Virus tres tenace

Bonjour,

--> Désactive l'UAC le temps de la désinfection.

/!\ Désactive tes protections résidentes (Antivirus, etc...) /!\

--> Télécharge ComboFix (de sUBs) sur ton Bureau.

--> Clique droit sur ComboFix.exe (le .exe n'est pas forcément visible) et choisis Exécuter en tant qu'administrateur afin de le lancer.

--> Réponds Oui au message d'avertissement pour que ComboFix commence l'analyse de ton PC.

--> Lorsqu'elle sera terminée, un rapport apparaîtra. Poste ce rapport (C:\Combofix.txt) dans ta prochaine réponse.

Pour t'aider : Un guide et un tutoriel sur l'utilisation de ComboFix

ComboFix 12-07-02.01 - acer 02/07/2012 18:05:58.1.4 - x64
Microsoft Windows 7 Édition Familiale Premium 6.1.7600.0.1252.33.1036.18.3957.1999 [GMT 2:00]
Lancé depuis: c:\users\acer\Downloads\ComboFix.exe
AV: avast! Antivirus *Disabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}
AV: McAfee VirusScan *Enabled/Outdated* {86355677-4064-3EA7-ABB3-1B136EB04637}
FW: McAfee Personal Firewall *Enabled* {BE0ED752-0A0B-3FFF-80EC-B2269063014C}
SP: avast! Antivirus *Disabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681}
SP: McAfee VirusScan *Enabled/Updated* {3D54B793-665E-3129-9103-206115370C8A}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\program files (x86)\Acer Bio Protection\PwdFilterV64.dll
c:\program files (x86)\Common Files\Acer GameZone online.ico
c:\users\acer\Documents\searcher_setup.exe
c:\windows\assembly\GAC_32\Desktop.ini
c:\windows\assembly\GAC_64\Desktop.ini
c:\windows\Installer\{f7d860cb-2036-29a6-7e83-9f32d62f4728}\@
c:\windows\Installer\{f7d860cb-2036-29a6-7e83-9f32d62f4728}\L\00000004.@
c:\windows\Installer\{f7d860cb-2036-29a6-7e83-9f32d62f4728}\L\1afb2d56
c:\windows\Installer\{f7d860cb-2036-29a6-7e83-9f32d62f4728}\L\201d3dde
c:\windows\Installer\{f7d860cb-2036-29a6-7e83-9f32d62f4728}\U\00000004.@
c:\windows\Installer\{f7d860cb-2036-29a6-7e83-9f32d62f4728}\U\00000008.@
c:\windows\Installer\{f7d860cb-2036-29a6-7e83-9f32d62f4728}\U\000000cb.@
c:\windows\Installer\{f7d860cb-2036-29a6-7e83-9f32d62f4728}\U\80000000.@
c:\windows\Installer\{f7d860cb-2036-29a6-7e83-9f32d62f4728}\U\80000032.@
c:\windows\Installer\{f7d860cb-2036-29a6-7e83-9f32d62f4728}\U\80000064.@
c:\windows\Installer\{f7d860cb-2036-29a6-7e83-9f32d62f4728}\U\trz6105.tmp
c:\windows\Installer\{f7d860cb-2036-29a6-7e83-9f32d62f4728}\U\trz86A0.tmp
c:\windows\Installer\{f7d860cb-2036-29a6-7e83-9f32d62f4728}\U\trz8E04.tmp
c:\windows\Installer\{f7d860cb-2036-29a6-7e83-9f32d62f4728}\U\trz96B4.tmp
c:\windows\Installer\{f7d860cb-2036-29a6-7e83-9f32d62f4728}\U\trz9DEE.tmp
c:\windows\Installer\{f7d860cb-2036-29a6-7e83-9f32d62f4728}\U\trzA052.tmp
c:\windows\Installer\{f7d860cb-2036-29a6-7e83-9f32d62f4728}\U\trzA24.tmp
c:\windows\Installer\{f7d860cb-2036-29a6-7e83-9f32d62f4728}\U\trzB59A.tmp
c:\windows\Installer\{f7d860cb-2036-29a6-7e83-9f32d62f4728}\U\trzB6A8.tmp
c:\windows\Installer\{f7d860cb-2036-29a6-7e83-9f32d62f4728}\U\trzBB28.tmp
c:\windows\Installer\{f7d860cb-2036-29a6-7e83-9f32d62f4728}\U\trzC8C0.tmp
c:\windows\Installer\{f7d860cb-2036-29a6-7e83-9f32d62f4728}\U\trzED4D.tmp
c:\windows\Installer\{f7d860cb-2036-29a6-7e83-9f32d62f4728}\U\trzED8A.tmp
c:\windows\Installer\{f7d860cb-2036-29a6-7e83-9f32d62f4728}\U\trzEF91.tmp
c:\windows\Installer\{f7d860cb-2036-29a6-7e83-9f32d62f4728}\U\trzF407.tmp
.
c:\windows\system32\services.exe . . . est infecté!!
.
.
((((((((((((((((((((((((((((( Fichiers créés du 2012-06-02 au 2012-07-02 ))))))))))))))))))))))))))))))))))))
.
.
2012-07-02 16:18 . 2012-07-02 16:18 -------- d-----w- c:\users\Default\AppData\Local\temp
2012-07-02 15:38 . 2012-07-02 15:38 -------- d-----w- c:\program files (x86)\Common Files\Java
2012-07-02 15:37 . 2012-07-02 15:37 -------- d-----w- c:\program files (x86)\Oracle
2012-07-02 15:36 . 2012-05-04 17:29 772504 ----a-w- c:\windows\SysWow64\npDeployJava1.dll
2012-07-02 15:34 . 2012-07-02 15:34 -------- d-----w- c:\program files (x86)\Java
2012-07-02 14:54 . 2012-07-02 14:54 -------- d-----w- c:\users\acer\AppData\Roaming\Avira
2012-07-02 14:49 . 2011-12-01 15:55 97312 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2012-07-02 14:49 . 2011-12-01 15:55 27760 ----a-w- c:\windows\system32\drivers\avkmgr.sys
2012-07-02 14:49 . 2011-12-01 15:55 130760 ----a-w- c:\windows\system32\drivers\avipbb.sys
2012-07-02 14:49 . 2012-07-02 14:49 -------- d-----w- c:\programdata\Avira
2012-07-02 14:49 . 2012-07-02 14:49 -------- d-----w- c:\program files (x86)\Avira
2012-07-02 13:50 . 2012-07-02 13:51 -------- d-----w- c:\program files (x86)\EasyPHP-5.3.9
2012-06-28 07:45 . 2012-06-28 07:45 -------- d-----w- c:\program files\CCleaner
2012-06-25 13:47 . 2012-06-25 13:47 -------- d-----w- c:\program files (x86)\Notepad++
2012-06-24 13:39 . 2012-06-24 13:39 -------- d-----w- c:\users\acer\AppData\Roaming\My Games
2012-06-24 13:30 . 2012-06-24 13:30 -------- d-----w- c:\program files (x86)\Firaxis Games
2012-06-24 13:30 . 2005-04-03 21:02 69714 ----a-w- c:\program files (x86)\Common Files\InstallShield\Professional\RunTime\11\00\Intel32\ctor.dll
2012-06-24 13:30 . 2005-04-03 21:01 274432 ----a-w- c:\program files (x86)\Common Files\InstallShield\Professional\RunTime\11\00\Intel32\iscript.dll
2012-06-24 13:30 . 2005-04-03 21:00 184320 ----a-w- c:\program files (x86)\Common Files\InstallShield\Professional\RunTime\11\00\Intel32\iuser.dll
2012-06-24 13:30 . 2005-04-03 21:00 63488 ----a-w- c:\program files (x86)\Common Files\InstallShield\Professional\RunTime\11\00\Intel32\ISBEW64.exe
2012-06-24 13:30 . 2005-04-03 20:59 5632 ----a-w- c:\program files (x86)\Common Files\InstallShield\Professional\RunTime\11\00\Intel32\DotNetInstaller.exe
2012-06-24 13:30 . 2005-04-03 21:02 753664 ----a-w- c:\program files (x86)\Common Files\InstallShield\Professional\RunTime\11\00\Intel32\iKernel.dll
2012-06-24 13:30 . 2012-06-24 13:30 200836 ----a-w- c:\program files (x86)\Common Files\InstallShield\Professional\RunTime\11\00\Intel32\iGdi.dll
2012-06-24 13:30 . 2012-06-24 13:30 331908 ----a-w- c:\program files (x86)\Common Files\InstallShield\Professional\RunTime\11\00\Intel32\setup.dll
2012-06-24 07:41 . 2012-06-24 07:41 -------- d-----w- c:\users\acer\AppData\Local\Macromedia
2012-06-22 07:13 . 2012-06-02 22:19 57880 ----a-w- c:\windows\system32\wuauclt.exe
2012-06-22 07:13 . 2012-06-02 22:19 44056 ----a-w- c:\windows\system32\wups2.dll
2012-06-22 07:13 . 2012-06-02 22:19 2428952 ----a-w- c:\windows\system32\wuaueng.dll
2012-06-22 07:13 . 2012-06-02 22:15 2622464 ----a-w- c:\windows\system32\wucltux.dll
2012-06-22 07:12 . 2012-06-02 22:19 38424 ----a-w- c:\windows\system32\wups.dll
2012-06-22 07:12 . 2012-06-02 22:19 701976 ----a-w- c:\windows\system32\wuapi.dll
2012-06-22 07:12 . 2012-06-02 22:15 99840 ----a-w- c:\windows\system32\wudriver.dll
2012-06-22 07:11 . 2012-06-02 13:19 186752 ----a-w- c:\windows\system32\wuwebv.dll
2012-06-22 07:11 . 2012-06-02 13:15 36864 ----a-w- c:\windows\system32\wuapp.exe
2012-06-21 15:21 . 2012-06-21 15:21 770384 ----a-w- c:\program files (x86)\Mozilla Firefox\msvcr100.dll
2012-06-21 15:21 . 2012-06-21 15:21 421200 ----a-w- c:\program files (x86)\Mozilla Firefox\msvcp100.dll
2012-06-19 15:35 . 2012-06-19 15:35 4967624 ----a-w- c:\program files (x86)\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}\components\SkypeFfComponent.dll
2012-06-16 20:36 . 2012-03-06 23:02 28504 ----a-w- c:\windows\system32\drivers\aswKbd.sys
2012-06-16 07:56 . 2012-05-18 02:01 499200 ----a-w- c:\program files\Internet Explorer\jsdbgui.dll
2012-06-16 07:56 . 2012-05-17 22:38 678912 ----a-w- c:\program files (x86)\Internet Explorer\iedvtool.dll
2012-06-16 07:56 . 2012-05-18 02:02 887296 ----a-w- c:\program files\Internet Explorer\iedvtool.dll
2012-06-13 20:43 . 2012-05-04 10:52 5505392 ----a-w- c:\windows\system32\ntoskrnl.exe
2012-06-13 20:43 . 2012-05-04 10:08 3902320 ----a-w- c:\windows\SysWow64\ntoskrnl.exe
2012-06-13 20:43 . 2012-05-04 10:08 3958128 ----a-w- c:\windows\SysWow64\ntkrnlpa.exe
2012-06-13 20:05 . 2012-04-26 05:34 149504 ----a-w- c:\windows\system32\rdpcorekmts.dll
2012-06-13 20:05 . 2012-04-26 05:34 76288 ----a-w- c:\windows\system32\rdpwsx.dll
2012-06-13 20:05 . 2012-04-26 05:28 9216 ----a-w- c:\windows\system32\rdrmemptylst.exe
2012-06-13 20:04 . 2012-05-02 05:32 208896 ----a-w- c:\windows\system32\profsvc.dll
2012-06-13 19:59 . 2012-05-15 01:32 3144192 ----a-w- c:\windows\system32\win32k.sys
2012-06-13 19:59 . 2012-04-28 03:50 204800 ----a-w- c:\windows\system32\drivers\rdpwd.sys
2012-06-13 19:59 . 2012-04-07 12:18 3213824 ----a-w- c:\windows\system32\msi.dll
2012-06-13 19:59 . 2012-04-07 11:34 2342400 ----a-w- c:\windows\SysWow64\msi.dll
2012-06-13 19:59 . 2012-04-24 05:59 1460224 ----a-w- c:\windows\system32\crypt32.dll
2012-06-13 19:59 . 2012-04-24 04:47 1156608 ----a-w- c:\windows\SysWow64\crypt32.dll
2012-06-13 19:59 . 2012-04-24 05:59 182272 ----a-w- c:\windows\system32\cryptsvc.dll
2012-06-13 19:59 . 2012-04-24 05:59 140288 ----a-w- c:\windows\system32\cryptnet.dll
2012-06-13 19:59 . 2012-04-24 04:47 139264 ----a-w- c:\windows\SysWow64\cryptsvc.dll
2012-06-13 19:59 . 2012-04-24 04:47 103936 ----a-w- c:\windows\SysWow64\cryptnet.dll
2012-06-10 08:04 . 2012-06-11 19:43 -------- d-----w- c:\program files (x86)\EA GAMES
2012-06-10 08:04 . 2004-08-18 08:34 442368 ----a-r- c:\windows\SysWow64\vp6vfw.dll
2012-06-09 19:35 . 2012-06-09 19:35 283200 ----a-w- c:\windows\system32\drivers\dtsoftbus01.sys
2012-06-09 19:35 . 2012-06-28 07:48 -------- d-----w- c:\users\acer\AppData\Roaming\DAEMON Tools Lite
2012-06-09 19:34 . 2012-06-09 19:35 -------- d-----w- c:\program files (x86)\DAEMON Tools Lite
2012-06-09 15:36 . 2012-06-10 08:01 -------- d-----w- c:\programdata\DAEMON Tools Lite
.
.
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-06-23 22:05 . 2012-05-25 19:22 426184 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2012-06-23 22:05 . 2012-02-29 20:57 70344 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2012-05-17 15:48 . 2012-05-06 08:30 772114 ----a-w- c:\windows\RON 2010 FRENCH DL Uninstaller.exe
2012-05-04 17:29 . 2012-03-10 11:40 687504 ----a-w- c:\windows\SysWow64\deployJava1.dll
2012-04-08 08:23 . 2012-04-08 08:23 40960 ----a-r- c:\users\acer\AppData\Roaming\Microsoft\Installer\{9559F7CA-5E34-4237-A2D9-D856464AD727}\NewShortcut1_9559F7CA5E344237A2D9D856464AD727.exe
2012-04-08 08:23 . 2012-04-08 08:23 40960 ----a-r- c:\users\acer\AppData\Roaming\Microsoft\Installer\{9559F7CA-5E34-4237-A2D9-D856464AD727}\ARPPRODUCTICON.exe
2012-04-04 13:56 . 2012-05-10 19:50 24904 ----a-w- c:\windows\system32\drivers\mbam.sys
.
.
------- Sigcheck -------
Note: Unsigned files aren't necessarily malware.
.
[-] 2009-07-14 . 50BEA589F7D7958BDD2528A8F69D05CC . 329216 . . [6.1.7600.16385] .. c:\windows\system32\services.exe
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\egisPSDP]
@="{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}"
[HKEY_CLASSES_ROOT\CLSID\{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}]
2009-09-10 13:41 120104 ----a-w- c:\program files (x86)\EgisTec\MyWinLocker 3\x86\PSDProtect.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2012-06-02 4786048]
"EA Core"="c:\program files (x86)\Electronic Arts\EADM\Core.exe" [2009-03-28 3325952]
"Skype"="c:\program files (x86)\Skype\Phone\Skype.exe" [2012-05-03 17355912]
"swg"="c:\program files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-12-02 39408]
"ShowBatteryBar"="c:\program files\BatteryBar\ShowBatteryBar.exe" [2009-05-28 89600]
"DAEMON Tools Lite"="c:\program files (x86)\DAEMON Tools Lite\DTLite.exe" [2012-04-17 3671872]
"Speech Recognition"="c:\windows\Speech\Common\sapisvr.exe" [2009-07-14 44544]
"EasyPHP"="c:\program files (x86)\EasyPHP-5.3.9\EasyPHP-5.3.9.exe" [2011-07-13 496640]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"EgisTecLiveUpdate"="c:\program files (x86)\EgisTec Egis Software Update\EgisUpdate.exe" [2009-08-04 199464]
"BackupManagerTray"="c:\program files (x86)\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe" [2009-10-29 261888]
"NortonOnlineBackupReminder"="c:\program files (x86)\Symantec\Norton Online Backup\Activation\NobuActivation.exe" [2009-07-25 588648]
"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2009-11-23 98304]
"LManager"="c:\program files (x86)\Launch Manager\LManager.exe" [2009-09-24 825864]
"EgisTecPMMUpdate"="c:\program files (x86)\EgisTec IPS\PmmUpdate.exe" [2009-12-08 401192]
