
User:
Computer Name: MACHINENAME
Event Code: 6009
Message: Microsoft (R) Windows (R) 5.01. 2600 Service Pack 2 Multiprocessor Free.
Record Number: 1
Source Name: EventLog
Time Written: 20091005212046.000000+120
Event Type: Information
User:
=====Application event log=====
Computer Name: BENHAMZA-A363EC
Event Code: 1000
Message: Performance counters for the MSDTC service (MSDTC) have been loaded.
The record data contains the new index values
assigned to this service.
Record Number: 5
Source Name: LoadPerf
Time Written: 20091005192940.000000+120
Event Type: Information
User:
Computer Name: BENHAMZA-A363EC
Event Code: 1000
Message: Performance counters for the TermService service (Terminal Server Services) have been loaded.
The record data contains the new index values
assigned to this service.
Record Number: 4
Source Name: LoadPerf
Time Written: 20091005192935.000000+120
Event Type: Information
User:
Computer Name: BENHAMZA-A363EC
Event Code: 1000
Message: Performance counters for the RemoteAccess service (Routing and Remote Access) have been loaded.
The record data contains the new index values
assigned to this service.
Record Number: 3
Source Name: LoadPerf
Time Written: 20091005192837.000000+120
Event Type: Information
User:
Computer Name: BENHAMZA-A363EC
Event Code: 1000
Message: Performance counters for the PSched service (PSched) have been loaded.
The record data contains the new index values
assigned to this service.
Record Number: 2
Source Name: LoadPerf
Time Written: 20091005192800.000000+120
Event Type: Information
User:
Computer Name: BENHAMZA-A363EC
Event Code: 1000
Message: Performance counters for the RSVP service (QoS RSVP) have been loaded.
The record data contains the new index values
assigned to this service.
Record Number: 1
Source Name: LoadPerf
Time Written: 20091005192759.000000+120
Event Type: Information
User:
======Environment variables======
"ComSpec"=%SystemRoot%\system32\cmd.exe
"Path"=%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem
"windir"=%SystemRoot%
"FP_NO_HOST_CHECK"=NO
"OS"=Windows_NT
"PROCESSOR_ARCHITECTURE"=x86
"PROCESSOR_LEVEL"=6
"PROCESSOR_IDENTIFIER"=x86 Family 6 Model 28 Stepping 2, GenuineIntel
"PROCESSOR_REVISION"=1c02
"NUMBER_OF_PROCESSORS"=2
"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
"TEMP"=%SystemRoot%\TEMP
"TMP"=%SystemRoot%\TEMP
-----------------EOF----------------- -
Sorry
Here is half of the log report log.txt
Logfile of random's system information tool 1.06 (written by random/random)
Run by Oumeima at 2009-10-05 20:59:35
Microsoft Windows XP Professional Service Pack 2
System drive C: has 126 GB (86%) free of 146 GB
Total RAM: 1015 MB (78% free)
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20:59:37, on 05/10/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINDOWS1\System32\smss.exe
C:\WINDOWS1\system32\winlogon.exe
C:\WINDOWS1\system32\services.exe
C:\WINDOWS1\system32\lsass.exe
C:\WINDOWS1\System32\svchost.exe
C:\WINDOWS1\system32\svchost.exe
C:\WINDOWS1\system32\spoolsv.exe
C:\WINDOWS1\system32\svchost.exe
C:\WINDOWS1\system32\wscntfy.exe
C:\WINDOWS1\Explorer.EXE
C:\WINDOWS1\system32\CTFMON.EXE
C:\Documents and Settings\tazebama.dl_
C:\WINDOWS1\service.exe
C:\Documents and Settings\Oumeima\Desktop\RSIT.exe
C:\Program Files\Trend Micro\HijackThis\Oumeima.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Links
O4 - HKLM\..\Run: [Windows Services] service.exe
O4 - HKLM\..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS1\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS1\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS1\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS1\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS1\system32\CTFMON.EXE (User 'Default user')
O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menu item: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
--
End of file - 1805 bytes
======Registry dump======
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"Windows Services"=C:\WINDOWS1\service.exe [2009-07-13 71680]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"Malwarebytes' Anti-Malware"=C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe [2009-09-10 489808]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"=C:\WINDOWS1\system32\ctfmon.exe [2004-08-04 15360]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"DisableTaskMgr"=1
"DisableRegistryTools"=1
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
"EnableLUA"=0
"DisableTaskMgr"=0
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoFolderOptions"=0
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoFolderOptions"=
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe"="C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe:*:Enabled:ipsec"
"C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe"="C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe:*:Enabled:ipsec"
"C:\WINDOWS1\Explorer.EXE"="C:\WINDOWS1\Explorer.EXE:*:Enabled:ipsec"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{2fe02a18-b1d6-11de-8858-e655658d3f05}]
shell\AutoRun\command - G:\RECYCLER\S-1-6-21-2434476501-1644491937-600003330-1213\svchost.exe
shell\open\command - G:\RECYCLER\S-1-6-21-2434476501-1644491937-600003330-1213\svchost.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{56647dd4-b1e3-11de-814a-806d6172696f}]
shell\AutoRun\command - F:\setup.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{56647dd7-b1e3-11de-814a-806d6172696f}]
shell\AutoRun\command - C:\zPharaoh.exe
shell\explore\command - C:\zPharaoh.exe
shell\open\command - C:\zPharaoh.exe
======List of files/folders created in the last 2 months======
2009-10-05 21:27:34 ----A---- C:\WINDOWS1\system32\h323log.txt
2009-10-05 21:25:19 ----A---- C:\WINDOWS1\system32\vfwwdm32.dll
2009-10-05 21:25:19 ----A---- C:\WINDOWS1\system32\ksuser.dll
2009-10-05 21:24:08 ----A---- C:\WINDOWS1\system32\usbui.dll
2009-10-05 21:21:57 ----SHD---- C:\WINDOWS1\Installer
2009-10-05 21:21:57 ----A---- C:\WINDOWS1\system32\PerfStringBackup.INI
2009-10-05 21:21:56 ----A---- C:\WINDOWS1\ODBCINST.INI
2009-10-05 21:21:48 ----RA---- C:\WINDOWS1\system32\kbdtuq.dll
2009-10-05 21:21:48 ----RA---- C:\WINDOWS1\system32\kbdtuf.dll
2009-10-05 21:21:48 ----RA---- C:\WINDOWS1\system32\kbdazel.dll
2009-10-05 21:21:46 ----RA---- C:\WINDOWS1\system32\kbdycc.dll
2009-10-05 21:21:46 ----RA---- C:\WINDOWS1\system32\kbduzb.dll
2009-10-05 21:21:46 ----RA---- C:\WINDOWS1\system32\kbdur.dll
2009-10-05 21:21:46 ----RA---- C:\WINDOWS1\system32\kbdtat.dll
2009-10-05 21:21:46 ----RA---- C:\WINDOWS1\system32\kbdru1.dll
2009-10-05 21:21:46 ----RA---- C:\WINDOWS1\system32\kbdru.dll
2009-10-05 21:21:46 ----RA---- C:\WINDOWS1\system32\kbdmon.dll
2009-10-05 21:21:46 ----RA---- C:\WINDOWS1\system32\kbdkyr.dll
2009-10-05 21:21:46 ----RA---- C:\WINDOWS1\system32\kbdkaz.dll
2009-10-05 21:21:46 ----RA---- C:\WINDOWS1\system32\kbdbu.dll
2009-10-05 21:21:46 ----RA---- C:\WINDOWS1\system32\kbdblr.dll
2009-10-05 21:21:46 ----RA---- C:\WINDOWS1\system32\kbdaze.dll
2009-10-05 21:21:44 ----RA---- C:\WINDOWS1\system32\kbdhept.dll
2009-10-05 21:21:44 ----RA---- C:\WINDOWS1\system32\kbdhela3.dll
2009-10-05 21:21:44 ----RA---- C:\WINDOWS1\system32\kbdhela2.dll
2009-10-05 21:21:44 ----RA---- C:\WINDOWS1\system32\kbdhe319.dll
2009-10-05 21:21:44 ----RA---- C:\WINDOWS1\system32\kbdhe220.dll
2009-10-05 21:21:44 ----RA---- C:\WINDOWS1\system32\kbdhe.dll
2009-10-05 21:21:44 ----RA---- C:\WINDOWS1\system32\kbdgkl.dll
2009-10-05 21:21:43 ----RA---- C:\WINDOWS1\system32\kbdlv1.dll
2009-10-05 21:21:43 ----RA---- C:\WINDOWS1\system32\kbdlv.dll
2009-10-05 21:21:43 ----RA---- C:\WINDOWS1\system32\kbdlt1.dll
2009-10-05 21:21:43 ----RA---- C:\WINDOWS1\system32\kbdlt.dll
2009-10-05 21:21:43 ----RA---- C:\WINDOWS1\system32\kbdest.dll
2009-10-05 21:21:41 ----RA---- C:\WINDOWS1\system32\kbdsl1.dll
2009-10-05 21:21:41 ----RA---- C:\WINDOWS1\system32\kbdsl.dll
2009-10-05 21:21:41 ----RA---- C:\WINDOWS1\system32\kbdro.dll
2009-10-05 21:21:41 ----RA---- C:\WINDOWS1\system32\kbdpl1.dll
2009-10-05 21:21:41 ----RA---- C:\WINDOWS1\system32\kbdpl.dll
2009-10-05 21:21:41 ----RA---- C:\WINDOWS1\system32\kbdhu1.dll
2009-10-05 21:21:41 ----RA---- C:\WINDOWS1\system32\kbdhu.dll
2009-10-05 21:21:41 ----RA---- C:\WINDOWS1\system32\kbdcz2.dll
2009-10-05 21:21:40 ----RA---- C:\WINDOWS1\system32\kbdycl.dll
2009-10-05 21:21:40 ----RA---- C:\WINDOWS1\system32\kbdcz1.dll
2009-10-05 21:21:40 ----RA---- C:\WINDOWS1\system32\kbdcz.dll
2009-10-05 21:21:40 ----RA---- C:\WINDOWS1\system32\kbdcr.dll
2009-10-05 21:21:40 ----RA---- C:\WINDOWS1\system32\KBDAL.DLL
2009-10-05 21:21:37 ----A---- C:\WINDOWS1\system32\irclass.dll
2009-10-05 21:21:37 ----A---- C:\WINDOWS1\system32\dgsetup.dll
2009-10-05 21:21:37 ----A---- C:\WINDOWS1\system32\dgrpsetu.dll
2009-10-05 21:21:36 ----A---- C:\WINDOWS1\system32\spxcoins.dll
2009-10-05 21:21:36 ----A---- C:\WINDOWS1\system32\EqnClass.Dll
2009-10-05 21:21:34 ----N---- C:\WINDOWS1\system32\CONFIG.TMP
2009-10-05 21:21:34 ----A---- C:\WINDOWS1\TASKMAN.EXE
2009-10-05 21:21:34 ----A---- C:\WINDOWS1\system32\batt.dll
2009-10-05 21:21:33 ----A---- C:\WINDOWS1\NOTEPAD.EXE
2009-10-05 21:21:32 ----A---- C:\WINDOWS1\system32\storprop.dll
2009-10-05 21:21:21 ----ASH---- C:\Documents and Settings\All Users.WINDOWS1\Application Data\desktop.ini
