Dropper

Je m'excuse de ce retart. j'ai telechargé et éxécuté usbfix u6.098 mais je ne trouve aucun rapport seulement un tableau noir avec le dessin d'un chat ...............

salut . Merci jlpjlp. je crois que je me suis déberassé de ce malvaillant . les choses se sont passées comme suit :j'étais entrain de chercher le rapport de usbfix que vous m'avez demandé sur c /usbfix j'ai cliqué sur les touches au hazart .j'ai trouvé un fichier quarantine .en l'ouvrant . il y avait dedant le fichier suspet . alors j'ai supprimé le fichier quarantine .j'ai scané plusieurs fois .pas de problèmes . je poste par la suite le log de rsit .quant au rapport option 2 dLogfile of random's system information tool 1.06 (written by random/random)
Run by naji at 2010-03-10 17:25:42
Microsoft Windows XP Professionnel Service Pack 2
System drive C: has 19 GB (77%) free of 25 GB
Total RAM: 1014 MB (19% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:26:01, on 10/03/2010
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0013)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\a-squared Anti-Malware\a2service.exe
C:\Program Files\rnamfler\naofsvc.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\TOSHIBA\Tvs\TvsTray.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\HSDPA USB MODEM\USB Modem.exe
C:\PROGRAM FILES\A-SQUARED ANTI-MALWARE\a2scan.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Windows Live\Contacts\wlcomm.exe
C:\Program Files\Windows Live\Toolbar\wltuser.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\naji\Bureau\RSIT.exe
C:\Program Files\trend micro\HijackThis\naji.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?fdr=lc&toHttps=1&redig=FA6AD360E0BE4C719380F8C470A3D3A8
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.co.ma/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.bing.com/spresults.aspx
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://runonce.msn.com/runonce3.aspx
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.5.4723.1820\swg.dll
O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll
O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [Tvs] C:\Program Files\TOSHIBA\Tvs\TvsTray.exe
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [wrna3ls] C:\Program Files\rnamfler\naomf.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Fichiers communs\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [a-squared] "C:\Program Files\a-squared Anti-Malware\a2guard.exe"
O4 - HKLM\..\Run: [regdiit] C:\WINDOWS\system32\winxp.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Google Sidewiki... - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll/cmsidewiki.html
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{70D71040-0F40-4D2A-9E2A-0B27025BEB47}: NameServer = 212.217.0.1 212.217.0.12
O23 - Service: a-squared Anti-Malware Service (a2AntiMalware) - Emsi Software GmbH - C:\Program Files\a-squared Anti-Malware\a2service.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Service Google Update (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: RdnaoFlSvc - Unknown owner - C:\Program Files\rnamfler\naofsvc.exe

salut.
%USERNAME%.exe
%username%_Fichiers.exe
*-1-1148.exe
*.0cr
*.0om
*.0xe
*.JPG-msnimages.exe
*packed_Pushbot.exe
*.pif
*.vir
*.XXX
1.*az
5FB9C0*.exe
839D4E*.bin
aautorun.*
ARK*.tmp
autorun*.txt
autorun.v*inf
autorun.inf*.scr
baca bro*.*
Data %username%.exe
DFD34*.bat
DiskAutoRun*.exe
Documents*.lnk
Documents %username%.exe
is15*.exe
is16*.exe
MSd*.vbs
Music*.lnk
New Folder*.lnk
nwnmff_e*.exe
Passwords*.lnk
photo*.exe
Pictures*.lnk
Video*.lnk
zPharaoh.?xe

salut.
Je dois avouer que j'ai paniqué avec usbfix...........je n'arrive pas à trouver le rapport.
après double clic sur le racourci usbfix présent au bureau apparait une fenetre pour executer .j'execute alors c'est (le chargement des fichiers ) ensuite l'apparition d'une page noire ou il y a des options de langues . je choisis
(f) francais et je tape (entrée) sur le clavier de mon pc mais ça ne donne rien ........et je m'arrete là.................

Alors .Je serai très reconnaissant pour votre cooperation et merci infinement.

Microsoft Windows XP Professionnel 5.1.2600.2.1252.33.1036.18.1014.782 [GMT 1:00]
Lancé depuis: c:\documents and settings\naji\Bureau\KillBagle.exe

AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !!
.
Les fichiers ci-dessous ont été désactivés pendant l'exécution:
c:\program files\rnamfler\radprlib.dll
c:\program files\rnamfler\radhslib.dll


(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\program files\rnamfler\radhslib.dll
c:\program files\rnamfler\radprlib.dll

.
((((((((((((((((((((((((((((( Fichiers créés du 2010-02-13 au 2010-03-13 ))))))))))))))))))))))))))))))))))))
.

