Log hijackthis pour conseils SVP

bonsoir mary,

suis pas un pro du tout, pour ton probléme demande a balltrap 34 ou a S!ri eux c'est plus que des pros

mary fait ton propre message sinon ont vas se melanger stp
merci

la chasse et le balltrap ma vrai passion
voir site perso dans profil

merci surtout a toi! pour ton aide a balltrap aussi sans vous il y aurait pas de soluce vous ete des maitres,

peux tu m'indiquer la fcon de poster le registre et refaire un log vx2 finder, je sais je suis un dur pour comprendre mais j'ai tellement de pages de message que je doit chaque rechercher avant et ca me prend un temps fou

voila ca ds un premier temps,

excuse moi suis maladroit en plus,

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,33,00,32,00,2e,00,64,00,6c,00,\
6c,00,00,00
"Logoff"="ChainWlxLogoffEvent"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,6e,00,65,00,74,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Logoff"="CryptnetWlxLogoffEvent"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll]
"DLLName"="cscdll.dll"
"Logon"="WinlogonLogonEvent"
"Logoff"="WinlogonLogoffEvent"
"ScreenSaver"="WinlogonScreenSaverEvent"
"Startup"="WinlogonStartupEvent"
"Shutdown"="WinlogonShutdownEvent"
"StartShell"="WinlogonStartShellEvent"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp]
"DLLName"="wlnotify.dll"
"Logon"="SCardStartCertProp"
"Logoff"="SCardStopCertProp"
"Lock"="SCardSuspendCertProp"
"Unlock"="SCardResumeCertProp"
"Enabled"=dword:00000001
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule]
"Asynchronous"=dword:00000000
"DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Impersonate"=dword:00000000
"StartShell"="SchedStartShell"
"Logoff"="SchedEventLogOff"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy]
"Logoff"="WLEventLogoff"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001
"DllName"=hex(2):73,00,63,00,6c,00,67,00,6e,00,74,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn]
"DLLName"="WlNotify.dll"
"Lock"="SensLockEvent"
"Logon"="SensLogonEvent"
"Logoff"="SensLogoffEvent"
"Safe"=dword:00000001
"MaxWait"=dword:00000258
"StartScreenSaver"="SensStartScreenSaverEvent"
"StopScreenSaver"="SensStopScreenSaverEvent"
"Startup"="SensStartupEvent"
"Shutdown"="SensShutdownEvent"
"StartShell"="SensStartShellEvent"
"PostShell"="SensPostShellEvent"
"Disconnect"="SensDisconnectEvent"
"Reconnect"="SensReconnectEvent"
"Unlock"="SensUnlockEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ShellServiceObjectDelayLoad]
"Asynchronous"=dword:00000000
"DllName"="C:\\WINDOWS\\system32\\enpsl1771.dll"
"Impersonate"=dword:00000000
"Logon"="WinLogon"
"Logoff"="WinLogoff"
"Shutdown"="WinShutdown"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv]
"Asynchronous"=dword:00000000
"DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Impersonate"=dword:00000000
"Logoff"="TSEventLogoff"
"Logon"="TSEventLogon"
"PostShell"="TSEventPostShell"
"Shutdown"="TSEventShutdown"
"StartShell"="TSEventStartShell"
"Startup"="TSEventStartup"
"MaxWait"=dword:00000258
"Reconnect"="TSEventReconnect"
"Disconnect"="TSEventDisconnect"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon]
"DLLName"="wlnotify.dll"
"Logon"="RegisterTicketExpiredNotificationEvent"
"Logoff"="UnregisterTicketExpiredNotificationEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

c'est cela?


Log for VX2.BetterInternet File Finder (msg126)

Files Found---

Additional Files---

Keys Under Notify---
crypt32chain
cryptnet
cscdll
ScCertProp
Schedule
sclgntfy
SensLogn
ShellServiceObjectDelayLoad
termsrv
wlballoon


Guardian Key--- is called:

User Agent String---
{8D548090-36A9-4B1F-BFB2-BB7F27AD3E24}

j'ai ceci aussi, dsl de repéter msg sur msg je fait ce que je peux pour les manip

127.0.0.1 localhost
127.0.0.1 www.igetnet.com
127.0.0.1 code.ignphrases.com
127.0.0.1 clear-search.com
127.0.0.1 r1.clrsch.com
127.0.0.1 sds.clrsch.com
127.0.0.1 status.clrsch.com
127.0.0.1 www.clrsch.com
127.0.0.1 clr-sch.com
127.0.0.1 sds-qckads.com
127.0.0.1 status.qckads.com
69.20.16.183 auto.search.msn.com
69.20.16.183 search.netscape.com
69.20.16.183 ieautosearch
69.20.16.183 ieautosearch
69.20.16.183 ieautosearch

bonsoir, mes excuses pour hier, j'ai eu de la visite, j'ai du fermer
j'ai voulu reprendre après et comme tu la dit j'étais trop optimiste car qd j'ai relancé horreur et damnation, une page s'affichait mais plus la meme. Je n'ai tjrs pas récup les fonctions de ma corbeille.

face a ca j'ai laisssé tomber

voci qd meme le dllcompare que tu m'avait demandé

SYSTEM32\en28l1~1.dll Mon 24 Jan 2005 12:10:38 ..S.R 225 716 220,43 K
C:\WINDOWS\SYSTEM32\enp8l1~1.dll Mon 24 Jan 2005 17:06:12 ..S.R 223 143 217,91 K
C:\WINDOWS\SYSTEM32\ir06l5~1.dll Sat 22 Jan 2005 21:44:18 ..S.R 225 660 220,37 K
C:\WINDOWS\SYSTEM32\ir64l5~1.dll Mon 24 Jan 2005 12:02:46 ..S.R 225 360 220,08 K
C:\WINDOWS\SYSTEM32\lv0s09~1.dll Mon 24 Jan 2005 16:38:02 ..S.R 222 562 217,34 K
C:\WINDOWS\SYSTEM32\lvns09~1.dll Sun 23 Jan 2005 16:40:44 ..S.R 222 845 217,62 K
C:\WINDOWS\SYSTEM32\q686lg~1.dll Mon 24 Jan 2005 15:30:24 ..S.R 223 051 217,82 K
C:\WINDOWS\SYSTEM32\xmboa.dll Mon 24 Jan 2005 17:06:12 ..S.R 225 716 220,43 K

comme tu vois je viens de le faire, la nouvelle page est de type about:blank sans rien après ce qui n'était pas le cas de la précédente, j'ai fait hijack et supprimer les nouvelles lignes (je fini par le connaitre par coeur), rien a faire elle se fixent pas

voici le résultat

Logfile of HijackThis v1.99.0
Scan saved at 18:15:36, on 24/01/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Messenger Plus! 3\MsgPlus.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\WINDOWS\System32\atievxx.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Fichiers communs\EPSON\EBAPI\eEBSVC.exe
C:\Program Files\Fichiers communs\EPSON\EBAPI\SAgent2.exe
C:\WINDOWS\System32\inetsrv\inetinfo.exe
C:\WINDOWS\System32\tcpsvcs.exe
c:\progra~1\intern~1\iexplore.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\mqsvc.exe
C:\WINDOWS\System32\mqtgsvc.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\klum\Bureau\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.hdnfbrokoovdpiox.com/scGhqs3p7cqEu2pACxMXYyQ1UQkWQYC45IAWyKhMNDeDeEr7UBc2sP04i/V3CXEP.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\protect32.dll/sp.html (obfuscated)
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32\protect32.dll/sp.html (obfuscated)
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\protect32.dll/sp.html (obfuscated)
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system32\protect32.dll/sp.html (obfuscated)
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system32\protect32.dll/sp.html (obfuscated)
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
O1 - Hosts: 69.20.16.183 auto.search.msn.com
O1 - Hosts: 69.20.16.183 search.netscape.com
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 ieautosearch
O2 - BHO: (no name) - {674665F8-1F32-496B-9284-FAF6034CFEF4} - C:\WINDOWS\system32\protect32.dll
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\Messenger Plus! 3\MsgPlus.exe"
O4 - HKLM\..\Run: [Coal Heart Bat Play] C:\Documents and Settings\All Users\Application Data\Third first coal heart\drvlist.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [4 aim] C:\DOCUME~1\klum\APPLIC~1\SEEKIN~1\Date each dash.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll
O15 - Trusted Zone: http://*.63.219.181.7
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=34738&clcid=0x409
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1099228269418
O17 - HKLM\System\CCS\Services\Tcpip\..\{0E40B604-4919-40F5-AFA4-45C7F99BE780}: NameServer = 69.50.188.180,195.225.176.31
O17 - HKLM\System\CCS\Services\Tcpip\..\{3B0CD561-A241-4B8D-9442-F780AB42DC63}: NameServer = 69.50.188.180,195.225.176.31
O17 - HKLM\System\CS1\Services\Tcpip\..\{0E40B604-4919-40F5-AFA4-45C7F99BE780}: NameServer = 69.50.188.180,195.225.176.31
O18 - Filter: text/html - {D616BCD7-2910-4EFF-877E-9F77DB8CD415} - C:\WINDOWS\system32\protect32.dll
O18 - Filter: text/plain - {D616BCD7-2910-4EFF-877E-9F77DB8CD415} - C:\WINDOWS\system32\protect32.dll
O23 - Service: avast! iAVS4 Control Service - Unknown - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - Unknown - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: Service d'administration du Gestionnaire de disque logique - Unknown - C:\WINDOWS\System32\dmadmin.exe
O23 - Service: EpsonBidirectionalService - Unknown - C:\Program Files\Fichiers communs\EPSON\EBAPI\eEBSVC.exe
O23 - Service: EPSON Printer Status Agent2 - SEIKO EPSON CORPORATION - C:\Program Files\Fichiers communs\EPSON\EBAPI\SAgent2.exe
O23 - Service: Journal des événements - Unknown - C:\WINDOWS\system32\services.exe
O23 - Service: Fax - Unknown - C:\WINDOWS\system32\fxssvc.exe
O23 - Service: Administration IIS - Unknown - C:\WINDOWS\System32\inetsrv\inetinfo.exe
O23 - Service: Service COM de gravage de CD IMAPI - Unknown - C:\WINDOWS\System32\imapi.exe
O23 - Service: Partage de Bureau à distance NetMeeting - Unknown - C:\WINDOWS\System32\mnmsrvc.exe
O23 - Service: Publication FTP - Unknown - C:\WINDOWS\System32\inetsrv\inetinfo.exe
O23 - Service: Plug-and-Play - Unknown - C:\WINDOWS\system32\services.exe
O23 - Service: Gestionnaire de session d'aide sur le Bureau à distance - Unknown - C:\WINDOWS\system32\sessmgr.exe
O23 - Service: Carte à puce - Unknown - C:\WINDOWS\System32\SCardSvr.exe
O23 - Service: Simple Mail Transfer Protocol (SMTP) - Unknown - C:\WINDOWS\System32\inetsrv\inetinfo.exe
O23 - Service: Service SNMP - Unknown - C:\WINDOWS\System32\snmp.exe
O23 - Service: Cliché instantané de volume - Unknown - C:\WINDOWS\System32\vssvc.exe
O23 - Service: Publication World Wide Web - Unknown - C:\WINDOWS\System32\inetsrv\inetinfo.exe
O23 - Service: Carte de performance WMI - Unknown - C:\WINDOWS\System32\wbem\wmiapsrv.exe

Voila je sais pas si il y a encore de l'espoir, mais je voudrait ne pas formater et arriver a une solution, je pense que si chaque fois on utilise le formatage on ne trouvera jamais la solution a rien

la clef de registre dont vous parler, j'ai pas ou alors je mis prend comme un manche! pourtant je sais faire une recherche là,
merci a vous deux

Salut Cédric_Bordeaux,

Reposte tout ca dans un nouveau message afin de ne pas confondre avec les logs et les explications destinées à André.

bonsoir S!RI,

ca me réjouis pas tes nouvelles, enfin bon.

j'ai récupérer une fois de plus ma page de démarrage, cette fois après plusieurs arret et redémarage ca semble stable

j'ai refait des scans, un momment j'avais plus que un vx2 sur 3, puis c'est revenu, je t'avoue que je commence sérieusement a en avoir asser, mais tant que tu veux bien m'aider je continue

merci a vous tous pour l'intéret que vous me porté
* DLLCompare Log version()
Files Found that Windows does not See or cannot Access
*Not everything listed here means you are infected!
________________________________________________

