Virus tres tenace

Résolu
max19 Messages postés 68 Statut Membre -  
Destrio5 Messages postés 99820 Date d'inscription   Statut Modérateur Dernière intervention   -
Bonjour,

je suis max19. Voilà mon histoire.

depuis quelques semaines j'ai affaire a un virus tres tenace.

voilà ce que avira me met :

"Dans le fichier 'C:\Windows\Installer\{f7d860cb-2036-29a6-7e83-9f32d62f4728}\U\80000032.@'
un virus ou un programme indésirable 'TR/ATRAPS.Gen2' [trojan] a été détecté.
Action exécutée : Refuser l'accès"

"Dans le fichier 'C:\Windows\Installer\{f7d860cb-2036-29a6-7e83-9f32d62f4728}\U\80000064.@'
un virus ou un programme indésirable 'TR/ATRAPS.Gen2' [trojan] a été détecté.
Action exécutée : Refuser l'accès"

j'ai essayé tous et tous ce qui était dans mon pouvoir pour essayer d'éradiquer ce virus. Il était sous différent nom mais les fichiers infecté sont toujours les mêmes. J'ai essayer avast antivirus.C Cleaner pour nettoyer tous les fichiers. j'ai tous essayé et je pense que je suis au bon endroits pour avoir de l'aide. J'ai ce virus depuis le début du mois de juin sans avoir d'effet particulier.

23 réponses

  • 1
  • 2
  1. Destrio5 Messages postés 99820 Date d'inscription   Statut Modérateur Dernière intervention   10 324
     
    Bonjour,

    --> Désactive l'UAC le temps de la désinfection.

    /!\ Désactive tes protections résidentes (Antivirus, etc...) /!\

    --> Télécharge ComboFix (de sUBs) sur ton Bureau.

    --> Clique droit sur ComboFix.exe (le .exe n'est pas forcément visible) et choisis Exécuter en tant qu'administrateur afin de le lancer.

    --> Réponds Oui au message d'avertissement pour que ComboFix commence l'analyse de ton PC.

    --> Lorsqu'elle sera terminée, un rapport apparaîtra. Poste ce rapport (C:\Combofix.txt) dans ta prochaine réponse.

    Pour t'aider : Un guide et un tutoriel sur l'utilisation de ComboFix
    1
  2. max19 Messages postés 68 Statut Membre
     