2010-03-06 21:04 . 2001-08-23 16:04 12288 -c--a-w- c:\windows\system32\dllcache\mouhid.sys
2010-03-06 21:04 . 2001-08-23 16:04 12288 ----a-w- c:\windows\system32\drivers\mouhid.sys
2010-03-06 21:04 . 2001-08-17 21:02 9600 -c--a-w- c:\windows\system32\dllcache\hidusb.sys
2010-03-06 21:04 . 2001-08-17 21:02 9600 ----a-w- c:\windows\system32\drivers\hidusb.sys
2010-03-05 12:27 . 2010-03-05 14:30 -------- d-----w- c:\program files\trend micro
2010-03-05 12:27 . 2010-03-05 12:27 -------- d-----w- C:\rsit
2010-03-05 11:20 . 2010-03-06 10:15 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2010-03-05 11:20 . 2010-03-05 21:22 -------- d-----w- c:\program files\Spybot - Search & Destroy
2010-03-04 23:01 . 2010-03-04 23:01 -------- d-----w- c:\program files\GoldWave
2010-03-04 20:46 . 2010-03-04 20:46 2855 ----a-w- c:\windows\system32\winxp.PIF
2010-03-04 20:43 . 2010-03-04 20:43 -------- d--h--w- c:\windows\PIF
2010-03-04 18:04 . 2010-03-12 23:24 -------- d-----w- c:\program files\a-squared Anti-Malware
2010-03-04 14:47 . 2010-03-04 21:44 -------- d-----w- c:\program files\SafeSoft
2010-03-04 12:32 . 2010-03-04 12:32 -------- d---a-w- c:\documents and settings\naji\Application Data\Malwarebytes
2010-03-04 12:32 . 2010-03-04 12:32 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2010-03-04 08:35 . 2010-03-04 09:16 -------- d-----w- c:\documents and settings\All Users\Application Data\Yahoo! Companion
2010-03-04 08:35 . 2010-03-04 08:35 -------- d---a-w- c:\documents and settings\naji\Application Data\Yahoo!
2010-03-04 08:35 . 2010-03-04 08:35 -------- d-----w- c:\program files\Yahoo!
2010-03-04 08:35 . 2010-03-04 08:35 -------- d-----w- c:\program files\CCleaner
2010-03-04 08:29 . 2010-03-04 13:29 -------- d---a-w- c:\documents and settings\naji\Local Settings\Application Data\Temp
2010-03-04 08:29 . 2010-03-04 08:29 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\Google
2010-03-04 08:24 . 2010-03-04 08:24 -------- d-----w- c:\documents and settings\LocalService\Local Settings\Application Data\Google
2010-03-03 10:06 . 2010-03-03 10:06 -------- d-----w- c:\program files\Realtek AC97
2010-03-01 22:16 . 2010-03-01 22:16 -------- d---a-w- c:\documents and settings\naji\Application Data\Media Player Classic
2010-03-01 12:12 . 2010-03-12 10:24 664 ----a-w- c:\windows\system32\d3d9caps.dat
2010-02-27 19:45 . 2010-03-04 08:43 -------- d-----w- c:\program files\FileHippo.com
2010-02-27 19:08 . 2010-03-12 23:55 -------- d--h--r- c:\program files\rnamfler
2010-02-27 17:48 . 2010-02-27 17:48 -------- d-----w- c:\program files\SereneScreen
2010-02-27 13:06 . 2010-02-27 13:06 227473 ----a-w- c:\documents and settings\naji\Application Data\MSNInstaller\msnauins.exe
2010-02-27 13:06 . 2010-02-27 13:06 -------- d---a-w- c:\documents and settings\naji\Application Data\MSNInstaller
2010-02-26 18:16 . 2010-02-26 18:16 -------- d-----w- c:\documents and settings\All Users\Application Data\McAfee
2010-02-26 17:14 . 2010-02-26 17:14 -------- d---a-w- c:\documents and settings\naji\Local Settings\Application Data\WMTools Downloaded Files
2010-02-26 10:43 . 2010-02-26 10:44 -------- d-----w- c:\program files\Magic Karaoke Maker
2010-02-25 18:23 . 2010-03-05 13:34 -------- d---a-w- c:\documents and settings\naji\Local Settings\Application Data\Google
2010-02-25 18:10 . 2010-03-04 08:24 -------- d-----w- c:\program files\Google
2010-02-25 17:51 . 2010-02-25 17:51 60416 ----a-w- c:\windows\ALCFDRTM.EXE
2010-02-25 17:51 . 2010-02-25 17:51 -------- d-----w- c:\windows\system32\Lang
2010-02-25 17:08 . 2007-10-16 10:40 97408 ----a-w- c:\windows\system32\drivers\cmusbser.sys
2010-02-25 17:08 . 2007-11-01 14:35 103424 ----a-w- c:\windows\system32\MyDIT_GenClassCoInst.dll
2010-02-25 17:08 . 2010-02-25 17:08 -------- d-----w- c:\program files\HSDPA USB MODEM
2010-02-25 17:03 . 2010-03-12 22:54 -------- d---a-w- c:\documents and settings\naji\Tracing
2010-02-25 11:00 . 2004-08-03 22:08 31616 -c--a-w- c:\windows\system32\dllcache\usbccgp.sys
2010-02-25 11:00 . 2004-08-03 22:08 31616 ----a-w- c:\windows\system32\drivers\usbccgp.sys
2010-02-25 10:58 . 2010-02-25 10:44 -------- d-----w- c:\program files\Internet Mobile+
2010-02-25 10:44 . 2010-02-25 10:44 -------- d-----w- c:\program files\TOSHIBA
2010-02-25 10:44 . 2005-08-03 09:44 69632 ----a-w- c:\windows\system32\TvsCtrl.dll
2010-02-25 10:44 . 2005-07-29 08:55 30592 ----a-w- c:\windows\system32\drivers\Tvs.sys
2010-02-25 10:44 . 2005-06-01 14:41 51840 ----a-w- c:\windows\system32\drivers\WOWXT_kern_i386.sys
2010-02-25 10:44 . 2005-01-25 13:35 29184 ----a-w- c:\windows\system32\drivers\TSXT_kern_i386.sys
2010-02-25 10:42 . 2010-02-25 10:42 -------- d-----w- c:\program files\Intel
2010-02-25 10:40 . 2008-01-09 05:19 2216064 ----a-w- c:\windows\system32\drivers\w29n51.sys
2010-02-25 10:40 . 2007-02-12 11:41 2732032 ----a-w- c:\windows\system32\Netw2r32.dll
2010-02-25 10:40 . 2007-02-12 11:40 557056 ----a-w- c:\windows\system32\Netw2c32.dll
2010-02-25 10:38 . 2004-08-03 22:07 6400 -c--a-w- c:\windows\system32\dllcache\splitter.sys
2010-02-25 10:38 . 2004-08-03 22:07 6400 ----a-w- c:\windows\system32\drivers\splitter.sys
2010-02-25 10:38 . 2004-08-03 22:15 82944 -c--a-w- c:\windows\system32\dllcache\wdmaud.sys
2010-02-25 10:38 . 2004-08-03 22:15 82944 ----a-w- c:\windows\system32\drivers\wdmaud.sys
2010-02-25 10:38 . 2004-08-03 22:07 52864 -c--a-w- c:\windows\system32\dllcache\dmusic.sys
2010-02-25 10:38 . 2004-08-03 22:07 52864 ----a-w- c:\windows\system32\drivers\DMusic.sys
2010-02-25 10:38 . 2001-08-17 21:00 54272 -c--a-w- c:\windows\system32\dllcache\swmidi.sys
2010-02-25 10:38 . 2001-08-17 21:00 54272 ----a-w- c:\windows\system32\drivers\swmidi.sys
2010-02-25 10:36 . 2005-03-05 05:02 1066278 ----a-w- c:\windows\system32\drivers\AGRSM.sys
2010-02-25 10:36 . 2010-02-25 10:44 -------- d-----w- c:\program files\Fichiers communs\InstallShield
2010-02-25 10:30 . 2010-02-25 10:30 -------- d-----w- c:\windows\system32\fr-fr
2010-02-25 10:28 . 2010-02-25 10:28 -------- d--h--w- c:\windows\$hf_mig$
2010-02-24 19:13 . 2010-02-24 19:13 -------- d-----w- c:\program files\Microsoft Silverlight
2010-02-24 19:06 . 2010-02-24 19:06 -------- d-----w- c:\program files\Fichiers communs\Windows Live
2010-02-24 19:02 . 2003-06-19 00:31 18944 ----a-w- c:\windows\system32\Spool\prtprocs\w32x86\mdippr.dll
2010-02-24 19:02 . 2003-06-19 00:31 17920 ----a-w- c:\windows\system32\mdimon.dll
2010-02-24 19:01 . 2010-02-24 19:01 -------- d-----w- c:\program files\Microsoft.NET
2010-02-24 19:00 . 2010-02-24 19:01 -------- d-----w- c:\windows\SHELLNEW
2010-02-24 18:55 . 2007-05-22 10:02 163840 ----a-w- c:\windows\system32\unrar.dll
2010-02-24 18:53 . 2003-03-18 21:20 1060864 ----a-w- c:\windows\system32\MFC71.dll
2010-02-24 18:53 . 2003-03-18 20:14 499712 ----a-w- c:\windows\system32\MSVCP71.dll
2010-02-24 18:53 . 2010-02-24 18:53 -------- d-----w- c:\program files\Alwil Software
2010-02-24 18:42 . 2010-02-24 19:14 42752 ----a-w- c:\documents and settings\naji\Local Settings\Application Data\GDIPFONTCACHEV1.DAT

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-03-03 14:57 . 2010-02-24 16:50 -------- d-----w- c:\program files\Fichiers communs\Adobe
2010-03-02 22:18 . 2001-08-28 10:00 72912 ----a-w- c:\windows\system32\perfc00C.dat
2010-03-02 22:18 . 2001-08-28 10:00 461974 ----a-w- c:\windows\system32\perfh00C.dat
2010-02-26 15:09 . 2010-02-25 10:37 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-02-24 19:13 . 2010-02-24 19:08 -------- d-----w- c:\program files\Microsoft
2010-02-24 19:13 . 2010-02-24 19:13 -------- d-----w- c:\program files\Microsoft Office Outlook Connector
2010-02-24 19:13 . 2010-02-24 19:08 -------- d-----w- c:\program files\Windows Live
2010-02-24 19:10 . 2010-02-24 19:10 -------- d-----w- c:\program files\Microsoft Sync Framework
2010-02-24 19:09 . 2010-02-24 19:09 -------- d-----w- c:\program files\Microsoft SQL Server Compact Edition
2010-02-24 19:08 . 2010-02-24 19:08 -------- d-----w- c:\program files\Windows Live SkyDrive
2010-02-24 18:55 . 2010-02-24 17:29 -------- d-----w- c:\program files\K-Lite Codec Pack
2010-02-24 17:15 . 2010-02-24 17:15 -------- d---a-w- c:\documents and settings\naji\Application Data\vlc
2010-02-24 17:15 . 2010-02-24 17:15 -------- d-----w- c:\program files\VideoLAN
2010-02-24 16:35 . 2010-02-24 16:35 -------- d-----w- c:\program files\microsoft frontpage
2010-02-24 16:34 . 2010-02-24 16:34 86331 ----a-w- c:\windows\pchealth\helpctr\OfflineCache\index.dat
2010-02-24 16:34 . 2010-02-24 16:34 -------- d-----w- c:\program files\Services en ligne
2010-02-24 16:32 . 2010-02-24 16:32 21892 ----a-w- c:\windows\system32\emptyregdb.dat
.

------- Sigcheck -------

[-] 2008-03-12 . 245B58B046D6970612CA6F0C796749B8 . 1548288 . . [5.1.2600.2180] . . c:\windows\system32\sfcfiles.dll
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2010-02-25 39408]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Tvs"="c:\program files\TOSHIBA\Tvs\TvsTray.exe" [2005-04-05 73728]
"BluetoothAuthenticationAgent"="bthprops.cpl" [2004-08-19 110592]
"wrna3ls"="c:\program files\rnamfler\naomf.exe" [2006-04-01 1253960]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2009-12-18 40368]
"Adobe ARM"="c:\program files\Fichiers communs\Adobe\ARM\1.0\AdobeARM.exe" [2009-12-11 948672]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-19 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=

R3 qcusbser;Mobile Connector USB Device for Legacy Serial Communication;c:\windows\system32\drivers\cmusbser.sys [25/02/2010 18:08 97408]
S2 gupdate;Service Google Update (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [04/03/2010 09:24 135664]
.
Contenu du dossier 'Tâches planifiées'

2010-03-13 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-03-04 08:24]

2010-03-12 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-03-04 08:24]
.
.
------- Examen supplémentaire -------
.
uStart Page = hxxp://www.google.co.ma/
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll/cmsidewiki.html
.
- - - - ORPHELINS SUPPRIMES - - - -

HKLM-Run-regdiit - c:\windows\system32\winxp.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-03-13 01:02
Windows 5.1.2600 Service Pack 2 NTFS

Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

Recherche de fichiers cachés ...