C:\WINDOWS\SYSTEM32\crsetacl.dll Tue 25 Jan 2005 8:18:42 ..S.R 223 566 218,32 K
C:\WINDOWS\SYSTEM32\en88l1~1.dll Tue 25 Jan 2005 14:42:34 ..S.R 223 018 217,79 K
C:\WINDOWS\SYSTEM32\hnrek.dll Tue 25 Jan 2005 8:11:44 ..S.R 223 018 217,79 K
C:\WINDOWS\SYSTEM32\ir06l5~1.dll Sat 22 Jan 2005 21:44:18 ..S.R 225 660 220,37 K
C:\WINDOWS\SYSTEM32\ir64l5~1.dll Mon 24 Jan 2005 12:02:46 ..S.R 225 360 220,08 K
C:\WINDOWS\SYSTEM32\l0n4la~1.dll Tue 25 Jan 2005 14:51:30 ..S.R 224 468 219,21 K
C:\WINDOWS\SYSTEM32\lv0s09~1.dll Mon 24 Jan 2005 16:38:02 ..S.R 222 562 217,34 K
C:\WINDOWS\SYSTEM32\lvns09~1.dll Sun 23 Jan 2005 16:40:44 ..S.R 222 845 217,62 K
C:\WINDOWS\SYSTEM32\mvctfp.dll Tue 25 Jan 2005 7:57:02 ..S.R 225 716 220,43 K
C:\WINDOWS\SYSTEM32\o084la~1.dll Tue 25 Jan 2005 9:46:20 ..S.R 224 498 219,23 K
C:\WINDOWS\SYSTEM32\q686lg~1.dll Mon 24 Jan 2005 15:30:24 ..S.R 223 051 217,82 K
C:\WINDOWS\SYSTEM32\ricrt4.dll Tue 25 Jan 2005 8:24:18 ..S.R 223 018 217,79 K
________________________________________________

rien a faire il veux pas les killer, je fait copier/coller, puis ok reboot
lignes apres lignes, j'ai achaque coup un message que je comprends pas trop et que tu doit connaitre j'en avai parlé plus haut

L2MFIX find log 1.02
These are the registry keys present
**********************************************************************************
Winlogon/notify:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Controls Folder]
"Asynchronous"=dword:00000000
"DllName"="C:\\WINDOWS\\system32\\en88l1lu1.dll"
"Impersonate"=dword:00000000
"Logon"="WinLogon"
"Logoff"="WinLogoff"
"Shutdown"="WinShutdown"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,33,00,32,00,2e,00,64,00,6c,00,\
6c,00,00,00
"Logoff"="ChainWlxLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,6e,00,65,00,74,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Logoff"="CryptnetWlxLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll]
"DLLName"="cscdll.dll"
"Logon"="WinlogonLogonEvent"
"Logoff"="WinlogonLogoffEvent"
"ScreenSaver"="WinlogonScreenSaverEvent"
"Startup"="WinlogonStartupEvent"
"Shutdown"="WinlogonShutdownEvent"
"StartShell"="WinlogonStartShellEvent"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp]
"DLLName"="wlnotify.dll"
"Logon"="SCardStartCertProp"
"Logoff"="SCardStopCertProp"
"Lock"="SCardSuspendCertProp"
"Unlock"="SCardResumeCertProp"
"Enabled"=dword:00000001
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule]
"Asynchronous"=dword:00000000
"DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Impersonate"=dword:00000000
"StartShell"="SchedStartShell"
"Logoff"="SchedEventLogOff"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy]
"Logoff"="WLEventLogoff"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001
"DllName"=hex(2):73,00,63,00,6c,00,67,00,6e,00,74,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn]
"DLLName"="WlNotify.dll"
"Lock"="SensLockEvent"
"Logon"="SensLogonEvent"
"Logoff"="SensLogoffEvent"
"Safe"=dword:00000001
"MaxWait"=dword:00000258
"StartScreenSaver"="SensStartScreenSaverEvent"
"StopScreenSaver"="SensStopScreenSaverEvent"
"Startup"="SensStartupEvent"
"Shutdown"="SensShutdownEvent"
"StartShell"="SensStartShellEvent"
"PostShell"="SensPostShellEvent"
"Disconnect"="SensDisconnectEvent"
"Reconnect"="SensReconnectEvent"
"Unlock"="SensUnlockEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv]
"Asynchronous"=dword:00000000
"DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Impersonate"=dword:00000000
"Logoff"="TSEventLogoff"
"Logon"="TSEventLogon"
"PostShell"="TSEventPostShell"
"Shutdown"="TSEventShutdown"
"StartShell"="TSEventStartShell"
"Startup"="TSEventStartup"
"MaxWait"=dword:00000258
"Reconnect"="TSEventReconnect"
"Disconnect"="TSEventDisconnect"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon]
"DLLName"="wlnotify.dll"
"Logon"="RegisterTicketExpiredNotificationEvent"
"Logoff"="UnregisterTicketExpiredNotificationEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

**********************************************************************************
useragent:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
"{8D548090-36A9-4B1F-BFB2-BB7F27AD3E24}"=""

