VIRUS TROJAN GAMETHIEF

info.txt logfile of random's system information tool 1.06 2009-06-08 19:44:58

======Uninstall list======

-->rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf
Adobe Flash Player 10 ActiveX-->C:\WINDOWS\system32\Macromed\Flash\uninstall_activeX.exe
Antivirus Personnel 2009-->MsiExec.exe /I{4B9BB601-13E9-4042-A3BC-E7955BF4A98F}
Antivirus Personnel 2009-->MsiExec.exe /I{4B9BB601-13E9-4042-A3BC-E7955BF4A98F}
ATI - Software Uninstall Utility-->C:\Program Files\ATI Technologies\UninstallAll\AtiCimUn.exe
ATI Catalyst Control Center-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{055EE59D-217B-43A7-ABFF-507B966405D8}\setup.exe" -l0x0
ATI Display Driver-->rundll32 C:\WINDOWS\system32\atiiiexx.dll,_InfEngUnInstallINFFile_RunDLL@16 -force_restart -flags:0x2010001 -inf_class:DISPLAY -clean
Catalyst Control Center - Branding-->MsiExec.exe /I{D3B1C799-CB73-42DE-BA0F-2344793A095C}
Correctif pour Windows XP (KB952287)-->"C:\WINDOWS\$NtUninstallKB952287$\spuninst\spuninst.exe"
EVEREST Ultimate Edition v4.60-->"C:\Program Files\Lavalys\EVEREST Ultimate Edition\unins000.exe"
HijackThis 2.0.2-->"C:\Program Files\trend micro\HijackThis.exe" /uninstall
HP Image Zone 4.7-->C:\Program Files\HP\Digital Imaging\uninstall\hpzscr01.exe -datfile hpqscr01.dat
HP PSC & OfficeJet 4.7-->"C:\Program Files\HP\Digital Imaging\{5469D537-9B44-4c78-BF2D-5F9807564F74}\setup\hpzscr01.exe" -datfile hposcr05.dat
IZArc 3.81-->"C:\Program Files\IZArc\unins000.exe"
Java(TM) 6 Update 7-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160070}
Microsoft .NET Framework 2.0-->C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.exe
Microsoft .NET Framework 3.0 French Language Pack-->MsiExec.exe /X{E3C080B0-23F5-49AF-89F8-8E8DBC89E659}
Microsoft .NET Framework 3.0-->C:\WINDOWS\Microsoft.NET\Framework\v3.0\Microsoft .NET Framework 3.0\setup.exe
Mise à jour de sécurité pour Lecteur Windows Media (KB952069)-->"C:\WINDOWS\$NtUninstallKB952069_WM9$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB923561)-->"C:\WINDOWS\$NtUninstallKB923561$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB938464)-->"C:\WINDOWS\$NtUninstallKB938464$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB938464-v2)-->"C:\WINDOWS\$NtUninstallKB938464-v2$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB946648)-->"C:\WINDOWS\$NtUninstallKB946648$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB950762)-->"C:\WINDOWS\$NtUninstallKB950762$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB950974)-->"C:\WINDOWS\$NtUninstallKB950974$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB951066)-->"C:\WINDOWS\$NtUninstallKB951066$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB951376-v2)-->"C:\WINDOWS\$NtUninstallKB951376-v2$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB951698)-->"C:\WINDOWS\$NtUninstallKB951698$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB951748)-->"C:\WINDOWS\$NtUninstallKB951748$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB952004)-->"C:\WINDOWS\$NtUninstallKB952004$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB952954)-->"C:\WINDOWS\$NtUninstallKB952954$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB954211)-->"C:\WINDOWS\$NtUninstallKB954211$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB954459)-->"C:\WINDOWS\$NtUninstallKB954459$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB954600)-->"C:\WINDOWS\$NtUninstallKB954600$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB955069)-->"C:\WINDOWS\$NtUninstallKB955069$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB956391)-->"C:\WINDOWS\$NtUninstallKB956391$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB956572)-->"C:\WINDOWS\$NtUninstallKB956572$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB956802)-->"C:\WINDOWS\$NtUninstallKB956802$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB956803)-->"C:\WINDOWS\$NtUninstallKB956803$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB956841)-->"C:\WINDOWS\$NtUninstallKB956841$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB957097)-->"C:\WINDOWS\$NtUninstallKB957097$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB958215)-->"C:\WINDOWS\$NtUninstallKB958215$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB958644)-->"C:\WINDOWS\$NtUninstallKB958644$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB958687)-->"C:\WINDOWS\$NtUninstallKB958687$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB958690)-->"C:\WINDOWS\$NtUninstallKB958690$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB959426)-->"C:\WINDOWS\$NtUninstallKB959426$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB960225)-->"C:\WINDOWS\$NtUninstallKB960225$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB960714)-->"C:\WINDOWS\$NtUninstallKB960714$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB960715)-->"C:\WINDOWS\$NtUninstallKB960715$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB960803)-->"C:\WINDOWS\$NtUninstallKB960803$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB961373)-->"C:\WINDOWS\$NtUninstallKB961373$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB963027)-->"C:\WINDOWS\$NtUninstallKB963027$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB951978)-->"C:\WINDOWS\$NtUninstallKB951978$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB955839)-->"C:\WINDOWS\$NtUninstallKB955839$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB967715)-->"C:\WINDOWS\$NtUninstallKB967715$\spuninst\spuninst.exe"
Module de prise en charge linguistique de Microsoft .NET Framework 2.0 - FRA-->C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0 Language Pack - FRA\install.exe
Module de prise en charge linguistique du français de Microsoft .NET Framework 3.0-->C:\WINDOWS\Microsoft.NET\Framework\v3.0\Microsoft .NET Framework 3.0 French Language Pack\setup.exe
MSXML 6 Service Pack 2 (KB954459)-->MsiExec.exe /I{1A528690-6A2D-4BC5-B143-8C4AE8D19D96}
OpenOffice.org 3.0-->MsiExec.exe /I{6860B340-530D-46B3-91F8-1AE1F70F7C33}
Picasa 3-->"C:\Program Files\Google\Picasa3\Uninstall.exe"
REALTEK GbE & FE Ethernet PCI NIC Driver-->C:\Program Files\InstallShield Installation Information\{ACCA20B0-C4D1-4BF5-BF21-0A0EB5EF9730}\setup.exe -runfromtemp -l0x040c -removeonly
Windows Communication Foundation-->MsiExec.exe /X{491DD792-AD81-429C-9EB4-86DD3D22E333}
Windows Imaging Component-->"C:\WINDOWS\$NtUninstallWIC$\spuninst\spuninst.exe"
Windows Presentation Foundation Language Pack (FRA)-->MsiExec.exe /X{6901DD22-527A-41EF-9059-E81FEDE9E494}
Windows Presentation Foundation-->MsiExec.exe /X{BAF78226-3200-4DB4-BE33-4D922A799840}
Windows Workflow Foundation FR Language Pack-->MsiExec.exe /I{B84C141C-9A13-44BE-9A69-301D7B11D836}
Windows Workflow Foundation-->MsiExec.exe /I{7D1B85BD-AA07-48B8-808D-67A4067FC6BD}
Windows XP Service Pack 3-->"C:\WINDOWS\$NtServicePackUninstall$\spuninst\spuninst.exe"
XML Paper Specification Shared Components Language Pack 1.0-->"C:\WINDOWS\$NtUninstallXPSEPSCLP$\spuninst\spuninst.exe"