    ComboFix 12-07-02.01 - acer 02/07/2012 18:05:58.1.4 - x64
    Microsoft Windows 7 Édition Familiale Premium 6.1.7600.0.1252.33.1036.18.3957.1999 [GMT 2:00]
    Lancé depuis: c:\users\acer\Downloads\ComboFix.exe
    AV: avast! Antivirus *Disabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}
    AV: McAfee VirusScan *Enabled/Outdated* {86355677-4064-3EA7-ABB3-1B136EB04637}
    FW: McAfee Personal Firewall *Enabled* {BE0ED752-0A0B-3FFF-80EC-B2269063014C}
    SP: avast! Antivirus *Disabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681}
    SP: McAfee VirusScan *Enabled/Updated* {3D54B793-665E-3129-9103-206115370C8A}
    SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
    .
    .
    (((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    c:\program files (x86)\Acer Bio Protection\PwdFilterV64.dll
    c:\program files (x86)\Common Files\Acer GameZone online.ico
    c:\users\acer\Documents\searcher_setup.exe
    c:\windows\assembly\GAC_32\Desktop.ini
    c:\windows\assembly\GAC_64\Desktop.ini
    c:\windows\Installer\{f7d860cb-2036-29a6-7e83-9f32d62f4728}\@
    c:\windows\Installer\{f7d860cb-2036-29a6-7e83-9f32d62f4728}\L\00000004.@
    c:\windows\Installer\{f7d860cb-2036-29a6-7e83-9f32d62f4728}\L\1afb2d56
    c:\windows\Installer\{f7d860cb-2036-29a6-7e83-9f32d62f4728}\L\201d3dde
    c:\windows\Installer\{f7d860cb-2036-29a6-7e83-9f32d62f4728}\U\00000004.@
    c:\windows\Installer\{f7d860cb-2036-29a6-7e83-9f32d62f4728}\U\00000008.@
    c:\windows\Installer\{f7d860cb-2036-29a6-7e83-9f32d62f4728}\U\000000cb.@
    c:\windows\Installer\{f7d860cb-2036-29a6-7e83-9f32d62f4728}\U\80000000.@
    c:\windows\Installer\{f7d860cb-2036-29a6-7e83-9f32d62f4728}\U\80000032.@
    c:\windows\Installer\{f7d860cb-2036-29a6-7e83-9f32d62f4728}\U\80000064.@
    c:\windows\Installer\{f7d860cb-2036-29a6-7e83-9f32d62f4728}\U\trz6105.tmp
    c:\windows\Installer\{f7d860cb-2036-29a6-7e83-9f32d62f4728}\U\trz86A0.tmp
    c:\windows\Installer\{f7d860cb-2036-29a6-7e83-9f32d62f4728}\U\trz8E04.tmp
    c:\windows\Installer\{f7d860cb-2036-29a6-7e83-9f32d62f4728}\U\trz96B4.tmp
    c:\windows\Installer\{f7d860cb-2036-29a6-7e83-9f32d62f4728}\U\trz9DEE.tmp
    c:\windows\Installer\{f7d860cb-2036-29a6-7e83-9f32d62f4728}\U\trzA052.tmp
    c:\windows\Installer\{f7d860cb-2036-29a6-7e83-9f32d62f4728}\U\trzA24.tmp
    c:\windows\Installer\{f7d860cb-2036-29a6-7e83-9f32d62f4728}\U\trzB59A.tmp
    c:\windows\Installer\{f7d860cb-2036-29a6-7e83-9f32d62f4728}\U\trzB6A8.tmp
    c:\windows\Installer\{f7d860cb-2036-29a6-7e83-9f32d62f4728}\U\trzBB28.tmp
    c:\windows\Installer\{f7d860cb-2036-29a6-7e83-9f32d62f4728}\U\trzC8C0.tmp
    c:\windows\Installer\{f7d860cb-2036-29a6-7e83-9f32d62f4728}\U\trzED4D.tmp
    c:\windows\Installer\{f7d860cb-2036-29a6-7e83-9f32d62f4728}\U\trzED8A.tmp
    c:\windows\Installer\{f7d860cb-2036-29a6-7e83-9f32d62f4728}\U\trzEF91.tmp
    c:\windows\Installer\{f7d860cb-2036-29a6-7e83-9f32d62f4728}\U\trzF407.tmp
    .
    c:\windows\system32\services.exe . . . est infecté!!
    .
    .
    ((((((((((((((((((((((((((((( Fichiers créés du 2012-06-02 au 2012-07-02 ))))))))))))))))))))))))))))))))))))
    .
    .
    2012-07-02 16:18 . 2012-07-02 16:18 -------- d-----w- c:\users\Default\AppData\Local\temp
    2012-07-02 15:38 . 2012-07-02 15:38 -------- d-----w- c:\program files (x86)\Common Files\Java
    2012-07-02 15:37 . 2012-07-02 15:37 -------- d-----w- c:\program files (x86)\Oracle
    2012-07-02 15:36 . 2012-05-04 17:29 772504 ----a-w- c:\windows\SysWow64\npDeployJava1.dll
    2012-07-02 15:34 . 2012-07-02 15:34 -------- d-----w- c:\program files (x86)\Java
    2012-07-02 14:54 . 2012-07-02 14:54 -------- d-----w- c:\users\acer\AppData\Roaming\Avira
    2012-07-02 14:49 . 2011-12-01 15:55 97312 ----a-w- c:\windows\system32\drivers\avgntflt.sys
    2012-07-02 14:49 . 2011-12-01 15:55 27760 ----a-w- c:\windows\system32\drivers\avkmgr.sys
    2012-07-02 14:49 . 2011-12-01 15:55 130760 ----a-w- c:\windows\system32\drivers\avipbb.sys
    2012-07-02 14:49 . 2012-07-02 14:49 -------- d-----w- c:\programdata\Avira
    2012-07-02 14:49 . 2012-07-02 14:49 -------- d-----w- c:\program files (x86)\Avira
    2012-07-02 13:50 . 2012-07-02 13:51 -------- d-----w- c:\program files (x86)\EasyPHP-5.3.9
    2012-06-28 07:45 . 2012-06-28 07:45 -------- d-----w- c:\program files\CCleaner
    2012-06-25 13:47 . 2012-06-25 13:47 -------- d-----w- c:\program files (x86)\Notepad++
    2012-06-24 13:39 . 2012-06-24 13:39 -------- d-----w- c:\users\acer\AppData\Roaming\My Games
    2012-06-24 13:30 . 2012-06-24 13:30 -------- d-----w- c:\program files (x86)\Firaxis Games
    2012-06-24 13:30 . 2005-04-03 21:02 69714 ----a-w- c:\program files (x86)\Common Files\InstallShield\Professional\RunTime\11\00\Intel32\ctor.dll
    2012-06-24 13:30 . 2005-04-03 21:01 274432 ----a-w- c:\program files (x86)\Common Files\InstallShield\Professional\RunTime\11\00\Intel32\iscript.dll
    2012-06-24 13:30 . 2005-04-03 21:00 184320 ----a-w- c:\program files (x86)\Common Files\InstallShield\Professional\RunTime\11\00\Intel32\iuser.dll
    2012-06-24 13:30 . 2005-04-03 21:00 63488 ----a-w- c:\program files (x86)\Common Files\InstallShield\Professional\RunTime\11\00\Intel32\ISBEW64.exe
    2012-06-24 13:30 . 2005-04-03 20:59 5632 ----a-w- c:\program files (x86)\Common Files\InstallShield\Professional\RunTime\11\00\Intel32\DotNetInstaller.exe
    2012-06-24 13:30 . 2005-04-03 21:02 753664 ----a-w- c:\program files (x86)\Common Files\InstallShield\Professional\RunTime\11\00\Intel32\iKernel.dll
    2012-06-24 13:30 . 2012-06-24 13:30 200836 ----a-w- c:\program files (x86)\Common Files\InstallShield\Professional\RunTime\11\00\Intel32\iGdi.dll
    2012-06-24 13:30 . 2012-06-24 13:30 331908 ----a-w- c:\program files (x86)\Common Files\InstallShield\Professional\RunTime\11\00\Intel32\setup.dll
    2012-06-24 07:41 . 2012-06-24 07:41 -------- d-----w- c:\users\acer\AppData\Local\Macromedia
    2012-06-22 07:13 . 2012-06-02 22:19 57880 ----a-w- c:\windows\system32\wuauclt.exe
    2012-06-22 07:13 . 2012-06-02 22:19 44056 ----a-w- c:\windows\system32\wups2.dll
    2012-06-22 07:13 . 2012-06-02 22:19 2428952 ----a-w- c:\windows\system32\wuaueng.dll
    2012-06-22 07:13 . 2012-06-02 22:15 2622464 ----a-w- c:\windows\system32\wucltux.dll
    2012-06-22 07:12 . 2012-06-02 22:19 38424 ----a-w- c:\windows\system32\wups.dll
    2012-06-22 07:12 . 2012-06-02 22:19 701976 ----a-w- c:\windows\system32\wuapi.dll
    2012-06-22 07:12 . 2012-06-02 22:15 99840 ----a-w- c:\windows\system32\wudriver.dll
    2012-06-22 07:11 . 2012-06-02 13:19 186752 ----a-w- c:\windows\system32\wuwebv.dll
    2012-06-22 07:11 . 2012-06-02 13:15 36864 ----a-w- c:\windows\system32\wuapp.exe
    2012-06-21 15:21 . 2012-06-21 15:21 770384 ----a-w- c:\program files (x86)\Mozilla Firefox\msvcr100.dll
    2012-06-21 15:21 . 2012-06-21 15:21 421200 ----a-w- c:\program files (x86)\Mozilla Firefox\msvcp100.dll
    2012-06-19 15:35 . 2012-06-19 15:35 4967624 ----a-w- c:\program files (x86)\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}\components\SkypeFfComponent.dll
    2012-06-16 20:36 . 2012-03-06 23:02 28504 ----a-w- c:\windows\system32\drivers\aswKbd.sys
    2012-06-16 07:56 . 2012-05-18 02:01 499200 ----a-w- c:\program files\Internet Explorer\jsdbgui.dll
    2012-06-16 07:56 . 2012-05-17 22:38 678912 ----a-w- c:\program files (x86)\Internet Explorer\iedvtool.dll
    2012-06-16 07:56 . 2012-05-18 02:02 887296 ----a-w- c:\program files\Internet Explorer\iedvtool.dll
    2012-06-13 20:43 . 2012-05-04 10:52 5505392 ----a-w- c:\windows\system32\ntoskrnl.exe
    2012-06-13 20:43 . 2012-05-04 10:08 3902320 ----a-w- c:\windows\SysWow64\ntoskrnl.exe
    2012-06-13 20:43 . 2012-05-04 10:08 3958128 ----a-w- c:\windows\SysWow64\ntkrnlpa.exe
    2012-06-13 20:05 . 2012-04-26 05:34 149504 ----a-w- c:\windows\system32\rdpcorekmts.dll
    2012-06-13 20:05 . 2012-04-26 05:34 76288 ----a-w- c:\windows\system32\rdpwsx.dll
    2012-06-13 20:05 . 2012-04-26 05:28 9216 ----a-w- c:\windows\system32\rdrmemptylst.exe
    2012-06-13 20:04 . 2012-05-02 05:32 208896 ----a-w- c:\windows\system32\profsvc.dll
    2012-06-13 19:59 . 2012-05-15 01:32 3144192 ----a-w- c:\windows\system32\win32k.sys
    2012-06-13 19:59 . 2012-04-28 03:50 204800 ----a-w- c:\windows\system32\drivers\rdpwd.sys
    2012-06-13 19:59 . 2012-04-07 12:18 3213824 ----a-w- c:\windows\system32\msi.dll
    2012-06-13 19:59 . 2012-04-07 11:34 2342400 ----a-w- c:\windows\SysWow64\msi.dll
    2012-06-13 19:59 . 2012-04-24 05:59 1460224 ----a-w- c:\windows\system32\crypt32.dll
    2012-06-13 19:59 . 2012-04-24 04:47 1156608 ----a-w- c:\windows\SysWow64\crypt32.dll
    2012-06-13 19:59 . 2012-04-24 05:59 182272 ----a-w- c:\windows\system32\cryptsvc.dll
    2012-06-13 19:59 . 2012-04-24 05:59 140288 ----a-w- c:\windows\system32\cryptnet.dll
    2012-06-13 19:59 . 2012-04-24 04:47 139264 ----a-w- c:\windows\SysWow64\cryptsvc.dll
    2012-06-13 19:59 . 2012-04-24 04:47 103936 ----a-w- c:\windows\SysWow64\cryptnet.dll
    2012-06-10 08:04 . 2012-06-11 19:43 -------- d-----w- c:\program files (x86)\EA GAMES
    2012-06-10 08:04 . 2004-08-18 08:34 442368 ----a-r- c:\windows\SysWow64\vp6vfw.dll
    2012-06-09 19:35 . 2012-06-09 19:35 283200 ----a-w- c:\windows\system32\drivers\dtsoftbus01.sys
    2012-06-09 19:35 . 2012-06-28 07:48 -------- d-----w- c:\users\acer\AppData\Roaming\DAEMON Tools Lite
    2012-06-09 19:34 . 2012-06-09 19:35 -------- d-----w- c:\program files (x86)\DAEMON Tools Lite
    2012-06-09 15:36 . 2012-06-10 08:01 -------- d-----w- c:\programdata\DAEMON Tools Lite
    .
    .
    .
    (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2012-06-23 22:05 . 2012-05-25 19:22 426184 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
    2012-06-23 22:05 . 2012-02-29 20:57 70344 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
    2012-05-17 15:48 . 2012-05-06 08:30 772114 ----a-w- c:\windows\RON 2010 FRENCH DL Uninstaller.exe
    2012-05-04 17:29 . 2012-03-10 11:40 687504 ----a-w- c:\windows\SysWow64\deployJava1.dll
    2012-04-08 08:23 . 2012-04-08 08:23 40960 ----a-r- c:\users\acer\AppData\Roaming\Microsoft\Installer\{9559F7CA-5E34-4237-A2D9-D856464AD727}\NewShortcut1_9559F7CA5E344237A2D9D856464AD727.exe
    2012-04-08 08:23 . 2012-04-08 08:23 40960 ----a-r- c:\users\acer\AppData\Roaming\Microsoft\Installer\{9559F7CA-5E34-4237-A2D9-D856464AD727}\ARPPRODUCTICON.exe
    2012-04-04 13:56 . 2012-05-10 19:50 24904 ----a-w- c:\windows\system32\drivers\mbam.sys
    .
    .
    ------- Sigcheck -------
    Note: Unsigned files aren't necessarily malware.
    .
    [-] 2009-07-14 . 50BEA589F7D7958BDD2528A8F69D05CC . 329216 . . [6.1.7600.16385] .. c:\windows\system32\services.exe
    .
    ((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
    REGEDIT4
    .
    [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\egisPSDP]
    @="{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}"
    [HKEY_CLASSES_ROOT\CLSID\{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}]
    2009-09-10 13:41 120104 ----a-w- c:\program files (x86)\EgisTec\MyWinLocker 3\x86\PSDProtect.dll
    .
    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2012-06-02 4786048]
    "EA Core"="c:\program files (x86)\Electronic Arts\EADM\Core.exe" [2009-03-28 3325952]
    "Skype"="c:\program files (x86)\Skype\Phone\Skype.exe" [2012-05-03 17355912]
    "swg"="c:\program files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-12-02 39408]
    "ShowBatteryBar"="c:\program files\BatteryBar\ShowBatteryBar.exe" [2009-05-28 89600]
    "DAEMON Tools Lite"="c:\program files (x86)\DAEMON Tools Lite\DTLite.exe" [2012-04-17 3671872]
    "Speech Recognition"="c:\windows\Speech\Common\sapisvr.exe" [2009-07-14 44544]
    "EasyPHP"="c:\program files (x86)\EasyPHP-5.3.9\EasyPHP-5.3.9.exe" [2011-07-13 496640]
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
    "EgisTecLiveUpdate"="c:\program files (x86)\EgisTec Egis Software Update\EgisUpdate.exe" [2009-08-04 199464]
    "BackupManagerTray"="c:\program files (x86)\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe" [2009-10-29 261888]
    "NortonOnlineBackupReminder"="c:\program files (x86)\Symantec\Norton Online Backup\Activation\NobuActivation.exe" [2009-07-25 588648]
    "StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2009-11-23 98304]
    "LManager"="c:\program files (x86)\Launch Manager\LManager.exe" [2009-09-24 825864]
    "EgisTecPMMUpdate"="c:\program files (x86)\EgisTec IPS\PmmUpdate.exe" [2009-12-08 401192]
    "EgisUpdate"="c:\program files (x86)\EgisTec IPS\EgisUpdate.exe" [2009-12-08 201512]
    "VitaKeyPdtWzd"="c:\program files (x86)\Acer Bio Protection\PdtWzd.exe" [2009-11-10 3569152]
    "ArcadeDeluxeAgent"="c:\program files (x86)\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe" [2009-10-29 419112]
    "PlayMovie"="c:\program files (x86)\Acer Arcade Deluxe\PlayMovie\PMVService.exe" [2009-11-12 181480]
    "Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe" [2011-01-30 35736]
    "Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-11-10 932288]
    "avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2011-12-01 258512]
    "SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2012-01-17 252296]
    .
    c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
    Acer VCM.lnk - c:\program files (x86)\Acer\Acer VCM\AcerVCM.exe [2009-12-2 708608]
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
    "ConsentPromptBehaviorAdmin"= 0 (0x0)
    "ConsentPromptBehaviorUser"= 3 (0x3)
    "EnableLUA"= 0 (0x0)
    "EnableUIADesktopToggle"= 0 (0x0)
    "PromptOnSecureDesktop"= 0 (0x0)
    .
    [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
    "aux5"=wdmaud.drv
    .
    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
    Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\!SASCORE]
    @=""
    .
    R2 0069251341244939mcinstcleanup;McAfee Application Installer Cleanup (0069251341244939);c:\users\acer\AppData\Local\Temp\006925~1.EXE [x]
    R2 avast! Firewall;avast! Firewall;c:\program files\AVAST Software\Avast\afwServ.exe [x]
    R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
