ComboFix 09-02-24.02 - Sinead 2009-02-25 18:40:28.5 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.2.1256.213.1036.18.511.293 [GMT 1:00]
Running from: c:\documents and settings\Sinead\Bureau\ComboFix.exe
AV: Avira AntiVir PersonalEdition *On-access scanning disabled* (Updated)
* Created a new restore point
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\windows\system32\aifmfuiw.ini
c:\windows\system32\bhlcjbii.ini
c:\windows\system32\cuuqbhhk.ini
c:\windows\system32\fjtfiolf.ini
c:\windows\system32\jmuhewvf.ini
c:\windows\system32\mqjxhntw.ini
c:\windows\system32\nmxcnquh.ini
c:\windows\system32\ovqxdwrh.ini
c:\windows\system32\vbehophw.ini
c:\windows\system32\vsahlynr.ini
c:\windows\system32\wlletbcb.ini
.
((((((((((((((((((((((((( Files Created from 2009-01-25 to 2009-02-25 )))))))))))))))))))))))))))))))
.
2009-02-24 16:46 . 2009-02-24 16:46 69,120 --a------ c:\windows\system32\whpohebv.VIR000
2009-02-23 16:42 . 2009-02-23 16:42 236,544 --a------ c:\windows\system32\byXPhIbA.VIR000
2009-02-22 01:48 . 2009-02-22 01:48 68,608 --a------ c:\windows\system32\huqncxmn.VIR
2009-02-22 01:47 . 2009-02-22 01:47 237,056 --a------ c:\windows\system32\vtUmJBSk.VIR000
2009-02-20 01:06 . 2009-02-20 01:06 68,608 --a------ c:\windows\system32\iibjclhb.VIR000
2009-02-20 01:04 . 2009-02-20 01:05 236,544 --a------ c:\windows\system32\cbXNDSll.VIR
2009-02-18 02:51 . 2009-02-18 03:06 <REP> d-------- c:\windows\BDOSCAN8
2009-02-17 03:56 . 2009-02-17 03:56 236,544 --a------ c:\windows\system32\tuvVOEXp.VIR000
2009-02-12 11:55 . 2009-02-12 11:55 <REP> d-------- c:\documents and settings\All Users\Application Data\Avira
2009-02-12 11:00 . 2009-02-12 11:00 <REP> d-------- c:\documents and settings\LocalService\Menu Démarrer
2009-02-12 10:56 . 2009-02-12 10:56 86,792 --a------ c:\windows\system32\drivers\bdfndisf.sys
2009-02-12 10:31 . 2009-02-12 11:27 <REP> d-------- c:\program files\BitDefender
2009-02-12 00:32 . 2009-02-24 21:46 <REP> d-------- c:\documents and settings\All Users\Application Data\Google Updater
2009-02-11 22:02 . 2009-02-11 22:02 <REP> d-------- c:\documents and settings\Sinead\Application Data\PCToolsFirewallPlus
2009-02-11 22:01 . 2009-02-11 22:01 <REP> d-------- c:\documents and settings\Sinead\Application Data\PCToolsSpamMonitorPlus
2009-02-11 19:56 . 2009-02-12 10:26 <REP> d-a------ c:\documents and settings\All Users\Application Data\TEMP
2009-02-11 19:55 . 2009-02-13 16:37 <REP> d-------- c:\program files\PC Tools Internet Security
2009-02-11 19:55 . 2009-02-12 10:27 <REP> d-------- c:\documents and settings\All Users\Application Data\PC Tools
2009-02-11 19:23 . 2009-02-11 19:23 159,578 --a------ c:\windows\Marsu-Fix 2.5 Uninstaller.exe
2009-02-11 13:57 . 2009-02-11 13:57 <REP> d-------- c:\program files\RAR Password Cracker
2009-02-11 13:47 . 2009-02-11 13:47 <REP> d-------- c:\program files\Rar Repair Tool
2009-02-11 13:26 . 2009-02-11 13:26 <REP> d-------- c:\program files\PicoZipRT
2009-02-10 18:43 . 2009-02-10 18:43 <REP> d-------- c:\program files\LizardTech
2009-02-10 16:00 . 2009-02-24 22:00 <REP> d-------- c:\program files\PDF Password Cracker Pro v3.0
