BESION D'UN COACH pr désinfection pc Merci!

Question

Bonjour,
Pc qui rame, déconexion internet fréquente, trucs bizarres en tous genres... dsl pr le manque d'informations rélles. J'aimerais que quelqu'un m'aide a voir si mon log hijack this est suspect (ci-joint).

J'aimerais connaitre le process à suivre pr refaire une santé a son pc, genre: 1-hijackthis 2-antivirus online 3-défragmentation etc...

Je suis derrière l'ordi cette aprem. J'espère avoir fini ce soir. Possible ?  Allez a votre bon coeur messieurs mesdames les as de la boite en binaire !

Merci d'avance

Dakoala

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:04:43, on 03/06/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\ATKKBService.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin
SvcLog.exe
C:\WINDOWS\system32
vsvc32.exe
C:\Program Files\Google\Update\GoogleUpdate.exe
C:\Program Files\Alcohol Soft\Alcohol 52\StarWind\StarWindServiceAE.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin
SvcIp.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32mctrl.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\WINDOWS\system32undll32.exe
C:\Program Files\Logitech\Video\LogiTray.exe
C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe
C:\Program Files\CyberLink\PowerDVD9\PDVD9Serv.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIBZE.EXE
C:\WINDOWS\system32\LVComS.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\WISPTIS.EXE
C:\Program Files\TP-LINK\TL-WN321G Wireless Utility\Installer\WINXP\TWCU.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Administrateur\Bureau\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://www.google.fr/?gws_rd=ssl
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O4 - HKLM\..\Run: [RemoteControl] C:\WINDOWS\system32mctrl.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [amd_dc_opt] C:\Program Files\AMD\Dual-Core Optimizer\amd_dc_opt.exe
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe"
O4 - HKLM\..\Run: [PCLEUSBTip] C:\Program Files\Pinnacle\Shared Files\Programs\USBTip\USBTip.exe
O4 - HKLM\..\Run: [USB2Check] RUNDLL32.EXE "C:\WINDOWS\system32\PCLECoInst.dll",CheckUSBController
O4 - HKLM\..\Run: [RemoteControl9] "C:\Program Files\CyberLink\PowerDVD9\PDVD9Serv.exe"
O4 - HKLM\..\Run: [PDVD9LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD9\Language\Language.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [AlcoholAutomount] "C:\Program Files\Alcohol Soft\Alcohol 52\axcmd.exe" /automount
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [EPSON Stylus D92 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIBZE.EXE /FU "C:\WINDOWS\TEMP\E_S2AA.tmp" /EF "HKCU"
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [LaunchList] C:\Program Files\Pinnacle\Studio 11\LaunchList2.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: AutoCAD Startup Accelerator.lnk = C:\Program Files\Fichiers communs\Autodesk Shared\acstart16.exe
O4 - Global Startup: TL-WN321G Wireless Utility.lnk = C:\Program Files\TP-LINK\TL-WN321G Wireless Utility\Installer\WINXP\TWCU.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll
O23 - Service: ATK Keyboard Service (ATKKeyboardService) - ASUSTeK COMPUTER INC. - C:\WINDOWS\ATKKBService.exe
O23 - Service: Autodesk Licensing Service - Autodesk, Inc. - C:\Program Files\Fichiers communs\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Fichiers communs\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Forceware Web Interface (ForcewareWebInterface) - Apache Software Foundation - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
O23 - Service: Google Update Service (gupdate1c9ae45a4f55dd0) (gupdate1c9ae45a4f55dd0) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: ForceWare IP service (nSvcIp) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin
SvcIp.exe
O23 - Service: ForceWare user log service (nSvcLog) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin
SvcLog.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exe
O23 - Service: PCLEPCI - Pinnacle Systems GmbH - C:\WINDOWS\system32\drivers\pclepci.sys
O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 52\StarWind\StarWindServiceAE.exe

DaKoala · Answer

J'ai lancé Panda antivirus online en attendant une réponse.

gen-hackman · Answer

salut :

Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) 

commence par mettre windows et IE à jour

DaKoala · Answer

et j'utilise firefox.

gen-hackman · Answer

ton windows est donc cracké

Pc qui rame, déconexion internet fréquente, trucs bizarres en tous genres.

je comprends donc mieux

achètes une license ca ira mieux

sinon pour internet explorer :

Internet Explorer présente des failles de sécurité qui mettent longtemps avant d'être corrigées mais il faut absolument le conserver à jour , pour les mises à jour Windows et Windows live Messenger

Télécharge Random's System Information Tool (RSIT) de random/random et enregistre l'exécutable sur ton Bureau. 

! Déconnecte toi et ferme toutes tes applications en cours ! 

Double-clique sur " RSIT.exe " pour le lancer . 

-> Une première fenêtre s'ouvre avec en titre : " Disclaimer of warranty " . 

* Devant l'option "List files/folders created ..." , tu choisis : 2 months 

* clique ensuite sur " Continue " pour lancer l'analyse ... 


-> laisse faire le scan et ne touche pas au PC ... 


Lorsque l'analyse sera terminée, deux fichiers texte s'ouvriront (probablement avec le bloc-note). 

Poste le contenu de " log.txt " (c'est celui qui apparait à l'écran), ainsi que de " info.txt " (que tu verras dans la barre des tâches), pour analyse et attends la suite ... 

Important : poste un rapport, puis l'autre dans la réponse suivante
Si tu essaies de poster les deux en même temps, cela risque d'être trop long pour le forum 


( Note : les rapports seront en outre sauvegardés dans ce dossier -> C:\rsit )

DaKoala · Answer

Premièrement : merci bcp de t'occuper de moi
J'ai panda online qui tourne en ce moment je peux quand même faire ta procédure???

DaKoala · Answer

Logfile of random's system information tool 1.06 (written by random/random)
Run by Administrateur at 2009-06-03 16:24:16
Microsoft Windows XP Professionnel Service Pack 2
System drive C: has 58 GB (76%) free of 76 GB
Total RAM: 2047 MB (63% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16:24:26, on 03/06/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\ATKKBService.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin
SvcLog.exe
C:\WINDOWS\system32
vsvc32.exe
C:\Program Files\Google\Update\GoogleUpdate.exe
C:\Program Files\Alcohol Soft\Alcohol 52\StarWind\StarWindServiceAE.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin
SvcIp.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32mctrl.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\WINDOWS\system32undll32.exe
C:\Program Files\Logitech\Video\LogiTray.exe
C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe
C:\Program Files\CyberLink\PowerDVD9\PDVD9Serv.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIBZE.EXE
C:\WINDOWS\system32\LVComS.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\WISPTIS.EXE
C:\Program Files\TP-LINK\TL-WN321G Wireless Utility\Installer\WINXP\TWCU.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Administrateur\Bureau\RSIT.exe
C:\Documents and Settings\Administrateur\Bureau\Administrateur.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://www.google.fr/?gws_rd=ssl
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O4 - HKLM\..\Run: [RemoteControl] C:\WINDOWS\system32mctrl.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [amd_dc_opt] C:\Program Files\AMD\Dual-Core Optimizer\amd_dc_opt.exe
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe"
O4 - HKLM\..\Run: [PCLEUSBTip] C:\Program Files\Pinnacle\Shared Files\Programs\USBTip\USBTip.exe
O4 - HKLM\..\Run: [USB2Check] RUNDLL32.EXE "C:\WINDOWS\system32\PCLECoInst.dll",CheckUSBController
O4 - HKLM\..\Run: [RemoteControl9] "C:\Program Files\CyberLink\PowerDVD9\PDVD9Serv.exe"
O4 - HKLM\..\Run: [PDVD9LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD9\Language\Language.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [AlcoholAutomount] "C:\Program Files\Alcohol Soft\Alcohol 52\axcmd.exe" /automount
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [EPSON Stylus D92 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIBZE.EXE /FU "C:\WINDOWS\TEMP\E_S2AA.tmp" /EF "HKCU"
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [LaunchList] C:\Program Files\Pinnacle\Studio 11\LaunchList2.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: AutoCAD Startup Accelerator.lnk = C:\Program Files\Fichiers communs\Autodesk Shared\acstart16.exe
O4 - Global Startup: TL-WN321G Wireless Utility.lnk = C:\Program Files\TP-LINK\TL-WN321G Wireless Utility\Installer\WINXP\TWCU.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll
O23 - Service: ATK Keyboard Service (ATKKeyboardService) - ASUSTeK COMPUTER INC. - C:\WINDOWS\ATKKBService.exe
O23 - Service: Autodesk Licensing Service - Autodesk, Inc. - C:\Program Files\Fichiers communs\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Fichiers communs\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Forceware Web Interface (ForcewareWebInterface) - Apache Software Foundation - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
O23 - Service: Google Update Service (gupdate1c9ae45a4f55dd0) (gupdate1c9ae45a4f55dd0) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: ForceWare IP service (nSvcIp) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin
SvcIp.exe
O23 - Service: ForceWare user log service (nSvcLog) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin
SvcLog.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exe
O23 - Service: PCLEPCI - Pinnacle Systems GmbH - C:\WINDOWS\system32\drivers\pclepci.sys
O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 52\StarWind\StarWindServiceAE.exe