    R2 gupdate;Service Google Update (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-02-29 135664]
    R2 RS_Service;Raw Socket Service;c:\program files (x86)\Acer\Acer VCM\RS_Service.exe [2009-07-10 253952]
    R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe [2012-05-03 158856]
    R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-06-23 250056]
    R3 btusbflt;Bluetooth USB Filter;c:\windows\system32\drivers\btusbflt.sys [2009-07-01 52264]
    R3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\DRIVERS\btwl2cap.sys [2009-04-07 35104]
    R3 gupdatem;Service Google Update (gupdatem);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-02-29 135664]
    R3 hidshim;Service for HID-KMDF Shim layer;c:\windows\system32\DRIVERS\hidshim.sys [2009-08-31 6656]
    R3 k57nd60a;Broadcom NetLink (TM) Gigabit Ethernet - NDIS 6.0;c:\windows\system32\DRIVERS\k57nd60a.sys [2009-08-06 320040]
    R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2012-04-04 24904]
    R3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2012-06-21 113120]
    R3 MWLService;MyWinLocker Service;c:\program files (x86)\EgisTec\MyWinLocker 3\x86\\MWLService.exe [2009-09-10 305448]
    R3 NETw5s64;Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows 7 - 64 Bit;c:\windows\system32\DRIVERS\NETw5s64.sys [2009-09-15 6952960]
    R3 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [2010-06-25 35344]
    R3 NTIBackupSvc;NTI Backup Now 5 Backup Service;c:\program files (x86)\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe [2009-11-06 50432]
    R3 nuvotonhidcir;Nuvoton HID CIR Receiver;c:\windows\system32\DRIVERS\nuvotonhidcir.sys [2009-08-31 26624]
    R3 nuvotonir;Nuvoton CIR Transceiver;c:\windows\system32\DRIVERS\nuvotonir.sys [2009-08-31 68096]
    R3 RTL8192su;Realtek RTL8192SU Wireless LAN 802.11n USB 2.0 Network Adapter;c:\windows\system32\DRIVERS\RTL8192su.sys [2009-10-14 674304]
    R3 VBoxNetAdp;VirtualBox Host-Only Ethernet Adapter;c:\windows\system32\DRIVERS\VBoxNetAdp.sys [2011-12-19 146736]
    R3 WatAdminSvc;Service Windows Activation Technologies;c:\windows\system32\Wat\WatAdminSvc.exe [2012-03-02 1255736]
    R4 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2012-04-04 654408]
    R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-22 57184]
    S0 johci;JMicron 1394 Filter Driver;c:\windows\system32\DRIVERS\johci.sys [2009-08-24 22640]
    S1 aswKbd;aswKbd; [x]
    S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys [2011-12-01 27760]
    S1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys [2012-06-09 283200]
    S1 mwlPSDFilter;mwlPSDFilter;c:\windows\system32\DRIVERS\mwlPSDFilter.sys [2009-06-02 22576]
    S1 mwlPSDNServ;mwlPSDNServ;c:\windows\system32\DRIVERS\mwlPSDNServ.sys [2009-06-02 20016]
    S1 mwlPSDVDisk;mwlPSDVDisk;c:\windows\system32\DRIVERS\mwlPSDVDisk.sys [2009-06-02 60464]
    S1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV64.SYS [2011-07-22 14928]
    S1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL64.SYS [2011-07-12 12368]
    S1 VBoxDrv;VirtualBox Service;c:\windows\system32\DRIVERS\VBoxDrv.sys [2011-12-19 224048]
    S1 VBoxUSBMon;VirtualBox USB Monitor Driver;c:\windows\system32\DRIVERS\VBoxUSBMon.sys [2011-12-19 130864]
    S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-14 59904]
    S2 !SASCORE;SAS Core Service;c:\program files\SUPERAntiSpyware\SASCORE64.EXE [2011-08-11 140672]
    S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2009-11-23 202752]
    S2 AntiVirSchedulerService;Avira Planificateur;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe [2011-12-01 86224]
    S2 ePowerSvc;Acer ePower Service;c:\program files\Acer\Acer PowerSmart Manager\ePowerSvc.exe [2009-12-03 788512]
    S2 FPSensor;EgisTec-Corp Fingerprint Reader Driver (FPSensor.sys);c:\windows\system32\Drivers\FPSensor.sys [2012-02-24 36400]
    S2 Greg_Service;GRegService;c:\program files (x86)\Acer\Registration\GregHSRW.exe [2009-08-28 1150496]
    S2 IGBASVC;EgisTec Service;c:\program files (x86)\Acer Bio Protection\BASVC.exe [2009-11-10 3450368]
    S2 NTI IScheduleSvc;NTI IScheduleSvc;c:\program files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe [2009-10-29 255744]
    S2 NTISchedulerSvc;NTI Backup Now 5 Scheduler Service;c:\program files (x86)\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe [2009-11-06 144640]
    S2 Skype C2C Service;Skype C2C Service;c:\programdata\Skype\Toolbars\Skype C2C Service\c2c_service.exe [2012-06-19 3048136]
    S2 UNS;Intel(R) Management & Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2009-09-30 2314240]
    S2 Updater Service;Updater Service;c:\program files\Acer\Acer Updater\UpdaterService.exe [2009-07-04 240160]
    S3 HECIx64;Intel(R) Management Engine Interface;c:\windows\system32\DRIVERS\HECIx64.sys [2009-09-17 56344]
    S3 nuvotoncir;Nuvoton IR Transceiver;c:\windows\system32\DRIVERS\nuvotoncir.sys [2009-08-31 48128]
    S3 RTL8187B;Carte réseau USB 2.0 Realtek RTL8187B sans fil 802.11b/g 54 Mbits/s;c:\windows\system32\DRIVERS\RTL8187B.sys [2009-06-10 416768]
    S3 VBoxNetFlt;VirtualBox Bridged Networking Service;c:\windows\system32\DRIVERS\VBoxNetFlt.sys [2011-12-19 165680]
    .
    .
    --- Autres Services/Pilotes en mémoire ---
    .
    *NewlyCreated* - WS2IFSL
    .
    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{35aad3b1-ad8b-11e1-950e-ea3aa75ee337}]
    \shell\AutoRun\command - E:\Autorun.exe
    .
    Contenu du dossier 'Tâches planifiées'
    .
    2012-07-02 c:\windows\Tasks\Adobe Flash Player Updater.job
    - c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-05-25 22:06]
    .
    2012-07-02 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
    - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-02-29 17:40]
    .
    2012-07-02 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
    - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-02-29 17:40]
    .
    2012-07-01 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-492616687-4278636726-398013855-1000Core.job
    - c:\users\acer\AppData\Local\Google\Update\GoogleUpdate.exe [2012-05-20 08:25]
    .
    2012-07-02 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-492616687-4278636726-398013855-1000UA.job
    - c:\users\acer\AppData\Local\Google\Update\GoogleUpdate.exe [2012-05-20 08:25]
    .
    .
    --------- X64 Entries -----------
    .
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\egisPSDP]
    @="{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}"
    [HKEY_CLASSES_ROOT\CLSID\{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}]
    2009-09-10 13:44 137512 ----a-w- c:\program files (x86)\EgisTec\MyWinLocker 3\x64\PSDProtect.dll
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "IAAnotif"="c:\program files (x86)\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2009-10-13 186904]
    "mwlDaemon"="c:\program files (x86)\EgisTec\MyWinLocker 3\x86\mwlDaemon.exe" [2009-09-10 349480]
    "Acer ePower Management"="c:\program files\Acer\Acer PowerSmart Manager\ePowerTrayLauncher.exe" [2009-12-03 496160]
    "RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2009-10-13 8224800]
    "PLFSetI"="c:\windows\PLFSetI.exe" [2009-11-20 200704]
    "combofix"="c:\combofix\CF6556.3XE" [2009-07-14 344576]
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
    "LoadAppInit_DLLs"=0x0
    .
    ------- Examen supplémentaire -------
    .
    uStart Page = hxxp://www.google.fr/
    uLocal Page = c:\windows\system32\blank.htm
    mStart Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=040c&m=aspire_8942g&r=27360212g106l0363z145t4971h237
    mLocal Page = c:\windows\SysWOW64\blank.htm
    IE: Download with &Media Finder - c:\program files (x86)\Media Finder\hook.html
    IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~1\Office12\EXCEL.EXE/3000
    IE: Envoyer au périphérique &Bluetooth... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
    IE: Envoyer l'&image au périphérique Bluetooth... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
    LSP: mswsock.dll
    TCP: DhcpNameServer = 192.168.1.1
    FF - ProfilePath - c:\users\acer\AppData\Roaming\Mozilla\Firefox\Profiles\3h1grxyv.default\
    FF - prefs.js: browser.search.selectedEngine - Google
    FF - prefs.js: browser.startup.homepage - www.google.fr
    FF - prefs.js: keyword.URL - hxxp://search.babylon.com/?affID=112555&tt=100512_3_&babsrc=KW_ss&mntrId=b2ef38de00000000000000871112a3dd&q=
    FF - prefs.js: network.proxy.type - 0
    FF - user.js: extensions.BabylonToolbar_i.babTrack - affID=112555&tt=100512_3_
    FF - user.js: extensions.BabylonToolbar_i.babExt -
    FF - user.js: extensions.BabylonToolbar_i.srcExt - ss
    FF - user.js: extensions.BabylonToolbar_i.id - b2ef38de00000000000000871112a3dd
    FF - user.js: extensions.BabylonToolbar_i.hardId - b2ef38de00000000000000871112a3dd
    FF - user.js: extensions.BabylonToolbar_i.instlDay - 15474
    FF - user.js: extensions.BabylonToolbar_i.vrsn - 1.5.3.17
    FF - user.js: extensions.BabylonToolbar_i.vrsni - 1.5.3.17
    FF - user.js: extensions.BabylonToolbar_i.vrsnTs - 1.5.3.1722:27
    FF - user.js: extensions.BabylonToolbar_i.prtnrId - babylon
    FF - user.js: extensions.BabylonToolbar_i.prdct - BabylonToolbar
    FF - user.js: extensions.BabylonToolbar_i.aflt - babsst
    FF - user.js: extensions.BabylonToolbar_i.smplGrp - none
    FF - user.js: extensions.BabylonToolbar_i.tlbrId - base
    FF - user.js: extensions.BabylonToolbar_i.instlRef - sst
    .
    - - - - ORPHELINS SUPPRIMES - - - -
    .
    Toolbar-Locked - (no file)
    Wow6432Node-HKCU-Run-Media Finder - c:\program files (x86)\Media Finder\Media Finder.exe
    Wow6432Node-HKLM-Run-Tutorials - (no file)
    SafeBoot-mcmscsvc
    SafeBoot-MCODS
    Toolbar-Locked - (no file)
    HKLM-Run-SynTPEnh - c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe
    AddRemove-RON 2010 ENGLISH DL - c:\windows\RON 2010 ENGLISH DL Uninstaller.exe
    AddRemove-{9C049499-055C-4a0c-A916-1D8CA1FF45EB} - c:\program files (x86)\\InstallShield Installation Information\{9C049499-055C-4a0c-A916-1D8CA1FF45EB}\Install.exe
    .
    .
    .
    --------------------- CLES DE REGISTRE BLOQUEES ---------------------
    .
    [HKEY_USERS\S-1-5-21-492616687-4278636726-398013855-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.eml\UserChoice]
    @Denied: (2) (LocalSystem)
    "Progid"="WindowsLiveMail.Email.1"
    .
    [HKEY_USERS\S-1-5-21-492616687-4278636726-398013855-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.vcf\UserChoice]
    @Denied: (2) (LocalSystem)
    "Progid"="WindowsLiveMail.VCard.1"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
    @Denied: (A 2) (Everyone)
    @="FlashBroker"
    "LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_2_202_235_ActiveX.exe,-101"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
    "Enabled"=dword:00000001
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
    @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_2_202_235_ActiveX.exe"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
    @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
    @Denied: (A 2) (Everyone)
    @="Shockwave Flash Object"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
    @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_2_202_235.ocx"
    "ThreadingModel"="Apartment"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
    @="0"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
    @="ShockwaveFlash.ShockwaveFlash.11"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
    @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_2_202_235.ocx, 1"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
    @="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
    @="1.0"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
    @="ShockwaveFlash.ShockwaveFlash"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
    @Denied: (A 2) (Everyone)
    @="Macromedia Flash Factory Object"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
    @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_2_202_235.ocx"
    "ThreadingModel"="Apartment"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
    @="FlashFactory.FlashFactory.1"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
    @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_2_202_235.ocx, 1"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
    @="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
    @="1.0"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
    @="FlashFactory.FlashFactory"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
    @Denied: (A 2) (Everyone)
    @="IFlashBroker4"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
    @="{00020424-0000-0000-C000-000000000046}"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
    @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
    "Version"="1.0"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
    @Denied: (Full) (Everyone)
    .
    ------------------------ Autres processus actifs ------------------------
    .
    c:\program files (x86)\Acer Bio Protection\CompPtcVUI.exe
    c:\program files (x86)\Avira\AntiVir Desktop\avguard.exe
    c:\program files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
    c:\program files (x86)\Intel\Intel Matrix Storage Manager\IAANTMon.exe
    c:\progra~2\EASYPH~1.9\Apache\bin\apache.exe
    c:\progra~2\EASYPH~1.9\MySql\bin\mysqld.exe
    c:\progra~2\EASYPH~1.9\Apache\bin\apache.exe
    c:\program files (x86)\avira\antivir desktop\avcenter.exe
    c:\program files (x86)\Avira\AntiVir Desktop\update.exe
    c:\program files (x86)\Avira\AntiVir Desktop\updrgui.exe
    .
    **************************************************************************
    .
    Heure de fin: 2012-07-02 18:47:21 - La machine a redémarré
    ComboFix-quarantined-files.txt 2012-07-02 16:47
    .
    Avant-CF: 409 945 890 816 octets libres
    Après-CF: 410 823 184 384 octets libres
    .
    - - End Of File - - DA446B7CF1453BFA6EFCEC88136EAC57
    0
  3. Destrio5 Messages postés 99820 Date d'inscription   Statut Modérateur Dernière intervention   10 324
     