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************
.
--------------------- DLLs chargées dans les processus actifs ---------------------

- - - - - - - > 'explorer.exe'(3172)
c:\windows\system32\msi.dll
.
------------------------ Autres processus actifs ------------------------
.
c:\program files\rnamfler\naofsvc.exe
c:\program files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
c:\windows\system32\rundll32.exe
.
**************************************************************************
.
Heure de fin: 2010-03-13 01:04:28 - La machine a redémarré
ComboFix-quarantined-files.txt 2010-03-13 00:04

Avant-CF: 20 220 473 344 octets libres
Après-CF: 20 390 543 360 octets libres

- - End Of File - - BA9A132B2718B5C4FB4E90937E9BB845

BONJOUR.
Fichier naomf.exe reçu le 2010.02.28 20:21:26 (UTC)
Situation actuelle: terminé

Résultat: 17/41 (41.46%)
Formaté Impression des résultats
Antivirus Version Dernière mise à jour Résultat
a-squared 4.5.0.50 2010.02.28 Trojan.Generic!IK
AhnLab-V3 5.0.0.2 2010.02.28 Win-Trojan/Xema.variant
AntiVir 8.2.1.176 2010.02.28 -
Antiy-AVL 2.0.3.7 2010.02.26 -
Authentium 5.2.0.5 2010.02.28 W32/Heuristic-210!Eldorado
Avast 4.8.1351.0 2010.02.28 -
AVG 9.0.0.730 2010.02.28 Dialer.BVH
BitDefender 7.2 2010.02.28 -
CAT-QuickHeal 10.00 2010.02.27 Trojan.Agent.IRC
ClamAV 0.96.0.0-git 2010.02.28 -
Comodo 4091 2010.02.28 UnclassifiedMalware
DrWeb 5.0.1.12222 2010.02.28 -
eSafe 7.0.17.0 2010.02.28 -
eTrust-Vet 35.2.7331 2010.02.26 -
F-Prot 4.5.1.85 2010.02.28 W32/Heuristic-210!Eldorado
F-Secure 9.0.15370.0 2010.02.28 -
Fortinet 4.0.14.0 2010.02.28 PossibleThreat
GData 19 2010.02.28 -
Ikarus T3.1.1.80.0 2010.02.28 Trojan.Generic
Jiangmin 13.0.900 2010.02.28 -
K7AntiVirus 7.10.984 2010.02.26 -
Kaspersky 7.0.0.125 2010.02.28 -
McAfee 5906 2010.02.28 -
McAfee+Artemis 5906 2010.02.28 potentially unwanted program Artemis!FC494E385EA3
McAfee-GW-Edition 6.8.5 2010.02.28 Heuristic.LooksLike.Win32.SuspiciousPE.H
Microsoft 1.5502 2010.02.28 -
NOD32 4903 2010.02.28 -
Norman 6.04.08 2010.02.28 W32/Dialer.RYK
nProtect 2009.1.8.0 2010.02.28 -
Panda 10.0.2.2 2010.02.28 Suspicious file
PCTools 7.0.3.5 2010.02.28 Trojan.Generic
Prevx 3.0 2010.02.28 High Risk System Back Door
Rising 22.36.06.04 2010.02.28 -
Sophos 4.50.0 2010.02.28 -
Sunbelt 5711 2010.02.28 Porn-Dialer.Win32.Generic
Symantec 20091.2.0.41 2010.02.28 Trojan Horse
TheHacker 6.5.1.7.215 2010.02.28 -
TrendMicro 9.120.0.1004 2010.02.28 -
VBA32 3.12.12.2 2010.02.26 -
ViRobot 2010.2.27.2206 2010.02.27 -
VirusBuster 5.0.27.0 2010.02.28 -
Information additionnelle
File size: 1253960 bytes
MD5 : fc494e385ea35698e9a0281de4271393
SHA1 : ed9918a4c580f5b81745098043f0a401d2d2ddc3
SHA256: cebc5fab3514724cbdff1205f5383702502efe8c3b191190c72fc236985678e9
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x137060
timedatestamp.....: 0x2A425E19 (Sat Jun 20 00:22:17 1992)
machinetype.......: 0x14C (Intel I386)

( 9 sections )
name viradd virsiz rawdsiz ntrpy md5
CODE 0x1000 0x100970 0x100A00 7.97 1d058592b30d72ea0a1dd957044484e1
DATA 0x102000 0x10790 0x10800 7.85 b0666d8c8d18f201be899bae0f5e5953
BSS 0x113000 0xE4D 0x0 0.00 d41d8cd98f00b204e9800998ecf8427e
.idata 0x114000 0x2A06 0x2C00 7.90 7a857bd9bdb8ee1268b104a870651f4d
.tls 0x117000 0x10 0x0 0.00 d41d8cd98f00b204e9800998ecf8427e
.rdata 0x118000 0x18 0x200 7.05 cabd4242d76645451a7ae56b4804c45c
.reloc 0x119000 0x10AF0 0x10C00 6.50 c13f58aa57e3b2c020820d54b6468670
.rsrc 0x12A000 0xC800 0xC800 6.49 88b8ebf2830d3d238c13f0fed816bedf
Jc 0x137000 0x2000 0xA48 7.84 f675c32038d700180453fb5bfdd413a2

( 1 imports )

> kernel32.dll: LoadLibraryA, GetProcAddress

( 0 exports )

TrID : File type identification
Win32 EXE Yoda's Crypter (54.4%)
Win32 Executable Generic (17.4%)
Win32 Dynamic Link Library (generic) (15.5%)
Win16/32 Executable Delphi generic (4.2%)
Generic Win/DOS Executable (4.1%)
ThreatExpert: https://www.symantec.com?md5=fc494e385ea35698e9a0281de4271393
ssdeep: 24576:FgXHlwKk+hnTkwPCelsZ3K/3VEeRx7CI0XuCF8jAArrzzz1JXV:FgXlN3QkCFxve/MuCYvzzz1
sigcheck: publisher....: n/a
copyright....: n/a
product......: n/a
description..: n/a
original name: n/a
internal name: n/a
file version.: n/a
comments.....: n/a
signers......: -
signing date.: -
verified.....: Unsigned

Prevx Info: http://info.prevx.com/aboutprogramtext.asp?PX5=867D4E5E48121BA8223013F3D2BB8200B7A28D01
PEiD : -
packers (Kaspersky): Yoda
packers (F-Prot): Yoda
CWSandbox: http://research.sunbelt-software.com/...
packers (Authentium): Yoda
RDS : NSRL Reference Data Set

Salut.
le rapport combofix

ComboFix 10-03-12.02 - naji 14/03/2010 13:44:44.3.1 - x86
Microsoft Windows XP Professionnel 5.1.2600.2.1252.33.1036.18.1014.730 [GMT 1:00]
Lancé depuis: c:\documents and settings\naji\Bureau\KillBagle.exe
Commutateurs utilisés :: c:\documents and settings\naji\Bureau\CFscript.txt

FILE ::
"c:\program files\rnamfler\naofsvc.exe"
"c:\program files\rnamfler\naomf.exe"
.

((((((((((((((((((((((((((((( Fichiers créés du 2010-02-14 au 2010-03-14 ))))))))))))))))))))))))))))))))))))
.