"EgisUpdate"="c:\program files (x86)\EgisTec IPS\EgisUpdate.exe" [2009-12-08 201512]
"VitaKeyPdtWzd"="c:\program files (x86)\Acer Bio Protection\PdtWzd.exe" [2009-11-10 3569152]
"ArcadeDeluxeAgent"="c:\program files (x86)\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe" [2009-10-29 419112]
"PlayMovie"="c:\program files (x86)\Acer Arcade Deluxe\PlayMovie\PMVService.exe" [2009-11-12 181480]
"Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe" [2011-01-30 35736]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-11-10 932288]
"avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2011-12-01 258512]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2012-01-17 252296]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Acer VCM.lnk - c:\program files (x86)\Acer\Acer VCM\AcerVCM.exe [2009-12-2 708608]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"aux5"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\!SASCORE]
@=""
.
R2 0069251341244939mcinstcleanup;McAfee Application Installer Cleanup (0069251341244939);c:\users\acer\AppData\Local\Temp\006925~1.EXE [x]
R2 avast! Firewall;avast! Firewall;c:\program files\AVAST Software\Avast\afwServ.exe [x]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 gupdate;Service Google Update (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-02-29 135664]
R2 RS_Service;Raw Socket Service;c:\program files (x86)\Acer\Acer VCM\RS_Service.exe [2009-07-10 253952]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe [2012-05-03 158856]
R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-06-23 250056]
R3 btusbflt;Bluetooth USB Filter;c:\windows\system32\drivers\btusbflt.sys [2009-07-01 52264]
R3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\DRIVERS\btwl2cap.sys [2009-04-07 35104]
R3 gupdatem;Service Google Update (gupdatem);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-02-29 135664]
R3 hidshim;Service for HID-KMDF Shim layer;c:\windows\system32\DRIVERS\hidshim.sys [2009-08-31 6656]
R3 k57nd60a;Broadcom NetLink (TM) Gigabit Ethernet - NDIS 6.0;c:\windows\system32\DRIVERS\k57nd60a.sys [2009-08-06 320040]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2012-04-04 24904]
R3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2012-06-21 113120]
R3 MWLService;MyWinLocker Service;c:\program files (x86)\EgisTec\MyWinLocker 3\x86\\MWLService.exe [2009-09-10 305448]
R3 NETw5s64;Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows 7 - 64 Bit;c:\windows\system32\DRIVERS\NETw5s64.sys [2009-09-15 6952960]
R3 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [2010-06-25 35344]
R3 NTIBackupSvc;NTI Backup Now 5 Backup Service;c:\program files (x86)\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe [2009-11-06 50432]
R3 nuvotonhidcir;Nuvoton HID CIR Receiver;c:\windows\system32\DRIVERS\nuvotonhidcir.sys [2009-08-31 26624]
R3 nuvotonir;Nuvoton CIR Transceiver;c:\windows\system32\DRIVERS\nuvotonir.sys [2009-08-31 68096]
R3 RTL8192su;Realtek RTL8192SU Wireless LAN 802.11n USB 2.0 Network Adapter;c:\windows\system32\DRIVERS\RTL8192su.sys [2009-10-14 674304]
R3 VBoxNetAdp;VirtualBox Host-Only Ethernet Adapter;c:\windows\system32\DRIVERS\VBoxNetAdp.sys [2011-12-19 146736]
R3 WatAdminSvc;Service Windows Activation Technologies;c:\windows\system32\Wat\WatAdminSvc.exe [2012-03-02 1255736]
R4 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2012-04-04 654408]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-22 57184]
S0 johci;JMicron 1394 Filter Driver;c:\windows\system32\DRIVERS\johci.sys [2009-08-24 22640]
S1 aswKbd;aswKbd; [x]
S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys [2011-12-01 27760]
S1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys [2012-06-09 283200]
S1 mwlPSDFilter;mwlPSDFilter;c:\windows\system32\DRIVERS\mwlPSDFilter.sys [2009-06-02 22576]
S1 mwlPSDNServ;mwlPSDNServ;c:\windows\system32\DRIVERS\mwlPSDNServ.sys [2009-06-02 20016]
S1 mwlPSDVDisk;mwlPSDVDisk;c:\windows\system32\DRIVERS\mwlPSDVDisk.sys [2009-06-02 60464]
S1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV64.SYS [2011-07-22 14928]
S1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL64.SYS [2011-07-12 12368]
S1 VBoxDrv;VirtualBox Service;c:\windows\system32\DRIVERS\VBoxDrv.sys [2011-12-19 224048]
S1 VBoxUSBMon;VirtualBox USB Monitor Driver;c:\windows\system32\DRIVERS\VBoxUSBMon.sys [2011-12-19 130864]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-14 59904]
S2 !SASCORE;SAS Core Service;c:\program files\SUPERAntiSpyware\SASCORE64.EXE [2011-08-11 140672]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2009-11-23 202752]
S2 AntiVirSchedulerService;Avira Planificateur;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe [2011-12-01 86224]
S2 ePowerSvc;Acer ePower Service;c:\program files\Acer\Acer PowerSmart Manager\ePowerSvc.exe [2009-12-03 788512]
S2 FPSensor;EgisTec-Corp Fingerprint Reader Driver (FPSensor.sys);c:\windows\system32\Drivers\FPSensor.sys [2012-02-24 36400]
S2 Greg_Service;GRegService;c:\program files (x86)\Acer\Registration\GregHSRW.exe [2009-08-28 1150496]
S2 IGBASVC;EgisTec Service;c:\program files (x86)\Acer Bio Protection\BASVC.exe [2009-11-10 3450368]
S2 NTI IScheduleSvc;NTI IScheduleSvc;c:\program files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe [2009-10-29 255744]
S2 NTISchedulerSvc;NTI Backup Now 5 Scheduler Service;c:\program files (x86)\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe [2009-11-06 144640]
S2 Skype C2C Service;Skype C2C Service;c:\programdata\Skype\Toolbars\Skype C2C Service\c2c_service.exe [2012-06-19 3048136]
S2 UNS;Intel(R) Management & Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2009-09-30 2314240]
S2 Updater Service;Updater Service;c:\program files\Acer\Acer Updater\UpdaterService.exe [2009-07-04 240160]
S3 HECIx64;Intel(R) Management Engine Interface;c:\windows\system32\DRIVERS\HECIx64.sys [2009-09-17 56344]
S3 nuvotoncir;Nuvoton IR Transceiver;c:\windows\system32\DRIVERS\nuvotoncir.sys [2009-08-31 48128]
S3 RTL8187B;Carte réseau USB 2.0 Realtek RTL8187B sans fil 802.11b/g 54 Mbits/s;c:\windows\system32\DRIVERS\RTL8187B.sys [2009-06-10 416768]
S3 VBoxNetFlt;VirtualBox Bridged Networking Service;c:\windows\system32\DRIVERS\VBoxNetFlt.sys [2011-12-19 165680]
.
.
--- Autres Services/Pilotes en mémoire ---
.
*NewlyCreated* - WS2IFSL
.
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{35aad3b1-ad8b-11e1-950e-ea3aa75ee337}]
\shell\AutoRun\command - E:\Autorun.exe
.
Contenu du dossier 'Tâches planifiées'
.
2012-07-02 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-05-25 22:06]
.
2012-07-02 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-02-29 17:40]
.
2012-07-02 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-02-29 17:40]
.
2012-07-01 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-492616687-4278636726-398013855-1000Core.job
- c:\users\acer\AppData\Local\Google\Update\GoogleUpdate.exe [2012-05-20 08:25]
.
2012-07-02 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-492616687-4278636726-398013855-1000UA.job
- c:\users\acer\AppData\Local\Google\Update\GoogleUpdate.exe [2012-05-20 08:25]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\egisPSDP]
@="{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}"
[HKEY_CLASSES_ROOT\CLSID\{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}]
2009-09-10 13:44 137512 ----a-w- c:\program files (x86)\EgisTec\MyWinLocker 3\x64\PSDProtect.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IAAnotif"="c:\program files (x86)\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2009-10-13 186904]
"mwlDaemon"="c:\program files (x86)\EgisTec\MyWinLocker 3\x86\mwlDaemon.exe" [2009-09-10 349480]
"Acer ePower Management"="c:\program files\Acer\Acer PowerSmart Manager\ePowerTrayLauncher.exe" [2009-12-03 496160]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2009-10-13 8224800]
"PLFSetI"="c:\windows\PLFSetI.exe" [2009-11-20 200704]
"combofix"="c:\combofix\CF6556.3XE" [2009-07-14 344576]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"LoadAppInit_DLLs"=0x0
.
------- Examen supplémentaire -------
.
uStart Page = hxxp://www.google.fr/
uLocal Page = c:\windows\system32\blank.htm
mStart Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=040c&m=aspire_8942g&r=27360212g106l0363z145t4971h237
mLocal Page = c:\windows\SysWOW64\blank.htm
IE: Download with &Media Finder - c:\program files (x86)\Media Finder\hook.html
IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~1\Office12\EXCEL.EXE/3000
IE: Envoyer au périphérique &Bluetooth... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
IE: Envoyer l'&image au périphérique Bluetooth... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
LSP: mswsock.dll
TCP: DhcpNameServer = 192.168.1.1
FF - ProfilePath - c:\users\acer\AppData\Roaming\Mozilla\Firefox\Profiles\3h1grxyv.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - www.google.fr
FF - prefs.js: keyword.URL - hxxp://search.babylon.com/?affID=112555&tt=100512_3_&babsrc=KW_ss&mntrId=b2ef38de00000000000000871112a3dd&q=
FF - prefs.js: network.proxy.type - 0
FF - user.js: extensions.BabylonToolbar_i.babTrack - affID=112555&tt=100512_3_
FF - user.js: extensions.BabylonToolbar_i.babExt -
FF - user.js: extensions.BabylonToolbar_i.srcExt - ss
FF - user.js: extensions.BabylonToolbar_i.id - b2ef38de00000000000000871112a3dd
FF - user.js: extensions.BabylonToolbar_i.hardId - b2ef38de00000000000000871112a3dd
FF - user.js: extensions.BabylonToolbar_i.instlDay - 15474
FF - user.js: extensions.BabylonToolbar_i.vrsn - 1.5.3.17
FF - user.js: extensions.BabylonToolbar_i.vrsni - 1.5.3.17
FF - user.js: extensions.BabylonToolbar_i.vrsnTs - 1.5.3.1722:27
FF - user.js: extensions.BabylonToolbar_i.prtnrId - babylon
FF - user.js: extensions.BabylonToolbar_i.prdct - BabylonToolbar
FF - user.js: extensions.BabylonToolbar_i.aflt - babsst
FF - user.js: extensions.BabylonToolbar_i.smplGrp - none
FF - user.js: extensions.BabylonToolbar_i.tlbrId - base
FF - user.js: extensions.BabylonToolbar_i.instlRef - sst
.
- - - - ORPHELINS SUPPRIMES - - - -
.
Toolbar-Locked - (no file)
Wow6432Node-HKCU-Run-Media Finder - c:\program files (x86)\Media Finder\Media Finder.exe
Wow6432Node-HKLM-Run-Tutorials - (no file)
SafeBoot-mcmscsvc
SafeBoot-MCODS
Toolbar-Locked - (no file)
HKLM-Run-SynTPEnh - c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe
AddRemove-RON 2010 ENGLISH DL - c:\windows\RON 2010 ENGLISH DL Uninstaller.exe
AddRemove-{9C049499-055C-4a0c-A916-1D8CA1FF45EB} - c:\program files (x86)\\InstallShield Installation Information\{9C049499-055C-4a0c-A916-1D8CA1FF45EB}\Install.exe
.
.
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------
.
[HKEY_USERS\S-1-5-21-492616687-4278636726-398013855-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.eml\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLiveMail.Email.1"
.
[HKEY_USERS\S-1-5-21-492616687-4278636726-398013855-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.vcf\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLiveMail.VCard.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_2_202_235_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_2_202_235_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_2_202_235.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_2_202_235.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_2_202_235.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_2_202_235.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Autres processus actifs ------------------------
.
c:\program files (x86)\Acer Bio Protection\CompPtcVUI.exe
c:\program files (x86)\Avira\AntiVir Desktop\avguard.exe
c:\program files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
c:\program files (x86)\Intel\Intel Matrix Storage Manager\IAANTMon.exe
c:\progra~2\EASYPH~1.9\Apache\bin\apache.exe
c:\progra~2\EASYPH~1.9\MySql\bin\mysqld.exe
c:\progra~2\EASYPH~1.9\Apache\bin\apache.exe
c:\program files (x86)\avira\antivir desktop\avcenter.exe
c:\program files (x86)\Avira\AntiVir Desktop\update.exe
c:\program files (x86)\Avira\AntiVir Desktop\updrgui.exe
.
**************************************************************************
.
Heure de fin: 2012-07-02 18:47:21 - La machine a redémarré
ComboFix-quarantined-files.txt 2012-07-02 16:47
.
Avant-CF: 409 945 890 816 octets libres
Après-CF: 410 823 184 384 octets libres
.
- - End Of File - - DA446B7CF1453BFA6EFCEC88136EAC57

