ComboFix 09-02-06.04 - stephane 2009-02-07 16:23:03.1 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.3.1252.33.1036.18.1023.470 [GMT -5:00]
Running from: c:\documents and settings\stephane\Bureau\ComboFix.exe
AV: Norton 360 *On-access scanning enabled* (Updated)
FW: Norton 360 *enabled*
* Created a new restore point
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\program files\Altnet
c:\program files\Altnet\My Altnet Shares\Bullguard Protection\plugins.cab.cab
c:\windows\IE4 Error Log.txt
c:\windows\system32\aicsny.dll
c:\windows\system32\btrvtq.dll
c:\windows\system32\bxwplhyr.dll.vir
c:\windows\system32\cadueuqi.dll
c:\windows\system32\cqwepj.dll
c:\windows\system32\cttgjx.dll
c:\windows\system32\dojoqcij.dll
c:\windows\system32\drivers\fad.sys
c:\windows\system32\drivers\seneka.sys
c:\windows\system32\dsmjxota.dll
c:\windows\system32\dwklgjfx.dll
c:\windows\system32\efcAPFut.dll
c:\windows\system32\efdqmysn.dll
c:\windows\system32\ejepejqb.dll
c:\windows\system32\ertovx.dll
c:\windows\system32\evzhwo.dll
c:\windows\system32\fqljxaji.dll
c:\windows\system32\fqolep.dll
c:\windows\system32\frebqfwr.dll
c:\windows\system32\fxdgwkgq.dll
c:\windows\system32\gbuyhghm.dll
c:\windows\system32\gvueok.dll
c:\windows\system32\htrerp.dll
c:\windows\system32\hwsweh.dll
c:\windows\system32\iblhrbqe.dll
c:\windows\system32\jasblgfq.dll
c:\windows\system32\jtbjny.dll
c:\windows\system32\jzghcj.dll
c:\windows\system32\kcxtxo.dll
c:\windows\system32\khibfpbj.dll
c:\windows\system32\klpvipek.dll
c:\windows\system32\lcpznr.dll
c:\windows\system32\ldddvmxj.dll
c:\windows\system32\lglvcbwt.dll
c:\windows\system32\lxshnqbi.dll
c:\windows\system32\lxykio.dll
c:\windows\system32\lzyenm.dll
c:\windows\system32\mebptaik.dll
c:\windows\system32\miugsg.dll
c:\windows\system32\mkrinw.dll
c:\windows\system32\mksgtkpv.dll.vir
c:\windows\system32\mvwsbojn.dll
c:\windows\system32\mxopcsyd.dll
c:\windows\system32\myvfjkia.dll
c:\windows\system32\neffey.dll
c:\windows\system32\nenuxf.dll
c:\windows\system32\nitqouct.dll
c:\windows\system32\nknhyp.dll
c:\windows\system32\oemmurpn.dll
c:\windows\system32\ojwrirhn.dll
c:\windows\system32\omnoaqlk.dll
c:\windows\system32\onnhyc.dll
c:\windows\system32\ozvxzh.dll
c:\windows\system32\phdhwpxk.dll
c:\windows\system32\qgoltbeu.dll
c:\windows\system32\qnufmqas.dll
c:\windows\system32\rejsni.dll
c:\windows\system32\rjgvjlci.dll
c:\windows\system32\sbhtuk.dll
c:\windows\system32\sqypokcr.dll
c:\windows\system32\svtrnp.dll
c:\windows\system32\swcprb.dll
c:\windows\system32\tbaeioiw.dll.vir
c:\windows\system32\trrhdeih.dll
c:\windows\system32\tsdutk.dll
c:\windows\system32\tsqkkbwf.dll
c:\windows\system32\tyodxj.dll
c:\windows\system32\uidgtafp.dll
c:\windows\system32\vhncfa.dll
c:\windows\system32\wjqcvvnv.dll
c:\windows\system32\wvUnmnNh.dll.vir
c:\windows\system32\WxHhQXbc.ini
c:\windows\system32\WxHhQXbc.ini2
c:\windows\system32\xkbebrmp.dll
c:\windows\system32\xrwrtw.dll
c:\windows\system32\xviwbd.dll
c:\windows\system32\ybnjkpsp.dll
c:\windows\system32\ygubhciu.dll
c:\windows\system32\yzcvey.dll
.