2009-02-10 15:58 . 2009-02-10 15:58 <REP> d-------- C:\Archivos de programa
2009-02-10 15:52 . 2009-02-11 13:29 480 --a------ c:\windows\crackpdf.INI
2009-02-10 15:51 . 2009-02-10 15:52 <REP> d-------- c:\program files\PDF Password Cracker v3.0
2009-02-10 00:03 . 2009-02-10 00:03 <REP> d-------- c:\program files\ESET
2009-02-09 20:36 . 2009-02-09 20:36 <REP> d-------- c:\program files\Malwarebytes' Anti-Malware
2009-02-09 20:36 . 2009-01-14 16:11 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys
2009-02-09 20:36 . 2009-01-14 16:11 15,504 --a------ c:\windows\system32\drivers\mbam.sys
2009-02-09 19:55 . 2009-02-09 20:32 <REP> d-------- c:\program files\FindyKill
2009-02-09 19:37 . 2009-02-09 19:37 <REP> d-------- c:\windows\35C03C043F1F42C2A989A757EE691F65.TMP
2009-02-09 19:07 . 2009-02-10 00:10 <REP> d-------- c:\program files\ElcomSoft
2009-02-09 17:28 . 2009-02-09 17:28 4,608 --a------ c:\windows\system32\redcuhpn.dll
2009-02-09 10:17 . 2009-02-09 17:27 <REP> d-------- c:\program files\IsoBourse
2009-02-08 17:58 . 2009-02-08 18:03 <REP> d-------- c:\program files\eToro
2009-02-07 23:59 . 2009-02-07 23:59 <REP> d-------- C:\OpenSSL
2009-02-07 23:59 . 2009-02-07 23:59 155,648 --a------ c:\windows\system32\libssl32.dll
2009-02-07 20:09 . 2009-02-10 00:06 <REP> d-------- c:\program files\Download Direct
2009-02-05 19:26 . 2004-05-14 16:53 462,848 --a------ c:\windows\system32\ltkrn13n.dll
2009-02-05 19:26 . 2004-05-14 16:53 450,560 --a------ c:\windows\system32\ltimg13n.dll
2009-02-05 19:26 . 2004-05-14 16:53 401,408 --a------ c:\windows\system32\lfcmp13n.dll
2009-02-05 19:26 . 2004-05-14 16:53 299,008 --a------ c:\windows\system32\ltdis13n.dll
2009-02-05 19:26 . 2004-01-12 02:09 206,336 --a------ c:\windows\system32\ltefx13n.dll
2009-02-05 19:26 . 2004-05-14 16:53 163,840 --a------ c:\windows\system32\ltfil13n.dll
2009-02-05 19:26 . 2003-11-04 15:10 69,632 --a------ c:\windows\system32\lfgif13n.dll
2009-02-05 19:26 . 2004-05-14 16:53 57,344 --a------ c:\windows\system32\lfbmp13n.dll
2009-02-02 00:38 . 2009-02-02 00:38 <REP> d-------- c:\program files\Fichiers communs\Macrovision Shared
2009-02-02 00:37 . 2008-04-07 05:38 45,392 -ra------ c:\windows\system32\AdobePDF.dll
2009-02-02 00:37 . 2008-04-07 05:38 22,872 -ra------ c:\windows\system32\AdobePDFUI.dll
2009-01-27 19:18 . 2009-01-27 19:18 59 --a------ c:\windows\system32\E_S15.tmp
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-02-25 17:04 --------- d-----w c:\program files\eMule
2009-02-24 18:17 --------- d-----w c:\documents and settings\Sinead\Application Data\Skype
2009-02-24 16:23 --------- d-----w c:\documents and settings\Sinead\Application Data\skypePM
2009-02-18 11:52 --------- d-----w c:\documents and settings\All Users\Application Data\Microsoft Help
2009-02-16 20:06 --------- d-----w c:\program files\MessengerDiscovery
2009-02-15 17:57 --------- d-----w c:\program files\Google
2009-02-10 17:43 --------- d--h--w c:\program files\InstallShield Installation Information
2009-02-10 15:26 --------- d-----w c:\program files\Fichiers communs\Adobe
2009-02-09 22:59 --------- d-----w c:\program files\VS Revo Group
2009-02-06 10:20 --------- d-----w c:\program files\Yahoo!