======Security center information======

AV: Antivirus Personnel 2009 (outdated)

======System event log======

Computer Name: POSTE
Event Code: 7036
Message: Le service Acquisition d'image Windows (WIA) est entré dans l'état : en cours d'exécution.

Record Number: 2839
Source Name: Service Control Manager
Time Written: 20090329065717.000000+120
Event Type: Informations
User:

Computer Name: POSTE
Event Code: 17
Message: Le périphérique a renvoyé une ou plusieurs réponses incorrectes après une réinitialisation du clavier.

Record Number: 2838
Source Name: i8042prt
Time Written: 20090329065715.000000+120
Event Type: Avertissement
User:

Computer Name: POSTE
Event Code: 7036
Message: Le service Acquisition d'image Windows (WIA) est entré dans l'état : en cours d'exécution.

Record Number: 2837
Source Name: Service Control Manager
Time Written: 20090328194747.000000+060
Event Type: Informations
User:

Computer Name: POSTE
Event Code: 4201
Message: Le système a détecté que la carte réseau \DEVICE\TCPIP_{343BAAAA-709F-49C3-B3CB-3A55C3EF4B3C} était connectée au réseau,
et a lancé une opération normale sur la carte réseau.

Record Number: 2836
Source Name: Tcpip
Time Written: 20090328194745.000000+060
Event Type: Informations
User:

Computer Name: POSTE
Event Code: 4201
Message: Le système a détecté que la carte réseau \DEVICE\TCPIP_{343BAAAA-709F-49C3-B3CB-3A55C3EF4B3C} était connectée au réseau,
et a lancé une opération normale sur la carte réseau.

Record Number: 2835
Source Name: Tcpip
Time Written: 20090328163408.000000+060
Event Type: Informations
User:

=====Application event log=====

Computer Name: POSTE
Event Code: 1100
Message: .NET Runtime Optimization Service (clr_optimization_v2.0.50727_32) - Began compiling: C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\Microsoft.Transactions.Bridge.dll


Record Number: 116
Source Name: .NET Runtime Optimization Service
Time Written: 20090119154050.000000+060
Event Type: Informations
User:

Computer Name: POSTE
Event Code: 1102
Message: .NET Runtime Optimization Service (clr_optimization_v2.0.50727_32) - Succesfully compiled: C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\ComSvcConfig.exe


Record Number: 115
Source Name: .NET Runtime Optimization Service
Time Written: 20090119154050.000000+060
Event Type:
User:

Computer Name: POSTE
Event Code: 1100
Message: .NET Runtime Optimization Service (clr_optimization_v2.0.50727_32) - Began compiling: C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\ComSvcConfig.exe


Record Number: 114
Source Name: .NET Runtime Optimization Service
Time Written: 20090119154034.000000+060
Event Type: Informations
User:

Computer Name: POSTE
Event Code: 1102
Message: .NET Runtime Optimization Service (clr_optimization_v2.0.50727_32) - Succesfully compiled: C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.ServiceModel.dll


Record Number: 113
Source Name: .NET Runtime Optimization Service
Time Written: 20090119154032.000000+060
Event Type:
User:

Computer Name: POSTE
Event Code: 1100
Message: .NET Runtime Optimization Service (clr_optimization_v2.0.50727_32) - Began compiling: C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.ServiceModel.dll


Record Number: 112
Source Name: .NET Runtime Optimization Service
Time Written: 20090119153802.000000+060
Event Type: Informations
User:

======Environment variables======

"ComSpec"=%SystemRoot%\system32\cmd.exe
"Path"=%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem;C:\Program Files\ATI Technologies\ATI.ACE\Core-Static
"windir"=%SystemRoot%
"FP_NO_HOST_CHECK"=NO
"OS"=Windows_NT
"PROCESSOR_ARCHITECTURE"=x86
"PROCESSOR_LEVEL"=15
"PROCESSOR_IDENTIFIER"=x86 Family 15 Model 36 Stepping 2, AuthenticAMD
"PROCESSOR_REVISION"=2402
"NUMBER_OF_PROCESSORS"=1
"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
"TEMP"=%SystemRoot%\TEMP
"TMP"=%SystemRoot%\TEMP

-----------------EOF-----------------




ET VOICI LE SECOND:


Logfile of random's system information tool 1.06 (written by random/random)
Run by Mélanie at 2009-06-08 19:44:08
Microsoft Windows XP Édition familiale Service Pack 3
System drive C: has 8 GB (10%) free of 76 GB
Total RAM: 382 MB (32% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:44:43, on 08/06/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\Micro Application\Antivirus Personnel 2009\avp.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\OpenOffice.org 3\program\soffice.exe
C:\Program Files\OpenOffice.org 3\program\soffice.bin
C:\Program Files\Micro Application\Antivirus Personnel 2009\avp.exe
C:\Program Files\Micro Application\Antivirus Personnel 2009\avp.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Java\jre1.6.0_07\bin\jucheck.exe
C:\DOCUME~1\MLANIE~1\LOCALS~1\Temp\ARCC\rav.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Mélanie\Local Settings\Temporary Internet Files\Content.IE5\8HQJSLE3\RSIT[1].exe
C:\Program Files\trend micro\Mélanie.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [UIUCU] C:\DOCUME~1\MLANIE~1\LOCALS~1\Temp\UIUCU.EXE -CLEAN_UP
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Micro Application\Antivirus Personnel 2009\avp.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [cdoosoft] C:\WINDOWS\system32\olhrwef.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: OpenOffice.org 3.0.lnk = C:\Program Files\OpenOffice.org 3\program\quickstart.exe
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINDOWS\system32\GPhotos.scr/200
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Statistiques d’Anti-Virus Internet - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Micro Application\Antivirus Personnel 2009\SCIEPlgn.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} (Fun Web Products Installer Start) - http://ak.exe.imgfarm.com/images/nocache/funwebproducts/ei-4/ZwinkyInitialSetup1.0.1.1.cab
O16 - DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} (HP Download Manager) - https://h20436.www2.hp.com/ediags/dex/secure/HPDEXAXO.cab
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

Vous êtes 2 à m'avoir demandé la même chose (c'est donc bon signe) j'ai posté les 2 "trucs" à l'autre personne, tu peux aller voir.
Merci.

############################## [ UsbFix V3.029 | Scan ]

# User : Mélanie (Administrateurs) # POSTE
# Update on 05/06/09 by Chiquitine29, C_XX & Chimay8
# WebSite : http://pagesperso-orange.fr/NosTools/usbfix.html
# Start at: 20:10:30 | 08/06/2009

# AMD Turion(tm) 64 Mobile Technology ML-28
# Microsoft Windows XP Édition familiale (5.1.2600 32-bit) # Service Pack 3
# Internet Explorer 6.0.2900.5512
# Windows Firewall Status : Enabled
# AV : Antivirus Personnel 2009 7.0.1.325 [ Enabled | (!) Outdated ]

# C:\ # Disque fixe local # 74,53 Go (7,93 Go free) # NTFS
# D:\ # Disque CD-ROM
# E:\ # Disque fixe local # 103,74 Go (38,77 Go free) # NTFS
# G:\ # Disque fixe local # 7,02 Go (1,32 Go free) [HP_RECOVERY] # FAT32
# H:\ # Disque amovible # 7,38 Go (6,35 Go free) [USB_DISK] # FAT32

############################## [ Processus actifs ]

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\Micro Application\Antivirus Personnel 2009\avp.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\OpenOffice.org 3\program\soffice.exe
C:\Program Files\OpenOffice.org 3\program\soffice.bin
C:\Program Files\Micro Application\Antivirus Personnel 2009\avp.exe
C:\Program Files\Micro Application\Antivirus Personnel 2009\avp.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Java\jre1.6.0_07\bin\jucheck.exe
C:\DOCUME~1\MLANIE~1\LOCALS~1\Temp\ARCC\rav.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\WINDOWS\system32\NOTEPAD.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe

################## [ Registre Startup ]

HKCU_Main: "Local Page"="C:\\WINDOWS\\system32\\blank.htm"
HKCU_Main: "Search Page"="https://www.google.com/?gws_rd=ssl"
HKCU_Main: "Start Page"="https://www.google.fr/?gws_rd=ssl"
HKLM_logon: "Userinit"="C:\\WINDOWS\\system32\\userinit.exe,"
HKLM_logon: "DefaultUserName"="M‚lanie"
HKLM_logon: "AltDefaultUserName"="M‚lanie"
HKLM_logon: "LegalNoticeCaption"=""
HKLM_logon: "LegalNoticeText"=""
HKLM_Run: StartCCC="C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
HKLM_Run: UIUCU=C:\DOCUME~1\MLANIE~1\LOCALS~1\Temp\UIUCU.EXE -CLEAN_UP
HKLM_Run: SunJavaUpdateSched="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
HKLM_Run: AVP="C:\Program Files\Micro Application\Antivirus Personnel 2009\avp.exe"
HKCU_Run: MSMSGS="C:\Program Files\Messenger\msmsgs.exe" /background
HKCU_Run: cdoosoft=C:\WINDOWS\system32\olhrwef.exe

################## [ Fichiers # Dossiers infectieux ]

