WindowsRecovery? [Résolu]

[sof42]

Bonjour à tous,

je suis très embêtée, mon ordinateur me lache petit à petit. Depuis ce matin, il y a une fenêtre "WindowsRecovery" qui s'ouvre disant "11 errors detected! Error fix is required" et impossible de fermer ceci. Depuis que cette fenêtre est apparue plusieurs chose ce produit, Avira me disant "que le fixier C:\ProgramData\4524424.exe, un virus ou un programme indésirable 'TR/Kazy.mekml.1' a été trouvé" et impossible de le supprimer, une autre fenêtre disant "Critical Hard Disk Drive Error", 3 autres fenêtres disant "Defaillance du disque dur le système a détecté un problème avec un plusieurs disques durs IDE/SATA installes. Nous vous recommandons de redemarrer votre système." ce que j'ai fais mais toujours pareil,une autre fenêtre disant "Windows n'a pas pu sauver les donner pour le fichier \\System32\\496A8300. Les données sont perdues. Cette erreur esqt peut être due à la defaillance du disque dur de votre ordinateur" il me demande de cliquer soit sur Annuler ou recommencer ou continuer et enfin une dernière fenêtre me disant "Impossible de trouver le profil!". Je ne sais plus quoi faire.

Dans l'attente de vos nouvelles. Merci.

Sophie

[danakil]

Salut sof42!

Un peu de lecture afin de te rassurer sur cette infection :
viewtopic-47974-0-asc-330.html#p437750

Maintenant pour agir.
Tu vas utiliser MalWareBytes sur ton PC en utilisant le mode sans échec.
Voici le tutoriel de Mbam --> tutoriel-malwarebytes-anti-malware-vt-46564.html

Consignes :
Télécharge le logiciel sur ton PC.
Effectue la mise à jour de celui-ci.

Ensuite ...

Redémarre ton PC en mode sans échec :
http://www.vista-xp.fr/forum/topic93.html
Lance Mbam et effectue un scan complet de ton PC.
En fin de scan, sélectionne "Supprimer la sélection".
En fin de procédure un rapport s'ouvrira > Referme le et redémarre ton PC en mode normal.

Reviens ici m'avertir de la réalisation de ces étapes afin que je te dise comment récupérer le rapport de suppression de Mbam et comment me le poster.

[sof42]

Bonjour danakil,

Je m'excuse de te répondre aussi tardivement.

Après avoir fait toutes les démarches que tu m'as dites, voici le rapport:

Code: Tout sélectionner

Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Version de la base de données: 6443

Windows 6.1.7600 (Safe Mode)
Internet Explorer 8.0.7600.16385

25/04/2011 22:41:48
mbam-log-2011-04-25 (22-41-48).txt

Type d'examen: Examen complet (C:\|D:\|)
Elément(s) analysé(s): 289151
Temps écoulé: 29 minute(s), 54 seconde(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 1
Elément(s) de données du Registre infecté(s): 1
Dossier(s) infecté(s): 1
Fichier(s) infecté(s): 7

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Valeur(s) du Registre infectée(s):
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\uvEWQXCeAJwf (Trojan.FakeAlert) -> Value: uvEWQXCeAJwf -> Quarantined and deleted successfully.

Elément(s) de données du Registre infecté(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr (PUM.Hijack.TaskManager) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Dossier(s) infecté(s):
c:\Users\EF\AppData\Roaming\microsoft\Windows\start menu\Programs\windows recovery (Trojan.FakeAV) -> Quarantined and deleted successfully.

Fichier(s) infecté(s):
c:\programdata\uvewqxceajwf.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
c:\programdata\42524424.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
c:\Users\EF\AppData\Local\Temp\0.37923541559803775.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
c:\Users\EF\AppData\Local\Temp\rxcawensmo.exe (Adware.Agent) -> Quarantined and deleted successfully.
c:\Users\EF\Desktop\windows recovery.lnk (Trojan.FakeAV) -> Quarantined and deleted successfully.
c:\Users\EF\AppData\Roaming\microsoft\Windows\start menu\Programs\windows recovery\uninstall windows recovery.lnk (Trojan.FakeAV) -> Quarantined and deleted successfully.
c:\Users\EF\AppData\Roaming\microsoft\Windows\start menu\Programs\windows recovery\windows recovery.lnk (Trojan.FakeAV) -> Quarantined and deleted successfully.

merci pour ton aide

[danakil]

OK!

'Windows Recovery' se manisfeste toujours?

Fais ceci également :
Télécharge OTL sur ton Bureau.
• Fait un double-clic sur l'icône d'OTL pour le lancer. (Sous Vista > Clic droit > Exécuter en tant qu'Administrateur).
• Assure toi d'avoir fermé toutes les applications en cours de fonctionnement.
• Quand la fenêtre d'OTL apparaît, assure toi que dans la section "Rapport" (en haut à droite) la case "Rapport Minimal" soit cochée.
• Copie et colle le contenu de cette citation dans la partie inférieure d'OTL "Personalisation" :

NetSvcs
%systemroot%\system32\drivers\*.sys /lockedfiles
msconfig
safebootminimal
safebootnetwork
activex
drivers32
%ALLUSERSPROFILE%\Application Data\*.
%ALLUSERSPROFILE%\Application Data\*.exe /s
%APPDATA%\*.
%APPDATA%\*.exe /s
%SYSTEMDRIVE%\*.exe
/md5start
sptd.sys
ahcix86s.sys
ahcix86.sys
AGP440.sys
atapi.sys
Changer.sys
cdrom.sys
cngaudit.dll
disk.sys
explorer.exe
eventlog.dll
eNetHook.dll
iastorv.sys
KR10N.sys
IdeChnDr.sys
logevent.dll
userinit.exe
winlogon.exe
wininit.exe
tcpip.sys
Sfloppy.sys
netlogon.dll
nvstor.sys
nvstor32.sys
nvrd32.sys
nvata.sys
nvgts.sys
ndis.sys
nvatabus.sys
usbscan.sys
usbprint.sys
tdtcp.sys
tdpipe.sys
swmidi.sys
splitter.sys
rdpwd.sys
RASACD.SYS
scecli.dll
viasraid.sys
vaxscsi.sys
viamraid.sys
ViPrt.sys
/md5stop
%systemroot%\*. /mp /s
%systemroot%\system32\*.dll /lockedfiles
%systemroot%\Tasks\*.job /lockedfiles

• Clique sur l'icône "Analyse" (en haut à gauche) .
• Laisse le scan aller à son terme sans te servir du PC.
• A la fin du scan un ou deux rapports vont s'ouvrir "OTL.Txt" et ( ou ) "Extras.Txt"( dans certains cas).