2009-02-05 10:15 --------- d-----w c:\program files\Mp3 My Mp3 2.0
2009-01-30 12:32 --------- d-----w c:\program files\MediaMonkey
2009-01-23 18:31 --------- d-----w c:\documents and settings\All Users\Application Data\FLEXnet
2009-01-22 17:54 --------- d-----w c:\documents and settings\Sinead\Application Data\TotalRecorder
2009-01-22 17:47 --------- d-----w c:\program files\HighCriteria
2009-01-22 16:06 --------- d-----w c:\documents and settings\Sinead\Application Data\Todae
2009-01-22 16:05 --------- d-----w c:\program files\The Rosetta Stone
2009-01-22 15:45 --------- d-----w c:\documents and settings\All Users\Application Data\Kaspersky Lab
2009-01-22 15:39 --------- d-----w c:\program files\Apple Software Update
2009-01-22 15:26 --------- d-----w c:\program files\NOS
2009-01-22 15:26 --------- d-----w c:\documents and settings\All Users\Application Data\NOS
2009-01-20 23:57 --------- d-----w c:\program files\Ela-Salaty
2009-01-20 23:08 --------- d-----w c:\program files\Total Video Converter
2009-01-16 16:57 --------- d-----w c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-01-16 16:55 --------- d-----w c:\program files\Spybot - Search & Destroy
2009-01-15 09:43 --------- d-----w c:\program files\Sierra On-Line
2009-01-15 08:35 --------- d-----w c:\program files\TLC-Edusoft
2009-01-13 10:22 --------- d-----w c:\program files\TuneUp Utilities 2008
2009-01-13 10:22 --------- d-----w c:\documents and settings\Sinead\Application Data\Malwarebytes
2009-01-13 10:22 --------- d-----w c:\documents and settings\All Users\Application Data\Malwarebytes
2009-01-10 11:26 --------- d-----w c:\documents and settings\All Users\Application Data\ESET
2009-01-10 11:25 --------- d-----w c:\documents and settings\All Users\Application Data\Avg8
2009-01-01 00:25 --------- d-----w c:\program files\QuickTime
2009-01-01 00:23 --------- d-----w c:\program files\Fichiers communs\Apple
2009-01-01 00:23 --------- d-----w c:\documents and settings\All Users\Application Data\Apple Computer
2008-12-31 21:17 410,984 ----a-w c:\windows\system32\deploytk.dll
2008-12-31 21:16 --------- d-----w c:\program files\Java
2008-12-27 08:34 --------- d-----w c:\documents and settings\Sinead\Application Data\Ahead
2004-08-04 04:54 65,024 --sha-w c:\windows\system32\asycfilt.dll
2006-08-25 15:51 617,472 --sha-w c:\windows\system32\comctl32.dll
2004-08-04 04:54 1,028,096 --sha-w c:\windows\system32\mfc42.dll
2002-09-07 00:00 57,344 --sha-w c:\windows\system32\mfc42loc.dll
2004-08-04 04:54 413,696 --sha-w c:\windows\system32\msvcp60.dll
2004-08-04 04:54 343,040 --sha-w c:\windows\system32\msvcrt.dll
2002-09-07 00:00 253,952 --sha-w c:\windows\system32\msvcrt20.dll
2007-12-04 18:41 550,912 --sha-w c:\windows\system32\oleaut32.dll
2004-08-04 04:54 83,456 --sha-w c:\windows\system32\olepro32.dll
2004-08-04 04:54 30,749 --sha-w c:\windows\system32\vbajet32.dll
.