"c:\windows\system32\services.exe . . . est infecté!!"

--> Refais une analyse avec ComboFix.

ComboFix 12-07-02.01 - acer 02/07/2012 19:35:27.2.4 - x64
Microsoft Windows 7 Édition Familiale Premium 6.1.7600.0.1252.33.1036.18.3957.2628 [GMT 2:00]
Lancé depuis: c:\users\acer\Downloads\ComboFix.exe
AV: Avira Desktop *Disabled/Outdated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
SP: Avira Desktop *Disabled/Outdated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
Une copie infectée de c:\windows\system32\Services.exe a été trouvée et désinfectée
Copie restaurée à partir de - c:\windows\winsxs\amd64_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.1.7600.16385_none_2b54b20ee6fa07b1\services.exe
.
.
((((((((((((((((((((((((((((( Fichiers créés du 2012-06-02 au 2012-07-02 ))))))))))))))))))))))))))))))))))))
.
.
2012-07-02 17:43 . 2012-07-02 17:43 -------- d-----w- c:\users\Default\AppData\Local\temp
2012-07-02 15:38 . 2012-07-02 15:38 -------- d-----w- c:\program files (x86)\Common Files\Java
2012-07-02 15:37 . 2012-07-02 15:37 -------- d-----w- c:\program files (x86)\Oracle
2012-07-02 15:36 . 2012-05-04 17:29 772504 ----a-w- c:\windows\SysWow64\npDeployJava1.dll
2012-07-02 15:34 . 2012-07-02 15:34 -------- d-----w- c:\program files (x86)\Java
2012-07-02 14:54 . 2012-07-02 14:54 -------- d-----w- c:\users\acer\AppData\Roaming\Avira
2012-07-02 14:49 . 2011-12-01 15:55 97312 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2012-07-02 14:49 . 2011-12-01 15:55 27760 ----a-w- c:\windows\system32\drivers\avkmgr.sys
2012-07-02 14:49 . 2011-12-01 15:55 130760 ----a-w- c:\windows\system32\drivers\avipbb.sys
2012-07-02 14:49 . 2012-07-02 14:49 -------- d-----w- c:\programdata\Avira
2012-07-02 14:49 . 2012-07-02 14:49 -------- d-----w- c:\program files (x86)\Avira
2012-07-02 13:50 . 2012-07-02 13:51 -------- d-----w- c:\program files (x86)\EasyPHP-5.3.9
2012-06-28 07:45 . 2012-06-28 07:45 -------- d-----w- c:\program files\CCleaner
2012-06-25 13:47 . 2012-06-25 13:47 -------- d-----w- c:\program files (x86)\Notepad++
2012-06-24 13:39 . 2012-06-24 13:39 -------- d-----w- c:\users\acer\AppData\Roaming\My Games
2012-06-24 13:30 . 2012-06-24 13:30 -------- d-----w- c:\program files (x86)\Firaxis Games
2012-06-24 13:30 . 2005-04-03 21:02 69714 ----a-w- c:\program files (x86)\Common Files\InstallShield\Professional\RunTime\11\00\Intel32\ctor.dll
2012-06-24 13:30 . 2005-04-03 21:01 274432 ----a-w- c:\program files (x86)\Common Files\InstallShield\Professional\RunTime\11\00\Intel32\iscript.dll
2012-06-24 13:30 . 2005-04-03 21:00 184320 ----a-w- c:\program files (x86)\Common Files\InstallShield\Professional\RunTime\11\00\Intel32\iuser.dll
2012-06-24 13:30 . 2005-04-03 21:00 63488 ----a-w- c:\program files (x86)\Common Files\InstallShield\Professional\RunTime\11\00\Intel32\ISBEW64.exe
2012-06-24 13:30 . 2005-04-03 20:59 5632 ----a-w- c:\program files (x86)\Common Files\InstallShield\Professional\RunTime\11\00\Intel32\DotNetInstaller.exe
2012-06-24 13:30 . 2005-04-03 21:02 753664 ----a-w- c:\program files (x86)\Common Files\InstallShield\Professional\RunTime\11\00\Intel32\iKernel.dll
2012-06-24 13:30 . 2012-06-24 13:30 200836 ----a-w- c:\program files (x86)\Common Files\InstallShield\Professional\RunTime\11\00\Intel32\iGdi.dll
2012-06-24 13:30 . 2012-06-24 13:30 331908 ----a-w- c:\program files (x86)\Common Files\InstallShield\Professional\RunTime\11\00\Intel32\setup.dll
2012-06-24 07:41 . 2012-06-24 07:41 -------- d-----w- c:\users\acer\AppData\Local\Macromedia
2012-06-22 07:13 . 2012-06-02 22:19 57880 ----a-w- c:\windows\system32\wuauclt.exe
2012-06-22 07:13 . 2012-06-02 22:19 44056 ----a-w- c:\windows\system32\wups2.dll
2012-06-22 07:13 . 2012-06-02 22:19 2428952 ----a-w- c:\windows\system32\wuaueng.dll
2012-06-22 07:13 . 2012-06-02 22:15 2622464 ----a-w- c:\windows\system32\wucltux.dll
2012-06-22 07:12 . 2012-06-02 22:19 38424 ----a-w- c:\windows\system32\wups.dll
2012-06-22 07:12 . 2012-06-02 22:19 701976 ----a-w- c:\windows\system32\wuapi.dll
2012-06-22 07:12 . 2012-06-02 22:15 99840 ----a-w- c:\windows\system32\wudriver.dll
2012-06-22 07:11 . 2012-06-02 13:19 186752 ----a-w- c:\windows\system32\wuwebv.dll
2012-06-22 07:11 . 2012-06-02 13:15 36864 ----a-w- c:\windows\system32\wuapp.exe
2012-06-21 15:21 . 2012-06-21 15:21 770384 ----a-w- c:\program files (x86)\Mozilla Firefox\msvcr100.dll
2012-06-21 15:21 . 2012-06-21 15:21 421200 ----a-w- c:\program files (x86)\Mozilla Firefox\msvcp100.dll
2012-06-19 15:35 . 2012-06-19 15:35 4967624 ----a-w- c:\program files (x86)\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}\components\SkypeFfComponent.dll
2012-06-16 20:36 . 2012-03-06 23:02 28504 ----a-w- c:\windows\system32\drivers\aswKbd.sys
2012-06-16 07:56 . 2012-05-18 02:01 499200 ----a-w- c:\program files\Internet Explorer\jsdbgui.dll
2012-06-16 07:56 . 2012-05-17 22:38 678912 ----a-w- c:\program files (x86)\Internet Explorer\iedvtool.dll
2012-06-16 07:56 . 2012-05-18 02:02 887296 ----a-w- c:\program files\Internet Explorer\iedvtool.dll
2012-06-13 20:43 . 2012-05-04 10:52 5505392 ----a-w- c:\windows\system32\ntoskrnl.exe
2012-06-13 20:43 . 2012-05-04 10:08 3902320 ----a-w- c:\windows\SysWow64\ntoskrnl.exe
2012-06-13 20:43 . 2012-05-04 10:08 3958128 ----a-w- c:\windows\SysWow64\ntkrnlpa.exe
2012-06-13 20:05 . 2012-04-26 05:34 149504 ----a-w- c:\windows\system32\rdpcorekmts.dll
2012-06-13 20:05 . 2012-04-26 05:34 76288 ----a-w- c:\windows\system32\rdpwsx.dll
2012-06-13 20:05 . 2012-04-26 05:28 9216 ----a-w- c:\windows\system32\rdrmemptylst.exe
2012-06-13 20:04 . 2012-05-02 05:32 208896 ----a-w- c:\windows\system32\profsvc.dll
2012-06-13 19:59 . 2012-05-15 01:32 3144192 ----a-w- c:\windows\system32\win32k.sys
2012-06-13 19:59 . 2012-04-28 03:50 204800 ----a-w- c:\windows\system32\drivers\rdpwd.sys
2012-06-13 19:59 . 2012-04-07 12:18 3213824 ----a-w- c:\windows\system32\msi.dll
2012-06-13 19:59 . 2012-04-07 11:34 2342400 ----a-w- c:\windows\SysWow64\msi.dll
2012-06-13 19:59 . 2012-04-24 05:59 1460224 ----a-w- c:\windows\system32\crypt32.dll
2012-06-13 19:59 . 2012-04-24 04:47 1156608 ----a-w- c:\windows\SysWow64\crypt32.dll
2012-06-13 19:59 . 2012-04-24 05:59 182272 ----a-w- c:\windows\system32\cryptsvc.dll
2012-06-13 19:59 . 2012-04-24 05:59 140288 ----a-w- c:\windows\system32\cryptnet.dll
2012-06-13 19:59 . 2012-04-24 04:47 139264 ----a-w- c:\windows\SysWow64\cryptsvc.dll
2012-06-13 19:59 . 2012-04-24 04:47 103936 ----a-w- c:\windows\SysWow64\cryptnet.dll
2012-06-10 08:04 . 2012-06-11 19:43 -------- d-----w- c:\program files (x86)\EA GAMES
2012-06-10 08:04 . 2004-08-18 08:34 442368 ----a-r- c:\windows\SysWow64\vp6vfw.dll
2012-06-09 19:35 . 2012-06-09 19:35 283200 ----a-w- c:\windows\system32\drivers\dtsoftbus01.sys
2012-06-09 19:35 . 2012-06-28 07:48 -------- d-----w- c:\users\acer\AppData\Roaming\DAEMON Tools Lite
2012-06-09 19:34 . 2012-06-09 19:35 -------- d-----w- c:\program files (x86)\DAEMON Tools Lite
2012-06-09 15:36 . 2012-06-10 08:01 -------- d-----w- c:\programdata\DAEMON Tools Lite
.
.
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-06-23 22:05 . 2012-05-25 19:22 426184 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2012-06-23 22:05 . 2012-02-29 20:57 70344 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2012-05-17 15:48 . 2012-05-06 08:30 772114 ----a-w- c:\windows\RON 2010 FRENCH DL Uninstaller.exe
2012-05-04 17:29 . 2012-03-10 11:40 687504 ----a-w- c:\windows\SysWow64\deployJava1.dll
2012-04-08 08:23 . 2012-04-08 08:23 40960 ----a-r- c:\users\acer\AppData\Roaming\Microsoft\Installer\{9559F7CA-5E34-4237-A2D9-D856464AD727}\NewShortcut1_9559F7CA5E344237A2D9D856464AD727.exe
2012-04-08 08:23 . 2012-04-08 08:23 40960 ----a-r- c:\users\acer\AppData\Roaming\Microsoft\Installer\{9559F7CA-5E34-4237-A2D9-D856464AD727}\ARPPRODUCTICON.exe
2012-04-04 13:56 . 2012-05-10 19:50 24904 ----a-w- c:\windows\system32\drivers\mbam.sys
.
.
((((((((((((((((((((((((((((( SnapShot@2012-07-02_16.22.30 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-12-02 03:45 . 2012-07-02 17:46 48282 c:\windows\system32\wdi\ShutdownPerformanceDiagnostics_SystemData.bin
+ 2009-07-14 05:10 . 2012-07-02 17:46 40168 c:\windows\system32\wdi\BootPerformanceDiagnostics_SystemData.bin
+ 2012-02-24 19:13 . 2012-07-02 17:46 7624 c:\windows\system32\wdi\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-492616687-4278636726-398013855-1000_UserData.bin
+ 2012-07-02 17:44 . 2012-07-02 17:44 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
- 2012-07-02 16:21 . 2012-07-02 16:21 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
+ 2012-07-02 17:44 . 2012-07-02 17:44 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
- 2012-07-02 16:21 . 2012-07-02 16:21 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
+ 2009-07-13 23:19 . 2009-07-14 01:39 328704 c:\windows\system32\Services.exe
- 2009-07-14 05:01 . 2012-07-02 16:20 323228 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat
+ 2009-07-14 05:01 . 2012-07-02 17:43 323228 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat
+ 2012-02-29 21:01 . 2012-07-02 17:43 854735 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-492616687-4278636726-398013855-1000-12288.dat
- 2012-02-29 21:01 . 2012-07-02 16:20 854735 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-492616687-4278636726-398013855-1000-12288.dat
- 2009-07-14 02:34 . 2012-07-02 13:05 10485760 c:\windows\system32\SMI\Store\Machine\SCHEMA.DAT
+ 2009-07-14 02:34 . 2012-07-02 16:37 10485760 c:\windows\system32\SMI\Store\Machine\SCHEMA.DAT
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\egisPSDP]
@="{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}"
[HKEY_CLASSES_ROOT\CLSID\{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}]
2009-09-10 13:41 120104 ----a-w- c:\program files (x86)\EgisTec\MyWinLocker 3\x86\PSDProtect.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2012-06-02 4786048]
"EA Core"="c:\program files (x86)\Electronic Arts\EADM\Core.exe" [2009-03-28 3325952]
"Skype"="c:\program files (x86)\Skype\Phone\Skype.exe" [2012-05-03 17355912]
"swg"="c:\program files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-12-02 39408]
"ShowBatteryBar"="c:\program files\BatteryBar\ShowBatteryBar.exe" [2009-05-28 89600]
"DAEMON Tools Lite"="c:\program files (x86)\DAEMON Tools Lite\DTLite.exe" [2012-04-17 3671872]
"Speech Recognition"="c:\windows\Speech\Common\sapisvr.exe" [2009-07-14 44544]
"EasyPHP"="c:\program files (x86)\EasyPHP-5.3.9\EasyPHP-5.3.9.exe" [2011-07-13 496640]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"EgisTecLiveUpdate"="c:\program files (x86)\EgisTec Egis Software Update\EgisUpdate.exe" [2009-08-04 199464]
"BackupManagerTray"="c:\program files (x86)\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe" [2009-10-29 261888]
"NortonOnlineBackupReminder"="c:\program files (x86)\Symantec\Norton Online Backup\Activation\NobuActivation.exe" [2009-07-25 588648]
"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2009-11-23 98304]
"LManager"="c:\program files (x86)\Launch Manager\LManager.exe" [2009-09-24 825864]
"EgisTecPMMUpdate"="c:\program files (x86)\EgisTec IPS\PmmUpdate.exe" [2009-12-08 401192]
"EgisUpdate"="c:\program files (x86)\EgisTec IPS\EgisUpdate.exe" [2009-12-08 201512]