...
Comme ces rapports seront volumineux, tu vas devoir les héberger afin que je puisse les récupérer.
Rend toi sur 1Ficher.com puis:

1/ Clique sur "Parcourir" afin de sélectionner le rapport "OTL.txt"
2/ Clique sur "Envoyer"


3/ Patiente quelques seconde, et copie le lien de partage qui apparait sous "Lien de téléchargement" afin de le coller dans ta réponse.


4/ Fait la même chose avec le rapport "Extras.txt"

[sof42]

Bonjour,

Voici les liens de téléchargements: http://qws1wx.pjointe.com/
http://bdm5pq.dl4free.com/

Pour répondre à ta question, WindowsRecorvery se manifeste pas mais je n'ai plus aucune photos ni même documents, certains onglets sur mon bureau ont disparru. J'ai tout perdu suite à ce virus?

[danakil]

Re,

Je pense que tes dossiers et fichiers ne sont plus visibles.

Fais ceci :
Tape simultanément sur ton clavier : Windows+R
> Dans la fenêtre ouverte tape : cmd et valide
> Dans la fenêtre MS-DOS (noire) après l'onglet clignotant colle cette citation :

attrib -h -r -s c:\* /s /d

> Valide par la touche Entrée.
> Tu vas voir des lignes défiler assez rapidement ... Laisse faire jusqu'à l'arrêt de ce défilement.
> Referme la fenêtre MS-DOS et redémarre ton PC.

... Au redémarrage ...
As-tu retrouvé tes fichiers?

[sof42]

Re,

Ouuuaaaaaa!!!!! J'ai tout retrouvé Je suis super contente. Tu es un vrai chef

[danakil]

On continu le nettoyage!

Fais ceci maintenant :
Ferme toutes les fenêtres actives sur ton PC.
Relance OTL > Clic droit dessus > "Exécuter en tant qu'Administrateur".
Dans l'interface d'OTL, vérifie que la case "Rapport minimal" soit bien cochée.
Copie et colle le contenu de cette citation dans la fenêtre "Personnalisation".

:OTL
FF - HKLM\software\mozilla\Firefox\Extensions\\freecompressor@spointer.com: C:\Program Files (x86)\FreeCompressor\spointer\extensions\freecompressor@spointer.com [2010/09/30 23:44:47 | 000,000,000 | ---D | M]
[2011/04/22 13:09:15 | 000,000,336 | -H-- | M] () -- C:\ProgramData\42524424
[2011/04/22 11:15:15 | 000,000,344 | -H-- | M] () -- C:\ProgramData\43507464
[2011/04/22 09:31:45 | 000,000,392 | -H-- | M] () -- C:\ProgramData\43966216
[2011/04/22 13:09:15 | 000,000,336 | -H-- | C] () -- C:\ProgramData\42524424
[2011/04/22 11:15:15 | 000,000,344 | -H-- | C] () -- C:\ProgramData\43507464
[2011/04/22 09:28:45 | 000,000,392 | -H-- | C] () -- C:\ProgramData\43966216
[2010/09/30 23:45:13 | 000,000,000 | -H-D | M] -- C:\Users\EF\AppData\Roaming\freeCompressor
[2011/04/16 01:14:25 | 000,759,020 | ---- | M] () -- C:\Windows\SysNative\perfh00C.dat
[2011/04/16 01:14:25 | 000,662,770 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2011/04/16 01:14:25 | 000,153,650 | ---- | M] () -- C:\Windows\SysNative\perfc00C.dat
[2011/04/16 01:14:25 | 000,123,964 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
O1 - Hosts: ::1 localhost
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found.
O33 - MountPoints2\{6de0f96f-5d53-11e0-81f6-00269e9d9522}\Shell - "" = AutoRun
O33 - MountPoints2\{6de0f96f-5d53-11e0-81f6-00269e9d9522}\Shell\AutoRun\command - "" = E:\LaunchU3.exe -a
@Alternate Data Stream - 232 bytes -> C:\ProgramData\TEMP:2DF54B62
@Alternate Data Stream - 152 bytes -> C:\ProgramData\TEMP:AB689DEA
@Alternate Data Stream - 144 bytes -> C:\ProgramData\TEMP:5D7E5A8F
@Alternate Data Stream - 140 bytes -> C:\ProgramData\TEMP:4D066AD2
@Alternate Data Stream - 139 bytes -> C:\ProgramData\TEMP:93DE1838
@Alternate Data Stream - 131 bytes -> C:\ProgramData\TEMP:E3C56885
@Alternate Data Stream - 130 bytes -> C:\ProgramData\TEMP:E1F04E8D
@Alternate Data Stream - 128 bytes -> C:\ProgramData\TEMP:ABE89FFE
@Alternate Data Stream - 128 bytes -> C:\ProgramData\TEMP:444C53BA
@Alternate Data Stream - 124 bytes -> C:\ProgramData\TEMP:4CF61E54
@Alternate Data Stream - 122 bytes -> C:\ProgramData\TEMP:CF2C26D2
@Alternate Data Stream - 121 bytes -> C:\ProgramData\TEMP:0B9176C0
@Alternate Data Stream - 112 bytes -> C:\ProgramData\TEMP:24FECE50

:files
C:\ProgramData\~42524424
C:\ProgramData\~42524424r
C:\ProgramData\42524424
C:\ProgramData\~43507464
C:\ProgramData\~43507464r
C:\ProgramData\43507464
C:\ProgramData\43966216
C:\ProgramData\~43966216
C:\ProgramData\~43966216r

:Commands
[emptytemp]
[emptyflash]
[resethosts]
[reboot]

Clique sur le bouton "Correction".
Ne touche plus au PC avant son redémarrage.
A l'ouverture du PC un rapport va s'ouvrir --> 04262011_xxxxxxx.log ... Si ce n'est le cas tu le retrouveras sous le même nom sur le Bureau ou alors dans son dossier --> C:\_OTL
Copie et colle ici en réponse le contenu de ce rapport.