((((((((((((((((((((((((((((( SnapShot@2009-02-24_20.00.46.59 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-02-25 11:19:27 16,384 ----atw c:\windows\temp\Perflib_Perfdata_314.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2004-10-13 1694208]
"MsnMsgr"="c:\program files\MSN Messenger\MsnMsgr.Exe" [2007-01-19 5674352]
"eMuleAutoStart"="c:\program files\eMule\eMule.exe" [2008-05-14 5423104]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2008-09-06 413696]
"BigDogPath"="c:\windows\VM_STI.EXE" [2005-02-28 53248]
"TkBellExe"="c:\program files\Fichiers communs\Real\Update_OB\realsched.exe" [2008-06-19 180269]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]
"Adobe Acrobat Speed Launcher"="c:\program files\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe" [2008-06-12 37232]
"Acrobat Assistant 8.0"="c:\program files\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe" [2008-06-11 640376]
"TrialReset"="c:\windows\regx32.exe" [2008-07-03 285327]
"avgnt"="c:\program files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-06-12 266497]
"SoundMan"="SOUNDMAN.EXE" [2003-08-15 c:\windows\SOUNDMAN.EXE]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-04 15360]
c:\documents and settings\Sinead\Menu D‚marrer\Programmes\D‚marrage\
Ela-Salaty.lnk - c:\program files\Ela-Salaty\Salaty.exe [2007-03-05 5353984]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"appinit_dlls"=acaptuser32.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"mixer"= DrvTrNTm.dll
"wave"= DrvTrNTm.dll
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0OODBS
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Adobe Acrobat Speed Launcher.lnk]
path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\Adobe Acrobat Speed Launcher.lnk
backup=c:\windows\pss\Adobe Acrobat Speed Launcher.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ares]
--a------ 2008-08-21 16:45 888832 c:\program files\Ares\Ares.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]
--a------ 2004-08-04 05:54 15360 c:\windows\system32\ctfmon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EPSON Stylus CX3200]
--a------ 2002-07-01 04:05 74752 c:\windows\system32\spool\drivers\w32x86\3\E_S10IC2.EXE
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
--a------ 2004-10-13 17:24 1694208 c:\program files\Messenger\msmsgs.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--a------ 2001-07-09 09:50 155648 c:\windows\system32\NeroCheck.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
--a------ 2008-06-19 16:02 180269 c:\program files\Fichiers communs\Real\Update_OB\realsched.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Fichiers communs\Ahead\lib\NMBgMonitor.exe"
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"TkBellExe"="c:\program files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
"IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" -atboottime
"PHIME2002A"=c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
"PHIME2002ASync"=c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
"BigDogPath"=c:\windows\VM_STI.EXE Vimicro USB PC Camera LTI301P
"REGSHAVE"=c:\program files\REGSHAVE\REGSHAVE.EXE /AUTORUN
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\eMule\\eMule.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\MessengerDiscovery\\MessengerDiscovery Live.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
