Quelques lenteurs... Résolu/Fermé

Question

Bonjour, 
Je reviens après quelques années sans soucis, vers les experts de l'informatique car mon pc portable Asus commence à patiner à certains moments. Quand ça se produit windows n'arrive pas à lancer le gestionnaire de tâches. En mode sans échec tout se passe bien. J'ai un autre compte utilisateur (PRO) qui lui rame beaucoup. 
Merci d'avance pour votre aide en cette heure tardive. 
J'ai lancé Malaware, il est en cours.

Ma configuration : 
Asus notebook
Intel core i5
2.67Ghz
windows 7 service pack1

voici le rapport hijackthis : 
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 00:36:34, on 24/04/2012
Platform: Unknown Windows (WinNT 6.01.3505 SP1)
MSIE: Internet Explorer v9.00 (9.00.8112.16421)
Boot mode: Normal

Running processes:
C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe
C:\Program Files (x86)\ASUS\ASUS Live Update\ALU.exe
C:\Program Files (x86)\ASUS\SmartLogon\sensorsrv.exe
C:\Windows\AsScrPro.exe
C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe
C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe
C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe
C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
C:\Program Files (x86)\ScanSoft\OmniPageSE4.0\OpWareSE4.exe
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
C:\Program Files (x86)\iTunes\iTunesHelper.exe
C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe
C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbam.exe
C:\Program Files (x86)\ASUS\ControlDeck\ControlDeck.exe
C:\Program Files (x86)\Mozilla Firefox\firefox.exe
C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe
C:\Users\JBMARTIN\Downloads\hijackthis_telechargement_01net.exe
C:\Users\JBMARTIN\AppData\Local\Temp\01net\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?cobrand=asus.msn.com&ocid=ASUDHP&pc=ASU2
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?cobrand=asus.msn.com&ocid=ASUDHP&pc=ASU2
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
F2 - REG:system.ini: UserInit=userinit.exe,
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Windows Live Messenger Companion Helper - {9FDDE16B-836F-4806-AB1F-1455CBEFF289} - C:\Program Files (x86)\Windows Live\Companion\companioncore.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll
O4 - HKLM\..\Run: [UpdateLBPShortCut] "C:\Program Files (x86)\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe" "C:\Program Files (x86)\CyberLink\LabelPrint" UpdateWithCreateOnce "Software\CyberLink\LabelPrint\2.5"
O4 - HKLM\..\Run: [UpdateP2GoShortCut] "C:\Program Files (x86)\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe" "C:\Program Files (x86)\CyberLink\Power2Go" UpdateWithCreateOnce "SOFTWARE\CyberLink\Power2Go\6.0"
O4 - HKLM\..\Run: [Nuance PDF Reader-reminder] "C:\Program Files (x86)\Nuance\PDF Reader\Ereg\Ereg.exe" -r "C:\ProgramData\Nuance\PDF Reader\Ereg\Ereg.ini"
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [ATKMEDIA] C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe
O4 - HKLM\..\Run: [HControlUser] C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe
O4 - HKLM\..\Run: [Wireless Console 3] C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files (x86)\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
O4 - HKLM\..\Run: [OpwareSE4] "C:\Program Files (x86)\ScanSoft\OmniPageSE4.0\OpwareSE4.exe"
O4 - HKLM\..\Run: [BrStsWnd] C:\Program Files (x86)\Brownie\BrstsW64.exe Autorun
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Malwarebytes' Anti-Malware] "C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [uTorrent] "C:\Program Files (x86)\uTorrent\uTorrent.exe"  /MINIMIZED
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'SERVICE RÉSEAU')
O4 - Startup: OpenOffice.org 3.3.lnk = C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe
O4 - Global Startup: AsusVibeLauncher.lnk = C:\Program Files (x86)\ASUS\AsusVibe\AsusVibeLauncher.exe
O4 - Global Startup: SRS Premium Sound.lnk = ?
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\Windows\system32\GPhotos.scr/200
O9 - Extra button: @C:\Program Files (x86)\Windows Live\Companion\companionlang.dll,-600 - {0000036B-C524-4050-81A0-243669A86B9F} - C:\Program Files (x86)\Windows Live\Companion\companioncore.dll
O9 - Extra button: @C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1004 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: @C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1003 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O13 - Gopher Prefix: 
O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab56986.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O18 - Protocol: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: ADSM Service (ADSMService) - ASUSTek Computer Inc. - C:\Program Files (x86)\ASUS\ASUS Data Security Manager\ADSMSrv.exe
O23 - Service: AFBAgent - Unknown owner - C:\Windows\system32\FBAgent.exe (file missing)
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: AMD External Events Utility - Unknown owner - C:\Windows\system32\atiesrxx.exe (file missing)
O23 - Service: Avira AntiVir Planificateur (AntiVirSchedulerService) - Avira GmbH - C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: ASLDR Service (ASLDRService) - ASUS - C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ASLDRSrv.exe
O23 - Service: ATKGFNEX Service (ATKGFNEXSrv) - ASUS - C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files (x86)\Bonjour\mDNSResponder.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Service Google Update (gupdatem) (gupdatem) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files (x86)\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Intel(R) Management and Security Application Local Management Service (LMS) - Intel Corporation - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
O23 - Service: MBAMService - Malwarebytes Corporation - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32
etlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: TurboBoost - Intel(R) Corporation - C:\Program Files\Intel\TurboBoost\TurboBoost.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: Intel(R) Management & Security Application User Notification Service (UNS) - Intel Corporation - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

g3n-h@ckm@n · Accepted Answer

salut je vois que depuis hier soir personne t'a pris en charge lol ^^

il faudrait qu'on fasse un scan plus approfondi car de nos jours hijackthis ne dit plus rien.

===

telecharge et enregistre Pre_Scan sur ton bureau :

http://forums-fec.be/gen-hackman/Pre_Scan.exe
http://general-changelog-team.fr/fr/downloads/viewdownload/41-outils-de-gen-hackman/52-pre-scan

Avertissement :Il y aura une extinction du bureau pendant le scan --> pas de panique.

une fois telechargé lance-le , laisse faire le scan jusqu'à l'apparition de "Pre_scan_la_date_et_l'heure.txt" sur le bureau.

si l'outil est relancé plusieurs fois , il te proposera un menu et qu'aucune option n'est demandée, lance l'option "Kill"

si l'outil est bloqué par l'infection utilise cette version avec extension .pif :

http://forums-fec.be/gen-hackman/Pre_Scan.pif

ou cette version renommée winlogon.exe :

http://forums-fec.be/gen-hackman/winlogon.exe

si l'outil detecte un proxy et que tu n'en as pas installé clique sur "supprimer le proxy"

Il se peut qu'une multitude de fenêtres noires clignotent , laisse-le travailler

Poste Pre_Scan_la_date_et_l'heure.txt qui apparaitra sur le bureau en fin de scan


NE LE POSTE PAS SUR LE FORUM !!! (il est trop long)

Heberge le rapport sur http://pjjoint.malekal.com puis donne le lien obtenu en echange sur le forum où tu te fais aider

haku78 · Answer

Trois fois rien du côté de Malaware. 

J'ai fait du tri dans mon démarrage. 

La défragmentation Windows bloque à 38% dans l'analyse du disque. C'est quoi le meilleur autre que Windows?

merci d'avance.

haku78 · Answer

Merci de te préoccuper de moi. ( de nous en fait car mon pc  je l'utilise en classe avec les élèves) 

J'ai essayé les deux premiers scans mais ça bloque. C'est écrit Réparation du registre et plus rien. 

Je teste winlogon là

g3n-h@ckm@n · Answer

reessaie en mode sans echec sinon

haku78 · Answer

Alors en mode sans échec il s'est lancé mais je n'ai aucun rapport sur le bureau au redémarrage c'est normal?

haku78 · Answer

La session "perso" qui a les droits admin et sous laquelle j'ai lancé le scan a l'air de mieux se porter par contre la session "pro" qui rame excessivement le fait toujours... ça met que l'application Windows a cessé de fonctionner, que je peux l'arrêter ou attendre qu'elle réponde à nouveau....

g3n-h@ckm@n · Answer

tu es bien allé dans ta session en mode sans echec ?

haku78 · Answer

oui et quand je lance le scan dans la section qui bug et bien il n'y a aucune réaction...

g3n-h@ckm@n · Answer

et ben le rapport est sur le bureau de la session où tu l'as lancé

haku78 · Answer

Je suis un boulet mais y a rien sur mon bureau... 
Je vais refaire le scan...

haku78 · Answer

J'ai refait le scan. Le PC redémarre en mode normal et me propose de relancer Pre_scan. Mais si je fais Kill et bien il bloque sur réparation registre...

Voilà où j'en suis.

g3n-h@ckm@n · Answer

retourne dans la session ou tu l'as lancé en mode sans echec et recupère le rapport

haku78 · Answer

Je suis désolé g3n-h@ckm@n y a un truc que je dois louper. 

1- je vais dans ma session perso en mode sans échec je lance le scan
2- à la fin du scan le pc redémarre en mode normal
3- je retourne sur ma session perso, pre_scan demande à se relancer, je lui accorde. 
4- le menu de pre_scan s'ouvre et si je refais kill lancer le scan ça bug sur réparation registre car nous sommes revenu en mode normal.
5- et sur le bureau de cette session je n'ai aucun rapport qui est apparu.

g3n-h@ckm@n · Answer

/!\ ATTENTION SUIVRE A LA LETTRE CES INDICATIONS/!\ __________________________________________________________ >Ce logiciel n'est à utiliser que prescrit par un helper qualifié et formé à l'outil.< >>>>>>>Ne pas utiliser en dehors de ce cas de figure : dangereux!<<<<<<<< ===================================================== ▶ Surtout , pense à l'enregistrement à renommer Combofix en "ton prenom.exe" avant qu'il soit enregistré sur ton disque dur Telecharge ici : Combofix Avant d'utiliser ComboFix : Si tu utilises AVG, IL FAUT IMPERATIVEMENT LE DESINSTALLER avant d'utiliser Combofix car il peut causer des dégâts en interaction avec l'outil pouvant mener à la réinstallation totale du système. La simple désactivation du résident n'est pas suffisante. Télécharge le désinstalleur d'AVG sur ce lien : https://www.avg.com/fr-fr/avg-remover Choisis la version adéquate (32 ou 64 bits)/!\ Les logiciels d'émulation de CD comme Daemon Tools peuvent gêner les outils de désinfection. Utilise Defogger pour les désactiver temporairement : ▶ Télécharge Defogger (de jpshortstuff) sur ton Bureau ▶ Lance le Une fenêtre apparait : clique sur "Disable" ▶ Fais redémarrer l'ordinateur si l'outil te le demande Note : Quand nous aurons terminé la désinfection, tu pourras réactiver ces logiciels en relançant Defogger et en cliquant sur "Re-enable" _________________________________________________________ >> referme les fenêtres de tous les programmes en cours. >> Désactive provisoirement et seulement le temps de l'utilisation de ComboFix, >>la protection en temps réel de ton Antivirus et de tes Antispywares, >>qui peuvent gêner fortement la procédure de recherche et de nettoyage de l'outil. °°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°° si tu as XP => double clique si tu as Vista ou windows 7 => clic droit "executer en tant que...." sur combofix renommé ¤¤¤¤¤¤¤¤¤¤ LAISSE-LE INSTALLER LA CONSOLE DE RECUPERATION S'IL TE LE DEMANDE ¤¤¤¤¤¤¤¤¤¤ ▶ !!!!!NE TOUCHE A RIEN PENDANT LE TRAVAIL DE COMBOFIX (SOURIS/CLAVIER.....)!!!!! ▶ n'oublie pas de reactiver la garde de ton Antivirus et de tes Antispywares, avant de te reconnecter à internet. ▶▶ Reviens sur le forum, et copie et colle la totalité du contenu de C:\Combofix.txt dans ton prochain message. ▶▶▶ Si, après le redémarrage de votre pc par combofix, vous avez des erreurs "Clé marquée pour suppression" ou des soucis de connexion internet, redémarrez à nouveau votre ordinateur

haku78 · Answer

"Reviens sur le forum, et copie et colle la totalité du contenu de C:\Combofix.txt dans ton prochain message. "

Quand j'ai lu ça je me suis dit que le rapport pre_scan pouvait y être et bingo! 

https://pjjoint.malekal.com/files.php?id=20120424_g9v14q13k8x11

encore merci pour ton aide. 