2009-10-05 21:21:16 ----RA---- C:\WINDOWS1\SET8.tmp
2009-10-05 21:21:13 ----RA---- C:\WINDOWS1\SET4.tmp
2009-10-05 21:21:12 ----RA---- C:\WINDOWS1\SET3.tmp
2009-10-05 21:21:07 ----D---- C:\WINDOWS1\system32\CatRoot2
2009-10-05 21:21:07 ----D---- C:\WINDOWS1\system32\CatRoot
2009-10-05 21:21:00 ----SD---- C:\Documents and Settings\All Users.WINDOWS1\Application Data\Microsoft
2009-10-05 21:20:41 ----A---- C:\WINDOWS1\setuplog.txt
2009-10-05 21:19:52 ----SH---- C:\boot.ini
2009-10-05 21:17:07 ----RSHDC---- C:\WINDOWS1\system32\dllcache
2009-10-05 21:17:07 ----RSD---- C:\WINDOWS1\Fonts
2009-10-05 21:17:07 ----RD---- C:\WINDOWS1\Web
2009-10-05 21:17:07 ----HD---- C:\WINDOWS1\inf
2009-10-05 21:17:07 ----D---- C:\WINDOWS1\WinSxS
2009-10-05 21:17:07 ----D---- C:\WINDOWS1\twain_32
2009-10-05 21:17:07 ----D---- C:\WINDOWS1\Temp
2009-10-05 21:17:07 ----D---- C:\WINDOWS1\system32\wins
2009-10-05 21:17:07 ----D---- C:\WINDOWS1\system32\wbem
2009-10-05 21:17:07 ----D---- C:\WINDOWS1\system32\usmt
2009-10-05 21:17:07 ----D---- C:\WINDOWS1\system32\spool
2009-10-05 21:17:07 ----D---- C:\WINDOWS1\system32\ShellExt
2009-10-05 21:17:07 ----D---- C:\WINDOWS1\system32\Setup
2009-10-05 21:17:07 ----D---- C:\WINDOWS1\system32\ras
2009-10-05 21:17:07 ----D---- C:\WINDOWS1\system32\oobe
2009-10-05 21:17:07 ----D---- C:\WINDOWS1\system32\npp
2009-10-05 21:17:07 ----D---- C:\WINDOWS1\system32\mui
2009-10-05 21:17:07 ----D---- C:\WINDOWS1\system32\inetsrv
2009-10-05 21:17:07 ----D---- C:\WINDOWS1\system32\IME
2009-10-05 21:17:07 ----D---- C:\WINDOWS1\system32\icsxml
2009-10-05 21:17:07 ----D---- C:\WINDOWS1\system32\ias
2009-10-05 21:17:07 ----D---- C:\WINDOWS1\system32\export
2009-10-05 21:17:07 ----D---- C:\WINDOWS1\system32\drivers
2009-10-05 21:17:07 ----D---- C:\WINDOWS1\system32\dhcp
2009-10-05 21:17:07 ----D---- C:\WINDOWS1\system32\config
2009-10-05 21:17:07 ----D---- C:\WINDOWS1\system32\3com_dmi
2009-10-05 21:17:07 ----D---- C:\WINDOWS1\system32\3076
2009-10-05 21:17:07 ----D---- C:\WINDOWS1\system32\2052
2009-10-05 21:17:07 ----D---- C:\WINDOWS1\system32\1054
2009-10-05 21:17:07 ----D---- C:\WINDOWS1\system32\1042
2009-10-05 21:17:07 ----D---- C:\WINDOWS1\system32\1041
2009-10-05 21:17:07 ----D---- C:\WINDOWS1\system32\1037
2009-10-05 21:17:07 ----D---- C:\WINDOWS1\system32\1036
2009-10-05 21:17:07 ----D---- C:\WINDOWS1\system32\1033
2009-10-05 21:17:07 ----D---- C:\WINDOWS1\system32\1031
2009-10-05 21:17:07 ----D---- C:\WINDOWS1\system32\1028
2009-10-05 21:17:07 ----D---- C:\WINDOWS1\system32\1025
2009-10-05 21:17:07 ----D---- C:\WINDOWS1\system32
2009-10-05 21:17:07 ----D---- C:\WINDOWS1\system
2009-10-05 21:17:07 ----D---- C:\WINDOWS1\security
2009-10-05 21:17:07 ----D---- C:\WINDOWS1\Resources
2009-10-05 21:17:07 ----D---- C:\WINDOWS1\repair
2009-10-05 21:17:07 ----D---- C:\WINDOWS1\Provisioning
2009-10-05 21:17:07 ----D---- C:\WINDOWS1\PeerNet
2009-10-05 21:17:07 ----D---- C:\WINDOWS1\pchealth
2009-10-05 21:17:07 ----D---- C:\WINDOWS1\mui
2009-10-05 21:17:07 ----D---- C:\WINDOWS1\msapps
2009-10-05 21:17:07 ----D---- C:\WINDOWS1\msagent
2009-10-05 21:17:07 ----D---- C:\WINDOWS1\Media
2009-10-05 21:17:07 ----D---- C:\WINDOWS1\java
2009-10-05 21:17:07 ----D---- C:\WINDOWS1\ime
2009-10-05 21:17:07 ----D---- C:\WINDOWS1\Help
2009-10-05 21:17:07 ----D---- C:\WINDOWS1\ehome
2009-10-05 21:17:07 ----D---- C:\WINDOWS1\Driver Cache
2009-10-05 21:17:07 ----D---- C:\WINDOWS1\Debug
2009-10-05 21:17:07 ----D---- C:\WINDOWS1\Cursors
2009-10-05 21:17:07 ----D---- C:\WINDOWS1\Connection Wizard
2009-10-05 21:17:07 ----D---- C:\WINDOWS1\Config
2009-10-05 21:17:07 ----D---- C:\WINDOWS1\AppPatch
2009-10-05 21:17:07 ----D---- C:\WINDOWS1\addins
2009-10-05 21:17:07 ----D---- C:\WINDOWS1
2009-10-05 20:59:35 ----D---- C:\rsit
2009-10-05 19:54:19 ----RSH---- C:\WINDOWS1\service.exe
2009-10-05 19:46:12 ----D---- C:\Documents and Settings\Oumeima\Application Data\Malwarebytes
2009-10-05 19:46:08 ----D---- C:\Documents and Settings\Oumeima\Application Data\tazebama
2009-10-05 19:45:48 ----D---- C:\Documents and Settings\All Users.WINDOWS1\Application Data\Malwarebytes
2009-10-05 19:40:42 ----D---- C:\Documents and Settings\Oumeima\Application Data\Identities
2009-10-05 19:40:31 ----ASH---- C:\Documents and Settings\Oumeima\Application Data\desktop.ini
2009-10-05 19:40:30 ----SD---- C:\Documents and Settings\Oumeima\Application Data\Microsoft
2009-10-05 19:39:37 ----D---- C:\WINDOWS1\SoftwareDistribution -
the second half here
2009-10-05 19:39:34 ----D---- C:\WINDOWS1\Prefetch
2009-10-05 19:39:33 ----SD---- C:\WINDOWS1\system32\Microsoft
2009-10-05 19:39:33 ----A---- C:\WINDOWS1\SchedLgU.Txt
2009-10-05 19:34:40 ----D---- C:\WINDOWS1\system32\xircom
2009-10-05 19:34:13 ----A---- C:\WINDOWS1\control.ini
2009-10-05 19:33:56 ----A---- C:\WINDOWS1\OEWABLog.txt
2009-10-05 19:33:50 ----A---- C:\WINDOWS1\system32\mapi32.dll
2009-10-05 19:32:33 ----SD---- C:\WINDOWS1\Downloaded Program Files
2009-10-05 19:32:33 ----RD---- C:\WINDOWS1\Offline Web Pages
2009-10-05 19:32:33 ----RAH---- C:\WINDOWS1\system32\logonui.exe.manifest
2009-10-05 19:32:22 ----RAH---- C:\WINDOWS1\system32\cdplayer.exe.manifest
2009-10-05 19:31:49 ----D---- C:\WINDOWS1\system32\DirectX
2009-10-05 19:31:31 ----A---- C:\WINDOWS1\system32\atrace.dll
2009-10-05 19:31:29 ----A---- C:\WINDOWS1\system32\desktop.ini
2009-10-05 19:31:29 ----A---- C:\WINDOWS1\desktop.ini
2009-10-05 19:31:24 ----A---- C:\WINDOWS1\system32\nmevtmsg.dll
2009-10-05 19:31:23 ----SD---- C:\WINDOWS1\Tasks
2009-10-05 19:31:23 ----A---- C:\WINDOWS1\system32\icfgnt5.dll
2009-10-05 19:31:23 ----A---- C:\WINDOWS1\system32\acctres.dll
2009-10-05 19:31:21 ----D---- C:\WINDOWS1\srchasst
2009-10-05 19:31:20 ----D---- C:\WINDOWS1\system32\Macromed
2009-10-05 19:31:17 ----A---- C:\WINDOWS1\system32\wuweb.dll
2009-10-05 19:31:17 ----A---- C:\WINDOWS1\system32\wups.dll
2009-10-05 19:31:17 ----A---- C:\WINDOWS1\system32\wucltui.dll
2009-10-05 19:31:17 ----A---- C:\WINDOWS1\system32\wuauserv.dll
2009-10-05 19:31:17 ----A---- C:\WINDOWS1\system32\wuaueng1.dll
2009-10-05 19:31:17 ----A---- C:\WINDOWS1\system32\wuaueng.dll
2009-10-05 19:31:17 ----A---- C:\WINDOWS1\system32\wuauclt1.exe
2009-10-05 19:31:17 ----A---- C:\WINDOWS1\system32\wuauclt.exe
2009-10-05 19:31:17 ----A---- C:\WINDOWS1\system32\wuapi.dll
2009-10-05 19:31:16 ----A---- C:\WINDOWS1\system32\qmgrprxy.dll
2009-10-05 19:31:16 ----A---- C:\WINDOWS1\system32\qmgr.dll
2009-10-05 19:31:16 ----A---- C:\WINDOWS1\system32\bitsprx3.dll
2009-10-05 19:31:16 ----A---- C:\WINDOWS1\system32\bitsprx2.dll
2009-10-05 19:31:11 ----A---- C:\WINDOWS1\system32\safrslv.dll
2009-10-05 19:31:11 ----A---- C:\WINDOWS1\system32\safrdm.dll
2009-10-05 19:31:11 ----A---- C:\WINDOWS1\system32\safrcdlg.dll
2009-10-05 19:31:11 ----A---- C:\WINDOWS1\system32\racpldlg.dll
2009-10-05 19:31:09 ----D---- C:\WINDOWS1\system32\Restore
2009-10-05 19:31:09 ----A---- C:\WINDOWS1\system32\srrstr.dll
2009-10-05 19:31:09 ----A---- C:\WINDOWS1\system32\fltMc.exe
2009-10-05 19:31:09 ----A---- C:\WINDOWS1\system32\fltlib.dll
2009-10-05 19:31:08 ----A---- C:\WINDOWS1\system32\srsvc.dll
2009-10-05 19:31:08 ----A---- C:\WINDOWS1\system32\srclient.dll
2009-10-05 19:31:08 ----A---- C:\WINDOWS1\system32\nmmkcert.dll
2009-10-05 19:31:08 ----A---- C:\WINDOWS1\system32\mnmdd.dll
2009-10-05 19:31:08 ----A---- C:\WINDOWS1\system32\isrdbg32.dll
2009-10-05 19:31:08 ----A---- C:\WINDOWS1\system32\ils.dll
2009-10-05 19:31:07 ----A---- C:\WINDOWS1\system32\msconf.dll
2009-10-05 19:31:07 ----A---- C:\WINDOWS1\system32\mnmsrvc.exe
2009-10-05 19:31:04 ----A---- C:\WINDOWS1\system32\msoert2.dll
2009-10-05 19:31:04 ----A---- C:\WINDOWS1\system32\msoeacct.dll
2009-10-05 19:31:03 ----A---- C:\WINDOWS1\system32\inetres.dll
2009-10-05 19:31:03 ----A---- C:\WINDOWS1\system32\inetcomm.dll
2009-10-05 19:31:02 ----A---- C:\WINDOWS1\system32\schedsvc.dll
2009-10-05 19:31:02 ----A---- C:\WINDOWS1\system32\mstinit.exe
2009-10-05 19:31:02 ----A---- C:\WINDOWS1\system32\mstask.dll
2009-10-05 19:31:01 ----A---- C:\WINDOWS1\system32\isign32.dll
2009-10-05 19:31:01 ----A---- C:\WINDOWS1\system32\inetcfg.dll
2009-10-05 19:31:01 ----A---- C:\WINDOWS1\system32\icwphbk.dll
2009-10-05 19:31:01 ----A---- C:\WINDOWS1\system32\icwdial.dll
2009-10-05 19:29:53 ----A---- C:\WINDOWS1\vbaddin.ini
2009-10-05 19:29:53 ----A---- C:\WINDOWS1\vb.ini
2009-10-05 19:29:46 ----D---- C:\WINDOWS1\Registration
2009-10-05 19:29:28 ----A---- C:\WINDOWS1\system32\write.exe
2009-10-05 19:29:21 ----A---- C:\WINDOWS1\system32\winchat.exe
2009-10-05 19:29:21 ----A---- C:\WINDOWS1\system32\sndvol32.exe
2009-10-05 19:29:21 ----A---- C:\WINDOWS1\system32\hticons.dll
2009-10-05 19:29:21 ----A---- C:\WINDOWS1\system32\avwav.dll
2009-10-05 19:29:21 ----A---- C:\WINDOWS1\system32\avtapi.dll
2009-10-05 19:29:21 ----A---- C:\WINDOWS1\system32\avmeter.dll
2009-10-05 19:29:14 ----A---- C:\WINDOWS1\system32\getuname.dll
2009-10-05 19:29:14 ----A---- C:\WINDOWS1\system32\charmap.exe
2009-10-05 19:29:14 ----A---- C:\WINDOWS1\system32\calc.exe
2009-10-05 19:29:13 ----A---- C:\WINDOWS1\system32\winmine.exe
2009-10-05 19:29:13 ----A---- C:\WINDOWS1\system32\usrlogon.cmd
2009-10-05 19:29:13 ----A---- C:\WINDOWS1\system32\sol.exe