[sof42]

Bonjour,

Voici le rapport:

Code: Tout sélectionner

All processes killed
========== OTL ==========
Registry value HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\freecompressor@spointer.com deleted successfully.
C:\Program Files (x86)\FreeCompressor\spointer\extensions\freecompressor@spointer.com\components folder moved successfully.
C:\Program Files (x86)\FreeCompressor\spointer\extensions\freecompressor@spointer.com\chrome\content folder moved successfully.
C:\Program Files (x86)\FreeCompressor\spointer\extensions\freecompressor@spointer.com\chrome folder moved successfully.
C:\Program Files (x86)\FreeCompressor\spointer\extensions\freecompressor@spointer.com folder moved successfully.
C:\ProgramData\42524424 moved successfully.
C:\ProgramData\43507464 moved successfully.
C:\ProgramData\43966216 moved successfully.
File C:\ProgramData\42524424 not found.
File C:\ProgramData\43507464 not found.
File C:\ProgramData\43966216 not found.
C:\Users\EF\AppData\Roaming\freeCompressor folder moved successfully.
C:\Windows\SysNative\perfh00C.dat moved successfully.
C:\Windows\SysNative\perfh009.dat moved successfully.
C:\Windows\SysNative\perfc00C.dat moved successfully.
C:\Windows\SysNative\perfc009.dat moved successfully.
::1 localhost removed from HOSTS file successfully
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5C255C8A-E604-49b4-9D64-90988571CECB}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5C255C8A-E604-49b4-9D64-90988571CECB}\ not found.
64bit-Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\Locked deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\Locked deleted successfully.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{2318C2B1-4965-11D4-9B18-009027A5CD4F} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2318C2B1-4965-11D4-9B18-009027A5CD4F}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{6de0f96f-5d53-11e0-81f6-00269e9d9522}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6de0f96f-5d53-11e0-81f6-00269e9d9522}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{6de0f96f-5d53-11e0-81f6-00269e9d9522}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6de0f96f-5d53-11e0-81f6-00269e9d9522}\ not found.
File E:\LaunchU3.exe -a not found.
ADS C:\ProgramData\TEMP:2DF54B62 deleted successfully.
ADS C:\ProgramData\TEMP:AB689DEA deleted successfully.
ADS C:\ProgramData\TEMP:5D7E5A8F deleted successfully.
ADS C:\ProgramData\TEMP:4D066AD2 deleted successfully.
ADS C:\ProgramData\TEMP:93DE1838 deleted successfully.
ADS C:\ProgramData\TEMP:E3C56885 deleted successfully.
ADS C:\ProgramData\TEMP:E1F04E8D deleted successfully.
ADS C:\ProgramData\TEMP:ABE89FFE deleted successfully.
ADS C:\ProgramData\TEMP:444C53BA deleted successfully.
ADS C:\ProgramData\TEMP:4CF61E54 deleted successfully.
ADS C:\ProgramData\TEMP:CF2C26D2 deleted successfully.
ADS C:\ProgramData\TEMP:0B9176C0 deleted successfully.
ADS C:\ProgramData\TEMP:24FECE50 deleted successfully.
========== FILES ==========
C:\ProgramData\~42524424 moved successfully.
C:\ProgramData\~42524424r moved successfully.
File\Folder C:\ProgramData\42524424 not found.
C:\ProgramData\~43507464 moved successfully.
C:\ProgramData\~43507464r moved successfully.
File\Folder C:\ProgramData\43507464 not found.
File\Folder C:\ProgramData\43966216 not found.
C:\ProgramData\~43966216 moved successfully.
C:\ProgramData\~43966216r moved successfully.
========== COMMANDS ==========
 
[EMPTYTEMP]
 
User: All Users
 
User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->Flash cache emptied: 0 bytes
 
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes
 
User: EF
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 35953503 bytes
->Java cache emptied: 27804 bytes
->Google Chrome cache emptied: 6418695 bytes
->Flash cache emptied: 127417 bytes
 
User: Public
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 14356351 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 50540 bytes
RecycleBin emptied: 1566275109 bytes
 
Total Files Cleaned = 1 548,00 mb
 
 
[EMPTYFLASH]
 
User: All Users
 
User: Default
->Flash cache emptied: 0 bytes
 
User: Default User
->Flash cache emptied: 0 bytes
 
User: EF
->Flash cache emptied: 0 bytes
 
User: Public
 
Total Flash Files Cleaned = 0,00 mb
 
C:\Windows\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully
 
OTL by OldTimer - Version 3.2.22.3 log created on 04272011_101753

Files\Folders moved on Reboot...

Registry entries deleted on Reboot...


Depuis que j'ai retrouvé mes fichiers, j'ai une fenêtre qui s'ouvre "desktop bloc note: [.ShellClassInfo]
LocalizedResourceName=@%SystemRoot%\system32\shell32.dll,-21787", c'est quoi?

[danakil]

Salut!

C'est pas bien méchant. Ce sont des configurations (images) du Bureau qui se manisfestent car nous avons forcés l'affichage de ceux-ci. Nous allons les cacher de nouveau.

Fais ceci :
Tape simultanément sur ton clavier : Windows+R
> Dans la fenêtre ouverte tape : cmd et valide
> Dans la fenêtre MS-DOS (noire) après l'onglet clignotant colle cette citation :

attrib +h c:\* /s /d

> Valide par la touche Entrée.
> Tu vas voir des lignes défiler assez rapidement ... Laisse faire jusqu'à l'arrêt de ce défilement.
> Referme la fenêtre MS-DOS et redémarre ton PC.