"VitaKeyPdtWzd"="c:\program files (x86)\Acer Bio Protection\PdtWzd.exe" [2009-11-10 3569152]
"ArcadeDeluxeAgent"="c:\program files (x86)\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe" [2009-10-29 419112]
"PlayMovie"="c:\program files (x86)\Acer Arcade Deluxe\PlayMovie\PMVService.exe" [2009-11-12 181480]
"Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe" [2011-01-30 35736]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-11-10 932288]
"avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2011-12-01 258512]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2012-01-17 252296]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Acer VCM.lnk - c:\program files (x86)\Acer\Acer VCM\AcerVCM.exe [2009-12-2 708608]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"aux5"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\!SASCORE]
@=""
.
R2 0069251341244939mcinstcleanup;McAfee Application Installer Cleanup (0069251341244939);c:\users\acer\AppData\Local\Temp\006925~1.EXE [x]
R2 avast! Firewall;avast! Firewall;c:\program files\AVAST Software\Avast\afwServ.exe [x]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 gupdate;Service Google Update (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-02-29 135664]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe [2012-05-03 158856]
R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-06-23 250056]
R3 btusbflt;Bluetooth USB Filter;c:\windows\system32\drivers\btusbflt.sys [2009-07-01 52264]
R3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\DRIVERS\btwl2cap.sys [2009-04-07 35104]
R3 gupdatem;Service Google Update (gupdatem);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-02-29 135664]
R3 hidshim;Service for HID-KMDF Shim layer;c:\windows\system32\DRIVERS\hidshim.sys [2009-08-31 6656]
R3 k57nd60a;Broadcom NetLink (TM) Gigabit Ethernet - NDIS 6.0;c:\windows\system32\DRIVERS\k57nd60a.sys [2009-08-06 320040]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2012-04-04 24904]
R3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2012-06-21 113120]
R3 MWLService;MyWinLocker Service;c:\program files (x86)\EgisTec\MyWinLocker 3\x86\\MWLService.exe [2009-09-10 305448]
R3 NETw5s64;Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows 7 - 64 Bit;c:\windows\system32\DRIVERS\NETw5s64.sys [2009-09-15 6952960]
R3 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [2010-06-25 35344]
R3 NTIBackupSvc;NTI Backup Now 5 Backup Service;c:\program files (x86)\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe [2009-11-06 50432]
R3 nuvotonhidcir;Nuvoton HID CIR Receiver;c:\windows\system32\DRIVERS\nuvotonhidcir.sys [2009-08-31 26624]
R3 nuvotonir;Nuvoton CIR Transceiver;c:\windows\system32\DRIVERS\nuvotonir.sys [2009-08-31 68096]
R3 RTL8187B;Carte réseau USB 2.0 Realtek RTL8187B sans fil 802.11b/g 54 Mbits/s;c:\windows\system32\DRIVERS\RTL8187B.sys [2009-06-10 416768]
R3 RTL8192su;Realtek RTL8192SU Wireless LAN 802.11n USB 2.0 Network Adapter;c:\windows\system32\DRIVERS\RTL8192su.sys [2009-10-14 674304]
R3 VBoxNetAdp;VirtualBox Host-Only Ethernet Adapter;c:\windows\system32\DRIVERS\VBoxNetAdp.sys [2011-12-19 146736]
R3 WatAdminSvc;Service Windows Activation Technologies;c:\windows\system32\Wat\WatAdminSvc.exe [2012-03-02 1255736]
R4 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2012-04-04 654408]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-22 57184]
S0 johci;JMicron 1394 Filter Driver;c:\windows\system32\DRIVERS\johci.sys [2009-08-24 22640]
S1 aswKbd;aswKbd; [x]
S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys [2011-12-01 27760]
S1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys [2012-06-09 283200]
S1 mwlPSDFilter;mwlPSDFilter;c:\windows\system32\DRIVERS\mwlPSDFilter.sys [2009-06-02 22576]
S1 mwlPSDNServ;mwlPSDNServ;c:\windows\system32\DRIVERS\mwlPSDNServ.sys [2009-06-02 20016]
S1 mwlPSDVDisk;mwlPSDVDisk;c:\windows\system32\DRIVERS\mwlPSDVDisk.sys [2009-06-02 60464]
S1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV64.SYS [2011-07-22 14928]
S1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL64.SYS [2011-07-12 12368]
S1 VBoxDrv;VirtualBox Service;c:\windows\system32\DRIVERS\VBoxDrv.sys [2011-12-19 224048]
S1 VBoxUSBMon;VirtualBox USB Monitor Driver;c:\windows\system32\DRIVERS\VBoxUSBMon.sys [2011-12-19 130864]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-14 59904]
S2 !SASCORE;SAS Core Service;c:\program files\SUPERAntiSpyware\SASCORE64.EXE [2011-08-11 140672]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2009-11-23 202752]
S2 AntiVirSchedulerService;Avira Planificateur;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe [2011-12-01 86224]
S2 ePowerSvc;Acer ePower Service;c:\program files\Acer\Acer PowerSmart Manager\ePowerSvc.exe [2009-12-03 788512]
S2 FPSensor;EgisTec-Corp Fingerprint Reader Driver (FPSensor.sys);c:\windows\system32\Drivers\FPSensor.sys [2012-02-24 36400]
S2 Greg_Service;GRegService;c:\program files (x86)\Acer\Registration\GregHSRW.exe [2009-08-28 1150496]
S2 IGBASVC;EgisTec Service;c:\program files (x86)\Acer Bio Protection\BASVC.exe [2009-11-10 3450368]
S2 NTI IScheduleSvc;NTI IScheduleSvc;c:\program files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe [2009-10-29 255744]
S2 NTISchedulerSvc;NTI Backup Now 5 Scheduler Service;c:\program files (x86)\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe [2009-11-06 144640]
S2 RS_Service;Raw Socket Service;c:\program files (x86)\Acer\Acer VCM\RS_Service.exe [2009-07-10 253952]
S2 Skype C2C Service;Skype C2C Service;c:\programdata\Skype\Toolbars\Skype C2C Service\c2c_service.exe [2012-06-19 3048136]
S2 UNS;Intel(R) Management & Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2009-09-30 2314240]
S2 Updater Service;Updater Service;c:\program files\Acer\Acer Updater\UpdaterService.exe [2009-07-04 240160]
S3 HECIx64;Intel(R) Management Engine Interface;c:\windows\system32\DRIVERS\HECIx64.sys [2009-09-17 56344]
S3 nuvotoncir;Nuvoton IR Transceiver;c:\windows\system32\DRIVERS\nuvotoncir.sys [2009-08-31 48128]
S3 VBoxNetFlt;VirtualBox Bridged Networking Service;c:\windows\system32\DRIVERS\VBoxNetFlt.sys [2011-12-19 165680]
.
.
Contenu du dossier 'Tâches planifiées'
.
2012-07-02 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-05-25 22:06]
.
2012-07-02 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-02-29 17:40]
.
2012-07-02 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-02-29 17:40]
.
2012-07-01 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-492616687-4278636726-398013855-1000Core.job
- c:\users\acer\AppData\Local\Google\Update\GoogleUpdate.exe [2012-05-20 08:25]
.
2012-07-02 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-492616687-4278636726-398013855-1000UA.job
- c:\users\acer\AppData\Local\Google\Update\GoogleUpdate.exe [2012-05-20 08:25]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\egisPSDP]
@="{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}"
[HKEY_CLASSES_ROOT\CLSID\{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}]
2009-09-10 13:44 137512 ----a-w- c:\program files (x86)\EgisTec\MyWinLocker 3\x64\PSDProtect.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IAAnotif"="c:\program files (x86)\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2009-10-13 186904]
"mwlDaemon"="c:\program files (x86)\EgisTec\MyWinLocker 3\x86\mwlDaemon.exe" [2009-09-10 349480]
"Acer ePower Management"="c:\program files\Acer\Acer PowerSmart Manager\ePowerTrayLauncher.exe" [2009-12-03 496160]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2009-10-13 8224800]
"SynTPEnh"="c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe" [BU]
"PLFSetI"="c:\windows\PLFSetI.exe" [2009-11-20 200704]
.
------- Examen supplémentaire -------
.
uStart Page = hxxp://www.google.fr/
uLocal Page = c:\windows\system32\blank.htm
mStart Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=040c&m=aspire_8942g&r=27360212g106l0363z145t4971h237
mLocal Page = c:\windows\SysWOW64\blank.htm
IE: Download with &Media Finder - c:\program files (x86)\Media Finder\hook.html
IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~1\Office12\EXCEL.EXE/3000
IE: Envoyer au périphérique &Bluetooth... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
IE: Envoyer l'&image au périphérique Bluetooth... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
TCP: DhcpNameServer = 192.168.1.1
FF - ProfilePath - c:\users\acer\AppData\Roaming\Mozilla\Firefox\Profiles\3h1grxyv.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - www.google.fr
FF - prefs.js: keyword.URL - hxxp://search.babylon.com/?affID=112555&tt=100512_3_&babsrc=KW_ss&mntrId=b2ef38de00000000000000871112a3dd&q=
FF - prefs.js: network.proxy.type - 0
FF - user.js: extensions.BabylonToolbar_i.babTrack - affID=112555&tt=100512_3_
FF - user.js: extensions.BabylonToolbar_i.babExt -
FF - user.js: extensions.BabylonToolbar_i.srcExt - ss
FF - user.js: extensions.BabylonToolbar_i.id - b2ef38de00000000000000871112a3dd
FF - user.js: extensions.BabylonToolbar_i.hardId - b2ef38de00000000000000871112a3dd
FF - user.js: extensions.BabylonToolbar_i.instlDay - 15474
FF - user.js: extensions.BabylonToolbar_i.vrsn - 1.5.3.17
FF - user.js: extensions.BabylonToolbar_i.vrsni - 1.5.3.17
FF - user.js: extensions.BabylonToolbar_i.vrsnTs - 1.5.3.1722:27
FF - user.js: extensions.BabylonToolbar_i.prtnrId - babylon
FF - user.js: extensions.BabylonToolbar_i.prdct - BabylonToolbar
FF - user.js: extensions.BabylonToolbar_i.aflt - babsst
FF - user.js: extensions.BabylonToolbar_i.smplGrp - none
FF - user.js: extensions.BabylonToolbar_i.tlbrId - base
FF - user.js: extensions.BabylonToolbar_i.instlRef - sst
.
- - - - ORPHELINS SUPPRIMES - - - -
.
Toolbar-Locked - (no file)
.
.
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------
.
[HKEY_USERS\S-1-5-21-492616687-4278636726-398013855-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.eml\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLiveMail.Email.1"
.
[HKEY_USERS\S-1-5-21-492616687-4278636726-398013855-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.vcf\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLiveMail.VCard.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_2_202_235_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_2_202_235_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_2_202_235.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_2_202_235.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_2_202_235.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_2_202_235.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Autres processus actifs ------------------------
.
c:\program files (x86)\Acer Bio Protection\CompPtcVUI.exe
c:\program files (x86)\Avira\AntiVir Desktop\avguard.exe
c:\program files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
c:\program files (x86)\Intel\Intel Matrix Storage Manager\IAANTMon.exe
c:\progra~2\EASYPH~1.9\MySql\bin\mysqld.exe
.
**************************************************************************
.
Heure de fin: 2012-07-02 19:54:13 - La machine a redémarré
ComboFix-quarantined-files.txt 2012-07-02 17:54
ComboFix2.txt 2012-07-02 16:47
.
Avant-CF: 410 793 984 000 octets libres
Après-CF: 410 407 309 312 octets libres
.
- - End Of File - - 945B5A6D4D7F140FB7A2D6BF25F81803