    "c:\windows\system32\services.exe . . . est infecté!!"

    --> Refais une analyse avec ComboFix.
    0
  4. max19 Messages postés 68 Statut Membre
     
    ComboFix 12-07-02.01 - acer 02/07/2012 19:35:27.2.4 - x64
    Microsoft Windows 7 Édition Familiale Premium 6.1.7600.0.1252.33.1036.18.3957.2628 [GMT 2:00]
    Lancé depuis: c:\users\acer\Downloads\ComboFix.exe
    AV: Avira Desktop *Disabled/Outdated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
    SP: Avira Desktop *Disabled/Outdated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
    SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
    .
    .
    (((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    Une copie infectée de c:\windows\system32\Services.exe a été trouvée et désinfectée
    Copie restaurée à partir de - c:\windows\winsxs\amd64_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.1.7600.16385_none_2b54b20ee6fa07b1\services.exe
    .
    .
    ((((((((((((((((((((((((((((( Fichiers créés du 2012-06-02 au 2012-07-02 ))))))))))))))))))))))))))))))))))))
    .
    .
    2012-07-02 17:43 . 2012-07-02 17:43 -------- d-----w- c:\users\Default\AppData\Local\temp
    2012-07-02 15:38 . 2012-07-02 15:38 -------- d-----w- c:\program files (x86)\Common Files\Java
    2012-07-02 15:37 . 2012-07-02 15:37 -------- d-----w- c:\program files (x86)\Oracle
    2012-07-02 15:36 . 2012-05-04 17:29 772504 ----a-w- c:\windows\SysWow64\npDeployJava1.dll
    2012-07-02 15:34 . 2012-07-02 15:34 -------- d-----w- c:\program files (x86)\Java
    2012-07-02 14:54 . 2012-07-02 14:54 -------- d-----w- c:\users\acer\AppData\Roaming\Avira
    2012-07-02 14:49 . 2011-12-01 15:55 97312 ----a-w- c:\windows\system32\drivers\avgntflt.sys
    2012-07-02 14:49 . 2011-12-01 15:55 27760 ----a-w- c:\windows\system32\drivers\avkmgr.sys
    2012-07-02 14:49 . 2011-12-01 15:55 130760 ----a-w- c:\windows\system32\drivers\avipbb.sys
    2012-07-02 14:49 . 2012-07-02 14:49 -------- d-----w- c:\programdata\Avira
    2012-07-02 14:49 . 2012-07-02 14:49 -------- d-----w- c:\program files (x86)\Avira
    2012-07-02 13:50 . 2012-07-02 13:51 -------- d-----w- c:\program files (x86)\EasyPHP-5.3.9
    2012-06-28 07:45 . 2012-06-28 07:45 -------- d-----w- c:\program files\CCleaner
    2012-06-25 13:47 . 2012-06-25 13:47 -------- d-----w- c:\program files (x86)\Notepad++
    2012-06-24 13:39 . 2012-06-24 13:39 -------- d-----w- c:\users\acer\AppData\Roaming\My Games
    2012-06-24 13:30 . 2012-06-24 13:30 -------- d-----w- c:\program files (x86)\Firaxis Games
    2012-06-24 13:30 . 2005-04-03 21:02 69714 ----a-w- c:\program files (x86)\Common Files\InstallShield\Professional\RunTime\11\00\Intel32\ctor.dll
    2012-06-24 13:30 . 2005-04-03 21:01 274432 ----a-w- c:\program files (x86)\Common Files\InstallShield\Professional\RunTime\11\00\Intel32\iscript.dll
    2012-06-24 13:30 . 2005-04-03 21:00 184320 ----a-w- c:\program files (x86)\Common Files\InstallShield\Professional\RunTime\11\00\Intel32\iuser.dll
    2012-06-24 13:30 . 2005-04-03 21:00 63488 ----a-w- c:\program files (x86)\Common Files\InstallShield\Professional\RunTime\11\00\Intel32\ISBEW64.exe
    2012-06-24 13:30 . 2005-04-03 20:59 5632 ----a-w- c:\program files (x86)\Common Files\InstallShield\Professional\RunTime\11\00\Intel32\DotNetInstaller.exe
    2012-06-24 13:30 . 2005-04-03 21:02 753664 ----a-w- c:\program files (x86)\Common Files\InstallShield\Professional\RunTime\11\00\Intel32\iKernel.dll
    2012-06-24 13:30 . 2012-06-24 13:30 200836 ----a-w- c:\program files (x86)\Common Files\InstallShield\Professional\RunTime\11\00\Intel32\iGdi.dll
    2012-06-24 13:30 . 2012-06-24 13:30 331908 ----a-w- c:\program files (x86)\Common Files\InstallShield\Professional\RunTime\11\00\Intel32\setup.dll
    2012-06-24 07:41 . 2012-06-24 07:41 -------- d-----w- c:\users\acer\AppData\Local\Macromedia
    2012-06-22 07:13 . 2012-06-02 22:19 57880 ----a-w- c:\windows\system32\wuauclt.exe
    2012-06-22 07:13 . 2012-06-02 22:19 44056 ----a-w- c:\windows\system32\wups2.dll
    2012-06-22 07:13 . 2012-06-02 22:19 2428952 ----a-w- c:\windows\system32\wuaueng.dll
    2012-06-22 07:13 . 2012-06-02 22:15 2622464 ----a-w- c:\windows\system32\wucltux.dll
    2012-06-22 07:12 . 2012-06-02 22:19 38424 ----a-w- c:\windows\system32\wups.dll
    2012-06-22 07:12 . 2012-06-02 22:19 701976 ----a-w- c:\windows\system32\wuapi.dll
    2012-06-22 07:12 . 2012-06-02 22:15 99840 ----a-w- c:\windows\system32\wudriver.dll
    2012-06-22 07:11 . 2012-06-02 13:19 186752 ----a-w- c:\windows\system32\wuwebv.dll
    2012-06-22 07:11 . 2012-06-02 13:15 36864 ----a-w- c:\windows\system32\wuapp.exe
    2012-06-21 15:21 . 2012-06-21 15:21 770384 ----a-w- c:\program files (x86)\Mozilla Firefox\msvcr100.dll
    2012-06-21 15:21 . 2012-06-21 15:21 421200 ----a-w- c:\program files (x86)\Mozilla Firefox\msvcp100.dll
    2012-06-19 15:35 . 2012-06-19 15:35 4967624 ----a-w- c:\program files (x86)\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}\components\SkypeFfComponent.dll
    2012-06-16 20:36 . 2012-03-06 23:02 28504 ----a-w- c:\windows\system32\drivers\aswKbd.sys
    2012-06-16 07:56 . 2012-05-18 02:01 499200 ----a-w- c:\program files\Internet Explorer\jsdbgui.dll
    2012-06-16 07:56 . 2012-05-17 22:38 678912 ----a-w- c:\program files (x86)\Internet Explorer\iedvtool.dll
    2012-06-16 07:56 . 2012-05-18 02:02 887296 ----a-w- c:\program files\Internet Explorer\iedvtool.dll
    2012-06-13 20:43 . 2012-05-04 10:52 5505392 ----a-w- c:\windows\system32\ntoskrnl.exe
    2012-06-13 20:43 . 2012-05-04 10:08 3902320 ----a-w- c:\windows\SysWow64\ntoskrnl.exe
    2012-06-13 20:43 . 2012-05-04 10:08 3958128 ----a-w- c:\windows\SysWow64\ntkrnlpa.exe
    2012-06-13 20:05 . 2012-04-26 05:34 149504 ----a-w- c:\windows\system32\rdpcorekmts.dll
    2012-06-13 20:05 . 2012-04-26 05:34 76288 ----a-w- c:\windows\system32\rdpwsx.dll
    2012-06-13 20:05 . 2012-04-26 05:28 9216 ----a-w- c:\windows\system32\rdrmemptylst.exe
    2012-06-13 20:04 . 2012-05-02 05:32 208896 ----a-w- c:\windows\system32\profsvc.dll
    2012-06-13 19:59 . 2012-05-15 01:32 3144192 ----a-w- c:\windows\system32\win32k.sys
    2012-06-13 19:59 . 2012-04-28 03:50 204800 ----a-w- c:\windows\system32\drivers\rdpwd.sys
    2012-06-13 19:59 . 2012-04-07 12:18 3213824 ----a-w- c:\windows\system32\msi.dll
    2012-06-13 19:59 . 2012-04-07 11:34 2342400 ----a-w- c:\windows\SysWow64\msi.dll
    2012-06-13 19:59 . 2012-04-24 05:59 1460224 ----a-w- c:\windows\system32\crypt32.dll
    2012-06-13 19:59 . 2012-04-24 04:47 1156608 ----a-w- c:\windows\SysWow64\crypt32.dll
    2012-06-13 19:59 . 2012-04-24 05:59 182272 ----a-w- c:\windows\system32\cryptsvc.dll
    2012-06-13 19:59 . 2012-04-24 05:59 140288 ----a-w- c:\windows\system32\cryptnet.dll
    2012-06-13 19:59 . 2012-04-24 04:47 139264 ----a-w- c:\windows\SysWow64\cryptsvc.dll
    2012-06-13 19:59 . 2012-04-24 04:47 103936 ----a-w- c:\windows\SysWow64\cryptnet.dll
    2012-06-10 08:04 . 2012-06-11 19:43 -------- d-----w- c:\program files (x86)\EA GAMES
    2012-06-10 08:04 . 2004-08-18 08:34 442368 ----a-r- c:\windows\SysWow64\vp6vfw.dll
    2012-06-09 19:35 . 2012-06-09 19:35 283200 ----a-w- c:\windows\system32\drivers\dtsoftbus01.sys
    2012-06-09 19:35 . 2012-06-28 07:48 -------- d-----w- c:\users\acer\AppData\Roaming\DAEMON Tools Lite
    2012-06-09 19:34 . 2012-06-09 19:35 -------- d-----w- c:\program files (x86)\DAEMON Tools Lite
    2012-06-09 15:36 . 2012-06-10 08:01 -------- d-----w- c:\programdata\DAEMON Tools Lite
    .
    .
    .
    (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2012-06-23 22:05 . 2012-05-25 19:22 426184 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
    2012-06-23 22:05 . 2012-02-29 20:57 70344 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
    2012-05-17 15:48 . 2012-05-06 08:30 772114 ----a-w- c:\windows\RON 2010 FRENCH DL Uninstaller.exe
    2012-05-04 17:29 . 2012-03-10 11:40 687504 ----a-w- c:\windows\SysWow64\deployJava1.dll
    2012-04-08 08:23 . 2012-04-08 08:23 40960 ----a-r- c:\users\acer\AppData\Roaming\Microsoft\Installer\{9559F7CA-5E34-4237-A2D9-D856464AD727}\NewShortcut1_9559F7CA5E344237A2D9D856464AD727.exe
    2012-04-08 08:23 . 2012-04-08 08:23 40960 ----a-r- c:\users\acer\AppData\Roaming\Microsoft\Installer\{9559F7CA-5E34-4237-A2D9-D856464AD727}\ARPPRODUCTICON.exe
    2012-04-04 13:56 . 2012-05-10 19:50 24904 ----a-w- c:\windows\system32\drivers\mbam.sys
    .
    .
    ((((((((((((((((((((((((((((( SnapShot@2012-07-02_16.22.30 )))))))))))))))))))))))))))))))))))))))))
    .
    + 2009-12-02 03:45 . 2012-07-02 17:46 48282 c:\windows\system32\wdi\ShutdownPerformanceDiagnostics_SystemData.bin
    + 2009-07-14 05:10 . 2012-07-02 17:46 40168 c:\windows\system32\wdi\BootPerformanceDiagnostics_SystemData.bin
    + 2012-02-24 19:13 . 2012-07-02 17:46 7624 c:\windows\system32\wdi\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-492616687-4278636726-398013855-1000_UserData.bin
    + 2012-07-02 17:44 . 2012-07-02 17:44 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
    - 2012-07-02 16:21 . 2012-07-02 16:21 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
    + 2012-07-02 17:44 . 2012-07-02 17:44 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
    - 2012-07-02 16:21 . 2012-07-02 16:21 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
    + 2009-07-13 23:19 . 2009-07-14 01:39 328704 c:\windows\system32\Services.exe
    - 2009-07-14 05:01 . 2012-07-02 16:20 323228 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat
    + 2009-07-14 05:01 . 2012-07-02 17:43 323228 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat
    + 2012-02-29 21:01 . 2012-07-02 17:43 854735 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-492616687-4278636726-398013855-1000-12288.dat
    - 2012-02-29 21:01 . 2012-07-02 16:20 854735 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-492616687-4278636726-398013855-1000-12288.dat
    - 2009-07-14 02:34 . 2012-07-02 13:05 10485760 c:\windows\system32\SMI\Store\Machine\SCHEMA.DAT
    + 2009-07-14 02:34 . 2012-07-02 16:37 10485760 c:\windows\system32\SMI\Store\Machine\SCHEMA.DAT
    .
    ((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
    REGEDIT4
    .
    [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\egisPSDP]
    @="{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}"
    [HKEY_CLASSES_ROOT\CLSID\{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}]
    2009-09-10 13:41 120104 ----a-w- c:\program files (x86)\EgisTec\MyWinLocker 3\x86\PSDProtect.dll
    .
    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2012-06-02 4786048]
    "EA Core"="c:\program files (x86)\Electronic Arts\EADM\Core.exe" [2009-03-28 3325952]
    "Skype"="c:\program files (x86)\Skype\Phone\Skype.exe" [2012-05-03 17355912]
    "swg"="c:\program files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-12-02 39408]
    "ShowBatteryBar"="c:\program files\BatteryBar\ShowBatteryBar.exe" [2009-05-28 89600]
    "DAEMON Tools Lite"="c:\program files (x86)\DAEMON Tools Lite\DTLite.exe" [2012-04-17 3671872]
    "Speech Recognition"="c:\windows\Speech\Common\sapisvr.exe" [2009-07-14 44544]
    "EasyPHP"="c:\program files (x86)\EasyPHP-5.3.9\EasyPHP-5.3.9.exe" [2011-07-13 496640]
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
    "EgisTecLiveUpdate"="c:\program files (x86)\EgisTec Egis Software Update\EgisUpdate.exe" [2009-08-04 199464]
    "BackupManagerTray"="c:\program files (x86)\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe" [2009-10-29 261888]
    "NortonOnlineBackupReminder"="c:\program files (x86)\Symantec\Norton Online Backup\Activation\NobuActivation.exe" [2009-07-25 588648]
    "StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2009-11-23 98304]
    "LManager"="c:\program files (x86)\Launch Manager\LManager.exe" [2009-09-24 825864]
    "EgisTecPMMUpdate"="c:\program files (x86)\EgisTec IPS\PmmUpdate.exe" [2009-12-08 401192]
    "EgisUpdate"="c:\program files (x86)\EgisTec IPS\EgisUpdate.exe" [2009-12-08 201512]
    "VitaKeyPdtWzd"="c:\program files (x86)\Acer Bio Protection\PdtWzd.exe" [2009-11-10 3569152]
    "ArcadeDeluxeAgent"="c:\program files (x86)\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe" [2009-10-29 419112]
    "PlayMovie"="c:\program files (x86)\Acer Arcade Deluxe\PlayMovie\PMVService.exe" [2009-11-12 181480]
    "Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe" [2011-01-30 35736]
    "Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-11-10 932288]
    "avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2011-12-01 258512]
    "SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2012-01-17 252296]
    .
    c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
    Acer VCM.lnk - c:\program files (x86)\Acer\Acer VCM\AcerVCM.exe [2009-12-2 708608]
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
    "ConsentPromptBehaviorAdmin"= 0 (0x0)
    "ConsentPromptBehaviorUser"= 3 (0x3)
    "EnableLUA"= 0 (0x0)
    "EnableUIADesktopToggle"= 0 (0x0)
    "PromptOnSecureDesktop"= 0 (0x0)
    .
    [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
    "aux5"=wdmaud.drv
    .
    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
    Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\!SASCORE]
    @=""
    .
    R2 0069251341244939mcinstcleanup;McAfee Application Installer Cleanup (0069251341244939);c:\users\acer\AppData\Local\Temp\006925~1.EXE [x]
    R2 avast! Firewall;avast! Firewall;c:\program files\AVAST Software\Avast\afwServ.exe [x]
    R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
    R2 gupdate;Service Google Update (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-02-29 135664]
    R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe [2012-05-03 158856]
    R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-06-23 250056]
    R3 btusbflt;Bluetooth USB Filter;c:\windows\system32\drivers\btusbflt.sys [2009-07-01 52264]
    R3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\DRIVERS\btwl2cap.sys [2009-04-07 35104]
    R3 gupdatem;Service Google Update (gupdatem);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-02-29 135664]
    R3 hidshim;Service for HID-KMDF Shim layer;c:\windows\system32\DRIVERS\hidshim.sys [2009-08-31 6656]
    R3 k57nd60a;Broadcom NetLink (TM) Gigabit Ethernet - NDIS 6.0;c:\windows\system32\DRIVERS\k57nd60a.sys [2009-08-06 320040]
    R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2012-04-04 24904]
    R3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2012-06-21 113120]
    R3 MWLService;MyWinLocker Service;c:\program files (x86)\EgisTec\MyWinLocker 3\x86\\MWLService.exe [2009-09-10 305448]
    R3 NETw5s64;Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows 7 - 64 Bit;c:\windows\system32\DRIVERS\NETw5s64.sys [2009-09-15 6952960]
    R3 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [2010-06-25 35344]
    R3 NTIBackupSvc;NTI Backup Now 5 Backup Service;c:\program files (x86)\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe [2009-11-06 50432]
    R3 nuvotonhidcir;Nuvoton HID CIR Receiver;c:\windows\system32\DRIVERS\nuvotonhidcir.sys [2009-08-31 26624]
    R3 nuvotonir;Nuvoton CIR Transceiver;c:\windows\system32\DRIVERS\nuvotonir.sys [2009-08-31 68096]
    R3 RTL8187B;Carte réseau USB 2.0 Realtek RTL8187B sans fil 802.11b/g 54 Mbits/s;c:\windows\system32\DRIVERS\RTL8187B.sys [2009-06-10 416768]
    R3 RTL8192su;Realtek RTL8192SU Wireless LAN 802.11n USB 2.0 Network Adapter;c:\windows\system32\DRIVERS\RTL8192su.sys [2009-10-14 674304]
    R3 VBoxNetAdp;VirtualBox Host-Only Ethernet Adapter;c:\windows\system32\DRIVERS\VBoxNetAdp.sys [2011-12-19 146736]
    R3 WatAdminSvc;Service Windows Activation Technologies;c:\windows\system32\Wat\WatAdminSvc.exe [2012-03-02 1255736]
    R4 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2012-04-04 654408]
    R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-22 57184]
    S0 johci;JMicron 1394 Filter Driver;c:\windows\system32\DRIVERS\johci.sys [2009-08-24 22640]
    S1 aswKbd;aswKbd; [x]
    S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys [2011-12-01 27760]
    S1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys [2012-06-09 283200]
    S1 mwlPSDFilter;mwlPSDFilter;c:\windows\system32\DRIVERS\mwlPSDFilter.sys [2009-06-02 22576]
    S1 mwlPSDNServ;mwlPSDNServ;c:\windows\system32\DRIVERS\mwlPSDNServ.sys [2009-06-02 20016]
    S1 mwlPSDVDisk;mwlPSDVDisk;c:\windows\system32\DRIVERS\mwlPSDVDisk.sys [2009-06-02 60464]
    S1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV64.SYS [2011-07-22 14928]
    S1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL64.SYS [2011-07-12 12368]
    S1 VBoxDrv;VirtualBox Service;c:\windows\system32\DRIVERS\VBoxDrv.sys [2011-12-19 224048]
    S1 VBoxUSBMon;VirtualBox USB Monitor Driver;c:\windows\system32\DRIVERS\VBoxUSBMon.sys [2011-12-19 130864]
    S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-14 59904]
    S2 !SASCORE;SAS Core Service;c:\program files\SUPERAntiSpyware\SASCORE64.EXE [2011-08-11 140672]
    S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2009-11-23 202752]
    S2 AntiVirSchedulerService;Avira Planificateur;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe [2011-12-01 86224]
    S2 ePowerSvc;Acer ePower Service;c:\program files\Acer\Acer PowerSmart Manager\ePowerSvc.exe [2009-12-03 788512]
    S2 FPSensor;EgisTec-Corp Fingerprint Reader Driver (FPSensor.sys);c:\windows\system32\Drivers\FPSensor.sys [2012-02-24 36400]
    S2 Greg_Service;GRegService;c:\program files (x86)\Acer\Registration\GregHSRW.exe [2009-08-28 1150496]
    S2 IGBASVC;EgisTec Service;c:\program files (x86)\Acer Bio Protection\BASVC.exe [2009-11-10 3450368]
    S2 NTI IScheduleSvc;NTI IScheduleSvc;c:\program files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe [2009-10-29 255744]
    S2 NTISchedulerSvc;NTI Backup Now 5 Scheduler Service;c:\program files (x86)\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe [2009-11-06 144640]
    S2 RS_Service;Raw Socket Service;c:\program files (x86)\Acer\Acer VCM\RS_Service.exe [2009-07-10 253952]
    S2 Skype C2C Service;Skype C2C Service;c:\programdata\Skype\Toolbars\Skype C2C Service\c2c_service.exe [2012-06-19 3048136]
    S2 UNS;Intel(R) Management & Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2009-09-30 2314240]
    S2 Updater Service;Updater Service;c:\program files\Acer\Acer Updater\UpdaterService.exe [2009-07-04 240160]
    S3 HECIx64;Intel(R) Management Engine Interface;c:\windows\system32\DRIVERS\HECIx64.sys [2009-09-17 56344]
    S3 nuvotoncir;Nuvoton IR Transceiver;c:\windows\system32\DRIVERS\nuvotoncir.sys [2009-08-31 48128]
    S3 VBoxNetFlt;VirtualBox Bridged Networking Service;c:\windows\system32\DRIVERS\VBoxNetFlt.sys [2011-12-19 165680]
    .
    .
    Contenu du dossier 'Tâches planifiées'
    .
    2012-07-02 c:\windows\Tasks\Adobe Flash Player Updater.job
    - c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-05-25 22:06]
    .
    2012-07-02 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
    - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-02-29 17:40]
    .
    2012-07-02 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
    - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-02-29 17:40]
    .
    2012-07-01 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-492616687-4278636726-398013855-1000Core.job
    - c:\users\acer\AppData\Local\Google\Update\GoogleUpdate.exe [2012-05-20 08:25]
    .
    2012-07-02 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-492616687-4278636726-398013855-1000UA.job
    - c:\users\acer\AppData\Local\Google\Update\GoogleUpdate.exe [2012-05-20 08:25]
    .
    .
    --------- X64 Entries -----------
    .
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\egisPSDP]
    @="{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}"
    [HKEY_CLASSES_ROOT\CLSID\{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}]
    2009-09-10 13:44 137512 ----a-w- c:\program files (x86)\EgisTec\MyWinLocker 3\x64\PSDProtect.dll
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "IAAnotif"="c:\program files (x86)\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2009-10-13 186904]
    "mwlDaemon"="c:\program files (x86)\EgisTec\MyWinLocker 3\x86\mwlDaemon.exe" [2009-09-10 349480]
    "Acer ePower Management"="c:\program files\Acer\Acer PowerSmart Manager\ePowerTrayLauncher.exe" [2009-12-03 496160]
    "RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2009-10-13 8224800]
    "SynTPEnh"="c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe" [BU]
    "PLFSetI"="c:\windows\PLFSetI.exe" [2009-11-20 200704]
    .
    ------- Examen supplémentaire -------
    .
    uStart Page = hxxp://www.google.fr/
    uLocal Page = c:\windows\system32\blank.htm
    mStart Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=040c&m=aspire_8942g&r=27360212g106l0363z145t4971h237
    mLocal Page = c:\windows\SysWOW64\blank.htm
    IE: Download with &Media Finder - c:\program files (x86)\Media Finder\hook.html
    IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~1\Office12\EXCEL.EXE/3000
    IE: Envoyer au périphérique &Bluetooth... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
    IE: Envoyer l'&image au périphérique Bluetooth... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
    TCP: DhcpNameServer = 192.168.1.1
    FF - ProfilePath - c:\users\acer\AppData\Roaming\Mozilla\Firefox\Profiles\3h1grxyv.default\
    FF - prefs.js: browser.search.selectedEngine - Google
    FF - prefs.js: browser.startup.homepage - www.google.fr
    FF - prefs.js: keyword.URL - hxxp://search.babylon.com/?affID=112555&tt=100512_3_&babsrc=KW_ss&mntrId=b2ef38de00000000000000871112a3dd&q=
    FF - prefs.js: network.proxy.type - 0
    FF - user.js: extensions.BabylonToolbar_i.babTrack - affID=112555&tt=100512_3_
    FF - user.js: extensions.BabylonToolbar_i.babExt -
    FF - user.js: extensions.BabylonToolbar_i.srcExt - ss
    FF - user.js: extensions.BabylonToolbar_i.id - b2ef38de00000000000000871112a3dd
    FF - user.js: extensions.BabylonToolbar_i.hardId - b2ef38de00000000000000871112a3dd
    FF - user.js: extensions.BabylonToolbar_i.instlDay - 15474
    FF - user.js: extensions.BabylonToolbar_i.vrsn - 1.5.3.17
    FF - user.js: extensions.BabylonToolbar_i.vrsni - 1.5.3.17
    FF - user.js: extensions.BabylonToolbar_i.vrsnTs - 1.5.3.1722:27
    FF - user.js: extensions.BabylonToolbar_i.prtnrId - babylon
    FF - user.js: extensions.BabylonToolbar_i.prdct - BabylonToolbar
    FF - user.js: extensions.BabylonToolbar_i.aflt - babsst
    FF - user.js: extensions.BabylonToolbar_i.smplGrp - none
    FF - user.js: extensions.BabylonToolbar_i.tlbrId - base
    FF - user.js: extensions.BabylonToolbar_i.instlRef - sst
    .
    - - - - ORPHELINS SUPPRIMES - - - -
    .
    Toolbar-Locked - (no file)
    .
    .
    .
    --------------------- CLES DE REGISTRE BLOQUEES ---------------------
    .
    [HKEY_USERS\S-1-5-21-492616687-4278636726-398013855-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.eml\UserChoice]
    @Denied: (2) (LocalSystem)
    "Progid"="WindowsLiveMail.Email.1"
    .
    [HKEY_USERS\S-1-5-21-492616687-4278636726-398013855-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.vcf\UserChoice]
    @Denied: (2) (LocalSystem)
    "Progid"="WindowsLiveMail.VCard.1"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
    @Denied: (A 2) (Everyone)
    @="FlashBroker"
    "LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_2_202_235_ActiveX.exe,-101"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
    "Enabled"=dword:00000001
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
    @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_2_202_235_ActiveX.exe"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
    @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
    @Denied: (A 2) (Everyone)
    @="Shockwave Flash Object"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
    @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_2_202_235.ocx"
    "ThreadingModel"="Apartment"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
    @="0"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
    @="ShockwaveFlash.ShockwaveFlash.11"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
    @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_2_202_235.ocx, 1"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
    @="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
    @="1.0"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
    @="ShockwaveFlash.ShockwaveFlash"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
    @Denied: (A 2) (Everyone)
    @="Macromedia Flash Factory Object"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
    @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_2_202_235.ocx"
    "ThreadingModel"="Apartment"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
    @="FlashFactory.FlashFactory.1"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
    @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_2_202_235.ocx, 1"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
    @="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
    @="1.0"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
    @="FlashFactory.FlashFactory"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
    @Denied: (A 2) (Everyone)
    @="IFlashBroker4"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
    @="{00020424-0000-0000-C000-000000000046}"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
    @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
    "Version"="1.0"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
    @Denied: (Full) (Everyone)
    .
    ------------------------ Autres processus actifs ------------------------
    .
    c:\program files (x86)\Acer Bio Protection\CompPtcVUI.exe
    c:\program files (x86)\Avira\AntiVir Desktop\avguard.exe
    c:\program files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
    c:\program files (x86)\Intel\Intel Matrix Storage Manager\IAANTMon.exe
    c:\progra~2\EASYPH~1.9\MySql\bin\mysqld.exe
    .
    **************************************************************************
    .
    Heure de fin: 2012-07-02 19:54:13 - La machine a redémarré
    ComboFix-quarantined-files.txt 2012-07-02 17:54
    ComboFix2.txt 2012-07-02 16:47
    .
    Avant-CF: 410 793 984 000 octets libres
    Après-CF: 410 407 309 312 octets libres
    .
    - - End Of File - - 945B5A6D4D7F140FB7A2D6BF25F81803
    0