j'attends ton analyse avant de me lancer dans combofix

g3n-h@ckm@n · Answer

desinstalle java update 29

lance combofix

haku78 · Answer

ComboFix 12-04-24.02 - JBMARTIN 25/04/2012   0:32.1.4 - x64
Microsoft Windows 7 Édition Familiale Premium   6.1.7601.1.1252.33.1036.18.3949.2272 [GMT 2:00]
Lancé depuis: c:\users\JBMARTIN\Desktop\jb.exe
AV: AntiVir Desktop *Disabled/Updated* {090F9C29-64CE-6C6F-379C-5901B49A85B7}
SP: AntiVir Desktop *Disabled/Updated* {B26E7DCD-42F4-63E1-0D2C-6273CF1DCF0A}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((   Autres suppressions   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\esupport\eDriver\Software\ASUS\MultiFrame\XP32_Vista32_Vista64_Win7_32_Win7_64_1.0.0021\Desktop_.ini
c:\users\JBMARTIN\AppData\Roaming\Mozilla\Firefox\Profiles\gwqqpvfq.default\weave	oFetch
c:\users\JBMARTIN\AppData\Roaming\Mozilla\Firefox\Profiles\gwqqpvfq.default\weave	oFetch\clients.json
c:\users\JBMARTIN\AppData\Roaming\Mozilla\Firefox\Profiles\gwqqpvfq.default\weave	oFetch	abs.json
.
.
(((((((((((((((((((((((((((((   Fichiers créés du 2012-03-24 au 2012-04-24  ))))))))))))))))))))))))))))))))))))
.
.
2012-04-24 20:23 . 2012-04-13 08:46	8917360	----a-w-	c:\programdata\Microsoft\Windows Defender\Definition Updates\{D3666270-7C0A-4CCA-8DD1-4F38A9C9BBD5}\mpengine.dll
2012-04-24 11:24 . 2012-04-24 16:53	--------	d-----w-	C:\Pre_Scan
2012-04-24 07:57 . 2012-04-24 07:57	--------	d-----w-	c:\users\JBMARTIN\AppData\Roaming\Auslogics
2012-04-24 07:57 . 2012-04-24 07:57	--------	d-----w-	c:\program files (x86)\Auslogics
2012-04-24 06:34 . 2012-04-24 06:34	--------	d-----w-	c:\windows\fr
2012-04-24 06:32 . 2012-04-24 06:32	--------	d-----w-	c:\windows\en
2012-04-24 06:32 . 2012-04-24 06:32	--------	d-----w-	c:\windows\el
2012-04-24 06:31 . 2012-04-24 06:31	--------	d-----w-	c:\windows\es
2012-04-24 06:31 . 2012-04-24 06:31	--------	d-----w-	c:\windows\he
2012-04-24 06:31 . 2012-04-24 06:31	--------	d-----w-	c:\windows\it
2012-04-24 06:31 . 2012-04-24 06:31	--------	d-----w-	c:\windows
l
2012-04-24 06:31 . 2012-04-24 06:31	--------	d-----w-	c:\windows\de
2012-04-24 06:23 . 2012-03-08 16:40	48488	----a-w-	c:\windows\system32\drivers\fssfltr.sys
2012-04-24 06:22 . 2012-04-24 06:22	19352	----a-w-	c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll
2012-04-24 06:08 . 2012-04-24 06:08	537432	----a-w-	c:\program files (x86)\Common Files\Windows Live\.cache\ab35fbc11cd21e001\DXSETUP.exe
2012-04-24 06:08 . 2012-04-24 06:08	15712	----a-w-	c:\program files (x86)\Common Files\Windows Live\.cache\abeae4561cd21e002\MeshBetaRemover.exe
2012-04-24 06:08 . 2012-04-24 06:08	1801048	----a-w-	c:\program files (x86)\Common Files\Windows Live\.cache\ab35fbc11cd21e001\dsetup32.dll
2012-04-24 06:08 . 2012-04-24 06:08	89944	----a-w-	c:\program files (x86)\Common Files\Windows Live\.cache\ab35fbc11cd21e001\DSETUP.dll
2012-04-23 20:26 . 2012-04-04 13:56	24904	----a-w-	c:\windows\system32\drivers\mbam.sys
2012-04-23 16:37 . 2012-04-24 11:11	--------	d-----w-	c:\programdata\Spybot - Search & Destroy
2012-04-23 16:37 . 2012-04-23 20:54	--------	d-----w-	c:\program files (x86)\Spybot - Search & Destroy
2012-04-23 16:34 . 2012-04-23 16:34	--------	d-----w-	c:\users\JBMARTIN\AppData\Roaming\Avira
2012-04-23 16:33 . 2012-04-23 23:15	--------	d-----w-	c:\users\JBMARTIN\AppData\Roaming\GetRightToGo
2012-04-23 16:28 . 2012-04-23 16:28	--------	d-----w-	c:\users\JBMARTIN\AppData\Roaming\Malwarebytes
2012-04-23 16:28 . 2012-04-23 20:26	--------	d-----w-	c:\program files (x86)\Malwarebytes' Anti-Malware
2012-04-23 16:28 . 2012-04-23 16:28	--------	d-----w-	c:\programdata\Malwarebytes
2012-04-21 21:44 . 2012-04-23 23:21	--------	d-----w-	c:\program files (x86)\Iminent
2012-04-14 08:47 . 2012-01-25 06:38	77312	----a-w-	c:\windows\system32dpwsx.dll
2012-04-14 08:47 . 2012-01-25 06:38	149504	----a-w-	c:\windows\system32dpcorekmts.dll
2012-04-14 07:49 . 2012-04-14 07:49	--------	d-----w-	c:\windows\system32\SPReview
2012-04-14 07:47 . 2012-04-14 07:47	--------	d-----w-	c:\windows\system32\EventProviders
2012-04-14 07:39 . 2012-04-14 07:39	8741536	----a-w-	c:\windows\SysWow64\FlashPlayerInstaller.exe
2012-04-13 06:06 . 2012-04-14 07:39	418464	----a-w-	c:\windows\SysWow64\FlashPlayerApp.exe
2012-04-12 17:20 . 2012-02-28 06:49	1390080	----a-w-	c:\windows\system32\wininet.dll
2012-04-12 17:20 . 2012-02-28 01:13	678912	----a-w-	c:\program files (x86)\Internet Explorer\iedvtool.dll
2012-04-12 17:20 . 2012-02-28 06:51	887296	----a-w-	c:\program files\Internet Explorer\iedvtool.dll
2012-04-12 17:20 . 2012-03-06 06:53	5559152	----a-w-	c:\windows\system32
toskrnl.exe
2012-04-12 17:20 . 2012-03-06 05:59	3968368	----a-w-	c:\windows\SysWow64
tkrnlpa.exe
2012-04-12 17:20 . 2012-03-06 05:59	3913072	----a-w-	c:\windows\SysWow64
toskrnl.exe
2012-04-12 17:19 . 2012-03-01 06:46	23408	----a-w-	c:\windows\system32\drivers\fs_rec.sys
2012-04-12 17:19 . 2012-03-01 06:33	81408	----a-w-	c:\windows\system32\imagehlp.dll
2012-04-12 17:19 . 2012-03-01 05:33	159232	----a-w-	c:\windows\SysWow64\imagehlp.dll
2012-04-12 17:19 . 2012-03-01 06:38	220672	----a-w-	c:\windows\system32\wintrust.dll
2012-04-12 17:19 . 2012-03-01 06:28	5120	----a-w-	c:\windows\system32\wmi.dll
2012-04-12 17:19 . 2012-03-01 05:37	172544	----a-w-	c:\windows\SysWow64\wintrust.dll
2012-04-12 17:19 . 2012-03-01 05:29	5120	----a-w-	c:\windows\SysWow64\wmi.dll
2012-04-05 15:43 . 2012-04-05 15:43	--------	d-----w-	c:\users\JBMARTIN\AppData\Local\ASUS
2012-04-04 05:53 . 2012-04-04 05:53	182160	----a-w-	c:\program files (x86)\Internet Explorer\Plugins
ppdf32.dll
.
.
.
((((((((((((((((((((((((((((((((((   Compte-rendu de Find3M   ))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-04-24 19:29 . 2012-01-13 09:52	45056	----a-w-	c:\windows\system32\acovcnt.exe
2012-04-14 08:03 . 2009-07-14 02:36	152576	----a-w-	c:\windows\SysWow64\msclmd.dll
2012-04-14 08:03 . 2009-07-14 02:36	175616	----a-w-	c:\windows\system32\msclmd.dll
2012-04-14 07:39 . 2011-07-26 20:58	70304	----a-w-	c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2012-03-22 19:12 . 2012-03-22 19:12	4435968	----a-w-	c:\windows\SysWow64\GPhotos.scr
2012-03-08 16:50 . 2012-03-08 16:50	49016	----a-w-	c:\windows\SysWow64\sirenacm.dll
2012-03-08 16:37 . 2012-03-08 16:37	302448	----a-w-	c:\windows\WLXPGSS.SCR
2012-02-26 02:13 . 2012-02-26 02:13	86528	----a-w-	c:\windows\SysWow64\iesysprep.dll
2012-02-26 02:13 . 2012-02-26 02:13	76800	----a-w-	c:\windows\SysWow64\SetIEInstalledDate.exe
2012-02-26 02:13 . 2012-02-26 02:13	74752	----a-w-	c:\windows\SysWow64\RegisterIEPKEYs.exe
2012-02-26 02:13 . 2012-02-26 02:13	74752	----a-w-	c:\windows\SysWow64\iesetup.dll
2012-02-26 02:13 . 2012-02-26 02:13	63488	----a-w-	c:\windows\SysWow64	dc.ocx
2012-02-26 02:13 . 2012-02-26 02:13	48640	----a-w-	c:\windows\SysWow64\mshtmler.dll
2012-02-26 02:13 . 2012-02-26 02:13	367104	----a-w-	c:\windows\SysWow64\html.iec
2012-02-26 02:13 . 2012-02-26 02:13	161792	----a-w-	c:\windows\SysWow64\msls31.dll
2012-02-26 02:13 . 2012-02-26 02:13	110592	----a-w-	c:\windows\SysWow64\IEAdvpack.dll
2012-02-26 02:13 . 2012-02-26 02:13	420864	----a-w-	c:\windows\SysWow64\vbscript.dll
2012-02-26 02:13 . 2012-02-26 02:13	35840	----a-w-	c:\windows\SysWow64\imgutil.dll
2012-02-26 02:13 . 2012-02-26 02:13	23552	----a-w-	c:\windows\SysWow64\licmgr10.dll
2012-02-26 02:13 . 2012-02-26 02:13	152064	----a-w-	c:\windows\SysWow64\wextract.exe
2012-02-26 02:13 . 2012-02-26 02:13	150528	----a-w-	c:\windows\SysWow64\iexpress.exe
2012-02-26 02:13 . 2012-02-26 02:13	142848	----a-w-	c:\windows\SysWow64\ieUnatt.exe
2012-02-26 02:13 . 2012-02-26 02:13	11776	----a-w-	c:\windows\SysWow64\mshta.exe
2012-02-26 02:13 . 2012-02-26 02:13	101888	----a-w-	c:\windows\SysWow64\admparse.dll
2012-02-26 02:13 . 2012-02-26 02:13	91648	----a-w-	c:\windows\system32\SetIEInstalledDate.exe
2012-02-26 02:13 . 2012-02-26 02:13	89088	----a-w-	c:\windows\system32\RegisterIEPKEYs.exe
2012-02-26 02:13 . 2012-02-26 02:13	49664	----a-w-	c:\windows\system32\imgutil.dll
2012-02-26 02:13 . 2012-02-26 02:13	48640	----a-w-	c:\windows\system32\mshtmler.dll
2012-02-26 02:13 . 2012-02-26 02:13	222208	----a-w-	c:\windows\system32\msls31.dll
2012-02-26 02:13 . 2012-02-26 02:13	173056	----a-w-	c:\windows\system32\ieUnatt.exe
2012-02-26 02:13 . 2012-02-26 02:13	135168	----a-w-	c:\windows\system32\IEAdvpack.dll
2012-02-26 02:13 . 2012-02-26 02:13	12288	----a-w-	c:\windows\system32\mshta.exe
2012-02-26 02:13 . 2012-02-26 02:13	114176	----a-w-	c:\windows\system32\admparse.dll
2012-02-26 02:13 . 2012-02-26 02:13	111616	----a-w-	c:\windows\system32\iesysprep.dll
2012-02-26 02:13 . 2012-02-26 02:13	85504	----a-w-	c:\windows\system32\iesetup.dll
2012-02-26 02:13 . 2012-02-26 02:13	76800	----a-w-	c:\windows\system32	dc.ocx
2012-02-26 02:13 . 2012-02-26 02:13	603648	----a-w-	c:\windows\system32\vbscript.dll
2012-02-26 02:13 . 2012-02-26 02:13	448512	----a-w-	c:\windows\system32\html.iec
2012-02-26 02:13 . 2012-02-26 02:13	30720	----a-w-	c:\windows\system32\licmgr10.dll
2012-02-26 02:13 . 2012-02-26 02:13	165888	----a-w-	c:\windows\system32\iexpress.exe
2012-02-26 02:13 . 2012-02-26 02:13	160256	----a-w-	c:\windows\system32\wextract.exe
2012-02-23 08:18 . 2011-07-17 09:59	279656	------w-	c:\windows\system32\MpSigStub.exe
2012-02-17 06:38 . 2012-03-14 21:03	1031680	----a-w-	c:\windows\system32dpcore.dll
2012-02-17 05:34 . 2012-03-14 21:03	826880	----a-w-	c:\windows\SysWow64dpcore.dll
2012-02-17 04:58 . 2012-03-14 21:03	210944	----a-w-	c:\windows\system32\driversdpwd.sys
2012-02-17 04:57 . 2012-03-14 21:03	23552	----a-w-	c:\windows\system32\drivers	dtcp.sys
2012-02-10 06:36 . 2012-03-14 21:06	1544192	----a-w-	c:\windows\system32\DWrite.dll
2012-02-10 05:38 . 2012-03-14 21:06	1077248	----a-w-	c:\windows\SysWow64\DWrite.dll
2012-02-03 04:34 . 2012-03-14 21:06	3145728	----a-w-	c:\windows\system32\win32k.sys
2006-05-03 10:06	163328	--sha-r-	c:\windows\SysWOW64\flvDX.dll
2007-02-21 11:47	31232	--sha-r-	c:\windows\SysWOW64\msfDX.dll
2008-03-16 13:30	216064	--sha-r-	c:\windows\SysWOW64
bDX.dll
2010-01-06 22:00	107520	--sha-r-	c:\windows\SysWOW64\TAKDSDecoder.dll
.
.
(((((((((((((((((((((((((((((((((   Points de chargement Reg   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés 
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ADSMOverlayIcon1]
@="{A8D448F4-0431-45AC-9F5E-E1B434AB2249}"
[HKEY_CLASSES_ROOT\CLSID\{A8D448F4-0431-45AC-9F5E-E1B434AB2249}]
2007-06-02 00:08	143360	----a-w-	c:\program files (x86)\ASUS\ASUS Data Security Manager\ShlExt\x86\OverlayIconShlExt1.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"UpdateLBPShortCut"="c:\program files (x86)\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe" [2009-05-20 222504]
"UpdateP2GoShortCut"="c:\program files (x86)\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe" [2009-05-20 222504]
"Nuance PDF Reader-reminder"="c:\program files (x86)\Nuance\PDF Reader\Ereg\Ereg.exe" [2008-11-03 328992]
"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2010-08-12 98304]
"ATKMEDIA"="c:\program files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe" [2010-05-03 170624]
"HControlUser"="c:\program files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe" [2009-06-19 105016]
"Wireless Console 3"="c:\program files (x86)\ASUS\Wireless Console 3\wcourier.exe" [2010-07-02 1597440]
"avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2011-02-04 281768]
"SSBkgdUpdate"="c:\program files (x86)\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2006-09-28 185896]
"OpwareSE4"="c:\program files (x86)\ScanSoft\OmniPageSE4.0\OpwareSE4.exe" [2006-10-11 75304]
"BrStsWnd"="c:\program files (x86)\Brownie\BrstsW64.exe" [2009-08-19 3695928]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-03 843712]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2011-06-09 254696]
"Malwarebytes' Anti-Malware"="c:\program files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" [2012-04-04 462408]
.
c:\users\PRO\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OpenOffice.org 3.3.lnk - c:\program files (x86)\OpenOffice.org 3\program\quickstart.exe [2010-12-13 1198592]
.
c:\users\JBMARTIN\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OpenOffice.org 3.3.lnk - c:\program files (x86)\OpenOffice.org 3\program\quickstart.exe [2010-12-13 1198592]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
AsusVibeLauncher.lnk - c:\program files (x86)\ASUS\AsusVibe\AsusVibeLauncher.exe [2011-1-12 548528]
SRS Premium Sound.lnk - c:\windows\Installer\{E5CF6B9C-3ABE-43C9-9413-AD5FFC98F049}\NewShortcut5_21C7B668029A47458B27645FE6E4A715.exe [2011-6-9 156952]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
"EnablELUA"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages	REG_MULTI_SZ   	kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sr.sys]
@="FSFilter System Recovery"
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 gupdate;Google Update Service (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-01-12 135664]
R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-14 253088]
R3 gupdatem;Service Google Update (gupdatem);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-01-12 135664]
R3 SiSGbeLH;SiS191/SiS190 Ethernet Device NDIS 6.0 Driver;c:\windows\system32\DRIVERS\SiSG664.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers	susbflt.sys [x]
R3 TurboBoost;TurboBoost;c:\program files\Intel\TurboBoost\TurboBoost.exe [2009-08-06 118672]
R3 WatAdminSvc;Service Windows Activation Technologies;c:\windows\system32\Wat\WatAdminSvc.exe [x]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-23 57184]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x]
S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2012-04-04 63928]
S2 AFBAgent;AFBAgent;c:\windows\system32\FBAgent.exe [x]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [x]
S2 AntiVirSchedulerService;Avira AntiVir Planificateur;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe [2011-07-26 136360]
S2 ASMMAP64;ASMMAP64;c:\program files (x86)\ASUS\ATK Package\ATKGFNEX\ASMMAP64.sys [2009-07-03 15416]
S2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2012-04-04 654408]
S2 TurboB;Turbo Boost UI Monitor driver;c:\windows\system32\DRIVERS\TurboB.sys [x]
S2 UNS;Intel(R) Management & Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2009-10-01 2314240]
S3 amdkmdag;amdkmdag;c:\windows\system32\DRIVERS\atikmdag.sys [x]
S3 amdkmdap;amdkmdap;c:\windows\system32\DRIVERS\atikmpag.sys [x]
S3 AtiHDAudioService;ATI Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW76.sys [x]
S3 ETD;ELAN PS/2 Port Input Device;c:\windows\system32\DRIVERS\ETD.sys [x]
S3 HECIx64;Intel(R) Management Engine Interface;c:\windows\system32\DRIVERS\HECIx64.sys [x]
S3 Impcd;Impcd;c:\windows\system32\DRIVERS\Impcd.sys [x]
S3 JMCR;JMCR;c:\windows\system32\DRIVERS\jmcr.sys [x]
S3 JME;JMicron Ethernet Adapter NDIS6.20 Driver (Amd64 Bits);c:\windows\system32\DRIVERS\JME.sys [x]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [x]
.
.
Contenu du dossier 'Tâches planifiées'
.
2012-04-24 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-13 07:39]
.
2012-04-24 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-01-12 15:50]
.
2012-04-24 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-01-12 15:50]
.
.
--------- x86-64 -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ADSMOverlayIcon1]
@="{A8D448F4-0431-45AC-9F5E-E1B434AB2249}"
[HKEY_CLASSES_ROOT\CLSID\{A8D448F4-0431-45AC-9F5E-E1B434AB2249}]
2007-06-01 23:52	159744	----a-w-	c:\program files (x86)\ASUS\ASUS Data Security Manager\ShlExt\x64\OverlayIconShlExt1_64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\AsusWSShellExt_B]
@="{6D4133E5-0742-4ADC-8A8C-9303440F7190}"
[HKEY_CLASSES_ROOT\CLSID\{6D4133E5-0742-4ADC-8A8C-9303440F7190}]
2009-11-26 05:49	70656	----a-w-	c:\program files (x86)\ASUS\ASUS WebStorage\SERVICE\AsusWSShellExt64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\AsusWSShellExt_O]
@="{64174815-8D98-4CE6-8646-4C039977D808}"
[HKEY_CLASSES_ROOT\CLSID\{64174815-8D98-4CE6-8646-4C039977D808}]
2009-11-26 05:49	70656	----a-w-	c:\program files (x86)\ASUS\ASUS WebStorage\SERVICE\AsusWSShellExt64.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ASUS WebStorage"="c:\program files (x86)\ASUS\ASUS WebStorage\SERVICE\AsusWSService.exe" [2010-03-16 1754448]
"SmartAudio"="c:\program files\CONEXANT\SAII\SAIICpl.exe" [2010-12-14 316032]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"LoadAppInit_DLLs"=0x0
.
------- Examen supplémentaire -------
.
uLocal Page = c:\windows\SysWOW64\blank.htm
uStart Page = hxxp://www.google.com/
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = *.local
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
TCP: DhcpNameServer = 212.27.40.240 212.27.40.241
FF - ProfilePath - c:\users\JBMARTIN\AppData\Roaming\Mozilla\Firefox\Profiles\gwqqpvfq.default\
FF - prefs.js: browser.search.selectedEngine - 
FF - prefs.js: keyword.URL - hxxp://www.google.com/search?q= 
.
- - - - ORPHELINS SUPPRIMES - - - -
.
Toolbar-Locked - (no file)
SafeBoot-dmboot.sys
SafeBoot-dmio.sys
SafeBoot-dmload.sys
SafeBoot-dmadmin
SafeBoot-dmserver
SafeBoot-SRService
Toolbar-Locked - (no file)
HKLM-Run-ETDWare - c:\program files (x86)\Elantech\ETDCtrl.exe
AddRemove-K_Series_ScreenSaver_EN - c:\windows\system32\K_Series_ScreenSaver_EN.scr
.
.
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\Windows\system32\Macromed\Flash\FlashUtil10d.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\LocalServer32]
@="c:\Windows\SysWow64\Macromed\Flash\FlashUtil10d.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\Windows\SysWow64\Macromed\Flash\Flash10d.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.10"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\Windows\SysWow64\Macromed\Flash\Flash10d.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\Windows\SysWow64\Macromed\Flash\Flash10d.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\Windows\SysWow64\Macromed\Flash\Flash10d.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}]
@Denied: (A 2) (Everyone)
@="IFlashBroker3"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Heure de fin: 2012-04-25  00:50:33
ComboFix-quarantined-files.txt  2012-04-24 22:50
.
Avant-CF: 63 592 202 240 octets libres
Après-CF: 63 333 982 208 octets libres
.
- - End Of File - - FF54BFC10B4F7B3E343FB9E70E81CCB1