((((((((((((((((((((((((( Files Created from 2009-01-07 to 2009-02-07 )))))))))))))))))))))))))))))))
.
2009-02-07 09:48 . 2009-02-07 15:33 1,605,214 ---hs---- c:\windows\system32\vnvvcqjw.ini
2009-02-06 11:26 . 2009-02-06 11:26 <REP> d-------- c:\program files\mIRC
2009-02-06 09:48 . 2009-02-06 09:48 1,590,972 ---hs---- c:\windows\system32\jicqojod.ini
2009-02-05 09:49 . 2009-02-05 09:49 1,590,555 ---hs---- c:\windows\system32\kepivplk.ini
2009-02-04 08:21 . 2009-02-04 08:21 1,563,129 ---hs---- c:\windows\system32\bqjepeje.ini
2009-02-03 05:33 . 2009-02-03 05:33 <REP> d-------- c:\program files\Nvu
2009-02-03 04:56 . 2009-02-04 08:21 1,537,668 ---hs---- c:\windows\system32\wnkffsxv.ini
2009-02-03 04:53 . 2009-02-07 16:33 1,104 --a------ c:\windows\calkjlnv
2009-02-02 07:47 . 2009-02-02 21:49 1,104 --a------ c:\windows\nryrjpuy
2009-01-26 16:25 . 2009-01-26 16:25 2,351 --a------ C:\RECUP2.DOC
2009-01-20 12:21 . 2009-01-20 12:21 284,672 --a------ c:\windows\system32\ddcAtroO.dll.vir
2009-01-20 07:16 . 2009-01-20 07:28 2,204 --a------ c:\windows\alrcuaca
2009-01-20 07:01 . 2009-01-20 07:01 59,904 --a------ c:\windows\system32\drivers\tdssserv.sys.vir
2009-01-20 06:59 . 2009-02-07 16:11 <REP> d-a------ c:\documents and settings\All Users\Application Data\TEMP
2009-01-20 06:59 . 2009-01-20 06:59 47,746 --a------ c:\windows\system32\drivers\senekanqvvnmof.sys.vir
2009-01-20 06:56 . 2009-01-20 06:58 <REP> d-------- c:\program files\Trojan Remover
2009-01-20 06:56 . 2009-01-20 06:56 <REP> d-------- c:\documents and settings\All Users\Application Data\Simply Super Software
2009-01-20 06:56 . 2006-05-25 14:52 162,304 --a------ c:\windows\system32\ztvunrar36.dll
2009-01-20 06:56 . 2003-02-02 19:06 153,088 --a------ c:\windows\system32\UNRAR3.dll
2009-01-20 06:56 . 2005-08-26 00:50 77,312 --a------ c:\windows\system32\ztvunace26.dll
2009-01-20 06:56 . 2002-03-06 00:00 75,264 --a------ c:\windows\system32\unacev2.dll
2009-01-20 06:56 . 2006-06-19 12:01 69,632 --a------ c:\windows\system32\ztvcabinet.dll
2009-01-20 06:34 . 2009-01-20 06:34 <REP> d-------- c:\program files\Trend Micro
2009-01-20 06:27 . 2009-01-20 06:27 <REP> d-------- c:\program files\Malware Removal Tool
2009-01-11 08:40 . 2009-01-11 08:40 <REP> d-------- C:\ATI
2009-01-10 21:30 . 2009-01-10 21:45 664 --a------ c:\windows\system32\d3d9caps.dat
2009-01-10 19:19 . 2009-01-10 19:19 218,624 --a------ c:\windows\system32\sysqvkeg.exe
2009-01-09 08:01 . 2009-01-09 08:02 <REP> d-------- c:\documents and settings\All Users\Application Data\Lavasoft
2009-01-09 07:37 . 2009-01-09 07:37 <REP> d-------- c:\program files\Fichiers communs\Wise Installation Wizard
2009-01-08 21:44 . 2009-01-08 21:44 73,216 --a------ c:\windows\system32\ffkuz.dll
2009-01-08 21:31 . 2008-09-25 08:20 483,328 --a------ c:\windows\system32\actskn45.ocx
2009-01-08 21:28 . 2009-01-08 21:28 38,400 --a------ c:\windows\system32\prunnet.exe.vir
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-02-07 14:06 --------- d-----w c:\documents and settings\All Users\Application Data\Google Updater
2009-01-30 14:57 --------- d-----w c:\program files\Fichiers communs\Symantec Shared
2009-01-11 13:47 --------- d--h--w c:\program files\InstallShield Installation Information
2009-01-11 13:42 --------- d-----w c:\program files\ATI Technologies
2009-01-09 13:01 --------- d-----w c:\program files\Lavasoft