  5. Vous n’avez pas trouvé la réponse que vous recherchez ?

    Posez votre question
  6. Destrio5 Messages postés 99820 Date d'inscription   Statut Modérateur Dernière intervention   10 324
     
    "Une copie infectée de c:\windows\system32\Services.exe a été trouvée et désinfectée "

    --> Bien.

    On va s'occuper des adwares :

    --> Télécharge et lance AdwCleaner (de Xplode), choisis l'option "Suppression" et poste le rapport :
    http://general-changelog-team.fr/fr/downloads/viewdownload/20-outils-de-xplode/2-adwcleaner
    0
  7. max19 Messages postés 68 Statut Membre
     
    # AdwCleaner v1.701 - Rapport créé le 03/07/2012 à 10:02:12
    # Mis à jour le 02/07/2012 par Xplode
    # Système d'exploitation : Windows 7 Home Premium (64 bits)
    # Nom d'utilisateur : acer - ACER-PC
    # Exécuté depuis : C:\Users\acer\Downloads\adwcleaner.exe
    # Option [Recherche]

    ***** [Services] *****

    ***** [Fichiers / Dossiers] *****

    Dossier Présent : C:\Users\acer\AppData\Local\Babylon
    Dossier Présent : C:\Users\acer\AppData\Roaming\Babylon
    Dossier Présent : C:\Users\acer\AppData\Roaming\Media Finder
    Dossier Présent : C:\Users\acer\AppData\Roaming\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}\gencrawler@some.com
    Dossier Présent : C:\ProgramData\Babylon
    Dossier Présent : C:\ProgramData\boost_interprocess
    Dossier Présent : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Media Finder
    Fichier Présent : C:\Users\acer\AppData\Roaming\Mozilla\Firefox\Profiles\3h1grxyv.default\searchplugins\SweetIm.xml
    Fichier Présent : C:\Users\Public\Desktop\eBay.lnk
    Fichier Présent : C:\Program Files (x86)\Mozilla Firefox\searchplugins\babylon.xml

    ***** [Registre] *****

    Clé Présente : HKCU\Software\MediaFinder
    Clé Présente : HKCU\Software\Microsoft\Internet Explorer\MenuExt\Download with &Media Finder
    Clé Présente : HKCU\Software\Softonic
    Clé Présente : HKCU\Software\SweetIm
    Clé Présente : HKCU\Software\Tutorials
    Clé Présente : HKLM\SOFTWARE\Babylon
    Clé Présente : HKLM\SOFTWARE\Classes\AppID\escort.DLL
    Clé Présente : HKLM\SOFTWARE\Classes\MF
    Clé Présente : HKLM\SOFTWARE\Google\Chrome\Extensions\dednnpigldgdbpgcdpfppmlcnnbjciel
    Clé Présente : HKLM\SOFTWARE\Google\Chrome\Extensions\lpmkgpnbiojfaoklbkpfneikocaobfai
    Clé Présente : HKLM\SOFTWARE\SweetIM
    [x64] Clé Présente : HKCU\Software\MediaFinder
    [x64] Clé Présente : HKCU\Software\Microsoft\Internet Explorer\MenuExt\Download with &Media Finder
    [x64] Clé Présente : HKCU\Software\Softonic
    [x64] Clé Présente : HKCU\Software\SweetIm
    [x64] Clé Présente : HKCU\Software\Tutorials
    [x64] Clé Présente : HKLM\SOFTWARE\Classes\AppID\escort.DLL
    [x64] Clé Présente : HKLM\SOFTWARE\Classes\MF

    ***** [Registre - GUID] *****

    Clé Présente : HKLM\SOFTWARE\Classes\AppID\{09C554C3-109B-483C-A06B-F14172F1A947}
    Clé Présente : HKLM\SOFTWARE\Classes\AppID\{BDB69379-802F-4EAF-B541-F8DE92DD98DB}
    Clé Présente : HKLM\SOFTWARE\Classes\CLSID\{2EECD738-5844-4A99-B4B6-146BF802613B}
    Clé Présente : HKLM\SOFTWARE\Classes\CLSID\{E46C8196-B634-44A1-AF6E-957C64278AB1}
    Clé Présente : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4D79-A620-CCE0C0A66CC9}
    Clé Présente : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{2EECD738-5844-4A99-B4B6-146BF802613B}
    Clé Présente : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{97F2FF5B-260C-4CCF-834A-2DDA4E29E39E}
    Clé Présente : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{EEE6C35C-6118-11DC-9C72-001320C79847}
    Clé Présente : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2EECD738-5844-4A99-B4B6-146BF802613B}
    [x64] Clé Présente : HKLM\SOFTWARE\Classes\AppID\{09C554C3-109B-483C-A06B-F14172F1A947}
    [x64] Clé Présente : HKLM\SOFTWARE\Classes\AppID\{BDB69379-802F-4EAF-B541-F8DE92DD98DB}
    [x64] Clé Présente : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4D79-A620-CCE0C0A66CC9}
    [x64] Clé Présente : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{2EECD738-5844-4A99-B4B6-146BF802613B}
    [x64] Clé Présente : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{97F2FF5B-260C-4CCF-834A-2DDA4E29E39E}
    [x64] Clé Présente : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{EEE6C35C-6118-11DC-9C72-001320C79847}
    [x64] Clé Présente : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2EECD738-5844-4A99-B4B6-146BF802613B}

    ***** [Navigateurs] *****

    -\\ Internet Explorer v9.0.8112.16421

    [OK] Le registre ne contient aucune entrée illégitime.