... Au redémarrage ...
Vérifie que tes fichiers images ayant disparus durant un moment soient toujours accessibles et que le message d'alerte ne soit plus présent.
Si cela est le cas on continu et termine la désinfection.
Si ce n'est pas le cas alors on effectuera les corrections en manuelles ou je te ferai utiliser un fix 'maison' pour corriger ce problème.

[sof42]

Re,

Après avoir effectuer ce que tu m'as dit j'ai de renouveau tout perdu (photos, documents, icones bureau,...).

[danakil]

OK!

Rebelote avec la commande DOS :

attrib -h -r -s c:\* /s /d

Je te prépare le Fix.

[sof42]

Salut,

Ok fait.

[danakil]

Re,

Télécharge danakil.zip sur ton Bureau et pas ailleurs.
> Décompresse le dossier danakil.zip (l'extension '.zip' n'est pas forcément visible) en faisant un clic "droit dessus > Extraire ici".
> Ouvre le nouveau dossier jaune danakil présent sur ton Bureau > Clic droit sur le fichier xmt > Exécuter en tant qu'administrateur.
> Le tool va démarrer tout seul et lancera un scan de ton PC.
> Patiente pendant la durée du scan jusqu'à l'ouverture du rapport result.log.
(Une sauvegarde de ce rapport se situe dans le dossier danakil sous le même nom)
> Copie et colle moi ici le contenu de ce rapport.

[sof42]

Re,

Voici le rapport de danakil:

Code: Tout sélectionner

C:\$Recycle.Bin\S-1-5-20\desktop.ini
C:\$Recycle.Bin\S-1-5-21-2708893818-3176066099-1369214052-1003\desktop.ini
C:\$Recycle.Bin\S-1-5-21-2708893818-3176066099-1369214052-500\desktop.ini
C:\$Recycle.Bin\S-1-5-21-797893910-3710657917-3650010046-500\desktop.ini
C:\Program Files\desktop.ini
C:\Program Files\Common Files\Microsoft Shared\Stationery\desktop.ini
C:\Program Files\Microsoft Games\Chess\desktop.ini
C:\Program Files\Microsoft Games\FreeCell\desktop.ini
C:\Program Files\Microsoft Games\Hearts\desktop.ini
C:\Program Files\Microsoft Games\Mahjong\desktop.ini
C:\Program Files\Microsoft Games\Purble Place\desktop.ini
C:\Program Files\Microsoft Games\Solitaire\desktop.ini
C:\Program Files\Microsoft Games\SpiderSolitaire\desktop.ini
C:\Program Files (x86)\desktop.ini
C:\Program Files (x86)\Acer\Registration\desktop.ini
C:\Program Files (x86)\Common Files\microsoft shared\Stationery\desktop.ini
C:\Program Files (x86)\Microsoft Office\Office12\1033\DataServices\desktop.ini
C:\Program Files (x86)\Microsoft Office\Office12\1036\DataServices\desktop.ini
C:\Program Files (x86)\Windows Live\Mail\Stationery\desktop.ini
C:\ProgramData\Microsoft\Windows\Ringtones\desktop.ini
C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\desktop.ini
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\desktop.ini
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Tablet PC\desktop.ini
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\desktop.ini
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acer\desktop.ini
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\eSobi v2\desktop.ini
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games\desktop.ini
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\desktop.ini
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office\desktop.ini
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\OpenOffice.org 3.1\desktop.ini
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini
C:\Users\desktop.ini
C:\Users\All Users\Microsoft\Windows\Ringtones\desktop.ini
C:\Users\All Users\Microsoft\Windows\Start Menu\desktop.ini
C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\desktop.ini
C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini
C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\desktop.ini
C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\desktop.ini
C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\Tablet PC\desktop.ini
C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\desktop.ini
C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Acer\desktop.ini
C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini
C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\eSobi v2\desktop.ini
C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Games\desktop.ini
C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Maintenance\desktop.ini
C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Microsoft Office\desktop.ini
C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\OpenOffice.org 3.1\desktop.ini
C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini
C:\Users\Default\AppData\Local\Microsoft\Windows\History\desktop.ini
C:\Users\Default\AppData\Local\Microsoft\Windows\History\History.IE5\desktop.ini
C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini
C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini
C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini
C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\desktop.ini
C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\desktop.ini
C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\desktop.ini
C:\Users\EF\AppData\Local\Microsoft\Feeds Cache\desktop.ini
C:\Users\EF\AppData\Local\Microsoft\Feeds Cache\62OX9908\desktop.ini
C:\Users\EF\AppData\Local\Microsoft\Feeds Cache\7MMEQRM3\desktop.ini
C:\Users\EF\AppData\Local\Microsoft\Feeds Cache\AN6XM4WG\desktop.ini
C:\Users\EF\AppData\Local\Microsoft\Feeds Cache\T2CTLMX1\desktop.ini
C:\Users\EF\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini
C:\Users\EF\AppData\Local\Microsoft\Windows\Burn\Burn1\desktop.ini
C:\Users\EF\AppData\Local\Microsoft\Windows\History\desktop.ini
C:\Users\EF\AppData\Local\Microsoft\Windows\History\History.IE5\desktop.ini
C:\Users\EF\AppData\Local\Microsoft\Windows\History\Low\desktop.ini
C:\Users\EF\AppData\Local\Microsoft\Windows\History\Low\History.IE5\desktop.ini
C:\Users\EF\AppData\Local\Microsoft\Windows\Temporary Internet Files\desktop.ini
C:\Users\EF\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\desktop.ini
C:\Users\EF\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DQWU36P7\desktop.ini
C:\Users\EF\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\FD8CN4VC\desktop.ini
C:\Users\EF\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\IIHGM3FI\desktop.ini
C:\Users\EF\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WV6Z2MSE\desktop.ini
C:\Users\EF\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\desktop.ini
C:\Users\EF\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\desktop.ini
C:\Users\EF\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\2GLG5A5H\desktop.ini
C:\Users\EF\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\3NKE3FVM\desktop.ini
C:\Users\EF\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\5SBQPJSD\desktop.ini
C:\Users\EF\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\VWUHDASR\desktop.ini
C:\Users\EF\AppData\Local\Microsoft\Windows Mail\Stationery\desktop.ini
C:\Users\EF\AppData\Local\Microsoft Games\FreeCell\desktop.ini
C:\Users\EF\AppData\Local\Microsoft Games\Hearts\desktop.ini
C:\Users\EF\AppData\Local\Microsoft Games\Purble Place\desktop.ini
C:\Users\EF\AppData\Local\Microsoft Games\Solitaire\desktop.ini
C:\Users\EF\AppData\Local\Microsoft Games\Spider Solitaire\desktop.ini
C:\Users\EF\AppData\Local\Temp\Low\Fichiers Internet temporaires\Content.IE5\desktop.ini
C:\Users\EF\AppData\Local\Temp\Low\Fichiers Internet temporaires\Content.IE5\70IZ31F5\desktop.ini
C:\Users\EF\AppData\Local\Temp\Low\Fichiers Internet temporaires\Content.IE5\F6CJ2ACE\desktop.ini