2010-03-14 12:20 . 2010-03-14 12:20 -------- d-----w- c:\windows\LastGood
2010-03-14 11:01 . 2010-03-14 11:01 552 ----a-w- c:\windows\system32\d3d8caps.dat
2010-03-14 07:10 . 2010-03-14 07:10 -------- d-----w- c:\program files\MSXML 6.0
2010-03-13 15:47 . 2010-03-13 15:47 -------- d-----w- c:\windows\ServicePackFiles
2010-03-13 15:33 . 2010-03-13 15:33 5115823 ----a-w- c:\documents and settings\All Users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe
2010-03-13 15:31 . 2010-01-07 15:07 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-03-13 15:31 . 2010-01-07 15:07 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-03-13 15:31 . 2010-03-13 15:35 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-03-13 11:40 . 2010-03-13 14:36 -------- d-----w- c:\windows\system32\CatRoot_bak
2010-03-13 10:52 . 2009-12-09 10:26 2059776 -c----w- c:\windows\system32\dllcache\ntkrnlpa.exe
2010-03-13 10:52 . 2009-12-09 10:26 2182400 -c----w- c:\windows\system32\dllcache\ntoskrnl.exe
2010-03-13 10:52 . 2009-12-09 10:26 2017792 -c----w- c:\windows\system32\dllcache\ntkrpamp.exe
2010-03-13 10:52 . 2009-12-09 10:26 2138112 -c----w- c:\windows\system32\dllcache\ntkrnlmp.exe
2010-03-13 10:48 . 2009-12-04 14:41 453760 -c----w- c:\windows\system32\dllcache\mrxsmb.sys
2010-03-13 00:37 . 2010-03-13 00:37 -------- d-----w- c:\documents and settings\All Users\Application Data\Alwil Software
2010-03-06 21:04 . 2001-08-23 16:04 12288 -c--a-w- c:\windows\system32\dllcache\mouhid.sys
2010-03-06 21:04 . 2001-08-23 16:04 12288 ----a-w- c:\windows\system32\drivers\mouhid.sys
2010-03-06 21:04 . 2001-08-17 21:02 9600 -c--a-w- c:\windows\system32\dllcache\hidusb.sys
2010-03-06 21:04 . 2001-08-17 21:02 9600 ----a-w- c:\windows\system32\drivers\hidusb.sys
2010-03-05 12:27 . 2010-03-05 14:30 -------- d-----w- c:\program files\trend micro
2010-03-05 12:27 . 2010-03-05 12:27 -------- d-----w- C:\rsit
2010-03-05 11:20 . 2010-03-06 10:15 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2010-03-05 11:20 . 2010-03-05 21:22 -------- d-----w- c:\program files\Spybot - Search & Destroy
2010-03-04 23:01 . 2010-03-04 23:01 -------- d-----w- c:\program files\GoldWave
2010-03-04 20:46 . 2010-03-04 20:46 2855 ----a-w- c:\windows\system32\winxp.PIF
2010-03-04 20:43 . 2010-03-04 20:43 -------- d--h--w- c:\windows\PIF
2010-03-04 18:04 . 2010-03-12 23:24 -------- d-----w- c:\program files\a-squared Anti-Malware
2010-03-04 14:47 . 2010-03-04 21:44 -------- d-----w- c:\program files\SafeSoft
2010-03-04 12:32 . 2010-03-04 12:32 -------- d---a-w- c:\documents and settings\naji\Application Data\Malwarebytes
2010-03-04 12:32 . 2010-03-04 12:32 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2010-03-04 08:35 . 2010-03-04 09:16 -------- d-----w- c:\documents and settings\All Users\Application Data\Yahoo! Companion
2010-03-04 08:35 . 2010-03-04 08:35 -------- d---a-w- c:\documents and settings\naji\Application Data\Yahoo!
2010-03-04 08:35 . 2010-03-04 08:35 -------- d-----w- c:\program files\Yahoo!
2010-03-04 08:35 . 2010-03-04 08:35 -------- d-----w- c:\program files\CCleaner
2010-03-04 08:29 . 2010-03-13 00:40 -------- d---a-w- c:\documents and settings\naji\Local Settings\Application Data\Temp
2010-03-04 08:29 . 2010-03-04 08:29 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\Google
2010-03-04 08:24 . 2010-03-04 08:24 -------- d-----w- c:\documents and settings\LocalService\Local Settings\Application Data\Google
2010-03-03 10:06 . 2010-03-03 10:06 -------- d-----w- c:\program files\Realtek AC97
2010-03-01 22:16 . 2010-03-01 22:16 -------- d---a-w- c:\documents and settings\naji\Application Data\Media Player Classic
2010-03-01 12:12 . 2010-03-13 21:09 664 ----a-w- c:\windows\system32\d3d9caps.dat
2010-02-27 19:45 . 2010-03-04 08:43 -------- d-----w- c:\program files\FileHippo.com
2010-02-27 19:08 . 2010-03-13 23:24 -------- d--h--r- c:\program files\rnamfler
2010-02-27 17:48 . 2010-02-27 17:48 -------- d-----w- c:\program files\SereneScreen
2010-02-27 13:06 . 2010-02-27 13:06 227473 ----a-w- c:\documents and settings\naji\Application Data\MSNInstaller\msnauins.exe
2010-02-27 13:06 . 2010-02-27 13:06 -------- d---a-w- c:\documents and settings\naji\Application Data\MSNInstaller
2010-02-26 18:16 . 2010-02-26 18:16 -------- d-----w- c:\documents and settings\All Users\Application Data\McAfee
2010-02-26 17:14 . 2010-02-26 17:14 -------- d---a-w- c:\documents and settings\naji\Local Settings\Application Data\WMTools Downloaded Files
2010-02-26 10:43 . 2010-02-26 10:44 -------- d-----w- c:\program files\Magic Karaoke Maker
2010-02-25 18:23 . 2010-03-13 00:41 -------- d---a-w- c:\documents and settings\naji\Local Settings\Application Data\Google
2010-02-25 18:10 . 2010-03-13 00:40 -------- d-----w- c:\program files\Google
2010-02-25 17:51 . 2010-02-25 17:51 60416 ----a-w- c:\windows\ALCFDRTM.EXE
2010-02-25 17:51 . 2010-02-25 17:51 -------- d-----w- c:\windows\system32\Lang
2010-02-25 17:08 . 2007-10-16 10:40 97408 ----a-w- c:\windows\system32\drivers\cmusbser.sys
2010-02-25 17:08 . 2007-11-01 14:35 103424 ----a-w- c:\windows\system32\MyDIT_GenClassCoInst.dll
2010-02-25 17:08 . 2010-02-25 17:08 -------- d-----w- c:\program files\HSDPA USB MODEM
2010-02-25 17:03 . 2010-03-13 23:47 -------- d---a-w- c:\documents and settings\naji\Tracing
2010-02-25 11:00 . 2004-08-03 22:08 31616 -c--a-w- c:\windows\system32\dllcache\usbccgp.sys
2010-02-25 11:00 . 2004-08-03 22:08 31616 ----a-w- c:\windows\system32\drivers\usbccgp.sys
2010-02-25 10:58 . 2010-02-25 10:44 -------- d-----w- c:\program files\Internet Mobile+
2010-02-25 10:44 . 2010-02-25 10:44 -------- d-----w- c:\program files\TOSHIBA
2010-02-25 10:44 . 2005-08-03 09:44 69632 ----a-w- c:\windows\system32\TvsCtrl.dll
2010-02-25 10:44 . 2005-07-29 08:55 30592 ----a-w- c:\windows\system32\drivers\Tvs.sys
2010-02-25 10:44 . 2005-06-01 14:41 51840 ----a-w- c:\windows\system32\drivers\WOWXT_kern_i386.sys
2010-02-25 10:44 . 2005-01-25 13:35 29184 ----a-w- c:\windows\system32\drivers\TSXT_kern_i386.sys
2010-02-25 10:42 . 2010-02-25 10:42 -------- d-----w- c:\program files\Intel
2010-02-25 10:40 . 2008-01-09 05:19 2216064 ----a-w- c:\windows\system32\drivers\w29n51.sys
2010-02-25 10:40 . 2007-02-12 11:41 2732032 ----a-w- c:\windows\system32\Netw2r32.dll
2010-02-25 10:40 . 2007-02-12 11:40 557056 ----a-w- c:\windows\system32\Netw2c32.dll
2010-02-25 10:38 . 2004-08-03 22:07 6400 -c--a-w- c:\windows\system32\dllcache\splitter.sys
2010-02-25 10:38 . 2004-08-03 22:07 6400 ----a-w- c:\windows\system32\drivers\splitter.sys
2010-02-25 10:38 . 2004-08-03 22:15 82944 -c--a-w- c:\windows\system32\dllcache\wdmaud.sys
2010-02-25 10:38 . 2004-08-03 22:15 82944 ----a-w- c:\windows\system32\drivers\wdmaud.sys
2010-02-25 10:38 . 2004-08-03 22:07 52864 -c--a-w- c:\windows\system32\dllcache\dmusic.sys
2010-02-25 10:38 . 2004-08-03 22:07 52864 ----a-w- c:\windows\system32\drivers\DMusic.sys
2010-02-25 10:38 . 2001-08-17 21:00 54272 -c--a-w- c:\windows\system32\dllcache\swmidi.sys
2010-02-25 10:38 . 2001-08-17 21:00 54272 ----a-w- c:\windows\system32\drivers\swmidi.sys
2010-02-25 10:36 . 2005-03-05 05:02 1066278 ----a-w- c:\windows\system32\drivers\AGRSM.sys
2010-02-25 10:36 . 2010-02-25 10:44 -------- d-----w- c:\program files\Fichiers communs\InstallShield
2010-02-25 10:30 . 2010-03-13 15:10 -------- d-----w- c:\windows\system32\fr-fr
2010-02-25 10:28 . 2010-03-14 12:21 -------- d--h--w- c:\windows\$hf_mig$
2010-02-24 19:13 . 2010-02-24 19:13 -------- d-----w- c:\program files\Microsoft Silverlight
2010-02-24 19:06 . 2010-02-24 19:06 -------- d-----w- c:\program files\Fichiers communs\Windows Live
2010-02-24 19:02 . 2003-06-19 00:31 18944 ----a-w- c:\windows\system32\Spool\prtprocs\w32x86\mdippr.dll
2010-02-24 19:02 . 2003-06-19 00:31 17920 ----a-w- c:\windows\system32\mdimon.dll
2010-02-24 19:01 . 2010-02-24 19:01 -------- d-----w- c:\program files\Microsoft.NET
2010-02-24 19:00 . 2010-02-24 19:01 -------- d-----w- c:\windows\SHELLNEW
2010-02-24 18:55 . 2007-05-22 10:02 163840 ----a-w- c:\windows\system32\unrar.dll
2010-02-24 18:53 . 2003-03-18 21:20 1060864 ----a-w- c:\windows\system32\MFC71.dll
2010-02-24 18:53 . 2003-03-18 20:14 499712 ----a-w- c:\windows\system32\MSVCP71.dll
2010-02-24 18:53 . 2010-03-13 00:37 -------- d-----w- c:\program files\Alwil Software
2010-02-24 18:42 . 2010-02-24 19:14 42752 ----a-w- c:\documents and settings\naji\Local Settings\Application Data\GDIPFONTCACHEV1.DAT