g3n-h@ckm@n · Answer

__________________________________________________ =>/!\Le script qui suit a été écrit spécialement cet ordinateur/!\ <= =>il est fort déconseillé de le transposer sur un autre ordinateur !<= ---------------------------------------------------------------------------- Toujours avec toutes les protections désactivées, fais ceci : ▶ Ouvre le bloc-notes (Menu démarrer --> programmes --> accessoires --> bloc-notes) ▶ Copie/colle dans le bloc-notes ce qui entre les lignes ci dessous (sans les lignes) : ---------------------------------------------------------- KillAll:: ClearJavaCache:: File:: c:\windows\system32\acovcnt.exe Folder:: c:\programdata\Spybot - Search & Destroy c:\program files (x86)\Spybot - Search & Destroy c:\program files (x86)\Iminent Registry:: [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] "SSBkgdUpdate"=- RegLock:: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}] [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\Elevation] [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\LocalServer32] [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\TypeLib] [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}] [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32] [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus] [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID] [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib] [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version] [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}] [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32] [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID] [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib] [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version] [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}] [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\ProxyStubClsid32] [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\TypeLib] [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security] ------------------------------------------------------------------ ▶ Enregistre ce fichier sur ton Bureau (et pas ailleurs !) sous le nom CFScript.txt ▶ Quitte le Bloc Notes ▶ Fais un glisser/déposer de ce fichier CFScript sur le fichier combofix comme sur cette : illustration ▶ Patiente le temps du scan. Le Bureau va disparaître à plusieurs reprises : c'est normal ! Ne touche à rien tant que le scan n'est pas terminé. ▶ Une fois le scan achevé, un rapport va s'afficher: poste son contenu. ▶ Si le fichier ne s'ouvre pas, il se trouve ici => C:\ComboFix.txt