DaKoala · Answer

info.txt logfile of random's system information tool 1.06 2009-06-03 16:24:28

======Uninstall list======

-->C:\Program Files\DivX\DivXConverterUninstall.exe /CONVERTER
-->rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf
Adobe After Effects CS3 Presets-->MsiExec.exe /I{193EAFD0-1BAF-4FB4-B18F-79D5D6A4B285}
Adobe Anchor Service CS3-->MsiExec.exe /I{90176341-0A8B-4CCC-A78D-F862228A6B95}
Adobe Asset Services CS3-->MsiExec.exe /I{6FF5DD7A-FE28-4439-B8CF-1E9AF4EA0A61}
Adobe Bridge CS3-->MsiExec.exe /I{9C9824D9-9000-4373-A6A5-D0E5D4831394}
Adobe Bridge Start Meeting-->MsiExec.exe /I{08B32819-6EEF-4057-AEDA-5AB681A36A23}
Adobe BridgeTalk Plugin CS3-->MsiExec.exe /I{B73CFB12-C814-4638-AFFD-7E3AAFAF0B4E}
Adobe Camera Raw 4.0-->MsiExec.exe /I{B3BF6689-A81D-40D8-9A86-4AC4ACD9FC1C}
Adobe CMaps-->MsiExec.exe /I{A2B242BD-FF8D-4840-9DAA-9170EABEC59C}
Adobe Color - Photoshop Specific-->MsiExec.exe /I{A2D81E70-2A98-4A08-A628-94388B063C5E}
Adobe Color Common Settings-->MsiExec.exe /I{DADD7B8A-BCB0-44F5-967A-ECB6B4F2ECD9}
Adobe Color EU Recommended Settings-->MsiExec.exe /I{73B5D990-04EA-4751-B10F-5534770B91F2}
Adobe Color JA Extra Settings-->MsiExec.exe /I{DD7DB3C5-6FA3-4FA3-8A71-C2F2940EB029}
Adobe Color NA Extra Settings-->MsiExec.exe /I{FF29A7E2-FF40-4D07-B7E4-2093DE59E10A}
Adobe Creative Suite 3 Master Collection-->MsiExec.exe /I{5D2398DF-3022-4820-93BA-F1175FBEA9CA}
Adobe Default Language CS3-->MsiExec.exe /I{B9B35331-B7E4-4E5C-BF4C-7BC87856124D}
Adobe Device Central CS3-->MsiExec.exe /I{8D2BA474-F406-4710-9AE4-D4F22D21F0DD}
Adobe Dreamweaver CS3-->MsiExec.exe /I{4BDB76C6-902E-41D5-9064-68768E02886B}
Adobe ExtendScript Toolkit 2-->MsiExec.exe /I{C2D69781-F392-4118-A5A7-C7E9C38DBFC2}
Adobe Extension Manager CS3-->MsiExec.exe /I{BE5F3842-8309-4754-92D5-83E02E6077A3}
Adobe Fireworks CS3-->MsiExec.exe /I{21C4D775-368A-46C4-8DC3-4207165B7115}
Adobe Flash CS3-->MsiExec.exe /I{80FD3971-8482-49C8-BA8C-B6464A15882F}
Adobe Flash Player 9 ActiveX-->MsiExec.exe /X{BB65C393-C76E-4F06-9B0C-2124AA8AF97B}
Adobe Flash Player 9 ActiveX-->MsiExec.exe /X{BC4F8E84-5E29-49EC-B4E7-E6F9CB50986C}
Adobe Flash Player 9 Plugin-->MsiExec.exe /X{88D422DB-E9C7-4E16-9D80-2999F4FD6AD9}
Adobe Flash Video Encoder-->MsiExec.exe /I{1B0BCA28-1F11-4D60-8A2F-DEBE04B5341E}
Adobe Fonts All-->MsiExec.exe /I{6ABE0BEE-D572-4FE8-B434-9E72A289431B}
Adobe Help Viewer CS3-->MsiExec.exe /I{7ACFB90E-8FD0-4397-AD3A-5195412623A3}
Adobe Illustrator CS-->RunDll32 "C:\Program Files\Fichiers communs\InstallShield\Professional\RunTime\0701\Intel32\ctor.dll",LaunchSetup "C:\Program Files\InstallShield Installation Information\{91A4AD99-69CE-4745-97B7-0E0DFBECFDE5}\setup.exe"
Adobe InDesign CS3 Icon Handler-->MsiExec.exe /I{EA7B3CC4-366D-4CF6-8350-FD7A7034116E}
Adobe Linguistics CS3-->MsiExec.exe /I{54793AA1-5001-42F4-ABB6-C364617C6078}
Adobe MotionPicture Color Files-->MsiExec.exe /I{6B708481-748A-4EB4-97C1-CD386244FF77}
Adobe PDF Library Files-->MsiExec.exe /I{D2559B88-CC9D-4B48-81BB-F492BAA9C48C}
Adobe Photoshop CS3-->MsiExec.exe /I{C1FA4B3B-1625-4922-9C9D-780E8FCE161A}
Adobe Premiere Pro CS3 Functional Content-->MsiExec.exe /I{50F102CA-4BE2-41A9-9810-5BB05EB91B9A}
Adobe Premiere Pro CS3 Third Party Content-->MsiExec.exe /I{485ACF57-F364-440A-8496-E1E81C8FA1AA}
Adobe Premiere Pro CS3-->MsiExec.exe /I{58DCEEE5-532E-44F4-B1D7-A146EF9E9FDA}
Adobe Reader 6.0 - Français-->MsiExec.exe /I{AC76BA86-7AD7-1036-7B44-000000000001}
Adobe Setup-->MsiExec.exe /I{1628F6BD-5ED1-4FD1-B90F-C106AF4E00F0}
Adobe SING CS3-->MsiExec.exe /I{B671CBFD-4109-4D35-9252-3062D3CCB7B2}
Adobe Stock Photos CS3-->MsiExec.exe /I{29E5EA97-5F74-4A57-B8B2-D4F169117183}
Adobe SVG Viewer 3.0-->C:\Program Files\Fichiers communs\Adobe\SVG Viewer 3.0\Uninstall\Winstall.exe -u -fC:\Program Files\Fichiers communs\Adobe\SVG Viewer 3.0\Uninstall\Install.log
Adobe Type Support-->MsiExec.exe /I{8E6808E2-613D-4FCD-81A2-6C8FA8E03312}
Adobe Update Manager CS3-->MsiExec.exe /I{E69AE897-9E0B-485C-8552-7841F48D42D8}
Adobe Version Cue CS3 Client-->MsiExec.exe /I{D0DFF92A-492E-4C40-B862-A74A173C25C5}
Adobe Video Profiles-->MsiExec.exe /I{845A8DB9-8802-4FD3-9FE3-938A6C46A2EC}
Adobe WAS CS3-->MsiExec.exe /I{C5BD220A-EFE8-48A5-B70E-9503D535FACE}
Adobe WinSoft Linguistics Plugin-->MsiExec.exe /I{184CE391-7E0E-4C63-9935-D7A10EDFD3C6}
Adobe XMP DVA Panels CS3-->MsiExec.exe /I{0224CACC-994D-45F8-B973-D65056EA9C2F}
Adobe XMP Panels CS3-->MsiExec.exe /I{D5A31AB1-345D-47C7-A87B-036A669F6DF1}
adsl TV-->C:\Program Files\adslTV\Uninstal.exe
AHV content for Acrobat and Flash-->MsiExec.exe /I{6BBAA81D-6A7E-43AD-8889-2F002DCAAFDD}
Ajouter ou supprimer Adobe Creative Suite 3 Master Collection-->C:\Program Files\Fichiers communs\Adobe\Installers\b5d5789539ea1f004a4defceea74312\Setup.exe
AlerteGPS G50-->C:\Program Files\AlerteGPS\G50\Uninstal.exe
Archiveur WinRAR-->C:\Program Files\WinRAR\uninstall.exe
ASUS Enhanced Display Driver-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\11\00\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{315ACD04-BCEB-478B-9B1D-5431D0E6CB11}\setup.exe" -l0x40c  -removeonly
ASUSUpdate-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{587178E7-B1DF-494E-9838-FA4DD36E873C}\Setup.exe" -l0x40c 
AutoCAD 2005 - English-->MsiExec.exe /I{5783F2D7-0301-0409-0002-0060B0CE6BBA}
Autodesk DWF Viewer 7-->MsiExec.exe /I{9A346205-EA92-4406-B1AB-50379DA3F057}
Autodesk DWF Viewer-->C:\PROGRA~1\Autodesk\AUTODE~1\Setup.exe /remove
AVG Free 8.0-->C:\Program Files\AVG\AVG8\setup.exe /UNINSTALL
Canon ScanGear Starter-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{18A5DFF2-8A95-49F3-873F-743CB5549F3D}\SETUP.EXE" -l0x40c anything
Clé Internet de prêt-->"C:\Program Files\InstallShield Installation Information\{93D34EE3-99B3-4DB1-8B0A-0A657466F90D}\setup.exe" -runfromtemp -l0x040c -removeonly
Correctif pour Windows XP (KB935448)-->"C:\WINDOWS\$NtUninstallKB935448$\spuninst\spuninst.exe"
Correctif pour Windows XP (KB952287)-->"C:\WINDOWS\$NtUninstallKB952287$\spuninst\spuninst.exe"
Correctif Windows XP - KB873339-->C:\WINDOWS\$NtUninstallKB873339$\spuninst\spuninst.exe
Correctif Windows XP - KB885835-->C:\WINDOWS\$NtUninstallKB885835$\spuninst\spuninst.exe
Correctif Windows XP - KB885836-->C:\WINDOWS\$NtUninstallKB885836$\spuninst\spuninst.exe
Correctif Windows XP - KB886185-->C:\WINDOWS\$NtUninstallKB886185$\spuninst\spuninst.exe
Correctif Windows XP - KB888302-->C:\WINDOWS\$NtUninstallKB888302$\spuninst\spuninst.exe
Correctif Windows XP - KB890859-->"C:\WINDOWS\$NtUninstallKB890859$\spuninst\spuninst.exe"
Correctif Windows XP - KB891781-->C:\WINDOWS\$NtUninstallKB891781$\spuninst\spuninst.exe
CyberLink PowerDVD 9-->"C:\Program Files\InstallShield Installation Information\{A8516AC9-AAF1-47F9-9766-03E2D4CDBCF8}\Setup.exe" /z-uninstall
CyberLink PowerDVD 9-->"C:\Program Files\InstallShield Installation Information\{A8516AC9-AAF1-47F9-9766-03E2D4CDBCF8}\Setup.exe" /z-uninstall
DivX Codec-->C:\Program Files\DivX\DivXCodecUninstall.exe /CODEC
DivX Converter-->C:\Program Files\DivX\DivXConverterUninstall.exe /CONVERTER
DivX Player-->C:\Program Files\DivX\DivXPlayerUninstall.exe /PLAYER
DivX Plus DirectShow Filters-->C:\Program Files\DivX\DivXDSFiltersUninstall.exe /DSFILTERS
DivX Web Player-->C:\Program Files\DivX\DivXWebPlayerUninstall.exe /PLUGIN
Dual-Core Optimizer-->MsiExec.exe /X{FF3D660E-E5CC-47FD-8050-1B4DE3BA81A9}
EPSON Logiciel imprimante-->C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\EPUPDATE.EXE /R
Final Codecs 2008 New Year Edition-->C:\Program Files\Final Codecs\uninst.exe
Google Earth Plugin-->MsiExec.exe /I{CFA3D1B0-415C-11DE-8251-005056806466}
Google SketchUp 6 Exporters-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{EB459C2F-41CA-4222-B9CA-F8EBA40B8DAB}\setup.exe" -l0x40c  -removeonly
Google SketchUp 6-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{98736A65-3C79-49EC-B7E9-A3C77774B0E6}\setup.exe" -l0x40c  -removeonly
Google SketchUp LayOut 6-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{C12D609B-EB71-411B-82C3-9BE6D40435D7}\setup.exe" -l0x40c  -removeonly
Google SketchUp Pro 6-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{12E75B98-8463-4C1F-8DDA-F6CF31566A55}\setup.exe" -l0x40c  -removeonly
Google Update Helper-->MsiExec.exe /I{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}
Google Earth-->MsiExec.exe /X{CC016F21-3970-11DE-B878-005056806466}
High Definition Audio Driver Package - KB888111-->"C:\WINDOWS\$NtUninstallKB888111WXPSP2$\spuninst\spuninst.exe"
HijackThis 2.0.2-->"C:\Documents and Settings\Administrateur\Bureau\HijackThis.exe" /uninstall
IKEA Home Planner-->MsiExec.exe /I{AFA9D219-A7FD-4240-8793-E5C7C9D715F4}
Java(TM) 6 Update 6-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160060}
Labtec WebCam-->MsiExec.exe /I{58E653BE-BD68-4D68-BB2E-3AE1B925AAD0}
Lecteur Windows Media 10-->"C:\Program Files\Windows Media Player\Setup_wm.exe" /Uninstall
Microsoft .NET Framework 1.1 Hotfix (KB928366)-->"C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Updates\hotfix.exe" "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Updates\M928366\M928366Uninstall.msp"
Microsoft .NET Framework 1.1-->msiexec.exe /X {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
Microsoft .NET Framework 1.1-->MsiExec.exe /X{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
Microsoft .NET Framework 2.0-->C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.exe
Microsoft Office Professional Edition 2003-->MsiExec.exe /I{9011040C-6000-11D3-8CFE-0150048383C9}
Microsoft Plus! Digital Media Edition-->MsiExec.exe /I{C6A7AF96-4EB1-4AAE-8318-1AB393C64F88}
Microsoft Plus! pour Windows XP-->MsiExec.exe /I{EEC2DAFD-5558-40AC-8E9C-5005C8F810E8}
Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{7299052b-02a4-4627-81f2-1818da5d550d}
Mise à jour de sécurité pour Lecteur Windows Media (KB911564)-->"C:\WINDOWS\$NtUninstallKB911564$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Lecteur Windows Media 10 (KB936782)-->"C:\WINDOWS\$NtUninstallKB936782_WMP10$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Lecteur Windows Media 6.4 (KB925398)-->"C:\WINDOWS\$NtUninstallKB925398_WMP64$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB890046)-->"C:\WINDOWS\$NtUninstallKB890046$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB893756)-->"C:\WINDOWS\$NtUninstallKB893756$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB896358)-->"C:\WINDOWS\$NtUninstallKB896358$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB896423)-->"C:\WINDOWS\$NtUninstallKB896423$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB896428)-->"C:\WINDOWS\$NtUninstallKB896428$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB899587)-->"C:\WINDOWS\$NtUninstallKB899587$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB899591)-->"C:\WINDOWS\$NtUninstallKB899591$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB900725)-->"C:\WINDOWS\$NtUninstallKB900725$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB901017)-->"C:\WINDOWS\$NtUninstallKB901017$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB901214)-->"C:\WINDOWS\$NtUninstallKB901214$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB902400)-->"C:\WINDOWS\$NtUninstallKB902400$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB905414)-->"C:\WINDOWS\$NtUninstallKB905414$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB905749)-->"C:\WINDOWS\$NtUninstallKB905749$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB908519)-->"C:\WINDOWS\$NtUninstallKB908519$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB911562)-->"C:\WINDOWS\$NtUninstallKB911562$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB911927)-->"C:\WINDOWS\$NtUninstallKB911927$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB913580)-->"C:\WINDOWS\$NtUninstallKB913580$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB914388)-->"C:\WINDOWS\$NtUninstallKB914388$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB914389)-->"C:\WINDOWS\$NtUninstallKB914389$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB918118)-->"C:\WINDOWS\$NtUninstallKB918118$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB918439)-->"C:\WINDOWS\$NtUninstallKB918439$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB919007)-->"C:\WINDOWS\$NtUninstallKB919007$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB920213)-->"C:\WINDOWS\$NtUninstallKB920213$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB920670)-->"C:\WINDOWS\$NtUninstallKB920670$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB920683)-->"C:\WINDOWS\$NtUninstallKB920683$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB920685)-->"C:\WINDOWS\$NtUninstallKB920685$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB922819)-->"C:\WINDOWS\$NtUninstallKB922819$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB923191)-->"C:\WINDOWS\$NtUninstallKB923191$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB923414)-->"C:\WINDOWS\$NtUninstallKB923414$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB923689)-->"C:\WINDOWS\$NtUninstallKB923689$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB923980)-->"C:\WINDOWS\$NtUninstallKB923980$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB924270)-->"C:\WINDOWS\$NtUninstallKB924270$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB924496)-->"C:\WINDOWS\$NtUninstallKB924496$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB924667)-->"C:\WINDOWS\$NtUninstallKB924667$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB925902)-->"C:\WINDOWS\$NtUninstallKB925902$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB926255)-->"C:\WINDOWS\$NtUninstallKB926255$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB926436)-->"C:\WINDOWS\$NtUninstallKB926436$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB927779)-->"C:\WINDOWS\$NtUninstallKB927779$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB927802)-->"C:\WINDOWS\$NtUninstallKB927802$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB928255)-->"C:\WINDOWS\$NtUninstallKB928255$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB928843)-->"C:\WINDOWS\$NtUninstallKB928843$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB929123)-->"C:\WINDOWS\$NtUninstallKB929123$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB930178)-->"C:\WINDOWS\$NtUninstallKB930178$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB931261)-->"C:\WINDOWS\$NtUninstallKB931261$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB931784)-->"C:\WINDOWS\$NtUninstallKB931784$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB932168)-->"C:\WINDOWS\$NtUninstallKB932168$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB933729)-->"C:\WINDOWS\$NtUninstallKB933729$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB935839)-->"C:\WINDOWS\$NtUninstallKB935839$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB935840)-->"C:\WINDOWS\$NtUninstallKB935840$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB936021)-->"C:\WINDOWS\$NtUninstallKB936021$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB937894)-->"C:\WINDOWS\$NtUninstallKB937894$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB938127)-->"C:\WINDOWS\$NtUninstallKB938127$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB941202)-->"C:\WINDOWS\$NtUninstallKB941202$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB941568)-->"C:\WINDOWS\$NtUninstallKB941568$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB941569)-->"C:\WINDOWS\$NtUninstallKB941569$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB941644)-->"C:\WINDOWS\$NtUninstallKB941644$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB941693)-->"C:\WINDOWS\$NtUninstallKB941693$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB943055)-->"C:\WINDOWS\$NtUninstallKB943055$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB943460)-->"C:\WINDOWS\$NtUninstallKB943460$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB943485)-->"C:\WINDOWS\$NtUninstallKB943485$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB944338)-->"C:\WINDOWS\$NtUninstallKB944338$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB944653)-->"C:\WINDOWS\$NtUninstallKB944653$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB945553)-->"C:\WINDOWS\$NtUninstallKB945553$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB946026)-->"C:\WINDOWS\$NtUninstallKB946026$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB947864)-->"C:\WINDOWS\$NtUninstallKB947864$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB948590)-->"C:\WINDOWS\$NtUninstallKB948590$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB948881)-->"C:\WINDOWS\$NtUninstallKB948881$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB950749)-->"C:\WINDOWS\$NtUninstallKB950749$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB950759)-->"C:\WINDOWS\$NtUninstallKB950759$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB950760)-->"C:\WINDOWS\$NtUninstallKB950760$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB950762)-->"C:\WINDOWS\$NtUninstallKB950762$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB950974)-->"C:\WINDOWS\$NtUninstallKB950974$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB951066)-->"C:\WINDOWS\$NtUninstallKB951066$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB951376)-->"C:\WINDOWS\$NtUninstallKB951376$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB951376-v2)-->"C:\WINDOWS\$NtUninstallKB951376-v2$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB951698)-->"C:\WINDOWS\$NtUninstallKB951698$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB951748)-->"C:\WINDOWS\$NtUninstallKB951748$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB952954)-->"C:\WINDOWS\$NtUninstallKB952954$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB953838)-->"C:\WINDOWS\$NtUninstallKB953838$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB953839)-->"C:\WINDOWS\$NtUninstallKB953839$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB894391)-->"C:\WINDOWS\$NtUninstallKB894391$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB898461)-->"C:\WINDOWS\$NtUninstallKB898461$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB900485)-->"C:\WINDOWS\$NtUninstallKB900485$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB908531)-->"C:\WINDOWS\$NtUninstallKB908531$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB910437)-->"C:\WINDOWS\$NtUninstallKB910437$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB911280)-->"C:\WINDOWS\$NtUninstallKB911280$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB916595)-->"C:\WINDOWS\$NtUninstallKB916595$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB920872)-->"C:\WINDOWS\$NtUninstallKB920872$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB922582)-->"C:\WINDOWS\$NtUninstallKB922582$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB927891)-->"C:\WINDOWS\$NtUninstallKB927891$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB930916)-->"C:\WINDOWS\$NtUninstallKB930916$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB938828)-->"C:\WINDOWS\$NtUninstallKB938828$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB942763)-->"C:\WINDOWS\$NtUninstallKB942763$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB951072-v2)-->"C:\WINDOWS\$NtUninstallKB951072-v2$\spuninst\spuninst.exe"
Mozilla Firefox (3.0.10)-->C:\Program Files\Mozilla Firefox\uninstall\helper.exe
MSXML 4.0 SP2 (KB936181)-->MsiExec.exe /I{C04E32E0-0416-434D-AFB9-6969D703A9EF}
MSXML 6.0 Parser-->MsiExec.exe /I{AEB9948B-4FF2-47C9-990E-47014492A0FE}
Nero 6 Ultra Edition-->C:\Program Files\Ahead
ero\uninstall\UNNERO.exe /UNINSTALL
NVIDIA Drivers-->C:\WINDOWS\system32
vudisp.exe UninstallGUI
NVIDIA ForceWare Network Access Manager-->C:\PROGRA~1\FICHIE~1\INSTAL~1\Driver\9\INTEL3~1\IDriver.exe /M{1F6423DE-7959-4178-80E0-023C7EAA5347} /l1036 
OpenOffice.org Installer 1.0-->MsiExec.exe /X{3A2AF807-9F9F-43C9-A24A-17B617238B74}
Package de pilotes Windows - Advanced Micro Devices (AmdK8) Processor  (05/27/2006 1.3.2.0)-->C:\PROGRA~1\DIFX\7B44739871F4D539FA473F57A832EA4B6A59EF06\DPInst.exe /d /u C:\WINDOWS\system32\DRVSTORE\amdk8_1F9DE4E49C97F59EE9F75C34E0E91E568FC9EEB2\amdk8.inf
Panda ActiveScan 2.0-->C:\Program Files\Panda Security\ActiveScan 2.0\as2uninst.exe
PDF Settings-->MsiExec.exe /I{AC5B0C19-D851-42F4-BDA0-410ECF7F70A5}
Pinnacle Instant DVD Recorder-->C:\Program Files\InstallShield Installation Information\{EF781A5C-58F5-4BFD-87F9-E4F14D382F25}\setup.exe -runfromtemp -l0x040cUNINSTALL -removeonly
PL-2303 USB-to-Serial-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}\Setup.exe" -l0x9 Installed
PowerDVD-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}\Setup.exe"  -uninstall
Programme de gestion Camera de Logitech®-->"C:\Program Files\Fichiers communs\Labtec\QCDRV\BIN\SETUP.EXE" UNINSTALL REMOVEPROMPT
QuickTime-->C:\WINDOWS\unvise32qt.exe C:\WINDOWS\system32\QuickTime\Uninstall.log
Realtek High Definition Audio Driver-->RtlUpd.exe -r -m
Skype™ 3.8-->MsiExec.exe /X{5C82DAE5-6EB0-4374-9254-BE3319BA4E82}
Studio 11-->C:\Program Files\InstallShield Installation Information\{110B1ADF-2EAE-4E8F-B501-D2A1E6D8ED9D}\Setup2.exe -runfromtemp -l0x040c UNINSTALL -removeonly
Sumatra PDF reader-->"C:\Program Files\SumatraPDF\uninstall.exe"
TightVNC 1.3.9-->"C:\Program Files\TightVNC\unins000.exe"
TL-WN321G Wireless Utility-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{B468AE7B-C667-4073-BED8-EAD17D5EE08C}\setup.exe" -l0x9  -removeonly
VC80CRTRedist - 8.0.50727.762-->MsiExec.exe /I{767CC44C-9BBC-438D-BAD3-FD4595DD148B}
Winamp-->"C:\Program Files\Winamp\UninstWA.exe"
Windows Installer 3.1 (KB893803)-->"C:\WINDOWS\$MSI31Uninstall_KB893803v2$\spuninst\spuninst.exe"
Windows Live installer-->MsiExec.exe /X{FD44E544-E7D0-4DBA-9FA0-8AE1A1300390}
Windows Live Messenger-->MsiExec.exe /X{BADF6744-3787-48F6-B8C9-4C4995401D65}
Windows Media Format Runtime-->"C:\Program Files\Windows Media Player\wmsetsdk.exe" /UninstallAll
Yahoo! Desktop Login-->MsiExec.exe /I{F9AEEC34-CF00-4CBD-9E36-DF9DC4002685}

======Security center information======

AV: AVG Anti-Virus Free (disabled) (outdated)

======System event log======

Computer Name: CHRISTEL
Event Code: 1009
Message: Une erreur de réseau s'est produite lors de la tentative d'envoi d'un message. Le code d'erreur est : Une opération de blocage a été interrompue par un appel à WSACancelBlockingCall.
.

Record Number: 5
Source Name: Dhcp
Time Written: 20090520223433.000000+120
Event Type: Avertissement
User: 

Computer Name: CHRISTEL
Event Code: 4201
Message: Le système a détecté que la carte réseau \DEVICE\TCPIP_{C73E1C62-3107-4C45-94EC-6C21FF1D1162} était connectée au réseau,
et a lancé une opération normale sur la carte réseau.

Record Number: 4
Source Name: Tcpip
Time Written: 20090520223432.000000+120
Event Type: Informations
User: 

Computer Name: CHRISTEL
Event Code: 1002
Message: Le bail de l'adresse IP 192.168.1.20 pour la carte réseau dont l'adresse réseau est 0019E018CA11
a été refusé par le serveur DHCP 192.168.2.1 (celui-ci a envoyé un message DHCPNACK).

Record Number: 3
Source Name: Dhcp
Time Written: 20090520223429.000000+120
Event Type: erreur
User: 

Computer Name: CHRISTEL
Event Code: 6005
Message: Le service d'Enregistrement d'événement a démarré.

Record Number: 2
Source Name: EventLog
Time Written: 20090520223427.000000+120
Event Type: Informations
User: 

Computer Name: CHRISTEL
Event Code: 6009
Message: Microsoft (R) Windows (R) 5.01. 2600 Service Pack 2 Multiprocessor Free.

Record Number: 1
Source Name: EventLog
Time Written: 20090520223427.000000+120
Event Type: Informations
User: 

=====Application event log=====

Computer Name: CHRISTEL
Event Code: 1102
Message: .NET Runtime Optimization Service (clr_optimization_v2.0.50727_32) - Succesfully compiled: System.Transactions, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089


Record Number: 716
Source Name: .NET Runtime Optimization Service
Time Written: 20080928134423.000000+120
Event Type: 
User: 

Computer Name: CHRISTEL
Event Code: 1100
Message: .NET Runtime Optimization Service (clr_optimization_v2.0.50727_32) - Began compiling: System.Transactions, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089


Record Number: 715
Source Name: .NET Runtime Optimization Service
Time Written: 20080928134422.000000+120
Event Type: Informations
User: 

Computer Name: CHRISTEL
Event Code: 1102
Message: .NET Runtime Optimization Service (clr_optimization_v2.0.50727_32) - Succesfully compiled: System.Security, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a


Record Number: 714
Source Name: .NET Runtime Optimization Service
Time Written: 20080928134422.000000+120
Event Type: 
User: 

Computer Name: CHRISTEL
Event Code: 1100
Message: .NET Runtime Optimization Service (clr_optimization_v2.0.50727_32) - Began compiling: System.Security, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a


Record Number: 713
Source Name: .NET Runtime Optimization Service
Time Written: 20080928134421.000000+120
Event Type: Informations
User: 

Computer Name: CHRISTEL
Event Code: 1102
Message: .NET Runtime Optimization Service (clr_optimization_v2.0.50727_32) - Succesfully compiled: System.EnterpriseServices, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a


Record Number: 712
Source Name: .NET Runtime Optimization Service
Time Written: 20080928134421.000000+120
Event Type: 
User: 

======Environment variables======

"ComSpec"=%SystemRoot%\system32\cmd.exe
"Path"=%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem;C:\Program Files\Fichiers communs\Autodesk Shared\
"windir"=%SystemRoot%
"FP_NO_HOST_CHECK"=NO
"OS"=Windows_NT
"PROCESSOR_ARCHITECTURE"=x86
"PROCESSOR_LEVEL"=15
"PROCESSOR_IDENTIFIER"=x86 Family 15 Model 107 Stepping 2, AuthenticAMD
"PROCESSOR_REVISION"=6b02
"NUMBER_OF_PROCESSORS"=2
"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
"TEMP"=%SystemRoot%\TEMP
"TMP"=%SystemRoot%\TEMP

-----------------EOF-----------------

gen-hackman · Answer

######## | XP _ Instal & recherche | #######


Telecharge et install UsbFix (de C_XX & Chiquitine29)

Branche tes sources de données externes à ton PC, (clé USB, disque dur externe, etc...) susceptibles d avoir été infectés sans les ouvrir

# Double clic sur le raccourci UsbFix présent sur ton bureau .

# Choisi l option 1 ( Recherche )

# Laisse travailler l outil.

# Ensuite post le rapport UsbFix.txt qui apparaitra.

# Note : Le rapport UsbFix.txt est sauvegardé a la racine du disque. ( C:\UsbFix.txt )

( CTRL+A Pour tout selectionner , CTRL+C pour copier et CTRL+V pour coller ) 

# Note : "Process.exe", une composante de l'outil, est détecté par certains antivirus (AntiVir, Dr.Web, Kaspersky Anti-Virus) comme étant un RiskTool. 
          Il ne s'agit pas d'un virus, mais d'un utilitaire destiné à mettre fin à des processus. 
          Mis entre de mauvaises mains, cet utilitaire pourrait arrêter des logiciels de sécurité (Antivirus, Firewall...) d'où l'alerte émise par ces antivirus.

DaKoala · Answer

On branche rien sur ce pc d'externe. J'ai TP-link, c'est ma clé internet wifi et le scanner de temps en temps.
Dois-je quand même faire ca?