**********************************************************************************
Shell Extension key:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]
"{00022613-0000-0000-C000-000000000046}"="Feuille de propri‚t‚s du fichier multim‚dia"
"{176d6597-26d3-11d1-b350-080036a75b03}"="Gestion de scanneur ICM"
"{1F2E5C40-9550-11CE-99D2-00AA006E086C}"="Page de s‚curit‚ NTFS"
"{3EA48300-8CF6-101B-84FB-666CCB9BCD32}"="Page des propri‚t‚s de OLE DocFile"
"{40dd6e20-7c17-11ce-a804-00aa003ca9f6}"="Extensions de l'environnement pour le partage"
"{41E300E0-78B6-11ce-849B-444553540000}"="PlusPack CPL Extension"
"{42071712-76d4-11d1-8b24-00a0c9068ff3}"="Extension Affichage Carte du Panneau de configuration"
"{42071713-76d4-11d1-8b24-00a0c9068ff3}"="Extension Affichage cran du Panneau de configuration"
"{42071714-76d4-11d1-8b24-00a0c9068ff3}"="Extension Affichage Panorama du Panneau de configuration"
"{4E40F770-369C-11d0-8922-00A024AB2DBB}"="Page de s‚curit‚ DS"
"{513D916F-2A8E-4F51-AEAB-0CBC76FB1AF8}"="Page de compatibilit‚"
"{56117100-C0CD-101B-81E2-00AA004AE837}"="Gestionnaire de donn‚es endommag‚es de l'environnement"
"{59099400-57FF-11CE-BD94-0020AF85B590}"="Extension copie de disquette"
"{59be4990-f85c-11ce-aff7-00aa003ca9f6}"="Extensions de l'environnement pour les objets r‚seau de Microsoft Windows"
"{5DB2625A-54DF-11D0-B6C4-0800091AA605}"="Gestion d'‚cran ICM"
"{675F097E-4C4D-11D0-B6C1-0800091AA605}"="Gestion d'imprimante ICM"
"{764BF0E1-F219-11ce-972D-00AA00A14F56}"="Extensions de l'environnement de compression de fichiers"
"{77597368-7b15-11d0-a0c2-080036af3f03}"="Extension de l'environnement d'imprimante Web"
"{7988B573-EC89-11cf-9C00-00AA00A14F56}"="Disk Quota UI"
"{853FE2B1-B769-11d0-9C4E-00C04FB6C6FA}"="Menu contextuel de cryptage"
"{85BBD920-42A0-1069-A2E4-08002B30309D}"="Porte-documents"
"{88895560-9AA2-1069-930E-00AA0030EBC8}"="Extension ic“ne HyperTerminal"
"{BD84B380-8CA2-1069-AB1D-08000948F534}"="Fonts"
"{DBCE2480-C732-101B-BE72-BA78E9AD5B27}"="Profil ICC"
"{F37C5810-4D3F-11d0-B4BF-00AA00BBB723}"="Page de s‚curit‚ des imprimantes"
"{f81e9010-6ea4-11ce-a7ff-00aa003ca9f6}"="Extensions de l'environnement pour le partage"
"{f92e8c40-3d33-11d2-b1aa-080036a75b03}"="Display TroubleShoot CPL Extension"
"{7444C717-39BF-11D1-8CD9-00C04FC29D45}"="Extension de cryptographie PKO"
"{7444C719-39BF-11D1-8CD9-00C04FC29D45}"="Extension de cryptographie Sign"
"{7007ACC7-3202-11D1-AAD2-00805FC1270E}"="Connexions r‚seau"
"{992CFFA0-F557-101A-88EC-00DD010CCC48}"="Connexions r‚seau"
"{E211B736-43FD-11D1-9EFB-0000F8757FCD}"="&Scanneurs et appareils photo"
"{FB0C9C8A-6C50-11D1-9F1D-0000F8757FCD}"="&Scanneurs et appareils photo"
"{905667aa-acd6-11d2-8080-00805f6596d2}"="&Scanneurs et appareils photo"
"{3F953603-1008-4f6e-A73A-04AAC7A992F1}"="&Scanneurs et appareils photo"
"{83bbcbf3-b28a-4919-a5aa-73027445d672}"="&Scanneurs et appareils photo"
"{F0152790-D56E-4445-850E-4F3117DB740C}"="Remote Sessions CPL Extension"
"{5F327514-6C5E-4d60-8F16-D07FA08A78ED}"="Auto Update Property Sheet Extension"
"{60254CA5-953B-11CF-8C96-00AA00B8708C}"="Extensions de l'interpr‚teur de commandes pour l'environnement d'ex‚cution de scripts Windows"
"{2206CDB2-19C1-11D1-89E0-00C04FD7A829}"="Liaison de donn‚es Microsoft"
"{DD2110F0-9EEF-11cf-8D8E-00AA0060F5BF}"="Tasks Folder Icon Handler"
"{797F1E90-9EDD-11cf-8D8E-00AA0060F5BF}"="Tasks Folder Shell Extension"
"{D6277990-4C6A-11CF-8D87-00AA0060F5BF}"="Tƒches planifi‚es"
"{0DF44EAA-FF21-4412-828E-260A8728E7F1}"="Barre des tƒches et menu D‚marrer"
"{2559a1f0-21d7-11d4-bdaf-00c04f60b9f0}"="Rechercher"
"{2559a1f1-21d7-11d4-bdaf-00c04f60b9f0}"="Aide et support"
"{2559a1f2-21d7-11d4-bdaf-00c04f60b9f0}"="Aide et support"
"{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}"="Ex‚cuter..."
"{2559a1f4-21d7-11d4-bdaf-00c04f60b9f0}"="Internet"
"{2559a1f5-21d7-11d4-bdaf-00c04f60b9f0}"="Courrier ‚lectronique"
"{D20EA4E1-3957-11d2-A40B-0C5020524152}"="Polices"
"{D20EA4E1-3957-11d2-A40B-0C5020524153}"="Outils d'administration"
"{875CB1A1-0F29-45de-A1AE-CFB4950D0B78}"="Audio Media Properties Handler"
"{40C3D757-D6E4-4b49-BB41-0E5BBEA28817}"="Video Media Properties Handler"
"{E4B29F9D-D390-480b-92FD-7DDB47101D71}"="Wav Properties Handler"
"{87D62D94-71B3-4b9a-9489-5FE6850DC73E}"="Avi Properties Handler"
"{A6FD9E45-6E44-43f9-8644-08598F5A74D9}"="Midi Properties Handler"
"{c5a40261-cd64-4ccf-84cb-c394da41d590}"="Video Thumbnail Extractor"
"{5E6AB780-7743-11CF-A12B-00AA004AE837}"="Barre d'outils Internet Microsoft"
"{22BF0C20-6DA7-11D0-B373-00A0C9034938}"="tat du t‚l‚chargement"
"{91EA3F8B-C99B-11d0-9815-00C04FD91972}"="Dossier Bureau ‚tendu"
"{6413BA2C-B461-11d1-A18A-080036B11A03}"="Dossier du shell augment‚"
"{F61FFEC1-754F-11d0-80CA-00AA005B4383}"="BandProxy"
"{7BA4C742-9E81-11CF-99D3-00AA004AE837}"="Bande du navigateur Microsoft"
"{30D02401-6A81-11d0-8274-00C04FD5AE38}"="Bande de recherche"
"{32683183-48a0-441b-a342-7c2a440a9478}"="Media Band"
"{169A0691-8DF9-11d1-A1C4-00C04FD75D13}"="Volet int‚gr‚ de recherche"
"{07798131-AF23-11d1-9111-00A0C98BA67D}"="Recherche Web"
"{AF4F6510-F982-11d0-8595-00AA004CD6D8}"="Utilitaire des options de l'arborescence du Registre"
"{01E04581-4EEE-11d0-BFE9-00AA005B4383}"="&Adresse"
"{A08C11D2-A228-11d0-825B-00AA005B4383}"="BoŒte d'entr‚e de l'adresse"
"{00BB2763-6A77-11D0-A535-00C04FD7D062}"="Saisie semi-automatique Microsoft"
"{7376D660-C583-11d0-A3A5-00C04FD706EC}"="TridentImageExtractor"
"{6756A641-DE71-11d0-831B-00AA005B4383}"="Liste de saisie semi-automatique MRU"
"{6935DB93-21E8-4ccc-BEB9-9FE3C77A297A}"="Liste de saisie semi-automatique personnalis‚e MRU"
"{7e653215-fa25-46bd-a339-34a2790f3cb7}"="Accessible"
"{acf35015-526e-4230-9596-becbe19f0ac9}"="Barre de progrŠs auto-ouvrante"
"{E0E11A09-5CB8-4B6C-8332-E00720A168F2}"="Analyseur de la barre d'adresses"
"{00BB2764-6A77-11D0-A535-00C04FD7D062}"="Liste de saisie semi-automatique de l'historique Microsoft"
"{03C036F1-A186-11D0-824A-00AA005B4383}"="Liste de saisie semi-automatique du dossier Shell Microsoft"
"{00BB2765-6A77-11D0-A535-00C04FD7D062}"="Conteneur de la liste de saisie semi-automatique multiple Microsoft"
"{ECD4FC4E-521C-11D0-B792-00A0C90312E1}"="Menu Site de bandes"
"{3CCF8A41-5C85-11d0-9796-00AA00B90ADF}"="Shell DeskBarApp"
"{ECD4FC4C-521C-11D0-B792-00A0C90312E1}"="Barre du Bureau"
"{ECD4FC4D-521C-11D0-B792-00A0C90312E1}"="Shell Rebar BandSite"
"{DD313E04-FEFF-11d1-8ECD-0000F87A470C}"="Assistance utilisateur"
"{EF8AD2D1-AE36-11D1-B2D2-006097DF8C11}"="ParamŠtres du dossier global"
"{EFA24E61-B078-11d0-89E4-00C04FC9E26E}"="Favorites Band"
"{0A89A860-D7B1-11CE-8350-444553540000}"="Shell Automation Inproc Service"
"{E7E4BC40-E76A-11CE-A9BB-00AA004AE837}"="Shell DocObject Viewer"
"{A5E46E3A-8849-11D1-9D8C-00C04FC99D61}"="Microsoft Browser Architecture"
"{FBF23B40-E3F0-101B-8488-00AA003E56F8}"="InternetShortcut"
"{3C374A40-BAE4-11CF-BF7D-00AA006946EE}"="Microsoft Url History Service"
"{FF393560-C2A7-11CF-BFF4-444553540000}"="Historique"
"{7BD29E00-76C1-11CF-9DD0-00A0C9034933}"="Temporary Internet Files"
"{7BD29E01-76C1-11CF-9DD0-00A0C9034933}"="Temporary Internet Files"
"{CFBFAE00-17A6-11D0-99CB-00C04FD64497}"="Microsoft Url Search Hook"
"{A2B0DD40-CC59-11d0-A3A5-00C04FD706EC}"="Image de d‚marrage de la Suite IE4"
"{67EA19A0-CCEF-11d0-8024-00C04FD75D13}"="CDF Extension Copy Hook"
"{131A6951-7F78-11D0-A979-00C04FD705A2}"="ISFBand OC"
"{9461b922-3c5a-11d2-bf8b-00c04fb93661}"="Search Assistant OC"
"{3DC7A020-0ACD-11CF-A9BB-00AA004AE837}"="Internet"
"{871C5380-42A0-1069-A2EA-08002B30309D}"="Internet Name Space"
"{EFA24E64-B078-11d0-89E4-00C04FC9E26E}"="Explorer Band"
"{9E56BE60-C50F-11CF-9A2C-00A0C90A90CE}"="Sendmail service"
"{9E56BE61-C50F-11CF-9A2C-00A0C90A90CE}"="Sendmail service"
"{88C6C381-2E85-11D0-94DE-444553540000}"="Dossier ActiveX Cache"
"{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"="WebCheck"
"{ABBE31D0-6DAE-11D0-BECA-00C04FD940BE}"="Subscription Mgr"
"{F5175861-2688-11d0-9C5E-00AA00A45957}"="Dossier Inscription"
"{08165EA0-E946-11CF-9C87-00AA005127ED}"="WebCheckWebCrawler"
"{E3A8BDE6-ABCE-11d0-BC4B-00C04FD929DB}"="WebCheckChannelAgent"
"{E8BB6DC0-6B4E-11d0-92DB-00A0C90C2BD7}"="TrayAgent"
"{7D559C10-9FE9-11d0-93F7-00AA0059CE02}"="Code Download Agent"
"{E6CC6978-6B6E-11D0-BECA-00C04FD940BE}"="ConnectionAgent"
"{D8BD2030-6FC9-11D0-864F-00AA006809D9}"="PostAgent"
"{7FC0B86E-5FA7-11d1-BC7C-00C04FD929DB}"="WebCheck SyncMgr Handler"
"{352EC2B7-8B9A-11D1-B8AE-006008059382}"="Gestionnaire d'applications d'environnement"
"{0B124F8F-91F0-11D1-B8B5-006008059382}"="num‚rateur d'applications install‚es"
"{CFCCC7A0-A282-11D1-9082-006008059382}"="Publication d'application Darwin"
"{e84fda7c-1d6a-45f6-b725-cb260c236066}"="Shell Image Verbs"
"{66e4e4fb-f385-4dd0-8d74-a2efd1bc6178}"="Shell Image Data Factory"
"{3F30C968-480A-4C6C-862D-EFC0897BB84B}"="Extracteur de miniatures de fichier + GDI"
"{9DBD2C50-62AD-11d0-B806-00C04FD706EC}"="Gestionnaire de miniatures - Informations de r‚sum‚ (DOCFILES)"
"{EAB841A0-9550-11cf-8C16-00805F1408F3}"="Extracteur de miniatures HTML"
"{eb9b1153-3b57-4e68-959a-a3266bc3d7fe}"="Shell Image Property Handler"
"{CC6EEFFB-43F6-46c5-9619-51D571967F7D}"="Assistant Publication de sites Web"
"{add36aa8-751a-4579-a266-d66f5202ccbb}"="Commande d'impressions via le Web"
"{6b33163c-76a5-4b6c-bf21-45de9cd503a1}"="Objet Assistant de publication Shell"
"{58f1f272-9240-4f51-b6d4-fd63d1618591}"="Assistant Obtenir une identit‚ Passport"
"{7A9D77BD-5403-11d2-8785-2E0420524153}"="Comptes d'utilisateurs"
"{E88DCCE0-B7B3-11d1-A9F0-00AA0060FA31}"="Dossier compress‚"
"{BD472F60-27FA-11cf-B8B4-444553540000}"="Compressed (zipped) Folder Right Drag Handler"
"{888DCA60-FC0A-11CF-8F0F-00C04FD7D062}"="Compressed (zipped) Folder SendTo Target"
"{63da6ec0-2e98-11cf-8d82-444553540000}"="FTP Folders Webview"
"{883373C3-BF89-11D1-BE35-080036B11A03}"="Microsoft DocProp Shell Ext"
"{A9CF0EAE-901A-4739-A481-E35B73E47F6D}"="Microsoft DocProp Inplace Edit Box Control"
"{8EE97210-FD1F-4B19-91DA-67914005F020}"="Microsoft DocProp Inplace ML Edit Box Control"
"{0EEA25CC-4362-4A12-850B-86EE61B0D3EB}"="Microsoft DocProp Inplace Droplist Combo Control"
"{6A205B57-2567-4A2C-B881-F787FAB579A3}"="Microsoft DocProp Inplace Calendar Control"
"{28F8A4AC-BBB3-4D9B-B177-82BFC914FA33}"="Microsoft DocProp Inplace Time Control"
"{8A23E65E-31C2-11d0-891C-00A024AB2DBB}"="Directory Query UI"
"{9E51E0D0-6E0F-11d2-9601-00C04FA31A86}"="Shell properties for a DS object"
"{163FDC20-2ABC-11d0-88F0-00A024AB2DBB}"="Directory Object Find"
"{F020E586-5264-11d1-A532-0000F8757D7E}"="Directory Start/Search Find"
"{0D45D530-764B-11d0-A1CA-00AA00C16E65}"="Directory Property UI"
"{62AE1F9A-126A-11D0-A14B-0800361B1103}"="Directory Context Menu Verbs"
"{ECF03A33-103D-11d2-854D-006008059367}"="MyDocs Copy Hook"
"{ECF03A32-103D-11d2-854D-006008059367}"="MyDocs Drop Target"
"{4a7ded0a-ad25-11d0-98a8-0800361b1103}"="MyDocs Properties"
"{750fdf0e-2a26-11d1-a3ea-080036587f03}"="Offline Files Menu"
"{10CFC467-4392-11d2-8DB4-00C04FA31A66}"="Offline Files Folder Options"
"{AFDB1F70-2A4C-11d2-9039-00C04F8EEB3E}"="Dossier Fichiers hors connexion"
"{143A62C8-C33B-11D1-84FE-00C04FA34A14}"="Microsoft Agent Character Property Sheet Handler"
"{ECCDF543-45CC-11CE-B9BF-0080C87CDBA6}"="DfsShell"
"{60fd46de-f830-4894-a628-6fa81bc0190d}"="%DESC_PublishDropTarget%"
"{7A80E4A8-8005-11D2-BCF8-00C04F72C717}"="MMC Icon Handler"
"{0CD7A5C0-9F37-11CE-AE65-08002B2E1262}"=".CAB file viewer"
"{32714800-2E5F-11d0-8B85-00AA0044F941}"="Des &personnes..."
"{8DD448E6-C188-4aed-AF92-44956194EB1F}"="Windows Media Player Play as Playlist Context Menu Handler"
"{CE3FB1D1-02AE-4a5f-A6E9-D9F1B4073E6C}"="Windows Media Player Burn Audio CD Context Menu Handler"
"{F1B9284F-E9DC-4e68-9D7E-42362A59F0FD}"="Windows Media Player Add to Playlist Context Menu Handler"
"{5a61f7a0-cde1-11cf-9113-00aa00425c62}"="IIS Shell Extension"
"{e57ce731-33e8-4c51-8354-bb4de9d215d1}"="P‚riph‚riques Plug and Play universels"
"{B5FB6487-7E79-4816-B73B-8A65E41971DA}"="BullGuard Antivirus v4"
"{D653647D-D607-4DF6-A5B8-48D2BA195F7B}"="BitDefender Antivirus v8"
"{EBDF1F20-C829-11D1-8233-FF20AF3E97A9}"="TrojanHunter Menu Shell Extension"
"{AB77609F-2178-4E6F-9C4B-44AC179D937A}"="aý Context Menu Shell Extension"
"{472083B0-C522-11CF-8763-00608CC02F24}"="avast"
"{E5AF72A6-2EFF-4967-B45E-8EE8E4D8A4FD}"=""
"{AACD3013-C200-406F-9ADE-793F7A63793A}"=""
"{87D1ED01-FD5E-43D1-B105-7CAF30E37453}"=""
"{B82FFA36-20D1-4790-AD69-71F6FFBAB01F}"=""
"{15B4E9C8-A50B-44B8-B8A7-63DF44A77117}"=""
"{1911C8CD-81B7-4E43-9A93-C9B225706686}"=""
"{AB211678-01E6-49E7-9E8A-6D30515E2DB6}"=""
"{E4408E0A-4C97-41E9-8CB6-961CCE3E47C7}"=""
"{f39a0dc0-9cc8-11d0-a599-00c04fd64433}"="Fichier de chaŒne"
"{f3aa0dc0-9cc8-11d0-a599-00c04fd64434}"="Raccourci de chaŒne"
"{f3ba0dc0-9cc8-11d0-a599-00c04fd64435}"="Channel Handler Object"
"{f3da0dc0-9cc8-11d0-a599-00c04fd64437}"="Channel Menu"
"{f3ea0dc0-9cc8-11d0-a599-00c04fd64438}"="Channel Properties"
"{B4C293B2-F2C0-45E0-8F65-EE7EAF5B4663}"=""
"{06E3B0B3-0BB5-497E-87C1-77074663E7A5}"=""
"{B344A36E-0057-4B57-8101-63AEA6C2EEFB}"=""
"{2559a1f7-21d7-11d4-bdaf-00c04f60b9f0}"="Set Program Access and Defaults"
"{596AB062-B4D2-4215-9F74-E9109B0A8153}"="Previous Versions Property Page"
"{9DB7A13C-F208-4981-8353-73CC61AE2783}"="Previous Versions"
"{692F0339-CBAA-47e6-B5B5-3B84DB604E87}"="Extensions Manager Folder"
"{640167b4-59b0-47a6-b335-a6b3c0695aea}"="Portable Media Devices"
"{cc86590a-b60a-48e6-996b-41d25ed39a1e}"="Portable Media Devices Menu"
"{D9468E5F-704E-42D7-B9DE-B38C11BB59A8}"=""
"{ED7AD8B8-8FBE-46EE-8846-CBFA587EF626}"=""
"{F255A864-F436-46B6-AD9D-898B63037098}"=""
"{4740AC10-6178-4C27-97BC-929A512F59B4}"=""
"{D5FC187F-7AEC-402C-9963-A4BBE6CE9ED1}"=""
"{EC539D8A-7656-4EDA-AC7C-9368116F18E7}"=""
"{D1706287-0D84-44D1-8639-0CED3D4623F8}"=""
"{E6AA094A-5168-4A4F-A416-746BFD17685D}"=""
"{CC09FA13-C440-47B8-B788-FB3DDBE17198}"=""