Found ! C:\WINDOWS\system32\ckvo0.dll
Found ! C:\WINDOWS\system32\nmdfgds0.dll
Found ! C:\WINDOWS\system32\nmdfgds1.dll
Found ! C:\WINDOWS\system32\nmdfgds2.dll
Found ! C:\WINDOWS\system32\olhrwef.exe
Found ! C:\DOCUME~1\MLANIE~1\LOCALS~1\Temp\help.exe
C:\autorun.inf # -> fichier appelé : "C:\8.exe" ( présent ! )
Found ! C:\0bcobed.exe
Found ! C:\0xuc.com
Found ! C:\1ogf.exe
Found ! C:\1utbfd.bat
Found ! C:\2a.exe
Found ! C:\2fiy.bat
Found ! C:\cqxj.exe
Found ! C:\cqxj.exe
Found ! C:\cv22.cmd
Found ! C:\e2.cmd
Found ! C:\eyt.exe
Found ! C:\fbak.exe
Found ! C:\gi2ky.exe
Found ! C:\qxty9be.cmd
Found ! C:\gy.exe
Found ! C:\hkn6k.bat
Found ! C:\hyetn1i.exe
Found ! C:\i6g6x.cmd
Found ! C:\icxpa.cmd
Found ! C:\jeorels.cmd
Found ! C:\jm3cx96.bat
Found ! C:\lc.exe
Found ! C:\luk1ylq.com
Found ! C:\m0vnonh.bat
Found ! C:\minm.cmd
Found ! C:\mt.bat
Found ! C:\n68mqcra.exe
Found ! C:\nu.cmd
Found ! C:\opgde.exe
Found ! C:\pook.com
Found ! C:\qwtb.com
Found ! C:\qwtb.com
Found ! C:\qxty9be.cmd
Found ! C:\rbj9jn1n.bat
Found ! C:\upw.bat
Found ! C:\ur0.com
Found ! C:\uxkl0apt.bat
Found ! C:\w2.com
Found ! C:\xh319r9b.bat
Found ! C:\xh319r9b.bat
Found ! C:\yhh.bat
Found ! C:\ysep1.exe
Found ! C:\9.cmd
Found ! C:\2.bat
Found ! C:\8.bat
Found ! C:\8.exe
Found ! C:\i.com
Found ! C:\i.cmd
Found ! C:\j.cmd
Found ! C:\autorun.inf
E:\autorun.inf # -> fichier appelé : "E:\8.exe" ( présent ! )
Found ! E:\0bcobed.exe
Found ! E:\0xuc.com
Found ! E:\1ogf.exe
Found ! E:\1utbfd.bat
Found ! E:\2fiy.bat
Found ! E:\cqxj.exe
Found ! E:\cqxj.exe
Found ! E:\cv22.cmd
Found ! E:\e2.cmd
Found ! E:\eyt.exe
Found ! E:\fbak.exe
Found ! E:\gi2ky.exe
Found ! E:\qxty9be.cmd
Found ! E:\gy.exe
Found ! E:\hkn6k.bat
Found ! E:\hyetn1i.exe
Found ! E:\i6g6x.cmd
Found ! E:\icxpa.cmd
Found ! E:\jeorels.cmd
Found ! E:\jm3cx96.bat
Found ! E:\luk1ylq.com
Found ! E:\m0vnonh.bat
Found ! E:\minm.cmd
Found ! E:\mt.bat
Found ! E:\nu.cmd
Found ! E:\opgde.exe
Found ! E:\pook.com
Found ! E:\qwtb.com
Found ! E:\qwtb.com
Found ! E:\qxty9be.cmd
Found ! E:\rbj9jn1n.bat
Found ! E:\upw.bat
Found ! E:\ur0.com
Found ! E:\uxkl0apt.bat
Found ! E:\w2.com
Found ! E:\yhh.bat
Found ! E:\9.cmd
Found ! E:\2.bat
Found ! E:\8.bat
Found ! E:\8.exe
Found ! E:\i.com
Found ! E:\w.com
Found ! E:\i.cmd
Found ! E:\j.cmd
Found ! E:\autorun.inf
G:\autorun.inf # -> fichier appelé : "G:\8.exe" ( présent ! )
Found ! G:\0bcobed.exe
Found ! G:\0xuc.com
Found ! G:\1ogf.exe
Found ! G:\1utbfd.bat
Found ! G:\2fiy.bat
Found ! G:\cqxj.exe
Found ! G:\cqxj.exe
Found ! G:\cv22.cmd
Found ! G:\e2.cmd
Found ! G:\eyt.exe
Found ! G:\fbak.exe
Found ! G:\gi2ky.exe
Found ! G:\qxty9be.cmd
Found ! G:\gy.exe
Found ! G:\hkn6k.bat
Found ! G:\hyetn1i.exe
Found ! G:\i6g6x.cmd
Found ! G:\icxpa.cmd
Found ! G:\jeorels.cmd
Found ! G:\jm3cx96.bat
Found ! G:\luk1ylq.com
Found ! G:\m0vnonh.bat
Found ! G:\minm.cmd
Found ! G:\mt.bat
Found ! G:\nu.cmd
Found ! G:\opgde.exe
Found ! G:\pook.com
Found ! G:\qwtb.com
Found ! G:\qwtb.com
Found ! G:\qxty9be.cmd
Found ! G:\rbj9jn1n.bat
Found ! G:\upw.bat
Found ! G:\ur0.com
Found ! G:\uxkl0apt.bat
Found ! G:\w2.com
Found ! G:\yhh.bat
Found ! G:\9.cmd
Found ! G:\2.bat
Found ! G:\8.bat
Found ! G:\8.exe
Found ! G:\i.com
Found ! G:\w.com
Found ! G:\i.cmd
Found ! G:\j.cmd
Found ! G:\autorun.inf