"c:\\Program Files\\Ares\\Ares.exe"=
"c:\\Documents and Settings\\All Users\\Application Data\\Kaspersky Lab Setup Files\\Kaspersky Anti-Virus 7.0.1.325\\French\\setup.exe"=
"c:\\Program Files\\Windows Media Player\\wmplayer.exe"=
"c:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"c:\\Program Files\\MSN Messenger\\livecall.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"7571:UDP"= 7571:UDP:UDP
"7561:TCP"= 7561:TCP:TCP
R0 sfsync03;StarForce Protection Synchronization Driver (version 3.x);c:\windows\system32\drivers\sfsync03.sys [2005-12-06 35328]
R3 slnt;RTL8139D PCI Fast Ethernet Adapter;c:\windows\system32\drivers\slnt.sys [2008-06-17 18004]
R3 TotRec7;Total Recorder WDM audio driver;c:\windows\system32\drivers\TotRec7.sys [2009-01-22 126984]
S2 gupdate1c98ca1717b0722;Google Update Service (gupdate1c98ca1717b0722);c:\program files\Google\Update\GoogleUpdate.exe [2009-02-12 133104]
S3 lredbooo;lredbooo;\??\c:\docume~1\Sinead\LOCALS~1\Temp\lredbooo.sys --> c:\docume~1\Sinead\LOCALS~1\Temp\lredbooo.sys [?]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bdx REG_MULTI_SZ scan
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\M]
\Shell\AutoRun\command - M:\start.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{23e7e9fd-92d8-11dd-99a2-00a1b0016a92}]
\Shell\AutoRun\command - L:\fppg1.exe
\Shell\explore\Command - L:\fppg1.exe
\Shell\open\Command - L:\fppg1.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{350b92d0-8a84-11dd-998f-000000000000}]
\Shell\AutoRun\command - L:\LaunchU3.exe -a
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{79e2bf31-4f5e-11dd-993e-000000000000}]
\shell\explore\command - ZG.PIF
\shell\open\Command - ZG.PIF
.
Contents of the 'Scheduled Tasks' folder
2009-02-25 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-02-12 00:32]
2009-02-25 c:\windows\Tasks\GoogleUpdateTaskMachine.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-02-12 00:35]
2009-02-20 c:\windows\Tasks\Maintenance en 1 clic.job
- c:\program files\TuneUp Utilities 2008\OneClick.exe [2008-06-20 09:23]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://fr.yahoo.com/
mStart Page = hxxp://fr.yahoo.com
uSearchURL,(Default) = hxxp://fr.rd.yahoo.com/customize/ie/defaults/su/msgr8/*http://fr.search.yahoo.com
IE: Ajouter la cible du lien à un fichier PDF existant - c:\program files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Ajouter à un fichier PDF existant - c:\program files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
IE: Consulter les dictionnaires (SYSTRAN) - c:\program files\SYSTRAN\6\\GUIres.dll/lookup.js
IE: Convertir au format Adobe PDF - c:\program files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
IE: Convertir la cible du lien au format Adobe PDF - c:\program files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: Traduire (SYSTRAN) - c:\program files\SYSTRAN\6\\GUIres.dll/translate.js
DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} - hxxp://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
FF - ProfilePath - c:\documents and settings\Sinead\Application Data\Mozilla\Firefox\Profiles\vxtt5ju5.default\
FF - prefs.js: browser.search.selectedEngine - Wikipأ©dia (fr)
FF - prefs.js: browser.startup.homepage - www.google.fr
FF - plugin: c:\program files\Google\Google Updater\2.4.1487.6512\npCIDetect13.dll