**********************************************************************************
HKEY ROOT CLASSIDS:
Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{AB211678-01E6-49E7-9E8A-6D30515E2DB6}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{AB211678-01E6-49E7-9E8A-6D30515E2DB6}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{AB211678-01E6-49E7-9E8A-6D30515E2DB6}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{AB211678-01E6-49E7-9E8A-6D30515E2DB6}\InprocServer32]
@="C:\\WINDOWS\\system32\\nztmsg.dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{06E3B0B3-0BB5-497E-87C1-77074663E7A5}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{06E3B0B3-0BB5-497E-87C1-77074663E7A5}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{06E3B0B3-0BB5-497E-87C1-77074663E7A5}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{06E3B0B3-0BB5-497E-87C1-77074663E7A5}\InprocServer32]
@="C:\\WINDOWS\\system32\\kxdno.dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{B344A36E-0057-4B57-8101-63AEA6C2EEFB}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{B344A36E-0057-4B57-8101-63AEA6C2EEFB}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{B344A36E-0057-4B57-8101-63AEA6C2EEFB}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{B344A36E-0057-4B57-8101-63AEA6C2EEFB}\InprocServer32]
@="C:\\WINDOWS\\system32\\nKl80e3ueh.dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{D9468E5F-704E-42D7-B9DE-B38C11BB59A8}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{D9468E5F-704E-42D7-B9DE-B38C11BB59A8}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{D9468E5F-704E-42D7-B9DE-B38C11BB59A8}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{D9468E5F-704E-42D7-B9DE-B38C11BB59A8}\InprocServer32]
@="C:\\WINDOWS\\system32\\wchfr.dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{ED7AD8B8-8FBE-46EE-8846-CBFA587EF626}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{ED7AD8B8-8FBE-46EE-8846-CBFA587EF626}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{ED7AD8B8-8FBE-46EE-8846-CBFA587EF626}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{ED7AD8B8-8FBE-46EE-8846-CBFA587EF626}\InprocServer32]
@="C:\\WINDOWS\\system32\\aficap.dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{F255A864-F436-46B6-AD9D-898B63037098}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{F255A864-F436-46B6-AD9D-898B63037098}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{F255A864-F436-46B6-AD9D-898B63037098}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{F255A864-F436-46B6-AD9D-898B63037098}\InprocServer32]
@="C:\\WINDOWS\\system32\\bpowser.dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{4740AC10-6178-4C27-97BC-929A512F59B4}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{4740AC10-6178-4C27-97BC-929A512F59B4}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{4740AC10-6178-4C27-97BC-929A512F59B4}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{4740AC10-6178-4C27-97BC-929A512F59B4}\InprocServer32]
@="C:\\WINDOWS\\system32\\guard.tmp"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{D5FC187F-7AEC-402C-9963-A4BBE6CE9ED1}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{D5FC187F-7AEC-402C-9963-A4BBE6CE9ED1}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{D5FC187F-7AEC-402C-9963-A4BBE6CE9ED1}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{D5FC187F-7AEC-402C-9963-A4BBE6CE9ED1}\InprocServer32]
@="C:\\WINDOWS\\system32\\aestream.dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{EC539D8A-7656-4EDA-AC7C-9368116F18E7}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{EC539D8A-7656-4EDA-AC7C-9368116F18E7}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{EC539D8A-7656-4EDA-AC7C-9368116F18E7}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{EC539D8A-7656-4EDA-AC7C-9368116F18E7}\InprocServer32]
@="C:\\WINDOWS\\system32\\ulp10.dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{D1706287-0D84-44D1-8639-0CED3D4623F8}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{D1706287-0D84-44D1-8639-0CED3D4623F8}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{D1706287-0D84-44D1-8639-0CED3D4623F8}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{D1706287-0D84-44D1-8639-0CED3D4623F8}\InprocServer32]
@="C:\\WINDOWS\\system32\\guard.tmp"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{E6AA094A-5168-4A4F-A416-746BFD17685D}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{E6AA094A-5168-4A4F-A416-746BFD17685D}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{E6AA094A-5168-4A4F-A416-746BFD17685D}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{E6AA094A-5168-4A4F-A416-746BFD17685D}\InprocServer32]
@="C:\\WINDOWS\\system32\\guard.tmp"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{CC09FA13-C440-47B8-B788-FB3DDBE17198}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{CC09FA13-C440-47B8-B788-FB3DDBE17198}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{CC09FA13-C440-47B8-B788-FB3DDBE17198}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{CC09FA13-C440-47B8-B788-FB3DDBE17198}\InprocServer32]
@="C:\\WINDOWS\\system32\\guard.tmp"
"ThreadingModel"="Apartment"