################## [ Registre # Clés Run infectieuses ]

Found ! HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run "cdoosoft"
Found ! HKU\S-1-5-21-1844237615-1425521274-839522115-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\Run "cdoosoft"

################## [ Registre # Mountpoints2 ]

HKCU\...\Explorer\MountPoints2\{1195b7fe-e5a3-11dd-825f-806d6172696f}\Shell\AutoRun\Command
HKCU\...\Explorer\MountPoints2\{1195b7fe-e5a3-11dd-825f-806d6172696f}\Shell\open\Command
HKCU\...\Explorer\MountPoints2\{5981fef4-fa92-11dd-9cdd-00c09fbdca56}\Shell\AutoRun\Command
HKCU\...\Explorer\MountPoints2\{5981fef4-fa92-11dd-9cdd-00c09fbdca56}\Shell\open\Command
HKCU\...\Explorer\MountPoints2\{77612bcd-4f37-11de-955a-00c09fbdca56}\Shell\AutoRun\Command
HKCU\...\Explorer\MountPoints2\{77612bcd-4f37-11de-955a-00c09fbdca56}\Shell\open\Command
HKCU\...\Explorer\MountPoints2\{87f9ad75-2335-11de-8a9d-00c09fbdca56}\Shell\AutoRun\Command
HKCU\...\Explorer\MountPoints2\{87f9ad75-2335-11de-8a9d-00c09fbdca56}\Shell\open\Command
HKCU\...\Explorer\MountPoints2\{93ac158f-e713-11dd-9cbb-00c09fbdca56}\Shell\AutoRun\Command
HKCU\...\Explorer\MountPoints2\{93ac158f-e713-11dd-9cbb-00c09fbdca56}\Shell\open\Command
HKCU\...\Explorer\MountPoints2\{93ac1590-e713-11dd-9cbb-00c09fbdca56}\Shell\AutoRun\Command
HKCU\...\Explorer\MountPoints2\{93ac1590-e713-11dd-9cbb-00c09fbdca56}\Shell\open\Command
HKCU\...\Explorer\MountPoints2\{963b3f03-ebf1-11dd-9cc2-00c09fbdca56}\Shell\AutoRun\Command
HKCU\...\Explorer\MountPoints2\{963b3f03-ebf1-11dd-9cc2-00c09fbdca56}\Shell\open\Command
HKCU\...\Explorer\MountPoints2\{a5d3eb77-f80c-11dd-9cd7-00c09fbdca56}\Shell\AutoRun\Command
HKCU\...\Explorer\MountPoints2\{a5d3eb77-f80c-11dd-9cd7-00c09fbdca56}\Shell\explore\Command
HKCU\...\Explorer\MountPoints2\{a5d3eb77-f80c-11dd-9cd7-00c09fbdca56}\Shell\open\Command
HKCU\...\Explorer\MountPoints2\{d21ab8a4-e627-11dd-9cb8-00c09fbdca56}\Shell\AutoRun\Command
HKCU\...\Explorer\MountPoints2\{d21ab8a4-e627-11dd-9cb8-00c09fbdca56}\Shell\explore\Command
HKCU\...\Explorer\MountPoints2\{d21ab8a4-e627-11dd-9cb8-00c09fbdca56}\Shell\open\Command
HKCU\...\Explorer\MountPoints2\{d4c203fb-ed00-11dd-9cc4-00c09fbdca56}\Shell\AutoRun\Command
HKCU\...\Explorer\MountPoints2\{d4c203fb-ed00-11dd-9cc4-00c09fbdca56}\Shell\open\Command
HKCU\...\Explorer\MountPoints2\{eeb59770-45f0-11de-b3d9-00c09fbdca56}\Shell\AutoRun\Command
HKCU\...\Explorer\MountPoints2\{eeb59770-45f0-11de-b3d9-00c09fbdca56}\Shell\open\Command

################## [ ! Fin du rapport # UsbFix V3.029 ! ]

############################## [ UsbFix V3.029 | Cleaning ]

# User : Mélanie (Administrateurs) # POSTE
# Update on 05/06/09 by Chiquitine29, C_XX & Chimay8
# WebSite : http://pagesperso-orange.fr/NosTools/usbfix.html
# Start at: 20:42:43 | 08/06/2009

# AMD Turion(tm) 64 Mobile Technology ML-28
# Microsoft Windows XP Édition familiale (5.1.2600 32-bit) # Service Pack 3
# Internet Explorer 6.0.2900.5512
# Windows Firewall Status : Enabled
# AV : Antivirus Personnel 2009 7.0.1.325 [ (!) Disabled | (!) Outdated ]

# C:\ # Disque fixe local # 74,53 Go (7,96 Go free) # NTFS
# D:\ # Disque CD-ROM
# E:\ # Disque fixe local # 103,74 Go (38,77 Go free) # NTFS
# G:\ # Disque fixe local # 7,02 Go (1,32 Go free) [HP_RECOVERY] # FAT32
# H:\ # Disque amovible # 7,38 Go (6,35 Go free) [USB_DISK] # FAT32

############################## [ Processus actifs ]

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\logonui.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\userinit.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe

################## [ Fichiers # Dossiers infectieux ]