    -\\ Mozilla Firefox v13.0.1 (fr)

    Nom du profil : default
    Fichier : C:\Users\acer\AppData\Roaming\Mozilla\Firefox\Profiles\3h1grxyv.default\prefs.js

    Présente : user_pref("browser.babylon.HPOnNewTab", "search.babylon.com");
    Présente : user_pref("browser.search.defaultenginename", "Search the web (Babylon)");
    Présente : user_pref("browser.search.order.1", "Search the web (Babylon)");
    Présente : user_pref("extensions.BabylonToolbar_i.aflt", "babsst");
    Présente : user_pref("extensions.BabylonToolbar_i.babExt", "");
    Présente : user_pref("extensions.BabylonToolbar_i.babTrack", "affID=112555&tt=100512_3_");
    Présente : user_pref("extensions.BabylonToolbar_i.hardId", "b2ef38de00000000000000871112a3dd");
    Présente : user_pref("extensions.BabylonToolbar_i.id", "b2ef38de00000000000000871112a3dd");
    Présente : user_pref("extensions.BabylonToolbar_i.instlDay", "15474");
    Présente : user_pref("extensions.BabylonToolbar_i.instlRef", "sst");
    Présente : user_pref("extensions.BabylonToolbar_i.newTab", true);
    Présente : user_pref("extensions.BabylonToolbar_i.newTabUrl", "hxxp://search.babylon.com/?affID=112555&tt=10051[...]
    Présente : user_pref("extensions.BabylonToolbar_i.prdct", "BabylonToolbar");
    Présente : user_pref("extensions.BabylonToolbar_i.prtnrId", "babylon");
    Présente : user_pref("extensions.BabylonToolbar_i.smplGrp", "none");
    Présente : user_pref("extensions.BabylonToolbar_i.srcExt", "ss");
    Présente : user_pref("extensions.BabylonToolbar_i.tlbrId", "base");
    Présente : user_pref("extensions.BabylonToolbar_i.vrsn", "1.5.3.17");
    Présente : user_pref("extensions.BabylonToolbar_i.vrsnTs", "1.5.3.1722:27:00");
    Présente : user_pref("extensions.BabylonToolbar_i.vrsni", "1.5.3.17");
    Présente : user_pref("keyword.URL", "hxxp://search.babylon.com/?affID=112555&tt=100512_3_&babsrc=KW_ss&mntrId=b[...]

    *************************

    AdwCleaner[R1].txt - [5839 octets] - [03/07/2012 10:02:12]

    ########## EOF - C:\AdwCleaner[R1].txt - [5967 octets] ##########
    0
  8. Destrio5 Messages postés 99820 Date d'inscription   Statut Modérateur Dernière intervention   10 324
     
    Tu as utilisé l'option "Recherche" d'AdwCleaner, utilise maintenant l'option "Suppression" et poste le rapport.
    0
  9. max19 Messages postés 68 Statut Membre
     
    # AdwCleaner v1.701 - Rapport créé le 03/07/2012 à 10:58:50
    # Mis à jour le 02/07/2012 par Xplode
    # Système d'exploitation : Windows 7 Home Premium (64 bits)
    # Nom d'utilisateur : acer - ACER-PC
    # Exécuté depuis : C:\Users\acer\Downloads\adwcleaner.exe
    # Option [Suppression]

    ***** [Services] *****

    ***** [Fichiers / Dossiers] *****

    Dossier Supprimé : C:\Users\acer\AppData\Local\Babylon
    Dossier Supprimé : C:\Users\acer\AppData\Roaming\Babylon
    Dossier Supprimé : C:\Users\acer\AppData\Roaming\Media Finder
    Dossier Supprimé : C:\Users\acer\AppData\Roaming\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}\gencrawler@some.com
    Dossier Supprimé : C:\ProgramData\Babylon
    Dossier Supprimé : C:\ProgramData\boost_interprocess
    Dossier Supprimé : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Media Finder
    Fichier Supprimé : C:\Users\acer\AppData\Roaming\Mozilla\Firefox\Profiles\3h1grxyv.default\searchplugins\SweetIm.xml
    Fichier Supprimé : C:\Users\Public\Desktop\eBay.lnk
    Fichier Supprimé : C:\Program Files (x86)\Mozilla Firefox\searchplugins\babylon.xml

    ***** [Registre] *****

    Clé Supprimée : HKCU\Software\MediaFinder
    Clé Supprimée : HKCU\Software\Microsoft\Internet Explorer\MenuExt\Download with &Media Finder
    Clé Supprimée : HKCU\Software\Softonic
    Clé Supprimée : HKCU\Software\SweetIm
    Clé Supprimée : HKCU\Software\Tutorials
    Clé Supprimée : HKLM\SOFTWARE\Babylon
    Clé Supprimée : HKLM\SOFTWARE\Classes\AppID\escort.DLL
    Clé Supprimée : HKLM\SOFTWARE\Classes\MF
    Clé Supprimée : HKLM\SOFTWARE\Google\Chrome\Extensions\dednnpigldgdbpgcdpfppmlcnnbjciel
    Clé Supprimée : HKLM\SOFTWARE\Google\Chrome\Extensions\lpmkgpnbiojfaoklbkpfneikocaobfai
    Clé Supprimée : HKLM\SOFTWARE\SweetIM

    ***** [Registre - GUID] *****

    Clé Supprimée : HKLM\SOFTWARE\Classes\AppID\{09C554C3-109B-483C-A06B-F14172F1A947}
    Clé Supprimée : HKLM\SOFTWARE\Classes\AppID\{BDB69379-802F-4EAF-B541-F8DE92DD98DB}
    Clé Supprimée : HKLM\SOFTWARE\Classes\CLSID\{2EECD738-5844-4A99-B4B6-146BF802613B}
    Clé Supprimée : HKLM\SOFTWARE\Classes\CLSID\{E46C8196-B634-44A1-AF6E-957C64278AB1}
    Clé Supprimée : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4D79-A620-CCE0C0A66CC9}
    Clé Supprimée : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{2EECD738-5844-4A99-B4B6-146BF802613B}
    Clé Supprimée : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{97F2FF5B-260C-4CCF-834A-2DDA4E29E39E}
    Clé Supprimée : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{EEE6C35C-6118-11DC-9C72-001320C79847}
    Clé Supprimée : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2EECD738-5844-4A99-B4B6-146BF802613B}

    ***** [Navigateurs] *****

    -\\ Internet Explorer v9.0.8112.16421

    [OK] Le registre ne contient aucune entrée illégitime.

    -\\ Mozilla Firefox v13.0.1 (fr)

    Nom du profil : default
    Fichier : C:\Users\acer\AppData\Roaming\Mozilla\Firefox\Profiles\3h1grxyv.default\prefs.js

    C:\Users\acer\AppData\Roaming\Mozilla\Firefox\Profiles\3h1grxyv.default\user.js ... Supprimé !

    Supprimée : user_pref("browser.babylon.HPOnNewTab", "search.babylon.com");
    Supprimée : user_pref("browser.search.defaultenginename", "Search the web (Babylon)");
    Supprimée : user_pref("browser.search.order.1", "Search the web (Babylon)");
    Supprimée : user_pref("extensions.BabylonToolbar_i.aflt", "babsst");
    Supprimée : user_pref("extensions.BabylonToolbar_i.babExt", "");
    Supprimée : user_pref("extensions.BabylonToolbar_i.babTrack", "affID=112555&tt=100512_3_");
    Supprimée : user_pref("extensions.BabylonToolbar_i.hardId", "b2ef38de00000000000000871112a3dd");
    Supprimée : user_pref("extensions.BabylonToolbar_i.id", "b2ef38de00000000000000871112a3dd");
    Supprimée : user_pref("extensions.BabylonToolbar_i.instlDay", "15474");
    Supprimée : user_pref("extensions.BabylonToolbar_i.instlRef", "sst");
    Supprimée : user_pref("extensions.BabylonToolbar_i.newTab", true);
    Supprimée : user_pref("extensions.BabylonToolbar_i.newTabUrl", "hxxp://search.babylon.com/?affID=112555&tt=10051[...]
    Supprimée : user_pref("extensions.BabylonToolbar_i.prdct", "BabylonToolbar");
    Supprimée : user_pref("extensions.BabylonToolbar_i.prtnrId", "babylon");
    Supprimée : user_pref("extensions.BabylonToolbar_i.smplGrp", "none");
    Supprimée : user_pref("extensions.BabylonToolbar_i.srcExt", "ss");
    Supprimée : user_pref("extensions.BabylonToolbar_i.tlbrId", "base");
    Supprimée : user_pref("extensions.BabylonToolbar_i.vrsn", "1.5.3.17");
    Supprimée : user_pref("extensions.BabylonToolbar_i.vrsnTs", "1.5.3.1722:27:00");
    Supprimée : user_pref("extensions.BabylonToolbar_i.vrsni", "1.5.3.17");
    Supprimée : user_pref("keyword.URL", "hxxp://search.babylon.com/?affID=112555&tt=100512_3_&babsrc=KW_ss&mntrId=b[...]

    *************************

    AdwCleaner[R1].txt - [5940 octets] - [03/07/2012 10:02:12]
    AdwCleaner[S1].txt - [4856 octets] - [03/07/2012 10:58:50]

    ########## EOF - C:\AdwCleaner[S1].txt - [4984 octets] ##########
    0
  10. Destrio5 Messages postés 99820 Date d'inscription   Statut Modérateur Dernière intervention   10 324
     
    --> Relance AdwCleaner et choisis "Désinstallation".

    Comment va le PC ?

    On va vérifier que c'est OK :

    --> Télécharge ZHPDiag (de Nicolas Coolman).

    --> Double-clique sur le fichier d'installation. Installe ZHPDiag avec les paramètres par défaut (N'oublie pas de cocher "Créer une icône sur le Bureau").

    --> Clique droit sur le raccourci de ZHPDiag et choisis Exécuter en tant qu'administrateur.

    --> Clique sur le bouton "UAC".

    --> Clique sur la loupe (Lancer le diagnostic) puis laisse l'outil scanner.

    --> Une fois le scan terminé, clique sur l'icône en forme de disquette et enregistre le fichier (le rapport de l'analyse) sur ton Bureau.

    --> Pour me transmettre le rapport, utilise le site http://pjjoint.malekal.com/ car le rapport ZHPDiag est plutôt long. Copie-colle le lien donné par le site ici.
    0
  13. Destrio5 Messages postés 99820 Date d'inscription   Statut Modérateur Dernière intervention   10 324
     
    Peux-tu faire analyser ce fichier : C:\Windows\mfebcdata

    Sur VirusTotal puis me poster le lien de l'analyse :
    https://www.virustotal.com/gui/
    0
  15. Destrio5 Messages postés 99820 Date d'inscription   Statut Modérateur Dernière intervention   10 324
     
    On ne sait toujours pas d'où vient de fichier.

    Mets-le dans une archive .zip, upload-la sur le site https://www.cjoint.com/ puis poste le lien.
    0
  17. Destrio5 Messages postés 99820 Date d'inscription   Statut Modérateur Dernière intervention   10 324
     
    --> Copie tout le texte présent en gras ci-dessous (Sélectionne-le, clique droit dessus et choisis "Copier").

    SysRestore
    [MD5.00000000000000000000000000000000] [APT] [Express Files Updater] (...) -- C:\Program Files (x86)\ExpressFiles\EFupdater.exe (.not file.)
    [MD5.00000000000000000000000000000000] [APT] [{6119986A-A9BB-47FA-8CE3-1E2D96A8FDFE}] (...) -- C:\Program Files\AVAST Software\Avast\aswRundll.exe (.not file.)
    [HKLM\Software\AVAST Software]
    [HKLM\Software\McAfeeInstaller]
    O81 - IFC: Internet Feature Controls [HKUS\.DEFAULT] [FEATURE_BROWSER_EMULATION] -- svchost.exe
    O81 - IFC: Internet Feature Controls [HKUS\S-1-5-18] [FEATURE_BROWSER_EMULATION] -- svchost.exe
    SS - | Auto 0 | (0069251341244939mcinstcleanup) . (...) - C:\Users\acer\AppData\Local\Temp\006925~1.exe
    O44 - LFC:[MD5.AF0AD1DB09BCDAC91F3D16E40F2F75CF] - 02/07/2012 - 13:50:15 ---A- . (...) -- C:\Windows\mfebcdata [8212]
    SS - | Auto 0 | (avast! Firewall) . (...) - C:\Program Files\AVAST Software\Avast\afwServ.exe
    O43 - CFD: 02/07/2012 - 18:20:50 - [0] ----D C:\ProgramData\AVAST Software
    O23 - Service: avast! Firewall (avast! Firewall) . (...) - C:\Program Files\AVAST Software\Avast\afwServ.exe (.not file.)
    SS - | Auto 0 | (McShield) . (...) - C:\Program Files (x86)\McAfee\VIRUSS~1\mcshield.exe
    O23 - Service: McAfee Application Installer Cleanup (00 (0069251341244939mcinstcleanup) . (...) - C:\Users\acer\AppData\Local\Temp\006925~1.exe (.not file.)
    O23 - Service: McAfee Real-time Scanner (McShield) . (...) - C:\Program Files (x86)\McAfee\VIRUSS~1\mcshield.exe (.not file.)
    O43 - CFD: 13/03/2012 - 17:08:36 - [170,564] ----D C:\Program Files (x86)\McAfee
    O43 - CFD: 02/12/2009 - 06:15:07 - [0] ----D C:\Program Files (x86)\McAfee.com
    O43 - CFD: 02/12/2009 - 06:15:55 - [0,975] ----D C:\Program Files (x86)\Common Files\McAfee
    O43 - CFD: 24/02/2012 - 17:52:24 - [23,656] ----D C:\ProgramData\McAfee
    [MD5.92CC7943B4D37C2803B1A1F8AD027943] [SPRF][02/06/2012] (.McAfee, Inc. - McAfee Download Manager SelfExtractor.) -- C:\Users\acer\Desktop\DMSetup.exe [3140560]
    SS - | Auto 0 | (McShield) . (...) - C:\Program Files (x86)\McAfee\VIRUSS~1\mcshield.exe
    SS - | Demand 0 | (McSysmon) . (...) - C:\Program Files (x86)\McAfee\VIRUSS~1\mcsysmon.exe
    C:\Program Files\AVAST Software
    EmptyCLSID
    EmptyFlash
    EmptyTemp

    --> Puis lance ZHPFix depuis le raccourci situé sur ton Bureau.
    (Sous Vista/Win7, il faut cliquer droit sur le raccourci de ZHPFix et choisir Exécuter en tant qu'administrateur)

    --> Une fois ZHPFix ouvert, clique sur le bouton "H" (Coller les lignes Helper).