**********************************************************************************
Files Found are not all bad files:

C:\WINDOWS\SYSTEM32\
abllj.dll Wed 29 Dec 2004 14:03:30 A.... 0 0,00 K
addfd3~1.dll Thu 30 Dec 2004 14:03:38 A.... 89 088 87,00 K
addgy3~1.dll Sat 25 Dec 2004 9:39:14 A.... 89 088 87,00 K
addgy~1.dll Fri 10 Dec 2004 11:32:18 A.... 89 088 87,00 K
addil.dll Thu 30 Dec 2004 1:24:16 ..... 89 088 87,00 K
addil~1.dll Wed 22 Dec 2004 21:39:02 A.... 89 088 87,00 K
addnl~1.dll Thu 16 Dec 2004 15:36:30 A.... 89 088 87,00 K
addwz3~1.dll Wed 22 Dec 2004 23:48:36 A.... 89 088 87,00 K
addzv3~1.dll Wed 29 Dec 2004 22:54:24 A.... 89 088 87,00 K
aestream.dll Sat 22 Jan 2005 15:28:36 A.... 222 989 217,76 K
ajpmgr.dll Wed 19 Jan 2005 18:07:42 A.... 56 0,05 K
akcore.dll Sun 2 Jan 2005 17:47:32 A.... 188 416 184,00 K
akrules.dll Sun 2 Jan 2005 17:47:34 A.... 110 592 108,00 K
akupd.dll Wed 19 Jan 2005 21:12:52 A.... 155 648 152,00 K
amsldp.dll Thu 20 Jan 2005 12:55:18 ..... 56 0,05 K
anxkp.dll Fri 10 Dec 2004 22:32:06 A.... 0 0,00 K
aoeem.dll Mon 27 Dec 2004 20:31:02 A.... 0 0,00 K
apicj3~1.dll Sat 11 Dec 2004 11:38:34 A.... 89 088 87,00 K
apidu3~1.dll Wed 22 Dec 2004 11:33:50 A.... 89 088 87,00 K
apihx3~1.dll Thu 9 Dec 2004 16:00:02 A.... 89 088 87,00 K
apimg~1.dll Mon 27 Dec 2004 10:05:52 A.... 89 088 87,00 K
apina3~1.dll Sun 2 Jan 2005 21:31:58 A.... 89 088 87,00 K
apisb~1.dll Thu 16 Dec 2004 9:16:44 A.... 89 088 87,00 K
apisl3~1.dll Sun 26 Dec 2004 6:20:00 A.... 89 088 87,00 K
apitv~1.dll Sun 26 Dec 2004 8:49:56 A.... 89 088 87,00 K
appez3~1.dll Wed 29 Dec 2004 12:18:08 A.... 89 088 87,00 K
appsp3~1.dll Mon 20 Dec 2004 4:01:22 A.... 89 088 87,00 K
appvt~1.dll Wed 22 Dec 2004 7:12:26 A.... 89 088 87,00 K
appww32.dll Tue 21 Dec 2004 13:27:24 A.... 89 088 87,00 K
appyw3~1.dll Mon 20 Dec 2004 16:06:38 A.... 89 088 87,00 K
appzq.dll Wed 22 Dec 2004 22:31:46 A.... 89 088 87,00 K
atcir.dll Sun 26 Dec 2004 9:37:24 A.... 0 0,00 K
atlcw3~1.dll Fri 24 Dec 2004 18:05:54 A.... 89 088 87,00 K
atldw~1.dll Wed 29 Dec 2004 20:25:56 A.... 89 088 87,00 K
atllf3~1.dll Fri 31 Dec 2004 22:45:02 A.... 89 088 87,00 K
atlsm.dll Sun 19 Dec 2004 19:22:58 A.... 89 088 87,00 K
atluk3~1.dll Thu 16 Dec 2004 15:05:06 A.... 89 088 87,00 K
atlyg~1.dll Fri 24 Dec 2004 7:43:48 A.... 89 088 87,00 K
atoda.dll Wed 5 Jan 2005 0:28:10 A.... 0 0,00 K
awphelp.dll Thu 6 Jan 2005 17:54:32 ..... 224 922 219,65 K
ayxh~1.dll Wed 22 Dec 2004 20:19:06 A.... 172 032 168,00 K
azaola~1.dll Thu 20 Jan 2005 13:14:00 A.... 56 0,05 K
blowselc.dll Thu 20 Jan 2005 13:18:28 A.... 56 0,05 K
bmfsk.dll Mon 3 Jan 2005 7:45:54 A.... 0 0,00 K
bpowser.dll Sat 22 Jan 2005 15:12:18 A.... 222 665 217,45 K
bxvhb.dll Sat 25 Dec 2004 11:57:16 A.... 0 0,00 K
cadqj.dll Sat 1 Jan 2005 10:18:00 A.... 0 0,00 K
crac32~1.dll Fri 17 Dec 2004 3:13:00 A.... 89 088 87,00 K
craf~1.dll Tue 28 Dec 2004 3:10:50 A.... 89 088 87,00 K
crbb~1.dll Fri 31 Dec 2004 4:10:00 A.... 89 088 87,00 K
criz~1.dll Sat 25 Dec 2004 8:23:08 A.... 89 088 87,00 K
crkz32~1.dll Sat 4 Dec 2004 17:22:52 A.... 89 088 87,00 K
crmy32~1.dll Fri 10 Dec 2004 16:52:10 A.... 89 088 87,00 K
crmz~1.dll Mon 27 Dec 2004 8:23:48 A.... 89 088 87,00 K
crpo~1.dll Sat 4 Dec 2004 11:54:10 A.... 89 088 87,00 K
crsetacl.dll Tue 25 Jan 2005 8:18:42 ..... 223 566 218,32 K
d3daid64.dll Wed 29 Dec 2004 18:00:50 A.... 0 0,00 K
d3dxov.dll Thu 28 Oct 2004 16:21:04 A.... 10 752 10,50 K
d3eg~1.dll Tue 28 Dec 2004 17:22:28 A.... 89 088 87,00 K
d3lw.dll Mon 6 Dec 2004 4:39:46 A.... 89 088 87,00 K
d3lx.dll Sat 1 Jan 2005 15:25:14 A.... 89 088 87,00 K
d3qn~1.dll Tue 28 Dec 2004 17:23:44 A.... 89 088 87,00 K
d3sf.dll Mon 20 Dec 2004 7:37:28 A.... 89 088 87,00 K
d3sm~1.dll Sat 25 Dec 2004 13:05:50 A.... 89 088 87,00 K
damrtp.dll Thu 20 Jan 2005 13:23:24 A.... 56 0,05 K
ddskmon.dll Thu 20 Jan 2005 13:29:48 A.... 56 0,05 K
diniq.dll Thu 30 Dec 2004 19:47:24 A.... 0 0,00 K
dldrm.dll Thu 20 Jan 2005 14:55:42 A.... 56 0,05 K
dlsf.dll Thu 20 Jan 2005 15:00:02 A.... 56 0,05 K
doknh.dll Sat 25 Dec 2004 18:38:48 A.... 0 0,00 K
dquiext.dll Sat 22 Jan 2005 19:34:16 A.... 56 0,05 K
drnaddr.dll Thu 20 Jan 2005 15:08:58 A.... 56 0,05 K
dsrrb.dll Sun 12 Dec 2004 3:57:32 A.... 0 0,00 K
dsserver.dll Fri 21 Jan 2005 17:26:02 A.... 56 0,05 K
dtgaz.dll Sun 12 Dec 2004 3:03:20 A.... 0 0,00 K
dywsockx.dll Thu 20 Jan 2005 15:18:00 A.... 56 0,05 K
e6202g~1.dll Thu 20 Jan 2005 15:22:18 A.... 56 0,05 K
en0ul1~1.dll Thu 20 Jan 2005 15:26:36 A.... 56 0,05 K
en86l1~1.dll Thu 20 Jan 2005 15:30:34 A.... 56 0,05 K
en88l1~1.dll Tue 25 Jan 2005 14:42:34 ..... 223 018 217,79 K
enjql1~1.dll Fri 21 Jan 2005 17:00:28 A.... 56 0,05 K
enn2l1~1.dll Thu 20 Jan 2005 15:39:06 A.... 56 0,05 K
enn4l1~1.dll Thu 20 Jan 2005 15:43:12 A.... 56 0,05 K
enp6l1~1.dll Thu 20 Jan 2005 15:58:02 A.... 56 0,05 K
eqjzl.dll Sun 2 Jan 2005 0:32:36 A.... 0 0,00 K
f40o0e~1.dll Thu 20 Jan 2005 16:02:20 A.... 56 0,05 K
f4l00e~1.dll Thu 20 Jan 2005 16:06:16 A.... 56 0,05 K
ffgqr.dll Sat 11 Dec 2004 20:43:18 A.... 0 0,00 K
fh20fra.dll Thu 20 Jan 2005 16:10:06 A.... 56 0,05 K
fn0021~1.dll Thu 20 Jan 2005 16:14:14 A.... 56 0,05 K
fp0203~1.dll Fri 21 Jan 2005 18:59:00 A.... 56 0,05 K
fpn003~1.dll Thu 20 Jan 2005 16:18:40 A.... 56 0,05 K
frdku.dll Fri 24 Dec 2004 15:48:14 A.... 0 0,00 K
freny.dll Tue 4 Jan 2005 20:11:16 A.... 0 0,00 K
hdrek.dll Sat 1 Jan 2005 9:34:02 A.... 0 0,00 K
hfdop.dll Tue 21 Dec 2004 1:34:00 A.... 0 0,00 K
hnrek.dll Tue 25 Jan 2005 8:11:44 ..... 223 018 217,79 K
hxpyn.dll Wed 29 Dec 2004 3:10:34 A.... 0 0,00 K
hypertrm.dll Wed 17 Nov 2004 18:42:34 A.... 354 304 346,00 K
ieem~1.dll Sun 2 Jan 2005 16:05:26 A.... 89 088 87,00 K
iekq32~1.dll Sat 18 Dec 2004 15:40:02 A.... 89 088 87,00 K
ieof.dll Fri 31 Dec 2004 8:07:36 A.... 89 088 87,00 K
ierr~1.dll Sun 19 Dec 2004 3:40:54 A.... 89 088 87,00 K
iesp1.dll Mon 24 Jan 2005 12:31:56 A.... 51 712 50,50 K
ietr~1.dll Sun 2 Jan 2005 3:43:24 A.... 89 088 87,00 K
ieyr32~1.dll Wed 29 Dec 2004 8:14:24 A.... 89 088 87,00 K
ihqcs.dll Tue 21 Dec 2004 14:49:32 A.... 0 0,00 K
ihxrtmgr.dll Sat 22 Jan 2005 19:39:02 A.... 56 0,05 K
ikssuba.dll Thu 20 Jan 2005 16:22:44 A.... 56 0,05 K
ioshlpr.dll Thu 20 Jan 2005 16:27:28 A.... 56 0,05 K
ipbj32~1.dll Tue 28 Dec 2004 4:05:40 A.... 89 088 87,00 K
ipca~1.dll Sat 11 Dec 2004 17:09:32 A.... 89 088 87,00 K
ipeb~1.dll Fri 31 Dec 2004 18:00:54 A.... 89 088 87,00 K
ipgf.dll Mon 27 Dec 2004 3:10:08 A.... 89 088 87,00 K
ipnb~1.dll Sat 25 Dec 2004 20:29:24 A.... 89 088 87,00 K
ipuf32~1.dll Mon 13 Dec 2004 10:54:00 A.... 89 088 87,00 K
ipwa32~1.dll Thu 9 Dec 2004 2:55:52 A.... 89 088 87,00 K
ipyg32~1.dll Mon 3 Jan 2005 17:11:42 A.... 89 088 87,00 K
ipyv32.dll Tue 4 Jan 2005 8:13:12 A.... 89 088 87,00 K
ir06l5~1.dll Sat 22 Jan 2005 21:44:18 ..... 225 660 220,37 K
ir64l5~1.dll Mon 24 Jan 2005 12:02:46 ..... 225 360 220,08 K
ir80l5~1.dll Fri 21 Jan 2005 17:04:24 A.... 56 0,05 K
irj0l5~1.dll Thu 20 Jan 2005 15:05:14 A.... 222 715 217,49 K
irjml5~1.dll Sat 22 Jan 2005 19:43:06 A.... 56 0,05 K
irl0l5~1.dll Thu 20 Jan 2005 17:02:44 A.... 56 0,05 K
irp0l5~1.dll Thu 20 Jan 2005 17:06:54 A.... 56 0,05 K
japrx.dll Mon 27 Dec 2004 21:18:46 A.... 0 0,00 K
javaab32.dll Mon 6 Dec 2004 5:37:56 A.... 89 088 87,00 K
javaci~1.dll Sun 2 Jan 2005 11:49:28 A.... 89 088 87,00 K
javain~1.dll Mon 20 Dec 2004 18:33:30 A.... 89 088 87,00 K
javamn.dll Tue 7 Dec 2004 17:14:44 A.... 89 088 87,00 K
javanf32.dll Fri 24 Dec 2004 3:38:50 A.... 89 088 87,00 K
javawk~1.dll Sat 8 Jan 2005 20:04:58 A.... 89 088 87,00 K
javayt~1.dll Sun 26 Dec 2004 2:46:38 A.... 89 088 87,00 K
jceaw.dll Sun 26 Dec 2004 7:03:32 A.... 0 0,00 K
jqvain~1.dll Thu 20 Jan 2005 17:15:42 A.... 56 0,05 K
jsyst.dll Wed 22 Dec 2004 3:47:00 A.... 0 0,00 K
jxproxy.dll Fri 21 Jan 2005 17:08:12 A.... 56 0,05 K
kfdes.dll Fri 21 Jan 2005 9:38:10 A.... 56 0,05 K
kfdlt1.dll Fri 21 Jan 2005 9:43:16 A.... 56 0,05 K
kmwxf.dll Tue 4 Jan 2005 19:11:14 A.... 0 0,00 K
kptbx.dll Sun 26 Dec 2004 1:57:54 A.... 0 0,00 K
kridi.dll Sun 26 Dec 2004 22:39:40 A.... 0 0,00 K
ktghu.dll Mon 3 Jan 2005 4:33:26 A.... 0 0,00 K
kvwim.dll Mon 13 Dec 2004 6:52:58 A.... 0 0,00 K
kxdno.dll Tue 11 Jan 2005 14:07:32 A.... 224 839 219,57 K
l0n4la~1.dll Tue 25 Jan 2005 14:51:30 ..... 224 468 219,21 K
ljtmd.dll Wed 8 Dec 2004 5:51:30 A.... 0 0,00 K
lsasrv.dll Thu 28 Oct 2004 2:24:00 A.... 728 576 711,50 K
lv0809~1.dll Fri 21 Jan 2005 9:47:24 A.... 56 0,05 K
lv0s09~1.dll Mon 24 Jan 2005 16:38:02 ..... 222 562 217,34 K
lv2409~1.dll Sat 22 Jan 2005 19:48:22 A.... 56 0,05 K
lv2609~1.dll Fri 21 Jan 2005 9:51:22 A.... 56 0,05 K
lvlq09~1.dll Fri 21 Jan 2005 9:56:34 A.... 56 0,05 K
lvnm09~1.dll Fri 21 Jan 2005 10:06:46 A.... 56 0,05 K
lvns09~1.dll Sun 23 Jan 2005 16:40:44 ..... 222 845 217,62 K
m0pola~1.dll Fri 21 Jan 2005 10:12:22 A.... 56 0,05 K
m4460e~1.dll Fri 21 Jan 2005 10:16:20 A.... 56 0,05 K
m4640e~1.dll Fri 21 Jan 2005 10:22:26 A.... 56 0,05 K
m4rm0e~1.dll Fri 21 Jan 2005 10:26:36 A.... 56 0,05 K
mfcbp3~1.dll Thu 23 Dec 2004 22:18:10 A.... 89 088 87,00 K
mfcdu~1.dll Wed 15 Dec 2004 20:47:04 A.... 89 088 87,00 K
mfclu3~1.dll Fri 24 Dec 2004 1:41:06 A.... 89 088 87,00 K
mfcrw~1.dll Thu 16 Dec 2004 6:53:10 A.... 89 088 87,00 K
mfcud3~1.dll Fri 24 Dec 2004 17:43:30 A.... 89 088 87,00 K
mfcwv3~1.dll Thu 30 Dec 2004 12:50:10 A.... 89 088 87,00 K
mfcyk3~1.dll Sat 25 Dec 2004 18:58:08 A.... 89 088 87,00 K
mhl_hp.dll Fri 21 Jan 2005 10:30:42 A.... 56 0,05 K
mjftsui2.dll Fri 21 Jan 2005 10:35:14 A.... 56 0,05 K
mkv1_0.dll Fri 21 Jan 2005 10:39:14 A.... 56 0,05 K
mscu~1.dll Sun 2 Jan 2005 11:40:52 A.... 89 088 87,00 K
msdj32~1.dll Wed 8 Dec 2004 4:30:12 A.... 89 088 87,00 K
mseggr~1.dll Fri 19 Nov 2004 10:17:50 A.... 8 0,01 K
mssa32~1.dll Mon 6 Dec 2004 11:01:44 A.... 89 088 87,00 K
msyy32~1.dll Sun 2 Jan 2005 4:20:36 A.... 89 088 87,00 K
mvctfp.dll Tue 25 Jan 2005 7:57:02 ..... 225 716 220,43 K
mzlbui.dll Fri 21 Jan 2005 10:44:06 A.... 56 0,05 K
n4l80e~1.dll Fri 21 Jan 2005 10:48:10 A.... 56 0,05 K
n4p40e~1.dll Fri 21 Jan 2005 10:53:16 A.... 56 0,05 K
naptools.dll Fri 21 Jan 2005 10:57:38 A.... 56 0,05 K
netee~1.dll Tue 21 Dec 2004 21:30:48 A.... 89 088 87,00 K
netjh3~1.dll Wed 8 Dec 2004 17:33:54 A.... 89 088 87,00 K
netjk3~1.dll Wed 15 Dec 2004 7:14:08 A.... 89 088 87,00 K
netks32.dll Fri 31 Dec 2004 1:27:08 A.... 89 088 87,00 K
netow3~1.dll Sun 26 Dec 2004 5:54:30 A.... 89 088 87,00 K
netqb~1.dll Wed 22 Dec 2004 14:41:02 A.... 89 088 87,00 K
netvp~1.dll Sat 18 Dec 2004 23:55:22 A.... 89 088 87,00 K
netvr.dll Fri 21 Jan 2005 11:02:50 A.... 56 0,05 K
nkl80e~1.dll Fri 21 Jan 2005 11:57:28 A.... 224 712 219,45 K
nmqev.dll Sat 18 Dec 2004 8:11:04 A.... 0 0,00 K
nqahj.dll Wed 5 Jan 2005 1:57:34 A.... 0 0,00 K
nqjob.dll Wed 29 Dec 2004 16:34:18 A.... 0 0,00 K
ntbi32~1.dll Fri 24 Dec 2004 10:25:38 A.... 89 088 87,00 K
ntej32.dll Sat 25 Dec 2004 14:44:52 A.... 89 088 87,00 K
ntej32~1.dll Sat 25 Dec 2004 14:44:52 A.... 89 088 87,00 K
ntfh~1.dll Mon 20 Dec 2004 22:11:36 A.... 89 088 87,00 K
ntqr32~1.dll Mon 27 Dec 2004 19:30:32 A.... 89 088 87,00 K
ntuz32~1.dll Sat 25 Dec 2004 13:24:02 A.... 89 088 87,00 K
ntxp32~1.dll Sat 18 Dec 2004 13:31:20 A.... 89 088 87,00 K
nztmsg.dll Thu 6 Jan 2005 9:53:40 A.... 224 922 219,65 K
o084la~1.dll Tue 25 Jan 2005 9:46:20 ..... 224 498 219,23 K
obdkh.dll Wed 22 Dec 2004 4:13:20 A.... 0 0,00 K
oetwp.dll Sun 26 Dec 2004 6:19:34 A.... 0 0,00 K
p48q0e~1.dll Fri 7 Jan 2005 16:00:16 A.... 225 376 220,09 K
paofmap.dll Fri 21 Jan 2005 11:06:48 A.... 56 0,05 K
pbycj.dll Fri 17 Dec 2004 0:14:48 A.... 0 0,00 K
pqd.dll Fri 21 Jan 2005 11:11:48 A.... 56 0,05 K
protec~1.dll Mon 24 Jan 2005 18:34:08 A.... 36 864 36,00 K
ptdop.dll Sat 11 Dec 2004 12:36:28 A.... 0 0,00 K
pwfok.dll Thu 6 Jan 2005 9:21:04 A.... 0 0,00 K
q4rq0e~1.dll Wed 12 Jan 2005 9:21:40 ..... 224 839 219,57 K
q686lg~1.dll Mon 24 Jan 2005 15:30:24 ..... 223 051 217,82 K
qsaxl.dll Mon 13 Dec 2004 2:08:46 A.... 0 0,00 K
r4r60e~1.dll Fri 21 Jan 2005 11:15:44 A.... 56 0,05 K
ricrt4.dll Tue 25 Jan 2005 8:24:18 ..... 223 018 217,79 K
rmsrad.dll Wed 5 Jan 2005 8:42:38 A.... 225 112 219,84 K
rpbfq.dll Thu 23 Dec 2004 3:52:30 A.... 0 0,00 K
rupdd.dll Fri 21 Jan 2005 11:19:46 A.... 56 0,05 K
s0pu0a~1.dll Fri 21 Jan 2005 11:38:46 A.... 56 0,05 K
sdkgj3~1.dll Thu 30 Dec 2004 12:35:02 A.... 89 088 87,00 K
sdkiy~1.dll Wed 29 Dec 2004 11:10:14 A.... 89 088 87,00 K
sdkms~1.dll Sun 2 Jan 2005 23:41:52 A.... 89 088 87,00 K
sdknq3~1.dll Tue 7 Dec 2004 20:10:44 A.... 89 088 87,00 K
sdknu3~1.dll Fri 17 Dec 2004 0:24:56 A.... 89 088 87,00 K
sdksc~1.dll Sun 2 Jan 2005 4:13:46 A.... 89 088 87,00 K
sdkvy32.dll Sun 9 Jan 2005 10:24:06 A.... 89 088 87,00 K
sdns.dll Fri 21 Jan 2005 11:43:32 A.... 56 0,05 K
sgknu3~1.dll Fri 21 Jan 2005 11:49:08 A.... 56 0,05 K
skrng.dll Thu 30 Dec 2004 8:36:00 A.... 0 0,00 K
slzgv.dll Sat 11 Dec 2004 1:22:00 A.... 0 0,00 K
soksc~1.dll Fri 21 Jan 2005 11:55:20 A.... 56 0,05 K
sorng.dll Fri 21 Jan 2005 11:59:34 A.... 56 0,05 K
sporder.dll Sun 2 Jan 2005 17:47:34 A.... 8 464 8,27 K
ssmlib.dll Fri 21 Jan 2005 12:03:38 A.... 56 0,05 K
svgzd.dll Sun 26 Dec 2004 9:01:36 A.... 0 0,00 K
svsme.dll Tue 4 Jan 2005 23:45:12 A.... 0 0,00 K
sxznp.dll Thu 23 Dec 2004 19:12:32 A.... 0 0,00 K
sysua3~1.dll Mon 6 Dec 2004 9:00:48 A.... 89 088 87,00 K
syswv3~1.dll Sat 25 Dec 2004 21:18:44 A.... 89 088 87,00 K
syszt3~1.dll Mon 13 Dec 2004 4:51:18 A.... 89 088 87,00 K
syszv3~1.dll Wed 8 Dec 2004 8:07:42 A.... 89 088 87,00 K
tpaob.dll Tue 21 Dec 2004 3:05:44 A.... 0 0,00 K
tuxln.dll Sun 26 Dec 2004 1:35:22 A.... 0 0,00 K
uaat.dll Fri 21 Jan 2005 12:08:02 A.... 56 0,05 K
uhrv42a.dll Fri 21 Jan 2005 17:16:02 A.... 56 0,05 K
ulp10.dll Sat 22 Jan 2005 16:17:06 A.... 223 985 218,73 K
upxww.dll Wed 22 Dec 2004 16:38:04 A.... 0 0,00 K
uryan.dll Tue 28 Dec 2004 8:59:32 A.... 0 0,00 K
uyoei.dll Tue 28 Dec 2004 10:09:50 A.... 0 0,00 K
w95inf16.dll Sat 1 Jan 2005 18:32:10 A.... 2 272 2,22 K
w95inf32.dll Sat 1 Jan 2005 18:32:10 A.... 4 608 4,50 K
wcydnp~1.dll Wed 22 Dec 2004 20:20:56 A.... 172 032 168,00 K
wdwfk.dll Thu 9 Dec 2004 12:27:16 A.... 0 0,00 K
winaq~1.dll Mon 13 Dec 2004 7:19:26 A.... 89 088 87,00 K
wincw~1.dll Mon 6 Dec 2004 1:15:12 A.... 89 088 87,00 K
winee3~1.dll Mon 20 Dec 2004 13:29:32 A.... 89 088 87,00 K
winoz3~1.dll Fri 31 Dec 2004 10:47:46 A.... 89 088 87,00 K
wins32t.dll Tue 14 Dec 2004 10:09:02 A.... 9 216 9,00 K
winsrv32.dll Thu 28 Oct 2004 16:21:04 A.... 27 648 27,00 K
winti3~1.dll Fri 17 Dec 2004 6:10:54 A.... 89 088 87,00 K
winue3~1.dll Sat 1 Jan 2005 23:28:38 A.... 89 088 87,00 K
winvu3~1.dll Mon 20 Dec 2004 18:27:20 A.... 89 088 87,00 K
wpbclnt.dll Fri 21 Jan 2005 17:30:38 A.... 56 0,05 K
wtwfu.dll Thu 16 Dec 2004 14:48:10 A.... 0 0,00 K
wwbclnt.dll Fri 21 Jan 2005 12:16:08 A.... 56 0,05 K
xiboa.dll Sun 12 Dec 2004 12:25:52 A.... 0 0,00 K
xzxnu.dll Tue 21 Dec 2004 4:30:22 A.... 0 0,00 K
yvesz.dll Sat 18 Dec 2004 15:56:24 A.... 0 0,00 K
zhzgz.dll Wed 15 Dec 2004 23:33:32 A.... 0 0,00 K
zoxza.dll Thu 23 Dec 2004 9:38:46 A.... 0 0,00 K
zsctq.dll Mon 3 Jan 2005 18:49:04 A.... 0 0,00 K