2009-10-05 19:29:13 ----A---- C:\WINDOWS1\system32\reset.exe
2009-10-05 19:29:13 ----A---- C:\WINDOWS1\system32\mshearts.exe
2009-10-05 19:29:13 ----A---- C:\WINDOWS1\system32\freecell.exe
2009-10-05 19:29:12 ----A---- C:\WINDOWS1\system32\tsshutdn.exe
2009-10-05 19:29:12 ----A---- C:\WINDOWS1\system32\tslabels.ini
2009-10-05 19:29:12 ----A---- C:\WINDOWS1\system32\tskill.exe
2009-10-05 19:29:12 ----A---- C:\WINDOWS1\system32\tsdiscon.exe
2009-10-05 19:29:12 ----A---- C:\WINDOWS1\system32\tscon.exe
2009-10-05 19:29:12 ----A---- C:\WINDOWS1\system32\shadow.exe
2009-10-05 19:29:12 ----A---- C:\WINDOWS1\system32\rwinsta.exe
2009-10-05 19:29:12 ----A---- C:\WINDOWS1\system32\regini.exe
2009-10-05 19:29:12 ----A---- C:\WINDOWS1\system32\rdpcfgex.dll
2009-10-05 19:29:12 ----A---- C:\WINDOWS1\system32\qwinsta.exe
2009-10-05 19:29:12 ----A---- C:\WINDOWS1\system32\qappsrv.exe
2009-10-05 19:29:12 ----A---- C:\WINDOWS1\system32\msg.exe
2009-10-05 19:29:12 ----A---- C:\WINDOWS1\system32\logoff.exe
2009-10-05 19:29:12 ----A---- C:\WINDOWS1\system32\cdmodem.dll
2009-10-05 19:29:11 ----A---- C:\WINDOWS1\system32\mtxlegih.dll
2009-10-05 19:29:11 ----A---- C:\WINDOWS1\system32\mtxex.dll
2009-10-05 19:29:11 ----A---- C:\WINDOWS1\system32\mtxdm.dll
2009-10-05 19:29:11 ----A---- C:\WINDOWS1\system32\msdtcprf.ini
2009-10-05 19:29:11 ----A---- C:\WINDOWS1\system32\dcomcnfg.exe
2009-10-05 19:29:11 ----A---- C:\WINDOWS1\system32\comrepl.dll
2009-10-05 19:29:11 ----A---- C:\WINDOWS1\system32\comaddin.dll
2009-10-05 19:29:10 ----A---- C:\WINDOWS1\system32\stclient.dll
2009-10-05 19:29:10 ----A---- C:\WINDOWS1\system32\comsnap.dll
2009-10-05 19:29:05 ----A---- C:\WINDOWS1\system32\wmimgmt.msc
2009-10-05 19:29:01 ----A---- C:\WINDOWS1\system32\sndrec32.exe
2009-10-05 19:29:01 ----A---- C:\WINDOWS1\system32\mplay32.exe
2009-10-05 19:29:01 ----A---- C:\WINDOWS1\system32\hypertrm.dll
2009-10-05 19:29:01 ----A---- C:\WINDOWS1\system32\accwiz.exe
2009-10-05 19:29:00 ----A---- C:\WINDOWS1\system32\spider.exe
2009-10-05 19:29:00 ----A---- C:\WINDOWS1\system32\mspaint.exe
2009-10-05 19:29:00 ----A---- C:\WINDOWS1\system32\clipbrd.exe
2009-10-05 19:28:59 ----A---- C:\WINDOWS1\system32\tscfgwmi.dll
2009-10-05 19:28:59 ----A---- C:\WINDOWS1\system32\sessmgr.exe
2009-10-05 19:28:59 ----A---- C:\WINDOWS1\system32\remotepg.dll
2009-10-05 19:28:59 ----A---- C:\WINDOWS1\system32\rdshost.exe
2009-10-05 19:28:59 ----A---- C:\WINDOWS1\system32\rdsaddin.exe
2009-10-05 19:28:59 ----A---- C:\WINDOWS1\system32\rdchost.dll
2009-10-05 19:28:59 ----A---- C:\WINDOWS1\system32\mstscax.dll
2009-10-05 19:28:59 ----A---- C:\WINDOWS1\system32\mstsc.exe
2009-10-05 19:28:58 ----D---- C:\WINDOWS1\system32\MsDtc
2009-10-05 19:28:58 ----A---- C:\WINDOWS1\system32\tscupgrd.exe
2009-10-05 19:28:58 ----A---- C:\WINDOWS1\system32\termsrv.dll
2009-10-05 19:28:58 ----A---- C:\WINDOWS1\system32\rdpwsx.dll
2009-10-05 19:28:58 ----A---- C:\WINDOWS1\system32\rdpsnd.dll
2009-10-05 19:28:58 ----A---- C:\WINDOWS1\system32\rdpclip.exe
2009-10-05 19:28:58 ----A---- C:\WINDOWS1\system32\qprocess.exe
2009-10-05 19:28:58 ----A---- C:\WINDOWS1\system32\mtxoci.dll
2009-10-05 19:28:58 ----A---- C:\WINDOWS1\system32\msdtcuiu.dll
2009-10-05 19:28:58 ----A---- C:\WINDOWS1\system32\icaapi.dll
2009-10-05 19:28:58 ----A---- C:\WINDOWS1\system32\cfgbkend.dll
2009-10-05 19:28:57 ----A---- C:\WINDOWS1\system32\xolehlp.dll
2009-10-05 19:28:57 ----A---- C:\WINDOWS1\system32\msdtctm.dll
2009-10-05 19:28:57 ----A---- C:\WINDOWS1\system32\msdtcprx.dll
2009-10-05 19:28:57 ----A---- C:\WINDOWS1\system32\msdtclog.dll
2009-10-05 19:28:57 ----A---- C:\WINDOWS1\system32\msdtc.exe
2009-10-05 19:28:56 ----D---- C:\WINDOWS1\system32\Com
2009-10-05 19:28:56 ----A---- C:\WINDOWS1\system32\comuid.dll
2009-10-05 19:28:56 ----A---- C:\WINDOWS1\system32\comsvcs.dll
2009-10-05 19:28:56 ----A---- C:\WINDOWS1\system32\colbact.dll
2009-10-05 19:28:56 ----A---- C:\WINDOWS1\system32\clbcatex.dll
2009-10-05 19:28:56 ----A---- C:\WINDOWS1\system32\catsrvut.dll
2009-10-05 19:28:56 ----A---- C:\WINDOWS1\system32\catsrvps.dll
2009-10-05 19:28:56 ----A---- C:\WINDOWS1\system32\catsrv.dll
2009-10-05 19:28:55 ----A---- C:\WINDOWS1\system32\clbcatq.dll
2009-10-05 19:28:51 ----A---- C:\WINDOWS1\system32\servdeps.dll
2009-10-05 19:28:50 ----A---- C:\WINDOWS1\system32\mmfutil.dll
2009-10-05 19:28:50 ----A---- C:\WINDOWS1\system32\licwmi.dll
2009-10-05 19:28:50 ----A---- C:\WINDOWS1\system32\cmprops.dll
2009-09-30 12:03:11 ----SHD---- C:\Config.Msi
2009-09-30 10:52:23 ----D---- C:\Program Files\Dachshund Software
2009-09-30 10:41:40 ----D---- C:\Program Files\Advanced System Optimizer
2009-09-27 10:08:57 ----RASH---- C:\logoneui.exe
2009-09-27 10:08:57 ----A---- C:\Jojo.exe
2009-09-27 09:56:18 ----D---- C:\Program Files\Seagate Software
2009-09-27 09:56:17 ----D---- C:\Program Files\MapInfo
2009-09-24 10:19:04 ----D---- C:\Program Files\AMT
2009-09-24 10:07:55 ----RSH---- C:\zPharaoh.exe
2009-09-17 15:40:19 ----D---- C:\Program Files\CCleaner
2009-09-17 15:10:43 ----D---- C:\Program Files\Trend Micro
2009-09-17 14:33:05 ----D---- C:\Program Files\Malwarebytes' Anti-Malware
2009-09-17 14:31:14 ----D---- C:\Program Files\Yahoo!
2009-09-15 19:12:31 ----D---- C:\Program Files\Kaspersky Lab
2009-09-15 19:04:08 ----D---- C:\Program Files\TuneUp Utilities 2007
2009-09-15 18:56:30 ----D---- C:\Program Files\Fichiers communs\Wise Installation Wizard
2009-09-15 00:51:42 ----D---- C:\Program Files\R
2009-09-14 22:42:53 ----A---- C:\info.bat
2009-09-12 19:46:59 ----D---- C:\Program Files\Internet Download Manager
======List of files/folders modified in the last 2 months======
2009-10-05 20:56:42 ----SHD---- C:\RECYCLER
2009-10-05 20:56:19 ----D---- C:\Program Files\Windows Media Player
2009-10-05 19:51:41 ----D---- C:\Program Files\Outlook Express
2009-10-05 19:51:41 ----D---- C:\Program Files\Internet Explorer
2009-10-05 19:46:34 ----D---- C:\Program Files\Movie Maker
2009-10-05 19:46:26 ----D---- C:\Program Files\Windows NT
2009-10-05 19:46:26 ----D---- C:\Program Files\NetMeeting
2009-10-05 19:45:49 ----A---- C:\WINDOWS1\system.ini
2009-10-05 19:40:30 ----D---- C:\Documents and Settings
2009-10-05 19:39:37 ----SHD---- C:\System Volume Information
2009-10-05 19:34:12 ----A---- C:\WINDOWS1\win.ini
2009-10-05 19:32:37 ----RD---- C:\Program Files
2009-10-05 19:31:04 ----D---- C:\Program Files\Fichiers communs\System
2009-10-05 19:29:29 ----D---- C:\Program Files\Messenger
2009-09-30 15:05:12 ----D---- C:\WINDOWS
2009-09-15 18:56:30 ----D---- C:\Program Files\Fichiers communs
2009-09-05 15:32:56 ----HD---- C:\Program Files\InstallShield Installation Information
======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
R1 intelppm;Intel processor driver; C:\WINDOWS1\system32\DRIVERS\intelppm.sys [2004-08-04 40320]
R3 abp470n5;abp470n5; \??\C:\WINDOWS1\system32\drivers\jgrlon.sys []
R3 CmBatt;Microsoft ACPI compliant control method battery driver; C:\WINDOWS1\system32\DRIVERS\CmBatt.sys [2004-08-04 14080]
R3 usbccgp;Microsoft USB Generic Parent Driver; C:\WINDOWS1\system32\DRIVERS\usbccgp.sys [2004-08-04 31616]
R3 usbehci;Microsoft USB 2.0 Enhanced Host Controller Miniport Driver; C:\WINDOWS1\system32\DRIVERS\usbehci.sys [2004-08-04 26624]
R3 usbhub;USB2 Hub; C:\WINDOWS1\system32\DRIVERS\usbhub.sys [2004-08-04 57600]
R3 usbstor;USB Mass Storage Driver; C:\WINDOWS1\system32\DRIVERS\USBSTOR.SYS [2004-08-04 26496]
R3 usbuhci;Microsoft Universal Host Controller Miniport Driver; C:\WINDOWS1\system32\DRIVERS\usbuhci.sys [2004-08-04 20480]
R3 usbvideo;USB Video Device (WDM); C:\WINDOWS1\System32\Drivers\usbvideo.sys [2004-08-04 78464]
S3 CCDECODE;Closed Caption Decoder; C:\WINDOWS1\system32\DRIVERS\CCDECODE.sys [2004-08-04 17024]
S3 MSTEE;Microsoft Site-to-Site Bridging Converter; C:\WINDOWS1\system32\drivers\MSTEE.sys [2004-08-04 5504]
S3 NABTSFEC;NABTS/FEC VBI Codec; C:\WINDOWS1\system32\DRIVERS\NABTSFEC.sys [2004-08-04 85376]
S3 NdisIP;Microsoft TV/Video Connection; C:\WINDOWS1\system32\DRIVERS\NdisIP.sys [2004-08-04 10880]
S3 SLIP;BDA Slipstreamer; C:\WINDOWS1\system32\DRIVERS\SLIP.sys [2004-08-04 11136]
S3 streamip;BDA IPSink; C:\WINDOWS1\system32\DRIVERS\StreamIP.sys [2004-08-04 15360]
S3 WSTCODEC;Standard Teletext Codec; C:\WINDOWS1\system32\DRIVERS\WSTCODEC.SYS [2004-08-04 19328]
S4 IntelIde;IntelIde; C:\WINDOWS1\system32\drivers\IntelIde.sys []
======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
All services whitelisted
-----------------EOF----------------- -
the second half here
2009-10-05 19:39:34 ----D---- C:\WINDOWS1\Prefetch
2009-10-05 19:39:33 ----SD---- C:\WINDOWS1\system32\Microsoft
2009-10-05 19:39:33 ----A---- C:\WINDOWS1\SchedLgU.Txt
2009-10-05 19:34:40 ----D---- C:\WINDOWS1\system32\xircom
2009-10-05 19:34:13 ----A---- C:\WINDOWS1\control.ini
2009-10-05 19:33:56 ----A---- C:\WINDOWS1\OEWABLog.txt
2009-10-05 19:33:50 ----A---- C:\WINDOWS1\system32\mapi32.dll
2009-10-05 19:32:33 ----SD---- C:\WINDOWS1\Downloaded Program Files
2009-10-05 19:32:33 ----RD---- C:\WINDOWS1\Offline Web Pages
2009-10-05 19:32:33 ----RAH---- C:\WINDOWS1\system32\logonui.exe.manifest
2009-10-05 19:32:22 ----RAH---- C:\WINDOWS1\system32\cdplayer.exe.manifest