"Une copie infectée de c:\windows\system32\Services.exe a été trouvée et désinfectée "

--> Bien.

On va s'occuper des adwares :

--> Télécharge et lance AdwCleaner (de Xplode), choisis l'option "Suppression" et poste le rapport :
http://general-changelog-team.fr/fr/downloads/viewdownload/20-outils-de-xplode/2-adwcleaner

# AdwCleaner v1.701 - Rapport créé le 03/07/2012 à 10:02:12
# Mis à jour le 02/07/2012 par Xplode
# Système d'exploitation : Windows 7 Home Premium (64 bits)
# Nom d'utilisateur : acer - ACER-PC
# Exécuté depuis : C:\Users\acer\Downloads\adwcleaner.exe
# Option [Recherche]

***** [Services] *****

***** [Fichiers / Dossiers] *****

Dossier Présent : C:\Users\acer\AppData\Local\Babylon
Dossier Présent : C:\Users\acer\AppData\Roaming\Babylon
Dossier Présent : C:\Users\acer\AppData\Roaming\Media Finder
Dossier Présent : C:\Users\acer\AppData\Roaming\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}\gencrawler@some.com
Dossier Présent : C:\ProgramData\Babylon
Dossier Présent : C:\ProgramData\boost_interprocess
Dossier Présent : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Media Finder
Fichier Présent : C:\Users\acer\AppData\Roaming\Mozilla\Firefox\Profiles\3h1grxyv.default\searchplugins\SweetIm.xml
Fichier Présent : C:\Users\Public\Desktop\eBay.lnk
Fichier Présent : C:\Program Files (x86)\Mozilla Firefox\searchplugins\babylon.xml

***** [Registre] *****

Clé Présente : HKCU\Software\MediaFinder
Clé Présente : HKCU\Software\Microsoft\Internet Explorer\MenuExt\Download with &Media Finder
Clé Présente : HKCU\Software\Softonic
Clé Présente : HKCU\Software\SweetIm
Clé Présente : HKCU\Software\Tutorials
Clé Présente : HKLM\SOFTWARE\Babylon
Clé Présente : HKLM\SOFTWARE\Classes\AppID\escort.DLL
Clé Présente : HKLM\SOFTWARE\Classes\MF
Clé Présente : HKLM\SOFTWARE\Google\Chrome\Extensions\dednnpigldgdbpgcdpfppmlcnnbjciel
Clé Présente : HKLM\SOFTWARE\Google\Chrome\Extensions\lpmkgpnbiojfaoklbkpfneikocaobfai
Clé Présente : HKLM\SOFTWARE\SweetIM
[x64] Clé Présente : HKCU\Software\MediaFinder
[x64] Clé Présente : HKCU\Software\Microsoft\Internet Explorer\MenuExt\Download with &Media Finder
[x64] Clé Présente : HKCU\Software\Softonic
[x64] Clé Présente : HKCU\Software\SweetIm
[x64] Clé Présente : HKCU\Software\Tutorials
[x64] Clé Présente : HKLM\SOFTWARE\Classes\AppID\escort.DLL
[x64] Clé Présente : HKLM\SOFTWARE\Classes\MF

***** [Registre - GUID] *****

Clé Présente : HKLM\SOFTWARE\Classes\AppID\{09C554C3-109B-483C-A06B-F14172F1A947}
Clé Présente : HKLM\SOFTWARE\Classes\AppID\{BDB69379-802F-4EAF-B541-F8DE92DD98DB}
Clé Présente : HKLM\SOFTWARE\Classes\CLSID\{2EECD738-5844-4A99-B4B6-146BF802613B}
Clé Présente : HKLM\SOFTWARE\Classes\CLSID\{E46C8196-B634-44A1-AF6E-957C64278AB1}
Clé Présente : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4D79-A620-CCE0C0A66CC9}
Clé Présente : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{2EECD738-5844-4A99-B4B6-146BF802613B}
Clé Présente : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{97F2FF5B-260C-4CCF-834A-2DDA4E29E39E}
Clé Présente : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{EEE6C35C-6118-11DC-9C72-001320C79847}
Clé Présente : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2EECD738-5844-4A99-B4B6-146BF802613B}
[x64] Clé Présente : HKLM\SOFTWARE\Classes\AppID\{09C554C3-109B-483C-A06B-F14172F1A947}
[x64] Clé Présente : HKLM\SOFTWARE\Classes\AppID\{BDB69379-802F-4EAF-B541-F8DE92DD98DB}
[x64] Clé Présente : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4D79-A620-CCE0C0A66CC9}
[x64] Clé Présente : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{2EECD738-5844-4A99-B4B6-146BF802613B}
[x64] Clé Présente : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{97F2FF5B-260C-4CCF-834A-2DDA4E29E39E}
[x64] Clé Présente : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{EEE6C35C-6118-11DC-9C72-001320C79847}
[x64] Clé Présente : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2EECD738-5844-4A99-B4B6-146BF802613B}

***** [Navigateurs] *****

-\\ Internet Explorer v9.0.8112.16421

[OK] Le registre ne contient aucune entrée illégitime.

-\\ Mozilla Firefox v13.0.1 (fr)

Nom du profil : default
Fichier : C:\Users\acer\AppData\Roaming\Mozilla\Firefox\Profiles\3h1grxyv.default\prefs.js

Présente : user_pref("browser.babylon.HPOnNewTab", "search.babylon.com");
Présente : user_pref("browser.search.defaultenginename", "Search the web (Babylon)");
Présente : user_pref("browser.search.order.1", "Search the web (Babylon)");
Présente : user_pref("extensions.BabylonToolbar_i.aflt", "babsst");
Présente : user_pref("extensions.BabylonToolbar_i.babExt", "");
Présente : user_pref("extensions.BabylonToolbar_i.babTrack", "affID=112555&tt=100512_3_");
Présente : user_pref("extensions.BabylonToolbar_i.hardId", "b2ef38de00000000000000871112a3dd");
Présente : user_pref("extensions.BabylonToolbar_i.id", "b2ef38de00000000000000871112a3dd");
Présente : user_pref("extensions.BabylonToolbar_i.instlDay", "15474");
Présente : user_pref("extensions.BabylonToolbar_i.instlRef", "sst");
Présente : user_pref("extensions.BabylonToolbar_i.newTab", true);
Présente : user_pref("extensions.BabylonToolbar_i.newTabUrl", "hxxp://search.babylon.com/?affID=112555&tt=10051[...]
Présente : user_pref("extensions.BabylonToolbar_i.prdct", "BabylonToolbar");
Présente : user_pref("extensions.BabylonToolbar_i.prtnrId", "babylon");
Présente : user_pref("extensions.BabylonToolbar_i.smplGrp", "none");
Présente : user_pref("extensions.BabylonToolbar_i.srcExt", "ss");
Présente : user_pref("extensions.BabylonToolbar_i.tlbrId", "base");
Présente : user_pref("extensions.BabylonToolbar_i.vrsn", "1.5.3.17");
Présente : user_pref("extensions.BabylonToolbar_i.vrsnTs", "1.5.3.1722:27:00");
Présente : user_pref("extensions.BabylonToolbar_i.vrsni", "1.5.3.17");
Présente : user_pref("keyword.URL", "hxxp://search.babylon.com/?affID=112555&tt=100512_3_&babsrc=KW_ss&mntrId=b[...]

*************************

AdwCleaner[R1].txt - [5839 octets] - [03/07/2012 10:02:12]

########## EOF - C:\AdwCleaner[R1].txt - [5967 octets] ##########

Tu as utilisé l'option "Recherche" d'AdwCleaner, utilise maintenant l'option "Suppression" et poste le rapport.