2009-01-09 12:17 --------- d-----w c:\program files\Google
2009-01-09 03:53 --------- d-----w c:\program files\CyberLink
2009-01-09 03:47 --------- d-----w c:\program files\Fichiers communs\Macromedia
2009-01-09 03:46 --------- d-----w c:\program files\Macromedia
2009-01-09 03:42 --------- d-----w c:\program files\LimeWire
2009-01-07 01:41 --------- d-----w c:\documents and settings\All Users\Application Data\Office Genuine Advantage
2008-12-23 21:17 --------- d-----w c:\documents and settings\All Users\Application Data\Symantec
2008-12-21 11:34 805 ----a-w c:\windows\system32\drivers\SYMEVENT.INF
2008-12-21 11:34 123,952 ----a-w c:\windows\system32\drivers\SYMEVENT.SYS
2008-12-21 11:34 10,671 ----a-w c:\windows\system32\drivers\SYMEVENT.CAT
2008-12-21 11:34 --------- d-----w c:\program files\Symantec
2008-12-21 03:20 --------- d-----w c:\program files\Norton 360
2008-12-18 02:39 --------- d-----w c:\program files\Windows Sidebar
2008-12-16 18:42 --------- d-----w c:\program files\Microsoft SQL Server
2008-12-11 15:54 --------- d-----w c:\program files\PacificPoker
2008-07-20 17:49 32,768 --sha-w c:\windows\system32\config\systemprofile\Local Settings\Historique\History.IE5\MSHist012008072020080721\index.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\OverlayExcluded]
@="{4433A54A-1AC8-432F-90FC-85F045CF383C}"
[HKEY_CLASSES_ROOT\CLSID\{4433A54A-1AC8-432F-90FC-85F045CF383C}]
2008-10-31 12:24 576352 --a------ c:\program files\Fichiers communs\Symantec Shared\Backup\buShell.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\OverlayPending]
@="{F17C0B1E-EF8E-4AD4-8E1B-7D7E8CB23225}"
[HKEY_CLASSES_ROOT\CLSID\{F17C0B1E-EF8E-4AD4-8E1B-7D7E8CB23225}]
2008-10-31 12:24 576352 --a------ c:\program files\Fichiers communs\Symantec Shared\Backup\buShell.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\OverlayProtected]
@="{476D0EA3-80F9-48B5-B70B-05E677C9C148}"
[HKEY_CLASSES_ROOT\CLSID\{476D0EA3-80F9-48B5-B70B-05E677C9C148}]
2008-10-31 12:24 576352 --a------ c:\program files\Fichiers communs\Symantec Shared\Backup\buShell.dll
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-13 15360]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-04-03 68856]
"pdfSaver3"="c:\program files\Tracker Software\PDF-XChange 3\pdfSaver\pdfSaver3.exe" [2004-09-05 380928]
"updateMgr"="c:\program files\Adobe\Acrobat 7.0\Acrobat\AdobeUpdateManager.exe" [2006-03-30 313472]
"H/PC Connection Agent"="c:\program files\Microsoft ActiveSync\Wcescomm.exe" [2006-11-13 1289000]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Apoint"="c:\program files\Apoint\Apoint.exe" [2004-09-13 155648]
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]
"IntelWireless"="c:\program files\Intel\Wireless\Bin\ifrmewrk.exe" [2004-10-30 385024]
"ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-05-12 344064]
"Acrobat Assistant 7.0"="c:\program files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe" [2006-01-12 483328]
"DLPSP"="c:\program files\dell printers\Additional Color Laser Software\Status Monitor\DLPSP.EXE" [2005-01-13 126976]
"IntelliPoint"="c:\program files\Microsoft IntelliPoint\ipoint.exe" [2005-12-04 461584]
"itype"="c:\program files\Microsoft IntelliType Pro\itype.exe" [2005-12-04 437008]
"HPHUPD05"="c:\program files\Hewlett-Packard\\{5372B9A6-6E51-4f90-9B40-E0A3B8475C4E}\hphupd05.exe" [2006-01-06 49152]