2009-10-05 19:31:49 ----D---- C:\WINDOWS1\system32\DirectX
2009-10-05 19:31:31 ----A---- C:\WINDOWS1\system32\atrace.dll
2009-10-05 19:31:29 ----A---- C:\WINDOWS1\system32\desktop.ini
2009-10-05 19:31:29 ----A---- C:\WINDOWS1\desktop.ini
2009-10-05 19:31:24 ----A---- C:\WINDOWS1\system32\nmevtmsg.dll
2009-10-05 19:31:23 ----SD---- C:\WINDOWS1\Tasks
2009-10-05 19:31:23 ----A---- C:\WINDOWS1\system32\icfgnt5.dll
2009-10-05 19:31:23 ----A---- C:\WINDOWS1\system32\acctres.dll
2009-10-05 19:31:21 ----D---- C:\WINDOWS1\srchasst
2009-10-05 19:31:20 ----D---- C:\WINDOWS1\system32\Macromed
2009-10-05 19:31:17 ----A---- C:\WINDOWS1\system32\wuweb.dll
2009-10-05 19:31:17 ----A---- C:\WINDOWS1\system32\wups.dll
2009-10-05 19:31:17 ----A---- C:\WINDOWS1\system32\wucltui.dll
2009-10-05 19:31:17 ----A---- C:\WINDOWS1\system32\wuauserv.dll
2009-10-05 19:31:17 ----A---- C:\WINDOWS1\system32\wuaueng1.dll
2009-10-05 19:31:17 ----A---- C:\WINDOWS1\system32\wuaueng.dll
2009-10-05 19:31:17 ----A---- C:\WINDOWS1\system32\wuauclt1.exe
2009-10-05 19:31:17 ----A---- C:\WINDOWS1\system32\wuauclt.exe
2009-10-05 19:31:17 ----A---- C:\WINDOWS1\system32\wuapi.dll
2009-10-05 19:31:16 ----A---- C:\WINDOWS1\system32\qmgrprxy.dll
2009-10-05 19:31:16 ----A---- C:\WINDOWS1\system32\qmgr.dll
2009-10-05 19:31:16 ----A---- C:\WINDOWS1\system32\bitsprx3.dll
2009-10-05 19:31:16 ----A---- C:\WINDOWS1\system32\bitsprx2.dll
2009-10-05 19:31:11 ----A---- C:\WINDOWS1\system32\safrslv.dll
2009-10-05 19:31:11 ----A---- C:\WINDOWS1\system32\safrdm.dll
2009-10-05 19:31:11 ----A---- C:\WINDOWS1\system32\safrcdlg.dll
2009-10-05 19:31:11 ----A---- C:\WINDOWS1\system32\racpldlg.dll
2009-10-05 19:31:09 ----D---- C:\WINDOWS1\system32\Restore
2009-10-05 19:31:09 ----A---- C:\WINDOWS1\system32\srrstr.dll
2009-10-05 19:31:09 ----A---- C:\WINDOWS1\system32\fltMc.exe
2009-10-05 19:31:09 ----A---- C:\WINDOWS1\system32\fltlib.dll
2009-10-05 19:31:08 ----A---- C:\WINDOWS1\system32\srsvc.dll
2009-10-05 19:31:08 ----A---- C:\WINDOWS1\system32\srclient.dll
2009-10-05 19:31:08 ----A---- C:\WINDOWS1\system32\nmmkcert.dll
2009-10-05 19:31:08 ----A---- C:\WINDOWS1\system32\mnmdd.dll
2009-10-05 19:31:08 ----A---- C:\WINDOWS1\system32\isrdbg32.dll
2009-10-05 19:31:08 ----A---- C:\WINDOWS1\system32\ils.dll
2009-10-05 19:31:07 ----A---- C:\WINDOWS1\system32\msconf.dll
2009-10-05 19:31:07 ----A---- C:\WINDOWS1\system32\mnmsrvc.exe
2009-10-05 19:31:04 ----A---- C:\WINDOWS1\system32\msoert2.dll
2009-10-05 19:31:04 ----A---- C:\WINDOWS1\system32\msoeacct.dll
2009-10-05 19:31:03 ----A---- C:\WINDOWS1\system32\inetres.dll
2009-10-05 19:31:03 ----A---- C:\WINDOWS1\system32\inetcomm.dll
2009-10-05 19:31:02 ----A---- C:\WINDOWS1\system32\schedsvc.dll
2009-10-05 19:31:02 ----A---- C:\WINDOWS1\system32\mstinit.exe
2009-10-05 19:31:02 ----A---- C:\WINDOWS1\system32\mstask.dll
2009-10-05 19:31:01 ----A---- C:\WINDOWS1\system32\isign32.dll
2009-10-05 19:31:01 ----A---- C:\WINDOWS1\system32\inetcfg.dll
2009-10-05 19:31:01 ----A---- C:\WINDOWS1\system32\icwphbk.dll
2009-10-05 19:31:01 ----A---- C:\WINDOWS1\system32\icwdial.dll
2009-10-05 19:29:53 ----A---- C:\WINDOWS1\vbaddin.ini
2009-10-05 19:29:53 ----A---- C:\WINDOWS1\vb.ini
2009-10-05 19:29:46 ----D---- C:\WINDOWS1\Registration
2009-10-05 19:29:28 ----A---- C:\WINDOWS1\system32\write.exe
2009-10-05 19:29:21 ----A---- C:\WINDOWS1\system32\winchat.exe
2009-10-05 19:29:21 ----A---- C:\WINDOWS1\system32\sndvol32.exe
2009-10-05 19:29:21 ----A---- C:\WINDOWS1\system32\hticons.dll
2009-10-05 19:29:21 ----A---- C:\WINDOWS1\system32\avwav.dll
2009-10-05 19:29:21 ----A---- C:\WINDOWS1\system32\avtapi.dll
2009-10-05 19:29:21 ----A---- C:\WINDOWS1\system32\avmeter.dll
2009-10-05 19:29:14 ----A---- C:\WINDOWS1\system32\getuname.dll
2009-10-05 19:29:14 ----A---- C:\WINDOWS1\system32\charmap.exe
2009-10-05 19:29:14 ----A---- C:\WINDOWS1\system32\calc.exe
2009-10-05 19:29:13 ----A---- C:\WINDOWS1\system32\winmine.exe
2009-10-05 19:29:13 ----A---- C:\WINDOWS1\system32\usrlogon.cmd
2009-10-05 19:29:13 ----A---- C:\WINDOWS1\system32\sol.exe
2009-10-05 19:29:13 ----A---- C:\WINDOWS1\system32\reset.exe
2009-10-05 19:29:13 ----A---- C:\WINDOWS1\system32\mshearts.exe
2009-10-05 19:29:13 ----A---- C:\WINDOWS1\system32\freecell.exe
2009-10-05 19:29:12 ----A---- C:\WINDOWS1\system32\tsshutdn.exe
2009-10-05 19:29:12 ----A---- C:\WINDOWS1\system32\tslabels.ini
2009-10-05 19:29:12 ----A---- C:\WINDOWS1\system32\tskill.exe
2009-10-05 19:29:12 ----A---- C:\WINDOWS1\system32\tsdiscon.exe
2009-10-05 19:29:12 ----A---- C:\WINDOWS1\system32\tscon.exe
2009-10-05 19:29:12 ----A---- C:\WINDOWS1\system32\shadow.exe
2009-10-05 19:29:12 ----A---- C:\WINDOWS1\system32\rwinsta.exe
2009-10-05 19:29:12 ----A---- C:\WINDOWS1\system32\regini.exe
2009-10-05 19:29:12 ----A---- C:\WINDOWS1\system32\rdpcfgex.dll
2009-10-05 19:29:12 ----A---- C:\WINDOWS1\system32\qwinsta.exe
2009-10-05 19:29:12 ----A---- C:\WINDOWS1\system32\qappsrv.exe
2009-10-05 19:29:12 ----A---- C:\WINDOWS1\system32\msg.exe
2009-10-05 19:29:12 ----A---- C:\WINDOWS1\system32\logoff.exe
2009-10-05 19:29:12 ----A---- C:\WINDOWS1\system32\cdmodem.dll
2009-10-05 19:29:11 ----A---- C:\WINDOWS1\system32\mtxlegih.dll
2009-10-05 19:29:11 ----A---- C:\WINDOWS1\system32\mtxex.dll
2009-10-05 19:29:11 ----A---- C:\WINDOWS1\system32\mtxdm.dll
2009-10-05 19:29:11 ----A---- C:\WINDOWS1\system32\msdtcprf.ini
2009-10-05 19:29:11 ----A---- C:\WINDOWS1\system32\dcomcnfg.exe
2009-10-05 19:29:11 ----A---- C:\WINDOWS1\system32\comrepl.dll
2009-10-05 19:29:11 ----A---- C:\WINDOWS1\system32\comaddin.dll
2009-10-05 19:29:10 ----A---- C:\WINDOWS1\system32\stclient.dll
2009-10-05 19:29:10 ----A---- C:\WINDOWS1\system32\comsnap.dll
2009-10-05 19:29:05 ----A---- C:\WINDOWS1\system32\wmimgmt.msc
2009-10-05 19:29:01 ----A---- C:\WINDOWS1\system32\sndrec32.exe
2009-10-05 19:29:01 ----A---- C:\WINDOWS1\system32\mplay32.exe
2009-10-05 19:29:01 ----A---- C:\WINDOWS1\system32\hypertrm.dll
2009-10-05 19:29:01 ----A---- C:\WINDOWS1\system32\accwiz.exe
2009-10-05 19:29:00 ----A---- C:\WINDOWS1\system32\spider.exe
2009-10-05 19:29:00 ----A---- C:\WINDOWS1\system32\mspaint.exe
2009-10-05 19:29:00 ----A---- C:\WINDOWS1\system32\clipbrd.exe
2009-10-05 19:28:59 ----A---- C:\WINDOWS1\system32\tscfgwmi.dll
2009-10-05 19:28:59 ----A---- C:\WINDOWS1\system32\sessmgr.exe
2009-10-05 19:28:59 ----A---- C:\WINDOWS1\system32\remotepg.dll
2009-10-05 19:28:59 ----A---- C:\WINDOWS1\system32\rdshost.exe
2009-10-05 19:28:59 ----A---- C:\WINDOWS1\system32\rdsaddin.exe
2009-10-05 19:28:59 ----A---- C:\WINDOWS1\system32\rdchost.dll
2009-10-05 19:28:59 ----A---- C:\WINDOWS1\system32\mstscax.dll
2009-10-05 19:28:59 ----A---- C:\WINDOWS1\system32\mstsc.exe
2009-10-05 19:28:58 ----D---- C:\WINDOWS1\system32\MsDtc
2009-10-05 19:28:58 ----A---- C:\WINDOWS1\system32\tscupgrd.exe
2009-10-05 19:28:58 ----A---- C:\WINDOWS1\system32\termsrv.dll
2009-10-05 19:28:58 ----A---- C:\WINDOWS1\system32\rdpwsx.dll
2009-10-05 19:28:58 ----A---- C:\WINDOWS1\system32\rdpsnd.dll
2009-10-05 19:28:58 ----A---- C:\WINDOWS1\system32\rdpclip.exe
2009-10-05 19:28:58 ----A---- C:\WINDOWS1\system32\qprocess.exe
2009-10-05 19:28:58 ----A---- C:\WINDOWS1\system32\mtxoci.dll
2009-10-05 19:28:58 ----A---- C:\WINDOWS1\system32\msdtcuiu.dll
2009-10-05 19:28:58 ----A---- C:\WINDOWS1\system32\icaapi.dll
2009-10-05 19:28:58 ----A---- C:\WINDOWS1\system32\cfgbkend.dll
2009-10-05 19:28:57 ----A---- C:\WINDOWS1\system32\xolehlp.dll
2009-10-05 19:28:57 ----A---- C:\WINDOWS1\system32\msdtctm.dll
2009-10-05 19:28:57 ----A---- C:\WINDOWS1\system32\msdtcprx.dll
2009-10-05 19:28:57 ----A---- C:\WINDOWS1\system32\msdtclog.dll
2009-10-05 19:28:57 ----A---- C:\WINDOWS1\system32\msdtc.exe
2009-10-05 19:28:56 ----D---- C:\WINDOWS1\system32\Com
2009-10-05 19:28:56 ----A---- C:\WINDOWS1\system32\comuid.dll
2009-10-05 19:28:56 ----A---- C:\WINDOWS1\system32\comsvcs.dll
2009-10-05 19:28:56 ----A---- C:\WINDOWS1\system32\colbact.dll
2009-10-05 19:28:56 ----A---- C:\WINDOWS1\system32\clbcatex.dll
2009-10-05 19:28:56 ----A---- C:\WINDOWS1\system32\catsrvut.dll
2009-10-05 19:28:56 ----A---- C:\WINDOWS1\system32\catsrvps.dll
2009-10-05 19:28:56 ----A---- C:\WINDOWS1\system32\catsrv.dll
2009-10-05 19:28:55 ----A---- C:\WINDOWS1\system32\clbcatq.dll
2009-10-05 19:28:51 ----A---- C:\WINDOWS1\system32\servdeps.dll
2009-10-05 19:28:50 ----A---- C:\WINDOWS1\system32\mmfutil.dll
2009-10-05 19:28:50 ----A---- C:\WINDOWS1\system32\licwmi.dll
2009-10-05 19:28:50 ----A---- C:\WINDOWS1\system32\cmprops.dll
2009-09-30 12:03:11 ----SHD---- C:\Config.Msi
2009-09-30 10:52:23 ----D---- C:\Program Files\Dachshund Software
2009-09-30 10:41:40 ----D---- C:\Program Files\Advanced System Optimizer
2009-09-27 10:08:57 ----RASH---- C:\logoneui.exe
2009-09-27 10:08:57 ----A---- C:\Jojo.exe
2009-09-27 09:56:18 ----D---- C:\Program Files\Seagate Software
2009-09-27 09:56:17 ----D---- C:\Program Files\MapInfo
2009-09-24 10:19:04 ----D---- C:\Program Files\AMT
2009-09-24 10:07:55 ----RSH---- C:\zPharaoh.exe
2009-09-17 15:40:19 ----D---- C:\Program Files\CCleaner
2009-09-17 15:10:43 ----D---- C:\Program Files\Trend Micro
2009-09-17 14:33:05 ----D---- C:\Program Files\Malwarebytes' Anti-Malware
2009-09-17 14:31:14 ----D---- C:\Program Files\Yahoo!