    --> Dans l'encadré principal, tu verras donc les lignes que tu as copié précédemment apparaître. Vérifie que toutes les lignes que je t'ai demandé de copier (et seulement elles) sont dans la fenêtre.

    --> Clique sur "GO" pour lancer le nettoyage. Laisse l'outil travailler et ne touche à rien.

    --> Une fois terminé, copie-colle le rapport dans ton prochain message.
    0
  18. max19 Messages postés 68 Statut Membre
     
    Rapport de ZHPFix 1.2.06 par Nicolas Coolman, Update du 17/05/2012
    Fichier d'export Registre : C:\ZHP\ZHPExportRegistry-03-07-2012-18-42-11.txt
    Run by acer at 03/07/2012 18:42:11
    Windows 7 Home Premium Edition, 64-bit (Build 7600)
    Web site : http://www.premiumorange.com/zeb-help-process/zhpfix.html
    Web site : http://nicolascoolman.skyrock.com/

    ========== Processus mémoire ==========
    SUPPRIME Memory Process: C:\Users\acer\Desktop\DMSetup.exe

    ========== Clé(s) du Registre ==========
    ABSENT Key: HKLM\Software\AVAST Software
    ABSENT Key: HKLM\Software\McAfeeInstaller
    SUPPRIME Key*: Service: 0069251341244939mcinstcleanup
    SUPPRIME Key*: Service: avast! Firewall
    ABSENT Key: Service: avast! Firewall
    SUPPRIME Key*: Service: McShield
    ABSENT Key: Service: 00 (0069251341244939mcinstcleanup
    ABSENT Key: Service: McShield
    SUPPRIME Key*: Service: McSysmon

    ========== Valeur(s) du Registre ==========
    ABSENT IFC: [FEATURE_BROWSER_EMULATION] svchost.exe

    ========== Dossier(s) ==========
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{00098BEC-2BE2-4191-B5A1-E80F1EDA3BEB}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{0087CDFB-65EF-48BB-81F4-8709233E47BE}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{0116E976-0259-4002-97AF-DF22845DBCAB}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{01219555-692D-43A3-A035-52ECC73E8FFA}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{0224A19D-362B-4CF1-B80C-79A798A96583}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{03767578-BE30-4058-93FA-DFE728361555}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{04522073-008C-4848-8BF1-97ADEA20546E}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{080F48A6-E42E-4AF1-A1CD-CC324F4B3BD0}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{093AE7B0-3EB1-4E20-AC38-332831A41F04}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{0A43A2B9-EEDF-4927-9682-10B4FA32A7BD}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{0A606A79-AA3D-4FEE-B75F-A3580D140D62}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{0BACC47A-7A3D-4B75-94EE-E1DB9FD5B1CC}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{0BEE2658-E3A6-463E-ACB2-8781A04BD828}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{0C2F3639-18A9-4495-AC45-B2A17A97549D}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{0CCDDD3D-70F9-4484-A0A5-E74D4291F877}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{0E69C428-1EE0-40B5-9B47-A64B44627454}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{0EC60E0B-7C3E-45E4-9ED4-889752D7FF79}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{0F43BAE9-830E-4826-BA59-A201459B26D7}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{10CFF519-D8F0-415C-BC9D-3D221CB0124F}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{116FCB99-5A20-4896-906C-E162E53F6DD6}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{119EA3D6-EF90-4971-8F67-4093D995DDCC}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{11C8FF34-E5DF-451E-B121-811800577240}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{11E4EA8B-E66B-453C-AA41-81A3DAC0C8ED}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{11F241B8-AF32-4D78-9845-5712CD166A87}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{1323241E-3E5B-40DB-BB8C-AF4228E42F29}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{13351A31-8546-4C3A-B1D2-384448E3F680}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{134C6966-F022-4C7E-B166-8692EFB67042}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{13EC55BE-DDA9-4331-AEE9-EC22D0157B16}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{14200A5E-10CD-4046-8A36-94942FE401BD}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{16474314-3970-498B-90B0-19544E3505E2}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{172453C8-C597-4D08-A376-8000C28CC149}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{18F5D77A-CF5A-4051-AC4A-94EB05BC9A9E}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{190AE871-F875-4303-9427-899DA7CA44B3}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{1934EB54-E596-4507-ABAA-AA5880C2C6C5}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{19FAFB06-14C5-4440-A62D-BF2ECFA04704}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{1B10D0E2-10AA-4C97-824E-6D9A2EBE5090}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{1B414AF5-CE51-4215-9AE8-DF5989E9432F}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{1B7C4676-874B-4FA1-B719-6AC98C8C6374}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{1D3C87C4-6E06-42CE-86F3-0883D836FAC7}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{1E589CDA-42C7-4916-A964-5CAEDF58D3C1}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{1FE2AF33-0D7C-434C-8EB0-BB91FF47DA40}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{1FF97118-58C2-4DA0-9EBC-4175E89419D4}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{2058D2D7-2453-4B83-A41D-A6741C5D52C3}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{210F4F4E-F82E-46EA-9F5D-015CC4A03752}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{2124EAF8-E255-4780-86C0-D1BFC3861666}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{21A4C1F8-7CC4-4B59-82C2-66D9755E0DB5}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{2201177C-6FE3-4D16-BAD7-FCBC176CED20}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{249D9ADC-4BF0-4060-8F9D-8FD09550CD43}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{257A8E55-F71E-4129-BF4F-7F6354931DCE}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{26872701-30BE-425C-BF3B-FF4B8DF33166}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{27C10F06-5FCE-4865-B20E-BCF610DF345A}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{27E30B5D-7751-40E5-8829-EF8DD673A752}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{294125C0-D32C-4D3D-BDFE-08907B8D0483}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{2ACB2401-C475-42C0-B55C-1BE520394037}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{2B73BDD1-86FA-4B5D-91B4-78CA86B0FC11}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{2B7E2E1B-2765-49B9-A27F-238A4A55A4C2}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{2BF0F477-A882-4259-8073-9CFE61532BB6}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{2CA87B12-6E69-47AF-9250-324D9A60D14B}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{2CE8BFB7-A407-4F54-97BE-5E46C6F62E26}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{2FA5DF4D-AAA9-4AB6-913A-E169FBFFAB77}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{311E2F66-8E47-4B34-A80E-959C945F4DAD}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{313FC2CA-FFDD-42BB-B0A4-C3436F6DF7A2}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{32010A69-C724-43DF-A99E-78E2CE43076A}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{33BC2D75-09A8-4637-B502-C743C7E6D71D}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{33F2E185-40A2-4D77-BC57-05564CC6B2E4}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{340A13B2-5FE6-461E-B4B4-1636C2D77719}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{340FF446-FA7A-4268-BD59-E5F27B7C1F21}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{378F0D5E-1B86-4D43-B806-A09D9F7A8A53}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{38396A57-C1A4-4EF1-980D-D2E3C4FF0B64}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{389A8C30-CD73-4A0C-8A41-3FA54331E29B}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{39CE7357-9A8F-4FE4-A184-185844896C23}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{3AC28D5C-257F-437D-A783-74821B1C6BD0}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{3C053F89-74DB-46B3-9C54-786624ECCD1F}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{3CD1EFF3-4F24-4E6A-9B93-C0A1AF7721AC}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{3D054FFD-4263-4037-A561-F81EFEDE8F64}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{3EB8C14B-9011-43E0-9180-40EEBF79B4A2}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{401A2CF4-2DD3-4801-8181-BBB47C4BF263}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{40307121-2326-4DA4-9E4A-87E27708B65D}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{4074F1CE-F1BD-4820-ACA2-5B564A0CE7BF}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{40D287A9-0D54-48DC-94A8-31419228877C}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{438DF109-518B-4AE0-AFA4-75D2A03F2FEE}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{446A6B70-7428-44D5-A7E4-02378FA51980}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{44A9A42A-703A-4DF8-8504-87D57FFA77DF}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{46020678-8AA3-4B2B-890E-1716FB26B441}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{4665C856-FDF5-45D6-B84B-1CE3B3C43EBC}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{4716AE6C-5C4A-4360-A559-F0FB76EAB61F}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{472CE4D0-BC83-4250-AC34-E82EFAFFD151}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{474B0721-6E3C-45B8-9489-EBF68E4D421B}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{47ADA9BA-EE38-4721-8BA3-DAD71EE52B2A}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{47B4A56A-4176-4187-96A2-DCBFEEAF1A2F}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{47B55B71-D33C-4CCC-8D5C-BA4D3BA427BF}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{48DED4E3-FFA3-475F-8173-7828F467305C}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{498EB10F-769A-4CBB-A2BA-AA246730158E}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{49BA790C-3E36-4DEE-8674-CE82B9B27317}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{4C4BC91D-511B-46DF-8DAB-FEBB440CEE8B}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{4CA5FCC5-E7C8-4742-858A-02FAF1F43D08}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{4D4E48E6-36C0-48EE-9720-053053091138}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{4EEDFE23-ABD4-4BC3-80FA-79EBFA2A4200}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{4F4D7C07-D263-425F-9B83-47C5F0BB9363}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{50FF6EEB-7A4A-405B-9109-CA4690299EB1}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{511D8FCF-08E0-49C2-BF4E-8CAF1632AC78}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{5235B7AF-4ED4-428E-B7B1-0009EC3C914A}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{526C835C-FDBE-499A-B286-A88A55BEB425}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{5309AF2C-4B48-400E-B105-4E155820C644}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{53CFAD64-DE7D-4BFC-A8AF-E763BA7BFEE4}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{53D96C55-33E7-46F1-881B-F4A052865EC8}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{5574AECB-2339-461E-A2CD-F59291640C09}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{55D4B43B-65DD-412A-8644-8F87299F4A22}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{55D62862-9059-4A05-A61A-2D5684D3DA88}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{56CD4634-86D6-4C30-8829-262122DF9F43}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{57C37CA9-0265-4C9B-88FB-C8BA483915CE}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{57FD85D2-0B54-48A8-B110-0F78641EEBBF}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{587F0EE3-BEB9-433D-99BD-F313C73CE117}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{58C83B3D-5FCF-45F9-A157-9721FB1EDDC0}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{597E25A4-6A8A-4261-8118-6C28DE390CA1}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{5B8215CB-CE2F-41DB-8F3E-A194B1463591}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{5BA42FA7-EF31-47D3-A7C2-4211B0567C51}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{5C66EE61-5749-457A-8CB2-02BAAA33B625}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{5DDF7D30-EAAC-4AC4-AF91-578EBE6BAF52}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{5EADA338-76BD-41E0-B023-60F1F0A2CD4A}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{5F048970-0CD8-4688-9906-19EB84D56C6C}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{5F56AA8E-BA2E-4AE9-8B6B-71366ED53478}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{5FA726A2-0AE3-429C-BEA5-555D56FAAF5F}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{5FE7A8A7-AE2F-4E82-9AAC-D0564AFDFDEB}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{60E911AC-1A47-4576-855C-7A1CC303CFA2}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{60F0B264-EABF-4091-A26E-C46FE5C1546E}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{6420C584-E943-4E99-8EE1-048915C19E79}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{643F8D02-7EE0-4E8D-9EE2-E891B44AB8A8}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{64B93B65-1D59-4CE6-A7C2-28411C947546}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{64E875B7-CD5D-49CB-8A34-382ED5B70C52}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{64F0DC21-E1A8-4ACD-9994-7BE530E0ACF6}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{650F1192-8347-4878-B5FD-1BD30081D5FF}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{65EEAA39-01E8-4666-8D21-DC81C095192A}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{6636AA84-C079-45D5-A1D5-2333D55C785B}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{66B85973-1BFC-4DA7-ADD8-C1F81647582A}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{671E882F-DD80-4F9D-8CF1-548B0366F47E}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{6A4C13B5-1F0A-45D4-A827-89D07DC2B7DC}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{6BE12B1E-A3DC-4F13-89FB-FCD19218A898}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{6D110041-1927-4754-8E18-D32D110052C9}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{6E4B03DC-7B63-4D20-8A5A-093ACA1245A6}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{6EC8C3E2-1C93-4A36-98EB-B94A8E7BEB70}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{6EFE4141-39E8-4107-BB32-BF8E073D7221}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{6FE3D6F8-BDB2-4DD6-82BE-89C66ACED928}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{715A19AE-5235-4042-A709-311FDB07F2D0}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{720DC266-F3C9-4B33-90FC-A4E3515ACABB}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{72A864C6-DAC8-4A86-8C9E-C979A352C476}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{750FA1FF-5376-4C3A-B3D9-98442D35CD3B}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{7528526E-5655-47BC-9DB5-51A631C4DF03}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{7546FD7E-783A-4323-BA15-5142EC68FA9B}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{76C30704-B729-457A-ABD7-6560197D574E}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{76F6B0BA-35B5-4B63-B8B9-0CBC7BD1B9BC}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{770D2882-7F14-4940-9A63-5547125B0477}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{778700C4-2F4A-43A4-AFDA-F11C915D25BE}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{7A641A06-74E1-4035-A7D5-C2856F196707}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{7B2027FB-221E-48A1-A86E-42D7312A4EE7}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{7B80D225-7648-433C-9340-15DD3F5F8B47}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{7BDEFD50-8BDA-4DB7-B8C0-2FFAF17338E7}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{7C40888A-6369-4976-B405-A565B7D7CD13}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{7C5F7F60-DAFA-4591-ACED-C5791A067485}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{7CEEE009-D3E8-4753-9D71-D8CA1DF635BF}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{7DBB676D-BA67-40CA-90A0-29AF9126123C}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{7F790A21-1FD4-45A4-A6F1-01AB6DEF6530}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{80B3C83C-E1C6-4EF9-A333-141045098434}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{82149A8F-F3A1-45DD-B19F-1FB183B19874}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{821B22F2-D71F-4A89-BE36-4C294F4A7315}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{830AB468-F077-41A6-91B1-C33357A413EF}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{847DC24E-2022-4773-878C-62104B4DD8DD}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{851BB1C7-3824-49E1-85D0-1CDC5898506A}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{85FB48DF-67FC-4D00-8D6B-00CA3D54EF11}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{864370E4-FDE4-433A-9DA1-FD1A963F384F}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{867774B2-5A81-44D7-8773-5F3E2E0538A2}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{86B99241-9A8C-4460-A6CF-A282849D26A1}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{876BD6B1-C33D-4DF0-8F06-9199D9FE6D20}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{88689D06-588D-42B3-8C0E-C08D91EF8A1C}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{8A72464F-9634-4B33-8292-EBADCD93DA6C}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{8BB9E06A-509D-43EC-B5F2-DECDDE53305D}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{8BBB1ADF-FFA0-4C58-BD82-1F35D61441B9}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{8CAE5948-13D6-42A0-8CEC-8CA0456F66D5}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{8DE0E1A9-3D53-4B28-B97B-AF957E86B54D}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{8E39DC0C-DA37-4309-8D2D-24D5DC00E47B}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{90429783-8195-4B75-8535-98EE24429B43}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{9112B437-2D43-483F-9FAE-DD8D5E2FB398}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{9261B2E0-0C0C-4FC2-B4E3-9DEE1E038309}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{93EB6532-1118-4A9B-AC8E-F8E1A855AD1E}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{947B84E9-5098-44CF-97F0-608C1E3FE057}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{95CA8CDD-73D8-4D38-8C79-CADF18CF7E29}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{95D8A573-8850-4516-895A-472A023A6D54}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{9742E4F5-4EFA-4B41-82DB-20E00E5C57F4}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{9742FBD2-998A-4B19-A85B-C5969F84042E}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{97B1EEFD-0012-46B8-AFAA-88EBE3B612DD}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{97C4E841-1077-4DA5-856C-0E6601C49C00}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{97E6BB1E-A681-4103-8F8C-FEDCD59D29D9}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{993C5764-8A2E-44A7-9B67-CF2D789E2F49}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{9969343E-14B4-4304-B8CC-17B180DFF37E}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{99A6C5EA-797C-4D1F-8896-C3EE215C9C98}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{9A32F191-AB28-4C73-94CE-020C9FEAE1D9}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{9ABA33EF-D324-453A-8FDE-011EAEDA2E9C}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{9AE29AFB-462D-415C-A9EC-E60DF75CDFD4}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{9B3842DB-220A-4ED2-9ECA-E6DEBCFB4C54}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{9C6B6F6B-C8F0-4C5C-B64B-DBB5D44563B3}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{9D41CD43-1316-46AD-A7FA-35B6AE658E65}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{9ED25BFE-2670-4AB2-BB7D-096E854110F3}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{9F924F42-953E-4B7A-BD03-AC4093A7B8CF}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{A09AB548-4BA3-4525-A4AD-ACFE48AD636C}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{A0D776F9-2935-41E0-8CAF-0791A8311DBC}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{A0EC3C98-633D-4C28-A985-963F6DE6AB32}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{A1F2C04E-8078-4079-968F-1BB7C5EED5C9}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{A37CE092-9CFC-4660-B101-C770B2C1BBCF}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{A79246A8-C027-4ECF-B213-F9ECF5A72015}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{AA2E965A-85BD-4F64-8C25-39F007A1AE79}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{AA3C8468-636E-4687-B956-7FA6CA903E3D}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{AC0B3B11-0AFE-4976-86C2-B99BF2559DFA}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{B03007ED-3000-4D54-A1CE-7A151438CB26}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{B05B0E9A-F667-469B-B7BD-DF7CE05149CC}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{B0895589-01AF-4CBA-9F00-79CB669643CF}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{B0B920AD-B8D7-4339-8A82-0C158061BD5D}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{B167DE0B-40E6-474D-A7F2-8FEA0CE3DE3B}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{B27AA360-456B-4AEB-921C-591E67CE8B55}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{B2ACD78B-B3C6-416B-B31D-A23D7E1D7813}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{B312D718-3B76-4BE5-AC90-93624240E9A0}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{B6B07348-6341-45A2-82F9-0282E4ED9154}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{B6DB339C-979B-4A90-BE30-084B049C4061}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{B75BD82C-F10C-4950-A4CF-A58D628D2FF5}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{B8FD4779-A070-4C65-B3E7-0B800FE22BBC}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{B91C424C-FFCD-411D-A63C-3CE7EE088153}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{BB22ED15-1390-448D-B1B8-06D29D7060C2}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{BC135254-3140-4751-A448-D031262D0335}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{BCB1B81C-146A-45C1-9071-2DA6D8826269}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{BCC6C684-E04F-4D98-869E-F6BA080C908B}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{BCF1BDC4-4127-40EC-A156-949A9AD9DA84}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{BD1FC94C-0076-402B-845E-9F976638FA68}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{BE8B8CA5-1B1F-4CAB-9741-2C0688BBB763}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{BF76DA5D-6366-4B12-AEA3-3C392206C113}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{C045DC2D-CDDA-46B8-B72A-8287571035AE}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{C17958B2-D299-4E58-AB14-07A68D95B99E}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{C26D3871-38A4-4CEA-951E-DAA2BD3E0FDE}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{C48421E6-635C-4812-BCC3-4AB4330100A4}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{C4CCB00B-39FA-4617-9160-8823A282F067}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{C5734011-86B5-4F16-9A2E-2201742B4AC1}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{C6CA3DFB-3589-455B-BD60-521836FEB633}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{C8A0FFDD-5EB1-4866-BFA7-3A76AE979076}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{C8B2B9D6-DDD8-4A40-A5E9-BED1BB8FD827}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{C8B9F9EE-1E6E-4DB1-9B01-8CC2D58B80B3}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{C8DC19D0-2200-46BD-BF20-A525EBF90003}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{CA6E4A16-1DA6-4537-A5CB-6152F4C588FF}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{CA6F0A65-8B9E-4374-AAE6-D2B3F44AC1A1}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{CBAD013A-84CF-4ECE-945B-D35B2EF34A1A}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{CBF3F7D4-3211-4FAE-B38E-708DA2A4A2E7}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{CD5975F3-EF28-4200-B7F5-3CF0F45BD6E9}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{CDFDC451-C0F6-49B0-989A-4BD092C482C2}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{CE1AFB0A-6996-4329-8B8C-4A1813933B21}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{CE55A688-2234-4CCD-BE43-F344A5D9A0EC}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{D2BCCD81-0148-4E4F-9466-977C81522024}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{D300E6CD-705C-4EED-83B8-2D48353D6F0B}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{D5598E84-7A83-4A27-A07C-B3FE63A481F4}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{D58E3EF4-447C-4C9F-B0DE-7925346CC603}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{D66F08C7-179C-4297-9D5D-76E3A4E42341}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{D6B14BA9-9A40-442F-BE36-AA99D77CA982}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{D6FD1DC8-7621-4438-8607-8DFA026626AC}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{D73EAC70-D7B4-40EE-AEEE-F7396C5E2BAD}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{D80C159E-A52D-4D77-BA71-8503904FE5F5}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{D831F946-A210-4D02-868D-4EA6AE0E8659}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{D9F5093F-3149-4383-8B20-790B9CA105BD}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{DA02A0FF-DE19-42D5-8418-29007CF4B671}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{DA083F39-9A56-4F50-A9D3-DE5ED7922D7C}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{DA133DD9-2335-418B-8F35-3A644F951C01}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{DAFCE74B-80A3-4100-BA6A-863D596E1556}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{DBD4A8E1-031B-40D1-9E4E-8896EA5F4444}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{DC5D8BEB-811E-445B-A7F9-764C98185CF3}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{DD0F8B3F-3127-4C00-9A1D-F0481D298ABF}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{DD7A23F6-CB0E-474A-BEED-4D6A9393D420}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{DE35C4EE-AA6D-4428-B503-9E531DD8CF6F}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{E05F4563-5967-4480-8D34-25A13C2239BA}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{E120A133-D873-4A9B-9A10-191BEAED59E1}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{E21542D3-7AB3-4D64-BA6A-B4C19AF017E1}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{E25A13F5-3047-41D5-BC7E-9901CC093966}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{E263D0C8-EF6C-47E1-859D-193617C3AC54}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{E309156A-45A4-4899-9450-AAD8B48FC938}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{E39AC7BA-D665-4DCF-B856-2A997DA8CE8B}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{E4188876-ECCA-43E0-853A-6D5EA9BD8D30}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{E4FC4E6A-CF79-4A4D-83AD-0CD75A28DFB5}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{E630309E-AC5A-4090-A367-69EAF5316E05}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{E63C3627-F5CD-4C99-841A-EFC1A1E8C017}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{E6A0B546-B5CE-434E-8ECB-BE18BF9BCD28}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{E6C9F223-433F-43CE-892D-67044BEC6961}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{E80ED3D7-7F2A-47C2-B3DC-AFE85C352C7A}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{E84D6E21-468C-491B-BA48-5F4E780B58B7}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{E8EE464C-F301-420C-BF2B-81C1B2238CAF}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{E9321811-B411-4BC4-A5E5-D47641F275B4}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{E9F2433C-96FD-48AE-9963-A4AAE4C27FBC}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{EB6C51A2-97CA-40F3-B798-8097E90386B0}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{ED67D051-FF8D-4CA1-8D33-47C1400E4CAB}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{EF8FB10F-30A3-4D69-ADC9-0154EA12094F}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{F2BD82E8-97AC-407A-9F1F-CB4AB971480D}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{F5A56791-BC2B-4706-852A-F916DC144103}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{F5C2824E-D159-4D52-9F39-E380E8176E18}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{F62283A9-9C2D-417A-A4D6-979809E8A2D4}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{F87170B6-1F03-4244-A39B-75B73222A9DA}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{F8826989-677C-48AA-B80C-C2B063D2E7E0}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{FA2A5643-5CFD-4DE5-A88A-C49B3CD68F74}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{FAD3213A-16B8-4461-B407-8F0D20860C52}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{FB10D4A6-569A-4E5E-82D7-6A270A36D6B0}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{FCFAA9DB-5D46-4884-A6C2-4BA71B345C32}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{FDB2C37F-1E13-47A0-9148-8B8B375E9364}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{FE1B99BC-26AD-40C2-BC4E-67E6F959B716}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{FE231B0F-08A0-4D3E-B0D6-CEDE029DF363}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{FFDD5FE0-95D3-423E-83EF-54CCE5C8873D}
    SUPPRIME Folder: C:\Users\acer\AppData\Local\{FFEB8F48-4D51-47C5-A12D-2DD3399B8FB9}
    SUPPRIME Flash Cookies:
    SUPPRIME Temporaires Windows:

    ========== Fichier(s) ==========
    ABSENT File: c:\users\acer\appdata\local\temp\006925~1.exe
    SUPPRIME File: c:\windows\mfebcdata
    ABSENT File: c:\program files\avast software\avast\afwserv.exe
    ABSENT File: c:\program files (x86)\mcafee\viruss~1\mcshield.exe
    SUPPRIME File: c:\users\acer\desktop\dmsetup.exe
    SUPPRIME Flash Cookies:
    SUPPRIME Temporaires Windows:

    ========== Tache planifiée ==========
    SUPPRIME Task: Express Files Updater
    SUPPRIME Task: {6119986A-A9BB-47FA-8CE3-1E2D96A8FDFE}

    ========== Restauration Système ==========
    Point de restauration du système créé avec succès

    ========== Récapitulatif ==========
    1 : Processus mémoire
    9 : Clé(s) du Registre
    1 : Valeur(s) du Registre
    310 : Dossier(s)
    7 : Fichier(s)
    2 : Tache planifiée
    1 : Restauration Système

    End of clean in 03mn 06s

    ========== Chemin de fichier rapport ==========
    C:\ZHP\ZHPFix[R1].txt - 03/07/2012 18:42:11 [28075]
    0
  19. Destrio5 Messages postés 99820 Date d'inscription   Statut Modérateur Dernière intervention   10 324
     
    Plus de souci ?
    0
  20. max19 Messages postés 68 Statut Membre
     
    apparemment tout est rentré dans l'ordre.

    je te remercie de m'être occuper de moi et surtout de mon ordi.
    0
  21. Destrio5 Messages postés 99820 Date d'inscription   Statut Modérateur Dernière intervention   10 324
     
    Pour finir :

    1/

    ---> Télécharge DelFix sur ton Bureau.
    * Clique droit sur DelFix et choisis Exécuter en tant qu'administrateur.
    * Clique sur le bouton Suppression.
    * Poste le rapport (C:\DelFixSuppr.txt).
    * Supprime DelFix.

    2/

    ---> Télécharge et installe CCleaner.
    * Lance-le. Va dans Options puis Avancé et décoche la case Effacer uniquement les fichiers etc....
    * Va dans Nettoyeur, choisis Analyse. Une fois terminé, lance le nettoyage.

    3/

    ---> Il est nécessaire de supprimer les points de restauration. Ensuite, crée un point de restauration.

    ==Prévention==

    Ton Windows n'est pas à jour. Il manque le SP1 par exemple.

    Voici un dossier sur la prévention et sécurité sur Internet (A lire avec Adobe Reader) : Lien

    Sois plus vigilant sur Internet ;)
    0
  • 1
  • 2

Discussions similaires

Chrome://newtab
Nova -
snoopy35_ -

14 réponses
Softonic,est-ce un virus ?
techmel1 -
techmel1 -

6 réponses
Désinstaller Softonic
Diguimette -
lilidurhone -

5 réponses
Erreur 0x800700E1
Didiervd -
Viktimz -

11 réponses
Virus dans filezilla
balnelius10 -
fabul -

9 réponses