C:\Users\EF\AppData\Local\Temp\Low\Fichiers Internet temporaires\Content.IE5\J05FVUOP\desktop.ini
C:\Users\EF\AppData\Local\Temp\Low\Fichiers Internet temporaires\Content.IE5\VRS0NL21\desktop.ini
C:\Users\EF\AppData\Local\Temp\Low\History\History.IE5\desktop.ini
C:\Users\EF\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini
C:\Users\EF\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\ImplicitAppShortcuts\70f62c6a7f1739bd\desktop.ini
C:\Users\EF\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\StartMenu\desktop.ini
C:\Users\EF\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini
C:\Users\EF\AppData\Roaming\Microsoft\Windows\Cookies\desktop.ini
C:\Users\EF\AppData\Roaming\Microsoft\Windows\Cookies\Low\desktop.ini
C:\Users\EF\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini
C:\Users\EF\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini
C:\Users\EF\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini
C:\Users\EF\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini
C:\Users\EF\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini
C:\Users\EF\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini
C:\Users\EF\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\desktop.ini
C:\Users\EF\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\desktop.ini
C:\Users\EF\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini
C:\Users\EF\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\desktop.ini
C:\Users\EF\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini
C:\Users\EF\Contacts\desktop.ini
C:\Users\EF\Desktop\desktop.ini
C:\Users\EF\Documents\desktop.ini
C:\Users\EF\Documents\My Stationery\desktop.ini
C:\Users\EF\Downloads\desktop.ini
C:\Users\EF\Favorites\desktop.ini
C:\Users\EF\Favorites\Links\desktop.ini
C:\Users\EF\Favorites\Sites Web MSN\Links\desktop.ini
C:\Users\EF\Links\desktop.ini
C:\Users\EF\Music\desktop.ini
C:\Users\EF\Music\Michael Jackson\desktop.ini
C:\Users\EF\Music\Michael Jackson\Michael Jackson - Blood On The Dance Floor\desktop.ini
C:\Users\EF\Music\Michael Jackson\Michael Jackson Greatest Hits - HIStory Volume I 2001\desktop.ini
C:\Users\EF\Music\Michael Jackson\[1995]Michael Jackson HIStory CD1\desktop.ini
C:\Users\EF\Music\Michael Jackson\[1995]Michael Jackson HIStory CD2\desktop.ini
C:\Users\EF\Pictures\desktop.ini
C:\Users\EF\Saved Games\desktop.ini
C:\Users\EF\Saved Games\Microsoft Games\desktop.ini
C:\Users\EF\Saved Games\Microsoft Games\FreeCell\desktop.ini
C:\Users\EF\Saved Games\Microsoft Games\Mahjong Titans\desktop.ini
C:\Users\EF\Saved Games\Microsoft Games\Purble Place\desktop.ini
C:\Users\EF\Searches\desktop.ini
C:\Users\EF\Videos\desktop.ini
C:\Users\Public\desktop.ini
C:\Users\Public\Desktop\desktop.ini
C:\Users\Public\Documents\desktop.ini
C:\Users\Public\Downloads\desktop.ini
C:\Users\Public\Libraries\desktop.ini
C:\Users\Public\Music\desktop.ini
C:\Users\Public\Music\Sample Music\desktop.ini
C:\Users\Public\Pictures\desktop.ini
C:\Users\Public\Pictures\Sample Pictures\desktop.ini
C:\Users\Public\Recorded TV\desktop.ini
C:\Users\Public\Recorded TV\Sample Media\desktop.ini
C:\Users\Public\Videos\desktop.ini
C:\Users\Public\Videos\Sample Videos\desktop.ini
C:\Windows\assembly\desktop.ini
C:\Windows\Downloaded Program Files\desktop.ini
C:\Windows\Fonts\desktop.ini
C:\Windows\Globalization\MCT\MCT-AU\Wallpaper\desktop.ini
C:\Windows\Globalization\MCT\MCT-BR\Link\desktop.ini
C:\Windows\Globalization\MCT\MCT-BR\Wallpaper\desktop.ini
C:\Windows\Globalization\MCT\MCT-CA\Wallpaper\desktop.ini
C:\Windows\Globalization\MCT\MCT-DE\Wallpaper\desktop.ini
C:\Windows\Globalization\MCT\MCT-ES\Link\desktop.ini
C:\Windows\Globalization\MCT\MCT-ES\Wallpaper\desktop.ini
C:\Windows\Globalization\MCT\MCT-FR\Link\desktop.ini
C:\Windows\Globalization\MCT\MCT-FR\Wallpaper\desktop.ini
C:\Windows\Globalization\MCT\MCT-GB\Link\desktop.ini
C:\Windows\Globalization\MCT\MCT-GB\Wallpaper\desktop.ini
C:\Windows\Globalization\MCT\MCT-IN\Link\desktop.ini
C:\Windows\Globalization\MCT\MCT-IN\Wallpaper\desktop.ini
C:\Windows\Globalization\MCT\MCT-IT\Wallpaper\desktop.ini
C:\Windows\Globalization\MCT\MCT-JP\Link\desktop.ini
C:\Windows\Globalization\MCT\MCT-JP\Wallpaper\desktop.ini
C:\Windows\Globalization\MCT\MCT-KR\Link\desktop.ini
C:\Windows\Globalization\MCT\MCT-KR\Wallpaper\desktop.ini
C:\Windows\Globalization\MCT\MCT-MX\Wallpaper\desktop.ini
C:\Windows\Globalization\MCT\MCT-NL\Wallpaper\desktop.ini
C:\Windows\Globalization\MCT\MCT-PL\Link\desktop.ini
C:\Windows\Globalization\MCT\MCT-PL\Wallpaper\desktop.ini
C:\Windows\Globalization\MCT\MCT-RU\Link\desktop.ini
C:\Windows\Globalization\MCT\MCT-RU\Wallpaper\desktop.ini
C:\Windows\Globalization\MCT\MCT-TR\Wallpaper\desktop.ini
C:\Windows\Globalization\MCT\MCT-US\Link\desktop.ini
C:\Windows\Globalization\MCT\MCT-US\Wallpaper\desktop.ini
C:\Windows\Globalization\MCT\MCT-ZA\Wallpaper\desktop.ini
C:\Windows\Media\desktop.ini
C:\Windows\Media\Afternoon\desktop.ini
C:\Windows\Media\Calligraphy\desktop.ini
C:\Windows\Media\Characters\desktop.ini
C:\Windows\Media\Cityscape\desktop.ini
C:\Windows\Media\Delta\desktop.ini
C:\Windows\Media\Festival\desktop.ini
C:\Windows\Media\Garden\desktop.ini
C:\Windows\Media\Heritage\desktop.ini
C:\Windows\Media\Landscape\desktop.ini
C:\Windows\Media\Quirky\desktop.ini
C:\Windows\Media\Raga\desktop.ini
C:\Windows\Media\Savanna\desktop.ini
C:\Windows\Media\Sonata\desktop.ini
C:\Windows\Offline Web Pages\desktop.ini
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\desktop.ini
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\desktop.ini
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files\desktop.ini
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\desktop.ini
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8HWC9R43\desktop.ini
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WA9QVTLX\desktop.ini
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WFB1J9E9\desktop.ini
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WZKVVC4L\desktop.ini
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Temp\Fichiers Internet temporaires\Content.IE5\desktop.ini