"HP Component Manager"="c:\program files\HP\hpcoretech\hpcmpmgr.exe" [2003-12-22 241664]
"HPHmon05"="c:\windows\system32\hphmon05.exe" [2006-01-06 491520]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2006-10-25 282624]
"MMReminderService"="c:\program files\Mindjet\MindManager 6\MMReminderService.exe" [2006-12-14 31232]
"PWRISOVM.EXE"="c:\program files\PowerISO\PWRISOVM.EXE" [2006-11-06 200704]
"HP Software Update"="c:\program files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe" [2007-05-08 54840]
"SmartSoft PDF Printer (demo) Agent"="c:\program files\Smart PDF Converter Pro\sspdfagentd.exe" [2007-10-22 94208]
"SmartSoft PDF Printer (demo) virtual printer agent"="c:\program files\Smart PDF Converter Pro\sspdfagentd.exe" [2007-10-22 94208]
"ccApp"="c:\program files\Fichiers communs\Symantec Shared\ccApp.exe" [2008-10-17 51048]
"osCheck"="c:\program files\Norton 360\osCheck.exe" [2008-02-26 988512]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-13 15360]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\IntelWireless]
2004-09-07 16:08 110592 c:\program files\Intel\Wireless\Bin\LgNotify.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=svtrnp.dll
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Microsoft Office\\OFFICE11\\EXCEL.EXE"=
"c:\\Program Files\\Microsoft Office\\OFFICE11\\POWERPNT.EXE"=
"c:\\Program Files\\Microsoft Office\\OFFICE11\\WINWORD.EXE"=
"c:\\WINDOWS\\system32\\fxsclnt.exe"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=
"c:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"c:\\Program Files\\MSN Messenger\\livecall.exe"=
"c:\program files\Microsoft ActiveSync\rapimgr.exe"= c:\program files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager
"c:\program files\Microsoft ActiveSync\wcescomm.exe"= c:\program files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager
"c:\program files\Microsoft ActiveSync\WCESMgr.exe"= c:\program files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\SmartFTP Client\\SmartFTP.exe"=
"c:\\Program Files\\mIRC\\mirc.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service
R2 DLSDB;Dell Printer Status Database;c:\program files\Dell Printers\Additional Color Laser Software\Status Monitor\dlsdbnt.exe [2006-04-28 135168]
R2 LiveUpdate Notice;LiveUpdate Notice;c:\program files\Fichiers communs\Symantec Shared\CCSVCHST.EXE [2008-02-18 149352]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Fichiers communs\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2008-12-20 99376]
R3 GTIPCI21;GTIPCI21;c:\windows\system32\drivers\gtipci21.sys [2005-10-25 80384]
S0 alrcuaca;alrcuaca; [x]
S0 calkjlnv;calkjlnv;c:\windows\system32\drivers\eyyjjjha.sys []
S0 nryrjpuy;nryrjpuy; [x]
S2 gupdate1c970b142204a6;Google Update Service (gupdate1c970b142204a6);c:\program files\Google\Update\GoogleUpdate.exe [2009-01-07 133104]
S3 COH_Mon;COH_Mon;c:\windows\system32\drivers\COH_Mon.sys [2008-01-12 23888]
--- Other Services/Drivers In Memory ---
*NewlyCreated* - COMHOST
.
Contents of the 'Scheduled Tasks' folder
2009-02-07 c:\windows\Tasks\GoogleUpdateTaskMachine.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-01-07 05:16]
2009-02-07 c:\windows\Tasks\User_Feed_Synchronization-{FC770AE9-DE7C-4898-8562-115EF651BFE0}.job
- c:\windows\system32\msfeedssync.exe [2006-10-17 11:58]
.