271 items found: 271 files, 0 directories.
Total of file sizes: 16 723 168 bytes 15,95 M
Locate .tmp files:

C:\WINDOWS\SYSTEM32\
guard.tmp Tue 25 Jan 2005 16:42:32 ..... 223 018 217,79 K

1 item found: 1 file, 0 directories.
Total of file sizes: 223 018 bytes 217,79 K
**********************************************************************************
Directory Listing of system files:
Le volume dans le lecteur C n'a pas de nom.
Le num‚ro de s‚rie du volume est B8C6-562C

R‚pertoire de C:\WINDOWS\System32

23/01/2005 15:56 <REP> dllcache
31/12/2004 11:51 10ÿ398 sdkkf.exe
26/12/2004 00:04 10ÿ553 appto.exe
22/12/2004 20:21 389ÿ120 d?dplay.exe
07/03/2004 16:13 <REP> Microsoft
3 fichier(s) 410ÿ071 octets
2 R‚p(s) 2ÿ416ÿ558ÿ080 octets libres

voila S!RI,

L2Mfix 1.02

Running From:
C:\Documents and Settings\klum\Bureau\l2mfix



RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
Copyright (c) 1999-2001 Frank Heyne Software (http://www.heysoft.de)
This program is Freeware, use it on your own risk!

Access Control List for Registry key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify:
(CI) DENY --C------- Tout le monde
(ID-NI) ALLOW Read BUILTIN\Utilisateurs
(ID-IO) ALLOW Read BUILTIN\Utilisateurs
(ID-NI) ALLOW Read BUILTIN\Utilisateurs avec pouvoir
(ID-IO) ALLOW Read BUILTIN\Utilisateurs avec pouvoir
(ID-NI) ALLOW Full access BUILTIN\Administrateurs
(ID-IO) ALLOW Full access BUILTIN\Administrateurs
(ID-NI) ALLOW Full access AUTORITE NT\SYSTEM
(ID-IO) ALLOW Full access AUTORITE NT\SYSTEM
(ID-IO) ALLOW Full access CREATEUR PROPRIETAIRE



Setting registry permissions:


RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
Copyright (c) 1999-2001 Frank Heyne Software (http://www.heysoft.de)
This program is Freeware, use it on your own risk!


Denying C access for really "Everyone"
- adding new ACCESS DENY entry
- removing existing ACCESS DENY entry


Registry Permissions set too:

RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
Copyright (c) 1999-2001 Frank Heyne Software (http://www.heysoft.de)
This program is Freeware, use it on your own risk!

Access Control List for Registry key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify:
(CI) DENY --C------- Tout le monde
(ID-NI) ALLOW Read BUILTIN\Utilisateurs
(ID-IO) ALLOW Read BUILTIN\Utilisateurs
(ID-NI) ALLOW Read BUILTIN\Utilisateurs avec pouvoir
(ID-IO) ALLOW Read BUILTIN\Utilisateurs avec pouvoir
(ID-NI) ALLOW Full access BUILTIN\Administrateurs
(ID-IO) ALLOW Full access BUILTIN\Administrateurs
(ID-NI) ALLOW Full access AUTORITE NT\SYSTEM
(ID-IO) ALLOW Full access AUTORITE NT\SYSTEM
(ID-IO) ALLOW Full access CREATEUR PROPRIETAIRE



Setting up for Reboot


Starting Reboot!

C:\Documents and Settings\klum\Bureau\l2mfix
System Rebooted!

Running From:
C:\Documents and Settings\klum\Bureau\l2mfix

killing explorer and rundll32.exe

Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
Copyright(C) 2002-2003 Craig.Peacock@beyondlogic.org
Killing PID 1636 'explorer.exe'
Killing PID 1636 'explorer.exe'

Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
Copyright(C) 2002-2003 Craig.Peacock@beyondlogic.org
Killing PID 1788 'rundll32.exe'

Scanning First Pass. Please Wait!

First Pass Completed

Second Pass Scanning

Second pass Completed!
Backing Up: C:\WINDOWS\system32\aestream.dll
1 fichier(s) copi‚(s).
Backing Up: C:\WINDOWS\system32\awphelp.dll
1 fichier(s) copi‚(s).
Backing Up: C:\WINDOWS\system32\bpowser.dll
1 fichier(s) copi‚(s).
Backing Up: C:\WINDOWS\system32\ir06l5ds1.dll
1 fichier(s) copi‚(s).
Backing Up: C:\WINDOWS\system32\ir64l5jq1.dll
1 fichier(s) copi‚(s).
Backing Up: C:\WINDOWS\system32\irj0l51m1.dll
1 fichier(s) copi‚(s).
Backing Up: C:\WINDOWS\system32\kxdno.dll
1 fichier(s) copi‚(s).
Backing Up: C:\WINDOWS\system32\l0n4la5q1d.dll
1 fichier(s) copi‚(s).
Backing Up: C:\WINDOWS\system32\lv0s09d7e.dll
1 fichier(s) copi‚(s).
Backing Up: C:\WINDOWS\system32\lvns0957e.dll
1 fichier(s) copi‚(s).
Backing Up: C:\WINDOWS\system32\mvctfp.dll
1 fichier(s) copi‚(s).
Backing Up: C:\WINDOWS\system32\nKl80e3ueh.dll
1 fichier(s) copi‚(s).
Backing Up: C:\WINDOWS\system32\nztmsg.dll
1 fichier(s) copi‚(s).
Backing Up: C:\WINDOWS\system32\o084lalq1dqe.dll
1 fichier(s) copi‚(s).
Backing Up: C:\WINDOWS\system32\p48q0el5ehq.dll
1 fichier(s) copi‚(s).
Backing Up: C:\WINDOWS\system32\q4rq0e95eh.dll
1 fichier(s) copi‚(s).
Backing Up: C:\WINDOWS\system32\q686lgls16q6.dll
1 fichier(s) copi‚(s).
Backing Up: C:\WINDOWS\system32\rMsrad.dll
1 fichier(s) copi‚(s).
Backing Up: C:\WINDOWS\system32\ulp10.dll
1 fichier(s) copi‚(s).
Backing Up: C:\WINDOWS\system32\vzajet32.dll
1 fichier(s) copi‚(s).
Backing Up: C:\WINDOWS\system32\guard.tmp
1 fichier(s) copi‚(s).
deleting: C:\WINDOWS\system32\aestream.dll
Successfully Deleted: C:\WINDOWS\system32\aestream.dll
deleting: C:\WINDOWS\system32\awphelp.dll
Successfully Deleted: C:\WINDOWS\system32\awphelp.dll
deleting: C:\WINDOWS\system32\bpowser.dll
Successfully Deleted: C:\WINDOWS\system32\bpowser.dll
deleting: C:\WINDOWS\system32\ir06l5ds1.dll
Successfully Deleted: C:\WINDOWS\system32\ir06l5ds1.dll
deleting: C:\WINDOWS\system32\ir64l5jq1.dll
Successfully Deleted: C:\WINDOWS\system32\ir64l5jq1.dll
deleting: C:\WINDOWS\system32\irj0l51m1.dll
Successfully Deleted: C:\WINDOWS\system32\irj0l51m1.dll
deleting: C:\WINDOWS\system32\kxdno.dll
Successfully Deleted: C:\WINDOWS\system32\kxdno.dll
deleting: C:\WINDOWS\system32\l0n4la5q1d.dll
Successfully Deleted: C:\WINDOWS\system32\l0n4la5q1d.dll
deleting: C:\WINDOWS\system32\lv0s09d7e.dll
Successfully Deleted: C:\WINDOWS\system32\lv0s09d7e.dll
deleting: C:\WINDOWS\system32\lvns0957e.dll
Successfully Deleted: C:\WINDOWS\system32\lvns0957e.dll
deleting: C:\WINDOWS\system32\mvctfp.dll
Successfully Deleted: C:\WINDOWS\system32\mvctfp.dll
deleting: C:\WINDOWS\system32\nKl80e3ueh.dll
Successfully Deleted: C:\WINDOWS\system32\nKl80e3ueh.dll
deleting: C:\WINDOWS\system32\nztmsg.dll
Successfully Deleted: C:\WINDOWS\system32\nztmsg.dll
deleting: C:\WINDOWS\system32\o084lalq1dqe.dll
Successfully Deleted: C:\WINDOWS\system32\o084lalq1dqe.dll
deleting: C:\WINDOWS\system32\p48q0el5ehq.dll
Successfully Deleted: C:\WINDOWS\system32\p48q0el5ehq.dll
deleting: C:\WINDOWS\system32\q4rq0e95eh.dll
Successfully Deleted: C:\WINDOWS\system32\q4rq0e95eh.dll
deleting: C:\WINDOWS\system32\q686lgls16q6.dll
Successfully Deleted: C:\WINDOWS\system32\q686lgls16q6.dll
deleting: C:\WINDOWS\system32\rMsrad.dll
Successfully Deleted: C:\WINDOWS\system32\rMsrad.dll
deleting: C:\WINDOWS\system32\ulp10.dll
Successfully Deleted: C:\WINDOWS\system32\ulp10.dll
deleting: C:\WINDOWS\system32\vzajet32.dll
Successfully Deleted: C:\WINDOWS\system32\vzajet32.dll
deleting: C:\WINDOWS\system32\guard.tmp
Successfully Deleted: C:\WINDOWS\system32\guard.tmp