haku78 · Answer

ComboFix 12-04-24.02 - JBMARTIN 25/04/2012   8:21.2.4 - x64
Microsoft Windows 7 Édition Familiale Premium   6.1.7601.1.1252.33.1036.18.3949.2458 [GMT 2:00]
Lancé depuis: c:\users\JBMARTIN\Desktop\jb.exe
Commutateurs utilisés :: c:\users\JBMARTIN\Desktop\CFScript.txt
AV: AntiVir Desktop *Disabled/Updated* {090F9C29-64CE-6C6F-379C-5901B49A85B7}
SP: AntiVir Desktop *Disabled/Updated* {B26E7DCD-42F4-63E1-0D2C-6273CF1DCF0A}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
FILE ::
"c:\windows\system32\acovcnt.exe"
.
.
((((((((((((((((((((((((((((((((((((   Autres suppressions   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\program files (x86)\Iminent
c:\program files (x86)\Iminent\Iminent.InstallLog
c:\program files (x86)\Spybot - Search & Destroy
c:\program files (x86)\Spybot - Search & Destroy\advcheck.dll
c:\program files (x86)\Spybot - Search & Destroy\aports.dll
c:\program files (x86)\Spybot - Search & Destroy\blindman.exe
c:\program files (x86)\Spybot - Search & Destroy\Default configuration.ini
c:\program files (x86)\Spybot - Search & Destroy\DelZip179.dll
c:\program files (x86)\Spybot - Search & Destroy\Dummies\dummy.cd_clint.dll
c:\program files (x86)\Spybot - Search & Destroy\Dummies\dummy.dap.gif
c:\program files (x86)\Spybot - Search & Destroy\Dummies\dummy.data.xml
c:\program files (x86)\Spybot - Search & Destroy\Dummies\dummy.default.gif
c:\program files (x86)\Spybot - Search & Destroy\Dummies\dummy.related.htm
c:\program files (x86)\Spybot - Search & Destroy\Help\Brasil.license.txt
c:\program files (x86)\Spybot - Search & Destroy\Help\Cesky.license.txt
c:\program files (x86)\Spybot - Search & Destroy\Help\Deutsch.license.txt
c:\program files (x86)\Spybot - Search & Destroy\Help\English.chm
c:\program files (x86)\Spybot - Search & Destroy\Help\English.license.txt
c:\program files (x86)\Spybot - Search & Destroy\Help\Espanol.license.txt
c:\program files (x86)\Spybot - Search & Destroy\Help\Francais.license.txt
c:\program files (x86)\Spybot - Search & Destroy\Help\Hellenic.license.txt
c:\program files (x86)\Spybot - Search & Destroy\Help\Italiano.license.txt
c:\program files (x86)\Spybot - Search & Destroy\Help\Japanese.license.ansi.txt
c:\program files (x86)\Spybot - Search & Destroy\Help\Japanese.license.txt
c:\program files (x86)\Spybot - Search & Destroy\Help\Korean.license.txt
c:\program files (x86)\Spybot - Search & Destroy\Help\Nederlands.license.txt
c:\program files (x86)\Spybot - Search & Destroy\Help\Polski.license.txt
c:\program files (x86)\Spybot - Search & Destroy\Help\Russkiy.license.txt
c:\program files (x86)\Spybot - Search & Destroy\Help\Slovensky.license.txt
c:\program files (x86)\Spybot - Search & Destroy\Help\Srpski.license.txt
c:\program files (x86)\Spybot - Search & Destroy\Help\Suomi.license.txt
c:\program files (x86)\Spybot - Search & Destroy\Includes\Adware.sbi
c:\program files (x86)\Spybot - Search & Destroy\Includes\AdwareC.sbi
c:\program files (x86)\Spybot - Search & Destroy\Includes\Browserpages.sbs
c:\program files (x86)\Spybot - Search & Destroy\Includes\CLSIDs.sbs
c:\program files (x86)\Spybot - Search & Destroy\Includes\Cookies.sbi
c:\program files (x86)\Spybot - Search & Destroy\Includes\Cookies.sbs
c:\program files (x86)\Spybot - Search & Destroy\Includes\Dialer.sbi
c:\program files (x86)\Spybot - Search & Destroy\Includes\Dialer.sbs
c:\program files (x86)\Spybot - Search & Destroy\Includes\DialerC.sbi
c:\program files (x86)\Spybot - Search & Destroy\Includes\Domains.sbs
c:\program files (x86)\Spybot - Search & Destroy\Includes\HeavyDuty.sbi
c:\program files (x86)\Spybot - Search & Destroy\Includes\Hijackers.sbi
c:\program files (x86)\Spybot - Search & Destroy\Includes\HijackersC.sbi
c:\program files (x86)\Spybot - Search & Destroy\Includes\iPhone.sbi
c:\program files (x86)\Spybot - Search & Destroy\Includes\Keyloggers.sbi
c:\program files (x86)\Spybot - Search & Destroy\Includes\KeyloggersC.sbi
c:\program files (x86)\Spybot - Search & Destroy\Includes\Logs.uts
c:\program files (x86)\Spybot - Search & Destroy\Includes\LSP.sbi
c:\program files (x86)\Spybot - Search & Destroy\Includes\LSP.sbs
c:\program files (x86)\Spybot - Search & Destroy\Includes\Malware.sbi
c:\program files (x86)\Spybot - Search & Destroy\Includes\MalwareC.sbi
c:\program files (x86)\Spybot - Search & Destroy\Includes\OperaPlugins.sbs
c:\program files (x86)\Spybot - Search & Destroy\Includes\ProcWatch.sbs
c:\program files (x86)\Spybot - Search & Destroy\Includes\PUPS.sbi
c:\program files (x86)\Spybot - Search & Destroy\Includes\PUPSC.sbi
c:\program files (x86)\Spybot - Search & Destroy\Includes\RegWatch.sbs
c:\program files (x86)\Spybot - Search & Destroy\Includes\RegXLinks.sbs
c:\program files (x86)\Spybot - Search & Destroy\Includes\Revision.sbi
c:\program files (x86)\Spybot - Search & Destroy\Includes\Revision.sbs
c:\program files (x86)\Spybot - Search & Destroy\Includes\Searchpages.sbs
c:\program files (x86)\Spybot - Search & Destroy\Includes\Security.sbi
c:\program files (x86)\Spybot - Search & Destroy\Includes\SecurityC.sbi
c:\program files (x86)\Spybot - Search & Destroy\Includes\Services.sbs
c:\program files (x86)\Spybot - Search & Destroy\Includes\Spybots.sbi
c:\program files (x86)\Spybot - Search & Destroy\Includes\SpybotsC.sbi
c:\program files (x86)\Spybot - Search & Destroy\Includes\Spyware.sbi
c:\program files (x86)\Spybot - Search & Destroy\Includes\SpywareC.sbi
c:\program files (x86)\Spybot - Search & Destroy\Includes\Startup.tnfo
c:\program files (x86)\Spybot - Search & Destroy\Includes\Targets.nfo
c:\program files (x86)\Spybot - Search & Destroy\Includes\Tracks.uti
c:\program files (x86)\Spybot - Search & Destroy\Includes\Trojans.sbi
c:\program files (x86)\Spybot - Search & Destroy\Includes\TrojansC-02.sbi
c:\program files (x86)\Spybot - Search & Destroy\Includes\TrojansC-03.sbi
c:\program files (x86)\Spybot - Search & Destroy\Includes\TrojansC-04.sbi
c:\program files (x86)\Spybot - Search & Destroy\Includes\TrojansC-05.sbi
c:\program files (x86)\Spybot - Search & Destroy\Includes\TrojansC.sbi
c:\program files (x86)\Spybot - Search & Destroy\Includes\TTLASSH.sbs
c:\program files (x86)\Spybot - Search & Destroy\Includes\URL-Blacklist.sbs
c:\program files (x86)\Spybot - Search & Destroy\Includes\X509White.sbs
c:\program files (x86)\Spybot - Search & Destroy\Languages\Afrikaans.sbl
c:\program files (x86)\Spybot - Search & Destroy\Languages\Arabic.sbl
c:\program files (x86)\Spybot - Search & Destroy\Languages\Azeri.sbl
c:\program files (x86)\Spybot - Search & Destroy\Languages\Bahasa Indonesia.sbl
c:\program files (x86)\Spybot - Search & Destroy\Languages\Belarusskiy.sbl
c:\program files (x86)\Spybot - Search & Destroy\Languages\Bosanski.sbl
c:\program files (x86)\Spybot - Search & Destroy\Languages\Brasil.sbl
c:\program files (x86)\Spybot - Search & Destroy\Languages\Bulgarski.sbl
c:\program files (x86)\Spybot - Search & Destroy\Languages\Catalan.sbl
c:\program files (x86)\Spybot - Search & Destroy\Languages\Cesky.sbl
c:\program files (x86)\Spybot - Search & Destroy\Languages\Chinese (simplified).sbl
c:\program files (x86)\Spybot - Search & Destroy\Languages\Chinese (traditional).sbl
c:\program files (x86)\Spybot - Search & Destroy\Languages\Dansk.sbl
c:\program files (x86)\Spybot - Search & Destroy\Languages\Deutsch.sbl
c:\program files (x86)\Spybot - Search & Destroy\Languages\Eesti.sbl
c:\program files (x86)\Spybot - Search & Destroy\Languages\English.sbl
c:\program files (x86)\Spybot - Search & Destroy\Languages\Espanol.sbl
c:\program files (x86)\Spybot - Search & Destroy\Languages\Esperanto.sbl
c:\program files (x86)\Spybot - Search & Destroy\Languages\Euskera.sbl
c:\program files (x86)\Spybot - Search & Destroy\Languages\Farsi.sbl
c:\program files (x86)\Spybot - Search & Destroy\Languages\Francais.sbl
c:\program files (x86)\Spybot - Search & Destroy\Languages\Furlan.sbl
c:\program files (x86)\Spybot - Search & Destroy\Languages\Galego.sbl
c:\program files (x86)\Spybot - Search & Destroy\Languages\Hebrew.sbl
c:\program files (x86)\Spybot - Search & Destroy\Languages\Hellenic.sbl
c:\program files (x86)\Spybot - Search & Destroy\Languages\Hindi.sbl
c:\program files (x86)\Spybot - Search & Destroy\Languages\Hrvatski.sbl
c:\program files (x86)\Spybot - Search & Destroy\Languages\Islenska.sbl
c:\program files (x86)\Spybot - Search & Destroy\Languages\Italiano.sbl
c:\program files (x86)\Spybot - Search & Destroy\Languages\Japanese.sbl
c:\program files (x86)\Spybot - Search & Destroy\Languages\Korean.sbl
c:\program files (x86)\Spybot - Search & Destroy\Languages\Latvian.sbl
c:\program files (x86)\Spybot - Search & Destroy\Languages\Letzebuergesch.sbl
c:\program files (x86)\Spybot - Search & Destroy\Languages\Lietuviu.sbl
c:\program files (x86)\Spybot - Search & Destroy\Languages\Magyar.sbl
c:\program files (x86)\Spybot - Search & Destroy\Languages\Makedonski.sbl
c:\program files (x86)\Spybot - Search & Destroy\Languages\Melayu.sbl
c:\program files (x86)\Spybot - Search & Destroy\Languages\Nederlands.sbl
c:\program files (x86)\Spybot - Search & Destroy\Languages\Norsk.sbl
c:\program files (x86)\Spybot - Search & Destroy\Languages\Polski.sbl
c:\program files (x86)\Spybot - Search & Destroy\Languages\Portugues.sbl
c:\program files (x86)\Spybot - Search & Destroy\Languages\Romaneste.sbl
c:\program files (x86)\Spybot - Search & Destroy\Languages\Russkiy.sbl
c:\program files (x86)\Spybot - Search & Destroy\Languages\Shqip.sbl
c:\program files (x86)\Spybot - Search & Destroy\Languages\Slovenscina.sbl
c:\program files (x86)\Spybot - Search & Destroy\Languages\Slovensky.sbl
c:\program files (x86)\Spybot - Search & Destroy\Languages\Srpski.sbl
c:\program files (x86)\Spybot - Search & Destroy\Languages\Suomi.sbl
c:\program files (x86)\Spybot - Search & Destroy\Languages\Svenska.sbl
c:\program files (x86)\Spybot - Search & Destroy\Languages\Thai.sbl
c:\program files (x86)\Spybot - Search & Destroy\Languages\Turkce.sbl
c:\program files (x86)\Spybot - Search & Destroy\Languages\Ukrainian.sbl
c:\program files (x86)\Spybot - Search & Destroy\Languages\Uzbek.sbl
c:\program files (x86)\Spybot - Search & Destroy\messages.zres
c:\program files (x86)\Spybot - Search & Destroy\OptOut.ini
c:\program files (x86)\Spybot - Search & Destroy\Plugins\Chai.dll
c:\program files (x86)\Spybot - Search & Destroy\Plugins\Fennel.dll
c:\program files (x86)\Spybot - Search & Destroy\Plugins\Mate.dll
c:\program files (x86)\Spybot - Search & Destroy\Plugins\TCPIPAddress.dll
c:\program files (x86)\Spybot - Search & Destroy\QDTNDRIKZC.scr
c:\program files (x86)\Spybot - Search & Destroy\REVNOVFRDBA.scr
c:\program files (x86)\Spybot - Search & Destroy\SDFiles.exe
c:\program files (x86)\Spybot - Search & Destroy\SDHelper.dll
c:\program files (x86)\Spybot - Search & Destroy\SDMain.exe
c:\program files (x86)\Spybot - Search & Destroy\SDShred.exe
c:\program files (x86)\Spybot - Search & Destroy\SDUpdate.exe
c:\program files (x86)\Spybot - Search & Destroy\SDWinSec.exe
c:\program files (x86)\Spybot - Search & Destroy\Skins\Colorblind.ini
c:\program files (x86)\Spybot - Search & Destroy\Skins\Italia.ini
c:\program files (x86)\Spybot - Search & Destroy\Skins\Italia.jpg
c:\program files (x86)\Spybot - Search & Destroy\Skins\Peace.ini
c:\program files (x86)\Spybot - Search & Destroy\Skins\Peace.jpg
c:\program files (x86)\Spybot - Search & Destroy\SpybotSD.exe
c:\program files (x86)\Spybot - Search & Destroy\sqlite3.dll
c:\program files (x86)\Spybot - Search & Destroy\TeaTimer.exe
c:\program files (x86)\Spybot - Search & Destroy\Tools.dll
c:\program files (x86)\Spybot - Search & Destroy\unins000.dat
c:\program files (x86)\Spybot - Search & Destroy\unins000.exe
c:\program files (x86)\Spybot - Search & Destroy\unins000.msg
c:\program files (x86)\Spybot - Search & Destroy\UninsSrv.dll
c:\program files (x86)\Spybot - Search & Destroy\Update.exe
c:\program files (x86)\Spybot - Search & Destroy\Updates\advcheck165.exe
c:\program files (x86)\Spybot - Search & Destroy\Updates\advcheck165.zip
c:\program files (x86)\Spybot - Search & Destroy\Updates\clsid.zip
c:\program files (x86)\Spybot - Search & Destroy\Updates\downloaded.ini
c:\program files (x86)\Spybot - Search & Destroy\Updates\online.ini
c:\program files (x86)\Spybot - Search & Destroy\Updates\online.ini.uiz
c:\program files (x86)\Spybot - Search & Destroy\Updates	eatimer166.exe
c:\program files (x86)\Spybot - Search & Destroy\Updates	eatimer166.zip
c:\program files (x86)\Spybot - Search & Destroy\WDPVEAP.scr
c:\program files (x86)\Spybot - Search & Destroy\WHNYLR.scr
c:\programdata\Spybot - Search & Destroy
c:\programdata\Spybot - Search & Destroy\Configuration.ini
c:\programdata\Spybot - Search & Destroy\Excludes\Bots.sbe
c:\programdata\Spybot - Search & Destroy\Excludes\Cookies.sbe
c:\programdata\Spybot - Search & Destroy\Excludes\FileExt.sbe
c:\programdata\Spybot - Search & Destroy\Excludes\Links.sbe
c:\programdata\Spybot - Search & Destroy\Excludes\Single.sbe
c:\programdata\Spybot - Search & Destroy\Excludes\SystemInternals.sbe
c:\programdata\Spybot - Search & Destroy\Excludes\UpdateDL.sbe
c:\programdata\Spybot - Search & Destroy\Excludes\WaitFor.sbe
c:\programdata\Spybot - Search & Destroy\Immunization.ini
c:\programdata\Spybot - Search & Destroy\Recovery\BabylonToolbar.zip
c:\programdata\Spybot - Search & Destroy\Recovery\BabylonToolbar1.zip
c:\programdata\Spybot - Search & Destroy\Recovery\BabylonToolbar10.zip
c:\programdata\Spybot - Search & Destroy\Recovery\BabylonToolbar11.zip
c:\programdata\Spybot - Search & Destroy\Recovery\BabylonToolbar12.zip
c:\programdata\Spybot - Search & Destroy\Recovery\BabylonToolbar13.zip
c:\programdata\Spybot - Search & Destroy\Recovery\BabylonToolbar14.zip
c:\programdata\Spybot - Search & Destroy\Recovery\BabylonToolbar15.zip
c:\programdata\Spybot - Search & Destroy\Recovery\BabylonToolbar16.zip
c:\programdata\Spybot - Search & Destroy\Recovery\BabylonToolbar17.zip
c:\programdata\Spybot - Search & Destroy\Recovery\BabylonToolbar18.zip
c:\programdata\Spybot - Search & Destroy\Recovery\BabylonToolbar19.zip
c:\programdata\Spybot - Search & Destroy\Recovery\BabylonToolbar2.zip
c:\programdata\Spybot - Search & Destroy\Recovery\BabylonToolbar20.zip
c:\programdata\Spybot - Search & Destroy\Recovery\BabylonToolbar21.zip
c:\programdata\Spybot - Search & Destroy\Recovery\BabylonToolbar22.zip
c:\programdata\Spybot - Search & Destroy\Recovery\BabylonToolbar23.zip
c:\programdata\Spybot - Search & Destroy\Recovery\BabylonToolbar24.zip
c:\programdata\Spybot - Search & Destroy\Recovery\BabylonToolbar25.zip
c:\programdata\Spybot - Search & Destroy\Recovery\BabylonToolbar26.zip
c:\programdata\Spybot - Search & Destroy\Recovery\BabylonToolbar27.zip
c:\programdata\Spybot - Search & Destroy\Recovery\BabylonToolbar3.zip
c:\programdata\Spybot - Search & Destroy\Recovery\BabylonToolbar4.zip
c:\programdata\Spybot - Search & Destroy\Recovery\BabylonToolbar5.zip
c:\programdata\Spybot - Search & Destroy\Recovery\BabylonToolbar6.zip
c:\programdata\Spybot - Search & Destroy\Recovery\BabylonToolbar7.zip
c:\programdata\Spybot - Search & Destroy\Recovery\BabylonToolbar8.zip
c:\programdata\Spybot - Search & Destroy\Recovery\BabylonToolbar9.zip
c:\windows\system32\acovcnt.exe
.
Une copie infectée de c:\windows\SysWow64\userinit.exe a été trouvée et désinfectée 
Copie restaurée à partir de - c:\windows\ERDNT\cache86\userinit.exe 
.
.
(((((((((((((((((((((((((((((   Fichiers créés du 2012-03-25 au 2012-04-25  ))))))))))))))))))))))))))))))))))))
.
.
2012-04-25 11:08 . 2012-04-25 11:08	--------	d-----w-	c:\users\PRO\AppData\Local	emp
2012-04-25 11:08 . 2012-04-25 11:08	--------	d-----w-	c:\users\Default\AppData\Local	emp
2012-04-24 22:38 . 2012-04-24 22:38	69000	----a-w-	c:\programdata\Microsoft\Windows Defender\Definition Updates\{D3666270-7C0A-4CCA-8DD1-4F38A9C9BBD5}\offreg.dll
2012-04-24 20:23 . 2012-04-13 08:46	8917360	----a-w-	c:\programdata\Microsoft\Windows Defender\Definition Updates\{D3666270-7C0A-4CCA-8DD1-4F38A9C9BBD5}\mpengine.dll
2012-04-24 11:24 . 2012-04-24 16:53	--------	d-----w-	C:\Pre_Scan
2012-04-24 07:57 . 2012-04-24 07:57	--------	d-----w-	c:\users\JBMARTIN\AppData\Roaming\Auslogics
2012-04-24 07:57 . 2012-04-24 07:57	--------	d-----w-	c:\program files (x86)\Auslogics
2012-04-24 06:34 . 2012-04-24 06:34	--------	d-----w-	c:\windows\fr
2012-04-24 06:32 . 2012-04-24 06:32	--------	d-----w-	c:\windows\en
2012-04-24 06:32 . 2012-04-24 06:32	--------	d-----w-	c:\windows\el
2012-04-24 06:31 . 2012-04-24 06:31	--------	d-----w-	c:\windows\es
2012-04-24 06:31 . 2012-04-24 06:31	--------	d-----w-	c:\windows\he
2012-04-24 06:31 . 2012-04-24 06:31	--------	d-----w-	c:\windows\it
2012-04-24 06:31 . 2012-04-24 06:31	--------	d-----w-	c:\windows
l
2012-04-24 06:31 . 2012-04-24 06:31	--------	d-----w-	c:\windows\de
2012-04-24 06:23 . 2012-03-08 16:40	48488	----a-w-	c:\windows\system32\drivers\fssfltr.sys
2012-04-24 06:22 . 2012-04-24 06:22	19352	----a-w-	c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll
2012-04-24 06:08 . 2012-04-24 06:08	537432	----a-w-	c:\program files (x86)\Common Files\Windows Live\.cache\ab35fbc11cd21e001\DXSETUP.exe
2012-04-24 06:08 . 2012-04-24 06:08	15712	----a-w-	c:\program files (x86)\Common Files\Windows Live\.cache\abeae4561cd21e002\MeshBetaRemover.exe