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-03-14 11:47 . 2001-08-28 10:00 72912 ----a-w- c:\windows\system32\perfc00C.dat
2010-03-14 11:47 . 2001-08-28 10:00 461974 ----a-w- c:\windows\system32\perfh00C.dat
2010-03-03 14:57 . 2010-02-24 16:50 -------- d-----w- c:\program files\Fichiers communs\Adobe
2010-02-26 15:09 . 2010-02-25 10:37 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-02-24 19:13 . 2010-02-24 19:08 -------- d-----w- c:\program files\Microsoft
2010-02-24 19:13 . 2010-02-24 19:13 -------- d-----w- c:\program files\Microsoft Office Outlook Connector
2010-02-24 19:13 . 2010-02-24 19:08 -------- d-----w- c:\program files\Windows Live
2010-02-24 19:10 . 2010-02-24 19:10 -------- d-----w- c:\program files\Microsoft Sync Framework
2010-02-24 19:09 . 2010-02-24 19:09 -------- d-----w- c:\program files\Microsoft SQL Server Compact Edition
2010-02-24 19:08 . 2010-02-24 19:08 -------- d-----w- c:\program files\Windows Live SkyDrive
2010-02-24 18:55 . 2010-02-24 17:29 -------- d-----w- c:\program files\K-Lite Codec Pack
2010-02-24 17:15 . 2010-02-24 17:15 -------- d---a-w- c:\documents and settings\naji\Application Data\vlc
2010-02-24 17:15 . 2010-02-24 17:15 -------- d-----w- c:\program files\VideoLAN
2010-02-24 16:35 . 2010-02-24 16:35 -------- d-----w- c:\program files\microsoft frontpage
2010-02-24 16:34 . 2010-02-24 16:34 86331 ----a-w- c:\windows\pchealth\helpctr\OfflineCache\index.dat
2010-02-24 16:34 . 2010-02-24 16:34 -------- d-----w- c:\program files\Services en ligne
2010-02-24 16:32 . 2010-02-24 16:32 21892 ----a-w- c:\windows\system32\emptyregdb.dat
2010-01-05 09:56 . 2004-08-19 13:09 832512 ------w- c:\windows\system32\wininet.dll
2010-01-05 09:56 . 2004-08-19 13:09 78336 ----a-w- c:\windows\system32\ieencode.dll
2010-01-05 09:56 . 2004-08-19 13:09 17408 ----a-w- c:\windows\system32\corpol.dll
2009-12-31 16:14 . 2004-08-03 20:14 352640 ----a-w- c:\windows\system32\drivers\srv.sys
2009-12-17 07:59 . 2010-02-24 16:31 347648 ----a-w- c:\windows\system32\mspaint.exe
.