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Temp\Fichiers Internet temporaires\Content.IE5\1EWHBBTH\desktop.ini
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Temp\Fichiers Internet temporaires\Content.IE5\4IGI8BJ4\desktop.ini
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Temp\Fichiers Internet temporaires\Content.IE5\P2ZME467\desktop.ini
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Temp\Fichiers Internet temporaires\Content.IE5\Y3EEX6TN\desktop.ini
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Temp\History\History.IE5\desktop.ini
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\desktop.ini
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\desktop.ini
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\desktop.ini
C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\History\desktop.ini
C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\History\History.IE5\desktop.ini
C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\Temporary Internet Files\desktop.ini
C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\desktop.ini
C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6GJY61GO\desktop.ini
C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B0JISRG1\desktop.ini
C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\FNGTZJJ3\desktop.ini
C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XFCSU4WP\desktop.ini
C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini
C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini
C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\desktop.ini
C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\desktop.ini
C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\desktop.ini
C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\desktop.ini
C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\desktop.ini
C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\desktop.ini
C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\desktop.ini
C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0PS72R2M\desktop.ini
C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\62AXOPQ5\desktop.ini
C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6GQ6MCUJ\desktop.ini
C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\FZG8CKJ5\desktop.ini
C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LIXMVQOA\desktop.ini
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\desktop.ini
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\desktop.ini
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\desktop.ini
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\desktop.ini
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0PS72R2M\desktop.ini
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\62AXOPQ5\desktop.ini
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6GQ6MCUJ\desktop.ini
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\FZG8CKJ5\desktop.ini
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LIXMVQOA\desktop.ini
C:\Windows\Web\Wallpaper\Architecture\desktop.ini
C:\Windows\Web\Wallpaper\Characters\desktop.ini
C:\Windows\Web\Wallpaper\Landscapes\desktop.ini
C:\Windows\Web\Wallpaper\Nature\desktop.ini
C:\Windows\Web\Wallpaper\Scenes\desktop.ini
C:\Windows\winsxs\amd64_microsoft-windows-ehome-reg-inf_31bf3856ad364e35_6.1.7600.16385_none_5121322bdca04800\desktop.ini
C:\Windows\winsxs\amd64_microsoft-windows-ehome-samplemedia_31bf3856ad364e35_6.1.7600.16385_none_b6b9b223710b3802\desktop.ini
C:\Windows\winsxs\amd64_microsoft-windows-fontext_31bf3856ad364e35_6.1.7600.16385_none_fa7a8a2a0d4e51c5\desktop.ini
C:\Windows\winsxs\amd64_microsoft-windows-gameexplorer_31bf3856ad364e35_6.1.7600.16385_none_9df540b5daee0822\desktop.ini
C:\Windows\winsxs\amd64_microsoft-windows-ie-objectcontrolviewer_31bf3856ad364e35_8.0.7600.16385_none_add5a10aa4d614d5\desktop.ini
C:\Windows\winsxs\amd64_microsoft-windows-ie-offlinefavorites_31bf3856ad364e35_8.0.7600.16385_none_d7db1bd6e26c8fb9\desktop.ini
C:\Windows\winsxs\amd64_microsoft-windows-m..-br-links-component_31bf3856ad364e35_6.1.7600.16385_none_f884207db70f2af5\desktop.ini
C:\Windows\winsxs\amd64_microsoft-windows-m..-es-links-component_31bf3856ad364e35_6.1.7600.16385_none_9bad6a6fe6cd2a9b\desktop.ini
C:\Windows\winsxs\amd64_microsoft-windows-m..-fr-links-component_31bf3856ad364e35_6.1.7600.16385_none_fdd5eb81e578b451\desktop.ini
C:\Windows\winsxs\amd64_microsoft-windows-m..-gb-links-component_31bf3856ad364e35_6.1.7600.16385_none_0c6f0acfe2258c98\desktop.ini
C:\Windows\winsxs\amd64_microsoft-windows-m..-in-links-component_31bf3856ad364e35_6.1.7600.16385_none_8524b6fd148c78d2\desktop.ini
C:\Windows\winsxs\amd64_microsoft-windows-m..-jp-links-component_31bf3856ad364e35_6.1.7600.16385_none_c4d0601d7a048c6b\desktop.ini
C:\Windows\winsxs\amd64_microsoft-windows-m..-kr-links-component_31bf3856ad364e35_6.1.7600.16385_none_047bef9cdf7ca004\desktop.ini
C:\Windows\winsxs\amd64_microsoft-windows-m..-pl-links-component_31bf3856ad364e35_6.1.7600.16385_none_501cbd860be777f1\desktop.ini
C:\Windows\winsxs\amd64_microsoft-windows-m..-ru-links-component_31bf3856ad364e35_6.1.7600.16385_none_eb4e5afbd781da48\desktop.ini
C:\Windows\winsxs\amd64_microsoft-windows-m..-us-links-component_31bf3856ad364e35_6.1.7600.16385_none_b0f49680a073500b\desktop.ini
C:\Windows\winsxs\amd64_microsoft-windows-m..ttheme-au-component_31bf3856ad364e35_6.1.7600.16385_none_3474618675ef0765\desktop.ini
C:\Windows\winsxs\amd64_microsoft-windows-m..ttheme-br-component_31bf3856ad364e35_6.1.7600.16385_none_0fd974910466d9d9\desktop.ini
C:\Windows\winsxs\amd64_microsoft-windows-m..ttheme-ca-component_31bf3856ad364e35_6.1.7600.16385_none_f8af4ddae3bfcc7f\desktop.ini
C:\Windows\winsxs\amd64_microsoft-windows-m..ttheme-de-component_31bf3856ad364e35_6.1.7600.16385_none_4d5bfdc5c9c70eda\desktop.ini
C:\Windows\winsxs\amd64_microsoft-windows-m..ttheme-es-component_31bf3856ad364e35_6.1.7600.16385_none_73dcb25ee3bfcc7f\desktop.ini
C:\Windows\winsxs\amd64_microsoft-windows-m..ttheme-fr-component_31bf3856ad364e35_6.1.7600.16385_none_df9f5ff2afce5135\desktop.ini
C:\Windows\winsxs\amd64_microsoft-windows-m..ttheme-gb-component_31bf3856ad364e35_6.1.7600.16385_none_90a406812df29cfc\desktop.ini