DaKoala · Answer

############################## [ UsbFix V3.028 | Scan ]

# User : Administrateur (Administrateurs) # CHRISTEL
# Update on 02/06/09 by Chiquitine29, C_XX & Chimay8
# WebSite : http://pagesperso-orange.fr/NosTools/usbfix.html
# Start at: 16:55:18 | 03/06/2009

# AMD Athlon(tm) 64 X2 Dual Core Processor 4400+
# Microsoft Windows XP Professionnel (5.1.2600 32-bit) # Service Pack 2
# Internet Explorer 6.0.2900.2180
# Windows Firewall Status : Enabled
# AV : AVG Anti-Virus Free 8.0 [ (!) Disabled | (!) Outdated ]

# A:\ # Lecteur de disquettes 3 ½ pouces
# C:\ # Disque fixe local # 74,52 Go (56,72 Go free) # NTFS
# D:\ # Disque fixe local # 372,61 Go (78,7 Go free) [DATA] # NTFS
# E:\ # Disque CD-ROM
# G:\ # Disque CD-ROM # 3,11 Go (0 Mo free) [MASTER COLLECTIO] # CDFS

############################## [ Processus actifs ]

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\ATKKBService.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin
SvcLog.exe
C:\WINDOWS\system32
vsvc32.exe
C:\Program Files\Google\Update\GoogleUpdate.exe
C:\Program Files\Alcohol Soft\Alcohol 52\StarWind\StarWindServiceAE.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin
SvcIp.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32mctrl.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\WINDOWS\system32undll32.exe
C:\Program Files\Logitech\Video\LogiTray.exe
C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe
C:\Program Files\CyberLink\PowerDVD9\PDVD9Serv.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIBZE.EXE
C:\WINDOWS\system32\LVComS.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\WISPTIS.EXE
C:\Program Files\TP-LINK\TL-WN321G Wireless Utility\Installer\WINXP\TWCU.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe

################## [  Registre Startup ]

HKCU_Main:   "Local Page"="C:\WINDOWS\system32\blank.htm" 
HKCU_Main:   "Search Page"="https://www.google.com/?gws_rd=ssl" 
HKCU_Main:   "Start Page"="https://www.google.fr/?gws_rd=ssl" 
HKLM_logon:  "Userinit"="C:\WINDOWS\system32\userinit.exe," 
HKLM_logon:  "DefaultUserName"="Administrateur" 
HKLM_logon:  "AltDefaultUserName"="Administrateur" 
HKLM_logon:  "LegalNoticeCaption"="" 
HKLM_logon:  "LegalNoticeText"="" 
HKLM_Run:    RemoteControl=C:\WINDOWS\system32mctrl.exe 
HKLM_Run:    QuickTime Task="C:\Program Files\QuickTime\qttask.exe" -atboottime 
HKLM_Run:    NeroFilterCheck=C:\WINDOWS\system32\NeroCheck.exe 
HKLM_Run:    NvCplDaemon=RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup 
HKLM_Run:    nwiz=nwiz.exe /install 
HKLM_Run:    NvMediaCenter=RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit 
HKLM_Run:    AVG8_TRAY=C:\PROGRA~1\AVG\AVG8\avgtray.exe 
HKLM_Run:    RTHDCPL=RTHDCPL.EXE 
HKLM_Run:    Alcmtr=ALCMTR.EXE 
HKLM_Run:    amd_dc_opt=C:\Program Files\AMD\Dual-Core Optimizer\amd_dc_opt.exe 
HKLM_Run:    LogitechVideoRepair=C:\Program Files\Logitech\Video\ISStart.exe 
HKLM_Run:    LogitechVideoTray=C:\Program Files\Logitech\Video\LogiTray.exe 
HKLM_Run:    SunJavaUpdateSched="C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe" 
HKLM_Run:    PCLEUSBTip=C:\Program Files\Pinnacle\Shared Files\Programs\USBTip\USBTip.exe 
HKLM_Run:    USB2Check=RUNDLL32.EXE "C:\WINDOWS\system32\PCLECoInst.dll",CheckUSBController 
HKLM_Run:    RemoteControl9="C:\Program Files\CyberLink\PowerDVD9\PDVD9Serv.exe" 
HKLM_Run:    PDVD9LanguageShortcut="C:\Program Files\CyberLink\PowerDVD9\Language\Language.exe" 
HKLM_Run:    HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversionun\OptionalComponents= 
HKCU_Run:    CTFMON.EXE=C:\WINDOWS\system32\ctfmon.exe  
HKCU_Run:    AlcoholAutomount="C:\Program Files\Alcohol Soft\Alcohol 52\axcmd.exe" /automount  
HKCU_Run:    MsnMsgr="C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background  
HKCU_Run:    EPSON Stylus D92 Series=C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIBZE.EXE /FU "C:\WINDOWS\TEMP\E_S2AA.tmp" /EF "HKCU"  
HKCU_Run:    Skype="C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized  
HKCU_Run:    LaunchList=C:\Program Files\Pinnacle\Studio 11\LaunchList2.exe  
HKCU_Run:    HKEY_CURRENT_USER\software\microsoft\windows\currentversionun\AdobeUpdater=  

################## [ Fichiers # Dossiers infectieux ]


################## [ Registre # Clés Run infectieuses ]


################## [ Registre # Mountpoints2 ]

HKCU\...\Explorer\MountPoints2\{61bc08c8-96f4-11dd-9989-0019e018ca11}\Shell\AutoRun\Command  
HKCU\...\Explorer\MountPoints2\{61bc08c8-96f4-11dd-9989-0019e018ca11}\Shell\explore\Command  
HKCU\...\Explorer\MountPoints2\{61bc08c8-96f4-11dd-9989-0019e018ca11}\Shell\open\Command  
HKCU\...\Explorer\MountPoints2\{77fe145e-42f8-11de-a581-001d6027cd1d}\Shell\AutoRun\Command  
HKCU\...\Explorer\MountPoints2\{77fe145e-42f8-11de-a581-001d6027cd1d}\Shell\explore\Command  
HKCU\...\Explorer\MountPoints2\{77fe145e-42f8-11de-a581-001d6027cd1d}\Shell\open\Command  
HKCU\...\Explorer\MountPoints2\{c51322d0-5c32-11dd-9964-001d6027cd1d}\Shell\Auto\Command  
HKCU\...\Explorer\MountPoints2\{c51322d0-5c32-11dd-9964-001d6027cd1d}\Shell\AutoRun\Command  

################## [ ! Fin du rapport # UsbFix V3.028 ! ]


ndlr:JAI fais hijackthis et usbfix avec pandaonline qui tournais en même temps.

gen-hackman · Answer

ok si panda a fini , fais ceci :


######## | Suppression | ########

Branche tes sources de données externes à ton PC, (clé USB, disque dur externe, etc...) susceptibles d avoir été infectés sans les ouvrir

# Double clic sur le raccourci UsbFix présent sur ton bureau

# choisi l option 2 ( Suppression )

# Ton bureau disparaitra et le pc redémarrera .

# Au redémarrage , UsbFix scannera ton pc , laisse travailler l outil.

# Ensuite post le rapport UsbFix.txt qui apparaitra avec le bureau .

# Note : Le rapport UsbFix.txt est sauvegardé a la racine du disque.( C:\UsbFix.txt )

( CTRL+A Pour tout selectionner , CTRL+C pour copier et CTRL+V pour coller ) 


######### | Désinstallation | #######


# Double clic sur le raccourci UsbFix présent sur ton bureau

# Choisi l option Désinstaller  ....

DaKoala · Answer

trop lent panda :/ je suis a 34%, il m'a deja trouver 13files infected et 13vulnerabilities... 
J'arrete et jfais ton truc.

DaKoala · Answer

############################## [ UsbFix V3.028 | Cleaning ]

# User : Administrateur (Administrateurs) # CHRISTEL
# Update on 02/06/09 by Chiquitine29, C_XX & Chimay8
# WebSite : http://pagesperso-orange.fr/NosTools/usbfix.html
# Start at: 17:34:51 | 03/06/2009

# AMD Athlon(tm) 64 X2 Dual Core Processor 4400+
# Microsoft Windows XP Professionnel (5.1.2600 32-bit) # Service Pack 2
# Internet Explorer 6.0.2900.2180
# Windows Firewall Status : Enabled
# AV : AVG Anti-Virus Free 8.0 [ (!) Disabled | (!) Outdated ]

# A:\ # Lecteur de disquettes 3 ½ pouces
# C:\ # Disque fixe local # 74,52 Go (56,73 Go free) # NTFS
# D:\ # Disque fixe local # 372,61 Go (78,7 Go free) [DATA] # NTFS
# E:\ # Disque CD-ROM
# G:\ # Disque CD-ROM

############################## [ Processus actifs ]

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\logonui.exe
C:\WINDOWS\ATKKBService.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
C:\Program Files\Google\Update\GoogleUpdate.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin
SvcLog.exe
C:\Program Files\Google\Update\GoogleUpdate.exe
C:\Program Files\Google\Update\GoogleUpdate.exe
C:\WINDOWS\system32
vsvc32.exe
C:\Program Files\Alcohol Soft\Alcohol 52\StarWind\StarWindServiceAE.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin
SvcIp.exe
C:\WINDOWS\system32\userinit.exe
C:\Program Files\Google\Update\GoogleUpdate.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\WINDOWS\System32\alg.exe

################## [ Fichiers # Dossiers infectieux ]


################## [ Registre # Clés Run infectieuses ]


################## [ Registre # Mountpoints2 ]

Deleted ! HKCU\...\Explorer\MountPoints2\{61bc08c8-96f4-11dd-9989-0019e018ca11}\Shell\AutoRun\Command  
Deleted ! HKCU\...\Explorer\MountPoints2\{77fe145e-42f8-11de-a581-001d6027cd1d}\Shell\AutoRun\Command  
Deleted ! HKCU\...\Explorer\MountPoints2\{c51322d0-5c32-11dd-9964-001d6027cd1d}\Shell\Auto\Command  

################## [ Listing des fichiers présent ]

[25/04/2008 18:58|--a------|1024] - C:\.rnd
[28/03/2009 11:46|--a------|95] - C:\AUTOEXEC.BAT
[25/04/2008 20:12|-r-hs----|224] - C:\boot.ini
[31/10/2004 14:00|-rahs----|4952] - C:\Bootfont.bin
[25/04/2008 18:26|--a------|0] - C:\CONFIG.SYS
[25/04/2008 18:26|-rahs----|0] - C:\IO.SYS
[25/04/2008 18:26|-rahs----|0] - C:\MSDOS.SYS
[31/10/2004 14:00|-rahs----|47564] - C:\NTDETECT.COM
[31/10/2004 14:00|-rahs----|251712] - C:
tldr
[?|?|?] - C:\pagefile.sys
[25/04/2008 19:02|--a------|575] - C:\RHDSetup.log
[28/03/2009 19:12|--ah-----|268] - C:\sqmdata00.sqm
[29/03/2009 02:36|--ah-----|268] - C:\sqmdata01.sqm
[29/03/2009 02:45|--ah-----|268] - C:\sqmdata02.sqm
[04/04/2009 19:28|--ah-----|268] - C:\sqmdata03.sqm
[16/04/2009 02:41|--ah-----|268] - C:\sqmdata04.sqm
[17/05/2009 17:03|--ah-----|268] - C:\sqmdata05.sqm
[20/05/2009 21:38|--ah-----|268] - C:\sqmdata06.sqm
[04/05/2009 04:39|--ah-----|268] - C:\sqmdata07.sqm
[05/05/2009 20:20|--ah-----|268] - C:\sqmdata08.sqm
[12/05/2009 03:41|--ah-----|268] - C:\sqmdata09.sqm
[16/05/2009 01:40|--ah-----|268] - C:\sqmdata10.sqm
[22/05/2009 00:49|--ah-----|268] - C:\sqmdata11.sqm
[20/05/2009 22:35|--ah-----|268] - C:\sqmdata12.sqm
[14/03/2009 09:19|--ah-----|268] - C:\sqmdata13.sqm
[15/03/2009 19:04|--ah-----|268] - C:\sqmdata14.sqm
[20/03/2009 02:00|--ah-----|268] - C:\sqmdata15.sqm
[27/03/2009 11:45|--ah-----|268] - C:\sqmdata16.sqm
[28/03/2009 12:08|--ah-----|268] - C:\sqmdata17.sqm
[28/03/2009 19:04|--ah-----|268] - C:\sqmdata18.sqm
[28/03/2009 19:08|--ah-----|268] - C:\sqmdata19.sqm
[28/03/2009 19:12|--ah-----|244] - C:\sqmnoopt00.sqm
[29/03/2009 02:36|--ah-----|244] - C:\sqmnoopt01.sqm
[29/03/2009 02:45|--ah-----|244] - C:\sqmnoopt02.sqm
[04/04/2009 19:28|--ah-----|244] - C:\sqmnoopt03.sqm
[16/04/2009 02:41|--ah-----|244] - C:\sqmnoopt04.sqm
[17/05/2009 17:03|--ah-----|244] - C:\sqmnoopt05.sqm
[20/05/2009 21:38|--ah-----|244] - C:\sqmnoopt06.sqm
[04/05/2009 04:39|--ah-----|244] - C:\sqmnoopt07.sqm
[05/05/2009 20:20|--ah-----|244] - C:\sqmnoopt08.sqm
[12/05/2009 03:41|--ah-----|244] - C:\sqmnoopt09.sqm
[16/05/2009 01:40|--ah-----|244] - C:\sqmnoopt10.sqm
[22/05/2009 00:49|--ah-----|244] - C:\sqmnoopt11.sqm
[20/05/2009 22:35|--ah-----|244] - C:\sqmnoopt12.sqm
[14/03/2009 09:19|--ah-----|244] - C:\sqmnoopt13.sqm
[15/03/2009 19:04|--ah-----|244] - C:\sqmnoopt14.sqm
[20/03/2009 02:00|--ah-----|244] - C:\sqmnoopt15.sqm
[27/03/2009 11:45|--ah-----|244] - C:\sqmnoopt16.sqm
[28/03/2009 12:08|--ah-----|244] - C:\sqmnoopt17.sqm
[28/03/2009 19:04|--ah-----|244] - C:\sqmnoopt18.sqm
[28/03/2009 19:08|--ah-----|244] - C:\sqmnoopt19.sqm
[03/06/2009 17:35|--a------|5369] - C:\UsbFix.txt
[16/06/2008 15:36|--a------|15624] - D:\AR-1213623371187.pdf
[21/05/2008 12:47|--a------|20] - D:\cle-wifi.txt
[30/09/2008 19:56|--a------|108281] - D:\permis-conduire-chris.jpg
[16/06/2008 12:48|--a------|199123] - D:\permis-conduire-ju.jpg
[01/12/2008 20:57|--ahs----|25088] - D:\Thumbs.db

################## [ Vaccination ]

# C:\autorun.inf ( # Not infected ) -> Folder created by UsbFix.  
# D:\autorun.inf ( # Not infected ) -> Folder created by UsbFix.  

################## [ ! Fin du rapport # UsbFix V3.028 ! ] 

volivola

gen-hackman · Answer

tu n as pas braanché tous tes peripheriques (cle usb , mp3 , sdcard , mp4 , 
disk dur externe)

il manque le lecteur F

DaKoala · Answer

jlai branche plus sur ce pc dc ya pas besoin, nan ?

gen-hackman · Answer

je prefere si car :

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{61bc08c8-96f4-11dd-9989-0019e018ca11}]
shell\AutoRun\command - F:\
shell\explore\command - F:\RECYCLED\INFO.exe
shell\open\command - F:\RECYCLED\INFO.exe 

grosse infection venant du lecteur F:\

DaKoala · Answer

Jviens de faire l'analyse. Tu mfais peur : F c mon dd externe de sauvegarde avec trop trucs important dessus :/


############################## [ UsbFix V3.028 | Scan ]

# User : Administrateur (Administrateurs) # CHRISTEL
# Update on 02/06/09 by Chiquitine29, C_XX & Chimay8
# WebSite : http://pagesperso-orange.fr/NosTools/usbfix.html
# Start at: 18:39:44 | 03/06/2009

# AMD Athlon(tm) 64 X2 Dual Core Processor 4400+
# Microsoft Windows XP Professionnel (5.1.2600 32-bit) # Service Pack 2
# Internet Explorer 6.0.2900.2180
# Windows Firewall Status : Enabled
# AV : AVG Anti-Virus Free 8.0 [ (!) Disabled | (!) Outdated ]

# A:\ # Lecteur de disquettes 3 ½ pouces
# C:\ # Disque fixe local # 74,52 Go (58,33 Go free) # NTFS
# D:\ # Disque fixe local # 372,61 Go (78,7 Go free) [DATA] # NTFS
# E:\ # Disque CD-ROM
# F:\ # Disque fixe local # 298,09 Go (13,01 Go free) [Volume] # NTFS
# G:\ # Disque CD-ROM
# H:\ # Disque amovible # 1,91 Go (1,21 Go free) # FAT32

############################## [ Processus actifs ]

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\savedump.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\ATKKBService.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin
SvcLog.exe
C:\Program Files\Google\Update\GoogleUpdate.exe
C:\WINDOWS\system32
vsvc32.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alcohol Soft\Alcohol 52\StarWind\StarWindServiceAE.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin
SvcIp.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32mctrl.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\Program Files\Logitech\Video\LogiTray.exe
C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe
C:\Program Files\CyberLink\PowerDVD9\PDVD9Serv.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32undll32.exe
C:\Program Files\TP-LINK\TL-WN321G Wireless Utility\Installer\WINXP\TWCU.exe
C:\WINDOWS\system32\LVComS.exe
C:\WINDOWS\system32\wuauclt.exe
F:\RavMonE.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe

################## [  Registre Startup ]

HKCU_Main:   "Local Page"="C:\WINDOWS\system32\blank.htm" 
HKCU_Main:   "Search Page"="https://www.google.com/?gws_rd=ssl" 
HKCU_Main:   "Start Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome" 
HKCU_Main:   "Window Title"="" 
HKLM_logon:  "Userinit"="C:\WINDOWS\system32\userinit.exe," 
HKLM_logon:  "DefaultUserName"="Administrateur" 
HKLM_logon:  "AltDefaultUserName"="Administrateur" 
HKLM_logon:  "LegalNoticeCaption"="" 
HKLM_logon:  "LegalNoticeText"="" 
HKLM_Run:    RemoteControl=C:\WINDOWS\system32mctrl.exe 
HKLM_Run:    QuickTime Task="C:\Program Files\QuickTime\qttask.exe" -atboottime 
HKLM_Run:    NeroFilterCheck=C:\WINDOWS\system32\NeroCheck.exe 
HKLM_Run:    NvCplDaemon=RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup 
HKLM_Run:    nwiz=nwiz.exe /install 
HKLM_Run:    NvMediaCenter=RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit 
HKLM_Run:    AVG8_TRAY=C:\PROGRA~1\AVG\AVG8\avgtray.exe 
HKLM_Run:    RTHDCPL=RTHDCPL.EXE 
HKLM_Run:    Alcmtr=ALCMTR.EXE 
HKLM_Run:    amd_dc_opt=C:\Program Files\AMD\Dual-Core Optimizer\amd_dc_opt.exe 
HKLM_Run:    LogitechVideoRepair=C:\Program Files\Logitech\Video\ISStart.exe 
HKLM_Run:    LogitechVideoTray=C:\Program Files\Logitech\Video\LogiTray.exe 
HKLM_Run:    SunJavaUpdateSched="C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe" 
HKLM_Run:    PCLEUSBTip=C:\Program Files\Pinnacle\Shared Files\Programs\USBTip\USBTip.exe 
HKLM_Run:    USB2Check=RUNDLL32.EXE "C:\WINDOWS\system32\PCLECoInst.dll",CheckUSBController 
HKLM_Run:    RemoteControl9="C:\Program Files\CyberLink\PowerDVD9\PDVD9Serv.exe" 
HKLM_Run:    PDVD9LanguageShortcut="C:\Program Files\CyberLink\PowerDVD9\Language\Language.exe" 
HKLM_Run:    RavAV=C:\WINDOWS\RavMonE.exe 
HKLM_Run:    HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversionun\OptionalComponents= 
HKCU_Run:    CTFMON.EXE=C:\WINDOWS\system32\ctfmon.exe  
HKCU_Run:    AlcoholAutomount="C:\Program Files\Alcohol Soft\Alcohol 52\axcmd.exe" /automount  
HKCU_Run:    MsnMsgr="C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background  
HKCU_Run:    EPSON Stylus D92 Series=C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIBZE.EXE /FU "C:\WINDOWS\TEMP\E_S2AA.tmp" /EF "HKCU"  
HKCU_Run:    Skype="C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized  
HKCU_Run:    LaunchList=C:\Program Files\Pinnacle\Studio 11\LaunchList2.exe  
HKCU_Run:    HKEY_CURRENT_USER\software\microsoft\windows\currentversionun\AdobeUpdater=  

################## [ Fichiers # Dossiers infectieux ]

Found ! F:avmone.exe  
Found ! F:\RavMonLog  
Found ! F:\autorun.inf  
Found ! F:\msvcr71.dll  
Found ! "F:avmonlog"  
H:\autorun.inf # -> fichier appelé : "H:\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013\sndrv.exe" ( présent ! )  
Found ! H:\NADFOLDER\autorun.exe  
Found ! H:\autorun.inf  
Found ! "H:\NADFOLDER"  
Found ! "H:\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013"  

################## [ Registre # Clés Run infectieuses ]

Found ! HKLM\Software\Microsoft\Windows\CurrentVersion\Run "RavAV"    

################## [ Registre # Mountpoints2 ]