------- Sigcheck -------

[-] 2008-04-14 . E17C85D5B5CF477638433B851A98499E . 1571840 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\327771f7f3830b5acec68906a2aac4ab\sfcfiles.dll
[-] 2008-03-12 . 245B58B046D6970612CA6F0C796749B8 . 1548288 . . [5.1.2600.2180] . . c:\windows\system32\sfcfiles.dll
.
((((((((((((((((((((((((((((( SnapShot_2010-03-13_23.26.33 )))))))))))))))))))))))))))))))))))))))))
.
- 2001-08-28 10:00 . 2010-03-13 16:34 60088 c:\windows\system32\perfc009.dat
+ 2001-08-28 10:00 . 2010-03-14 11:47 60088 c:\windows\system32\perfc009.dat
+ 2008-07-25 10:17 . 2008-07-25 10:17 15360 c:\windows\system32\mui\0409\mscorees.dll
+ 2007-05-08 16:08 . 2007-05-08 16:08 86728 c:\windows\system32\msxml6r.dll
+ 2008-07-25 10:16 . 2008-07-25 10:16 83968 c:\windows\system32\mscories.dll
+ 2004-08-19 13:09 . 2009-09-04 20:46 58880 c:\windows\system32\msasn1.dll
+ 2004-08-19 13:09 . 2009-09-04 20:46 58880 c:\windows\system32\dllcache\msasn1.dll
+ 2008-07-25 10:16 . 2008-07-25 10:16 96760 c:\windows\system32\dfshim.dll
+ 2008-07-25 10:17 . 2008-07-25 10:17 37896 c:\windows\Microsoft.NET\Framework\v2.0.50727\WMINet_Utils.dll
+ 2008-07-25 10:17 . 2008-07-25 10:17 81400 c:\windows\Microsoft.NET\Framework\v2.0.50727\TLBREF.DLL
+ 2008-07-25 10:17 . 2008-07-25 10:17 77824 c:\windows\Microsoft.NET\Framework\v2.0.50727\System.Web.RegularExpressions.dll
+ 2008-07-25 10:17 . 2008-07-25 10:17 57392 c:\windows\Microsoft.NET\Framework\v2.0.50727\System.EnterpriseServices.Thunk.dll
- 2005-09-23 06:28 . 2005-09-23 06:28 81920 c:\windows\Microsoft.NET\Framework\v2.0.50727\System.Drawing.Design.dll
+ 2008-07-25 10:17 . 2008-07-25 10:17 81920 c:\windows\Microsoft.NET\Framework\v2.0.50727\System.Drawing.Design.dll
+ 2008-07-25 10:17 . 2008-07-25 10:17 81920 c:\windows\Microsoft.NET\Framework\v2.0.50727\System.Configuration.Install.dll
- 2005-09-23 06:28 . 2005-09-23 06:28 81920 c:\windows\Microsoft.NET\Framework\v2.0.50727\System.Configuration.Install.dll
+ 2008-07-25 10:17 . 2008-07-25 10:17 95232 c:\windows\Microsoft.NET\Framework\v2.0.50727\ShFusRes.dll
+ 2008-07-25 10:17 . 2008-07-25 10:17 16896 c:\windows\Microsoft.NET\Framework\v2.0.50727\sbscmp20_mscorlib.dll
+ 2008-07-25 10:17 . 2008-07-25 10:17 61952 c:\windows\Microsoft.NET\Framework\v2.0.50727\regtlibv12.exe
+ 2008-07-25 10:17 . 2008-07-25 10:17 32768 c:\windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
- 2005-09-23 06:28 . 2005-09-23 06:28 32768 c:\windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
+ 2008-07-25 10:17 . 2008-07-25 10:17 53248 c:\windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
- 2005-09-23 06:28 . 2005-09-23 06:28 53248 c:\windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
+ 2008-07-25 10:17 . 2008-07-25 10:17 88584 c:\windows\Microsoft.NET\Framework\v2.0.50727\PerfCounter.dll
+ 2008-07-25 10:17 . 2008-07-25 10:17 24584 c:\windows\Microsoft.NET\Framework\v2.0.50727\normalization.dll
+ 2008-07-25 10:17 . 2008-07-25 10:17 31744 c:\windows\Microsoft.NET\Framework\v2.0.50727\MUI\0409\mscorsecr.dll
+ 2008-07-25 10:17 . 2008-07-25 10:17 19456 c:\windows\Microsoft.NET\Framework\v2.0.50727\mscortim.dll
+ 2008-07-25 10:17 . 2008-07-25 10:17 69632 c:\windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
+ 2008-07-25 10:16 . 2008-07-25 10:16 18944 c:\windows\Microsoft.NET\Framework\v2.0.50727\mscorsn.dll
+ 2008-07-25 10:17 . 2008-07-25 10:17 77312 c:\windows\Microsoft.NET\Framework\v2.0.50727\mscorsec.dll
+ 2008-07-25 10:17 . 2008-07-25 10:17 94208 c:\windows\Microsoft.NET\Framework\v2.0.50727\mscorld.dll
+ 2008-07-25 10:17 . 2008-07-25 10:17 46592 c:\windows\Microsoft.NET\Framework\v2.0.50727\mscorie.dll
+ 2008-07-25 10:17 . 2008-07-25 10:17 83456 c:\windows\Microsoft.NET\Framework\v2.0.50727\mscordbc.dll
- 2005-09-23 06:28 . 2005-09-23 06:28 69632 c:\windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe
+ 2008-07-25 10:16 . 2008-07-25 10:16 69632 c:\windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe
+ 2008-07-25 10:16 . 2008-07-25 10:16 97792 c:\windows\Microsoft.NET\Framework\v2.0.50727\MmcAspExt.dll
+ 2008-07-25 10:16 . 2008-07-25 10:16 12800 c:\windows\Microsoft.NET\Framework\v2.0.50727\Microsoft.Vsa.Vb.CodeDOMProcessor.dll
- 2005-09-23 06:28 . 2005-09-23 06:28 12800 c:\windows\Microsoft.NET\Framework\v2.0.50727\Microsoft.Vsa.Vb.CodeDOMProcessor.dll
- 2005-09-23 06:28 . 2005-09-23 06:28 32768 c:\windows\Microsoft.NET\Framework\v2.0.50727\Microsoft.Vsa.dll
+ 2008-07-25 10:16 . 2008-07-25 10:16 32768 c:\windows\Microsoft.NET\Framework\v2.0.50727\Microsoft.Vsa.dll
+ 2008-07-25 10:16 . 2008-07-25 10:16 28672 c:\windows\Microsoft.NET\Framework\v2.0.50727\Microsoft.VisualBasic.Vsa.dll
- 2005-09-23 06:28 . 2005-09-23 06:28 28672 c:\windows\Microsoft.NET\Framework\v2.0.50727\Microsoft.VisualBasic.Vsa.dll
+ 2008-07-25 10:16 . 2008-07-25 10:16 77824 c:\windows\Microsoft.NET\Framework\v2.0.50727\Microsoft.Build.Utilities.dll
- 2005-09-23 06:28 . 2005-09-23 06:28 36864 c:\windows\Microsoft.NET\Framework\v2.0.50727\Microsoft.Build.Framework.dll
+ 2008-07-25 10:16 . 2008-07-25 10:16 36864 c:\windows\Microsoft.NET\Framework\v2.0.50727\Microsoft.Build.Framework.dll
- 2005-09-23 06:28 . 2005-09-23 06:28 40960 c:\windows\Microsoft.NET\Framework\v2.0.50727\jsc.exe
+ 2008-07-25 10:16 . 2008-07-25 10:16 40960 c:\windows\Microsoft.NET\Framework\v2.0.50727\jsc.exe
+ 2008-07-25 10:17 . 2008-07-25 10:17 72192 c:\windows\Microsoft.NET\Framework\v2.0.50727\ISymWrapper.dll
- 2005-09-23 06:28 . 2005-09-23 06:28 72192 c:\windows\Microsoft.NET\Framework\v2.0.50727\ISymWrapper.dll
+ 2008-07-25 10:17 . 2008-07-25 10:17 65032 c:\windows\Microsoft.NET\Framework\v2.0.50727\InstallUtilLib.dll
- 2005-09-23 06:28 . 2005-09-23 06:28 28672 c:\windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe
+ 2008-07-25 10:17 . 2008-07-25 10:17 28672 c:\windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe
+ 2008-07-25 10:17 . 2008-07-25 10:17 77824 c:\windows\Microsoft.NET\Framework\v2.0.50727\IEHost.dll
+ 2008-07-25 10:16 . 2008-07-25 10:16 18936 c:\windows\Microsoft.NET\Framework\v2.0.50727\fusion.dll
+ 2008-07-25 10:16 . 2008-07-25 10:16 62968 c:\windows\Microsoft.NET\Framework\v2.0.50727\dfdll.dll
+ 2008-07-25 10:16 . 2008-07-25 10:16 35320 c:\windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
+ 2008-07-25 10:17 . 2008-07-25 10:17 69120 c:\windows\Microsoft.NET\Framework\v2.0.50727\CustomMarshalers.dll
+ 2008-07-25 10:17 . 2008-07-25 10:17 27136 c:\windows\Microsoft.NET\Framework\v2.0.50727\Culture.dll
+ 2008-07-25 10:16 . 2008-07-25 10:16 13312 c:\windows\Microsoft.NET\Framework\v2.0.50727\cscompmgd.dll
- 2005-09-23 06:28 . 2005-09-23 06:28 13312 c:\windows\Microsoft.NET\Framework\v2.0.50727\cscompmgd.dll
+ 2008-07-25 10:16 . 2008-07-25 10:16 80376 c:\windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
+ 2008-07-25 10:17 . 2008-07-25 10:17 89608 c:\windows\Microsoft.NET\Framework\v2.0.50727\CORPerfMonExt.dll
+ 2008-07-25 10:16 . 2008-07-25 10:16 33792 c:\windows\Microsoft.NET\Framework\v2.0.50727\aspnet_wp.exe
+ 2008-07-25 10:16 . 2008-07-25 10:16 34312 c:\windows\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
+ 2008-07-25 10:16 . 2008-07-25 10:16 33288 c:\windows\Microsoft.NET\Framework\v2.0.50727\aspnet_regiis.exe
+ 2008-07-25 10:16 . 2008-07-25 10:16 24576 c:\windows\Microsoft.NET\Framework\v2.0.50727\aspnet_regbrowsers.exe
+ 2008-07-25 10:16 . 2008-07-25 10:16 84480 c:\windows\Microsoft.NET\Framework\v2.0.50727\aspnet_rc.dll
+ 2008-07-25 10:16 . 2008-07-25 10:16 33800 c:\windows\Microsoft.NET\Framework\v2.0.50727\Aspnet_perf.dll
+ 2008-07-25 10:16 . 2008-07-25 10:16 17416 c:\windows\Microsoft.NET\Framework\v2.0.50727\aspnet_isapi.dll
+ 2008-07-25 10:16 . 2008-07-25 10:16 22024 c:\windows\Microsoft.NET\Framework\v2.0.50727\aspnet_filter.dll
+ 2008-07-25 10:16 . 2008-07-25 10:16 36864 c:\windows\Microsoft.NET\Framework\v2.0.50727\aspnet_compiler.exe
- 2005-09-23 06:28 . 2005-09-23 06:28 36864 c:\windows\Microsoft.NET\Framework\v2.0.50727\aspnet_compiler.exe
+ 2008-07-25 10:17 . 2008-07-25 10:17 58880 c:\windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
+ 2008-07-25 10:16 . 2008-07-25 10:16 98808 c:\windows\Microsoft.NET\Framework\v2.0.50727\alink.dll
- 2005-09-23 06:28 . 2005-09-23 06:28 10752 c:\windows\Microsoft.NET\Framework\v2.0.50727\Accessibility.dll
+ 2008-07-25 10:17 . 2008-07-25 10:17 10752 c:\windows\Microsoft.NET\Framework\v2.0.50727\Accessibility.dll
+ 2008-07-25 10:16 . 2008-07-25 10:16 13824 c:\windows\Microsoft.NET\Framework\v2.0.50727\1033\CvtResUI.dll
+ 2008-07-25 10:16 . 2008-07-25 10:16 28672 c:\windows\Microsoft.NET\Framework\v2.0.50727\1033\alinkui.dll
+ 2008-07-25 10:16 . 2008-07-25 10:16 96768 c:\windows\Microsoft.NET\Framework\v1.0.3705\mscormmc.dll
+ 2008-07-25 10:17 . 2008-07-25 10:17 16896 c:\windows\Microsoft.NET\Framework\SharedReg12.dll
+ 2008-07-25 10:17 . 2008-07-25 10:17 16896 c:\windows\Microsoft.NET\Framework\sbscmp20_perfcounter.dll
+ 2008-07-25 10:17 . 2008-07-25 10:17 16896 c:\windows\Microsoft.NET\Framework\sbscmp20_mscorwks.dll
+ 2008-07-25 10:16 . 2008-07-25 10:16 16896 c:\windows\Microsoft.NET\Framework\sbscmp10.dll
+ 2008-07-25 10:16 . 2008-07-25 10:16 82944 c:\windows\Microsoft.NET\Framework\NETFXSBS10.exe
+ 2008-07-29 16:27 . 2008-07-29 16:27 93184 c:\windows\Installer\333de.msi
+ 2008-07-25 10:16 . 2008-07-25 10:16 7168 c:\windows\Microsoft.NET\Framework\v2.0.50727\Microsoft_VsaVb.dll
- 2005-09-23 06:28 . 2005-09-23 06:28 7168 c:\windows\Microsoft.NET\Framework\v2.0.50727\Microsoft_VsaVb.dll
+ 2008-07-25 10:17 . 2008-07-25 10:17 5632 c:\windows\Microsoft.NET\Framework\v2.0.50727\Microsoft.VisualC.Dll
- 2005-09-23 06:29 . 2005-09-23 06:29 5632 c:\windows\Microsoft.NET\Framework\v2.0.50727\Microsoft.VisualC.Dll
+ 2008-07-25 10:17 . 2008-07-25 10:17 6656 c:\windows\Microsoft.NET\Framework\v2.0.50727\IIEHost.dll
+ 2008-07-25 10:17 . 2008-07-25 10:17 8192 c:\windows\Microsoft.NET\Framework\v2.0.50727\IEExecRemote.dll
- 2005-09-23 06:28 . 2005-09-23 06:28 8192 c:\windows\Microsoft.NET\Framework\v2.0.50727\IEExecRemote.dll
- 2005-09-23 06:28 . 2005-09-23 06:28 9728 c:\windows\Microsoft.NET\Framework\v2.0.50727\IEExec.exe