FF - plugin: c:\program files\Google\Update\1.2.141.5\npGoogleOneClick7.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npdjvu.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npGoogleGadgetPluginFirefoxWin.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npyaxmpb.dll
---- FIREFOX POLICIES ----
FF - user.js: network.http.max-persistent-connections-per-server - 4
FF - user.js: content.max.tokenizing.time - 200000
FF - user.js: content.notify.interval - 100000
FF - user.js: content.switch.threshold - 650000
FF - user.js: nglayout.initialpaint.delay - 300
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-02-25 18:44:39
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
[HKEY_USERS\S-1-5-21-1757981266-261903793-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{1FBB77BF-9CBB-56D3-1519-4345B33092FA}*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\System*]
"OODEFRAG10.00.00.01WORKSTATION"="A8597018E93E2152883BD1B8A26FF5420802086091B0C6C40D95926518A3EC129F45CCE9500
BF31B3078511BBABFAB58FEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BEC
C74CFEBC9E127BECC74CFEBC9E127BECC74CA6A0AC4980AC7933A6A0AC4980AC7933A9C6AECB7A5D1
407BA7FD869164D679418CC964FCBE6833F8FA36E901976E50EDEBB6CA9D1026551B327146FDF0C42
91A60747E4B1D97479FDBF318564F4C09FC3B97F96BFB116692CB3E71088CC41F9C42885139291E92
980BDF9EF371A661D84496DBF0C12D860D1E05303721CA214B77E026270AFA42E1A349F6CE01D4CC5
016BD271EF1677F40438D5E7E343A6447A3E44623D75772B8021CB9922DCF91ECB069F7C9951512CD
129C4DE19B21FAEB8FEA427E2CCCB089EE37E9BAED78FED2D6218B6A900D7507F06C70D407C75BF54
3BD1C4BCC19DEE92BF0B9931B53CC2A1AED27738FD91EE0706DD9DFC57A224E3D1CC561A027D50AFD
F16BE45BD466BD67ABB9BCE4F98D714C056BCE51F37CD2F886C7DBF648F5E7DCE9C3DFDDC867C313C
9383E9979A218738D51E06D156F3B605D958E65F0B90337D6C465E246ACDC74EEC147DA2DB23744BD
5F45D13B690A8D21291388DBEA24240A712DFC872FB676C31B76EDDB0FBA543237C5C29A4606CE167
D0573188124C4F46DC7023B4E70D399AD797DA848B95C8DDF16DFE7EE71B068047D52D5D24274712E
5EEB0DB34EFB93967C6CE5578F66BFA97E82438EB02F456A5BD89455E5E292B70B291A2C9F357F0DA
3D1534AB2C9C43311FCBD8F4234B37A20971DD8C30D70345848B5A5437DDF9AA322BC951CEB3540BD
2CA7AD43408437B29B5D5BD8F9CE0AE2108EAC4088160D1CDB34E5A2C691EF03B9DCE1B9E8FF26B01
C97345A1A4DE7D38124BCDEAD50353307211FD43DD653503E3179E7EA70EB66AC50DB9427EEC04EF5
B8AE916559533EAD2F3B2C893C22DC9DEAB79277D3324AF658EF60021CD9B623AC7D2755C217883E1
EDB8A570A332A17677091E1ED2FE120AF99C9BE1971E9A26B88A28AC8033F352878EF63E48A392B4F
9719A00B494C3B4620C0E7FB46D1ABAA8D483EC63702A7AE1F98C2B466197C945970D7871376E10F1
6E001AE5EA573C72B88DA4CC4709D2AC05EACA06D09E0703251543F6BE2F65622DD1353B7F390D0A0
482C1964EE57A2F7C4B1344DC0C656C090AFE878692A785F814B99D961FB572455095EAA48A32C3F0
99DE1173B5FDD1F5F3B0B8EA9F67BE440EF2C59FD76545521C574B69B5E1D738F66B5105679016601
03FF3D0CC5F87C53B13C40FA9EBAF413E9D89C01991EFEAB65C3F075F00AF035075F69C086AEA7848
ADFBDB4DBD74EF3FE74D545AEE9F6662B666F4D1D22CDD5B83D33B2F87899C1A3CA202F0F3677E611
79451934D92CBB6E6274AE4B3A830"
.
Completion time: 2009-02-25 18:49:02
ComboFix-quarantined-files.txt 2009-02-25 17:47:45
ComboFix2.txt 2009-02-24 19:02:31
ComboFix3.txt 2008-12-01 19:17:34
ComboFix4.txt 2008-10-07 23:42:00
ComboFix5.txt 2009-02-25 17:39:26
Pre-Run: 4 110 237 696 octets libres
Post-Run: 4,103,696,384 octets libres
285 --- E O F --- 2009-02-12 02:01:01