2012-04-24 06:08 . 2012-04-24 06:08	1801048	----a-w-	c:\program files (x86)\Common Files\Windows Live\.cache\ab35fbc11cd21e001\dsetup32.dll
2012-04-24 06:08 . 2012-04-24 06:08	89944	----a-w-	c:\program files (x86)\Common Files\Windows Live\.cache\ab35fbc11cd21e001\DSETUP.dll
2012-04-23 20:26 . 2012-04-04 13:56	24904	----a-w-	c:\windows\system32\drivers\mbam.sys
2012-04-23 16:34 . 2012-04-23 16:34	--------	d-----w-	c:\users\JBMARTIN\AppData\Roaming\Avira
2012-04-23 16:33 . 2012-04-23 23:15	--------	d-----w-	c:\users\JBMARTIN\AppData\Roaming\GetRightToGo
2012-04-23 16:28 . 2012-04-23 16:28	--------	d-----w-	c:\users\JBMARTIN\AppData\Roaming\Malwarebytes
2012-04-23 16:28 . 2012-04-23 20:26	--------	d-----w-	c:\program files (x86)\Malwarebytes' Anti-Malware
2012-04-23 16:28 . 2012-04-23 16:28	--------	d-----w-	c:\programdata\Malwarebytes
2012-04-14 08:47 . 2012-01-25 06:38	77312	----a-w-	c:\windows\system32dpwsx.dll
2012-04-14 08:47 . 2012-01-25 06:38	149504	----a-w-	c:\windows\system32dpcorekmts.dll
2012-04-14 07:49 . 2012-04-14 07:49	--------	d-----w-	c:\windows\system32\SPReview
2012-04-14 07:47 . 2012-04-14 07:47	--------	d-----w-	c:\windows\system32\EventProviders
2012-04-14 07:39 . 2012-04-14 07:39	8741536	----a-w-	c:\windows\SysWow64\FlashPlayerInstaller.exe
2012-04-13 06:06 . 2012-04-14 07:39	418464	----a-w-	c:\windows\SysWow64\FlashPlayerApp.exe
2012-04-12 17:20 . 2012-02-28 06:49	1390080	----a-w-	c:\windows\system32\wininet.dll
2012-04-12 17:20 . 2012-02-28 01:13	678912	----a-w-	c:\program files (x86)\Internet Explorer\iedvtool.dll
2012-04-12 17:20 . 2012-02-28 06:51	887296	----a-w-	c:\program files\Internet Explorer\iedvtool.dll
2012-04-12 17:20 . 2012-03-06 06:53	5559152	----a-w-	c:\windows\system32
toskrnl.exe
2012-04-12 17:20 . 2012-03-06 05:59	3968368	----a-w-	c:\windows\SysWow64
tkrnlpa.exe
2012-04-12 17:20 . 2012-03-06 05:59	3913072	----a-w-	c:\windows\SysWow64
toskrnl.exe
2012-04-12 17:19 . 2012-03-01 06:46	23408	----a-w-	c:\windows\system32\drivers\fs_rec.sys
2012-04-12 17:19 . 2012-03-01 06:33	81408	----a-w-	c:\windows\system32\imagehlp.dll
2012-04-12 17:19 . 2012-03-01 05:33	159232	----a-w-	c:\windows\SysWow64\imagehlp.dll
2012-04-12 17:19 . 2012-03-01 06:38	220672	----a-w-	c:\windows\system32\wintrust.dll
2012-04-12 17:19 . 2012-03-01 06:28	5120	----a-w-	c:\windows\system32\wmi.dll
2012-04-12 17:19 . 2012-03-01 05:37	172544	----a-w-	c:\windows\SysWow64\wintrust.dll
2012-04-12 17:19 . 2012-03-01 05:29	5120	----a-w-	c:\windows\SysWow64\wmi.dll
2012-04-05 15:43 . 2012-04-05 15:43	--------	d-----w-	c:\users\JBMARTIN\AppData\Local\ASUS
2012-04-04 05:53 . 2012-04-04 05:53	182160	----a-w-	c:\program files (x86)\Internet Explorer\Plugins
ppdf32.dll
.
.
.
((((((((((((((((((((((((((((((((((   Compte-rendu de Find3M   ))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-04-14 08:03 . 2009-07-14 02:36	152576	----a-w-	c:\windows\SysWow64\msclmd.dll
2012-04-14 08:03 . 2009-07-14 02:36	175616	----a-w-	c:\windows\system32\msclmd.dll
2012-04-14 07:39 . 2011-07-26 20:58	70304	----a-w-	c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2012-03-22 19:12 . 2012-03-22 19:12	4435968	----a-w-	c:\windows\SysWow64\GPhotos.scr
2012-03-08 16:50 . 2012-03-08 16:50	49016	----a-w-	c:\windows\SysWow64\sirenacm.dll
2012-03-08 16:37 . 2012-03-08 16:37	302448	----a-w-	c:\windows\WLXPGSS.SCR
2012-02-26 02:13 . 2012-02-26 02:13	86528	----a-w-	c:\windows\SysWow64\iesysprep.dll
2012-02-26 02:13 . 2012-02-26 02:13	76800	----a-w-	c:\windows\SysWow64\SetIEInstalledDate.exe
2012-02-26 02:13 . 2012-02-26 02:13	74752	----a-w-	c:\windows\SysWow64\RegisterIEPKEYs.exe
2012-02-26 02:13 . 2012-02-26 02:13	74752	----a-w-	c:\windows\SysWow64\iesetup.dll
2012-02-26 02:13 . 2012-02-26 02:13	63488	----a-w-	c:\windows\SysWow64	dc.ocx
2012-02-26 02:13 . 2012-02-26 02:13	48640	----a-w-	c:\windows\SysWow64\mshtmler.dll
2012-02-26 02:13 . 2012-02-26 02:13	367104	----a-w-	c:\windows\SysWow64\html.iec
2012-02-26 02:13 . 2012-02-26 02:13	161792	----a-w-	c:\windows\SysWow64\msls31.dll
2012-02-26 02:13 . 2012-02-26 02:13	110592	----a-w-	c:\windows\SysWow64\IEAdvpack.dll
2012-02-26 02:13 . 2012-02-26 02:13	420864	----a-w-	c:\windows\SysWow64\vbscript.dll
2012-02-26 02:13 . 2012-02-26 02:13	35840	----a-w-	c:\windows\SysWow64\imgutil.dll
2012-02-26 02:13 . 2012-02-26 02:13	23552	----a-w-	c:\windows\SysWow64\licmgr10.dll
2012-02-26 02:13 . 2012-02-26 02:13	152064	----a-w-	c:\windows\SysWow64\wextract.exe
2012-02-26 02:13 . 2012-02-26 02:13	150528	----a-w-	c:\windows\SysWow64\iexpress.exe
2012-02-26 02:13 . 2012-02-26 02:13	142848	----a-w-	c:\windows\SysWow64\ieUnatt.exe
2012-02-26 02:13 . 2012-02-26 02:13	11776	----a-w-	c:\windows\SysWow64\mshta.exe
2012-02-26 02:13 . 2012-02-26 02:13	101888	----a-w-	c:\windows\SysWow64\admparse.dll
2012-02-26 02:13 . 2012-02-26 02:13	91648	----a-w-	c:\windows\system32\SetIEInstalledDate.exe
2012-02-26 02:13 . 2012-02-26 02:13	89088	----a-w-	c:\windows\system32\RegisterIEPKEYs.exe
2012-02-26 02:13 . 2012-02-26 02:13	49664	----a-w-	c:\windows\system32\imgutil.dll
2012-02-26 02:13 . 2012-02-26 02:13	48640	----a-w-	c:\windows\system32\mshtmler.dll
2012-02-26 02:13 . 2012-02-26 02:13	222208	----a-w-	c:\windows\system32\msls31.dll
2012-02-26 02:13 . 2012-02-26 02:13	173056	----a-w-	c:\windows\system32\ieUnatt.exe
2012-02-26 02:13 . 2012-02-26 02:13	135168	----a-w-	c:\windows\system32\IEAdvpack.dll
2012-02-26 02:13 . 2012-02-26 02:13	12288	----a-w-	c:\windows\system32\mshta.exe
2012-02-26 02:13 . 2012-02-26 02:13	114176	----a-w-	c:\windows\system32\admparse.dll
2012-02-26 02:13 . 2012-02-26 02:13	111616	----a-w-	c:\windows\system32\iesysprep.dll
2012-02-26 02:13 . 2012-02-26 02:13	85504	----a-w-	c:\windows\system32\iesetup.dll
2012-02-26 02:13 . 2012-02-26 02:13	76800	----a-w-	c:\windows\system32	dc.ocx
2012-02-26 02:13 . 2012-02-26 02:13	603648	----a-w-	c:\windows\system32\vbscript.dll
2012-02-26 02:13 . 2012-02-26 02:13	448512	----a-w-	c:\windows\system32\html.iec
2012-02-26 02:13 . 2012-02-26 02:13	30720	----a-w-	c:\windows\system32\licmgr10.dll
2012-02-26 02:13 . 2012-02-26 02:13	165888	----a-w-	c:\windows\system32\iexpress.exe
2012-02-26 02:13 . 2012-02-26 02:13	160256	----a-w-	c:\windows\system32\wextract.exe
2012-02-23 08:18 . 2011-07-17 09:59	279656	------w-	c:\windows\system32\MpSigStub.exe
2012-02-17 06:38 . 2012-03-14 21:03	1031680	----a-w-	c:\windows\system32dpcore.dll
2012-02-17 05:34 . 2012-03-14 21:03	826880	----a-w-	c:\windows\SysWow64dpcore.dll
2012-02-17 04:58 . 2012-03-14 21:03	210944	----a-w-	c:\windows\system32\driversdpwd.sys
2012-02-17 04:57 . 2012-03-14 21:03	23552	----a-w-	c:\windows\system32\drivers	dtcp.sys
2012-02-10 06:36 . 2012-03-14 21:06	1544192	----a-w-	c:\windows\system32\DWrite.dll
2012-02-10 05:38 . 2012-03-14 21:06	1077248	----a-w-	c:\windows\SysWow64\DWrite.dll
2012-02-03 04:34 . 2012-03-14 21:06	3145728	----a-w-	c:\windows\system32\win32k.sys
2006-05-03 10:06	163328	--sha-r-	c:\windows\SysWOW64\flvDX.dll
2007-02-21 11:47	31232	--sha-r-	c:\windows\SysWOW64\msfDX.dll
2008-03-16 13:30	216064	--sha-r-	c:\windows\SysWOW64
bDX.dll
2010-01-06 22:00	107520	--sha-r-	c:\windows\SysWOW64\TAKDSDecoder.dll
.
.
(((((((((((((((((((((((((((((   SnapShot@2012-04-24_22.41.53   )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-07-14 05:10 . 2012-04-25 06:12	35220              c:\windows\system32\wdi\BootPerformanceDiagnostics_SystemData.bin
- 2011-07-15 15:58 . 2012-04-24 20:19	7944              c:\windows\system32\wdi\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-2795626641-3094803326-748952498-1001_UserData.bin
+ 2011-07-15 15:58 . 2012-04-25 06:12	7944              c:\windows\system32\wdi\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-2795626641-3094803326-748952498-1001_UserData.bin
- 2012-04-24 20:17 . 2012-04-24 20:17	2048              c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
+ 2012-04-25 11:09 . 2012-04-25 11:09	2048              c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
- 2012-04-24 20:17 . 2012-04-24 20:17	2048              c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
+ 2012-04-25 11:09 . 2012-04-25 11:09	2048              c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
+ 2011-07-15 18:25 . 2012-04-25 06:50	258536              c:\windows\system32\wdi\SuspendPerformanceDiagnostics_SystemData_S3.bin
+ 2012-04-25 11:08 . 2012-04-25 11:08	151992              c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache3.0.0.0.dat
- 2009-07-14 05:01 . 2012-04-24 11:15	284664              c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat
+ 2009-07-14 05:01 . 2012-04-25 11:08	284664              c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat
+ 2012-04-25 11:08 . 2012-04-25 11:08	285432              c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-2795626641-3094803326-748952498-1001-12288.dat
.
(((((((((((((((((((((((((((((((((   Points de chargement Reg   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés 
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ADSMOverlayIcon1]
@="{A8D448F4-0431-45AC-9F5E-E1B434AB2249}"
[HKEY_CLASSES_ROOT\CLSID\{A8D448F4-0431-45AC-9F5E-E1B434AB2249}]
2007-06-02 00:08	143360	----a-w-	c:\program files (x86)\ASUS\ASUS Data Security Manager\ShlExt\x86\OverlayIconShlExt1.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"UpdateLBPShortCut"="c:\program files (x86)\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe" [2009-05-20 222504]
"UpdateP2GoShortCut"="c:\program files (x86)\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe" [2009-05-20 222504]
"Nuance PDF Reader-reminder"="c:\program files (x86)\Nuance\PDF Reader\Ereg\Ereg.exe" [2008-11-03 328992]
"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2010-08-12 98304]
"ATKMEDIA"="c:\program files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe" [2010-05-03 170624]
"HControlUser"="c:\program files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe" [2009-06-19 105016]
"Wireless Console 3"="c:\program files (x86)\ASUS\Wireless Console 3\wcourier.exe" [2010-07-02 1597440]
"avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2011-02-04 281768]
"OpwareSE4"="c:\program files (x86)\ScanSoft\OmniPageSE4.0\OpwareSE4.exe" [2006-10-11 75304]
"BrStsWnd"="c:\program files (x86)\Brownie\BrstsW64.exe" [2009-08-19 3695928]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-03 843712]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2011-06-09 254696]
"Malwarebytes' Anti-Malware"="c:\program files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" [2012-04-04 462408]
.
c:\users\PRO\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OpenOffice.org 3.3.lnk - c:\program files (x86)\OpenOffice.org 3\program\quickstart.exe [2010-12-13 1198592]
.
c:\users\JBMARTIN\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OpenOffice.org 3.3.lnk - c:\program files (x86)\OpenOffice.org 3\program\quickstart.exe [2010-12-13 1198592]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
AsusVibeLauncher.lnk - c:\program files (x86)\ASUS\AsusVibe\AsusVibeLauncher.exe [2011-1-12 548528]
SRS Premium Sound.lnk - c:\windows\Installer\{E5CF6B9C-3ABE-43C9-9413-AD5FFC98F049}\NewShortcut5_21C7B668029A47458B27645FE6E4A715.exe [2011-6-9 156952]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
"EnablELUA"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages	REG_MULTI_SZ   	kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sr.sys]
@="FSFilter System Recovery"
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 gupdate;Google Update Service (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-01-12 135664]
R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-14 253088]
R3 gupdatem;Service Google Update (gupdatem);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-01-12 135664]
R3 SiSGbeLH;SiS191/SiS190 Ethernet Device NDIS 6.0 Driver;c:\windows\system32\DRIVERS\SiSG664.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers	susbflt.sys [x]
R3 TurboBoost;TurboBoost;c:\program files\Intel\TurboBoost\TurboBoost.exe [2009-08-06 118672]
R3 WatAdminSvc;Service Windows Activation Technologies;c:\windows\system32\Wat\WatAdminSvc.exe [x]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-23 57184]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x]
S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2012-04-04 63928]
S2 AFBAgent;AFBAgent;c:\windows\system32\FBAgent.exe [x]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [x]
S2 AntiVirSchedulerService;Avira AntiVir Planificateur;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe [2011-07-26 136360]
S2 ASMMAP64;ASMMAP64;c:\program files (x86)\ASUS\ATK Package\ATKGFNEX\ASMMAP64.sys [2009-07-03 15416]
S2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2012-04-04 654408]
S2 TurboB;Turbo Boost UI Monitor driver;c:\windows\system32\DRIVERS\TurboB.sys [x]
S2 UNS;Intel(R) Management & Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2009-10-01 2314240]
S3 amdkmdag;amdkmdag;c:\windows\system32\DRIVERS\atikmdag.sys [x]
S3 amdkmdap;amdkmdap;c:\windows\system32\DRIVERS\atikmpag.sys [x]
S3 AtiHDAudioService;ATI Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW76.sys [x]
S3 ETD;ELAN PS/2 Port Input Device;c:\windows\system32\DRIVERS\ETD.sys [x]
S3 HECIx64;Intel(R) Management Engine Interface;c:\windows\system32\DRIVERS\HECIx64.sys [x]
S3 Impcd;Impcd;c:\windows\system32\DRIVERS\Impcd.sys [x]
S3 JMCR;JMCR;c:\windows\system32\DRIVERS\jmcr.sys [x]
S3 JME;JMicron Ethernet Adapter NDIS6.20 Driver (Amd64 Bits);c:\windows\system32\DRIVERS\JME.sys [x]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [x]
.
.
Contenu du dossier 'Tâches planifiées'
.
2012-04-25 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-13 07:39]
.
2012-04-25 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-01-12 15:50]
.
2012-04-25 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-01-12 15:50]
.
.
--------- x86-64 -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ADSMOverlayIcon1]
@="{A8D448F4-0431-45AC-9F5E-E1B434AB2249}"
[HKEY_CLASSES_ROOT\CLSID\{A8D448F4-0431-45AC-9F5E-E1B434AB2249}]
2007-06-01 23:52	159744	----a-w-	c:\program files (x86)\ASUS\ASUS Data Security Manager\ShlExt\x64\OverlayIconShlExt1_64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\AsusWSShellExt_B]
@="{6D4133E5-0742-4ADC-8A8C-9303440F7190}"
[HKEY_CLASSES_ROOT\CLSID\{6D4133E5-0742-4ADC-8A8C-9303440F7190}]
2009-11-26 05:49	70656	----a-w-	c:\program files (x86)\ASUS\ASUS WebStorage\SERVICE\AsusWSShellExt64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\AsusWSShellExt_O]
@="{64174815-8D98-4CE6-8646-4C039977D808}"
[HKEY_CLASSES_ROOT\CLSID\{64174815-8D98-4CE6-8646-4C039977D808}]
2009-11-26 05:49	70656	----a-w-	c:\program files (x86)\ASUS\ASUS WebStorage\SERVICE\AsusWSShellExt64.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ASUS WebStorage"="c:\program files (x86)\ASUS\ASUS WebStorage\SERVICE\AsusWSService.exe" [2010-03-16 1754448]
"SmartAudio"="c:\program files\CONEXANT\SAII\SAIICpl.exe" [2010-12-14 316032]
"ETDWare"="c:\program files (x86)\Elantech\ETDCtrl.exe" [BU]
.
------- Examen supplémentaire -------
.
uLocal Page = c:\windows\SysWOW64\blank.htm
uStart Page = hxxp://www.google.com/
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = *.local
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
TCP: DhcpNameServer = 212.27.40.240 212.27.40.241
FF - ProfilePath - c:\users\JBMARTIN\AppData\Roaming\Mozilla\Firefox\Profiles\gwqqpvfq.default\
FF - prefs.js: browser.search.selectedEngine - 
FF - prefs.js: keyword.URL - hxxp://www.google.com/search?q= 
.
- - - - ORPHELINS SUPPRIMES - - - -
.
Toolbar-Locked - (no file)
AddRemove-{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1 - c:\program files (x86)\Spybot - Search & Destroy\unins000.exe
.
.
.
------------------------ Autres processus actifs ------------------------
.
c:\program files (x86)\ASUS\ATK Package\ATK Hotkey\ASLDRSrv.exe
c:\program files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe
c:\program files (x86)\Avira\AntiVir Desktop\avguard.exe
c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files (x86)\Bonjour\mDNSResponder.exe
c:\program files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
c:\program files (x86)\ASUS\SmartLogon\sensorsrv.exe
c:\program files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe
c:\program files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exe
c:\program files (x86)\ASUS\ASUS Data Security Manager\ADSMSrv.exe
c:\program files (x86)\ASUS\ATK Package\ATK Hotkey\ATKOSD.exe
c:\program files (x86)\ASUS\ATK Package\ATK Hotkey\KBFiltr.exe
c:\program files (x86)\ASUS\ATK Package\ATK Hotkey\WDC.exe
c:\windows\AsScrPro.exe
c:\program files (x86)\CyberLink\Power2Go\CLMLSvc.exe
c:\program files (x86)\OpenOffice.org 3\program\soffice.exe
c:\program files (x86)\OpenOffice.org 3\program\soffice.bin
c:\program files (x86)\ASUS\ControlDeck\ControlDeck.exe
.
**************************************************************************
.
Heure de fin: 2012-04-25  13:15:03 - La machine a redémarré
ComboFix-quarantined-files.txt  2012-04-25 11:15
ComboFix2.txt  2012-04-24 22:50
.
Avant-CF: 63 329 705 984 octets libres
Après-CF: 63 262 212 096 octets libres
.
- - End Of File - - 6E4585322DAD41B3C14FD9E966BF1AF9