+ 2008-07-25 10:17 . 2008-07-25 10:17 9728 c:\windows\Microsoft.NET\Framework\v2.0.50727\IEExec.exe
+ 2008-07-25 10:16 . 2008-07-25 10:16 5120 c:\windows\Microsoft.NET\Framework\v2.0.50727\dfsvc.exe
+ 2008-07-25 10:17 . 2008-07-25 10:17 635904 c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.3053_x-ww_b80fa8ca\msvcr80.dll
+ 2008-07-25 10:17 . 2008-07-25 10:17 558080 c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.3053_x-ww_b80fa8ca\msvcp80.dll
+ 2008-07-25 10:17 . 2008-07-25 10:17 479232 c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.3053_x-ww_b80fa8ca\msvcm80.dll
+ 2006-08-24 15:15 . 2006-08-24 15:15 150808 c:\windows\system32\rgb9rast_2.dll
+ 2001-08-28 10:00 . 2010-03-14 11:47 395848 c:\windows\system32\perfh009.dat
- 2001-08-28 10:00 . 2010-03-13 16:34 395848 c:\windows\system32\perfh009.dat
+ 2008-07-25 10:16 . 2008-07-25 10:16 158720 c:\windows\system32\mscorier.dll
+ 2008-07-25 10:16 . 2008-07-25 10:16 282112 c:\windows\system32\mscoree.dll
+ 2008-07-25 10:16 . 2008-07-25 10:16 438272 c:\windows\Microsoft.NET\Framework\v2.0.50727\webengine.dll
+ 2008-07-25 10:17 . 2008-07-25 10:17 839680 c:\windows\Microsoft.NET\Framework\v2.0.50727\System.Web.Services.dll
- 2005-09-23 06:28 . 2005-09-23 06:28 835584 c:\windows\Microsoft.NET\Framework\v2.0.50727\System.Web.Mobile.dll
+ 2008-07-25 10:17 . 2008-07-25 10:17 835584 c:\windows\Microsoft.NET\Framework\v2.0.50727\System.Web.Mobile.dll
+ 2008-07-25 10:17 . 2008-07-25 10:17 261632 c:\windows\Microsoft.NET\Framework\v2.0.50727\System.Transactions.dll
- 2005-09-23 06:28 . 2005-09-23 06:28 114688 c:\windows\Microsoft.NET\Framework\v2.0.50727\System.ServiceProcess.dll
+ 2008-07-25 10:17 . 2008-07-25 10:17 114688 c:\windows\Microsoft.NET\Framework\v2.0.50727\System.ServiceProcess.dll
+ 2008-07-25 10:17 . 2008-07-25 10:17 258048 c:\windows\Microsoft.NET\Framework\v2.0.50727\System.Security.dll
- 2005-09-23 06:28 . 2005-09-23 06:28 258048 c:\windows\Microsoft.NET\Framework\v2.0.50727\System.Security.dll
+ 2008-07-25 10:17 . 2008-07-25 10:17 131072 c:\windows\Microsoft.NET\Framework\v2.0.50727\System.Runtime.Serialization.Formatters.Soap.dll
- 2005-09-23 06:28 . 2005-09-23 06:28 131072 c:\windows\Microsoft.NET\Framework\v2.0.50727\System.Runtime.Serialization.Formatters.Soap.dll
+ 2008-07-25 10:17 . 2008-07-25 10:17 303104 c:\windows\Microsoft.NET\Framework\v2.0.50727\System.Runtime.Remoting.dll
- 2005-09-23 06:28 . 2005-09-23 06:28 258048 c:\windows\Microsoft.NET\Framework\v2.0.50727\System.Messaging.dll
+ 2008-07-25 10:17 . 2008-07-25 10:17 258048 c:\windows\Microsoft.NET\Framework\v2.0.50727\System.Messaging.dll
+ 2008-07-25 10:17 . 2008-07-25 10:17 372736 c:\windows\Microsoft.NET\Framework\v2.0.50727\System.Management.dll
+ 2008-07-25 10:17 . 2008-07-25 10:17 113664 c:\windows\Microsoft.NET\Framework\v2.0.50727\System.EnterpriseServices.Wrapper.dll
- 2005-09-23 06:28 . 2005-09-23 06:28 258048 c:\windows\Microsoft.NET\Framework\v2.0.50727\System.EnterpriseServices.dll
+ 2008-07-25 10:17 . 2008-07-25 10:17 258048 c:\windows\Microsoft.NET\Framework\v2.0.50727\System.EnterpriseServices.dll
+ 2008-07-25 10:17 . 2008-07-25 10:17 626688 c:\windows\Microsoft.NET\Framework\v2.0.50727\System.Drawing.dll
+ 2008-07-25 10:17 . 2008-07-25 10:17 188416 c:\windows\Microsoft.NET\Framework\v2.0.50727\System.DirectoryServices.Protocols.dll
- 2005-09-23 06:28 . 2005-09-23 06:28 188416 c:\windows\Microsoft.NET\Framework\v2.0.50727\System.DirectoryServices.Protocols.dll
+ 2008-07-25 10:17 . 2008-07-25 10:17 401408 c:\windows\Microsoft.NET\Framework\v2.0.50727\System.DirectoryServices.dll
+ 2008-07-25 10:16 . 2008-07-25 10:16 970752 c:\windows\Microsoft.NET\Framework\v2.0.50727\System.Deployment.dll
+ 2008-07-25 10:17 . 2008-07-25 10:17 745472 c:\windows\Microsoft.NET\Framework\v2.0.50727\System.Data.SqlXml.dll
+ 2008-07-25 10:17 . 2008-07-25 10:17 486400 c:\windows\Microsoft.NET\Framework\v2.0.50727\System.Data.OracleClient.dll
+ 2008-07-25 10:17 . 2008-07-25 10:17 425984 c:\windows\Microsoft.NET\Framework\v2.0.50727\System.configuration.dll
- 2005-09-23 06:28 . 2005-09-23 06:28 110592 c:\windows\Microsoft.NET\Framework\v2.0.50727\sysglobl.dll
+ 2008-07-25 10:17 . 2008-07-25 10:17 110592 c:\windows\Microsoft.NET\Framework\v2.0.50727\sysglobl.dll
+ 2008-07-25 10:17 . 2008-07-25 10:17 392184 c:\windows\Microsoft.NET\Framework\v2.0.50727\SOS.dll
+ 2008-07-25 10:17 . 2008-07-25 10:17 118784 c:\windows\Microsoft.NET\Framework\v2.0.50727\shfusion.dll
+ 2008-07-25 10:16 . 2008-07-25 10:16 143360 c:\windows\Microsoft.NET\Framework\v2.0.50727\peverify.dll
+ 2008-07-25 10:17 . 2008-07-25 10:17 100856 c:\windows\Microsoft.NET\Framework\v2.0.50727\ngen.exe
+ 2008-07-25 10:17 . 2008-07-25 10:17 230912 c:\windows\Microsoft.NET\Framework\v2.0.50727\mscorsvc.dll
+ 2008-07-25 10:17 . 2008-07-25 10:17 345600 c:\windows\Microsoft.NET\Framework\v2.0.50727\mscorrc.dll
+ 2008-07-25 10:17 . 2008-07-25 10:17 114176 c:\windows\Microsoft.NET\Framework\v2.0.50727\mscorpe.dll
+ 2008-07-25 10:17 . 2008-07-25 10:17 367104 c:\windows\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll
+ 2008-07-25 10:17 . 2008-07-25 10:17 308224 c:\windows\Microsoft.NET\Framework\v2.0.50727\mscordbi.dll
+ 2008-07-25 10:17 . 2008-07-25 10:17 998408 c:\windows\Microsoft.NET\Framework\v2.0.50727\mscordacwks.dll
+ 2008-07-25 10:17 . 2008-07-25 10:17 659456 c:\windows\Microsoft.NET\Framework\v2.0.50727\Microsoft.VisualBasic.dll
- 2005-09-23 06:29 . 2005-09-23 06:29 372736 c:\windows\Microsoft.NET\Framework\v2.0.50727\Microsoft.VisualBasic.Compatibility.dll
+ 2008-07-25 10:17 . 2008-07-25 10:17 372736 c:\windows\Microsoft.NET\Framework\v2.0.50727\Microsoft.VisualBasic.Compatibility.dll
- 2005-09-23 06:29 . 2005-09-23 06:29 110592 c:\windows\Microsoft.NET\Framework\v2.0.50727\Microsoft.VisualBasic.Compatibility.Data.dll
+ 2008-07-25 10:17 . 2008-07-25 10:17 110592 c:\windows\Microsoft.NET\Framework\v2.0.50727\Microsoft.VisualBasic.Compatibility.Data.dll
+ 2008-07-25 10:16 . 2008-07-25 10:16 749568 c:\windows\Microsoft.NET\Framework\v2.0.50727\Microsoft.JScript.dll
+ 2008-07-25 10:16 . 2008-07-25 10:16 655360 c:\windows\Microsoft.NET\Framework\v2.0.50727\Microsoft.Build.Tasks.dll
+ 2008-07-25 10:16 . 2008-07-25 10:16 348160 c:\windows\Microsoft.NET\Framework\v2.0.50727\Microsoft.Build.Engine.dll
+ 2008-07-25 10:17 . 2008-07-25 10:17 230904 c:\windows\Microsoft.NET\Framework\v2.0.50727\ilasm.exe
+ 2008-07-25 10:17 . 2008-07-25 10:17 798224 c:\windows\Microsoft.NET\Framework\v2.0.50727\EventLogMessages.dll
+ 2008-07-25 10:17 . 2008-07-25 10:17 575496 c:\windows\Microsoft.NET\Framework\v2.0.50727\diasymreader.dll
+ 2008-07-25 10:17 . 2008-07-25 10:17 106496 c:\windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe
- 2005-09-23 06:28 . 2005-09-23 06:28 106496 c:\windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe
+ 2008-07-25 10:16 . 2008-07-25 10:16 507904 c:\windows\Microsoft.NET\Framework\v2.0.50727\AspNetMMCExt.dll
- 2005-09-23 06:28 . 2005-09-23 06:28 106496 c:\windows\Microsoft.NET\Framework\v2.0.50727\aspnet_regsql.exe
+ 2008-07-25 10:16 . 2008-07-25 10:16 106496 c:\windows\Microsoft.NET\Framework\v2.0.50727\aspnet_regsql.exe
+ 2008-07-25 10:17 . 2008-07-25 10:17 147968 c:\windows\Microsoft.NET\Framework\v2.0.50727\AdoNetDiag.dll
+ 2008-07-25 10:16 . 2008-07-25 10:16 218112 c:\windows\Microsoft.NET\Framework\v2.0.50727\1033\Vsavb7rtUI.dll
+ 2008-07-25 10:17 . 2008-07-25 10:17 193016 c:\windows\Microsoft.NET\Framework\v2.0.50727\1033\vbc7ui.dll
+ 2008-07-25 10:16 . 2008-07-25 10:16 145408 c:\windows\Microsoft.NET\Framework\v2.0.50727\1033\cscompui.dll
+ 2008-07-29 16:37 . 2008-07-29 16:37 911360 c:\windows\Installer\333e6.msp
+ 2008-07-29 16:33 . 2008-07-29 16:33 506368 c:\windows\Installer\333e5.msp
+ 2008-07-29 16:35 . 2008-07-29 16:35 553472 c:\windows\Installer\333e3.msp
+ 2010-03-14 07:10 . 2010-03-14 07:10 871424 c:\windows\Installer\333dd.msi
+ 2007-05-15 14:43 . 2007-05-15 14:43 1320800 c:\windows\system32\msxml6.dll
+ 2008-07-25 10:16 . 2008-07-25 10:16 1344000 c:\windows\Microsoft.NET\Framework\v2.0.50727\VsaVb7rt.dll
+ 2008-07-25 10:17 . 2008-07-25 10:17 1172472 c:\windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
+ 2008-07-25 10:17 . 2008-07-25 10:17 2048000 c:\windows\Microsoft.NET\Framework\v2.0.50727\System.XML.dll
+ 2008-07-25 10:17 . 2008-07-25 10:17 5025792 c:\windows\Microsoft.NET\Framework\v2.0.50727\System.Windows.Forms.dll
+ 2008-07-25 10:17 . 2008-07-25 10:17 5238784 c:\windows\Microsoft.NET\Framework\v2.0.50727\System.Web.dll
+ 2008-07-25 10:17 . 2008-07-25 10:17 3149824 c:\windows\Microsoft.NET\Framework\v2.0.50727\System.dll
+ 2008-07-25 10:17 . 2008-07-25 10:17 5062656 c:\windows\Microsoft.NET\Framework\v2.0.50727\System.Design.dll
+ 2008-07-25 10:17 . 2008-07-25 10:17 2933248 c:\windows\Microsoft.NET\Framework\v2.0.50727\System.Data.dll
+ 2008-07-25 10:16 . 2008-07-25 10:16 5815296 c:\windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll
+ 2008-07-25 10:17 . 2008-07-25 10:17 4546560 c:\windows\Microsoft.NET\Framework\v2.0.50727\mscorlib.dll
+ 2008-07-25 10:16 . 2008-07-25 10:16 1163768 c:\windows\Microsoft.NET\Framework\v2.0.50727\cscomp.dll
+ 2008-07-29 16:31 . 2008-07-29 16:31 6083072 c:\windows\Installer\333e7.msp
+ 2008-07-29 16:43 . 2008-07-29 16:43 1013248 c:\windows\Installer\333e4.msp
+ 2008-07-29 16:39 . 2008-07-29 16:39 3403264 c:\windows\Installer\333e2.msp
+ 2008-07-29 16:41 . 2008-07-29 16:41 6487040 c:\windows\Installer\333e1.msp
+ 2008-07-29 16:29 . 2008-07-29 16:29 2926080 c:\windows\Installer\333e0.msp
+ 2008-07-29 16:45 . 2008-07-29 16:45 2543616 c:\windows\Installer\333df.msp
.
-- Instantané actualisé --
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2010-02-25 39408]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Tvs"="c:\program files\TOSHIBA\Tvs\TvsTray.exe" [2005-04-05 73728]
"BluetoothAuthenticationAgent"="bthprops.cpl" [2004-08-19 110592]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2009-12-18 40368]
"Adobe ARM"="c:\program files\Fichiers communs\Adobe\ARM\1.0\AdobeARM.exe" [2009-12-11 948672]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-19 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=