HKCU\...\Explorer\MountPoints2\{cbb24fd5-2e87-11dd-994b-001d6027cd1d}\Shell\Auto\Command  
HKCU\...\Explorer\MountPoints2\{cbb24fd5-2e87-11dd-994b-001d6027cd1d}\Shell\AutoRun\Command  

################## [ ! Fin du rapport # UsbFix V3.028 ! ]

gen-hackman · Answer

ben tu vois qu il est tres infecté et H:\ aussi :

Found ! F:\ravmone.exe
Found ! F:\RavMonLog
Found ! F:\autorun.inf
Found ! F:\msvcr71.dll
Found ! "F:\ravmonlog"
H:\autorun.inf # -> fichier appelé : "H:\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013\sndrv.exe" ( présent ! )
Found ! H:\NADFOLDER\autorun.exe
Found ! H:\autorun.inf
Found ! "H:\NADFOLDER"
Found ! "H:\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013" 

 fais l option 2

DaKoala · Answer

fait, ci-joint le log


############################## [ UsbFix V3.028 | Cleaning ]

# User : Administrateur (Administrateurs) # CHRISTEL
# Update on 02/06/09 by Chiquitine29, C_XX & Chimay8
# WebSite : http://pagesperso-orange.fr/NosTools/usbfix.html
# Start at: 20:19:07 | 03/06/2009

# AMD Athlon(tm) 64 X2 Dual Core Processor 4400+
# Microsoft Windows XP Professionnel (5.1.2600 32-bit) # Service Pack 2
# Internet Explorer 6.0.2900.2180
# Windows Firewall Status : Enabled
# AV : AVG Anti-Virus Free 8.0 [ (!) Disabled | (!) Outdated ]

# A:\ # Lecteur de disquettes 3 ½ pouces
# C:\ # Disque fixe local # 74,52 Go (58,33 Go free) # NTFS
# D:\ # Disque fixe local # 372,61 Go (78,7 Go free) [DATA] # NTFS
# E:\ # Disque CD-ROM
# F:\ # Disque fixe local # 298,09 Go (13,18 Go free) [Volume] # NTFS
# G:\ # Disque CD-ROM
# H:\ # Disque amovible # 1,91 Go (1,2 Go free) # FAT32

############################## [ Processus actifs ]

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\ATKKBService.exe
C:\WINDOWS\system32\logonui.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
C:\Program Files\Google\Update\GoogleUpdate.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin
SvcLog.exe
C:\Program Files\Google\Update\GoogleUpdate.exe
C:\Program Files\Google\Update\GoogleUpdate.exe
C:\WINDOWS\system32
vsvc32.exe
C:\Program Files\Alcohol Soft\Alcohol 52\StarWind\StarWindServiceAE.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\WINDOWS\system32\userinit.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin
SvcIp.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
C:\Program Files\Google\Update\GoogleUpdate.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\WINDOWS\System32\alg.exe

################## [ Fichiers # Dossiers infectieux ]

Deleted ! F:avmone.exe    
Deleted ! F:\RavMonLog    
Deleted ! F:\autorun.inf    
Deleted ! F:\msvcr71.dll    
Deleted ! H:\NADFOLDER\autorun.exe    
Deleted ! H:avmone.exe    
Deleted ! H:\autorun.inf    
Deleted ! H:\msvcr71.dll    
Deleted ! "H:\NADFOLDER"    
Deleted ! "H:\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013"    

################## [ Registre # Clés Run infectieuses ]

Deleted ! HKLM\Software\Microsoft\Windows\CurrentVersion\Run "RavAV"    

################## [ Registre # Mountpoints2 ]


################## [ Listing des fichiers présent ]

[25/04/2008 18:58|--a------|1024] - C:\.rnd
[28/03/2009 11:46|--a------|95] - C:\AUTOEXEC.BAT
[25/04/2008 20:12|-r-hs----|224] - C:\boot.ini
[31/10/2004 14:00|-rahs----|4952] - C:\Bootfont.bin
[25/04/2008 18:26|--a------|0] - C:\CONFIG.SYS
[25/04/2008 18:26|-rahs----|0] - C:\IO.SYS
[25/04/2008 18:26|-rahs----|0] - C:\MSDOS.SYS
[31/10/2004 14:00|-rahs----|47564] - C:\NTDETECT.COM
[31/10/2004 14:00|-rahs----|251712] - C:
tldr
[?|?|?] - C:\pagefile.sys
[25/04/2008 19:02|--a------|575] - C:\RHDSetup.log
[28/03/2009 19:12|--ah-----|268] - C:\sqmdata00.sqm
[29/03/2009 02:36|--ah-----|268] - C:\sqmdata01.sqm
[29/03/2009 02:45|--ah-----|268] - C:\sqmdata02.sqm
[04/04/2009 19:28|--ah-----|268] - C:\sqmdata03.sqm
[16/04/2009 02:41|--ah-----|268] - C:\sqmdata04.sqm
[17/05/2009 17:03|--ah-----|268] - C:\sqmdata05.sqm
[20/05/2009 21:38|--ah-----|268] - C:\sqmdata06.sqm
[04/05/2009 04:39|--ah-----|268] - C:\sqmdata07.sqm
[05/05/2009 20:20|--ah-----|268] - C:\sqmdata08.sqm
[12/05/2009 03:41|--ah-----|268] - C:\sqmdata09.sqm
[16/05/2009 01:40|--ah-----|268] - C:\sqmdata10.sqm
[22/05/2009 00:49|--ah-----|268] - C:\sqmdata11.sqm
[20/05/2009 22:35|--ah-----|268] - C:\sqmdata12.sqm
[14/03/2009 09:19|--ah-----|268] - C:\sqmdata13.sqm
[15/03/2009 19:04|--ah-----|268] - C:\sqmdata14.sqm
[20/03/2009 02:00|--ah-----|268] - C:\sqmdata15.sqm
[27/03/2009 11:45|--ah-----|268] - C:\sqmdata16.sqm
[28/03/2009 12:08|--ah-----|268] - C:\sqmdata17.sqm
[28/03/2009 19:04|--ah-----|268] - C:\sqmdata18.sqm
[28/03/2009 19:08|--ah-----|268] - C:\sqmdata19.sqm
[28/03/2009 19:12|--ah-----|244] - C:\sqmnoopt00.sqm
[29/03/2009 02:36|--ah-----|244] - C:\sqmnoopt01.sqm
[29/03/2009 02:45|--ah-----|244] - C:\sqmnoopt02.sqm
[04/04/2009 19:28|--ah-----|244] - C:\sqmnoopt03.sqm
[16/04/2009 02:41|--ah-----|244] - C:\sqmnoopt04.sqm
[17/05/2009 17:03|--ah-----|244] - C:\sqmnoopt05.sqm
[20/05/2009 21:38|--ah-----|244] - C:\sqmnoopt06.sqm
[04/05/2009 04:39|--ah-----|244] - C:\sqmnoopt07.sqm
[05/05/2009 20:20|--ah-----|244] - C:\sqmnoopt08.sqm
[12/05/2009 03:41|--ah-----|244] - C:\sqmnoopt09.sqm
[16/05/2009 01:40|--ah-----|244] - C:\sqmnoopt10.sqm
[22/05/2009 00:49|--ah-----|244] - C:\sqmnoopt11.sqm
[20/05/2009 22:35|--ah-----|244] - C:\sqmnoopt12.sqm
[14/03/2009 09:19|--ah-----|244] - C:\sqmnoopt13.sqm
[15/03/2009 19:04|--ah-----|244] - C:\sqmnoopt14.sqm
[20/03/2009 02:00|--ah-----|244] - C:\sqmnoopt15.sqm
[27/03/2009 11:45|--ah-----|244] - C:\sqmnoopt16.sqm
[28/03/2009 12:08|--ah-----|244] - C:\sqmnoopt17.sqm
[28/03/2009 19:04|--ah-----|244] - C:\sqmnoopt18.sqm
[28/03/2009 19:08|--ah-----|244] - C:\sqmnoopt19.sqm
[03/06/2009 20:19|--a------|5612] - C:\UsbFix.txt
[16/06/2008 15:36|--a------|15624] - D:\AR-1213623371187.pdf
[21/05/2008 12:47|--a------|20] - D:\cle-wifi.txt
[30/09/2008 19:56|--a------|108281] - D:\permis-conduire-chris.jpg
[16/06/2008 12:48|--a------|199123] - D:\permis-conduire-ju.jpg
[01/12/2008 20:57|--ahs----|25088] - D:\Thumbs.db
[26/05/2009 11:07|--a------|125440] - H:\CV 1.doc
[25/05/2009 11:38|--a------|140932] - H:\carte-identite.jpg
[25/05/2009 11:38|--a------|397392] - H:\Master.jpg
[03/06/2009 18:36|--a------|1616] - H:\BOOTEX.LOG

################## [ Vaccination ]

# C:\autorun.inf ( # Not infected ) -> Folder created by UsbFix.  
# D:\autorun.inf ( # Not infected ) -> Folder created by UsbFix.  
# F:\autorun.inf ( # Not infected ) -> Folder created by UsbFix.  
# H:\autorun.inf ( # Not infected ) -> Folder created by UsbFix.  

################## [ ! Fin du rapport # UsbFix V3.028 ! ]

gen-hackman · Answer

bien relance rsit

DaKoala · Answer

Oki je relance RSIT

DaKoala · Answer

Logfile of random's system information tool 1.06 (written by random/random)
Run by Administrateur at 2009-06-04 15:12:15
Microsoft Windows XP Professionnel Service Pack 2
System drive C: has 60 GB (78%) free of 76 GB
Total RAM: 2047 MB (71% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:12:20, on 04/06/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\ATKKBService.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin
SvcLog.exe
C:\Program Files\Google\Update\GoogleUpdate.exe
C:\WINDOWS\system32
vsvc32.exe
C:\Program Files\Alcohol Soft\Alcohol 52\StarWind\StarWindServiceAE.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin
SvcIp.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
C:\WINDOWS\explorer.exe
C:\Program Files\TP-LINK\TL-WN321G Wireless Utility\Installer\WINXP\TWCU.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\WISPTIS.EXE
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Administrateur\Bureau\RSIT.exe
C:\Documents and Settings\Administrateur\Bureau\Administrateur.exe

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://www.google.fr/?gws_rd=ssl
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O4 - HKLM\..\Run: [RemoteControl] C:\WINDOWS\system32mctrl.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [amd_dc_opt] C:\Program Files\AMD\Dual-Core Optimizer\amd_dc_opt.exe
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe"
O4 - HKLM\..\Run: [PCLEUSBTip] C:\Program Files\Pinnacle\Shared Files\Programs\USBTip\USBTip.exe
O4 - HKLM\..\Run: [USB2Check] RUNDLL32.EXE "C:\WINDOWS\system32\PCLECoInst.dll",CheckUSBController
O4 - HKLM\..\Run: [RemoteControl9] "C:\Program Files\CyberLink\PowerDVD9\PDVD9Serv.exe"
O4 - HKLM\..\Run: [PDVD9LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD9\Language\Language.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [AlcoholAutomount] "C:\Program Files\Alcohol Soft\Alcohol 52\axcmd.exe" /automount
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [EPSON Stylus D92 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIBZE.EXE /FU "C:\WINDOWS\TEMP\E_S2AA.tmp" /EF "HKCU"
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [LaunchList] C:\Program Files\Pinnacle\Studio 11\LaunchList2.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: AutoCAD Startup Accelerator.lnk = C:\Program Files\Fichiers communs\Autodesk Shared\acstart16.exe
O4 - Global Startup: TL-WN321G Wireless Utility.lnk = C:\Program Files\TP-LINK\TL-WN321G Wireless Utility\Installer\WINXP\TWCU.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll
O23 - Service: ATK Keyboard Service (ATKKeyboardService) - ASUSTeK COMPUTER INC. - C:\WINDOWS\ATKKBService.exe
O23 - Service: Autodesk Licensing Service - Autodesk, Inc. - C:\Program Files\Fichiers communs\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Fichiers communs\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Forceware Web Interface (ForcewareWebInterface) - Apache Software Foundation - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
O23 - Service: Google Update Service (gupdate1c9ae45a4f55dd0) (gupdate1c9ae45a4f55dd0) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: ForceWare IP service (nSvcIp) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin
SvcIp.exe
O23 - Service: ForceWare user log service (nSvcLog) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin
SvcLog.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exe
O23 - Service: PCLEPCI - Pinnacle Systems GmbH - C:\WINDOWS\system32\drivers\pclepci.sys
O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 52\StarWind\StarWindServiceAE.exe

gen-hackman · Answer

---> Désactive ton antivirus le temps de la manipulation car OTM est détecté comme une infection à tort. 

---> Télécharge OTM (OldTimer) sur ton Bureau : 

---> Double-clique sur OTM.exe afin de le lancer. 

---> Copie (Ctrl+C) le texte suivant ci-dessous : 





:processes 
explorer.exe

:services
acx4lvfe
Bonjour Service

:files
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\Adobe Gamma Loader.lnk
C:\WINDOWS\RavMonE.exe

:reg
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7E853D72-626A-48EC-A868-BA8D5E23E045}]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"QuickTime Task"=-
"NeroFilterCheck"=-
"nwiz"=-
"RTHDCPL"=-
"Alcmtr"=-
"USB2Check"=-
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"MsnMsgr"=-
"Skype"=-
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot
etwork\{1a3e09be-1e45-494b-9174-d7385b45bbf5}]



:commands 
[purity] 
[emptytemp] 
[start explorer] 
[reboot] 





---> Colle (Ctrl+V) le texte précédemment copié dans le cadre Paste Instructions for Items to be Moved. 

---> Clique maintenant sur le bouton MoveIt! puis ferme OTM 

Si un fichier ou dossier ne peut pas être supprimé immédiatement, le logiciel te demandera de redémarrer. 
Accepte en cliquant sur YES. 

---> Poste le rapport situé dans ce dossier : C:\_OTM\MovedFiles\ 
Le nom du rapport correspond au moment de sa création : date_heure.log

DaKoala · Answer

Voilavoila. jaimerais juste un peu comprendre ce que je fais mais bon...
merci du suivi
DaKoala



========== PROCESSES ==========
Process explorer.exe killed successfully.
========== SERVICES/DRIVERS ==========
Service\Driver acx4lvfe not found.
Service\Driver acx4lvfe not found.
Service\Driver Bonjour Service stopped successfully.
Service\Driver Bonjour Service deleted successfully.
========== FILES ==========
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\Adobe Gamma Loader.lnk moved successfully.
C:\WINDOWS\RavMonE.exe moved successfully.
========== REGISTRY ==========
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7E853D72-626A-48EC-A868-BA8D5E23E045}\ deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\QuickTime Task deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\NeroFilterCheck deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\nwiz deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\RTHDCPL deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\Alcmtr deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\USB2Check deleted successfully.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\MsnMsgr deleted successfully.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\Skype deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot
etwork\{1a3e09be-1e45-494b-9174-d7385b45bbf5}\ deleted successfully.
========== COMMANDS ==========
File delete failed. C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\etilqs_lAwd8VHsDhkUiEm04sFM scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\~DF550B.tmp scheduled to be deleted on reboot.
User's Temp folder emptied.
User's Internet Explorer cache folder emptied.
File delete failed. C:\Documents and Settings\Administrateur\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
User's Temporary Internet Files folder emptied.
Local Service Temp folder emptied.
File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
Local Service Temporary Internet Files folder emptied.
Network Service Temp folder emptied.
File delete failed. C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
Network Service Temporary Internet Files folder emptied.
Windows Temp folder emptied.
Java cache emptied.
File delete failed. C:\Documents and Settings\Administrateur\Local Settings\Application Data\Mozilla\Firefox\Profiles\le0qrzay.default\Cache\_CACHE_001_ scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Administrateur\Local Settings\Application Data\Mozilla\Firefox\Profiles\le0qrzay.default\Cache\_CACHE_002_ scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Administrateur\Local Settings\Application Data\Mozilla\Firefox\Profiles\le0qrzay.default\Cache\_CACHE_003_ scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Administrateur\Local Settings\Application Data\Mozilla\Firefox\Profiles\le0qrzay.default\Cache\_CACHE_MAP_ scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Administrateur\Local Settings\Application Data\Mozilla\Firefox\Profiles\le0qrzay.default\urlclassifier3.sqlite scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Administrateur\Local Settings\Application Data\Mozilla\Firefox\Profiles\le0qrzay.default\XUL.mfl scheduled to be deleted on reboot.
FireFox cache emptied.
Temp folders emptied.
Explorer started successfully
 
OTM by OldTimer - Version 2.1.0.0 log created on 06052009_150659

Files moved on Reboot...
File C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\etilqs_lAwd8VHsDhkUiEm04sFM not found!
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\~DF550B.tmp moved successfully.
C:\Documents and Settings\Administrateur\Local Settings\Application Data\Mozilla\Firefox\Profiles\le0qrzay.default\Cache\_CACHE_001_ moved successfully.
C:\Documents and Settings\Administrateur\Local Settings\Application Data\Mozilla\Firefox\Profiles\le0qrzay.default\Cache\_CACHE_002_ moved successfully.
C:\Documents and Settings\Administrateur\Local Settings\Application Data\Mozilla\Firefox\Profiles\le0qrzay.default\Cache\_CACHE_003_ moved successfully.
C:\Documents and Settings\Administrateur\Local Settings\Application Data\Mozilla\Firefox\Profiles\le0qrzay.default\Cache\_CACHE_MAP_ moved successfully.
C:\Documents and Settings\Administrateur\Local Settings\Application Data\Mozilla\Firefox\Profiles\le0qrzay.default\urlclassifier3.sqlite moved successfully.
C:\Documents and Settings\Administrateur\Local Settings\Application Data\Mozilla\Firefox\Profiles\le0qrzay.default\XUL.mfl moved successfully.

Registry entries deleted on Reboot...

DaKoala · Answer

J'ai plus d'antivirus a jour. Je veux virer AVG antivirus free pour mettre Avira antivir free. Qu'en penses-tu ?
Jcrois que ma copine a pas réussi à virer l'AVG.

gen-hackman · Answer

ce que tu fais ?

tu utilises des petits logiciels qui permettent la desinfection et le perfectionnement de ton pc afin que tu repartes satisfait :) dans le meilleur du possible :)

Rsit : Logiciel de diagnostic etendu permettant de reprer les infections et les anomalies systeme et programme (precision de de 1 à 10 = 7)

USBFix : comme son nom l'indique il eradique les infections par transmission usb d'abord mais aussi tout un tas de petits programmes nefastes au bon fonctionnement 

OTM :permet de supprimer des programmes au demarrage ,donc d'alleger l'ordi au boot , ainsi que de supprimer des fichiers/dossiers inutiles ou nefastes , ommis par les logiciels de desinfection 

Malwarebytes :sert a peaufiner en fin de desinfection 


Imprime ces instructions car il faudra fermer toutes les fenêtres et applications lors de l'installation et de l'analyse.



Télécharges :

Malwarebytes  

ou  :

Malwarebytes

* Installe le ( choisis bien "francais" ; ne modifie pas les paramètres d'installe ) et mets le à jour .

(NB : S'il te manque "COMCTL32.OCX" lors de l'installe, alors télécharge le ici : COMCTL32.OCX

* Potasses le Tuto pour te familiariser avec le prg :


( cela dit, il est très simple d'utilisation ).

relance malwarebytes en suivant scrupuleusement ces consignes :

! Déconnecte toi et ferme toutes applications en cours !

* Lance Malwarebyte's .

Fais un examen dit "Complet" .

--> Laisse le programme travailler ( et ne rien faire d'autre avec le PC durant le scan ).
--> à la fin tu cliques sur "résultat" .
--> Vérifie que tous les objets infectés soient validés, puis clique sur " suppression " .

Note : si il faut redémarrer ton PC pour finir le nettoyage, fais le !


Poste le rapport sauvegardé après la suppression des objets infectés (dans l'onglet "rapport/log"de Malwarebytes, le dernier en date)

DaKoala · Answer

Voilavoila. Jai pas virer antispy. ca doit etre un vieux programme. Ca sent pas lvirus ca.
Par contre jai essayer de virer AVG free: impossible. Erreur qui fait redemarrer a la fin dla disinstalle sans que le programme soit virer. Jvoulais remplacer avg par avira . Qu'en pensestu?