haku78 · Answer

Aucune amélioration du côté de ma session "pro"... 
Dois je lancer combofix à partir de celle-ci en mode sans échec?

g3n-h@ckm@n · Answer

fermer toutes les fenêtres et applications lors de l'installation et de l'analyse.


&#9654 Télécharge ici :

Malwarebytes  

&#9654 Installe le ( choisis bien "francais" ; ne modifie pas les paramètres d'installe ) et mets le à jour .

relance malwarebytes en suivant scrupuleusement ces consignes :

! Déconnecte toi et ferme toutes applications en cours !

&#9654 Lance Malwarebyte's .

Fais un examen dit "Complet" .

&#9654 Laisse le programme travailler ( et ne rien faire d'autre avec le PC durant le scan ).
&#9654 à la fin tu cliques sur "résultat" .
&#9654 Vérifie que tous les objets infectés soient validés, puis clique sur " suppression " .

&#9654 Note : si il faut redémarrer ton PC pour finir le nettoyage, fais le !


&#9654 Poste le rapport sauvegardé après la suppression des objets infectés (dans l'onglet "rapport/log"de Malwarebytes, le dernier en date)

haku78 · Answer

La galère : les deux premiers scans ont planté au bout d'une heure... et pourtant je ne touchais à rien... 
Le troisième est passé en mode sans échec sur la session qui pose problème. 
Et il n'a rien trouvé...

En fait sur la session qui est lente, il m'est impossible de lancer quoique se soit sans que l'écran prenne une opacité blanche caractéristique d'un plantage. Après quand je fais CTRL+ALT+SUP, il me mets échec de l'affichage des éléments de sécurité. Bref le pc plante. Ça ma l'a fait également aussi une fois sur l'autre session qui se porte mieux. 



Malwarebytes Anti-Malware (Trial) 1.61.0.1400
www.malwarebytes.org

Database version: v2012.04.25.04

Windows 7 Service Pack 1 x64 NTFS (Safe Mode/Networking)
Internet Explorer 9.0.8112.16421
PRO :: JBMARTIN-PC [limited]

Protection: Disabled

25/04/2012 17:44:59
mbam-log-2012-04-25 (17-44-59).txt

Scan type: Full scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 362361
Time elapsed: 55 minute(s), 7 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys : 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 1
C:\Users\PRO\Downloads\winlogon.exe (Heuristics.Reserved.Word.Exploit) -> Quarantined and deleted successfully.

(end)

haku78 · Answer

En retour de veille, la session administrateur ralentit et plante.
L'autre session ne veut toujours rien savoir. 
La souris des fois disparait et revient une demi seconde après à un endroit différent de l'écran...

Bref ça continue et je désespère...

haku78 · Answer

Me conseillez vous de réinstaller Windows 7? 
J'ai une partition. Je place mes documents sur D: et je répare C: ???

g3n-h@ckm@n · Answer

fais ca :

https://forums.cnetfrance.fr/tutoriels-securite-informatique/179557-dr-web-cureit-le-tutoriel

haku78 · Answer

Merci de ne pas me laisser tomber.

4b0e8137.qua	C:\Documents	and	Settings\All	Users\Application	Data\Avira\AntiVir	Desktop\INFECTED	JS.Click.223	Désinfecté.
4b2266ec.qua	C:\Documents	and	Settings\All	Users\Application	Data\Avira\AntiVir	Desktop\INFECTED	JS.IFrame.173	Supprimé.
4be81887.qua	C:\Documents	and	Settings\All	Users\Application	Data\Avira\AntiVir	Desktop\INFECTED	JS.Click.223	Désinfecté.

Par contre aucune différence...

g3n-h@ckm@n · Answer

re

Télécharge ici :OTL

&#9654 enregistre le sur ton Bureau.

si tu as XP => double clique
si tu as Vista ou windows 7 => clic droit "executer en tant que...." 

sur OTL.exe pour le lancer.

&#9654 => Clique ici pour voir la Configuration

&#9654 Copie et colle le contenu de ce qui suit en gras dans la partie inférieure d'OTL "Personnalisation"

/md5start
explorer.exe
winlogon.exe
wininit.exe
volsnap.sys
atapi.sys
ndisuio.sys
net.exe
net1.exe
Rundll32.exe
/md5stop 
netsvcs
safebootminimal
safebootnetwork 
%systemroot%\system32\*.dll /lockedfiles
%systemroot%\system32\*.exe /lockedfiles
%systemroot%\system32\*.ini
%systemroot%\Tasks\*.*
%systemroot%\system32\Tasks\*.*
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\system32\config\*.exe /s
%systemroot%\system32\*.sys 
HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa /s
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon
CREATERESTOREPOINT 

&#9654 Clic sur Analyse.

A la fin du scan, le Bloc-Notes va s'ouvrir avec le rapport (OTL.txt).

Ce fichier est sur ton Bureau (en général C:\Documents and settings\le_nom_de_ta_session\<Bureau ou Desktop>\OTL.txt)

&#9654&#9654&#9654 NE LE POSTE PAS SUR LE FORUM (il est trop long)

heberge OTL.txt et extra.txt sur http://pjjoint.malekal.com et donne les liens

haku78 · Answer

Voilà le rapport : 

https://pjjoint.malekal.com/files.php?id=20120427_y15y12u15y10s11

Merci de ta patience et de ton investissement.

haku78 · Answer

Oups! voici le extra : 

https://pjjoint.malekal.com/files.php?id=20120427_n5v9l5n77

g3n-h@ckm@n · Answer

ATTENTION !!! : Script personnalisé pour cette machine uniquement , ne pas reproduire !! 

si tu as XP => double clique
si tu as Vista ou windows 7 => clic droit "executer en tant que...." 

sur OTL.exe pour le lancer.


&#9654Copie la liste qui se trouve en gras ci-dessous,

&#9654 colle-la dans la zone sous "Personnalisation" :


:processes
explorer.exe
iexplore.exe
firefox.exe
msnmsgr.exe
Teatimer.exe

:OTL
FF - user.js - File not found
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_2_202_233.dll File not found
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=:  File not found
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O4 - Startup: C:\Users\JBMARTIN\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk
O4 - Startup: C:\Users\PRO\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present 


:Reg
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"Wireless Console 3"=-

:Files
C:\Users\JBMARTIN\AppData\Local\{*} 
C:\Windows\SysNative\acovcnt.exe          
C:\Users\JBMARTIN\Application Data\Microsoft\Internet Explorer\Quick Launch\Spybot - Search & D
C:\END     
C:\Users\JBMARTIN\Desktop\Spybot - Search & Destroy.lnk 

:commands
[CLEARALLRESTOREPOINTS]
[emptytemp]
[start explorer]
[reboot]


&#9654 Clique sur "Correction" pour lancer la suppression.


&#9654 Poste le rapport qui logiquement s'ouvrira tout seul en fin de travail appres le redemarrage.