# AdwCleaner v1.701 - Rapport créé le 03/07/2012 à 10:58:50
# Mis à jour le 02/07/2012 par Xplode
# Système d'exploitation : Windows 7 Home Premium (64 bits)
# Nom d'utilisateur : acer - ACER-PC
# Exécuté depuis : C:\Users\acer\Downloads\adwcleaner.exe
# Option [Suppression]

***** [Services] *****

***** [Fichiers / Dossiers] *****

Dossier Supprimé : C:\Users\acer\AppData\Local\Babylon
Dossier Supprimé : C:\Users\acer\AppData\Roaming\Babylon
Dossier Supprimé : C:\Users\acer\AppData\Roaming\Media Finder
Dossier Supprimé : C:\Users\acer\AppData\Roaming\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}\gencrawler@some.com
Dossier Supprimé : C:\ProgramData\Babylon
Dossier Supprimé : C:\ProgramData\boost_interprocess
Dossier Supprimé : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Media Finder
Fichier Supprimé : C:\Users\acer\AppData\Roaming\Mozilla\Firefox\Profiles\3h1grxyv.default\searchplugins\SweetIm.xml
Fichier Supprimé : C:\Users\Public\Desktop\eBay.lnk
Fichier Supprimé : C:\Program Files (x86)\Mozilla Firefox\searchplugins\babylon.xml

***** [Registre] *****

Clé Supprimée : HKCU\Software\MediaFinder
Clé Supprimée : HKCU\Software\Microsoft\Internet Explorer\MenuExt\Download with &Media Finder
Clé Supprimée : HKCU\Software\Softonic
Clé Supprimée : HKCU\Software\SweetIm
Clé Supprimée : HKCU\Software\Tutorials
Clé Supprimée : HKLM\SOFTWARE\Babylon
Clé Supprimée : HKLM\SOFTWARE\Classes\AppID\escort.DLL
Clé Supprimée : HKLM\SOFTWARE\Classes\MF
Clé Supprimée : HKLM\SOFTWARE\Google\Chrome\Extensions\dednnpigldgdbpgcdpfppmlcnnbjciel
Clé Supprimée : HKLM\SOFTWARE\Google\Chrome\Extensions\lpmkgpnbiojfaoklbkpfneikocaobfai
Clé Supprimée : HKLM\SOFTWARE\SweetIM

***** [Registre - GUID] *****

Clé Supprimée : HKLM\SOFTWARE\Classes\AppID\{09C554C3-109B-483C-A06B-F14172F1A947}
Clé Supprimée : HKLM\SOFTWARE\Classes\AppID\{BDB69379-802F-4EAF-B541-F8DE92DD98DB}
Clé Supprimée : HKLM\SOFTWARE\Classes\CLSID\{2EECD738-5844-4A99-B4B6-146BF802613B}
Clé Supprimée : HKLM\SOFTWARE\Classes\CLSID\{E46C8196-B634-44A1-AF6E-957C64278AB1}
Clé Supprimée : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4D79-A620-CCE0C0A66CC9}
Clé Supprimée : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{2EECD738-5844-4A99-B4B6-146BF802613B}
Clé Supprimée : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{97F2FF5B-260C-4CCF-834A-2DDA4E29E39E}
Clé Supprimée : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{EEE6C35C-6118-11DC-9C72-001320C79847}
Clé Supprimée : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2EECD738-5844-4A99-B4B6-146BF802613B}

***** [Navigateurs] *****

-\\ Internet Explorer v9.0.8112.16421

[OK] Le registre ne contient aucune entrée illégitime.

-\\ Mozilla Firefox v13.0.1 (fr)

Nom du profil : default
Fichier : C:\Users\acer\AppData\Roaming\Mozilla\Firefox\Profiles\3h1grxyv.default\prefs.js

C:\Users\acer\AppData\Roaming\Mozilla\Firefox\Profiles\3h1grxyv.default\user.js ... Supprimé !

Supprimée : user_pref("browser.babylon.HPOnNewTab", "search.babylon.com");
Supprimée : user_pref("browser.search.defaultenginename", "Search the web (Babylon)");
Supprimée : user_pref("browser.search.order.1", "Search the web (Babylon)");
Supprimée : user_pref("extensions.BabylonToolbar_i.aflt", "babsst");
Supprimée : user_pref("extensions.BabylonToolbar_i.babExt", "");
Supprimée : user_pref("extensions.BabylonToolbar_i.babTrack", "affID=112555&tt=100512_3_");
Supprimée : user_pref("extensions.BabylonToolbar_i.hardId", "b2ef38de00000000000000871112a3dd");
Supprimée : user_pref("extensions.BabylonToolbar_i.id", "b2ef38de00000000000000871112a3dd");
Supprimée : user_pref("extensions.BabylonToolbar_i.instlDay", "15474");
Supprimée : user_pref("extensions.BabylonToolbar_i.instlRef", "sst");
Supprimée : user_pref("extensions.BabylonToolbar_i.newTab", true);
Supprimée : user_pref("extensions.BabylonToolbar_i.newTabUrl", "hxxp://search.babylon.com/?affID=112555&tt=10051[...]
Supprimée : user_pref("extensions.BabylonToolbar_i.prdct", "BabylonToolbar");
Supprimée : user_pref("extensions.BabylonToolbar_i.prtnrId", "babylon");
Supprimée : user_pref("extensions.BabylonToolbar_i.smplGrp", "none");
Supprimée : user_pref("extensions.BabylonToolbar_i.srcExt", "ss");
Supprimée : user_pref("extensions.BabylonToolbar_i.tlbrId", "base");
Supprimée : user_pref("extensions.BabylonToolbar_i.vrsn", "1.5.3.17");
Supprimée : user_pref("extensions.BabylonToolbar_i.vrsnTs", "1.5.3.1722:27:00");
Supprimée : user_pref("extensions.BabylonToolbar_i.vrsni", "1.5.3.17");
Supprimée : user_pref("keyword.URL", "hxxp://search.babylon.com/?affID=112555&tt=100512_3_&babsrc=KW_ss&mntrId=b[...]

*************************

AdwCleaner[R1].txt - [5940 octets] - [03/07/2012 10:02:12]
AdwCleaner[S1].txt - [4856 octets] - [03/07/2012 10:58:50]

########## EOF - C:\AdwCleaner[S1].txt - [4984 octets] ##########

--> Relance AdwCleaner et choisis "Désinstallation".

Comment va le PC ?

On va vérifier que c'est OK :

--> Télécharge ZHPDiag (de Nicolas Coolman).

--> Double-clique sur le fichier d'installation. Installe ZHPDiag avec les paramètres par défaut (N'oublie pas de cocher "Créer une icône sur le Bureau").

--> Clique droit sur le raccourci de ZHPDiag et choisis Exécuter en tant qu'administrateur.

--> Clique sur le bouton "UAC".

--> Clique sur la loupe (Lancer le diagnostic) puis laisse l'outil scanner.

--> Une fois le scan terminé, clique sur l'icône en forme de disquette et enregistre le fichier (le rapport de l'analyse) sur ton Bureau.

--> Pour me transmettre le rapport, utilise le site http://pjjoint.malekal.com/ car le rapport ZHPDiag est plutôt long. Copie-colle le lien donné par le site ici.

eh bien l'anti virus a arreter de me mettre des message en continu. C'est déjà une tres bonne chose

https://pjjoint.malekal.com/files.php?id=ZHPDiag_20120703_d12u15e8o15q15 => le rapport de ZHPDiag

--> Pour supprimer les traces d'Avast, utilise ceci :
https://www.avast.com/fr-fr/uninstall-utility

Je reviens plus tard pour te donner une procédure avec ZHPFix.

Peux-tu faire analyser ce fichier : C:\Windows\mfebcdata

Sur VirusTotal puis me poster le lien de l'analyse :
https://www.virustotal.com/gui/

est ce que c'est cela : https://www.virustotal.com/gui/file/fcc20aa71cdab92fd469a77eb4b15890871cd2ef529b11d72fb4e80cd2f896fc ?

On ne sait toujours pas d'où vient de fichier.

Mets-le dans une archive .zip, upload-la sur le site https://www.cjoint.com/ puis poste le lien.

https://www.cjoint.com/?BGdsdMsNCuf

--> Copie tout le texte présent en gras ci-dessous (Sélectionne-le, clique droit dessus et choisis "Copier").

SysRestore
[MD5.00000000000000000000000000000000] [APT] [Express Files Updater] (...) -- C:\Program Files (x86)\ExpressFiles\EFupdater.exe (.not file.)
[MD5.00000000000000000000000000000000] [APT] [{6119986A-A9BB-47FA-8CE3-1E2D96A8FDFE}] (...) -- C:\Program Files\AVAST Software\Avast\aswRundll.exe (.not file.)
[HKLM\Software\AVAST Software]
[HKLM\Software\McAfeeInstaller]
O81 - IFC: Internet Feature Controls [HKUS\.DEFAULT] [FEATURE_BROWSER_EMULATION] -- svchost.exe
O81 - IFC: Internet Feature Controls [HKUS\S-1-5-18] [FEATURE_BROWSER_EMULATION] -- svchost.exe
SS - | Auto 0 | (0069251341244939mcinstcleanup) . (...) - C:\Users\acer\AppData\Local\Temp\006925~1.exe
O44 - LFC:[MD5.AF0AD1DB09BCDAC91F3D16E40F2F75CF] - 02/07/2012 - 13:50:15 ---A- . (...) -- C:\Windows\mfebcdata [8212]
SS - | Auto 0 | (avast! Firewall) . (...) - C:\Program Files\AVAST Software\Avast\afwServ.exe
O43 - CFD: 02/07/2012 - 18:20:50 - [0] ----D C:\ProgramData\AVAST Software
O23 - Service: avast! Firewall (avast! Firewall) . (...) - C:\Program Files\AVAST Software\Avast\afwServ.exe (.not file.)
SS - | Auto 0 | (McShield) . (...) - C:\Program Files (x86)\McAfee\VIRUSS~1\mcshield.exe
O23 - Service: McAfee Application Installer Cleanup (00 (0069251341244939mcinstcleanup) . (...) - C:\Users\acer\AppData\Local\Temp\006925~1.exe (.not file.)
O23 - Service: McAfee Real-time Scanner (McShield) . (...) - C:\Program Files (x86)\McAfee\VIRUSS~1\mcshield.exe (.not file.)
O43 - CFD: 13/03/2012 - 17:08:36 - [170,564] ----D C:\Program Files (x86)\McAfee
O43 - CFD: 02/12/2009 - 06:15:07 - [0] ----D C:\Program Files (x86)\McAfee.com
O43 - CFD: 02/12/2009 - 06:15:55 - [0,975] ----D C:\Program Files (x86)\Common Files\McAfee
O43 - CFD: 24/02/2012 - 17:52:24 - [23,656] ----D C:\ProgramData\McAfee
[MD5.92CC7943B4D37C2803B1A1F8AD027943] [SPRF][02/06/2012] (.McAfee, Inc. - McAfee Download Manager SelfExtractor.) -- C:\Users\acer\Desktop\DMSetup.exe [3140560]
SS - | Auto 0 | (McShield) . (...) - C:\Program Files (x86)\McAfee\VIRUSS~1\mcshield.exe
SS - | Demand 0 | (McSysmon) . (...) - C:\Program Files (x86)\McAfee\VIRUSS~1\mcsysmon.exe
C:\Program Files\AVAST Software
EmptyCLSID
EmptyFlash
EmptyTemp

--> Puis lance ZHPFix depuis le raccourci situé sur ton Bureau.
(Sous Vista/Win7, il faut cliquer droit sur le raccourci de ZHPFix et choisir Exécuter en tant qu'administrateur)

--> Une fois ZHPFix ouvert, clique sur le bouton "H" (Coller les lignes Helper).

--> Dans l'encadré principal, tu verras donc les lignes que tu as copié précédemment apparaître. Vérifie que toutes les lignes que je t'ai demandé de copier (et seulement elles) sont dans la fenêtre.

--> Clique sur "GO" pour lancer le nettoyage. Laisse l'outil travailler et ne touche à rien.

--> Une fois terminé, copie-colle le rapport dans ton prochain message.