- - - - ORPHANS REMOVED - - - -
BHO-{c0181f8e-000f-4b2b-a6eb-872fe0b503a5} - c:\windows\system32\svtrnp.dll
BHO-{E78A0314-0BE1-4EFF-AB33-C5AE0EF5F8E4} - c:\windows\system32\cbXQhHxW.dll
HKCU-Run-BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA} - c:\program files\Fichiers communs\Ahead\lib\NMBgMonitor.exe
HKCU-Run-eyeBeam SIP Client - (no file)
HKLM-Run-78b91414 - c:\windows\system32\wjqcvvnv.dll
HKLM-Run-NWEReboot - (no file)
HKLM-Run-pdfSaver3 - (no file)
.
------- Supplementary Scan -------
.
uStart Page = about:blank
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: Convert link target to Adobe PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convert link target to existing PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert selected links to Adobe PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Convert selected links to existing PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Convert selection to Adobe PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convert selection to existing PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert to Adobe PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convert to existing PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
Trusted Zone: registeredsite.com\report
DPF: {4871A87A-BFDD-4106-8153-FFDE2BAC2967} - hxxp://dlm.tools.akamai.com/dlmanager/versions/activex/dlm-activex-2.2.4.1.cab
DPF: {4A3CBDDD-C4DC-4C38-B44F-704DAEF628AE} - hxxp://24.203.221.53/ProjectServer/objects/pjclient.cab
DPF: {AF9A1421-E128-4D5F-A37E-039F305867B9} - hxxp://24.203.221.53/ProjectServer/objects/1033/pjcintl.cab
DPF: {D3CE6AB6-8B46-436E-853E-CE6FEFA9652F} - hxxp://k-log/UImageUploaderCAB/UImageUploaderXPD.cab
DPF: {E72CFC93-BAE3-8D60-85D1-129993AAC8B9} - hxxp://www.motointer.com/UImageUploaderCAB/UImageUploaderXP.cab
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
http://www.gmer.netRootkit scan 2009-02-07 16:36:01
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
c:\windows\system32\drivers\eyyjjjha.sys 25088 bytes executable
scan completed successfully
hidden files: 1
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\Ø•€|ÿÿÿÿ•€|ù•9~*]
"C040111900063D11C8EF10054038389C"="C?\\WINDOWS\\system32\\FM20ENU.DLL"
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'winlogon.exe'(1192)
c:\windows\system32\Ati2evxx.dll
c:\program files\Intel\Wireless\Bin\LgNotify.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\ati2evxx.exe
c:\program files\Intel\Wireless\Bin\EvtEng.exe
c:\program files\Intel\Wireless\Bin\S24EvMon.exe
c:\program files\Intel\Wireless\Bin\WLKEEPER.exe
c:\program files\Intel\Wireless\Bin\ZCfgSvc.exe
c:\program files\Lavasoft\Ad-Aware\aawservice.exe
c:\windows\system32\scardsvr.exe
c:\progra~1\Intel\Wireless\Bin\1XConfig.exe
c:\program files\Symantec\LiveUpdate\AluSchedulerSvc.exe
c:\windows\system32\BAsfIpM.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe
c:\program files\Dell\OpenManage\Client\Iap.exe
c:\program files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\program files\Microsoft SQL Server\MSSQL$MICROSOFTBCM\Binn\sqlservr.exe
c:\windows\system32\ati2evxx.exe
c:\program files\Dell\NicConfigSvc\NicConfigSvc.exe
c:\program files\Intel\Wireless\Bin\RegSrvc.exe
c:\program files\Dell Printers\Additional Color Laser Software\Status Monitor\dlpwdnt.exe
c:\program files\Apoint\ApntEx.exe
c:\progra~1\MI3AA1~1\rapimgr.exe
c:\program files\Digital Line Detect\DLG.exe
c:\program files\Java\jre1.6.0_07\bin\jucheck.exe
.
**************************************************************************
.
Completion time: 2009-02-07 16:43:09 - machine was rebooted
ComboFix-quarantined-files.txt 2009-02-07 21:42:27
Pre-Run: 5ÿ072ÿ322ÿ560 octets libres
Post-Run: 5,057,183,744 octets libres
333 --- E O F --- 2008-12-18 01:09:25