2009-09-15 19:12:31 ----D---- C:\Program Files\Kaspersky Lab
2009-09-15 19:04:08 ----D---- C:\Program Files\TuneUp Utilities 2007
2009-09-15 18:56:30 ----D---- C:\Program Files\Fichiers communs\Wise Installation Wizard
2009-09-15 00:51:42 ----D---- C:\Program Files\R
2009-09-14 22:42:53 ----A---- C:\info.bat
2009-09-12 19:46:59 ----D---- C:\Program Files\Internet Download Manager
======List of files/folders modified in the last 2 months======
2009-10-05 20:56:42 ----SHD---- C:\RECYCLER
2009-10-05 20:56:19 ----D---- C:\Program Files\Windows Media Player
2009-10-05 19:51:41 ----D---- C:\Program Files\Outlook Express
2009-10-05 19:51:41 ----D---- C:\Program Files\Internet Explorer
2009-10-05 19:46:34 ----D---- C:\Program Files\Movie Maker
2009-10-05 19:46:26 ----D---- C:\Program Files\Windows NT
2009-10-05 19:46:26 ----D---- C:\Program Files\NetMeeting
2009-10-05 19:45:49 ----A---- C:\WINDOWS1\system.ini
2009-10-05 19:40:30 ----D---- C:\Documents and Settings
2009-10-05 19:39:37 ----SHD---- C:\System Volume Information
2009-10-05 19:34:12 ----A---- C:\WINDOWS1\win.ini
2009-10-05 19:32:37 ----RD---- C:\Program Files
2009-10-05 19:31:04 ----D---- C:\Program Files\Fichiers communs\System
2009-10-05 19:29:29 ----D---- C:\Program Files\Messenger
2009-09-30 15:05:12 ----D---- C:\WINDOWS
2009-09-15 18:56:30 ----D---- C:\Program Files\Fichiers communs
2009-09-05 15:32:56 ----HD---- C:\Program Files\InstallShield Installation Information
======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
R1 intelppm;Intel Processor Driver; C:\WINDOWS1\system32\DRIVERS\intelppm.sys [2004-08-04 40320]
R3 abp470n5;abp470n5; \??\C:\WINDOWS1\system32\drivers\jgrlon.sys []
R3 CmBatt;Microsoft ACPI Adapter Driver; C:\WINDOWS1\system32\DRIVERS\CmBatt.sys [2004-08-04 14080]
R3 usbccgp;Microsoft Generic USB Parent Driver; C:\WINDOWS1\system32\DRIVERS\usbccgp.sys [2004-08-04 31616]
R3 usbehci;Microsoft USB 2.0 Enhanced Host Controller Miniport Driver; C:\WINDOWS1\system32\DRIVERS\usbehci.sys [2004-08-04 26624]
R3 usbhub;USB2 Hub; C:\WINDOWS1\system32\DRIVERS\usbhub.sys [2004-08-04 57600]
R3 usbstor;USB Mass Storage Driver; C:\WINDOWS1\system32\DRIVERS\USBSTOR.SYS [2004-08-04 26496]
R3 usbuhci;Microsoft Universal Host Controller Miniport Driver; C:\WINDOWS1\system32\DRIVERS\usbuhci.sys [2004-08-04 20480]
R3 usbvideo;USB Video Device (WDM); C:\WINDOWS1\System32\Drivers\usbvideo.sys [2004-08-04 78464]
S3 CCDECODE;Closed Caption Decoder; C:\WINDOWS1\system32\DRIVERS\CCDECODE.sys [2004-08-04 17024]
S3 MSTEE;Microsoft Transport Site-to-Site Converter; C:\WINDOWS1\system32\drivers\MSTEE.sys [2004-08-04 5504]
S3 NABTSFEC;NABTS/FEC VBI Codec; C:\WINDOWS1\system32\DRIVERS\NABTSFEC.sys [2004-08-04 85376]
S3 NdisIP;Microsoft TV/Video Connection; C:\WINDOWS1\system32\DRIVERS\NdisIP.sys [2004-08-04 10880]
S3 SLIP;BDA slippage device; C:\WINDOWS1\system32\DRIVERS\SLIP.sys [2004-08-04 11136]
S3 streamip;BDA IPSink; C:\WINDOWS1\system32\DRIVERS\StreamIP.sys [2004-08-04 15360]
S3 WSTCODEC;Standard Teletext Codec; C:\WINDOWS1\system32\DRIVERS\WSTCODEC.SYS [2004-08-04 19328]
S4 IntelIde;IntelIde; C:\WINDOWS1\system32\drivers\IntelIde.sys []
======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
All services whitelisted
-----------------EOF----------------- -
and here is the report from info.txt I apologize for the disorganization
info.txt logfile of random's system information tool 1.06 2009-10-05 20:59:39
======Uninstall list======
-->rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS1\INF\PCHealth.inf
HijackThis 2.0.2-->"C:\Program Files\Trend Micro\HijackThis\HijackThis.exe" /uninstall
Malwarebytes' Anti-Malware-->"C:\Program Files\Malwarebytes' Anti-Malware\unins000.exe"
======System event log======
Computer Name: BENHAMZA-A363EC
Event Code: 60054
Message: The installer has successfully installed Windows version 2600.
Record Number: 5
Source Name: Setup
Time Written: 20091005193826.000000+120
Event Type: Information
User:
Computer Name: BENHAMZA-A363EC
Event Code: 15007
Message: The reservation of the namespace identified by the URL prefix http://*:2869/ has been successfully added.
Record Number: 4
Source Name: HTTP
Time Written: 20091005193212.000000+120
Event Type: Information
User:
Computer Name: BENHAMZA-A363EC
Event Code: 6011
Message: The NetBIOS name and the DNS hostname of this computer have been changed from MACHINENAME to BENHAMZA-A363EC.
Record Number: 3
Source Name: EventLog
Time Written: 20091005192745.000000+120
Event Type: Information
User:
Computer Name: MACHINENAME
Event Code: 6005
Message: The Event Log service has started.
Record Number: 2
Source Name: EventLog
Time Written: 20091005212046.000000+120
Event Type: Information
User:
Computer Name: MACHINENAME
Event Code: 6009
Message: Microsoft (R) Windows (R) 5.01. 2600 Service Pack 2 Multiprocessor Free.
Record Number: 1
Source Name: EventLog
Time Written: 20091005212046.000000+120
Event Type: Information
User:
=====Application event log=====
Computer Name: BENHAMZA-A363EC
Event Code: 1000
Message: Performance counters for the MSDTC service (MSDTC) have been loaded.
The record data contains the new index values
assigned to this service.
Record Number: 5
Source Name: LoadPerf
Time Written: 20091005192940.000000+120
Event Type: Information
User:
Computer Name: BENHAMZA-A363EC
Event Code: 1000
Message: Performance counters for the TermService service (Terminal Services) have been loaded.
The record data contains the new index values
assigned to this service.
Record Number: 4
Source Name: LoadPerf
Time Written: 20091005192935.000000+120
Event Type: Information
User:
Computer Name: BENHAMZA-A363EC
Event Code: 1000
Message: Performance counters for the RemoteAccess service (Routing and Remote Access) have been loaded.
The record data contains the new index values
assigned to this service.
Record Number: 3
Source Name: LoadPerf
Time Written: 20091005192837.000000+120
Event Type: Information
User:
Computer Name: BENHAMZA-A363EC
Event Code: 1000
Message: Performance counters for the PSched service (PSched) have been loaded.
The record data contains the new index values
assigned to this service.
Record Number: 2
Source Name: LoadPerf
Time Written: 20091005192800.000000+120
Event Type: Information
User:
Computer Name: BENHAMZA-A363EC
Event Code: 1000
Message: Performance counters for the RSVP service (QoS RSVP) have been loaded.
The record data contains the new index values
assigned to this service.
Record Number: 1
Source Name: LoadPerf
Time Written: 20091005192759.000000+120
Event Type: Information
User:
======Environment variables======
"ComSpec"=%SystemRoot%\system32\cmd.exe
"Path"=%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem
"windir"=%SystemRoot%
"FP_NO_HOST_CHECK"=NO
"OS"=Windows_NT
"PROCESSOR_ARCHITECTURE"=x86
"PROCESSOR_LEVEL"=6
"PROCESSOR_IDENTIFIER"=x86 Family 6 Model 28 Stepping 2, GenuineIntel
"PROCESSOR_REVISION"=1c02
"NUMBER_OF_PROCESSORS"=2
"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
"TEMP"=%SystemRoot%\TEMP
"TMP"=%SystemRoot%\TEMP
-----------------EOF------------------
Hello
Download ComboFix: http://download.bleepingcomputer.com/sUBs/ComboFix.exe
-> Rename it to save it on your desktop as asdehi (just to prevent the infection from recognizing it)
-> Double-click on combofix.exe.
-> Press the 1 key (Yes) to start the scan.
-> When the scan is complete, a report will appear. Copy/paste this report into your next response.
NOTE: The report can also be found here: C:\Combofix.txt
Before using ComboFix:
-> Disconnect from the Internet and close all running program windows.
-> Temporarily disable the real-time protection of your antivirus and antispyware programs, as they can significantly interfere with the search and cleaning process of the tool.
Once done, double-click on ComboFix.exe on your desktop.
- Respond yes to the warning message, so the program can start analyzing the PC.
- Attention: During this step, do not use the PC and do not open any programs. Risk of freezing the computer
- At the end of the scan, ComboFix may need to restart the PC to complete the disinfection/search, let it do so.
- A report will then open in Notepad, this report file Combofix.txt is automatically saved and stored at C:\Combofix.txt)
-> Reactivate the real-time protection of your antivirus and antispyware programs before reconnecting to the internet.
-> Come back to the forum, and copy and paste the entire content of C:\Combofix.txt into your next message.
!\ Do not touch anything until the scan is finished. /!\: risk of freezing the computer (complete crash)
:: If ComboFix detects something and asks to restart, you accept
@+
--
We've all been a beginner at something at one point.
But knowledge is the reward of diligence.
-
-
Good evening;
Thank you for replying
I need to explain a bit, I installed Windows using an external drive, I didn't overwrite the previous version because it contains my documents, so I created a new installation directory that I named windows1. The new Windows is completely empty but allowed me to install an antivirus, Avira, with which I tried to disinfect. Now the problem is twofold: no drivers installed, no programs, plus there are fewer infection problems than before.
Anyway, I installed your software and here is its report
ComboFix 09-10-05.01 - Oumeima 06/10/2009 21:29.1.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.33.1036.18.1015.654 [GMT 2:00]
Run from: c:\documents and settings\Oumeima\Desktop\asdehi.exe
AV: AntiVir Desktop *On-access scanning disabled* (Outdated) {AD166499-45F9-482A-A743-FDD3350758C7}
WARNING - RECOVERY CONSOLE NOT INSTALLED ON THIS MACHINE!!
.
(((((((((((((((((((((((((((((((((((( Other deletions ))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\1xniph.bat
c:\documents and settings\Oumeima\Application Data\tazebama
c:\documents and settings\Oumeima\Application Data\tazebama\zPharaoh.dat
c:\documents and settings\user\Application Data\tazebama
c:\documents and settings\user\Application Data\tazebama\tazebama.log
c:\documents and settings\user\Application Data\tazebama\zPharaoh.dat
C:\info.bat
c:\recycler\S-1-5-21-1782076257-3958230823-2850711411-1004
c:\recycler\S-1-5-21-2269492344-1529916022-4017061352-1004
c:\recycler\S-1-5-21-3919753884-705377545-1586257123-1004
c:\recycler\S-1-5-21-790525478-2025429265-725345543-1004
c:\windows\Installer\1588f7.msi
c:\windows\Installer\303554.msi
c:\windows\Installer\303558.msi
c:\windows\Installer\3cff6.msi
c:\windows\Installer\3cffb.msi
c:\windows\Installer\3d000.msi
c:\windows\Installer\3d005.msi
c:\windows\Installer\3d00b.msi
c:\windows\Installer\3d013.msi
c:\windows\Installer\3d018.msi
c:\windows\Installer\3d01d.msi
c:\windows\Installer\3d022.msi
c:\windows\Installer\3d027.msi
c:\windows\Installer\3d02d.msi
c:\windows\Installer\3d033.msi
c:\windows\Installer\3d039.msi
c:\windows\Installer\3d03e.msi
c:\windows\Installer\3d044.msi
c:\windows\Installer\3d049.msi
c:\windows\Installer\3d04f.msi
c:\windows\Installer\3d055.msi
c:\windows\Installer\3d05a.msi
c:\windows\Installer\3d061.msi
c:\windows\Installer\689fe3.msi
c:\windows\Installer\91383.msi
c:\windows\Installer\f54c2.msi
c:\windows1\service.exe
.
((((((((((((((((((((((((((((( Files created from 2009-09-06 to 2009-10-06 ))))))))))))))))))))))))))))))))))))
.
2009-10-06 18:12 . 2009-10-06 18:12 -------- d-----w- c:\documents and settings\Oumeima\Application Data\Yahoo!