Desktop.ini sucessfully removed

Zipping up files for submission:
adding: aestream.dll (104 bytes security) (deflated 4%)
adding: awphelp.dll (104 bytes security) (deflated 4%)
adding: bpowser.dll (104 bytes security) (deflated 3%)
adding: ir06l5ds1.dll (104 bytes security) (deflated 5%)
adding: ir64l5jq1.dll (104 bytes security) (deflated 5%)
adding: irj0l51m1.dll (104 bytes security) (deflated 3%)
adding: kxdno.dll (104 bytes security) (deflated 4%)
adding: l0n4la5q1d.dll (104 bytes security) (deflated 4%)
adding: lv0s09d7e.dll (104 bytes security) (deflated 3%)
adding: lvns0957e.dll (104 bytes security) (deflated 3%)
adding: mvctfp.dll (104 bytes security) (deflated 5%)
adding: nKl80e3ueh.dll (104 bytes security) (deflated 4%)
adding: nztmsg.dll (104 bytes security) (deflated 4%)
adding: o084lalq1dqe.dll (104 bytes security) (deflated 4%)
adding: p48q0el5ehq.dll (104 bytes security) (deflated 4%)
adding: q4rq0e95eh.dll (104 bytes security) (deflated 4%)
adding: q686lgls16q6.dll (104 bytes security) (deflated 4%)
adding: rMsrad.dll (104 bytes security) (deflated 4%)
adding: ulp10.dll (104 bytes security) (deflated 4%)
adding: vzajet32.dll (104 bytes security) (deflated 4%)
adding: guard.tmp (104 bytes security) (deflated 4%)
adding: cecho.reg (104 bytes security) (deflated 2%)
adding: clear.reg (104 bytes security) (deflated 69%)
adding: echo.reg (104 bytes security) (deflated 9%)
adding: desktop.ini (104 bytes security) (deflated 13%)
adding: direct.txt (104 bytes security) (stored 0%)
adding: lo2.txt (104 bytes security) (deflated 83%)
adding: readme.txt (104 bytes security) (deflated 49%)
adding: report.txt (104 bytes security) (deflated 74%)
adding: test.txt (104 bytes security) (deflated 78%)
adding: test2.txt (104 bytes security) (deflated 49%)
adding: xfind.txt (104 bytes security) (deflated 73%)
adding: backregs/06E3B0B3-0BB5-497E-87C1-77074663E7A5.reg (104 bytes security) (deflated 70%)
adding: backregs/4740AC10-6178-4C27-97BC-929A512F59B4.reg (104 bytes security) (deflated 70%)
adding: backregs/AB211678-01E6-49E7-9E8A-6D30515E2DB6.reg (104 bytes security) (deflated 70%)
adding: backregs/B344A36E-0057-4B57-8101-63AEA6C2EEFB.reg (104 bytes security) (deflated 70%)
adding: backregs/CC09FA13-C440-47B8-B788-FB3DDBE17198.reg (104 bytes security) (deflated 70%)
adding: backregs/D1706287-0D84-44D1-8639-0CED3D4623F8.reg (104 bytes security) (deflated 70%)
adding: backregs/D5FC187F-7AEC-402C-9963-A4BBE6CE9ED1.reg (104 bytes security) (deflated 70%)
adding: backregs/D9468E5F-704E-42D7-B9DE-B38C11BB59A8.reg (104 bytes security) (deflated 70%)
adding: backregs/E6AA094A-5168-4A4F-A416-746BFD17685D.reg (104 bytes security) (deflated 70%)
adding: backregs/EC539D8A-7656-4EDA-AC7C-9368116F18E7.reg (104 bytes security) (deflated 70%)
adding: backregs/ED7AD8B8-8FBE-46EE-8846-CBFA587EF626.reg (104 bytes security) (deflated 70%)
adding: backregs/F255A864-F436-46B6-AD9D-898B63037098.reg (104 bytes security) (deflated 70%)
adding: backregs/shell.reg (104 bytes security) (deflated 73%)

Restoring Registry Permissions:


RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
Copyright (c) 1999-2001 Frank Heyne Software (http://www.heysoft.de)
This program is Freeware, use it on your own risk!


Revoking access for really "Everyone"


Registry permissions set too:

RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
Copyright (c) 1999-2001 Frank Heyne Software (http://www.heysoft.de)
This program is Freeware, use it on your own risk!

Access Control List for Registry key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify:
(ID-NI) ALLOW Read BUILTIN\Utilisateurs
(ID-IO) ALLOW Read BUILTIN\Utilisateurs
(ID-NI) ALLOW Read BUILTIN\Utilisateurs avec pouvoir
(ID-IO) ALLOW Read BUILTIN\Utilisateurs avec pouvoir
(ID-NI) ALLOW Full access BUILTIN\Administrateurs
(ID-IO) ALLOW Full access BUILTIN\Administrateurs
(ID-NI) ALLOW Full access AUTORITE NT\SYSTEM
(ID-IO) ALLOW Full access AUTORITE NT\SYSTEM
(ID-IO) ALLOW Full access CREATEUR PROPRIETAIRE


Restoring Sedebugprivilege:

Granting SeDebugPrivilege to Administrators ... failed (GetAccountSid(Administrators)=1332

deleting local copy: aestream.dll
deleting local copy: awphelp.dll
deleting local copy: bpowser.dll
deleting local copy: ir06l5ds1.dll
deleting local copy: ir64l5jq1.dll
deleting local copy: irj0l51m1.dll
deleting local copy: kxdno.dll
deleting local copy: l0n4la5q1d.dll
deleting local copy: lv0s09d7e.dll
deleting local copy: lvns0957e.dll
deleting local copy: mvctfp.dll
deleting local copy: nKl80e3ueh.dll
deleting local copy: nztmsg.dll
deleting local copy: o084lalq1dqe.dll
deleting local copy: p48q0el5ehq.dll
deleting local copy: q4rq0e95eh.dll
deleting local copy: q686lgls16q6.dll
deleting local copy: rMsrad.dll
deleting local copy: ulp10.dll
deleting local copy: vzajet32.dll
deleting local copy: guard.tmp

The following Is the Current Export of the Winlogon notify key:
****************************************************************************
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,33,00,32,00,2e,00,64,00,6c,00,\
6c,00,00,00
"Logoff"="ChainWlxLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,6e,00,65,00,74,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Logoff"="CryptnetWlxLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll]
"DLLName"="cscdll.dll"
"Logon"="WinlogonLogonEvent"
"Logoff"="WinlogonLogoffEvent"
"ScreenSaver"="WinlogonScreenSaverEvent"
"Startup"="WinlogonStartupEvent"
"Shutdown"="WinlogonShutdownEvent"
"StartShell"="WinlogonStartShellEvent"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp]
"DLLName"="wlnotify.dll"
"Logon"="SCardStartCertProp"
"Logoff"="SCardStopCertProp"
"Lock"="SCardSuspendCertProp"
"Unlock"="SCardResumeCertProp"
"Enabled"=dword:00000001
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule]
"Asynchronous"=dword:00000000
"DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Impersonate"=dword:00000000
"StartShell"="SchedStartShell"
"Logoff"="SchedEventLogOff"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy]
"Logoff"="WLEventLogoff"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001
"DllName"=hex(2):73,00,63,00,6c,00,67,00,6e,00,74,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn]
"DLLName"="WlNotify.dll"
"Lock"="SensLockEvent"
"Logon"="SensLogonEvent"
"Logoff"="SensLogoffEvent"
"Safe"=dword:00000001
"MaxWait"=dword:00000258
"StartScreenSaver"="SensStartScreenSaverEvent"
"StopScreenSaver"="SensStopScreenSaverEvent"
"Startup"="SensStartupEvent"
"Shutdown"="SensShutdownEvent"
"StartShell"="SensStartShellEvent"
"PostShell"="SensPostShellEvent"
"Disconnect"="SensDisconnectEvent"
"Reconnect"="SensReconnectEvent"
"Unlock"="SensUnlockEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv]
"Asynchronous"=dword:00000000
"DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Impersonate"=dword:00000000
"Logoff"="TSEventLogoff"
"Logon"="TSEventLogon"
"PostShell"="TSEventPostShell"
"Shutdown"="TSEventShutdown"
"StartShell"="TSEventStartShell"
"Startup"="TSEventStartup"
"MaxWait"=dword:00000258
"Reconnect"="TSEventReconnect"
"Disconnect"="TSEventDisconnect"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon]
"DLLName"="wlnotify.dll"
"Logon"="RegisterTicketExpiredNotificationEvent"
"Logoff"="UnregisterTicketExpiredNotificationEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001


The following are the files found:
****************************************************************************
C:\WINDOWS\system32\aestream.dll
C:\WINDOWS\system32\awphelp.dll
C:\WINDOWS\system32\bpowser.dll
C:\WINDOWS\system32\ir06l5ds1.dll
C:\WINDOWS\system32\ir64l5jq1.dll
C:\WINDOWS\system32\irj0l51m1.dll
C:\WINDOWS\system32\kxdno.dll
C:\WINDOWS\system32\l0n4la5q1d.dll
C:\WINDOWS\system32\lv0s09d7e.dll
C:\WINDOWS\system32\lvns0957e.dll
C:\WINDOWS\system32\mvctfp.dll
C:\WINDOWS\system32\nKl80e3ueh.dll
C:\WINDOWS\system32\nztmsg.dll
C:\WINDOWS\system32\o084lalq1dqe.dll
C:\WINDOWS\system32\p48q0el5ehq.dll
C:\WINDOWS\system32\q4rq0e95eh.dll
C:\WINDOWS\system32\q686lgls16q6.dll
C:\WINDOWS\system32\rMsrad.dll
C:\WINDOWS\system32\ulp10.dll
C:\WINDOWS\system32\vzajet32.dll
C:\WINDOWS\system32\guard.tmp

Registry Entries that were Deleted:
Please verify that the listing looks ok.
If there was something deleted wrongly there are backups in the backreg folder.
****************************************************************************
REGEDIT4

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]
"{E5AF72A6-2EFF-4967-B45E-8EE8E4D8A4FD}"=-
"{AACD3013-C200-406F-9ADE-793F7A63793A}"=-
"{87D1ED01-FD5E-43D1-B105-7CAF30E37453}"=-
"{B82FFA36-20D1-4790-AD69-71F6FFBAB01F}"=-
"{15B4E9C8-A50B-44B8-B8A7-63DF44A77117}"=-
"{1911C8CD-81B7-4E43-9A93-C9B225706686}"=-
"{AB211678-01E6-49E7-9E8A-6D30515E2DB6}"=-
"{E4408E0A-4C97-41E9-8CB6-961CCE3E47C7}"=-
"{B4C293B2-F2C0-45E0-8F65-EE7EAF5B4663}"=-
"{06E3B0B3-0BB5-497E-87C1-77074663E7A5}"=-
"{B344A36E-0057-4B57-8101-63AEA6C2EEFB}"=-
"{D9468E5F-704E-42D7-B9DE-B38C11BB59A8}"=-
"{ED7AD8B8-8FBE-46EE-8846-CBFA587EF626}"=-
"{F255A864-F436-46B6-AD9D-898B63037098}"=-
"{4740AC10-6178-4C27-97BC-929A512F59B4}"=-
"{D5FC187F-7AEC-402C-9963-A4BBE6CE9ED1}"=-
"{EC539D8A-7656-4EDA-AC7C-9368116F18E7}"=-
"{D1706287-0D84-44D1-8639-0CED3D4623F8}"=-
"{E6AA094A-5168-4A4F-A416-746BFD17685D}"=-
"{CC09FA13-C440-47B8-B788-FB3DDBE17198}"=-
[-HKEY_CLASSES_ROOT\CLSID\{E5AF72A6-2EFF-4967-B45E-8EE8E4D8A4FD}]
[-HKEY_CLASSES_ROOT\CLSID\{AACD3013-C200-406F-9ADE-793F7A63793A}]
[-HKEY_CLASSES_ROOT\CLSID\{87D1ED01-FD5E-43D1-B105-7CAF30E37453}]
[-HKEY_CLASSES_ROOT\CLSID\{B82FFA36-20D1-4790-AD69-71F6FFBAB01F}]
[-HKEY_CLASSES_ROOT\CLSID\{15B4E9C8-A50B-44B8-B8A7-63DF44A77117}]
[-HKEY_CLASSES_ROOT\CLSID\{1911C8CD-81B7-4E43-9A93-C9B225706686}]
[-HKEY_CLASSES_ROOT\CLSID\{AB211678-01E6-49E7-9E8A-6D30515E2DB6}]
[-HKEY_CLASSES_ROOT\CLSID\{E4408E0A-4C97-41E9-8CB6-961CCE3E47C7}]
[-HKEY_CLASSES_ROOT\CLSID\{B4C293B2-F2C0-45E0-8F65-EE7EAF5B4663}]
[-HKEY_CLASSES_ROOT\CLSID\{06E3B0B3-0BB5-497E-87C1-77074663E7A5}]
[-HKEY_CLASSES_ROOT\CLSID\{B344A36E-0057-4B57-8101-63AEA6C2EEFB}]
[-HKEY_CLASSES_ROOT\CLSID\{D9468E5F-704E-42D7-B9DE-B38C11BB59A8}]
[-HKEY_CLASSES_ROOT\CLSID\{ED7AD8B8-8FBE-46EE-8846-CBFA587EF626}]
[-HKEY_CLASSES_ROOT\CLSID\{F255A864-F436-46B6-AD9D-898B63037098}]
[-HKEY_CLASSES_ROOT\CLSID\{4740AC10-6178-4C27-97BC-929A512F59B4}]
[-HKEY_CLASSES_ROOT\CLSID\{D5FC187F-7AEC-402C-9963-A4BBE6CE9ED1}]
[-HKEY_CLASSES_ROOT\CLSID\{EC539D8A-7656-4EDA-AC7C-9368116F18E7}]
[-HKEY_CLASSES_ROOT\CLSID\{D1706287-0D84-44D1-8639-0CED3D4623F8}]
[-HKEY_CLASSES_ROOT\CLSID\{E6AA094A-5168-4A4F-A416-746BFD17685D}]
[-HKEY_CLASSES_ROOT\CLSID\{CC09FA13-C440-47B8-B788-FB3DDBE17198}]
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
"{8D548090-36A9-4B1F-BFB2-BB7F27AD3E24}"=-
****************************************************************************
Desktop.ini Contents:
****************************************************************************
[.ShellClassInfo]
CLSID={645FF040-5081-101B-9F08-00AA002F954E}
<IDone>{8D548090-36A9-4B1F-BFB2-BB7F27AD3E24}</IDone>
<IDtwo>AD</IDtwo>
<VERSION>200</VERSION>
****************************************************************************
Classid's found from regsearch:
****************************************************************************



ouf S!ri, ca as été d'une extreme violance ca ma meme niquer mon adresse IP, ceci dit j'ai récupérer les fonctions de ma corbeille, j'ai refait adaware, plus de vx2 en vue! il reste un trojan, je lis ton dernier message et je fait ce qu'il faut