Rapport de ZHPFix 1.2.06 par Nicolas Coolman, Update du 17/05/2012
Fichier d'export Registre : C:\ZHP\ZHPExportRegistry-03-07-2012-18-42-11.txt
Run by acer at 03/07/2012 18:42:11
Windows 7 Home Premium Edition, 64-bit (Build 7600)
Web site : http://www.premiumorange.com/zeb-help-process/zhpfix.html
Web site : http://nicolascoolman.skyrock.com/

========== Processus mémoire ==========
SUPPRIME Memory Process: C:\Users\acer\Desktop\DMSetup.exe

========== Clé(s) du Registre ==========
ABSENT Key: HKLM\Software\AVAST Software
ABSENT Key: HKLM\Software\McAfeeInstaller
SUPPRIME Key*: Service: 0069251341244939mcinstcleanup
SUPPRIME Key*: Service: avast! Firewall
ABSENT Key: Service: avast! Firewall
SUPPRIME Key*: Service: McShield
ABSENT Key: Service: 00 (0069251341244939mcinstcleanup
ABSENT Key: Service: McShield
SUPPRIME Key*: Service: McSysmon

========== Valeur(s) du Registre ==========
ABSENT IFC: [FEATURE_BROWSER_EMULATION] svchost.exe

========== Dossier(s) ==========
SUPPRIME Folder: C:\Users\acer\AppData\Local\{00098BEC-2BE2-4191-B5A1-E80F1EDA3BEB}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{0087CDFB-65EF-48BB-81F4-8709233E47BE}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{0116E976-0259-4002-97AF-DF22845DBCAB}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{01219555-692D-43A3-A035-52ECC73E8FFA}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{0224A19D-362B-4CF1-B80C-79A798A96583}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{03767578-BE30-4058-93FA-DFE728361555}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{04522073-008C-4848-8BF1-97ADEA20546E}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{080F48A6-E42E-4AF1-A1CD-CC324F4B3BD0}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{093AE7B0-3EB1-4E20-AC38-332831A41F04}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{0A43A2B9-EEDF-4927-9682-10B4FA32A7BD}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{0A606A79-AA3D-4FEE-B75F-A3580D140D62}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{0BACC47A-7A3D-4B75-94EE-E1DB9FD5B1CC}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{0BEE2658-E3A6-463E-ACB2-8781A04BD828}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{0C2F3639-18A9-4495-AC45-B2A17A97549D}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{0CCDDD3D-70F9-4484-A0A5-E74D4291F877}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{0E69C428-1EE0-40B5-9B47-A64B44627454}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{0EC60E0B-7C3E-45E4-9ED4-889752D7FF79}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{0F43BAE9-830E-4826-BA59-A201459B26D7}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{10CFF519-D8F0-415C-BC9D-3D221CB0124F}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{116FCB99-5A20-4896-906C-E162E53F6DD6}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{119EA3D6-EF90-4971-8F67-4093D995DDCC}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{11C8FF34-E5DF-451E-B121-811800577240}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{11E4EA8B-E66B-453C-AA41-81A3DAC0C8ED}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{11F241B8-AF32-4D78-9845-5712CD166A87}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{1323241E-3E5B-40DB-BB8C-AF4228E42F29}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{13351A31-8546-4C3A-B1D2-384448E3F680}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{134C6966-F022-4C7E-B166-8692EFB67042}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{13EC55BE-DDA9-4331-AEE9-EC22D0157B16}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{14200A5E-10CD-4046-8A36-94942FE401BD}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{16474314-3970-498B-90B0-19544E3505E2}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{172453C8-C597-4D08-A376-8000C28CC149}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{18F5D77A-CF5A-4051-AC4A-94EB05BC9A9E}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{190AE871-F875-4303-9427-899DA7CA44B3}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{1934EB54-E596-4507-ABAA-AA5880C2C6C5}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{19FAFB06-14C5-4440-A62D-BF2ECFA04704}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{1B10D0E2-10AA-4C97-824E-6D9A2EBE5090}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{1B414AF5-CE51-4215-9AE8-DF5989E9432F}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{1B7C4676-874B-4FA1-B719-6AC98C8C6374}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{1D3C87C4-6E06-42CE-86F3-0883D836FAC7}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{1E589CDA-42C7-4916-A964-5CAEDF58D3C1}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{1FE2AF33-0D7C-434C-8EB0-BB91FF47DA40}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{1FF97118-58C2-4DA0-9EBC-4175E89419D4}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{2058D2D7-2453-4B83-A41D-A6741C5D52C3}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{210F4F4E-F82E-46EA-9F5D-015CC4A03752}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{2124EAF8-E255-4780-86C0-D1BFC3861666}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{21A4C1F8-7CC4-4B59-82C2-66D9755E0DB5}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{2201177C-6FE3-4D16-BAD7-FCBC176CED20}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{249D9ADC-4BF0-4060-8F9D-8FD09550CD43}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{257A8E55-F71E-4129-BF4F-7F6354931DCE}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{26872701-30BE-425C-BF3B-FF4B8DF33166}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{27C10F06-5FCE-4865-B20E-BCF610DF345A}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{27E30B5D-7751-40E5-8829-EF8DD673A752}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{294125C0-D32C-4D3D-BDFE-08907B8D0483}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{2ACB2401-C475-42C0-B55C-1BE520394037}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{2B73BDD1-86FA-4B5D-91B4-78CA86B0FC11}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{2B7E2E1B-2765-49B9-A27F-238A4A55A4C2}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{2BF0F477-A882-4259-8073-9CFE61532BB6}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{2CA87B12-6E69-47AF-9250-324D9A60D14B}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{2CE8BFB7-A407-4F54-97BE-5E46C6F62E26}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{2FA5DF4D-AAA9-4AB6-913A-E169FBFFAB77}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{311E2F66-8E47-4B34-A80E-959C945F4DAD}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{313FC2CA-FFDD-42BB-B0A4-C3436F6DF7A2}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{32010A69-C724-43DF-A99E-78E2CE43076A}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{33BC2D75-09A8-4637-B502-C743C7E6D71D}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{33F2E185-40A2-4D77-BC57-05564CC6B2E4}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{340A13B2-5FE6-461E-B4B4-1636C2D77719}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{340FF446-FA7A-4268-BD59-E5F27B7C1F21}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{378F0D5E-1B86-4D43-B806-A09D9F7A8A53}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{38396A57-C1A4-4EF1-980D-D2E3C4FF0B64}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{389A8C30-CD73-4A0C-8A41-3FA54331E29B}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{39CE7357-9A8F-4FE4-A184-185844896C23}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{3AC28D5C-257F-437D-A783-74821B1C6BD0}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{3C053F89-74DB-46B3-9C54-786624ECCD1F}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{3CD1EFF3-4F24-4E6A-9B93-C0A1AF7721AC}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{3D054FFD-4263-4037-A561-F81EFEDE8F64}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{3EB8C14B-9011-43E0-9180-40EEBF79B4A2}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{401A2CF4-2DD3-4801-8181-BBB47C4BF263}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{40307121-2326-4DA4-9E4A-87E27708B65D}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{4074F1CE-F1BD-4820-ACA2-5B564A0CE7BF}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{40D287A9-0D54-48DC-94A8-31419228877C}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{438DF109-518B-4AE0-AFA4-75D2A03F2FEE}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{446A6B70-7428-44D5-A7E4-02378FA51980}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{44A9A42A-703A-4DF8-8504-87D57FFA77DF}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{46020678-8AA3-4B2B-890E-1716FB26B441}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{4665C856-FDF5-45D6-B84B-1CE3B3C43EBC}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{4716AE6C-5C4A-4360-A559-F0FB76EAB61F}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{472CE4D0-BC83-4250-AC34-E82EFAFFD151}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{474B0721-6E3C-45B8-9489-EBF68E4D421B}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{47ADA9BA-EE38-4721-8BA3-DAD71EE52B2A}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{47B4A56A-4176-4187-96A2-DCBFEEAF1A2F}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{47B55B71-D33C-4CCC-8D5C-BA4D3BA427BF}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{48DED4E3-FFA3-475F-8173-7828F467305C}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{498EB10F-769A-4CBB-A2BA-AA246730158E}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{49BA790C-3E36-4DEE-8674-CE82B9B27317}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{4C4BC91D-511B-46DF-8DAB-FEBB440CEE8B}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{4CA5FCC5-E7C8-4742-858A-02FAF1F43D08}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{4D4E48E6-36C0-48EE-9720-053053091138}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{4EEDFE23-ABD4-4BC3-80FA-79EBFA2A4200}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{4F4D7C07-D263-425F-9B83-47C5F0BB9363}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{50FF6EEB-7A4A-405B-9109-CA4690299EB1}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{511D8FCF-08E0-49C2-BF4E-8CAF1632AC78}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{5235B7AF-4ED4-428E-B7B1-0009EC3C914A}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{526C835C-FDBE-499A-B286-A88A55BEB425}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{5309AF2C-4B48-400E-B105-4E155820C644}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{53CFAD64-DE7D-4BFC-A8AF-E763BA7BFEE4}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{53D96C55-33E7-46F1-881B-F4A052865EC8}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{5574AECB-2339-461E-A2CD-F59291640C09}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{55D4B43B-65DD-412A-8644-8F87299F4A22}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{55D62862-9059-4A05-A61A-2D5684D3DA88}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{56CD4634-86D6-4C30-8829-262122DF9F43}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{57C37CA9-0265-4C9B-88FB-C8BA483915CE}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{57FD85D2-0B54-48A8-B110-0F78641EEBBF}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{587F0EE3-BEB9-433D-99BD-F313C73CE117}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{58C83B3D-5FCF-45F9-A157-9721FB1EDDC0}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{597E25A4-6A8A-4261-8118-6C28DE390CA1}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{5B8215CB-CE2F-41DB-8F3E-A194B1463591}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{5BA42FA7-EF31-47D3-A7C2-4211B0567C51}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{5C66EE61-5749-457A-8CB2-02BAAA33B625}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{5DDF7D30-EAAC-4AC4-AF91-578EBE6BAF52}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{5EADA338-76BD-41E0-B023-60F1F0A2CD4A}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{5F048970-0CD8-4688-9906-19EB84D56C6C}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{5F56AA8E-BA2E-4AE9-8B6B-71366ED53478}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{5FA726A2-0AE3-429C-BEA5-555D56FAAF5F}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{5FE7A8A7-AE2F-4E82-9AAC-D0564AFDFDEB}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{60E911AC-1A47-4576-855C-7A1CC303CFA2}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{60F0B264-EABF-4091-A26E-C46FE5C1546E}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{6420C584-E943-4E99-8EE1-048915C19E79}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{643F8D02-7EE0-4E8D-9EE2-E891B44AB8A8}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{64B93B65-1D59-4CE6-A7C2-28411C947546}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{64E875B7-CD5D-49CB-8A34-382ED5B70C52}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{64F0DC21-E1A8-4ACD-9994-7BE530E0ACF6}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{650F1192-8347-4878-B5FD-1BD30081D5FF}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{65EEAA39-01E8-4666-8D21-DC81C095192A}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{6636AA84-C079-45D5-A1D5-2333D55C785B}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{66B85973-1BFC-4DA7-ADD8-C1F81647582A}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{671E882F-DD80-4F9D-8CF1-548B0366F47E}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{6A4C13B5-1F0A-45D4-A827-89D07DC2B7DC}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{6BE12B1E-A3DC-4F13-89FB-FCD19218A898}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{6D110041-1927-4754-8E18-D32D110052C9}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{6E4B03DC-7B63-4D20-8A5A-093ACA1245A6}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{6EC8C3E2-1C93-4A36-98EB-B94A8E7BEB70}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{6EFE4141-39E8-4107-BB32-BF8E073D7221}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{6FE3D6F8-BDB2-4DD6-82BE-89C66ACED928}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{715A19AE-5235-4042-A709-311FDB07F2D0}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{720DC266-F3C9-4B33-90FC-A4E3515ACABB}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{72A864C6-DAC8-4A86-8C9E-C979A352C476}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{750FA1FF-5376-4C3A-B3D9-98442D35CD3B}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{7528526E-5655-47BC-9DB5-51A631C4DF03}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{7546FD7E-783A-4323-BA15-5142EC68FA9B}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{76C30704-B729-457A-ABD7-6560197D574E}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{76F6B0BA-35B5-4B63-B8B9-0CBC7BD1B9BC}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{770D2882-7F14-4940-9A63-5547125B0477}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{778700C4-2F4A-43A4-AFDA-F11C915D25BE}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{7A641A06-74E1-4035-A7D5-C2856F196707}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{7B2027FB-221E-48A1-A86E-42D7312A4EE7}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{7B80D225-7648-433C-9340-15DD3F5F8B47}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{7BDEFD50-8BDA-4DB7-B8C0-2FFAF17338E7}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{7C40888A-6369-4976-B405-A565B7D7CD13}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{7C5F7F60-DAFA-4591-ACED-C5791A067485}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{7CEEE009-D3E8-4753-9D71-D8CA1DF635BF}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{7DBB676D-BA67-40CA-90A0-29AF9126123C}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{7F790A21-1FD4-45A4-A6F1-01AB6DEF6530}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{80B3C83C-E1C6-4EF9-A333-141045098434}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{82149A8F-F3A1-45DD-B19F-1FB183B19874}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{821B22F2-D71F-4A89-BE36-4C294F4A7315}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{830AB468-F077-41A6-91B1-C33357A413EF}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{847DC24E-2022-4773-878C-62104B4DD8DD}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{851BB1C7-3824-49E1-85D0-1CDC5898506A}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{85FB48DF-67FC-4D00-8D6B-00CA3D54EF11}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{864370E4-FDE4-433A-9DA1-FD1A963F384F}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{867774B2-5A81-44D7-8773-5F3E2E0538A2}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{86B99241-9A8C-4460-A6CF-A282849D26A1}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{876BD6B1-C33D-4DF0-8F06-9199D9FE6D20}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{88689D06-588D-42B3-8C0E-C08D91EF8A1C}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{8A72464F-9634-4B33-8292-EBADCD93DA6C}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{8BB9E06A-509D-43EC-B5F2-DECDDE53305D}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{8BBB1ADF-FFA0-4C58-BD82-1F35D61441B9}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{8CAE5948-13D6-42A0-8CEC-8CA0456F66D5}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{8DE0E1A9-3D53-4B28-B97B-AF957E86B54D}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{8E39DC0C-DA37-4309-8D2D-24D5DC00E47B}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{90429783-8195-4B75-8535-98EE24429B43}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{9112B437-2D43-483F-9FAE-DD8D5E2FB398}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{9261B2E0-0C0C-4FC2-B4E3-9DEE1E038309}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{93EB6532-1118-4A9B-AC8E-F8E1A855AD1E}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{947B84E9-5098-44CF-97F0-608C1E3FE057}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{95CA8CDD-73D8-4D38-8C79-CADF18CF7E29}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{95D8A573-8850-4516-895A-472A023A6D54}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{9742E4F5-4EFA-4B41-82DB-20E00E5C57F4}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{9742FBD2-998A-4B19-A85B-C5969F84042E}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{97B1EEFD-0012-46B8-AFAA-88EBE3B612DD}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{97C4E841-1077-4DA5-856C-0E6601C49C00}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{97E6BB1E-A681-4103-8F8C-FEDCD59D29D9}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{993C5764-8A2E-44A7-9B67-CF2D789E2F49}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{9969343E-14B4-4304-B8CC-17B180DFF37E}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{99A6C5EA-797C-4D1F-8896-C3EE215C9C98}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{9A32F191-AB28-4C73-94CE-020C9FEAE1D9}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{9ABA33EF-D324-453A-8FDE-011EAEDA2E9C}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{9AE29AFB-462D-415C-A9EC-E60DF75CDFD4}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{9B3842DB-220A-4ED2-9ECA-E6DEBCFB4C54}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{9C6B6F6B-C8F0-4C5C-B64B-DBB5D44563B3}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{9D41CD43-1316-46AD-A7FA-35B6AE658E65}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{9ED25BFE-2670-4AB2-BB7D-096E854110F3}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{9F924F42-953E-4B7A-BD03-AC4093A7B8CF}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{A09AB548-4BA3-4525-A4AD-ACFE48AD636C}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{A0D776F9-2935-41E0-8CAF-0791A8311DBC}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{A0EC3C98-633D-4C28-A985-963F6DE6AB32}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{A1F2C04E-8078-4079-968F-1BB7C5EED5C9}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{A37CE092-9CFC-4660-B101-C770B2C1BBCF}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{A79246A8-C027-4ECF-B213-F9ECF5A72015}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{AA2E965A-85BD-4F64-8C25-39F007A1AE79}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{AA3C8468-636E-4687-B956-7FA6CA903E3D}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{AC0B3B11-0AFE-4976-86C2-B99BF2559DFA}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{B03007ED-3000-4D54-A1CE-7A151438CB26}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{B05B0E9A-F667-469B-B7BD-DF7CE05149CC}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{B0895589-01AF-4CBA-9F00-79CB669643CF}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{B0B920AD-B8D7-4339-8A82-0C158061BD5D}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{B167DE0B-40E6-474D-A7F2-8FEA0CE3DE3B}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{B27AA360-456B-4AEB-921C-591E67CE8B55}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{B2ACD78B-B3C6-416B-B31D-A23D7E1D7813}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{B312D718-3B76-4BE5-AC90-93624240E9A0}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{B6B07348-6341-45A2-82F9-0282E4ED9154}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{B6DB339C-979B-4A90-BE30-084B049C4061}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{B75BD82C-F10C-4950-A4CF-A58D628D2FF5}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{B8FD4779-A070-4C65-B3E7-0B800FE22BBC}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{B91C424C-FFCD-411D-A63C-3CE7EE088153}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{BB22ED15-1390-448D-B1B8-06D29D7060C2}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{BC135254-3140-4751-A448-D031262D0335}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{BCB1B81C-146A-45C1-9071-2DA6D8826269}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{BCC6C684-E04F-4D98-869E-F6BA080C908B}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{BCF1BDC4-4127-40EC-A156-949A9AD9DA84}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{BD1FC94C-0076-402B-845E-9F976638FA68}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{BE8B8CA5-1B1F-4CAB-9741-2C0688BBB763}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{BF76DA5D-6366-4B12-AEA3-3C392206C113}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{C045DC2D-CDDA-46B8-B72A-8287571035AE}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{C17958B2-D299-4E58-AB14-07A68D95B99E}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{C26D3871-38A4-4CEA-951E-DAA2BD3E0FDE}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{C48421E6-635C-4812-BCC3-4AB4330100A4}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{C4CCB00B-39FA-4617-9160-8823A282F067}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{C5734011-86B5-4F16-9A2E-2201742B4AC1}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{C6CA3DFB-3589-455B-BD60-521836FEB633}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{C8A0FFDD-5EB1-4866-BFA7-3A76AE979076}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{C8B2B9D6-DDD8-4A40-A5E9-BED1BB8FD827}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{C8B9F9EE-1E6E-4DB1-9B01-8CC2D58B80B3}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{C8DC19D0-2200-46BD-BF20-A525EBF90003}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{CA6E4A16-1DA6-4537-A5CB-6152F4C588FF}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{CA6F0A65-8B9E-4374-AAE6-D2B3F44AC1A1}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{CBAD013A-84CF-4ECE-945B-D35B2EF34A1A}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{CBF3F7D4-3211-4FAE-B38E-708DA2A4A2E7}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{CD5975F3-EF28-4200-B7F5-3CF0F45BD6E9}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{CDFDC451-C0F6-49B0-989A-4BD092C482C2}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{CE1AFB0A-6996-4329-8B8C-4A1813933B21}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{CE55A688-2234-4CCD-BE43-F344A5D9A0EC}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{D2BCCD81-0148-4E4F-9466-977C81522024}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{D300E6CD-705C-4EED-83B8-2D48353D6F0B}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{D5598E84-7A83-4A27-A07C-B3FE63A481F4}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{D58E3EF4-447C-4C9F-B0DE-7925346CC603}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{D66F08C7-179C-4297-9D5D-76E3A4E42341}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{D6B14BA9-9A40-442F-BE36-AA99D77CA982}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{D6FD1DC8-7621-4438-8607-8DFA026626AC}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{D73EAC70-D7B4-40EE-AEEE-F7396C5E2BAD}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{D80C159E-A52D-4D77-BA71-8503904FE5F5}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{D831F946-A210-4D02-868D-4EA6AE0E8659}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{D9F5093F-3149-4383-8B20-790B9CA105BD}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{DA02A0FF-DE19-42D5-8418-29007CF4B671}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{DA083F39-9A56-4F50-A9D3-DE5ED7922D7C}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{DA133DD9-2335-418B-8F35-3A644F951C01}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{DAFCE74B-80A3-4100-BA6A-863D596E1556}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{DBD4A8E1-031B-40D1-9E4E-8896EA5F4444}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{DC5D8BEB-811E-445B-A7F9-764C98185CF3}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{DD0F8B3F-3127-4C00-9A1D-F0481D298ABF}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{DD7A23F6-CB0E-474A-BEED-4D6A9393D420}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{DE35C4EE-AA6D-4428-B503-9E531DD8CF6F}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{E05F4563-5967-4480-8D34-25A13C2239BA}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{E120A133-D873-4A9B-9A10-191BEAED59E1}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{E21542D3-7AB3-4D64-BA6A-B4C19AF017E1}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{E25A13F5-3047-41D5-BC7E-9901CC093966}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{E263D0C8-EF6C-47E1-859D-193617C3AC54}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{E309156A-45A4-4899-9450-AAD8B48FC938}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{E39AC7BA-D665-4DCF-B856-2A997DA8CE8B}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{E4188876-ECCA-43E0-853A-6D5EA9BD8D30}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{E4FC4E6A-CF79-4A4D-83AD-0CD75A28DFB5}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{E630309E-AC5A-4090-A367-69EAF5316E05}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{E63C3627-F5CD-4C99-841A-EFC1A1E8C017}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{E6A0B546-B5CE-434E-8ECB-BE18BF9BCD28}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{E6C9F223-433F-43CE-892D-67044BEC6961}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{E80ED3D7-7F2A-47C2-B3DC-AFE85C352C7A}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{E84D6E21-468C-491B-BA48-5F4E780B58B7}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{E8EE464C-F301-420C-BF2B-81C1B2238CAF}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{E9321811-B411-4BC4-A5E5-D47641F275B4}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{E9F2433C-96FD-48AE-9963-A4AAE4C27FBC}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{EB6C51A2-97CA-40F3-B798-8097E90386B0}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{ED67D051-FF8D-4CA1-8D33-47C1400E4CAB}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{EF8FB10F-30A3-4D69-ADC9-0154EA12094F}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{F2BD82E8-97AC-407A-9F1F-CB4AB971480D}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{F5A56791-BC2B-4706-852A-F916DC144103}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{F5C2824E-D159-4D52-9F39-E380E8176E18}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{F62283A9-9C2D-417A-A4D6-979809E8A2D4}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{F87170B6-1F03-4244-A39B-75B73222A9DA}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{F8826989-677C-48AA-B80C-C2B063D2E7E0}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{FA2A5643-5CFD-4DE5-A88A-C49B3CD68F74}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{FAD3213A-16B8-4461-B407-8F0D20860C52}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{FB10D4A6-569A-4E5E-82D7-6A270A36D6B0}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{FCFAA9DB-5D46-4884-A6C2-4BA71B345C32}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{FDB2C37F-1E13-47A0-9148-8B8B375E9364}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{FE1B99BC-26AD-40C2-BC4E-67E6F959B716}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{FE231B0F-08A0-4D3E-B0D6-CEDE029DF363}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{FFDD5FE0-95D3-423E-83EF-54CCE5C8873D}
SUPPRIME Folder: C:\Users\acer\AppData\Local\{FFEB8F48-4D51-47C5-A12D-2DD3399B8FB9}
SUPPRIME Flash Cookies:
SUPPRIME Temporaires Windows:

========== Fichier(s) ==========
ABSENT File: c:\users\acer\appdata\local\temp\006925~1.exe
SUPPRIME File: c:\windows\mfebcdata
ABSENT File: c:\program files\avast software\avast\afwserv.exe
ABSENT File: c:\program files (x86)\mcafee\viruss~1\mcshield.exe
SUPPRIME File: c:\users\acer\desktop\dmsetup.exe
SUPPRIME Flash Cookies:
SUPPRIME Temporaires Windows:

========== Tache planifiée ==========
SUPPRIME Task: Express Files Updater
SUPPRIME Task: {6119986A-A9BB-47FA-8CE3-1E2D96A8FDFE}

========== Restauration Système ==========
Point de restauration du système créé avec succès

========== Récapitulatif ==========
1 : Processus mémoire
9 : Clé(s) du Registre
1 : Valeur(s) du Registre
310 : Dossier(s)
7 : Fichier(s)
2 : Tache planifiée
1 : Restauration Système

End of clean in 03mn 06s

========== Chemin de fichier rapport ==========
C:\ZHP\ZHPFix[R1].txt - 03/07/2012 18:42:11 [28075]

Plus de souci ?

apparemment tout est rentré dans l'ordre.

je te remercie de m'être occuper de moi et surtout de mon ordi.

Pour finir :

1/

---> Télécharge DelFix sur ton Bureau.
* Clique droit sur DelFix et choisis Exécuter en tant qu'administrateur.
* Clique sur le bouton Suppression.
* Poste le rapport (C:\DelFixSuppr.txt).
* Supprime DelFix.

2/

---> Télécharge et installe CCleaner.
* Lance-le. Va dans Options puis Avancé et décoche la case Effacer uniquement les fichiers etc....
* Va dans Nettoyeur, choisis Analyse. Une fois terminé, lance le nettoyage.

3/

---> Il est nécessaire de supprimer les points de restauration. Ensuite, crée un point de restauration.

==Prévention==

Ton Windows n'est pas à jour. Il manque le SP1 par exemple.

Voici un dossier sur la prévention et sécurité sur Internet (A lire avec Adobe Reader) : Lien

Sois plus vigilant sur Internet ;)