2009-10-06 18:12 . 2009-10-06 18:12 -------- d-----w- c:\documents and settings\All Users.WINDOWS1\Application Data\Yahoo! Companion
2009-10-05 20:57 . 2009-03-30 08:32 96104 ----a-w- c:\windows1\system32\drivers\avipbb.sys
2009-10-05 20:57 . 2009-03-24 14:07 55640 ----a-w- c:\windows1\system32\drivers\avgntflt.sys
2009-10-05 20:57 . 2009-02-13 10:28 22360 ----a-w- c:\windows1\system32\drivers\avgntmgr.sys
2009-10-05 20:57 . 2009-02-13 10:17 45416 ----a-w- c:\windows1\system32\drivers\avgntdd.sys
2009-10-05 20:57 . 2009-10-05 20:57 -------- d-----w- c:\program files\Avira
2009-10-05 20:57 . 2009-10-05 20:57 -------- d-----w- c:\documents and settings\All Users.WINDOWS1\Application Data\Avira
.
(((((((((((((((((((((((((((((((((( Find3M report ))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-10-06 18:12 . 2009-09-17 13:40 -------- d-----w- c:\program files\CCleaner
2009-10-05 22:19 . 2009-09-15 17:04 -------- d-----w- c:\program files\TuneUp Utilities 2007
2009-10-05 22:19 . 2009-09-17 12:33 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-10-05 22:19 . 2009-09-12 17:46 -------- d-----w- c:\program files\Internet Download Manager
2009-10-05 22:19 . 2009-06-07 07:17 -------- d-----w- c:\program files\Apoint2K
2009-10-05 22:19 . 2009-09-24 08:19 -------- d-----w- c:\program files\AMT
2009-10-05 22:19 . 2009-09-30 08:41 -------- d-----w- c:\program files\Advanced System Optimizer
2009-10-05 17:46 . 2009-10-05 17:46 -------- d-----w- c:\documents and settings\Oumeima\Application Data\Malwarebytes
2009-10-05 17:45 . 2009-10-05 17:45 -------- d-----w- c:\documents and settings\All Users.WINDOWS1\Application Data\Malwarebytes
2009-10-05 17:41 . 2002-09-07 00:00 49054 ----a-w- c:\windows1\system32\perfc00C.dat
2009-10-05 17:41 . 2002-09-07 00:00 368314 ----a-w- c:\windows1\system32\perfh00C.dat
2009-10-05 17:30 . 2009-10-05 17:30 21892 ----a-w- c:\windows1\system32\emptyregdb.dat
2009-09-30 08:52 . 2009-09-30 08:52 -------- d-----w- c:\program files\Dachshund Software
2009-09-30 08:41 . 2009-09-30 08:41 -------- d-----w- c:\documents and settings\user\Application Data\Systweak
2009-09-30 08:39 . 2009-09-12 17:47 -------- d-----w- c:\documents and settings\user\Application Data\DMCache
2009-09-27 13:40 . 2009-09-06 14:26 63384 ----a-w- c:\documents and settings\user\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-09-27 07:59 . 2009-09-27 07:58 -------- d-----w- c:\documents and settings\user\Application Data\MapInfo
2009-09-27 07:56 . 2009-09-27 07:56 -------- d-----w- c:\program files\Seagate Software
2009-09-27 07:56 . 2009-09-27 07:56 -------- d-----w- c:\program files\MapInfo
2009-09-17 13:40 . 2009-09-17 13:40 -------- d-----w- c:\documents and settings\user\Application Data\Yahoo!
2009-09-17 13:39 . 2009-09-17 12:31 -------- d-----w- c:\program files\Yahoo!
2009-09-17 13:10 . 2009-09-17 13:10 -------- d-----w- c:\program files\Trend Micro
2009-09-17 12:33 . 2009-09-17 12:33 -------- d-----w- c:\documents and settings\user\Application Data\Malwarebytes
2009-09-15 17:12 . 2009-09-15 17:12 -------- d-----w- c:\program files\Kaspersky Lab
2009-09-15 17:04 . 2009-09-15 17:04 -------- d-----w- c:\documents and settings\user\Application Data\TuneUp Software
2009-09-15 16:56 . 2009-09-15 16:56 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard
2009-09-14 22:51 . 2009-09-14 22:51 -------- d-----w- c:\program files\R
2009-09-12 17:49 . 2009-09-12 17:47 -------- d-----w- c:\documents and settings\user\Application Data\IDM
2009-09-10 12:54 . 2009-10-05 17:46 38224 ----a-w- c:\windows1\system32\drivers\mbamswissarmy.sys
2009-09-10 12:53 . 2009-10-05 17:45 19160 ----a-w- c:\windows1\system32\drivers\mbam.sys
2009-09-05 13:32 . 2009-06-06 21:18 -------- d--h--w- c:\program files\InstallShield Installation Information
.
((((((((((((((((((((((((((((((((( Registry load points ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty items & initial legitimate items are not listed
REGEDIT4
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows1\system32\CTFMON.EXE" [2004-08-04 15360]
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UpdatesDisableNotify"=dword:00000001
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"AntiVirusOverride"=dword:00000001
"AntiVirusDisableNotify"=dword:00000001
"FirewallDisableNotify"=dword:00000001
"FirewallOverride"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
"UacDisableNotify"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [05/10/2009 22:57 108289]
S3 abp470n5;abp470n5;\??\c:\windows1\system32\drivers\jgrlon.sys --> c:\windows1\system32\drivers\jgrlon.sys [?]
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-10-06 21:33
Windows 5.1.2600 Service Pack 2 NTFS
Searching for hidden processes ...
Searching for hidden auto-start items ...
Searching for hidden files ...
Scan completed successfully
Hidden files: 0
**************************************************************************
.
End time: 2009-10-06 21:34
ComboFix-quarantined-files.txt 2009-10-06 19:34
Before-CF: 139,644,796,928 bytes free
After-CF: 139,607,277,568 bytes free
134
thank you for replying-
Hello
We'll continue with this:
# Note: "Process.exe", a component of the tool, is detected by some antivirus programs (AntiVir, Dr.Web, Kaspersky Anti-Virus) as a RiskTool.
It is not a virus, but a utility designed to terminate processes.
In the wrong hands, this utility could stop security software (Antivirus, Firewall...) which is why these antivirus programs raise an alert.
Download and install UsbFix from C_XX
Here: http://sd-1.archive-host.com/members/up/127028005715545653/UsbFix.exe
Tutorial by Malekal_Morte if needed, thanks to him: https://www.malekal.com/usbfix-supprimer-virus-usb/
Connect your external data sources to your PC (USB drive, external hard drive, etc...) that may have been infected without opening them
# Double-click on the UsbFix shortcut present on your desktop.
# Choose option 1 (Search)
# Let the tool work.
# Then post the UsbFix.txt report that will appear.
# Note: The UsbFix.txt report is saved at the root of the drive. (C:\UsbFix.txt)
(CTRL+A to select all, CTRL+C to copy, and CTRL+V to paste)
@+
--
We have all been beginners at something at one point.
But knowledge is the reward of diligence.
-
-
Hello;
the USB-fix link doesn’t seem to be working, is there a way to download it otherwise
thank you -
Hello
here is the report
############################## | UsbFix V6.038 |
User : Oumeima (Administrators) # BENHAMZA-A363EC
Update on 06/10/2009 by Chiquitine29, C_XX & Chimay8
Start at: 18:53:44 | 07/10/2009
Website : http://pagesperso-orange.fr/NosTools/index.html
Intel(R) Atom(TM) CPU N270 @ 1.60GHz
Microsoft Windows XP Professional (5.1.2600 32-bit) # Service Pack 2
Internet Explorer 6.0.2900.2180
Windows Firewall Status : Disabled
AV : AntiVir Desktop 9.0.1.26 [ Enabled | (!) Outdated ]
C:\ -> Local disk # 142.9 Go (130.04 Go free) [system] # NTFS
D:\ -> Local disk # 37.26 Go (21.56 Go free) # NTFS
G:\ -> Removable disk # 1.86 Go (1.03 Go free) [KINGSTON] # FAT
############################## | Active Processes |
C:\WINDOWS1\System32\smss.exe
C:\WINDOWS1\system32\csrss.exe
C:\WINDOWS1\system32\winlogon.exe
C:\WINDOWS1\system32\services.exe
C:\WINDOWS1\system32\lsass.exe
C:\WINDOWS1\system32\svchost.exe
C:\WINDOWS1\system32\svchost.exe
C:\WINDOWS1\System32\svchost.exe
C:\WINDOWS1\system32\svchost.exe
C:\WINDOWS1\system32\svchost.exe
C:\WINDOWS1\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\WINDOWS1\Explorer.EXE
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\WINDOWS1\system32\svchost.exe
C:\WINDOWS1\system32\wbem\wmiprvse.exe
################## | Infectious Files # Folders |
D:\Recycler\S-5-3-42-2819952290-8240758988-879315005-3665
G:\autorun.inf -> called file : "G:\RECYCLER\S-1-6-21-2434476501-1644491937-600003330-1213\svchost.exe" ( Missing ! )
G:\1.taz
G:\autorun.inf
G:\Recycler\S-1-6-21-2434476501-1644491937-600003330-1213
G:\Recycler\S-1-6-21-2434476501-1644491937-600003330-1213\Desktop.ini
G:\Recycler\S-5-3-42-2819952290-8240758988-879315005-3665
################## | Registry # Infectious Run Keys |
[HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System] "DisableRegistryTools"
[HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] "NoDrives"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] "NoDrives"
################## | Registry # Mountpoints2 |
HKCU\..\..\Explorer\MountPoints2\{2fe02a18-b1d6-11de-8858-e655658d3f05}
Shell\AutoRun\command =RECYCLER\S-1-6-21-2434476501-1644491937-600003330-1213\svchost.exe
Shell\open\command =RECYCLER\S-1-6-21-2434476501-1644491937-600003330-1213\svchost.exe
################## | ! End of report # UsbFix V6.038 ! |
See you later-
Re
Connect your external data sources to your PC, (USB stick, external hard drive, etc...) that may have been infected without opening them
# Double click on the UsbFix shortcut on your desktop
# choose option 2 (Removal)
# Your desktop will disappear and the PC will restart.
# Upon restart, UsbFix will scan your PC, let the tool work.
# Then post the UsbFix.txt report that will appear with the desktop.
# Note: The UsbFix.txt report is saved at the root of the drive. (C:\UsbFix.txt)
( CTRL+A to select all, CTRL+C to copy and CTRL+V to paste )
@+
--
We have all been beginners in something at one time.
But knowledge is the reward for diligence.