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,33,00,32,00,2e,00,64,00,6c,00,\
6c,00,00,00
"Logoff"="ChainWlxLogoffEvent"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,6e,00,65,00,74,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Logoff"="CryptnetWlxLogoffEvent"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll]
"DLLName"="cscdll.dll"
"Logon"="WinlogonLogonEvent"
"Logoff"="WinlogonLogoffEvent"
"ScreenSaver"="WinlogonScreenSaverEvent"
"Startup"="WinlogonStartupEvent"
"Shutdown"="WinlogonShutdownEvent"
"StartShell"="WinlogonStartShellEvent"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp]
"DLLName"="wlnotify.dll"
"Logon"="SCardStartCertProp"
"Logoff"="SCardStopCertProp"
"Lock"="SCardSuspendCertProp"
"Unlock"="SCardResumeCertProp"
"Enabled"=dword:00000001
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule]
"Asynchronous"=dword:00000000
"DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Impersonate"=dword:00000000
"StartShell"="SchedStartShell"
"Logoff"="SchedEventLogOff"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy]
"Logoff"="WLEventLogoff"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001
"DllName"=hex(2):73,00,63,00,6c,00,67,00,6e,00,74,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn]
"DLLName"="WlNotify.dll"
"Lock"="SensLockEvent"
"Logon"="SensLogonEvent"
"Logoff"="SensLogoffEvent"
"Safe"=dword:00000001
"MaxWait"=dword:00000258
"StartScreenSaver"="SensStartScreenSaverEvent"
"StopScreenSaver"="SensStopScreenSaverEvent"
"Startup"="SensStartupEvent"
"Shutdown"="SensShutdownEvent"
"StartShell"="SensStartShellEvent"
"PostShell"="SensPostShellEvent"
"Disconnect"="SensDisconnectEvent"
"Reconnect"="SensReconnectEvent"
"Unlock"="SensUnlockEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv]
"Asynchronous"=dword:00000000
"DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Impersonate"=dword:00000000
"Logoff"="TSEventLogoff"
"Logon"="TSEventLogon"
"PostShell"="TSEventPostShell"
"Shutdown"="TSEventShutdown"
"StartShell"="TSEventStartShell"
"Startup"="TSEventStartup"
"MaxWait"=dword:00000258
"Reconnect"="TSEventReconnect"
"Disconnect"="TSEventDisconnect"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon]
"DLLName"="wlnotify.dll"
"Logon"="RegisterTicketExpiredNotificationEvent"
"Logoff"="UnregisterTicketExpiredNotificationEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

la R1 et les 017 je suppose?

Logfile of HijackThis v1.99.0
Scan saved at 21:30:26, on 25/01/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Messenger Plus! 3\MsgPlus.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\WINDOWS\System32\atievxx.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\Fichiers communs\EPSON\EBAPI\eEBSVC.exe
C:\Program Files\Fichiers communs\EPSON\EBAPI\SAgent2.exe
c:\progra~1\intern~1\iexplore.exe
C:\WINDOWS\System32\inetsrv\inetinfo.exe
C:\WINDOWS\System32\tcpsvcs.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\mqsvc.exe
C:\WINDOWS\System32\mqtgsvc.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\klum\Bureau\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.gozszzpqqpgtixiqaaukrmqoa.com/scGhqs3p7cqEu2pACxMXYyQ1UQkWQYC45IAWyKhMNDeEO8HXg6Ffvf04i/V3CXEP.html
O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\Messenger Plus! 3\MsgPlus.exe"
O4 - HKLM\..\Run: [Coal Heart Bat Play] C:\Documents and Settings\All Users\Application Data\Third first coal heart\drvlist.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [4 aim] C:\DOCUME~1\klum\APPLIC~1\SEEKIN~1\Date each dash.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=34738&clcid=0x409
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1099228269418
O17 - HKLM\System\CCS\Services\Tcpip\..\{0E40B604-4919-40F5-AFA4-45C7F99BE780}: NameServer = 69.50.188.180,195.225.176.31
O17 - HKLM\System\CCS\Services\Tcpip\..\{3B0CD561-A241-4B8D-9442-F780AB42DC63}: NameServer = 69.50.188.180,195.225.176.31
O17 - HKLM\System\CS1\Services\Tcpip\..\{0E40B604-4919-40F5-AFA4-45C7F99BE780}: NameServer = 69.50.188.180,195.225.176.31
O23 - Service: avast! iAVS4 Control Service - Unknown - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - Unknown - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: Service d'administration du Gestionnaire de disque logique - Unknown - C:\WINDOWS\System32\dmadmin.exe
O23 - Service: EpsonBidirectionalService - Unknown - C:\Program Files\Fichiers communs\EPSON\EBAPI\eEBSVC.exe
O23 - Service: EPSON Printer Status Agent2 - SEIKO EPSON CORPORATION - C:\Program Files\Fichiers communs\EPSON\EBAPI\SAgent2.exe
O23 - Service: Journal des événements - Unknown - C:\WINDOWS\system32\services.exe
O23 - Service: Fax - Unknown - C:\WINDOWS\system32\fxssvc.exe
O23 - Service: Administration IIS - Unknown - C:\WINDOWS\System32\inetsrv\inetinfo.exe
O23 - Service: Service COM de gravage de CD IMAPI - Unknown - C:\WINDOWS\System32\imapi.exe
O23 - Service: Partage de Bureau à distance NetMeeting - Unknown - C:\WINDOWS\System32\mnmsrvc.exe
O23 - Service: Publication FTP - Unknown - C:\WINDOWS\System32\inetsrv\inetinfo.exe
O23 - Service: Plug-and-Play - Unknown - C:\WINDOWS\system32\services.exe
O23 - Service: Gestionnaire de session d'aide sur le Bureau à distance - Unknown - C:\WINDOWS\system32\sessmgr.exe
O23 - Service: Carte à puce - Unknown - C:\WINDOWS\System32\SCardSvr.exe
O23 - Service: Simple Mail Transfer Protocol (SMTP) - Unknown - C:\WINDOWS\System32\inetsrv\inetinfo.exe
O23 - Service: Service SNMP - Unknown - C:\WINDOWS\System32\snmp.exe
O23 - Service: Cliché instantané de volume - Unknown - C:\WINDOWS\System32\vssvc.exe
O23 - Service: Publication World Wide Web - Unknown - C:\WINDOWS\System32\inetsrv\inetinfo.exe
O23 - Service: Carte de performance WMI - Unknown - C:\WINDOWS\System32\wbem\wmiapsrv.exe

S!RI et encore des emmerde pour me reconnecter, dsl

page ok, corbeille ok, si tu est plus la ce soir pas grave moi de toute facon c'est klum mon nom de famille, richard connais pas! et je vais plus t'ennuyer pour ce soir suis crevé, ceci dit je sais pas comment te remercier pour ce que tu as fait aujourd'hui, je la fait plus longue, demain si tu veux bien on mis l'estocade on imprime et tu pourra faire profiter tout le monde de cette expérience,

merci! je reste encore 5 min, si tu veux me répondre

bonne soirée

slt S!ri, cmt va-tu?

résumé de l'épisode précédent:

j'ai fixé les ligne 17 du log, c'est ok elles reviennent pas
la R1 qd je l'ai fixé poblème de connect ai fait réparé la connect et je suis la, seulement j'ose pas réeaissayer ( peur de plus récupérer la connect surtout que ici ont est 4 et que je suis le seule a pouvoir faire les manipe et évidemment si ca va c'est de ma faute, bien sur!!)

ce midi j'ai lancé avast, ad-aware et adaware aware, tout était clean, puis je me suis baladé sur le forum

j'ai refait ca il y a une heure, 9 malware, mis en quarantaine que j'ai supprimer un seule de retour le trojan évidemment

sinon le système est stable, sauf un trés léger ralentissement sur le net et une barre shearch "machin" que je peux fermer sans blème

voici le log:

Logfile of HijackThis v1.99.0
Scan saved at 17:07:40, on 26/01/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Messenger Plus! 3\MsgPlus.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\WINDOWS\System32\atievxx.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\Fichiers communs\EPSON\EBAPI\eEBSVC.exe
C:\Program Files\Fichiers communs\EPSON\EBAPI\SAgent2.exe
C:\WINDOWS\System32\inetsrv\inetinfo.exe
C:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe
C:\WINDOWS\System32\tcpsvcs.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\mqsvc.exe
C:\WINDOWS\System32\mqtgsvc.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe
C:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe
C:\WINDOWS\system32\wuauclt.exe
c:\progra~1\intern~1\iexplore.exe
C:\WINDOWS\system32\wscntfy.exe
c:\progra~1\intern~1\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\klum\Bureau\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.abtgfgmsdthwvfix.com/scGhqs3p7cqEu2pACxMXYyQ1UQkWQYC45IAWyKhMNDd9x7t9NlMQYv04i/V3CXEP.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.fr.msn.be/
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\Messenger Plus! 3\MsgPlus.exe"
O4 - HKLM\..\Run: [Coal Heart Bat Play] C:\Documents and Settings\All Users\Application Data\Third first coal heart\drvlist.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [4 aim] C:\DOCUME~1\klum\APPLIC~1\SEEKIN~1\Date each dash.exe
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Pages liées - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Pages similaires - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Version de la page actuelle disponible dans le cache Google - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=34738&clcid=0x409
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1099228269418
O23 - Service: avast! iAVS4 Control Service - Unknown - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - Unknown - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: Service d'administration du Gestionnaire de disque logique - Unknown - C:\WINDOWS\System32\dmadmin.exe
O23 - Service: EpsonBidirectionalService - Unknown - C:\Program Files\Fichiers communs\EPSON\EBAPI\eEBSVC.exe
O23 - Service: EPSON Printer Status Agent2 - SEIKO EPSON CORPORATION - C:\Program Files\Fichiers communs\EPSON\EBAPI\SAgent2.exe
O23 - Service: Journal des événements - Unknown - C:\WINDOWS\system32\services.exe
O23 - Service: Fax - Unknown - C:\WINDOWS\system32\fxssvc.exe
O23 - Service: Administration IIS - Unknown - C:\WINDOWS\System32\inetsrv\inetinfo.exe
O23 - Service: Service COM de gravage de CD IMAPI - Unknown - C:\WINDOWS\System32\imapi.exe
O23 - Service: Kerio Personal Firewall 4 - Kerio Technologies - C:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe
O23 - Service: Partage de Bureau à distance NetMeeting - Unknown - C:\WINDOWS\System32\mnmsrvc.exe
O23 - Service: Publication FTP - Unknown - C:\WINDOWS\System32\inetsrv\inetinfo.exe
O23 - Service: Plug-and-Play - Unknown - C:\WINDOWS\system32\services.exe
O23 - Service: Gestionnaire de session d'aide sur le Bureau à distance - Unknown - C:\WINDOWS\system32\sessmgr.exe
O23 - Service: Carte à puce - Unknown - C:\WINDOWS\System32\SCardSvr.exe
O23 - Service: Simple Mail Transfer Protocol (SMTP) - Unknown - C:\WINDOWS\System32\inetsrv\inetinfo.exe
O23 - Service: Service SNMP - Unknown - C:\WINDOWS\System32\snmp.exe
O23 - Service: Cliché instantané de volume - Unknown - C:\WINDOWS\System32\vssvc.exe
O23 - Service: Publication World Wide Web - Unknown - C:\WINDOWS\System32\inetsrv\inetinfo.exe
O23 - Service: Carte de performance WMI - Unknown - C:\WINDOWS\System32\wbem\wmiapsrv.exe

Merci de voir,

Salut Richard1

La réponse logiciel au problème d'André concernant VX2 à été donnée ici:
http://www.commentcamarche.net/forum/affich-1200688-vx2#9
par Wathelet et Balltrap34 m'avait parlé de ce logiciel:
http://www.downloads.subratam.org/l2mfix.exe
dans un autre message.

La procédure pour enlever VX2 à la main est donnée dans d'autre posts, mais cela ne fonctionnait pas avec André... va savoir pourquoi.
Il a fallut utiliser une méthode un peu plus radicale.