R3 qcusbser;Mobile Connector USB Device for Legacy Serial Communication;c:\windows\system32\drivers\cmusbser.sys [25/02/2010 18:08 97408]
S2 gupdate;Service Google Update (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [04/03/2010 09:24 135664]
.
Contenu du dossier 'Tâches planifiées'

2010-03-14 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-03-04 08:24]

2010-03-14 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-03-04 08:24]
.
.
------- Examen supplémentaire -------
.
uStart Page = hxxp://www.google.co.ma/
uInternet Connection Wizard,ShellNext = iexplore
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll/cmsidewiki.html
TCP: {70D71040-0F40-4D2A-9E2A-0B27025BEB47} = 212.217.0.1 212.217.0.12
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-03-14 13:47
Windows 5.1.2600 Service Pack 2 NTFS

Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

Recherche de fichiers cachés ...

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************
.
--------------------- DLLs chargées dans les processus actifs ---------------------

- - - - - - - > 'explorer.exe'(2384)
c:\windows\system32\msi.dll
.
Heure de fin: 2010-03-14 13:48:54
ComboFix-quarantined-files.txt 2010-03-14 12:48
ComboFix2.txt 2010-03-13 23:28
ComboFix3.txt 2010-03-13 00:04

Avant-CF: 17 625 870 336 octets libres
Après-CF: 17 608 523 776 octets libres

WindowsXP-KB310994-SP2-Pro-BootDisk-FRA.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professionnel" /noexecute=optin /fastdetect

- - End Of File - - D6265CC2CBC7B269D14FD815DA992D43

salut.

Je commence par le rapport de suppression de tools cleaner .



[ Rapport ToolsCleaner version 2.3.11 (par A.Rothstein & dj QUIOU) ]

--> Recherche:

C:\Qoobox: trouvé !
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis: trouvé !
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis\HijackThis.lnk: trouvé !
C:\Documents and Settings\naji\Bureau\HijackThis.lnk: trouvé !
C:\Documents and Settings\naji\Recent\UsbFix.lnk: trouvé !
C:\Program Files\trend micro\HijackThis: trouvé !
C:\Program Files\trend micro\HijackThis\HijackThis.exe: trouvé !
C:\Program Files\trend micro\HijackThis\hijackthis.log: trouvé !
C:\Qoobox\Quarantine\catchme.log: trouvé !
C:\WINDOWS\mbr.exe: trouvé !

---------------------------------
--> Suppression:

C:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis\HijackThis.lnk: supprimé !
C:\Documents and Settings\naji\Bureau\HijackThis.lnk: supprimé !
C:\Program Files\trend micro\HijackThis\HijackThis.exe: supprimé !
C:\Documents and Settings\naji\Recent\UsbFix.lnk: supprimé !
C:\Program Files\trend micro\HijackThis\hijackthis.log: supprimé !
C:\Qoobox\Quarantine\catchme.log: supprimé !
C:\WINDOWS\mbr.exe: supprimé !
C:\Qoobox: supprimé !
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis: supprimé !
C:\Program Files\trend micro\HijackThis: supprimé !

Salut Brave jlpjlp .Je vous remercie de tous mon coeur .


Maintenant , Internet Explorer est mis à jour .

J'ai installé Java (TM)6Update18 .

si c'est fini alors c'est à vous de mettre fin à la discution et mille fois merci..