-
-
Hello
here is the report
############################## | UsbFix V6.038 |
User : Oumeima (Administrators) # BENHAMZA-A363EC
Update on 06/10/2009 by Chiquitine29, C_XX & Chimay8
Start at: 20:20:12 | 07/10/2009
Website : http://pagesperso-orange.fr/NosTools/index.html
Intel(R) Atom(TM) CPU N270 @ 1.60GHz
Microsoft Windows XP Professional (5.1.2600 32-bit) # Service Pack 2
Internet Explorer 6.0.2900.2180
Windows Firewall Status : Disabled
AV : AntiVir Desktop 9.0.1.26 [ Enabled | (!) Outdated ]
C:\ -> Local fixed disk # 142.9 Go (130.03 Go free) [system] # NTFS
D:\ -> Removable disk
E:\ -> Removable disk
F:\ -> Local fixed disk # 37.26 Go (21.56 Go free) # NTFS
G:\ -> Removable disk # 1.86 Go (1.03 Go free) [KINGSTON] # FAT
############################## | Active processes |
C:\WINDOWS1\System32\smss.exe
C:\WINDOWS1\system32\csrss.exe
C:\WINDOWS1\system32\winlogon.exe
C:\WINDOWS1\system32\services.exe
C:\WINDOWS1\system32\lsass.exe
C:\WINDOWS1\system32\svchost.exe
C:\WINDOWS1\system32\svchost.exe
C:\WINDOWS1\System32\svchost.exe
C:\WINDOWS1\system32\svchost.exe
C:\WINDOWS1\system32\svchost.exe
C:\WINDOWS1\system32\logonui.exe
C:\WINDOWS1\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\WINDOWS1\system32\userinit.exe
C:\WINDOWS1\Explorer.EXE
C:\WINDOWS1\system32\svchost.exe
C:\WINDOWS1\system32\wbem\wmiprvse.exe
################## | Infectious files # Folders |
Not deleted! F:\Recycler\S-5-3-42-2819952290-8240758988-879315005-3665
G:\autorun.inf -> called file : "G:\RECYCLER\S-1-6-21-2434476501-1644491937-600003330-1213\svchost.exe" ( Missing ! )
Deleted! G:\1.taz
Deleted! G:\autorun.inf
Deleted! G:\Recycler\S-1-6-21-2434476501-1644491937-600003330-1213\Desktop.ini
Deleted! G:\Recycler\S-1-6-21-2434476501-1644491937-600003330-1213
Deleted! G:\Recycler\S-5-3-42-2819952290-8240758988-879315005-3665
################## | Registry # Infectious Run keys |
Deleted! [HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System] "DisableRegistryTools"
Deleted! [HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] "NoDrives"
Deleted! [HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] "NoDrives"
################## | Registry # Mountpoints2 |
################## | Listing of present files |
[06/06/2009 20:00|--a------|0] C:\AUTOEXEC.BAT
[05/10/2009 19:27|---hs----|214] C:\boot.ini
[07/09/2002 02:00|-rahs----|4952] C:\Bootfont.bin
[06/10/2009 21:34|--a------|8317] C:\ComboFix.txt
[06/06/2009 20:00|--a------|0] C:\CONFIG.SYS
[06/06/2009 20:00|-rahs----|0] C:\IO.SYS
[06/06/2009 20:00|-rahs----|0] C:\MSDOS.SYS
[05/08/2004 14:00|-rahs----|47564] C:\NTDETECT.COM
[07/06/2009 09:29|-rahs----|252240] C:\ntldr
[?|?|?] C:\pagefile.sys
[07/10/2009 20:23|--a------|2891] C:\UsbFix.txt
[21/07/2009 23:46|--a------|585379996] F:\Abeille.nrg
[23/05/2009 09:53|--a------|172349596] F:\botanique.nrg
[22/07/2009 11:59|--a------|106995868] F:\Dactylogiciel.nrg
[21/07/2009 23:42|--a------|583694492] F:\English.nrg
[21/07/2009 23:50|--a------|502401180] F:\Fritz8.nrg
[15/07/2009 18:49|--a------|690407580] F:\Termino.nrg
[14/09/2009 15:07|--a------|104832] G:\pic_2004-10-05_210944.jpg
[14/09/2009 15:12|--a------|3280765] G:\CI010868.pdf
[30/09/2009 20:55|--a------|36352] G:\ACP.doc
[14/09/2009 15:16|--a------|2045868] G:\adAcp.pdf
[06/10/2009 22:16|--a------|3327308] G:\asdehi.exe
[30/09/2009 18:52|--a------|27136] G:\Hijackthis.doc
[20/12/2006 14:53|--a------|37624085] G:\Hou‚rou.pdf
[05/10/2009 13:49|--a------|232] G:\Alfatron.txt
[06/10/2009 21:41|--a------|8317] G:\combo.txt
[19/08/2009 01:45|--a------|862847] G:\habilitation magister_ar.pdf
[01/10/2009 15:16|--a------|38400] G:\Tablev‚g‚.xls
[03/06/2008 00:42|--a------|4122998] G:\JAUFFRET 2001 - Validation et comparaison de divers indicateurs des changements a long terme.pdf
[07/10/2009 19:42|--a------|1233236] G:\UsbFix.exe
[26/07/2007 03:28|--a------|3275332] G:\these_chehma.pdf
[05/10/2009 21:02|--a------|26517] G:\log.txt
[21/06/2009 12:26|--a------|764928] G:\DIFFERENTES FONCTION ().ppt
[22/08/2009 12:31|--a------|109786] G:\CCA.pptx
[24/11/2008 21:03|--a------|3312594] G:\MedalusManual.pdf
[03/11/2008 22:13|--a------|5925376] G:\THESE doctorat latreche ali.doc
[07/10/2009 18:55|--a------|2527] G:\UsbFix.txt
[05/10/2009 21:02|--a------|4121] G:\info.txt
[05/10/2009 19:56|--a------|1758] G:\hijackthis.log
[17/11/2008 00:02|--a------|98] G:\Pour plus de films.url
[30/09/2009 13:10|--a------|1371] G:\r‚capstan.txt
################## | Vaccination |
# C:\autorun.inf -> Folder created by UsbFix.
# F:\autorun.inf -> Folder created by UsbFix.
# G:\autorun.inf -> Folder created by UsbFix.
################## | Upload |
Please send the file : C:\DOCUME~1\Oumeima\Desktop\UsbFix_Upload_Me_BENHAMZA-A363EC.zip : https://www.androidworld.fr/
Thank you for your contribution.
################## | ! End of the report # UsbFix V6.038 ! |
See you later-
Re
1) Please do this
Please send the file: C:\DOCUME~1\Oumeima\Bureau\UsbFix_Upload_Me_BENHAMZA-A363EC.zip : https://www.androidworld.fr/
Thank you for your contribution.
2) Download Malwarebytes Anti-Malware here
http://www.malwarebytes.org/mbam.php
* Install it (make sure to choose "French"; do not change the installation settings) and update it.
(Note: If you are missing "COMCTL32.OCX" during installation, download it here: https://www.malekal.com/tutorial-aboutbuster/
* Study the tutorial to familiarize yourself with the program:
https://forum.pcastuces.com/sujet.asp?f=31&s=3
(That said, it is very easy to use).
Restart Malwarebytes by strictly following these instructions:
! Disconnect and close all running applications!
* Launch Malwarebytes.
Run a "Complete" scan.
--> Let the program work (and do not do anything else with the PC during the scan).
--> When it's finished, click on "results".
--> Make sure all infected items are checked, then click on "remove".
Note: If you need to restart your PC to complete the cleanup, do it!
Post the saved report after removing the infected items (in the "report/log" tab of Malwarebytes, the most recent one)
@+
--
We have all been beginners at something at some point.
But knowledge is the reward for diligence.
-
-
Hello;
I installed the anti-malware with its default options, the PC did not let me use the internet, and it displayed an error message "Please report to Malwarebytes support, Anti Malware, the error code below Error code: 732(0.0)", I don't really know what that means,
anyway I launched the anti-malware, I'm sending you the report
Malwarebytes' Anti-Malware 1.41
Database version: 2775
Windows 5.1.2600 Service Pack 2
08/10/2009 00:26:21
mbam-log-2009-10-08 (00-26-21).txt
Scan type: Full scan (C:\|)
Items examined: 160772
Elapsed time: 38 minute(s), 12 second(s)
Infected memory process(es): 0
Infected memory module(s): 0
Infected registry key(s): 0
Infected registry value(s): 0
Infected registry data item(s): 1
Infected folder(s): 0
Infected file(s): 0
Infected memory process(es):
(No harmful items detected)
Infected memory module(s):
(No harmful items detected)
Infected registry key(s):
(No harmful items detected)
Infected registry value(s):
(No harmful items detected)
Infected registry data item(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
Infected folder(s):
(No harmful items detected)
Infected file(s):
(No harmful items detected)
thank you and see you later-
Hello
1)Let's try with another anti-spyware.
Download Superantispyware (SAS)
https://www.superantispyware.com/
Choose “save” and save it on your desktop.
Double-click or right-click (run as…) under Vista on the installation icon that has just been created and follow the instructions.
Create an icon on the desktop.
Double-click or right-click (run as…) under Vista on the SAS icon (a head in a red circle with a line through it) to launch it.
- If the tool prompts you to update the program (“update the program definitions”), click yes.
- Under Configuration and Preferences, click on the “Preferences” button
- Click on the “Scanning Control” tab
- In “Scanner Options”, make sure the checkbox next to the following lines is checked:
Close browsers before scanning
Scan for tracking cookies
Terminate memory threats before quarantining
- Leave the other lines unchecked.
- Click on the “Close” button to exit the control center screen.
- In the main window, click on “Scan for Harmful Software” and then on “Scan your computer”.
In the left column, check C:\Fixed Drive.
In the right column, under “Complete scan”, click on “Perform Complete Scan”
Click on “next” to start the scan. Wait during the duration of the scan.
At the end of the scan, a results window will open. Click OK.
Make sure all lines in the white window are checked and click on “Next”.
Everything that has been found will be quarantined. If you are prompted to restart the computer (“reboot”), click Yes.
To copy the information to the forum, do this:
- after restarting the computer, double-click on the icon to launch SAS.
- Click on “Preferences” then on the “Statistics/Logs” tab.
- In “scanners logs”, double-click on SUPERAntiSpyware Scan Log.
- The report will open in your default text editor.
- Copy its content into your reply
2)Are you able to install an antivirus?
If so, do a full scan and send me the report.
Thank you
@+
--
We have all been beginners in something at some point.
But knowledge is the reward for diligence.
-
-
Good evening;
I will do what you asked me, but I have a few questions to ask you;
since the computer wouldn't let me connect, is it possible to update the Avira antivirus and the antispyware manually?
Then, if I proceed with a formatting, will that fix my problems?
Thank you for your reply
Talk to you later-
Hello
1)Do you still have connection issues to access the internet now, or only issues accessing the software I ask you about, including the update of your antivirus?
Let's address this first question please
Thanks
@+
--
We have all been a beginner at something at one point.
But knowledge is the reward of diligence.
-
-
Hello,
sorry for the delay
the antispyware report
SUPERAntiSpyware Scan Log
https://www.superantispyware.com/
Generated 10/11/2009 at 02:00 PM
Application Version : 4.29.1002
Core Rules Database Version : 4102
Trace Rules Database Version: 1978
Scan type : Complete Scan
Total Scan Time : 01:18:10
Memory items scanned : 418
Memory threats detected : 0
Registry items scanned : 3669
Registry threats detected : 0
File items scanned : 59018
File threats detected : 9
Adware.Tracking Cookie
C:\Documents and Settings\user\Cookies\user@ad.zanox[1].txt
C:\Documents and Settings\user\Cookies\user@atdmt[1].txt
C:\Documents and Settings\user\Cookies\user@bluestreak[2].txt
C:\Documents and Settings\user\Cookies\user@bs.serving-sys[2].txt
C:\Documents and Settings\user\Cookies\user@doubleclick[2].txt
C:\Documents and Settings\user\Cookies\user@msnportal.112.2o7[1].txt
C:\Documents and Settings\user\Cookies\user@qnsr[1].txt
C:\Documents and Settings\user\Cookies\user@serving-sys[2].txt
C:\Documents and Settings\user\Cookies\user@sfr.122.2o7[1].txt
the Avira report is
Avira AntiVir Personal
Report file creation date : Sunday, October 11, 2009 02:08 PM
The search is on 1284893 virus strains.
License holder : Avira AntiVir Personal - FREE Antivirus
Serial number : 0000149996-ADJIE-0000001
Platform : Windows XP
Windows version : (Service Pack 2) [5.1.2600]
Boot Mode : Started normally
Identifier : SYSTEM
Computer name : BENHAMZA-A363EC
Version information :
BUILD.DAT : 9.0.0.65 17959 Bytes 22/04/2009 12:06:00
AVSCAN.EXE : 9.0.3.6 466689 Bytes 21/04/2009 12:20:54
AVSCAN.DLL : 9.0.3.0 49409 Bytes 03/03/2009 09:21:02
LUKE.DLL : 9.0.3.2 209665 Bytes 20/02/2009 10:35:11
LUKERES.DLL : 9.0.2.0 13569 Bytes 03/03/2009 09:21:31
ANTIVIR0.VDF : 7.1.0.0 15603712 Bytes 27/10/2008 11:30:36
ANTIVIR1.VDF : 7.1.2.12 3336192 Bytes 11/02/2009 19:33:26
ANTIVIR2.VDF : 7.1.2.105 513536 Bytes 03/03/2009 06:41:14
ANTIVIR3.VDF : 7.1.2.127 110592 Bytes 05/03/2009 13:58:20
Engine version : 8.2.0.100
AEVDF.DLL : 8.1.1.0 106868 Bytes 27/01/2009 16:36:42
AESCRIPT.DLL : 8.1.1.56 352634 Bytes 26/02/2009 19:01:56
AESCN.DLL : 8.1.1.7 127347 Bytes 12/02/2009 10:44:25
AERDL.DLL : 8.1.1.3 438645 Bytes 29/10/2008 17:24:41
AEPACK.DLL : 8.1.3.10 397686 Bytes 04/03/2009 12:06:10
AEOFFICE.DLL : 8.1.0.36 196987 Bytes 26/02/2009 19:01:56
AEHEUR.DLL : 8.1.0.100 1618295 Bytes 25/02/2009 14:49:16
AEHELP.DLL : 8.1.2.2 119158 Bytes 26/02/2009 19:01:56
AEGEN.DLL : 8.1.1.24 336244 Bytes 04/03/2009 12:06:10
AEEMU.DLL : 8.1.0.9 393588 Bytes 09/10/2008 13:32:40
AECORE.DLL : 8.1.6.6 176501 Bytes 17/02/2009 13:22:44
AEBB.DLL : 8.1.0.3 53618 Bytes 09/10/2008 13:32:40
AVWINLL.DLL : 9.0.0.3 18177 Bytes 12/12/2008 07:47:30
AVPREF.DLL : 9.0.0.1 43777 Bytes 03/12/2008 10:39:26
AVREP.DLL : 8.0.0.3 155905 Bytes 20/01/2009 13:34:28
AVREG.DLL : 9.0.0.0 36609 Bytes 07/11/2008 14:24:42
AVARKT.DLL : 9.0.0.3 292609 Bytes 24/03/2009 14:05:22
AVEVTLOG.DLL : 9.0.0.7 167169 Bytes 30/01/2009 09:36:37
SQLITE3.DLL : 3.6.1.0 326401 Bytes 28/01/2009 14:03:49
SMTPLIB.DLL : 9.2.0.25 28417 Bytes 02/02/2009 07:20:57
NETNT.DLL : 9.0.0.0 11521 Bytes 07/11/2008 14:40:59
RCIMAGE.DLL : 9.0.0.21 2438401 Bytes 17/02/2009 12:49:32
RCTEXT.DLL : 9.0.37.0 88321 Bytes 15/04/2009 09:07:05
Configuration for the current scan :
Task name...............................: Full system scan
Configuration file......................: c:\program files\avira\antivir desktop\sysscan.avp
Documentation.................................: low
Main action.............................: interactive
Secondary action.............................: ignore
Search for master boot sectors......: on
Search for boot sectors.........: on
Boot sectors...........................: C:,
Search in active programs..........: on
Search in the registry.......: on
Search for Rootkits.........................: on
System file integrity check......: off
File search mode.....................: All files
Search in archives....................: on
Limit recursion depth..........: 20
Archive Smart Extensions......................: on
Macrovirus heuristic.....................: on
File heuristic...........................: medium
Various danger categories.............: +APPL,+GAME,+JOKE,+PCK,+SPR,
Start of the scan : Sunday, October 11, 2009 02:08 PM
The search for hidden objects begins.