C:\Windows\winsxs\amd64_microsoft-windows-m..ttheme-in-component_31bf3856ad364e35_6.1.7600.16385_none_5ab89b69752e8636\desktop.ini
C:\Windows\winsxs\amd64_microsoft-windows-m..ttheme-it-component_31bf3856ad364e35_6.1.7600.16385_none_0bd16b052df29cfc\desktop.ini
C:\Windows\winsxs\amd64_microsoft-windows-m..ttheme-jp-component_31bf3856ad364e35_6.1.7600.16385_none_1f07b0cb1d9f164f\desktop.ini
C:\Windows\winsxs\amd64_microsoft-windows-m..ttheme-kr-component_31bf3856ad364e35_6.1.7600.16385_none_e356c62cc60fa668\desktop.ini
C:\Windows\winsxs\amd64_microsoft-windows-m..ttheme-mx-component_31bf3856ad364e35_6.1.7600.16385_none_fc528b79548778dc\desktop.ini
C:\Windows\winsxs\amd64_microsoft-windows-m..ttheme-nl-component_31bf3856ad364e35_6.1.7600.16385_none_ce12671a4dd92927\desktop.ini
C:\Windows\winsxs\amd64_microsoft-windows-m..ttheme-pl-component_31bf3856ad364e35_6.1.7600.16385_none_35f55ccb238ce4d5\desktop.ini
C:\Windows\winsxs\amd64_microsoft-windows-m..ttheme-ru-component_31bf3856ad364e35_6.1.7600.16385_none_a77d89e58e66c2ac\desktop.ini
C:\Windows\winsxs\amd64_microsoft-windows-m..ttheme-tr-component_31bf3856ad364e35_6.1.7600.16385_none_b6d417c887b872f7\desktop.ini
C:\Windows\winsxs\amd64_microsoft-windows-m..ttheme-us-component_31bf3856ad364e35_6.1.7600.16385_none_b2f45fe5915da9ef\desktop.ini
C:\Windows\winsxs\amd64_microsoft-windows-m..ttheme-za-component_31bf3856ad364e35_6.1.7600.16385_none_a361574c7d52bad0\desktop.ini
C:\Windows\winsxs\amd64_microsoft-windows-mail-app_31bf3856ad364e35_6.1.7600.16385_none_4d4d1f2f696639a2\desktop.ini
C:\Windows\winsxs\amd64_microsoft-windows-musicsamples_31bf3856ad364e35_6.1.7600.16385_none_06495209cbd8e93b\desktop.ini
C:\Windows\winsxs\amd64_microsoft-windows-photosamples_31bf3856ad364e35_6.1.7600.16385_none_f36e0e659b8042be\desktop.ini
C:\Windows\winsxs\amd64_microsoft-windows-ringtonesamples_31bf3856ad364e35_6.1.7600.16385_none_135e536ebbe59c28\desktop.ini
C:\Windows\winsxs\amd64_microsoft-windows-s..-soundthemes-garden_31bf3856ad364e35_6.1.7600.16385_none_f7a4bf1e15863e21\desktop.ini
C:\Windows\winsxs\amd64_microsoft-windows-s..-soundthemes-quirky_31bf3856ad364e35_6.1.7600.16385_none_e55404efe49bb9cb\desktop.ini
C:\Windows\winsxs\amd64_microsoft-windows-s..-soundthemes-sonata_31bf3856ad364e35_6.1.7600.16385_none_201752c112c5078c\desktop.ini
C:\Windows\winsxs\amd64_microsoft-windows-s..allpaper-characters_31bf3856ad364e35_6.1.7600.16385_none_bde0eaed84920a21\desktop.ini
C:\Windows\winsxs\amd64_microsoft-windows-s..allpaper-landscapes_31bf3856ad364e35_6.1.7600.16385_none_e57abb2f66db71a9\desktop.ini
C:\Windows\winsxs\amd64_microsoft-windows-s..dthemes-calligraphy_31bf3856ad364e35_6.1.7600.16385_none_c1407bc73caf8dfc\desktop.ini
C:\Windows\winsxs\amd64_microsoft-windows-s..i-accessibilityuser_31bf3856ad364e35_6.1.7600.16385_none_bf396ba9226e0702\desktop.ini
C:\Windows\winsxs\amd64_microsoft-windows-s..ini-accessoriesuser_31bf3856ad364e35_6.1.7600.16385_none_7ff91f5d2dd6c770\desktop.ini
C:\Windows\winsxs\amd64_microsoft-windows-s..ini-maintenanceuser_31bf3856ad364e35_6.1.7600.16385_none_61fc91b36f901b87\desktop.ini
C:\Windows\winsxs\amd64_microsoft-windows-s..ini-systemtoolsuser_31bf3856ad364e35_6.1.7600.16385_none_7ca09f65fd387e58\desktop.ini
C:\Windows\winsxs\amd64_microsoft-windows-s..ktopini-accessories_31bf3856ad364e35_6.1.7600.16385_none_480c0d8bd31ae43f\desktop.ini
C:\Windows\winsxs\amd64_microsoft-windows-s..ktopini-maintenance_31bf3856ad364e35_6.1.7600.16385_none_ba8f25a3b6d81a68\desktop.ini
C:\Windows\winsxs\amd64_microsoft-windows-s..ktopini-systemtools_31bf3856ad364e35_6.1.7600.16385_none_da623240a154f357\desktop.ini
C:\Windows\winsxs\amd64_microsoft-windows-s..l-soundthemes-delta_31bf3856ad364e35_6.1.7600.16385_none_fbf7e0678b64a4b8\desktop.ini
C:\Windows\winsxs\amd64_microsoft-windows-s..lpaper-architecture_31bf3856ad364e35_6.1.7600.16385_none_d99106b927aa7782\desktop.ini
C:\Windows\winsxs\amd64_microsoft-windows-s..ndthemes-characters_31bf3856ad364e35_6.1.7600.16385_none_08da32b0fdad9220\desktop.ini
C:\Windows\winsxs\amd64_microsoft-windows-s..opini-accessibility_31bf3856ad364e35_6.1.7600.16385_none_36604ea896f9a97d\desktop.ini
C:\Windows\winsxs\amd64_microsoft-windows-s..oundthemes-festival_31bf3856ad364e35_6.1.7600.16385_none_121f20b55f0bde68\desktop.ini
C:\Windows\winsxs\amd64_microsoft-windows-s..oundthemes-heritage_31bf3856ad364e35_6.1.7600.16385_none_5872c0830d0c4747\desktop.ini
C:\Windows\winsxs\amd64_microsoft-windows-s..sktopini-sendtouser_31bf3856ad364e35_6.1.7600.16385_none_64398328adc9c59d\desktop.ini
C:\Windows\winsxs\amd64_microsoft-windows-s..soundthemes-savanna_31bf3856ad364e35_6.1.7600.16385_none_8501e89d0b011992\desktop.ini
C:\Windows\winsxs\amd64_microsoft-windows-s..undthemes-afternoon_31bf3856ad364e35_6.1.7600.16385_none_2a05e57d5ab3659e\desktop.ini
C:\Windows\winsxs\amd64_microsoft-windows-s..undthemes-cityscape_31bf3856ad364e35_6.1.7600.16385_none_5b48f43248490503\desktop.ini
C:\Windows\winsxs\amd64_microsoft-windows-s..undthemes-landscape_31bf3856ad364e35_6.1.7600.16385_none_7a83a914edc3de49\desktop.ini
C:\Windows\winsxs\amd64_microsoft-windows-shell-sounds_31bf3856ad364e35_6.1.7600.16385_none_73076dd9cf3a9dce\desktop.ini
C:\Windows\winsxs\amd64_microsoft-windows-shell-soundthemes-raga_31bf3856ad364e35_6.1.7600.16385_none_2fe300bf8e73cdbd\desktop.ini
C:\Windows\winsxs\amd64_microsoft-windows-shell-wallpaper-nature_31bf3856ad364e35_6.1.7600.16385_none_d5909570704a09c0\desktop.ini
C:\Windows\winsxs\amd64_microsoft-windows-shell-wallpaper-scenes_31bf3856ad364e35_6.1.7600.16385_none_a4393b1a254aeaee\desktop.ini
C:\Windows\winsxs\amd64_microsoft-windows-tabletpc-journal_31bf3856ad364e35_6.1.7600.16385_none_73a679f8be493c8c\desktop.ini
C:\Windows\winsxs\amd64_microsoft-windows-videosamples_31bf3856ad364e35_6.1.7600.16385_none_51a21f033003affd\desktop.ini
C:\Windows\winsxs\amd64_subsystem-for-unix-based-applications_31bf3856ad364e35_6.1.7600.16385_none_cfdd496d09a0a280\desktop.ini
C:\Windows\winsxs\x86_microsoft-windows-mail-app_31bf3856ad364e35_6.1.7600.16385_none_f12e83abb108c86c\desktop.ini