haku78 · Answer

All processes killed
========== PROCESSES ==========
No active process named explorer.exe was found!
No active process named iexplore.exe was found!
No active process named firefox.exe was found!
No active process named msnmsgr.exe was found!
No active process named Teatimer.exe was found!
========== OTL ==========
Registry key HKEY_LOCAL_MACHINE\Software\MozillaPlugins\@adobe.com/FlashPlayer\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\Software\MozillaPlugins\@microsoft.com/GENUINE\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\Software\MozillaPlugins\@Apple.com/iTunes,version=\ deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\Locked deleted successfully.
C:\Users\JBMARTIN\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk moved successfully.
C:\Users\PRO\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk moved successfully.
Registry key HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Internet Explorer\Restrictions\ deleted successfully.
========== REGISTRY ==========
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\Wireless Console 3 deleted successfully.
========== FILES ==========
C:\Users\JBMARTIN\AppData\Local\{00020968-A655-4120-9F4B-CC2E32CEDB22} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{0072C1EB-2505-49AD-92AE-1EF5EDC670DC} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{00A7B134-92AB-4EAC-8BC1-B6F7EBF1948E} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{01778AC0-A251-462E-AEB7-B5DBA803B2DD} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{01B40D5F-63C0-4295-B09E-68B3C93CDDB7} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{01DE7A7A-9C53-417B-9009-25D02050B17D} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{033DADC4-A6BF-4359-904A-890105AEF874} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{049162B4-3554-45E4-AD56-6CD3FAA49D13} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{05369609-3D96-41CB-895E-413F224A4A3D} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{06886525-1A39-4AB4-A8AE-DAD8C6391CA1} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{069CF159-C3B2-49FC-8633-98433BA2FFA7} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{07DE18F4-5D2D-40BA-97ED-96378679A135} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{07E94BB6-694E-4F3D-905A-1288120ED13D} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{096BC691-FB71-4C46-BF6E-5BE45D3DB7CB} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{09C007E4-FEFF-4326-80F5-D3655405C0B1} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{0A064FAD-11DB-4FCB-91E1-4699EEEB23EF} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{0C351E22-CEDF-4571-AD17-9F6378F0EE51} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{0D6217C1-2620-4392-AAA7-3FBFC26F8455} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{0ECD7962-63C3-4F92-974E-CE9846A6DD51} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{0FC6A238-7648-4ACD-9F74-7CCAF77D3E3D} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{10AC1AC9-E79B-4297-89AB-82FF1F57EF39} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{10CC16C0-075B-4A03-A556-E857CAB7BF8C} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{11286A89-73D0-4944-B4E7-2DC5BB42E62D} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{11C6A3FD-A820-44F4-81A8-D871ECD37B8B} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{12E62F6C-E9A4-48C0-8D2E-5AC218E3D1FD} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{130AC3B8-11E5-4F1D-8F77-24D7C284C133} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{1417CCBE-93E2-4C0C-BC2C-67AD50DB3147} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{14623012-AA6C-4E5D-B5D2-78767D2661E9} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{14BFC8FC-8C2F-41C1-A9B7-0803C3B534DE} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{15027DAC-625F-4DE8-A48E-03808ADD9DD6} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{157AE5A1-BD50-40B2-9AE7-79599CFA96DF} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{17284B42-119E-44B2-BC3D-167546F7472F} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{173D90E9-6372-4DF2-9174-ECAA51C35589} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{18A13B47-CC88-415F-82A2-A377571A29F2} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{191BC73D-74DF-44B3-AE0D-E65DA5097EE8} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{19221492-0932-4D46-95C2-165314362FA3} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{1BFB54D3-5F9F-43B0-B047-CC77C0CD2EFB} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{1C55B4A8-6FFF-457E-91A7-FA672E922781} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{1EF67887-765C-451B-9BD1-C3345ACFE6A6} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{1FA5B38C-680B-4859-B453-BC450C2199B0} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{210765AB-4CC1-4984-ADDF-8D01C931E012} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{2387F1D1-611C-4AFD-8834-41F63E195982} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{2547EBBD-AD37-4E05-A2B3-A4C353F4C220} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{25785C1B-CF14-45CA-8E2D-2D25235CFBDB} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{258D6D9B-0E1A-4524-9740-4939D0AEAAD3} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{25EFD2C8-C659-4D01-878E-90847A9EC04F} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{27025461-4DAA-4DCD-8D6B-A41A4524CEF5} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{270433A8-661F-48E9-B6EF-6E0D110FAD07} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{27070C21-D0C9-4DA7-981B-5DD323797529} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{27534566-BD48-4C98-9262-E623F2798BE3} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{281B5DD4-CEFC-4FDA-83F2-120A1069D8B0} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{28E8FFFD-8488-4431-AB05-6734E8ECF9FC} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{29430D89-652E-4F32-B8FB-6E0D692CEACD} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{2CCBC8AB-60BC-463C-8EC0-F5A2D6807AE4} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{2D7D0B6E-D0FF-4F22-9896-4DDBB6884188} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{2D99ECFD-1BD9-4E18-9F01-7B4263824372} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{2D9B9B11-DB29-4296-8937-97E7AC5DF28A} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{2E7815A6-2A01-4BB9-8CDC-DC5DCE91007C} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{2EF8BD91-4C29-4F75-B440-54E692615BBE} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{2F81C7E6-876B-4BEF-91C1-A6A9B048DB2A} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{2FA0EA8B-2EB7-4F31-BC34-B90D9CACA9E9} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{313D3EFA-5802-41AA-B338-B604EE0D73F0} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{323C4CDC-662C-467C-9762-028C1589AC83} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{33054D20-0B95-4593-84BC-B100F100D333} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{33AD5A42-42C8-4117-AFEA-06D6A3A91646} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{33F7723B-568E-46CC-A230-72246118162A} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{3716039B-7068-42EC-B695-EA404DD1C305} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{37B94A41-A401-489E-BABD-6F6E575B9AEF} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{37C00489-1B8D-44A3-A898-5116BE6E5D1D} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{38E2391A-9DB9-466C-B683-7C0CF4851B04} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{39486843-A564-481D-8BBF-62ACC76A2318} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{3949C644-B9F2-4E79-A332-BAE3CEACB232} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{3A1D1F7E-A6B4-4848-96AB-A8DD9AEBFC78} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{3B5FE505-F8D5-480A-9FDE-EA0989B98E98} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{3BDE5D3F-D327-4914-9291-AA79674D2856} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{3D84D07E-F56F-4C2C-8E39-084B7E2A934D} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{3EAD5F7F-380A-4138-8F3E-CF9651CD373E} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{4017FF3B-EC4C-4B78-8D58-98CE73A51611} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{40AC6571-631B-45AE-95D8-EACECAEE3672} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{40F7C6CF-FEF9-4533-A3EF-112B2F66BEE5} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{420BF291-A171-4BC6-8287-014BFA150402} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{42EB8917-267A-4651-A305-8DD7EA3C523B} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{43205D54-604D-4406-8A1F-1D750B918E2A} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{43DB5063-C64B-4242-9BD3-297516BCE0AC} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{45FAD595-9FE1-4BBF-8999-A05E9232E3AD} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{475BDB55-C1F3-4062-A234-5FCD9C35D5E8} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{47A55408-F407-413F-8209-721E41BBD0D4} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{47FD88EC-3919-4186-B5A7-568BF1654EB6} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{487B57F1-AA06-4C4B-B730-9DA7B22DCE66} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{48C91550-0967-4F7E-91BA-73398C203A22} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{48F9D600-3B06-4478-A060-2942A6826BDC} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{49132288-210C-49D5-8634-82C7C5F4AC6C} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{4954CBD5-75EF-4485-B979-C07F22A3F684} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{49B0FD39-7CEE-4F34-9AE2-45C3C6545813} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{4A63C442-6E0F-4617-B0E2-82D035173994} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{4D88017F-DCE3-4C56-8670-18B9FD532A9A} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{4E3EEAEE-6A7A-4B6A-AEB0-EF9559354773} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{4E3FEB8A-BB82-4670-9ABE-A04FA9149BD3} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{4F733C04-DCB5-417C-A766-0C359C3D4EE3} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{4FDB1FEA-1E86-4506-880A-45F88F672D1A} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{505BA57B-078A-4D73-9006-EE0CE8ADC6AE} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{5130A68D-1A57-4072-AB55-94465131B79F} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{519DEE3B-C267-4E21-83DC-A5E587FB7DED} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{5303730E-D8CB-4E14-90B1-DF4058F66CE7} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{5562CE93-DBB9-41D8-AC44-619119AB352D} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{569C6449-3B72-4D85-8267-9212480152D8} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{5798D726-99F5-489A-9556-309AC4D5F16E} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{5821F5CE-644F-4B41-9518-786541FD689D} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{582A8F25-484D-4140-9FAF-8429A85CC179} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{59A3674B-C832-4F98-A628-6EB728D5B1B5} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{5A08DDFA-4C5C-49D2-9FEB-392EF52DF2B3} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{5A0D2041-07C2-4EC0-A070-FF21B327E265} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{5A4504A5-66EB-4C79-B69E-CACEA0254DF9} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{5A79D94D-D45C-40BE-BC23-9E0E8E5589BF} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{5AEADA6D-13F4-4995-9733-E5C780CFC815} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{5C85DA69-A91C-4298-B957-49C7C69F4786} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{5C869A1B-CB28-4A6F-BFBB-AE71070F92F0} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{5D92D98B-4054-4FBD-B793-85F9D8093EF1} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{5E3F8105-52D5-433D-81E8-0BB95A374973} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{5F12E7B9-6BFE-47CC-B4BB-C603F2CD6CEF} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{5FFDC255-41E0-4053-AA9F-D0E86435FC5B} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{602FC210-1B05-479E-A92A-C6EE05FAC717} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{6039A277-1B44-4A57-8954-EDC6C31E34AE} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{62DF7C67-D30D-4BE0-A509-27FC4B7BF6C9} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{641D2B9E-3C6E-408C-81A3-2DC3F995F46F} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{652EBFAB-1A3C-4B97-B0AA-BD2F8D03E1BC} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{65FF25B9-0B49-4013-8684-97F5197574C6} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{6990D26F-264B-440E-B4E0-0B4614EEF2CE} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{6AD517DF-568A-4E24-99CC-CDB2958E9555} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{6AE9EAAB-207D-4F24-B62C-1A4B9EE07FA6} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{6C5F8CA5-DEEB-460A-A306-C04FCD96499D} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{6C75CD68-1A3E-4857-8D08-EBB44ADD492D} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{6CD55D62-60BE-4781-B8D3-2B80F60CF120} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{6CE90E87-2BB2-4D0C-901C-4B2968C3D3E6} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{6CF960F1-39B7-439E-A38C-360243CFD8AC} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{6D774587-0590-4CB7-8177-C96BFAF0424C} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{6DA9C749-D4C8-4D11-AF61-2677F9762478} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{6E0E475E-8A14-4AEC-B537-4C52F497B8EC} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{6E82314F-8ADF-4E44-AE46-B218231F1682} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{6F493D18-5E90-4253-BA25-D9F0C9E9CEF2} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{6F5A5AA8-6420-4B13-B4C3-833191DE36BE} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{6F798990-C762-4DE0-A44F-15A6734CD349} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{6F7B57A0-F638-487A-B1DF-E95427FB16E1} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{6F9A9951-781A-4695-A071-AF0F2229B5CF} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{6FC89687-AF1A-44ED-A7EA-DD095358ACE2} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{700B855F-0B04-42F3-BE47-D65FDC15F5BA} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{70156D47-0440-462D-A906-C9D88E4065AB} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{702AA88D-0BC4-4E3E-B3C9-4BAC3F814882} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{706C2601-F0E8-4C8A-8CFF-EB56A97A3FE6} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{70D9CB94-43C7-4000-B5FF-D3BB330B328E} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{7195DE2E-EFF0-4F98-8811-255C7D075AF6} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{71A9A1C7-45D7-4B24-AFA6-0C496B7CAF0C} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{737D4014-7FAA-4CA2-BB78-B0740320491F} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{73AA2AA0-E9D7-4B58-9311-6D92A8E32DE3} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{75555DE3-4881-44AF-BFEE-418710873778} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{7579EEC4-8187-4084-BCE1-46AF68BEB80E} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{76EA720F-1CFE-4ADD-AF08-A845FF7BF71D} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{77F31533-E6C4-4814-9365-ADBA0F9D9CD5} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{783C9AAA-DC4F-4789-96F4-4961FAAD9EAF} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{7B4F938D-48F6-4136-880F-061F860693C1} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{7C6A1C90-0679-4F1A-8944-220A48FFD5D0} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{7CC6AECD-F407-40C3-AD0B-90FC3F159813} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{7D141D5C-BB96-49F2-A634-1C337AD416F5} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{7D35A631-8E7F-4D03-8F7A-5E45A45B5FBA} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{7D97D8F8-7DD5-470F-B0A5-DB57D020F889} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{7E0EA46F-C581-4D38-9657-97D30A093115} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{7E2D6B99-718E-4130-96D4-786BC4FCDBC3} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{7EC547A1-B750-459B-86B8-A32C1DF649BB} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{7EF3F361-E94C-4B23-8C3B-56636A6A9C2E} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{7F06D6AB-73A7-41AA-A659-47C434065A32} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{7F206EC3-22C7-4BB8-9C54-11B0EBBAFCD6} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{7FAA1EEE-743A-4AA6-9D99-08F24955045B} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{7FFF7509-90F8-4D61-9420-37D95CF3F96F} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{804EBA14-3216-48DD-B6A0-B999980148BE} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{80BBC6CC-1F70-4352-8366-C53F1BEA9390} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{80E685A5-4E93-4C14-ABD3-E9E9893A6BF2} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{810CAE0B-DEB1-4D15-AD9D-72FF603E47B3} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{8382899A-1881-47ED-B54D-F10EE46FCD3A} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{8459E593-AE35-4475-A296-5A0747228C04} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{847A398F-76D3-4835-B696-CF4F3A9B8B8A} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{84A93A8E-C02D-41CA-83F5-2E7902559B36} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{85C8D574-B343-4801-8930-F184A6FD1312} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{85F4E444-EB53-4B59-B991-6E4A1EAAF422} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{868B4951-81C9-402F-A3D1-2BE9BD728D95} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{872A34B2-35B6-47CC-8BA2-81347795E7A4} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{87D133D4-EBEA-4E7F-8E85-022B50B4DAC7} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{8867F2B9-6682-4EC0-B98E-44D2984DE847} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{8A94F49D-457E-47FE-961C-40613F41D998} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{8ADE974C-42D0-4414-83A1-26A4DAE925C9} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{8BE64513-DD54-46BB-9802-E737C95E437C} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{8C9DCE85-9A34-4B60-B21D-B6DAA9776244} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{8CA10094-D741-4736-B514-707845B11AFB} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{8CA1ADF2-8D20-4D7F-B254-F2D2DC0FB131} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{8D47CC06-F302-49C8-93BF-1EB56233C377} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{91E14433-6E41-47C2-ADA3-CF36D4151D23} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{9273AD33-13DD-4CA4-819B-BE7B0F61BBD8} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{946F8D4D-EB5F-409A-98AA-D3E9ECA516B9} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{958638F2-CAAF-458D-856A-2767C342F71F} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{95A758E0-4CDD-4637-AE5C-B3EB61F1718D} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{95B1D6D0-A4BA-49AB-A6AC-47EBDF19F60A} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{95F1AE21-8601-4588-A18A-4880CD725CAE} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{96049CED-3704-40CC-8A07-F8DF103B2AEC} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{962877F8-812C-45C7-AC48-42770215572E} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{98125B48-DABC-4DE5-8519-049E13166998} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{98C6C72C-196C-45E0-BE52-B3956FC1F34B} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{9AB4447A-DA37-4417-8383-7E0F56AC9D3A} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{9B198A88-5A89-4D30-B5BE-5E39022B32BC} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{9CE595C5-9D2C-45A6-8328-4A45AB2B1BC6} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{9D1842E4-6AEF-4917-952A-13D700DBC516} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{9DAE6FB7-9D18-4161-8F88-25AD5D3EBC35} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{9EA9030C-1DAB-41B4-B38B-F96FE8729A24} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{9F35DC94-908E-4A47-8776-2465AF4874B7} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{A050D0E3-FD4B-41D9-A478-B27CDEEDA1E5} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{A1295B9F-F831-42DF-8A4F-624460016836} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{A1A4F176-8633-4E18-8550-1638ABC16C10} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{A236D339-565A-4399-9C8B-B66A21319E28} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{A5ED0373-3E3E-45F2-92A1-68BBE9996DC9} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{A648B5B9-D09E-4140-9BF3-350295F5C59E} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{A68BFCE6-1874-4CDD-B340-28DF570A38AB} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{A69ABB90-1428-4679-8CC0-BC87683E124E} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{A6E1B627-4A6E-4A37-86B8-D3ECF01F9564} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{A7DF5699-7417-4015-AE5A-44DC018E614C} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{A930BC21-CC07-4EE5-B39E-02AD90DD6846} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{A99E7B14-BE44-4ACC-A42C-45999B737BC8} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{AA1B591F-6296-4837-A987-7BA9100617AE} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{AC3B10EC-DD2B-44E8-A7F2-0A4074E08342} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{AC649775-9195-4047-990A-F0C24D55EBD1} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{AC6B3EF9-0C85-4543-AFF7-61922D1F6B70} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{ACDE6854-F217-494D-9D79-5B7AE7A76EE0} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{ADD51E29-85EC-4FF4-9AAA-4240D993EE56} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{ADF9D975-059D-4E46-89C7-E2D0166949AC} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{AE1D2391-3BD3-41C9-A7C6-F871F63C299E} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{AE3401BE-CED3-42BF-8D29-B56477AF68C9} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{AE4151A2-6928-4E8C-8EBB-DB3EEF6B9D89} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{AF17F7E8-C846-4ACA-8BA9-09909E0EBDB3} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{B01DDCB5-E462-41C4-AD12-6982629659E2} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{B046E9B9-6FE8-4DE5-B18F-7734EC96AC3E} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{B11D713F-ACBC-4370-BDB1-C8BAEE387AAD} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{B1B45938-DEEE-4CF6-A140-BDE34E96BF58} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{B224D860-28DD-40D6-8D84-D8EF585BF041} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{B2630305-2AC2-4C1F-ABB2-284D4303A6CF} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{B3857765-E29F-47A0-97A2-AF791EFA5BF4} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{B3F7A99A-4A18-495F-AF42-D989A88C25F7} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{B479147E-88EE-4461-BA0F-C73F714BED72} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{B47D6A00-BA17-425A-9C97-0DEE7A211885} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{B5CFE485-85E3-4164-8264-E964FC5D0FF6} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{B9C9451C-4874-4F19-9A8C-D56ABBA7FBA4} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{BA5315E2-F1A9-4225-BF1F-41D160D4E783} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{BAA29EAF-1B8D-46CB-9442-BAE61F5BC7D4} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{BACD0056-E4E7-4052-B625-869A85076314} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{BCF396D4-39CB-4131-B3ED-5E45F2DE5CF0} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{BCF60B20-5952-43A5-B709-76A8704EEAB4} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{BEA74120-E981-4419-87C9-3BE3EF882707} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{BEABA221-12B4-4593-81EF-EEE0B2DE382E} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{BEC95FBD-9519-4D6F-8BEC-D4B74A1611C3} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{C029AD64-1995-45F1-A2E9-234CD3723950} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{C045F7D8-B0E8-4DFC-B309-B26A3F0CB8FD} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{C086D3D2-CB38-41D3-AAE4-D47A437DFC68} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{C11488CE-FCDF-4817-8EB0-8533228441FF} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{C22D1B73-9D78-45FA-A01D-6FF181E4F041} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{C2717F13-4259-4261-ADC9-175176B1F0E0} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{C31436D4-DBC8-4DD2-928E-F793C3C46E5E} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{C361AAE2-BBB9-4056-8CA0-C91BE176E3C2} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{C48F4913-F18A-40F6-B6FA-E5F6F8CF6C29} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{C5A77ED5-FB92-497F-B55E-E2C844A406EF} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{C6382DAD-6834-4529-B1BE-3431CFC67D9B} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{C69ED4A1-0BFB-4D50-A37D-28E9F7C7D337} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{CA12FA22-587D-45BF-BDBF-2654C815954B} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{CABB8D68-4D10-4DA1-874B-FAB7B04FE895} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{CBFC7D39-ACAC-419A-A0F3-E61033678341} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{CD27F3FB-ADD0-437D-9957-4280248C5DB7} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{CD6AA6C8-65D5-4780-BD7A-60B8CA6D586C} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{CD7252B0-34FC-4126-BA86-867B2CCB539D} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{CEE4514A-1D8E-4950-9023-174A3733980F} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{D1C58624-3DB9-4BEE-85E6-E5FAB5762384} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{D2D1739F-5014-4A94-93D4-88B4B1FCC6F9} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{D41293E9-A6D5-4B53-830D-3DA4EAD6AFDE} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{D497B985-0D54-4AF4-8B94-33CB6E6B7B1E} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{D508DF9E-40DE-4CA3-B7BB-94D9D6E680D5} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{D5F34DE6-7626-4CB5-B028-9F9A81174C59} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{D7A1D9EC-3E88-424C-9957-1AA2E9FEB8B8} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{D7C0CE99-2EBB-4C49-9D02-3CBBB35980EC} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{D7F6CDFC-D52F-4DE7-A720-0A742E114AF0} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{D85690A5-E90A-4ECE-AED9-273670127F39} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{D8EE3480-373D-4569-AE06-6967C82CB2A5} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{D8FEFEF8-95BD-42A4-9F2E-292C71D4C94B} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{D92884A8-D2FD-4979-A59E-3A50DEAEB78C} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{D994F131-669D-45AF-B27C-85C5B478A037} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{DA885DA4-D699-48A0-96A9-77FDA800AE2B} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{DA88C061-8550-49B3-9BCF-27CCA7D9B4DF} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{DBEFA0D4-209D-4F22-8AF5-EA156144587D} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{DC01E70C-9279-48F2-9EEC-9F7E24FA1513} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{DDEEF7AB-D23E-4DE6-B486-3256D59E4718} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{DE8E4D1A-8AA7-4B7B-9407-D8E3122CB5EA} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{DEDB243E-5E9D-45E2-9CB8-565CEF8D5E94} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{DF2CB4D6-3E87-4336-8082-3412D35303A8} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{DFD235E4-751F-472E-A066-EA239372A5C1} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{DFD3E588-3319-4A03-B779-61A41D15A5ED} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{E0C070DE-B05B-4E60-9574-6B9E267D4AD0} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{E0FFE1C5-D40E-47F8-A78C-6166918D18C7} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{E1026ED2-C8CD-4BE6-8AE5-A29DBEFFA587} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{E12592D9-5848-414D-8E5D-F68B2AA523BC} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{E1731339-6465-4A44-B01F-50AF8DE51B92} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{E258FFFC-793A-4837-8D0F-C3E4C557CDE2} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{E2C6CD90-BE53-4773-B873-C5FF5E053104} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{E3003E27-769D-4522-ACFF-9756677E77F3} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{E30E533F-072C-42FB-9880-53C95BBB0D90} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{E31476A2-2BB4-4D01-9A8D-377EA1F2EA69} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{E7F10FEF-B890-4E61-B148-12162C6F70B1} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{EA0DA0E1-226E-48F8-94E4-528E583ACD57} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{EA96B3A5-0A04-434C-9D59-653AB5D97519} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{EB20ACD1-68FE-4158-B270-15BDEAA1DA5D} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{EB4882D2-FC30-4C48-93D8-0E9EFD1B4681} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{EBE21C7F-342B-41E8-84B9-90A5D59F684C} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{EC9C5C58-AB31-466A-99BF-9E2F97AACF86} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{EDBF43CE-3EC3-486B-9DA8-A1A80037D1E1} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{EE00467D-9B14-4E63-9157-F5D3945B6FDF} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{EE5209D6-145E-4025-B56F-75DCB7128923} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{EE67525E-C568-4978-B9A5-16B7107450F6} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{EE8C0D89-78C9-4327-A0C4-B94E6718B675} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{EF1F4689-1A49-4423-A684-1E41E1A1F954} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{EF561CFC-FB17-4ECD-9101-6F0982A28790} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{F04ADAC6-4B63-491F-A230-7BABC25C8AEE} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{F0BE1BB5-E48C-45EC-BB4E-2DC58ACDFF86} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{F0F33BE6-E6D1-430A-B62B-F47B09C97A8C} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{F18D127D-DF36-4CF3-8D4F-19B722EBE92D} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{F5046D32-5310-4149-BC9C-E9BADBBC56AB} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{F5754154-9574-4784-AB8C-EC030AF08BF6} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{F5C09286-E55B-4ADA-AB22-E88F89A44246} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{F74C28BE-C86E-4831-BB9F-C6681C68821B} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{F761D62C-F495-4AB7-8E23-29C13CB40ACD} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{F76E685E-4928-4E24-B927-6CC7B076B579} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{F786E189-7C40-4B6B-8932-C003FF17B7D1} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{F7AAE1AC-731A-4B15-A17E-29BD11CA6CA8} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{F9334E1B-F07C-4958-948C-E96627824A80} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{F944269F-4517-425F-9104-49B1BFAFDD74} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{FC125F7E-6DC9-4F73-BD2F-F9E97833A24B} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{FCEF159A-0042-456F-9095-CE30B9CF2745} folder moved successfully.
C:\Users\JBMARTIN\AppData\Local\{FE3ED296-2505-4044-8D05-98564398A98D} folder moved successfully.
C:\Windows\SysNative\acovcnt.exe moved successfully.
File\Folder C:\Users\JBMARTIN\Application Data\Microsoft\Internet Explorer\Quick Launch\Spybot - Search & D not found.
C:\END moved successfully.
C:\Users\JBMARTIN\Desktop\Spybot - Search & Destroy.lnk moved successfully.
========== COMMANDS ==========
Unable to stop System Restore Service. Error code 1084. Restore points not cleared.
Unable to start System Restore Service. Error code 1084. Restore point not created.
 