'28340' objects have been checked, '0' hidden objects have been found.
The search on running processes begins :
Process search 'avscan.exe' - '1' module(s) are checked
Process search 'avcenter.exe' - '1' module(s) are checked
Process search 'wuauclt.exe' - '1' module(s) are checked
Process search 'wscntfy.exe' - '1' module(s) are checked
Process search 'iPodService.exe' - '1' module(s) are checked
Process search 'svchost.exe' - '1' module(s) are checked
Process search 'mDNSResponder.exe' - '1' module(s) are checked
Process search 'AppleMobileDeviceService.exe' - '1' module(s) are checked
Process search 'dslmon.exe' - '1' module(s) are checked
Process search 'SUPERAntiSpyware.exe' - '1' module(s) are checked
Process search 'iTunesHelper.exe' - '1' module(s) are checked
Process search 'realsched.exe' - '1' module(s) are checked
Process search 'RTHDCPL.exe' - '1' module(s) are checked
Process search 'avgnt.exe' - '1' module(s) so -
Hello,
sorry for the delay
the antispyware report
SUPERAntiSpyware Scan Log
https://www.superantispyware.com/
Generated 10/11/2009 at 02:00 PM
Application Version : 4.29.1002
Core Rules Database Version : 4102
Trace Rules Database Version: 1978
Scan type : Complete Scan
Total Scan Time : 01:18:10
Memory items scanned : 418
Memory threats detected : 0
Registry items scanned : 3669
Registry threats detected : 0
File items scanned : 59018
File threats detected : 9
Adware.Tracking Cookie
C:\Documents and Settings\user\Cookies\user@ad.zanox[1].txt
C:\Documents and Settings\user\Cookies\user@atdmt[1].txt
C:\Documents and Settings\user\Cookies\user@bluestreak[2].txt
C:\Documents and Settings\user\Cookies\user@bs.serving-sys[2].txt
C:\Documents and Settings\user\Cookies\user@doubleclick[2].txt
C:\Documents and Settings\user\Cookies\user@msnportal.112.2o7[1].txt
C:\Documents and Settings\user\Cookies\user@qnsr[1].txt
C:\Documents and Settings\user\Cookies\user@serving-sys[2].txt
C:\Documents and Settings\user\Cookies\user@sfr.122.2o7[1].txt
the Avira report is
Avira AntiVir Personal
Report file creation date: Sunday, October 11, 2009 2:08 PM
The search covers 1,284,893 virus strains.
License holder: Avira AntiVir Personal - FREE Antivirus
Serial number: 0000149996-ADJIE-0000001
Platform: Windows XP
Windows version: (Service Pack 2) [5.1.2600]
Boot Mode: Started normally
Identifier: SYSTEM
Computer Name: BENHAMZA-A363EC
Version information:
BUILD.DAT : 9.0.0.65 17959 Bytes 22/04/2009 12:06:00
AVSCAN.EXE : 9.0.3.6 466689 Bytes 21/04/2009 12:20:54
AVSCAN.DLL : 9.0.3.0 49409 Bytes 03/03/2009 09:21:02
LUKE.DLL : 9.0.3.2 209665 Bytes 20/02/2009 10:35:11
LUKERES.DLL : 9.0.2.0 13569 Bytes 03/03/2009 09:21:31
ANTIVIR0.VDF : 7.1.0.0 15603712 Bytes 27/10/2008 11:30:36
ANTIVIR1.VDF : 7.1.2.12 3336192 Bytes 11/02/2009 19:33:26
ANTIVIR2.VDF : 7.1.2.105 513536 Bytes 03/03/2009 06:41:14
ANTIVIR3.VDF : 7.1.2.127 110592 Bytes 05/03/2009 13:58:20
Engine version: 8.2.0.100
AEVDF.DLL : 8.1.1.0 106868 Bytes 27/01/2009 16:36:42
AESCRIPT.DLL : 8.1.1.56 352634 Bytes 26/02/2009 19:01:56
AESCN.DLL : 8.1.1.7 127347 Bytes 12/02/2009 10:44:25
AERDL.DLL : 8.1.1.3 438645 Bytes 29/10/2008 17:24:41
AEPACK.DLL : 8.1.3.10 397686 Bytes 04/03/2009 12:06:10
AEOFFICE.DLL : 8.1.0.36 196987 Bytes 26/02/2009 19:01:56
AEHEUR.DLL : 8.1.0.100 1618295 Bytes 25/02/2009 14:49:16
AEHELP.DLL : 8.1.2.2 119158 Bytes 26/02/2009 19:01:56
AEGEN.DLL : 8.1.1.24 336244 Bytes 04/03/2009 12:06:10
AEEMU.DLL : 8.1.0.9 393588 Bytes 09/10/2008 13:32:40
AECORE.DLL : 8.1.6.6 176501 Bytes 17/02/2009 13:22:44
AEBB.DLL : 8.1.0.3 53618 Bytes 09/10/2008 13:32:40
AVWINLL.DLL : 9.0.0.3 18177 Bytes 12/12/2008 07:47:30
AVPREF.DLL : 9.0.0.1 43777 Bytes 03/12/2008 10:39:26
AVREP.DLL : 8.0.0.3 155905 Bytes 20/01/2009 13:34:28
AVREG.DLL : 9.0.0.0 36609 Bytes 07/11/2008 14:24:42
AVARKT.DLL : 9.0.0.3 292609 Bytes 24/03/2009 14:05:22
AVEVTLOG.DLL : 9.0.0.7 167169 Bytes 30/01/2009 09:36:37
SQLITE3.DLL : 3.6.1.0 326401 Bytes 28/01/2009 14:03:49
SMTPLIB.DLL : 9.2.0.25 28417 Bytes 02/02/2009 07:20:57
NETNT.DLL : 9.0.0.0 11521 Bytes 07/11/2008 14:40:59
RCIMAGE.DLL : 9.0.0.21 2438401 Bytes 17/02/2009 12:49:32
RCTEXT.DLL : 9.0.37.0 88321 Bytes 15/04/2009 09:07:05
Configuration for the current search:
Task name...............................: Full system scan
Configuration file......................: c:\program files\avira\antivir desktop\sysscan.avp
Documentation.................................: low
Primary action.............................: interactive
Secondary action.............................: ignore
Search for master boot sectors..: on
Search for boot sectors.........: on
Boot sectors...........................: C:,
Search in active programs..........: on
Search currently in registry.......: on
Rootkit search.........................: on
System file integrity check......: off
File search mode.....................: All files
Search in archives....................: on
Limit recursion depth..........: 20
Archive Smart Extensions......................: on
Heuristic macrovirus.....................: on
Heuristic file...........................: medium
Categories of disparate threats.............: +APPL,+GAME,+JOKE,+PCK,+SPR,
Start of search: Sunday, October 11, 2009 2:08 PM
The search for hidden objects begins.
'28340' objects have been checked, '0' hidden objects have been found.
The search on running processes begins:
Process search 'avscan.exe' - '1' module(s) are checked
Process search 'avcenter.exe' - '1' module(s) are checked
Process search 'wuauclt.exe' - '1' module(s) are checked
Process search 'wscntfy.exe' - '1' module(s) are checked
Process search 'iPodService.exe' - '1' module(s) are checked
Process search 'svchost.exe' - '1' module(s) are checked
Process search 'mDNSResponder.exe' - '1' module(s) are checked
Process search 'AppleMobileDeviceService.exe' - '1' module(s) are checked
Process search 'dslmon.exe' - '1' module(s) are checked
Process search 'SUPERAntiSpyware.exe' - '1' module(s) are checked
Process search 'iTunesHelper.exe' - '1' module(s) are checked
Process search 'realsched.exe' - '1' module(s) are checked
Process search 'RTHDCPL.exe' - '1' module(s) are checked
Process search 'avgnt.exe' - '1' module(s) are checked
Process search 'explorer.exe' - '1' module(s) are checked
Process search 'avguard.exe' - '1' module(s) are checked
Process search 'sched.exe' - '1' module(s) are checked
Process search 'spoolsv.exe' - '1' module(s) are checked
Process search 'svchost.exe' - '1' module(s) are checked
Process search 'svchost.exe' - '1' module(s) are checked
Process search 'svchost.exe' - '1' module(s) are checked
Process search 'svchost.exe' - '1' module(s) are checked
Process search 'svchost.exe' - '1' module(s) are checked
Process search 'lsass.exe' - '1' module(s) are checked
Process search 'services.exe' - '1' module(s) are checked
Process search 'winlogon.exe' - '1' module(s) are checked
Process search 'csrss.exe' - '1' module(s) are checked
Process search 'smss.exe' - '1' module(s) are checked
'28' processes have been checked with '28' modules
The search on master boot sectors begins:
Master boot sector HD0
[INFO] No virus found!
The search on boot sectors begins:
Boot sector 'C:\'
[INFO] No virus found!
The search on executable file references (registry) begins:
The registry has been checked ( '45' files).
The search on selected files begins:
Search beginning in 'C:\' <system>
C:\pagefile.sys
[WARNING] Unable to open the file!
[NOTE] This file is a Windows system file.
[NOTE] It is correct that this file cannot be opened for search.
C:\Documents and Settings\Oumeima\Desktop\alfatron n20\Bluetooth.rar
[0] Archive type: RAR
--> Bluetooth\Win64\Data1.cab
[1] Archive type: CAB (Microsoft)
--> F54937_BTTray.exe
[WARNING] No other files could be decompressed from this archive. The archive is closed.
[WARNING] No other files could be decompressed from this archive. The archive is closed.
C:\Documents and Settings\Oumeima\My Documents\MISC FILES\oumeima1\kis9.0.0.463fr.exe
[0] Archive type: NSIS
--> /setup.exe
[WARNING] No other files could be decompressed from this archive. The archive is closed.
[WARNING] No other files could be decompressed from this archive. The archive is closed.
C:\Documents and Settings\Oumeima\My Documents\MISC FILES\oumeima1\UsbFix_Upload_Me_BENHAMZA-A363EC.zip
[0] Archive type: ZIP
--> UsbFix_Upload_Me/1.taz.UsbFix
[RESULT] Contains the detection signature of worm WORM/Mabezat.B.79
C:\System Volume Information\_restore{730D25B4-D33A-4541-A834-AD0DA0165E62}\RP15\A0015725.exe
[0] Archive type: NSIS
--> /setup.exe
[WARNING] No other files could be decompressed from this archive. The archive is closed.
[WARNING] No other files could be decompressed from this archive. The archive is closed.
C:\System Volume Information\_restore{7A17A6F5-214C-4459-8979-822DD7374D71}\RP12\A0003089.exe
[0] Archive type: NSIS
--> /setup.exe
[WARNING] No other files could be decompressed from this archive. The archive is closed.
[WARNING] No other files could be decompressed from this archive. The archive is closed.
C:\System Volume Information\_restore{7A17A6F5-214C-4459-8979-822DD7374D71}\RP5\A0001790.exe
[0] Archive type: RAR SFX (self extracting)
--> 32788R22FWJFW\ForceLibrary.dll
[RESULT] Contains the Trojan TR/Hijacker.Gen
--> 32788R22FWJFW\n.pif
[RESULT] The file contains an executable program. However, it disguises itself under a harmless file extension (HIDDENEXT/Crypted)
Start of disinfection:
C:\Documents and Settings\Oumeima\My Documents\MISC FILES\oumeima1\UsbFix_Upload_Me_BENHAMZA-A363EC.zip
[NOTE] The file has been moved to the quarantine directory under the name '4b33d4cd.qua'!
C:\System Volume Information\_restore{7A17A6F5-214C-4459-8979-822DD7374D71}\RP5\A0001790.exe
[NOTE] The file has been moved to the quarantine directory under the name '4b01d48a.qua'!
End of search: Sunday, October 11, 2009 2:49 PM
Time taken: 41:08 Minute(s)
The search has been fully completed
6257 directories have been checked
205204 files have been checked
3 viruses or unwanted programs have been found
0 files have been classified as suspicious
0 files have been deleted
0 viruses or unwanted programs have been repaired
2 files have been moved to quarantine
0 files have been renamed
1 Unable to check files
205200 Uninfected files
1998 archives have been checked
9 Warnings
3 Guidelines
28340 objects have been checked during the Rootkitscan
0 hidden objects have been found
thank you for getting back to me-
Good evening
Please update your antivirus; is it working?
See you later
--
We have all been beginners at something at one point.
But knowledge is the reward of diligence.- Hello;
thank you very much, it's working, I was able to update my antivirus and antimalware,
and I ran a full scan, there's just a small problem,
when the internet disconnects, I can't connect, there's some sort of blockage at the USB level, does that mean I have to restart the computer every time the internet disconnects to reconnect, or are there other tricks;
thanks again
-
-
Hello
thank you very much now everything is in order, I was able to update the antivirus and antimalware and I managed to connect
I only have one problem left which is downloading the bluetooth driver, I think I will post the message in the appropriate place
thank you again