Deleted ! C:\WINDOWS\system32\ckvo0.dll
Deleted ! C:\WINDOWS\system32\nmdfgds0.dll
Deleted ! C:\WINDOWS\system32\nmdfgds1.dll
Deleted ! C:\WINDOWS\system32\nmdfgds2.dll
Deleted ! C:\WINDOWS\system32\olhrwef.exe
Deleted ! C:\DOCUME~1\MLANIE~1\LOCALS~1\Temp\help.exe
Deleted ! C:\0bcobed.exe
Deleted ! C:\0xuc.com
Deleted ! C:\1ogf.exe
Deleted ! C:\1utbfd.bat
Deleted ! C:\2a.exe
Deleted ! C:\2fiy.bat
Deleted ! C:\cqxj.exe
Deleted ! C:\cv22.cmd
Deleted ! C:\e2.cmd
Deleted ! C:\eyt.exe
Deleted ! C:\fbak.exe
Deleted ! C:\gi2ky.exe
Deleted ! C:\qxty9be.cmd
Deleted ! C:\gy.exe
Deleted ! C:\hkn6k.bat
Deleted ! C:\hyetn1i.exe
Deleted ! C:\i6g6x.cmd
Deleted ! C:\icxpa.cmd
Deleted ! C:\jeorels.cmd
Deleted ! C:\jm3cx96.bat
Deleted ! C:\lc.exe
Deleted ! C:\luk1ylq.com
Deleted ! C:\m0vnonh.bat
Deleted ! C:\minm.cmd
Deleted ! C:\mt.bat
Deleted ! C:\n68mqcra.exe
Deleted ! C:\nu.cmd
Deleted ! C:\opgde.exe
Deleted ! C:\pook.com
Deleted ! C:\qwtb.com
Deleted ! C:\rbj9jn1n.bat
Deleted ! C:\upw.bat
Deleted ! C:\ur0.com
Deleted ! C:\uxkl0apt.bat
Deleted ! C:\w2.com
Deleted ! C:\xh319r9b.bat
Deleted ! C:\yhh.bat
Deleted ! C:\ysep1.exe
Deleted ! C:\9.cmd
Deleted ! C:\2.bat
Deleted ! C:\8.bat
Deleted ! C:\i.com
Deleted ! C:\i.cmd
Deleted ! C:\j.cmd
Deleted ! E:\0bcobed.exe
Deleted ! E:\0xuc.com
Deleted ! E:\1ogf.exe
Deleted ! E:\1utbfd.bat
Deleted ! E:\2fiy.bat
Deleted ! E:\cqxj.exe
Deleted ! E:\cv22.cmd
Deleted ! E:\e2.cmd
Deleted ! E:\eyt.exe
Deleted ! E:\fbak.exe
Deleted ! E:\gi2ky.exe
Deleted ! E:\qxty9be.cmd
Deleted ! E:\gy.exe
Deleted ! E:\hkn6k.bat
Deleted ! E:\hyetn1i.exe
Deleted ! E:\i6g6x.cmd
Deleted ! E:\icxpa.cmd
Deleted ! E:\jeorels.cmd
Deleted ! E:\jm3cx96.bat
Deleted ! E:\luk1ylq.com
Deleted ! E:\m0vnonh.bat
Deleted ! E:\minm.cmd
Deleted ! E:\mt.bat
Deleted ! E:\nu.cmd
Deleted ! E:\opgde.exe
Deleted ! E:\pook.com
Deleted ! E:\qwtb.com
Deleted ! E:\rbj9jn1n.bat
Deleted ! E:\upw.bat
Deleted ! E:\ur0.com
Deleted ! E:\uxkl0apt.bat
Deleted ! E:\w2.com
Deleted ! E:\yhh.bat
Deleted ! E:\9.cmd
Deleted ! E:\2.bat
Deleted ! E:\8.bat
Deleted ! E:\i.com
Deleted ! E:\w.com
Deleted ! E:\i.cmd
Deleted ! E:\j.cmd
Deleted ! G:\0bcobed.exe
Deleted ! G:\0xuc.com
Deleted ! G:\1ogf.exe
Deleted ! G:\1utbfd.bat
Deleted ! G:\2fiy.bat
Deleted ! G:\cqxj.exe
Deleted ! G:\cv22.cmd
Deleted ! G:\e2.cmd
Deleted ! G:\eyt.exe
Deleted ! G:\fbak.exe
Deleted ! G:\gi2ky.exe
Deleted ! G:\qxty9be.cmd
Deleted ! G:\gy.exe
Deleted ! G:\hkn6k.bat
Deleted ! G:\hyetn1i.exe
Deleted ! G:\i6g6x.cmd
Deleted ! G:\icxpa.cmd
Deleted ! G:\jeorels.cmd
Deleted ! G:\jm3cx96.bat
Deleted ! G:\luk1ylq.com
Deleted ! G:\m0vnonh.bat
Deleted ! G:\minm.cmd
Deleted ! G:\mt.bat
Deleted ! G:\nu.cmd
Deleted ! G:\opgde.exe
Deleted ! G:\pook.com
Deleted ! G:\qwtb.com
Deleted ! G:\rbj9jn1n.bat
Deleted ! G:\upw.bat
Deleted ! G:\ur0.com
Deleted ! G:\uxkl0apt.bat
Deleted ! G:\w2.com
Deleted ! G:\yhh.bat
Deleted ! G:\9.cmd
Deleted ! G:\2.bat
Deleted ! G:\8.bat
Deleted ! G:\i.com
Deleted ! G:\w.com
Deleted ! G:\i.cmd
Deleted ! G:\j.cmd

################## [ Registre # Clés Run infectieuses ]

Deleted ! HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run "cdoosoft"

################## [ Registre # Mountpoints2 ]