[EMPTYTEMP]
 
User: All Users
 
User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
User: JBMARTIN
->Temp folder emptied: 269277 bytes
->Temporary Internet Files folder emptied: 410124 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 12489538 bytes
->Flash cache emptied: 3091529 bytes
 
User: PRO
->Temp folder emptied: 82666 bytes
->Temporary Internet Files folder emptied: 38215 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 54876393 bytes
->Flash cache emptied: 491 bytes
 
User: Public
->Temp folder emptied: 0 bytes
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 7603854 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 36028577 bytes
RecycleBin emptied: 51205 bytes
 
Total Files Cleaned = 110,00 mb
 
 
OTL by OldTimer - Version 3.2.42.1 log created on 04272012_183117

Files\Folders moved on Reboot...
C:\Users\JBMARTIN\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.

Registry entries deleted on Reboot...

g3n-h@ckm@n · Answer

telecharge ici : Load_KidoKiller

Desactive tes protections

lance-le , clique sur lancer le nettoyage 

l'outil va télécharger automatiquement la derniere version puis

le scan se lancera ensuite

à la fin Kido.txt se mettra sur ton bureau

&#9654&#9654&#9654 NE LE POSTE PAS SUR LE FORUM (il risque d'être trop long)

clic droit dessus , envoyer vers , dossiers compressés

ensuite :

heberge l'archive et donne le lien

haku78 · Answer

Quand je lis le fichier texte ça fait bugger le pc... mais je suis les consignes et donc voici le lien pour le télécharger :
http://jameshorner.fr/images/divers/Kido.rar

g3n-h@ckm@n · Answer

toujours des soucis ?

haku78 · Answer

Aucune amélioration.... :-(

g3n-h@ckm@n · Answer

fais voir ton dernier rapport de malwarebyes ?

haku78 · Answer

Malwarebytes Anti-Malware (Essai) 1.61.0.1400
www.malwarebytes.org

Version de la base de données: v2012.04.28.03

Windows 7 Service Pack 1 x64 NTFS (Mode sans échec/Réseau)
Internet Explorer 9.0.8112.16421
JBMARTIN :: JBMARTIN-PC [administrateur]

Protection: Désactivé

28/04/2012 12:34:12
mbam-log-2012-04-28 (12-34-12).txt

Type d'examen: Examen complet
Options d'examen activées: Mémoire | Démarrage | Registre | Système de fichiers | Heuristique/Extra | Heuristique/Shuriken | PUP | PUM
Options d'examen désactivées: P2P
Elément(s) analysé(s): 422316
Temps écoulé: 57 minute(s), 52 seconde(s)

Processus mémoire détecté(s): 0
(Aucun élément nuisible détecté)

Module(s) mémoire détecté(s): 0
(Aucun élément nuisible détecté)

Clé(s) du Registre détectée(s): 0
(Aucun élément nuisible détecté)

Valeur(s) du Registre détectée(s): 0
(Aucun élément nuisible détecté)

Elément(s) de données du Registre détecté(s): 0
(Aucun élément nuisible détecté)

Dossier(s) détecté(s): 0
(Aucun élément nuisible détecté)

Fichier(s) détecté(s): 1
C:\Users\JBMARTIN\Downloads\winlogon.exe (Heuristics.Reserved.Word.Exploit) -> Mis en quarantaine et supprimé avec succès.

(fin)

g3n-h@ckm@n · Answer

je t'ai pas demandé de refaire un scan je te demandais le dernier rapport de scan

haku78 · Answer

pardon... je te mets les derniers...

Malwarebytes Anti-Malware (Trial) 1.61.0.1400
www.malwarebytes.org

Database version: v2012.04.25.04

Windows 7 Service Pack 1 x64 NTFS (Safe Mode/Networking)
Internet Explorer 9.0.8112.16421
PRO :: JBMARTIN-PC [limited]

Protection: Disabled

25/04/2012 17:44:59
mbam-log-2012-04-25 (17-44-59).txt

Scan type: Full scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 362361
Time elapsed: 55 minute(s), 7 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 1
C:\Users\PRO\Downloads\winlogon.exe (Heuristics.Reserved.Word.Exploit) -> Quarantined and deleted successfully.

(end)

haku78 · Answer

Malwarebytes Anti-Malware (Essai) 1.61.0.1400
www.malwarebytes.org

Version de la base de données: v2012.04.23.06

Windows 7 Service Pack 1 x64 NTFS (Mode sans échec/Réseau)
Internet Explorer 9.0.8112.16421
JBMARTIN :: JBMARTIN-PC [administrateur]

Protection: Désactivé

24/04/2012 01:36:49
mbam-log-2012-04-24 (01-36-49).txt

Type d'examen: Examen complet
Options d'examen activées: Mémoire | Démarrage | Registre | Système de fichiers | Heuristique/Extra | Heuristique/Shuriken | PUP | PUM
Options d'examen désactivées: P2P
Elément(s) analysé(s): 458896
Temps écoulé: 54 minute(s), 22 seconde(s)

Processus mémoire détecté(s): 0
(Aucun élément nuisible détecté)

Module(s) mémoire détecté(s): 0
(Aucun élément nuisible détecté)

Clé(s) du Registre détectée(s): 0
(Aucun élément nuisible détecté)

Valeur(s) du Registre détectée(s): 0
(Aucun élément nuisible détecté)

Elément(s) de données du Registre détecté(s): 0
(Aucun élément nuisible détecté)

Dossier(s) détecté(s): 0
(Aucun élément nuisible détecté)

Fichier(s) détecté(s): 3
C:\Users\JBMARTIN\Documents\JAMESHORNER.FR\jameshorner.fr\wordpress\ResizeImagesSetup.exe (PUP.Adware.RKN) -> Mis en quarantaine et supprimé avec succès.
C:\Users\JBMARTIN\Documents\JAMESHORNER.FR\jameshorner.fr\wordpress\ResizeImagesSetup1.0.exe (PUP.Adware.RKN) -> Mis en quarantaine et supprimé avec succès.
C:\Users\JBMARTIN\Downloads\hijackthis_telechargement_01net.exe (PUP.Toolbar.Repacked) -> Mis en quarantaine et supprimé avec succès.

(fin)

g3n-h@ckm@n · Answer

ok fais ce grand menage voir

https://gen-hackman.kanak.fr/

haku78 · Answer

D'accord! 
Y a du taf. 

je commence : 
hyIGotInfected v1.5.2(by Tigzy)
********************************

Run : 28/04/2012 19:56:19 [Safe Mode with Network]
Machine : JBMARTIN-PC (4 CPUs) [JBMARTIN : ADMIN]
OS: Microsoft Windows 7 Édition Familiale Premium  Service Pack 1 (x64)

~~ Plugins check: ~~

UPTODATE [Microsoft Windows 7 Édition Familiale Premium ] Current : Service Pack 1 -- Latest : Service Pack 1
UPTODATE [Firefox (x86)] Current : 12.0 -- Latest : 12.0
UPTODATE [Internet Explorer] Current : 9.0.8112.16421 -- Latest : 9.0.8112.16421
UPTODATE [Internet Explorer (x86)] Current : 9.0.8112.16421 -- Latest : 9.0.8112.16421
UPTODATE [Adobe Reader (x86)] Current : 10 -- Latest : 10
UPTODATE [Adobe Flash] Current : 11.2.202.233 -- Latest : 11.2.202.233
UPTODATE [Adobe Flash (x86)] Current : 11.2.202.233 -- Latest : 11.2.202.233
UPTODATE [Adobe Flash ActiveX] Current : 11.2.202.233 -- Latest : 11.2.202.233
UPTODATE [Adobe Flash ActiveX (x86)] Current : 11.2.202.233 -- Latest : 11.2.202.233
UPTODATE [Adobe Flash FF Plugin] Current : 11.2.202.233 -- Latest : 11.2.202.233
UPTODATE [Adobe Flash FF Plugin (x86)] Current : 11.2.202.233 -- Latest : 11.2.202.233


Finished
<C:\Users\JBMARTIN\Desktop\WIGIReport[0].txt>
WIGIReport[0].txt

g3n-h@ckm@n · Answer

magnifique :)

haku78 · Answer

# DelFix v8.8 - Rapport créé le 28/04/2012 à 20:00:12
# Mis à jour le 12/02/12 par Xplode
# Système d'exploitation : Windows 7 Home Premium Service Pack 1 (64 bits)
# Nom d'utilisateur : JBMARTIN - JBMARTIN-PC (Administrateur)
# Exécuté depuis : C:\Users\JBMARTIN\Desktop\delfix.exe
# Option [Suppression]


~~~~~~ Dossiers(s) ~~~~~~

Supprimé : C:\Qoobox
Supprimé : C:\_OTL
Supprimé : C:\Users\JBMARTIN\DoctorWeb

~~~~~~ Fichier(s) ~~~~~~

Supprimé : C:\Users\JBMARTIN\Desktop\jb.exe <-- Combofix
Supprimé : C:\ComboFix.txt
Supprimé : C:\MEMBRES.MDB
Supprimé : C:\Users\JBMARTIN\Desktop\Extras.Txt
Supprimé : C:\Users\JBMARTIN\Desktop\OTL.exe
Supprimé : C:\Users\JBMARTIN\Desktop\OTL.Txt
Supprimé : C:\Users\JBMARTIN\Desktop\WhyIGotInfected.exe
Supprimé : C:\Users\JBMARTIN\Downloads\Defogger.exe
Supprimé : C:\Users\JBMARTIN\Downloads\drweb-cureit.exe
Supprimé : C:\Users\JBMARTIN\Downloads\Pre_Scan.exe
Supprimé : C:\Users\JBMARTIN\Downloads\Pre_Scan.pif
Supprimé : C:\Windows\grep.exe
Supprimé : C:\Windows\PEV.exe
Supprimé : C:\Windows\NIRCMD.exe
Supprimé : C:\Windows\MBR.exe
Supprimé : C:\Windows\SED.exe
Supprimé : C:\Windows\SWREG.exe
Supprimé : C:\Windows\SWSC.exe
Supprimé : C:\Windows\SWXCACLS.exe
Supprimé : C:\Windows\Zip.exe

~~~~~~ Registre ~~~~~~

Clé Supprimée : HKCU\Software\g3n-h@ckm@n
Clé Supprimée : HKCU\Software\IDAVLab
Clé Supprimée : HKLM\SOFTWARE\OldTimer Tools
Clé Supprimée : HKLM\SOFTWARE\IDAVLab
Clé Supprimée : HKLM\SOFTWARE\Swearware
Clé Supprimée : HKLM\SOFTWARE\TrendMicro\Hijackthis
Clé Supprimée : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\combofix.exe

~~~~~~ Autres ~~~~~~

-> Prefetch Vidé

*************************

DelFix[S1].txt - [1727 octets] - [28/04/2012 20:00:12]

########## EOF - C:\DelFix[S1].txt - [1851 octets] ##########

g3n-h@ckm@n · Answer

époustoufliffiant !!! ^^

haku78 · Answer

merci ^^ c'est pas dur car le tuto est bien fait. 

Dans le nettoyage de disque est ce que je peux me débarrasser des Fichiers de sauvegarde du service pack (920 mo)?

g3n-h@ckm@n · Answer

perso je vire tout

haku78 · Answer

Ayé! J'ai tout suivi et tout lu de A à Z... Mais toujours le même souci... 

Avec tout ce qu'on a fait je sens bien que mon pc est propre, par exemple le démarrage se fait rapidement pour les deux sessions. Par contre pour la session qui pose problème il m'est impossible de lancer quoique soit. Dès que je place la souris sur la barre des tâches en bas de l'écran la souris se transforme en rond d'attente. Dès que je clique sur un icône, l'écran devient opaque... et le pc ne répond plus, reboot obligatoire. Bref cette session ne fonctionne plus.

g3n-h@ckm@n · Answer

tu as des choses importantes dedans ?

haku78 · Answer

Tout ce qui concerne mon boulot... donc oui...
Mais en fait je peux y accéder via c:/utilisateurs/nom de ma session pro. 
Donc est ce que je ne pourrais pas copier les dossiers à partir de ce chemin vers ma session qui semble plus viable puis ensuite supprimer ma session pro?

g3n-h@ckm@n · Answer

et la recrréer tu peux très bien ! 

ou alors créee un autre session , transfère tout directement de l'une à l'autre et supprime celle-ci
¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Pre_Scan_Concept ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤

haku78 · Answer

Je vais faire ça. Merci pour ton aide et ton soutien je te tiens au courant.

g3n-h@ckm@n · Answer

pas de soucis ;)

haku78 · Answer

Tout a l'air bon à présent. Merci g3n-h@ckm@n pour ton aide apportée durant toute la semaine. 
Bonne continuation.

g3n-h@ckm@n · Answer

:)

haku78 · Answer

Je me suis emballé trop vite. 
Dès que je laisse un peu le pc tourner seul... style tout à l'heure pour qu'il fasse tranquillement un scan antivir et que je reviens dessus, il rame. Et au ctrl alt sup il me met échec dans l'affichage des options de sécurité. Reboot obligatoire. 

g3n-h@ckm@n si tu n'as plus l'envie de m'aider ou si tu es à court d'idées, je le comprendrais bien évidemment.

g3n-h@ckm@n · Answer

il a quel age le pc ?

haku78 · Answer

il a 9 mois...

haku78 · Answer

Est ce que c'est normal que la mémoire physique s'élève à 33% dès la fin du démarrage? du coup là je lance mozilla pour écrire sur le forum et je grimpe direct à 2000 mo en mémoire cache (700 au démarrage) pour 4000 au total.

Autre symptômes : 
- le démarrage fini à chaque fois que je lance Mozilla il met du temps à se lancer. Et si je clique plusieurs fois et bien au bout de 30 secondes il me l'ouvre autant de fois que j'avais cliqué... bien entendu...
- Depuis hier mozilla m'ouvre quelques fois les pages web sans leur feuille de style, sans leur mise en forme, très pratique pour surfer...

g3n-h@ckm@n · Answer

t'as fait TOUT le menage recommandé ? ou t'as eu la flemme de faire la suite .?

haku78 · Answer

J'ai fait : 
WIGI
Defogger (car on l'avait utilisé)
DelFix

J'ai configuré CC cleaner comme indiqué. 
J'ai fait nettoyage des disques (j'ai tout viré comme tu m'as dit)
Vérifications des erreurs.  (c'était long d'ailleurs)
Défragmentation. 

J'ai ensuite mis à jour Java. Virer les anciennes versions. 
Pareil pour adobe.

Les quarantaines de Malaware et de Antivir étaient vides.

Je ne me suis pas penché encore sur le pare feu
J'ai fait la manip au niveau des restaurations système. 

Puis j'ai lu les conseils de prévention.

Est-ce que j'ai loupé un truc? 

J'ai toujours suivi à le lettre tes conseils, vu que je passe mon temps sur le pc et que je souhaite vraiment résoudre ces petits soucis et bien je m'applique à bien faire les choses.

g3n-h@ckm@n · Answer

ok et malgré tout cela des soucis persistent ?

haku78 · Answer

oui... les quelques soucis que j'ai décrit plus haut, qu'il ne m'avait jamais fait avant et qui peuvent me gêner dans mon travail.

g3n-h@ckm@n · Answer

tu as souvenir depuis quand ils sont apparus ? tu faisais quoi ?

haku78 · Answer

Ils sont apparus la première fois au travail lundi dernier quand j'ai voulu rentrer dans ma session professionnelle. Les premiers démarrages furent très lents, Le ctrl alt sup mettait échec... Je n'avais pas touché à cette session depuis quelques jours à cause des vacances. 

La vieille au soir j'avais utiliser CC cleaner pour désinstaller Imminent un truc que je ne connaissais pas et que j'avais remarqué durant le nettoyage hebdomadaire. 
J'ai aussi viré Bonjour pensant que c'était un truc inutile... Mais apparemment ce n'est pas le cas ^^. 
Le lendemain vu les difficultés rencontrées j'ai fait une restauration système afin de revenir à ma configuration de dimanche mais le mal était fait. Pendant mes vacances j'avais aussi pris le mauvais réflexe de ne pas arrêter le pc avec le bouton Arrêter mais en repliant juste l'écran, et en ne fermant pas les sessions... La session pro qui est resté ouverte plusieurs jours n'a peut être pas aimé.

g3n-h@ckm@n · Answer

ah ben c est sur que si tu fais n'imp' avec ton systeme.....

Quelques lenteurs...

66 réponses

Discussions similaires

Newsletters