Deleted ! HKCU\...\Explorer\MountPoints2\{5981fef4-fa92-11dd-9cdd-00c09fbdca56}\Shell\AutoRun\Command
Deleted ! HKCU\...\Explorer\MountPoints2\{77612bcd-4f37-11de-955a-00c09fbdca56}\Shell\AutoRun\Command
Deleted ! HKCU\...\Explorer\MountPoints2\{87f9ad75-2335-11de-8a9d-00c09fbdca56}\Shell\AutoRun\Command
Deleted ! HKCU\...\Explorer\MountPoints2\{963b3f03-ebf1-11dd-9cc2-00c09fbdca56}\Shell\AutoRun\Command
Deleted ! HKCU\...\Explorer\MountPoints2\{a5d3eb77-f80c-11dd-9cd7-00c09fbdca56}\Shell\AutoRun\Command
Deleted ! HKCU\...\Explorer\MountPoints2\{d21ab8a4-e627-11dd-9cb8-00c09fbdca56}\Shell\AutoRun\Command
Deleted ! HKCU\...\Explorer\MountPoints2\{d4c203fb-ed00-11dd-9cc4-00c09fbdca56}\Shell\AutoRun\Command
Deleted ! HKCU\...\Explorer\MountPoints2\{eeb59770-45f0-11de-b3d9-00c09fbdca56}\Shell\AutoRun\Command

################## [ Listing des fichiers présent ]

[18/01/2009 22:26|--a------|0] - C:\AUTOEXEC.BAT
[18/01/2009 22:16|---hs----|216] - C:\boot.ini
[02/03/2006 14:00|-rahs----|4952] - C:\Bootfont.bin
[18/01/2009 22:26|--a------|0] - C:\CONFIG.SYS
[04/06/2009 07:54|-r-hs----|103180] - C:\gclwpivc.cmd
[18/01/2009 22:26|-rahs----|0] - C:\IO.SYS
[18/01/2009 22:26|-rahs----|0] - C:\MSDOS.SYS
[02/03/2006 14:00|-rahs----|47564] - C:\NTDETECT.COM
[04/06/2009 08:19|-rahs----|252240] - C:\ntldr
[?|?|?] - C:\pagefile.sys
[03/06/2009 08:51|-r-hs----|105244] - C:\q9.cmd
[01/02/2009 21:56|--a------|275] - C:\Raccourci vers Disque local (F).lnk
[08/06/2009 20:44|--a------|6963] - C:\UsbFix.txt
[25/01/2009 11:16|-r-hs----|108512] - C:\uvsqfgwd.cmd
[18/06/2007 10:40|--a------|0] - E:\AILog.txt
[30/11/2008 16:40|--a------|27648] - E:\article anglais.doc
[13/08/2008 21:03|-rahs----|228] - E:\boot.ini
[05/08/2004 23:00|-rahs----|4952] - E:\Bootfont.bin
[29/10/2008 14:29|--a------|25088] - E:\Brunon Benoit.doc
[14/11/2008 22:16|--a------|26569] - E:\Coca cola.odt
[31/10/2008 19:13|--a------|369829] - E:\Contractualisation dossier.txt
[29/11/2008 19:35|--a------|119296] - E:\Contrats territoriaux de dvlp.doc
[29/11/2008 19:35|--a------|176543] - E:\Contrats territoriaux de d‚veloppement.pdf
[22/11/2008 16:30|--a------|1405263] - E:\cours de marketing le bon.odt
[27/10/2008 19:40|--a------|1733764] - E:\CV (c‚lia beaulaigue).odt
[21/03/2009 17:37|--a------|23584] - E:\CV benoit.odt
[28/12/2008 18:37|--a------|33630] - E:\CV BP.doc
[18/10/2008 11:39|--a------|1747456] - E:\CV c‚lia beaulaigue.doc
[12/07/2006 01:21|--a------|1078394] - E:\DSCF0818.JPG
[21/12/2008 15:18|--a------|36352] - E:\Eco et territoire d‚localisations.doc
[24/12/2008 17:34|--a------|58368] - E:\Eco G‚o.doc
[30/12/2008 23:24|--a------|30078893] - E:\exam macro.pdf
[22/11/2008 19:57|--a------|143360] - E:\expos‚ anglais dvl durable.doc
[07/12/2008 16:26|--a------|118471] - E:\expos‚ anglais dvl durable.odt
[04/06/2009 07:54|-r-hs----|103180] - E:\gclwpivc.cmd
[12/09/2008 10:36|--ahs----|1072279552] - E:\hiberfil.sys
[12/09/2008 10:37|--a------|1669] - E:\hpqp.ini
[01/11/2008 23:53|--a------|352768] - E:\INTRODUCTION AU MARKETING.doc
[18/06/2007 09:37|-rahs----|0] - E:\IO.SYS
[24/12/2008 12:33|--a------|1311232] - E:\Les d‚localisations Maurice Vincent.ppt
[31/10/2008 19:19|--a------|279479] - E:\Les m‚tiers du dvlp territorial.pdf
[27/10/2008 20:08|--a------|26624] - E:\lettre de motivation (C‚lia Beaulaigue).doc
[29/10/2008 13:43|--a------|9728] - E:\Lettre de motivation benoit darty.wps
[25/10/2008 18:15|--a------|28672] - E:\Lettre de motivation CB.wps
[27/10/2008 21:37|--a------|11776] - E:\Lettre de motivation c‚lia beaulaigue.wps
[27/10/2008 21:38|--a------|26624] - E:\LM CB.doc
[04/10/2008 18:49|--a------|13312] - E:\LM stage 2008 2009.wps
[04/10/2008 19:48|--a------|13824] - E:\LM stage CCI.wps
[12/10/2008 13:23|--a------|14336] - E:\LM stage Expansion 42.wps
[12/10/2008 13:23|--a------|16384] - E:\LM stage SECV.wps
[12/10/2008 13:23|--a------|29184] - E:\LM stage SIE.wps
[12/10/2008 13:23|--a------|29184] - E:\LM stage SPTAC.wps
[01/11/2008 17:25|--a------|572928] - E:\M1Eco-2008-2009-Mkg_stratBV.ppt
[24/01/2009 13:41|--a------|236510] - E:\MARKETING.odt
[30/11/2008 17:30|--a------|27648] - E:\Mission stage CG.doc
[30/11/2008 17:40|--a------|11776] - E:\Mission stage CG.wps
[04/01/2009 15:52|--a------|31404] - E:\Mission stage C‚lia Beaulaigue nouvelle version.odt
[18/06/2007 09:37|-rahs----|0] - E:\MSDOS.SYS
[05/08/2004 23:00|-rahs----|47564] - E:\ntdetect.com
[05/08/2004 23:00|-rahs----|251712] - E:\ntldr
[12/09/2008 10:36|--ahs----|1610612736] - E:\pagefile.sys
[07/12/2008 00:16|--a------|894467] - E:\Photo CŠl.jpg
[07/11/2008 23:31|--a------|504766] - E:\photo c‚lia 2.JPG
[07/11/2008 23:28|--a------|511381] - E:\photo c‚lia.JPG
[22/12/2008 15:28|--a------|50688] - E:\plan droit.doc
[13/12/2008 19:47|--a------|32885] - E:\plan expos‚ anglais.odt
[22/12/2008 22:29|--a------|48128] - E:\plan ‚co et territoire.doc
[29/11/2008 18:46|--a------|29696] - E:\Politique contractuelle.doc
[03/06/2009 08:51|-r-hs----|105244] - E:\q9.cmd
[14/07/2008 08:58|--a------|159] - E:\Setup.log
[11/10/2008 14:25|--a------|26112] - E:\SG et HSBC.doc
[01/07/2008 00:21|--ah-----|268] - E:\sqmdata00.sqm
[01/07/2008 00:21|--ah-----|244] - E:\sqmnoopt00.sqm
[13/12/2008 17:01|--a------|24064] - E:\Stage C‚lia.doc
[13/12/2008 16:52|--a------|30720] - E:\STAGE d‚scriptif de la mission.doc
[19/12/2008 21:39|--a------|25088] - E:\STAGE d‚scriptif de la mission2.doc
[13/12/2008 17:00|--a------|24064] - E:\Stage.doc
[23/01/2009 22:10|--a------|700416] - E:\StubInstaller.exe
[13/12/2008 17:21|--a------|28160] - E:\SystŠme d'info.doc
[13/12/2008 19:53|--a------|25010] - E:\traduction dvlp durable.odt
[15/11/2008 14:32|--a------|24576] - E:\traduction le sommeil.doc
[23/01/2009 22:10|--a------|149504] - E:\UNWISE.EXE
[19/05/1999 11:40|--a------|5885] - E:\UNWISE.INI
[25/01/2009 11:16|-r-hs----|108512] - E:\uvsqfgwd.cmd
[21/06/2007 11:09|--a------|128] - E:\winlogon.exe
[12/09/2008 10:37|--a------|44] - E:\XP_TV.ini
[27/07/2001 13:07|---hs----|0] - G:\AUTOEXEC.BAT
[25/01/2009 10:16|-r-hs----|108512] - G:\uvsqfgwd.cmd
[09/01/2002 17:52|---hs----|244] - G:\BOOT.INI
[25/03/2005 05:00|---hs----|298096] - G:\CMLDR
[28/07/2001 05:07|---hs----|0] - G:\CONFIG.SYS
[25/05/2005 01:48|---hs----|102] - G:\Desktop.ini
[17/06/2001 14:31|---hs----|0] - G:\GRAPH
[25/01/2002 07:21|---hs----|0] - G:\GRAPH16
[20/01/2009 23:01|--ahs----|73728] - G:\Info.exe
[28/07/2001 05:07|---hs----|0] - G:\IO.SYS
[28/07/2001 05:07|---hs----|0] - G:\MSDOS.SYS
[25/07/2001 21:00|---hs----|45124] - G:\NTDETECT.COM
[17/08/2001 05:32|---hs----|0] - G:\NTFS
[25/03/2005 05:00|---hs----|298096] - G:\NTLDR
[03/11/2005 06:19|---hs----|181736] - G:\protect.ed
[19/07/2006 14:04|---hs----|36] - G:\SAVEFILE.DIR
[08/02/2002 06:44|---hs----|88038] - G:\Warning.bmp
[25/03/2005 05:00|---hs----|10] - G:\WIN51
[25/03/2005 05:00|---hs----|10] - G:\WIN51IA
[25/03/2005 05:00|---hs----|10] - G:\WIN51IA.SP1
[25/03/2005 05:00|---hs----|167] - G:\WINBOM.INI
[23/05/2001 18:19|---hs----|0] - G:\XGA
[19/07/2006 14:04|---hs----|34] - G:\BLOCK.RIN
[19/07/2006 14:16|---hs----|894] - G:\MASTER.LOG
[19/07/2006 14:05|---hs----|0] - G:\USER
[03/06/2009 08:51|-r-hs----|105244] - G:\q9.cmd
[04/06/2009 07:54|-r-hs----|103180] - G:\gclwpivc.cmd

################## [ Vaccination ]

# C:\autorun.inf ( # Not infected ) -> Folder created by UsbFix.
# E:\autorun.inf ( # Not infected ) -> Folder created by UsbFix.
# G:\autorun.inf ( # Not infected ) -> Folder created by UsbFix.
# H:\autorun.inf ( # Not infected ) -> Folder created by UsbFix.

################## [ ! Fin du rapport # UsbFix V3.029 ! ]