Malwarebytes' Anti-Malware 1.37
Version de la base de données: 2233
Windows 5.1.2600 Service Pack 2

05/06/2009 16:37:03
mbam-log-2009-06-05 (16-36-52).txt

Type de recherche: Examen complet (C:\|D:\|)
Eléments examinés: 281851
Temps écoulé: 1 hour(s), 2 minute(s), 51 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 1
Fichier(s) infecté(s): 1

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
C:\Program Files\antispy (Rogue.AntiSpy) -> No action taken.

Fichier(s) infecté(s):
c:\program files\antispy\xp-AntiSpy.exe (Rogue.AntiSpy) -> No action taken.

DaKoala · Answer

Merci dm'avoir expliquer sque jfaisais... me sent vraiment moins mouton même si ca reste le cas ;D !

gen-hackman · Answer

je peux avoir le rapport apres suppression de Malwarebytes

C:\Program Files\antispy (Rogue.AntiSpy)-> No action taken.

avg est pas degueu pour un gratuit mais si tu veux le desinstall regarde ici :


Désinstallation Antivirus , Parefeu , Antispyware

DaKoala · Answer

Jarrive pas a supprimer avg malgré le tuto... il me sort cette erreur. Que faire? Il me faut un antivirus absolument :S

Machine locale: l'installation a échoué
    Initialisation :
        Avertissement: Echec de la vérification de l'état de l'élément fichier avgsched.log.
            Echec de l'ouverture du fichier. %FILE% = "øÅoocuments and Settings\All Users\Application Data\avg8\Log\avgsched.log"
                Error 0xe001042c
    Installation :
        Erreur: Echec de l'opération fichier avgsched.log: création d'une sauvegarde....
            Error 0x80070005 %DESTINATION% = "C:\Documents and Settings\All Users\Application Data\avg8\Log\avgsched.log.install_backup", %SOURCE% = "C:\Documents and Settings\All Users\Application Data\avg8\Log\avgsched.log"

Jte renvoie un malwarebytes Log!

DaKoala · Answer

Si je supprime tout avg sans faire la desinstallation cad juste jeter les fichiers avg , ca marche?? ou c pa un bon process? Il me faut o moins un antivirus sinon jvais reprendre un truc illico je sens :/ ?

gen-hackman · Answer

oui mais il faut virer les cles aussi



==> Télécharge  OAD (de Laur3n7!)

- Enregistre le sur ton bureau

Double clique sur le OAD pour le lancer

- nom de fichier à rechercher ,tapes : AVG
- Type de recherche : sélectionne l'option 6 puis valide [entree]

OAD va maintenant rechercher le fichier. Laisse le travailler jusqu'à ce qu'il en ai terminé.
Le rapport de recherche s'affichera automatiquement à dès qu'il en aura terminé.

- Fais un copier / coller de ce rapport dans ton prochain post.

Note importante : Suivant la taille des disques dur cette recherche peut prendre plusieurs minutes. Sois patient

DaKoala · Answer

trop long le log , jle fais en deux temps...

 05/06/2009 ---- 20:27:55,21  

----------------------------------
§§§§§§ [AVG] §§§§§§
----------------------------------
[X] Registre
 
-------------- [  ] rapide
-- Fichier --- [  ] disque systeme
 ------------- [X] complete


********************
     [Registre] 
********************


[HKEY_LOCAL_MACHINE\SOFTWARE\AVG]

[HKEY_LOCAL_MACHINE\SOFTWARE\AVG\Avg8]

[HKEY_LOCAL_MACHINE\SOFTWARE\AVG\Avg8]
"AvgDir"="C:\Program Files\AVG\AVG8"

[HKEY_LOCAL_MACHINE\SOFTWARE\AVG\Avg8]
"AvgAllUsersDir"="C:\Documents and Settings\All Users\Application Data\avg8"

[HKEY_LOCAL_MACHINE\SOFTWARE\AVG\Avg8\EMC]

[HKEY_LOCAL_MACHINE\SOFTWARE\AVG\Avg8\EMC]
"Log"="C:\Documents and Settings\All Users\Application Data\avg8\Emc\Log"

[HKEY_LOCAL_MACHINE\SOFTWARE\AVG\Avg8\LinkScanner]

[HKEY_LOCAL_MACHINE\SOFTWARE\AVG\Avg8\LinkScanner]
"AppPath"="C:\Program Files\AVG\AVG8"

[HKEY_LOCAL_MACHINE\SOFTWARE\AVG\Avg8\LinkScanner]
"LocalIcons"="C:\Program Files\AVG\AVG8\Icons"

[HKEY_LOCAL_MACHINE\SOFTWARE\AVG\Avg8\LinkScanner]
"ControlFile"="C:\Program Files\AVG\AVG8\cf.dat"

[HKEY_LOCAL_MACHINE\SOFTWARE\AVG\Avg8\LinkScanner\Prevalence]

[HKEY_LOCAL_MACHINE\SOFTWARE\AVG\Avg8\LinkScanner\Prevalence]
"LocalPath"="C:\Documents and Settings\All Users\Application Data\avg8\Lsdb\Prev"

[HKEY_LOCAL_MACHINE\SOFTWARE\AVG\Avg8\LinkScanner\SiteBlocker]

[HKEY_LOCAL_MACHINE\SOFTWARE\AVG\Avg8\LinkScanner\SiteBlocker]
"BLSigFile"="C:\Program Files\AVG\AVG8\sb.dat"

[HKEY_LOCAL_MACHINE\SOFTWARE\AVG\Avg8\LinkScanner\SploitChecker]

[HKEY_LOCAL_MACHINE\SOFTWARE\AVG\Avg8\LinkScanner\SploitChecker]
"SigFile"="C:\Program Files\AVG\AVG8\sc.dat"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\AVG8 Shell Extension]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AVG.Kernel.7]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AVG.Kernel.7]
@="AVG 7 Compatibility Class"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AVG.Kernel.7\CLSID]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AVG.Office]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AVG.Office]
@="AVG plugin for the Microsoft Office"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AVG.Office\CLSID]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AVG.Office\CurVer]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AVG.Office\CurVer]
@="AVG.Office.8"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AVG.Office.8]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AVG.Office.8]
@="AVG plugin for the Microsoft Office"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AVG.Office.8\CLSID]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AVGeneralNotification.AVGeneralNotification]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AVGeneralNotification.AVGeneralNotification]
@="AVGeneralNotification Class"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AVGeneralNotification.AVGeneralNotification\CurVer]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AVGeneralNotification.AVGeneralNotification\CurVer]
@="AVGeneralNotification.AVGeneralNotification.1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AVGeneralNotification.AVGeneralNotification.1]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AVGeneralNotification.AVGeneralNotification.1]
@="AVGeneralNotification Class"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AVGeneralNotification.AVGeneralNotification.1\CLSID]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{04373D9C-5ED8-44f2-BA00-7895D6A5A2DA}]
@="AVG plugin for the Microsoft Office"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{04373D9C-5ED8-44f2-BA00-7895D6A5A2DA}\InprocServer32]
@="C:\Program Files\AVG\AVG8\avgoff2k.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{04373D9C-5ED8-44f2-BA00-7895D6A5A2DA}\ProgID]
@="AVG.Office.8"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{04373D9C-5ED8-44f2-BA00-7895D6A5A2DA}\VersionIndependentProgID]
@="AVG.Office"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{239A3C5E-8D41-11D1-B675-00C04FA3C554}]
@="AVGeneralNotification Class"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{239A3C5E-8D41-11D1-B675-00C04FA3C554}\ProgID]
@="AVGeneralNotification.AVGeneralNotification.1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{239A3C5E-8D41-11D1-B675-00C04FA3C554}\VersionIndependentProgID]
@="AVGeneralNotification.AVGeneralNotification"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{41564737-3200-1071-989B-0000E87B4FB1}]
@="AVG 7 Compatibility Class"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{41564737-3200-1071-989B-0000E87B4FB1}\InprocServer32]
@="C:\Program Files\AVG\AVG8\avg7api.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{41564737-3200-1071-989B-0000E87B4FB1}\ProgID]
@="AVG.Kernel.7"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{41564737-3200-1071-989B-0000E87B4FB1}\VersionIndependentProgID]
@="AVG.Kernel"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9F97547E-4609-42C5-AE0C-81C61FFAEBC3}]
@="AVG8 Shell Extension Class"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9F97547E-4609-42C5-AE0C-81C61FFAEBC3}\InprocServer32]
@="C:\Program Files\AVG\AVG8\avgse.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\AVG8 Shell Extension]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\piffile\shellex\ContextMenuHandlers\AVG8 Shell Extension]

[HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update
etwork\secure-S-1-5-18]
"c"="c=ANcH4TK-9-luxnx7-XibYQOAwEEvSZa1Djtl1uxYUDv2JHh-Hl7thdkbhLDF9HR043yKkshAvG99ZMn0EsTRIeSv2t4i4um9gA"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\11.0\Registration\{9011040C-6000-11D3-8CFE-0150048383C9}]
"Current1"="QwBPAE4AVABSAEEAVAAgAEQARQAgAEwASQBDAEUATgBDAEUAIABVAFQASQBMAEkAUwBBAFQARQBVAFIAIABGAEkATgBBAEwAIABQAE8AVQBSACAATABPAEcASQBDAEkARQBMACAATQBJAEMAUgBPAFMATwBGAFQACgBJAE0AUABPAFIAVABBAE4AVACgABQgoADAACAATABJAFIARQAgAEEAVABUAEUATgBUAEkAVgBFAE0ARQBOAFQAoAA6ACAATABlACAAcAByAOkAcwBlAG4AdAAgAEMAbwBuAHQAcgBhAHQAIABkAGUAIABMAGkAYwBlAG4AYwBlACAAVQB0AGkAbABpAHMAYQB0AGUAdQByACAARgBpAG4AYQBsACAAKABsAGUAIACrAKAAQwBMAFUARgCgALsAKQAgAGMAbwBuAHMAdABpAHQAdQBlACAAdQBuACAAYwBvAG4AdAByAGEAdAAgAGUAbgB0AHIAZQAgAHYAbwB1AHMAIAAoAHAAZQByAHMAbwBuAG4AZQAgAHAAaAB5AHMAaQBxAHUAZQAgAG8AdQAgAHAAZQByAHMAbwBuAG4AZQAgAG0AbwByAGEAbABlACAAdQBuAGkAcQB1AGUAKQAgAGUAdAAgAE0AaQBjAHIAbwBzAG8AZgB0ACAAQwBvAHIAcABvAHIAYQB0AGkAbwBuACAAcABvAHIAdABhAG4AdAAgAHMAdQByACAAbABlACAAbABvAGcAaQBjAGkAZQBsACAATQBpAGMAcgBvAHMAbwBmAHQAIABxAHUAaQAgAGEAYwBjAG8AbQBwAGEAZwBuAGUAIABjAGUAIABDAEwAVQBGACAAZQB0ACAAcQB1AGkAIABpAG4AYwBsAHUAdAAgAGQAZQBzACAAcwB1AHAAcABvAHIAdABzACAAYQBzAHMAbwBjAGkA6QBzACAAZQB0ACAAZABlAHMAIABzAGUAcgB2AGkAYwBlAHMAIABJAG4AdABlAHIAbgBlAHQAIABNAGkAYwByAG8AcwBvAGYAdAAgACgAbABlACAAqwCgAEwAbwBnAGkAYwBpAGUAbACgALsAKQAuACAATABlACAATABvAGcAaQBjAGkAZQBsACAAcABlAHUAdAAgAOoAdAByAGUAIABhAGMAYwBvAG0AcABhAGcAbgDpACAAZAAZIHUAbgAgAGEAdgBlAG4AYQBuAHQAIABvAHUAIABkABkgdQBuACAAYQBkAGQAZQBuAGQAdQBtACAAYQB1ACAAcAByAOkAcwBlAG4AdAAgAEMATABVAEYALgAgAEUATgAgAEkATgBTAFQAQQBMAEwAQQBOAFQALAAgAEUATgAgAEMATwBQAEkAQQBOAFQAIABPAFUAIABFAE4AIABVAFQASQBMAEkAUwBBAE4AVAAgAEwARQAgAEwATwBHAEkAQwBJAEUATAAsACAAVgBPAFUAUwAgAFIARQBDAE8ATgBOAEEASQBTAFMARQBaACAAygBUAFIARQAgAEwASQDJACAAUABBAFIAIABMAEUAUwAgAFQARQBSAE0ARQBTACAARABVACAAUABSAMkAUwBFAE4AVAAgAEMATABVAEYALgAgAFMASQAgAFYATwBVAFMAIADKAFQARQBTACAARQBOACAARADJAFMAQQBDAEMATwBSAEQAIABBAFYARQBDACAATABFAFMAIABUAEUAUgBNAEUAUwAgAEQARQAgAEMARQAgAEMATABVAEYALAAgAFYARQBVAEkATABMAEUAWgAgAE4ARQAgAFAAQQBTACAASQBOAFMAVABBAEwATABFAFIALAAgAEMATwBQAEkARQBSACAATgBJACAAVQBUAEkATABJAFMARQBSACAATABFACAATABPAEcASQBDAEkARQBMAC4AIABUAE8AVQBUAEUARgBPAEkAUwAsACAAVgBPAFUAUwAgAFAATwBVAFYARQBaACAATABFACAAUgBFAFQATwBVAFIATgBFAFIAIADAACAATAAZIEUATgBEAFIATwBJAFQAIABPANkAIABWAE8AVQBTACAAVgBPAFUAUwAgAEwAGSDKAFQARQBTACAAUABSAE8AQwBVAFIAyQAsACAAQQBGAEkATgAgAEQAGSBFAE4AIABPAEIAVABFAE4ASQBSACAATABFACAAUgBFAE0AQgBPAFUAUgBTAEUATQBFAE4AVAAgAEkATgBUAMkARwBSAEEATAAsACAATABFACAAQwBBAFMAIADJAEMASADJAEEATgBUAC4ACgAxAC4ACQBDAE8ATgBDAEUAUwBTAEkATwBOACAARABFACAATABJAEMARQBOAEMARQAuACAATQBpAGMAcgBvAHMAbwBmAHQAIAB2AG8AdQBzACAAYwBvAG4AYwDoAGQAZQAgAGwAZQBzACAAZAByAG8AaQB0AHMAIABzAHUAaQB2AGEAbgB0AHMALAAgAHMAbwB1AHMAIAByAOkAcwBlAHIAdgBlACAAcQB1AGUAIAB2AG8AdQBzACAAcgBlAHMAcABlAGMAdABpAGUAegAgAGwAGSBlAG4AcwBlAG0AYgBsAGUAIABkAGUAcwAgAHQAZQByAG0AZQBzACAAZAB1ACAAcAByAOkAcwBlAG4AdAAgAEMATABVAEYAoAA6AAoAMQAuADEACQBJAG4AcwB0AGEAbABsAGEAdABpAG8AbgAgAGUAdAAgAHUAdABpAGwAaQBzAGEAdABpAG8AbgAuACAAVgBvAHUAcwAgAOoAdABlAHMAIABhAHUAdABvAHIAaQBzAOkAIADgAKAAOgAKAAkAKABhACkAoABpAG4AcwB0AGEAbABsAGUAcgAgAGUAdAAgAHUAdABpAGwAaQBzAGUAcgAgAHUAbgAgAGUAeABlAG0AcABsAGEAaQByAGUAIABkAHUAIABMAG8AZwBpAGMAaQBlAGwAIABzAHUAcgAgAHUAbgAgAG8AcgBkAGkAbgBhAHQAZQB1AHIAIABwAGUAcgBzAG8AbgBuAGUAbAAgAG8AdQAgAHQAbwB1AHQAIABhAHUAdAByAGUAIABkAGkAcwBwAG8AcwBpAHQAaQBmAKAAOwAgAGUAdAAgAAoACQAoAGIAKQCgAGkAbgBzAHQAYQBsAGwAZQByACAAdQBuACAAZQB4AGUAbQBwAGwAYQBpAHIAZQAgAHMAdQBwAHAAbADpAG0AZQBuAHQAYQBpAHIAZQAgAGQAdQAgAEwAbwBnAGkAYwBpAGUAbAAgAHMAdQByACAAdQBuACAAYQB1AHQAcgBlACAAZABpAHMAcABvAHMAaQB0AGkAZgAgAHAAbwByAHQAYQBiAGwAZQAgAGUAbgAgAHYAdQBlACAAZABlACAAcwBvAG4AIAB1AHQAaQBsAGkAcwBhAHQAaQBvAG4AIABlAHgAYwBsAHUAcwBpAHYAZQAgAHAAYQByACAAbAAZIHUAdABpAGwAaQBzAGEAdABlAHUAcgAgAHAAcgBpAG4AYwBpAHAAYQBsACAAZABlACAAbAAZIGUAeABlAG0AcABsAGEAaQByAGUAIABvAHIAaQBnAGkAbgBhAGwAIABkAHUAIABMAG8AZwBpAGMAaQBlAGwALgAKADEALgAyAAkAQQB1AHQAcgBlAHMAIABkAHIAbwBpAHQAcwAgAHAAbwB1AHIAIABsAGUAIABzAHQAbwBjAGsAYQBnAGUALwBsABkgdQB0AGkAbABpAHMAYQB0AGkAbwBuACAAZQBuACAAcgDpAHMAZQBhAHUALgAgAEMAbwBtAG0AZQAgAGEAbAB0AGUAcgBuAGEAdABpAHYAZQAgAGEAdQB4ACAAZAByAG8AaQB0AHMAIABxAHUAaQAgAHYAbwB1AHMAIABzAG8AbgB0ACAAYwBvAG4AYwDpAGQA6QBzACAAIABkAGEAbgBzACAAbABlACAAcABhAHIAYQBnAHIAYQBwAGgAZQAgADEALgAxACgAYQApACwAIAB2AG8AdQBzACAA6gB0AGUAcwAgAGEAdQB0AG8AcgBpAHMA6QAgAOAAIABpAG4AcwB0AGEAbABsAGUAcgAgAHUAbgAgAGUAeABlAG0AcABsAGEAaQByAGUAIABkAHUAIABMAG8AZwBpAGMAaQBlAGwAIABzAHUAcgAgAHUAbgAgAGQAaQBzAHAAbwBzAGkAdABpAGYAIABkAGUAIABzAHQAbwBjAGsAYQBnAGUAIAByAOkAcwBlAGEAdQAsACAAdABlAGwAIABxAHUAGSB1AG4AIABvAHIAZABpAG4AYQB0AGUAdQByACAAcwBlAHIAdgBlAHUAcgAsACAAZQB0ACAA4AAgAHAAZQByAG0AZQB0AHQAcgBlACAA4AAgAHUAbgAgAGQAaQBzAHAAbwBzAGkAdABpAGYAIABkABkgYQBjAGMA6ABzACwAIAB0AGUAbAAgAHEAdQAZIHUAbgAgAG8AcgBkAGkAbgBhAHQAZQB1AHIAIABwAGUAcgBzAG8AbgBuAGUAbAAsACAAZAAZIGEAYwBjAOkAZABlAHIAIADgACAAbAAZIGUAeABlAG0AcABsAGEAaQByAGUAIABzAG8AdQBzACAAbABpAGMAZQBuAGMAZQAgAGQAdQAgAEwAbwBnAGkAYwBpAGUAbAAgAHMAdQByACAAdQBuACAAcgDpAHMAZQBhAHUAIABwAHIAaQB2AOkAIABlAHQAIABkAGUAIABsABkgdQB0AGkAbABpAHMAZQByAC4AIABWAG8AdQBzACAAZABlAHYAZQB6ACAAdgBvAHUAcwAgAHAAcgBvAGMAdQByAGUAcgAgAHUAbgBlACAAbABpAGMAZQBuAGMAZQAgAGQAGSB1AHQAaQBsAGkAcwBhAHQAaQBvAG4AIABkAHUAIABMAG8AZwBpAGMAaQBlAGwAIABwAG8AdQByACAAYwBoAGEAcQB1AGUAIABkAGkAcwBwAG8AcwBpAHQAaQBmACAAcwB1AHAAcABsAOkAbQBlAG4AdABhAGkAcgBlACAAcQB1AGkAIABhAGMAYwDoAGQAZQAgAGEAdQAgAEwAbwBnAGkAYwBpAGUAbAAgAGkAbgBzAHQAYQBsAGwA6QAgAHMAdQByACAAbABlACAAZABpAHMAcABvAHMAaQB0AGkAZgAgAGQAZQAgAHMAdABvAGMAawBhAGcAZQAgAHIA6QBzAGUAYQB1ACAAZQB0ACAAcQB1AGkAIABsABkgdQB0AGkAbABpAHMAZQAsACAAcwBhAHUAZgAgAGEAdQB0AG8AcgBpAHMAYQB0AGkAbwBuACAAcAByAOkAdgB1AGUAIADgACAAbAAZIGEAcgB0AGkAYwBsAGUAoAAxAC4ANAAgAGQAdQAgAHAAcgDpAHMAZQBuAHQAIABDAEwAVQBGAC4AIAAKADEALgAzAAkAQwBvAG4AYwBlAHMAcwBpAG8AbgAgAGQAZQAgAGwAaQBjAGUAbgBjAGUAIABwAG8AdQByACAAUgBlAG0AbwB0AGUAIABEAGUAcwBrAHQAbwBwAC4AIABWAG8AdQBzACAA6gB0AGUAcwAgAGEAdQB0AG8AcgBpAHMA6QAgAOAAIAB1AHQAaQBsAGkAcwBlAHIAIABkAGUAcwAgAHQAZQBjAGgAbgBvAGwAbwBnAGkAZQBzACAAZAAZIGEAYwBjAOgAcwAgAOAAIABkAGkAcwB0AGEAbgBjAGUALAAgAHQAZQBsAGwAZQBzACAAcQB1AGUAIABsAGUAcwAgAGYAbwBuAGMAdABpAG8AbgBuAGEAbABpAHQA6QBzACAAUgBlAG0AbwB0AGUAIABEAGUAcwBrAHQAbwBwACAAZABlACAATQBpAGMAcgBvAHMAbwBmAHQAIABXAGkAbgBkAG8AdwBzACAAbwB1ACAATgBlAHQATQBlAGUAdABpAG4AZwAsACAAcABvAHUAcgAgAGEAYwBjAOkAZABlAHIAIADgACAAdgBvAHQAcgBlACAAZQB4AGUAbQBwAGwAYQBpAHIAZQAgAHMAbwB1AHMAIABsAGkAYwBlAG4AYwBlACAAZAB1ACAATABvAGcAaQBjAGkAZQBsACAAZQB0ACAAcABvAHUAcgAgAGwAGSB1AHQAaQBsAGkAcwBlAHIALAAgAHMAbwB1AHMAIAByAOkAcwBlAHIAdgBlACAAcQB1AGUAIABzAGUAdQBsACAAbAAZIHUAdABpAGwAaQBzAGEAdABlAHUAcgAgAHAAcgBpAG4AYwBpAHAAYQBsACAAZAB1ACAAZABpAHMAcABvAHMAaQB0AGkAZgAgAGgA6QBiAGUAcgBnAGUAYQBuAHQAIABsAGEAIABzAGUAcwBzAGkAbwBuACAAYgB1AHIAZQBhAHUAIADgACAAZABpAHMAdABhAG4AYwBlACAAYQBjAGMA6ABkAGUAIABhAHUAIABMAG8AZwBpAGMAaQBlAGwALAAgAGUAdAAgAGwAGSB1AHQAaQBsAGkAcwBlACwAIABhAHYAZQBjACAAdQBuACAAZABpAHMAcABvAHMAaQB0AGkAZgAgAGQAGSBhAGMAYwDoAHMAIADgACAAZABpAHMAdABhAG4AYwBlAC4AIABDAGUAcwAgAGQAcgBvAGkAdABzACAAYQBwAHAAbABpAGMAYQBiAGwAZQBzACAAYQB1ACAAYgB1AHIAZQBhAHUAIADgACAAZABpAHMAdABhAG4AYwBlACAAbgBlACAAdgBvAHUAcwAgAHAAZQByAG0AZQB0AHQAZQBuAHQAIABwAGEAcwAgAGQAGSB1AHQAaQBsAGkAcwBlAHIAIABsAGUAIABMAG8AZwBpAGMAaQBlAGwAIABzAGkAbQB1AGwAdABhAG4A6QBtAGUAbgB0ACAAcwB1AHIAIABsAGUAIABkAGkAcwBwAG8AcwBpAHQAaQBmACAAaADpAGIAZQByAGcAZQBhAG4AdAAgAGwAYQAgAHMAZQBzAHMAaQBvAG4AIABiAHUAcgBlAGEAdQAgAOAAIABkAGkAcwB0AGEAbgBjAGUAIABlAHQAIABzAHUAcgAgAGwAZQAgAGQAaQBzAHAAbwBzAGkAdABpAGYAIABkABkgYQBjAGMA6ABzAC4ACgAxAC4ANAAJAEMAbwBuAGMAZQBzAHMAaQBvAG4AIABkAGUAIABsAGkAYwBlAG4AYwBlACAAcABvAHUAcgAgAFIAZQBtAG8AdABlACAAQQBzAHMAaQBzAHQAYQBuAGMAZQAuACAAVgBvAHUAcwAgAOoAdABlAHMAIABhAHUAdABvAHIAaQBzAOkAIADgACAAcABlAHIAbQBlAHQAdAByAGUAIADgACAAdABvAHUAdAAgAGQAaQBzAHAAbwBzAGkAdABpAGYAIABkABkgYQBjAGMA6QBkAGUAcgAgAOAAIAB2AG8AdAByAGUAIABlAHgAZQBtAHAAbABhAGkAcgBlACAAcwBvAHUAcwAgAGwAaQBjAGUAbgBjAGUAIABkAHUAIABMAG8AZwBpAGMAaQBlAGwAIABlAHQAIABkAGUAIABsABkgdQB0AGkAbABpAHMAZQByACAAYQB1AHgAIABzAGUAdQBsAGUAcwAgAGYAaQBuAHMAIABkAGUAIAB2AG8AdQBzACAAZgBvAHUAcgBuAGkAcgAgAHUAbgAgAHMAdQBwAHAAbwByAHQAIAB0AGUAYwBoAG4AaQBxAHUAZQAgAGUAdAAgAGQAZQBzACAAcwBlAHIAdgBpAGMAZQBzACAAZABlACAAbQBhAGkAbgB0AGUAbgBhAG4AYwBlAC4ACgAxAC4ANQAJAEMAbwBuAGMAZQBzAHMAaQBvAG4AIABkAGUAIABsAGkAYwBlAG4AYwBlACAAcABvAHUAcgAgAGwAZQBzACAAyQBsAOkAbQBlAG4AdABzACAATQB1AGwAdABpAG0A6QBkAGkAYQBzAC4AIABMAGUAIABMAG8AZwBpAGMAaQBlAGwAIABwAGUAdQB0ACAAaQBuAGMAbAB1AHIAZQAgAGMAZQByAHQAYQBpAG4AZQBzACAAcABoAG8AdABvAGcAcgBhAHAAaABpAGUAcwAsACAAaQBtAGEAZwBlAHMAIABjAGwAaQBwAGEAcgB0ACwAIABmAG8AcgBtAGUAcwAsACAAYQBuAGkAbQBhAHQAaQBvAG4AcwAsACAAbQB1AHMAaQBxAHUAZQBzACAAZQB0ACAAYwBlAHIAdABhAGkAbgBzACAAcwBvAG4AcwAgAGUAdAAgAGMAbABpAHAAcwAgAHYAaQBkAOkAbwAgAHEAdQBpACAAcwBvAG4AdAAgAGkAZABlAG4AdABpAGYAaQDpAHMAIABkAGEAbgBzACAAbABlACAATABvAGcAaQBjAGkAZQBsACAAcABvAHUAcgAgAHYAbwB0AHIAZQAgAHAAcgBvAHAAcgBlACAAdQBzAGEAZwBlACAAKABlAG4AcwBlAG0AYgBsAGUALAAgAGwAZQBzACAAqwCgAMkAbADpAG0AZQBuAHQAcwAgAE0AdQBsAHQAaQBtAOkAZABpAGEAcwCgALsAKQAuACAAVgBvAHUAcwAgAOoAdABlAHMAIABhAHUAdABvAHIAaQBzAOkAIADgACAAYwBvAHAAaQBlAHIALAAgAG0AbwBkAGkAZgBpAGUAcgAsACAAYwBvAG4AYwDpAGQAZQByACAAcwBvAHUAcwAgAGwAaQBjAGUAbgBjAGUALAAgAGEAZgBmAGkAYwBoAGUAcgAgAGUAdAAgAGQAaQBzAHQAcgBpAGIAdQBlAHIAIABsAGUAcwAgAMkAbADpAG0AZQBuAHQAcwAgAE0AdQBsAHQAaQBtAOkAZABpAGEAcwAsACAAYQBpAG4AcwBpACAAcQB1AGUAIABsAGUAcwAgAG0AbwBkAGkAZgBpAGMAYQB0AGkAbwBuAHMAIABxAHUAZQAgAHYAbwB1AHMAIABsAGUAdQByACAAYQBwAHAAbwByAHQAZQB6ACwAIABlAG4AIAB0AGEAbgB0ACAAcQB1AGUAIABwAGEAcgB0AGkAZQAgAGkAbgB0AOkAZwByAGEAbgB0AGUAIABkAGUAIAB2AG8AcwAgAHAAcgBvAGQAdQBpAHQAcwAgAGwAbwBnAGkAYwBpAGUAbABzACAAZQB0ACAAcwBlAHIAdgBpAGMAZQBzACwAIAB5ACAAYwBvAG0AcAByAGkAcwAgAHYAbwBzACAAcwBpAHQAZQBzACAAVwBlAGIALAAgAG0AYQBpAHMAIAB2AG8AdQBzACAAbgAZIOoAdABlAHMAIABwAGEAcwAgAGEAdQB0AG8AcgBpAHMA6QAgAOAAIABlAGYAZgBlAGMAdAB1AGUAcgAgAGwAZQBzACAAbwBwAOkAcgBhAHQAaQBvAG4AcwAgAHMAdQBpAHYAYQBuAHQAZQBzAKAAOgAKACIgCQBWAG8AdQBzACAAbgAZIOoAdABlAHMAIABwAGEAcwAgAGEAdQB0AG8AcgBpAHMA6QAgAOAAIAB2AGUAbgBkAHIAZQAsACAAYwBvAG4AYwDpAGQAZQByACAAcwBvAHUAcwAgAGwAaQBjAGUAbgBjAGUAIABvAHUAIABkAGkAcwB0AHIAaQBiAHUAZQByACAAZABlAHMAIABlAHgAZQBtAHAAbABhAGkAcgBlAHMAIABkAGUAcwAgAMkAbADpAG0AZQBuAHQAcwAgAE0AdQBsAHQAaQBtAOkAZABpAGEAcwAgAHMAZQB1AGwAcwAgAG8AdQAgAGQAYQBuAHMAIABsAGUAIABjAGEAZAByAGUAIABkABkgdQBuAGUAIABjAG8AbABsAGUAYwB0AGkAbwBuACwAIABkABkgdQBuACAAcAByAG8AZAB1AGkAdAAgAG8AdQAgAGQAGSB1AG4AIABzAGUAcgB2AGkAYwBlACAAZABvAG4AdAAgAGwAYQAgAHYAYQBsAGUAdQByACAAcAByAGkAbgBjAGkAcABhAGwAZQAgAHIAZQBwAG8AcwBlACAAcwB1AHIAIABsAGUAcwAgAMkAbADpAG0AZQBuAHQAcwAgAE0AdQBsAHQAaQBtAOkAZABpAGEAcwAuAAoAIiAJAFYAbwB1AHMAIABuABkg6gB0AGUAcwAgAGEAdQB0AG8AcgBpAHMA6QAgAOAAIABjAG8AbgBjAOkAZABlAHIAIABhAHUAeAAgAGMAbABpAGUAbgB0AHMAIABkAGUAIAB2AG8AdAByAGUAIABwAHIAbwBkAHUAaQB0ACAAbwB1ACAAcwBlAHIAdgBpAGMAZQAgAGEAdQBjAHUAbgAgAGQAcgBvAGkAdAAgAGQAZQAgAGMAbwBuAGMA6QBkAGUAcgAgAHMAbwB1AHMAIABsAGkAYwBlAG4AYwBlACAAbwB1ACAAZABlACAAZABpAHMAdAByAGkAYgB1AGUAcgAgAGwAZQBzACAAyQBsAOkAbQBlAG4AdABzACAATQB1AGwAdABpAG0A6QBkAGkAYQBzAC4ACgAiIAkAVgBvAHUAcwAgAG4AGSDqAHQAZQBzACAAYQB1AHQAbwByAGkAcwDpACAA4AAgAGMAbwBuAGMA6QBkAGUAcgAgAHMAbwB1AHMAIABsAGkAYwBlAG4AYwBlACAAbwB1ACAA4AAgAGQAaQBzAHQAcgBpAGIAdQBlAHIAIABhAHUAYwB1AG4AIABkAGUAcwAgAMkAbADpAG0AZQBuAHQAcwAgAE0AdQBsAHQAaQBtAOkAZABpAGEAcwAgAHEAdQBpACAAaQBuAGMAbAB1AGUAbgB0ACAAZABlAHMAIAByAGUAcAByAOkAcwBlAG4AdABhAHQAaQBvAG4AcwAgAGQAGSBpAG4AZABpAHYAaQBkAHUAcwAsACAAZABlACAAZwBvAHUAdgBlAHIAbgBlAG0AZQBuAHQAcwAsACAAZABlACAAbABvAGcAbwBzACwAIABkAGUAIABzAGkAZwBsAGUAcwAsACAAZAAZIGUAbQBiAGwA6ABtAGUAcwAsACAAZABlACAAbQBhAHIAcQB1AGUAcwAgAG8AdQAgAGQAGSBlAG4AdABpAHQA6QBzACAAaQBkAGUAbgB0AGkAZgBpAGEAYgBsAGUAcwAsACAA4AAgAGQAZQBzACAAZgBpAG4AcwAgAGMAbwBtAG0AZQByAGMAaQBhAGwAZQBzACAAbwB1ACAAcABvAHUAcgAgAGkAbgBkAGkAcQB1AGUAcgAgAGQAZQAgAGYAYQDnAG8AbgAgAGUAeABwAHIAZQBzAHMAZQAgAG8AdQAgAGkAbQBwAGwAaQBjAGkAdABlACAAbABlAHUAcgAgAGEAcwBzAG8AYwBpAGEAdABpAG8AbgAgAGEAdgBlAGMAIAB1AG4AIABwAHIAbwBkAHUAaQB0ACwAIAB1AG4AIABzAGUAcgB2AGkAYwBlACwAIAB1AG4AZQAgAGUAbgB0AGkAdADpACAAbwB1ACAAdQBuAGUAIABhAGMAdABpAHYAaQB0AOkALgAKACIgCQBWAG8AdQBzACAAbgAZIOoAdABlAHMAIABwAGEAcwAgAGEAdQB0AG8AcgBpAHMA6QAgAOAAIAB1AHQAaQBsAGkAcwBlAHIAIABsAGUAcwAgAMkAbADpAG0AZQBuAHQAcwAgAE0AdQBsAHQAaQBtAOkAZABpAGEAcwAgAHAAbwB1AHIAIABjAHIA6QBlAHIAIABkAGUAcwAgAFMBdQB2AHIAZQBzACAAbwBiAHMAYwDoAG4AZQBzACAAbwB1ACAAZABpAGYAZgBhAG0AYQB0AG8AaQByAGUAcwAsACAAdABlAGwAbABlAHMAIABxAHUAGSBlAGwAbABlAHMAIABzAG8AbgB0ACAAZADpAGYAaQBuAGkAZQBzACAAcABhAHIAIABsAGEAIABsAOkAZwBpAHMAbABhAHQAaQBvAG4AIABmAOkAZADpAHIAYQBsAGUAIABhAG0A6QByAGkAYwBhAGkAbgBlACAAYQB1ACAAbQBvAG0AZQBuAHQAIABkAGUAIABsAGUAdQByACAAYwByAOkAYQB0AGkAbwBuAC4ACgBFAG4AIABvAHUAdAByAGUALAAgAHYAbwB1AHMAIABkAGUAdgBlAHoAIAAoAGEAKQCgAGcAYQByAGEAbgB0AGkAcgAgAGUAdAAgAGQA6QBmAGUAbgBkAHIAZQAgAE0AaQBjAHIAbwBzAG8AZgB0ACAAYwBvAG4AdAByAGUAIAB0AG8AdQB0AGUAIAByAOkAYwBsAGEAbQBhAHQAaQBvAG4AIABvAHUAIABhAGMAdABpAG8AbgAgAGUAbgAgAGoAdQBzAHQAaQBjAGUALAAgAHkAIABjAG8AbQBwAHIAaQBzACAAcABvAHUAcgAgAGwAZQBzACAAaABvAG4AbwByAGEAaQByAGUAcwAgAGQAGSBhAHYAbwBjAGEAdABzACAAZQB0ACAAZABlACAAYwBvAG4AcwBlAGkAbABzACwAIABxAHUAaQAgAHIA6QBzAHUAbAB0AGUAcgBhAGkAdAAgAGQAZQAgAGwAYQAgAGMAbwBuAGMAZQBzAHMAaQBvAG4AIABkAGUAIABsAGkAYwBlAG4AYwBlACwAIABkAGUAIABsABkgdQB0AGkAbABpAHMAYQB0AGkAbwBuACAAbwB1ACAAZABlACAAbABhACAAZABpAHMAdAByAGkAYgB1AHQAaQBvAG4AIABkABkgyQBsAOkAbQBlAG4AdABzACAATQB1AGwAdABpAG0A6QBkAGkAYQBzACAAcQB1AGUAIAB2AG8AdQBzACAAYQB1AHIAaQBlAHoAIABtAG8AZABpAGYAaQDpAHMALAAgAGUAdAAgACgAYgApAKAAaQBuAGMAbAB1AHIAZQAgAHUAbgBlACAAbQBlAG4AdABpAG8AbgAgAGQAZQAgAGQAcgBvAGkAdABzACAAZAAZIGEAdQB0AGUAdQByACAAdgBhAGwAYQBiAGwAZQAgAGQAYQBuAHMAIAB2AG8AcwAgAHAAcgBvAGQAdQBpAHQAcwAgAGUAdAAgAHMAZQByAHYAaQBjAGUAcwAgAHEAdQBpACAAaQBuAGMAbAB1AGUAbgB0ACAAbABlAHMAIADJAGwA6QBtAGUAbgB0AHMAIABNAHUAbAB0AGkAbQDpAGQAaQBhAHMALgAKADEALgA2AAkAQwBvAG4AYwBlAHMAcwBpAG8AbgAgAGQAZQAgAGwAaQBjAGUAbgBjAGUAIABwAG8AdQByACAAbABhACAAZABvAGMAdQBtAGUAbgB0AGEAdABpAG8AbgAuACAATABhACAAZABvAGMAdQBtAGUAbgB0AGEAdABpAG8AbgAgAHEAdQBpACAAYQBjAGMAbwBtAHAAYQBnAG4AZQAgAGwAZQAgAEwAbwBnAGkAYwBpAGUAbAAgAGUAcwB0ACAAYwBvAG4AYwDpAGQA6QBlACAAcwBvAHUAcwAgAGwAaQBjAGUAbgBjAGUAIADgACAAdABpAHQAcgBlACAAZABlACAAcgDpAGYA6QByAGUAbgBjAGUAIABlAHQAIADgACAAZABlAHMAIABmAGkAbgBzACAAaQBuAHQAZQByAG4AZQBzACAAZQB0ACAAbgBvAG4AIABjAG8AbQBtAGUAcgBjAGkAYQBsAGUAcwAgAHUAbgBpAHEAdQBlAG0AZQBuAHQALgAKADEALgA3AAkAQwBvAG4AYwBlAHMAcwBpAG8AbgAgAGQAZQAgAGwAaQBjAGUAbgBjAGUAIABwAG8AdQByACAAbABlAHMAIABtAG8AZADoAGwAZQBzAC4AIABMAGUAIABMAG8AZwBpAGMAaQBlAGwAIABlAHMAdAAgAHMAdQBzAGMAZQBwAHQAaQBiAGwAZQAgAGQAGSBpAG4AYwBsAHUAcgBlACAAZABlAHMAIABtAG8AZADoAGwAZQBzACAAZABlACAAZABvAGMAdQBtAGUAbgB0AC4AIABWAG8AdQBzACAA6gB0AGUAcwAgAGEAdQB0AG8AcgBpAHMA6QAgAOAAIABjAG8AcABpAGUAcgAgAGUAdAAgAOAAIABtAG8AZABpAGYAaQBlAHIAIABsAGUAcwAgAG0AbwBkAOgAbABlAHMAIABkAGUAIABkAG8AYwB1AG0AZQBuAHQAIABkAGkAcwBwAG8AbgBpAGIAbABlAHMAIABkAGEAbgBzACAAbABlACAAYwBhAGQAcgBlACAAZAB1ACAAbABvAGcAaQBjAGkAZQBsACAATQBpAGMAcgBvAHMAbwBmAHQAIABxAHUAaQAgAGEAYwBjAG8AbQBwAGEAZwBuAGUAIABsAGUAIABwAHIA6QBzAGUAbgB0ACAAQwBMAFUARgAgAGUAdAAgAOAAIABkAGkAcwB0AHIAaQBiAHUAZQByACAAYwBlAHMAIABtAG8AZADoAGwAZQBzACwAIABhAGkAbgBzAGkAIABxAHUAZQAgAGwAZQBzACAAbQBvAGQAaQBmAGkAYwBhAHQAaQBvAG4AcwAgAHEAdQBlACAAdgBvAHUAcwAgAGwAZQB1AHIAIABhAHAAcABvAHIAdABlAHoALAAgAHAAbwB1AHIAIABxAHUAGSBpAGwAcwAgAHMAbwBpAGUAbgB0ACAAdQB0AGkAbABpAHMA6QBzACAAcABhAHIAIABkABkgYQB1AHQAcgBlAHMAIABsAGkAYwBlAG4AYwBpAOkAcwAgAGQAdQAgAEwAbwBnAGkAYwBpAGUAbAAuACAAVgBvAHUAcwAgAOoAdABlAHMAIADpAGcAYQBsAGUAbQBlAG4AdAAgAGEAdQB0AG8AcgBpAHMA6QAgAOAAIABjAG8AcABpAGUAcgAsACAA4AAgAG0AbwBkAGkAZgBpAGUAcgAgAGUAdAAgAOAAIABkAGkAcwB0AHIAaQBiAHUAZQByACAAbABlAHMAIABtAG8AZADoAGwAZQBzACAAZABpAHMAcABvAG4AaQBiAGwAZQBzACAAZABhAG4AcwAgAGwAZQAgAGMAYQBkAHIAZQAgAGQAZQAgAHMAZQByAHYAaQBjAGUAcwAgAEkAbgB0AGUAcgBuAGUAdAAgAGEAcwBzAG8AYwBpAOkAcwAsACAAYQBpAG4AcwBpACAAcQB1AGUAIABsAGUAcwAgAG0AbwBkAGkAZgBpAGMAYQB0AGkAbwBuAHMAIABxAHUAZQAgAHYAbwB1AHMAIABsAGUAdQByACAAYQBwAHAAbwByAHQAZQB6ACwAIABwAG8AdQByACAAcQB1ABkgaQBsAHMAIABzAG8AaQBlAG4AdAAgAHUAdABpAGwAaQBzAOkAcwAgAHAAYQByACAAZAAZIGEAdQB0AHIAZQBzACAAbABpAGMAZQBuAGMAaQDpAHMAIABkAHUAIABMAG8AZwBpAGMAaQBlAGwALAAgAG0AYQBpAHMAIAB1AG4AaQBxAHUAZQBtAGUAbgB0ACAAZQBuACAAdgB1AGUAIABkABkgdQBuAGUAIABjAG8AcgByAGUAcwBwAG8AbgBkAGEAbgBjAGUAIABwAGUAcgBzAG8AbgBuAGUAbABsAGUAIABvAHUAIABjAG8AbQBtAGUAcgBjAGkAYQBsAGUAIABpAG0AcABsAGkAcQB1AGEAbgB0ACAAdQBuAGUAIABjAG8AbQBtAHUAbgBpAGMAYQB0AGkAbwBuACAAZABlACAAcABlAHIAcwBvAG4AbgBlACAA4AAgAHAAZQByAHMAbwBuAG4AZQAuACAAVgBvAHUAcwAgAG4AGSDqAHQAZQBzACAAcABhAHMAIABhAHUAdABvAHIAaQBzAOkAIADgACAAZQBmAGYAZQBjAHQAdQBlAHIAIABsAGUAcwAgAG8AcADpAHIAYQB0AGkAbwBuAHMAIABzAHUAaQB2AGEAbgB0AGUAcwCgADoACgAiIAkAVgBvAHUAcwAgAG4AGSDqAHQAZQBzACAAcABhAHMAIABhAHUAdABvAHIAaQBzAOkAIADgACAAdgBlAG4AZAByAGUALAAgAOAAIAByAGUAdgBlAG4AZAByAGUALAAgAOAAIABjAG8AbgBjAOkAZABlAHIAIABzAG8AdQBzACAAbABpAGMAZQBuAGMAZQAsACAA4AAgAHAAcgDqAHQAZQByACwAIADgACAAbABvAHUAZQByACAAbwB1ACAA4AAgAHQAcgBhAG4AcwBmAOkAcgBlAHIALAAgAOAAIAB0AGkAdAByAGUAIABvAG4A6QByAGUAdQB4ACwAIABsAGUAcwAgAG0AbwBkAOgAbABlAHMALgAKACIgCQBWAG8AdQBzACAAbgAZIOoAdABlAHMAIABwAGEAcwAgAGEAdQB0AG8AcgBpAHMA6QAgAOAAIABkAGkAcwB0AHIAaQBiAHUAZQByACA"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\11.0\Registration\{9011040C-6000-11D3-8CFE-0150048383C9}]
"Current2"="AbABlAHMAIABtAG8AZADoAGwAZQBzACAAZABpAHMAcABvAG4AaQBiAGwAZQBzACAAZABhAG4AcwAgAGwAZQAgAGMAYQBkAHIAZQAgAGQAZQAgAHMAZQByAHYAaQBjAGUAcwAgAEkAbgB0AGUAcgBuAGUAdAAgAGUAbgAgAHQAYQBuAHQAIABxAHUAZQAgAHAAYQByAHQAaQBlACAAZAAZIHUAbgAgAHAAcgBvAGQAdQBpAHQAIABvAHUAIABkABkgdQBuACAAcwBlAHIAdgBpAGMAZQAuAAoAIiAJAFYAbwB1AHMAIABuABkg6gB0AGUAcwAgAHAAYQBzACAAYQB1AHQAbwByAGkAcwDpACAA4AAgAGMAbwBwAGkAZQByACAAbwB1ACAA4AAgAHAAdQBiAGwAaQBlAHIAIABsAGUAcwAgAG0AbwBkAOgAbABlAHMAIABkAGkAcwBwAG8AbgBpAGIAbABlAHMAIABkAGEAbgBzACAAbABlACAAYwBhAGQAcgBlACAAZABlACAAcwBlAHIAdgBpAGMAZQBzACAASQBuAHQAZQByAG4AZQB0ACAAcwB1AHIAIAB0AG8AdQB0ACAAbwByAGQAaQBuAGEAdABlAHUAcgAgAHIA6QBzAGUAYQB1ACwAIABuAGkAIADgACAAbABlAHMAIABkAGkAZgBmAHUAcwBlAHIAIABzAHUAcgAgAHQAbwB1AHQAIABzAHUAcABwAG8AcgB0AC4AIAAKAFYAbwB1AHMAIABkAGUAdgBlAHoAIABnAGEAcgBhAG4AdABpAHIAIABlAHQAIABkAOkAZgBlAG4AZAByAGUAIABNAGkAYwByAG8AcwBvAGYAdAAgAGMAbwBuAHQAcgBlACAAdABvAHUAdABlACAAcgDpAGMAbABhAG0AYQB0AGkAbwBuACAAbwB1ACAAYQBjAHQAaQBvAG4AIABlAG4AIABqAHUAcwB0AGkAYwBlACwAIAB5ACAAYwBvAG0AcAByAGkAcwAgAHAAbwB1AHIAIABsAGUAcwAgAGgAbwBuAG8AcgBhAGkAcgBlAHMAIABkABkgYQB2AG8AYwBhAHQAcwAgAGUAdAAgAGQAZQAgAGMAbwBuAHMAZQBpAGwAcwAsACAAcQB1AGkAIAByAOkAcwB1AGwAdABlAHIAYQBpAHQAIABkAGUAIABsAGEAIABjAG8AbgBjAGUAcwBzAGkAbwBuACAAZABlACAAbABpAGMAZQBuAGMAZQAgAG8AdQAgAGQAZQAgAGwAYQAgAGQAaQBzAHQAcgBpAGIAdQB0AGkAbwBuACAAZABlAHMAIABtAG8AZADoAGwAZQBzACAAcQB1AGUAIAB2AG8AdQBzACAAYQB1AHIAaQBlAHoAIABtAG8AZABpAGYAaQDpAHMALgAKADIALgAJAEQARQBTAEMAUgBJAFAAVABJAE8ATgAgAEQARQBTACAAQQBVAFQAUgBFAFMAIABEAFIATwBJAFQAUwAgAEUAVAAgAEwASQBNAEkAVABBAFQASQBPAE4AUwAKADIALgAxAAkAQQBjAHQAaQB2AGEAdABpAG8AbgAgAG8AYgBsAGkAZwBhAHQAbwBpAHIAZQAuACAAQwBFACAATABPAEcASQBDAEkARQBMACAAQwBPAE4AVABJAEUATgBUACAARABFAFMAIABUAEUAQwBIAE4ATwBMAE8ARwBJAEUAUwAgAEMATwBOAMcAVQBFAFMAIABQAE8AVQBSACAARQBNAFAAygBDAEgARQBSACAAVABPAFUAVABFACAAVQBUAEkATABJAFMAQQBUAEkATwBOACAARgBSAEEAVQBEAFUATABFAFUAUwBFACAARABVACAATABPAEcASQBDAEkARQBMAC4AIABJAGwAIABzAGUAIABwAGUAdQB0ACAAcQB1AGUAIAB2AG8AdQBzACAAbgBlACAAcAB1AGkAcwBzAGkAZQB6ACAAcABhAHMAIABlAHgAZQByAGMAZQByACAAdgBvAHMAIABkAHIAbwBpAHQAcwAgAHMAdQByACAAbABlACAATABvAGcAaQBjAGkAZQBsACAAYQB1ACAAdABpAHQAcgBlACAAZAB1ACAAcAByAOkAcwBlAG4AdAAgAEMATABVAEYAIABhAHAAcgDoAHMAIAB1AG4AIABuAG8AbQBiAHIAZQAgAGwAaQBtAGkAdADpACAAZABlACAAbABhAG4AYwBlAG0AZQBuAHQAcwAgAGQAdQAgAHAAcgBvAGQAdQBpAHQALAAgAOAAIABtAG8AaQBuAHMAIABxAHUAZQAgAHYAbwB1AHMAIABuABkgYQBjAHQAaQB2AGkAZQB6ACAAdgBvAHQAcgBlACAAZQB4AGUAbQBwAGwAYQBpAHIAZQAgAGQAdQAgAEwAbwBnAGkAYwBpAGUAbAAgAGQAZQAgAGwAYQAgAG0AYQBuAGkA6AByAGUAIABkAOkAYwByAGkAdABlACAAZABhAG4AcwAgAGwAYQAgAHMA6QBxAHUAZQBuAGMAZQAgAGQAZQAgAGwAYQBuAGMAZQBtAGUAbgB0AC4AIABJAGwAIABlAHMAdAAgAHAAbwBzAHMAaQBiAGwAZQAgAHEAdQBlACAAdgBvAHUAcwAgAGQAZQB2AGkAZQB6ACAA6QBnAGEAbABlAG0AZQBuAHQAIAByAOkAYQBjAHQAaQB2AGUAcgAgAGwAZQAgAEwAbwBnAGkAYwBpAGUAbAAgAHMAaQAgAHYAbwB1AHMAIABtAG8AZABpAGYAaQBlAHoAIAB2AG8AdAByAGUAIABtAGEAdADpAHIAaQBlAGwAIABpAG4AZgBvAHIAbQBhAHQAaQBxAHUAZQAgAG8AdQAgAGwAZQAgAEwAbwBnAGkAYwBpAGUAbAAuACAATQBpAGMAcgBvAHMAbwBmAHQAIAB1AHQAaQBsAGkAcwBlAHIAYQAgAGMAZQBzACAAdABlAGMAaABuAG8AbABvAGcAaQBlAHMAIABwAG8AdQByACAAdgDpAHIAaQBmAGkAZQByACAAcwBpACAAdgBvAHUAcwAgAGQAaQBzAHAAbwBzAGUAegAgAGQAGSB1AG4AIABlAHgAZQBtAHAAbABhAGkAcgBlACAAcwBvAHUAcwAgAGwAaQBjAGUAbgBjAGUAIABlAG4AIABiAG8AbgBuAGUAIABlAHQAIABkAHUAZQAgAGYAbwByAG0AZQAgAGQAdQAgAEwAbwBnAGkAYwBpAGUAbAAuACAAUwBpACAAdgBvAHUAcwAgAG4AGSB1AHQAaQBsAGkAcwBlAHoAIABwAGEAcwAgAHUAbgAgAGUAeABlAG0AcABsAGEAaQByAGUAIABzAG8AdQBzACAAbABpAGMAZQBuAGMAZQAgAGQAdQAgAEwAbwBnAGkAYwBpAGUAbAAsACAAdgBvAHUAcwAgAG4AGSDqAHQAZQBzACAAcABhAHMAIABhAHUAdABvAHIAaQBzAOkAIADgACAAaQBuAHMAdABhAGwAbABlAHIAIABsAGUAIABMAG8AZwBpAGMAaQBlAGwAIABvAHUAIABzAGUAcwAgAGYAdQB0AHUAcgBlAHMAIABtAGkAcwBlAHMAIADgACAAagBvAHUAcgAuACAATQBpAGMAcgBvAHMAbwBmAHQAIABuAGUAIAByAGUAYwB1AGUAaQBsAGwAZQAgAGEAdQBjAHUAbgBlACAAaQBuAGYAbwByAG0AYQB0AGkAbwBuACAAZAAZIGkAZABlAG4AdABpAGYAaQBjAGEAdABpAG8AbgAgAHAAZQByAHMAbwBuAG4AZQBsAGwAZQAgAHMAdQByACAAdgBvAHQAcgBlACAAZABpAHMAcABvAHMAaQB0AGkAZgAgAGEAdQAgAGMAbwB1AHIAcwAgAGQAZQAgAGMAZQAgAHAAcgBvAGMAZQBzAHMAdQBzAC4ACgAyAC4AMgAJAFMAZQByAHYAaQBjAGUAcwAgAEkAbgB0AGUAcgBuAGUAdAAuACAAVgBvAHUAcwAgAG4AGSDqAHQAZQBzACAAcABhAHMAIABhAHUAdABvAHIAaQBzAOkAIADgACAAdQB0AGkAbABpAHMAZQByACAAdABvAHUAdAAgAHMAZQByAHYAaQBjAGUAIABJAG4AdABlAHIAbgBlAHQAIABNAGkAYwByAG8AcwBvAGYAdAAgAGEAcwBzAG8AYwBpAOkAIABhAHUAIABMAG8AZwBpAGMAaQBlAGwAIABkABkgdQBuAGUAIABxAHUAZQBsAGMAbwBuAHEAdQBlACAAbQBhAG4AaQDoAHIAZQAgAHEAdQBpACAAcABvAHUAcgByAGEAaQB0ACAAZQBuAGQAbwBtAG0AYQBnAGUAcgAsACAAZADpAHMAYQBjAHQAaQB2AGUAcgAsACAAcwB1AHIAYwBoAGEAcgBnAGUAcgAgAG8AdQAgAGQA6QB0AOkAcgBpAG8AcgBlAHIAIAB1AG4AIAB0AGUAbAAgAHMAZQByAHYAaQBjAGUAIABvAHUAIABwAGUAcgB0AHUAcgBiAGUAcgAgAHMAbwBuACAAdQB0AGkAbABpAHMAYQB0AGkAbwBuACAAZQB0ACAAcwBhACAAagBvAHUAaQBzAHMAYQBuAGMAZQAgAHAAYQByACAAdQBuACAAdABpAGUAcgBzAC4AIABWAG8AdQBzACAAbgAZIOoAdABlAHMAIABwAGEAcwAgAGEAdQB0AG8AcgBpAHMA6QAgAOAAIAB0AGUAbgB0AGUAcgAgAGQAGSBhAGMAYwDpAGQAZQByACwAIABkAGUAIABmAGEA5wBvAG4AIABuAG8AbgAgAGEAdQB0AG8AcgBpAHMA6QBlACwAIADgACAAdABvAHUAdAAgAHMAZQByAHYAaQBjAGUALAAgAGMAbwBtAHAAdABlACwAIABzAHkAcwB0AOgAbQBlACAAaQBuAGYAbwByAG0AYQB0AGkAcQB1AGUAIABvAHUAIAByAOkAcwBlAGEAdQAgAGEAcwBzAG8AYwBpAOkAIABhAHUAeAAgAHMAZQByAHYAaQBjAGUAcwAgAEkAbgB0AGUAcgBuAGUAdAAuACAACgAyAC4AMwAJAFIAZQBjAG8AbgBuAGEAaQBzAHMAYQBuAGMAZQAgAHYAbwBjAGEAbABlAC8AZAAZIOkAYwByAGkAdAB1AHIAZQAuACAAUwBpACAAbABlACAATABvAGcAaQBjAGkAZQBsACAAaQBuAGMAbAB1AHQAIAB1AG4AIABjAG8AbQBwAG8AcwBhAG4AdAAgAGQAZQAgAHIAZQBjAG8AbgBuAGEAaQBzAHMAYQBuAGMAZQAgAHYAbwBjAGEAbABlACAAZQB0AC8AbwB1ACAAdQBuACAAYwBvAG0AcABvAHMAYQBuAHQAIABkAGUAIAByAGUAYwBvAG4AbgBhAGkAcwBzAGEAbgBjAGUAIABkABkg6QBjAHIAaQB0AHUAcgBlACwAIAB2AG8AdQBzACAAZABlAHYAZQB6ACAAYwBvAG0AcAByAGUAbgBkAHIAZQAgAHEAdQBlACAAbABhACAAcgBlAGMAbwBuAG4AYQBpAHMAcwBhAG4AYwBlACAAdgBvAGMAYQBsAGUAIABlAHQAIABsAGEAIAByAGUAYwBvAG4AbgBhAGkAcwBzAGEAbgBjAGUAIABkABkg6QBjAHIAaQB0AHUAcgBlACAAcwBvAG4AdAAgAGYAbwBuAGQA6QBlAHMAIABlAHMAcwBlAG4AdABpAGUAbABsAGUAbQBlAG4AdAAgAHMAdQByACAAdQBuACAAcAByAG8AYwBlAHMAcwB1AHMAIABzAHQAYQB0AGkAcwB0AGkAcQB1AGUAoABlAHQAIABxAHUAZQAgAGQAZQBzACAAZQByAHIAZQB1AHIAcwAgAGQAZQAgAHIAZQBjAG8AbgBuAGEAaQBzAHMAYQBuAGMAZQAgAHMAbwBuAHQAIABpAG4AaADpAHIAZQBuAHQAZQBzACAA4AAgAGMAZQAgAHAAcgBvAGMAZQBzAHMAdQBzACwAoABJAGwAIABlAHMAdAAgAGQAZQAgAHYAbwB0AHIAZQAgAHIAZQBzAHAAbwBuAHMAYQBiAGkAbABpAHQA6QAgAGQAGSBvAHIAZwBhAG4AaQBzAGUAcgAgAGwAYQAgAGcAZQBzAHQAaQBvAG4AIABkAGUAIABjAGUAcwAgAGUAcgByAGUAdQByAHMALAAgAGQAZQAgAGMAbwBuAHQAcgD0AGwAZQByACAAbABlACAAcAByAG8AYwBlAHMAcwB1AHMAIABkAGUAIAByAGUAYwBvAG4AbgBhAGkAcwBzAGEAbgBjAGUAIABlAHQAIABkAGUAIABjAG8AcgByAGkAZwBlAHIAIABsAGUAcwAgAGUAcgByAGUAdQByAHMALgAgAE0AaQBjAHIAbwBzAG8AZgB0ACAAbwB1ACAAcwBlAHMAIABmAG8AdQByAG4AaQBzAHMAZQB1AHIAcwAgAG4AZQAgAHAAbwB1AHIAcgBvAG4AdAAgAOoAdAByAGUAIAB0AGUAbgB1AHMAIAByAGUAcwBwAG8AbgBzAGEAYgBsAGUAcwAgAGQAGSBhAHUAYwB1AG4AIABwAHIA6QBqAHUAZABpAGMAZQAgAGMAYQB1AHMA6QAgAHAAYQByACAAZABlAHMAIABlAHIAcgBlAHUAcgBzACAAcgDpAHMAdQBsAHQAYQBuAHQAIABkAGUAcwAgAHAAcgBvAGMAZQBzAHMAdQBzACAAZABlACAAcgBlAGMAbwBuAG4AYQBpAHMAcwBhAG4AYwBlACAAdgBvAGMAYQBsAGUAIABlAHQAIABkABkg6QBjAHIAaQB0AHUAcgBlAC4ACgAyAC4ANAAJAEwAaQBtAGkAdABhAHQAaQBvAG4AcwAgAGEAcABwAGwAaQBjAGEAYgBsAGUAcwAgAGEAdQAgAEwAbwBnAGkAYwBpAGUAbAAgAEUAeADpAGMAdQB0AGEAYgBsAGUAIABkABkg6QBjAHIAaQB0AHUAcgBlACAAZABlACAAcgBhAHAAcABvAHIAdABzAC4AIABMAGUAIABMAG8AZwBpAGMAaQBlAGwAIABlAHMAdAAgAHMAdQBzAGMAZQBwAHQAaQBiAGwAZQAgAGQAZQAgAGMAbwBuAHQAZQBuAGkAcgAgAHUAbgAgAGwAbwBnAGkAYwBpAGUAbAAgAGUAeADpAGMAdQB0AGEAYgBsAGUAIABkABkg6QBjAHIAaQB0AHUAcgBlACAAZABlACAAcgBhAHAAcABvAHIAdABzACAAKABsAGUAIACrAKAATABvAGcAaQBjAGkAZQBsACAARQB4AOkAYwB1AHQAYQBiAGwAZQCgALsAKQAuACAASABvAHIAbQBpAHMAIABkAGEAbgBzACAAbABlACAAYwBhAGQAcgBlACAAZAAZIHUAbgBlACAAdQB0AGkAbABpAHMAYQB0AGkAbwBuACAAYQB2AGUAYwAgAGwAZQAgAEwAbwBnAGkAYwBpAGUAbAAsACAAdgBvAHUAcwAgAG4AGSDqAHQAZQBzACAAcABhAHMAIABhAHUAdABvAHIAaQBzAOkAIADgACAAdQB0AGkAbABpAHMAZQByACAAbABlACAATABvAGcAaQBjAGkAZQBsACAARQB4AOkAYwB1AHQAYQBiAGwAZQAgAGEAdgBlAGMAIAB0AG8AdQB0AGUAIABhAHUAdAByAGUAIABhAHAAcABsAGkAYwBhAHQAaQBvAG4AIABsAG8AZwBpAGMAaQBlAGwAbABlACAAbgBpACAA4AAgAGwAGSB1AHQAaQBsAGkAcwBlAHIAIABkAGEAbgBzACAAbABlACAAYwBhAGQAcgBlACAAZABlACAAdABvAHUAdAAgAHAAcgBvAGMAZQBzAHMAdQBzACAAbwB1ACAAcwB5AHMAdADoAG0AZQAgAHUAdABpAGwAaQBzAOkAIABwAG8AdQByACAAZADpAGwAaQB2AHIAZQByACwAIABwAGEAcgB0AGEAZwBlAHIAIABvAHUAIABkAGkAcwB0AHIAaQBiAHUAZQByACAAYQB1AHQAbwBtAGEAdABpAHEAdQBlAG0AZQBuAHQAIABkAGUAcwAgAGQAbwBjAHUAbQBlAG4AdABzACAAbwB1ACAAYQB1AHQAcgBlAHMAIABTAXUAdgByAGUAcwAgAGMAcgDpAOkAcwAgAOAAIABsABkgYQBpAGQAZQAgAGQAdQAgAEwAbwBnAGkAYwBpAGUAbAAgAEUAeADpAGMAdQB0AGEAYgBsAGUALgAKADMALgAJAEQAUgBPAEkAVABTACAAUgDJAFMARQBSAFYAyQBTACAARQBUACAAUABSAE8AUABSAEkAyQBUAMkALgAgAFQAbwB1AHMAIABsAGUAcwAgAGQAcgBvAGkAdABzACAAcQB1AGkAIABuAGUAIAB2AG8AdQBzACAAcwBvAG4AdAAgAHAAYQBzACAAZQB4AHAAcgBlAHMAcwDpAG0AZQBuAHQAIABjAG8AbgBjAOkAZADpAHMAIABkAGEAbgBzACAAbABlACAAcAByAOkAcwBlAG4AdAAgAEMATABVAEYAIABzAG8AbgB0ACAAcgDpAHMAZQByAHYA6QBzACAAcABhAHIAIABNAGkAYwByAG8AcwBvAGYAdAAuACAATABlACAATABvAGcAaQBjAGkAZQBsACAAZQBzAHQAIABwAHIAbwB0AOkAZwDpACAAcABhAHIAIABsAGUAcwAgAGwAbwBpAHMAIABlAHQAIABsAGUAcwAgAHQAcgBhAGkAdADpAHMAIABpAG4AdABlAHIAbgBhAHQAaQBvAG4AYQB1AHgAIABlAG4AIABtAGEAdABpAOgAcgBlACAAZABlACAAZAByAG8AaQB0ACAAZAAZIGEAdQB0AGUAdQByACAAZQB0ACAAZABlACAAcAByAG8AcAByAGkA6QB0AOkAIABpAG4AdABlAGwAbABlAGMAdAB1AGUAbABsAGUALgAgAEwAZQBzACAAZAByAG8AaQB0AHMAIABkAGUAIABwAHIAbwBwAHIAaQDpAHQA6QAsACAAZAByAG8AaQB0AHMAIABkABkgYQB1AHQAZQB1AHIAIABlAHQAIABhAHUAdAByAGUAcwAgAGQAcgBvAGkAdABzACAAZABlACAAcAByAG8AcAByAGkA6QB0AOkAIABpAG4AdABlAGwAbABlAGMAdAB1AGUAbABsAGUAIABzAHUAcgAgAGwAZQAgAEwAbwBnAGkAYwBpAGUAbAAgAGEAcABwAGEAcgB0AGkAZQBuAG4AZQBuAHQAIADgACAATQBpAGMAcgBvAHMAbwBmAHQAIABvAHUAIADgACAAcwBlAHMAIABmAG8AdQByAG4AaQBzAHMAZQB1AHIAcwAuACAATABlACAATABvAGcAaQBjAGkAZQBsACAAbgAZIGUAcwB0ACAAcABhAHMAIAB2AGUAbgBkAHUAIABtAGEAaQBzACAAYwBvAG4AYwDpAGQA6QAgAHMAbwB1AHMAIABsAGkAYwBlAG4AYwBlAC4AIABMAGUAIABwAHIA6QBzAGUAbgB0ACAAQwBMAFUARgAgAG4AZQAgAHYAbwB1AHMAIABjAG8AbgBjAOgAZABlACAAYQB1AGMAdQBuACAAZAByAG8AaQB0ACAAcwB1AHIAIABkAGUAcwAgAG0AYQByAHEAdQBlAHMAIABkAGUAIABmAGEAYgByAGkAcQB1AGUAIABvAHUAIABkAGUAIABzAGUAcgB2AGkAYwBlACAAYQBwAHAAYQByAHQAZQBuAGEAbgB0ACAA4AAgAE0AaQBjAHIAbwBzAG8AZgB0AC4ACgA0AC4ACQBMAEkATQBJAFQAQQBUAEkATwBOAFMAIABSAEUATABBAFQASQBWAEUAUwAgAMAAIABMABkgSQBOAEcAyQBOAEkARQBSAEkARQAgAMAAIABSAEUAQgBPAFUAUgBTACwAIADAACAATABBACAARADJAEMATwBNAFAASQBMAEEAVABJAE8ATgAgAEUAVAAgAEEAVQAgAEQAyQBTAEEAUwBTAEUATQBCAEwAQQBHAEUALgAgAFYAbwB1AHMAIABuABkg6gB0AGUAcwAgAHAAYQBzACAAYQB1AHQAbwByAGkAcwDpACAA4AAgAHIAZQBjAG8AbgBzAHQAaQB0AHUAZQByACAAbABhACAAbABvAGcAaQBxAHUAZQAgAGQAdQAgAEwAbwBnAGkAYwBpAGUAbAAsACAA4AAgAGwAZQAgAGQA6QBjAG8AbQBwAGkAbABlAHIAIABvAHUAIADgACAAbABlACAAZADpAHMAYQBzAHMAZQBtAGIAbABlAHIALAAgAHMAYQB1AGYAIABkAGEAbgBzACAAbABhACAAbQBlAHMAdQByAGUAIABvAPkAIABjAGUAcwAgAG8AcADpAHIAYQB0AGkAbwBuAHMAIABzAGUAcgBhAGkAZQBuAHQAIABlAHgAcAByAGUAcwBzAOkAbQBlAG4AdAAgAHAAZQByAG0AaQBzAGUAcwAgAHAAYQByACAAbABhACAAcgDpAGcAbABlAG0AZQBuAHQAYQB0AGkAbwBuACAAYQBwAHAAbABpAGMAYQBiAGwAZQAgAG4AbwBuAG8AYgBzAHQAYQBuAHQAIABsAGEAIABwAHIA6QBzAGUAbgB0AGUAIABsAGkAbQBpAHQAYQB0AGkAbwBuAC4ACgA1AC4ACQBJAE4AVABFAFIARABJAEMAVABJAE8ATgAgAEQARQAgAEwATwBDAEEAVABJAE8ATgAvAEQAGSBIAMkAQgBFAFIARwBFAE0ARQBOAFQAIADAACAARABFAFMAIABGAEkATgBTACAAQwBPAE0ATQBFAFIAQwBJAEEATABFAFMALgAgAFYAbwB1AHMAIABuABkg6gB0AGUAcwAgAHAAYQBzACAAYQB1AHQAbwByAGkAcwDpACAA4AAgAHAAcgDqAHQAZQByACAAbwB1ACAA4AAgAGwAbwB1AGUAcgAgAGwAZQAgAEwAbwBnAGkAYwBpAGUAbAAsACAAbgBpACAA4AAgAGYAbwB1AHIAbgBpAHIAIABkAGUAcwAgAHMAZQByAHYAaQBjAGUAcwAgAGQAGSBoAOkAYgBlAHIAZwBlAG0AZQBuAHQAIABjAG8AbQBtAGUAcgBjAGkAYQBsACAAYQB2AGUAYwAgAGwAZQAgAEwAbwBnAGkAYwBpAGUAbAAuAAoANgAuAAkAQQBVAFQATwBSAEkAUwBBAFQASQBPAE4AIABEABkgVQBUAEkATABJAFMAQQBUAEkATwBOACAARABFACAARABPAE4ATgDJAEUAUwAuACAAVgBvAHUAcwAgAGEAdQB0AG8AcgBpAHMAZQB6ACAATQBpAGMAcgBvAHMAbwBmAHQAIABlAHQAIABzAGUAcwAgAGEAZgBmAGkAbABpAOkAcwAgAOAAIABjAG8AbABsAGUAYwB0AGUAcgAgAGUAdAAgAOAAIAB1AHQAaQBsAGkAcwBlAHIAIABsAGUAcwAgAGkAbgBmAG8AcgBtAGEAdABpAG8AbgBzACAAdABlAGMAaABuAGkAcQB1AGUAcwAgAHIAYQBzAHMAZQBtAGIAbADpAGUAcwAgAGQAYQBuAHMAIABsAGUAIABjAGEAZAByAGUAIABkAGUAcwAgAHMAZQByAHYAaQBjAGUAcwAgAGQAGSBhAHMAcwBpAHMAdABhAG4AYwBlACAAcQB1AGkAIAB2AG8AdQBzACAAcwBvAG4AdAAgAGYAbwB1AHIAbgBpAHMALAAgAGwAZQAgAGMAYQBzACAA6QBjAGgA6QBhAG4AdAAsACAAZQB0ACAAcQB1AGkAIABwAG8AcgB0AGUAbgB0ACAAcwB1AHIAIABsAGUAIABMAG8AZwBpAGMAaQBlAGwALgAgAE0AaQBjAHIAbwBzAG8AZgB0ACAAcABvAHUAcgByAGEAIAB1AHQAaQBsAGkAcwBlAHIAIABjAGUAcwAgAGkAbgBmAG8AcgBtAGEAdABpAG8AbgBzACAAZABhAG4AcwAgAGwAZQAgAHMAZQB1AGwAIABiAHUAdAAgAGQAGSBhAG0A6QBsAGkAbwByAGUAcgAgAHMAZQBzACAAcAByAG8AZAB1AGkAdABzACAAbwB1ACAAZABlACAAdgBvAHUAcwAgAGYAbwB1AHIAbgBpAHIAIABkAGUAcwAgAHMAZQByAHYAaQBjAGUAcwAgAG8AdQAgAGQAZQBzACAAdABlAGMAaABuAG8AbABvAGcAaQBlAHMAIABwAGUAcgBzAG8AbgBuAGEAbABpAHMA6QBzACAAZQB0ACAAcwAZIGUAbgBnAGEAZwBlACAA4AAgAG4AZQAgAHAAYQBzACAAZABpAHYAdQBsAGcAdQBlAHIAIABjAGUAcwAgAGkAbgBmAG8AcgBtAGEAdABpAG8AbgBzACAAcwBvAHUAcwAgAHUAbgBlACAAZgBvAHIAbQBlACAAcQB1AGkAIAB2AG8AdQBzACAAaQBkAGUAbgB0AGkAZgBpAGUAcgBhAGkAdAAgAHAAZQByAHMAbwBuAG4AZQBsAGwAZQBtAGUAbgB0AC4ACgA3AC4ACQBMAEkARQBOAFMAIABWAEUAUgBTACAARABFAFMAIABTAEkAVABFAFMAIABUAEkARQBSAFMALgAgAE0AaQBjAHIAbwBzAG8AZgB0ACAAbgAZIGUAcwB0ACAAcABhAHMAIAByAGUAcwBwAG8AbgBzAGEAYgBsAGUAIABkAHUAIABjAG8AbgB0AGUAbgB1ACAAZABlAHMAIABzAGkAdABlAHMAIABvAHUAIABkAGUAcwAgAHMAZQByAHYAaQBjAGUAcwAgAHQAaQBlAHIAcwAsACAAZABlAHMAIABsAGkAZQBuAHMAIABxAHUAGSBpAGwAcwAgAGMAbwBuAHQAaQBlAG4AbgBlAG4AdAAgAG4AaQAgAGQAZQBzACAAbQBvAGQAaQBmAGkAYwBhAHQAaQBvAG4AcwAgAG8AdQAgAG0AaQBzAGUAcwAgAOAAIABqAG8AdQByACAAcQB1AGkAIABsAGUAdQByACAAcwBvAG4AdAAgAGEAcABwAG8AcgB0AOkAZQBzAC4AIABNAGkAYwByAG8AcwBvAGYAdAAgAGYAbwB1AHIAbgBpAHQAIABjAGUAcwAgAGwAaQBlAG4AcwAgAGUAdAAgAGMAZQB0ACAAYQBjAGMA6ABzACAAdgBlAHIAcwAgAGQAZQBzACAAcwBpAHQAZQBzACAAZQB0ACAAcwBlAHIAdgBpAGMAZQBzACAAdABpAGUAcgBzACAAcABvAHUAcgAgAHYAbwB0AHIAZQAgAGMAbwBtAG0AbwBkAGkAdADpACAAdQBuAGkAcQB1AGUAbQBlAG4AdAAsACAAZQB0ACAAbAAZIGkAbgBzAGUAcgB0AGkAbwBuACAAZABlACAAdABvAHUAdAAgAGwAaQBlAG4AIABvAHUAIABkAGUAIAB0AG8AdQB0ACAAYQBjAGMA6ABzACAAbgAZIGkAbQBwAGwAaQBxAHUAZQAgAHAAYQBzACAAbAAZIGEAcABwAHIAbwBiAGEAdABpAG8AbgAgAGQAdQAgAHMAaQB0AGUAIABvAHUAIABkAHUAIABzAGUAcgB2AGkAYwBlACAAZQBuACAAcQB1AGUAcwB0AGkAbwBuACAAcABhAHIAIABNAGkAYwByAG8AcwBvAGYAdAAuACAACgA4AC4ACQBMAE8ARwBJAEMASQBFAEwAUwAvAFMARQBSAFYASQBDAEUAUwAgAFMAVQBQAFAATADJAE0ARQBOAFQAQQBJAFIARQBTAC4AIABMAGUAIABwAHIA6QBzAGUAbgB0ACAAQwBMAFUARgAgAHMAGSBhAHAAcABsAGkAcQB1AGUAIABhAHUAeAAgAG0AaQBzAGUAcwAgAOAAIABqAG8AdQByACwAIABjAG8AbQBwAGwA6QBtAGUAbgB0AHMALAAgAG0AbwBkAHUAbABlAHMAIABjAG8AbQBwAGwA6QBtAGUAbgB0AGEAaQByAGUAcwAgAG8AdQAgAHMAZQByAHYAaQBjAGUAcwAgAEkAbgB0AGUAcgBuAGUAdAAgAGQAdQAgAEwAbwBnAGkAYwBpAGUAbAAgAGYAbwB1AHIAbgBpAHMAIABvAHUAIABtAGkAcwAgAOAAIAB2AG8AdAByAGUAIABkAGkAcwBwAG8AcwBpAHQAaQBvAG4AIABwAGEAcgAgAE0AaQBjAHIAbwBzAG8AZgB0ACAAYQBwAHIA6ABzACAAbABhACAAZABhAHQAZQAgAOAAIABsAGEAcQB1AGUAbABsAGUAIAB2AG8AdQBzACAAYQB2AGUAegAgAG8AYgB0AGUAbgB1ACAAdgBvAHQAcgBlACAAZQB4AGUAbQBwAGwAYQBpAHIAZQAgAGkAbgBpAHQAaQBhAGwAIABkAHUAIABMAG8AZwBpAGMAaQBlAGwALAAgAOAAIABtAG8AaQBuAHMAIABxAHUAZQAgAGQAGSBhAHUAdAByAGUAcwAgAGMAbwBuAGQAaQB0AGkAbwBuAHMAIABuAGUAIABsAGUAdQByACAAcwBvAGkAZQBuAHQAIABhAHAAcABsAGkAYwBhAGIAbABlAHMALgAgAE0AaQBjAHIAbwBzAG8AZgB0ACAAcwBlACAAcgDpAHMAZQByAHYAZQAgAGwAZQAgAGQAcgBvAGkAdAAgAGQAZQAgAG0AZQB0AHQAcgBlACAAZgBpAG4AIABhAHUAeAAgAHMAZQByAHYAaQBjAGUAcwAgAEkAbgB0AGUAcgBuAGUAdAAgAGYAbwB1AHIAbgBpAHMAIABvAHUAIAByAGUAbgBkAHUAcwAgAGEAYwBjAGUAcwBzAGkAYgBsAGUAcwAgAHAAYQByACAAbAAZIGkAbgB0AGUAcgBtAOkAZABpAGEAaQByAGUAIABkAHUAIABMAG8AZwBpAGMAaQBlAGwALgAKADkALgAJAE0ASQBTAEUAUwAgAMAAIABKAE8AVQBSAC4AIABQAG8AdQByACAAdQB0AGkAbABpAHMAZQByACAAdQBuACAATABvAGcAaQBjAGkAZQBsACAAcAByAOkAcwBlAG4AdADpACAAYwBvAG0AbQBlACAAdQBuAGUAIABtAGkAcwBlACAA4AAgAGoAbwB1AHIALAAgAHYAbwB1AHMAIABkAGUAdgBlAHoAIADqAHQAcgBlACAAdABpAHQAdQBsAGEAaQByAGUAIABkABkgdQBuAGUAIABsAGkAYwBlAG4AYwBlACAAdgBvAHUAcwAgAHAAZQByAG0AZQB0AHQAYQBuAHQAIABkABkgdQB0AGkAbABpAHMAZQByACAAbABlACAAbABvAGcAaQBjAGkAZQBsACAAaQBkAGUAbgB0AGkAZgBpAOkAIABwAGEAcgAgAE0AaQBjAHIAbwBzAG8AZgB0ACAAYwBvAG0AbQBlACAAcABvAHUAdgBhAG4AdAAgAGYAYQBpAHIAZQAgAGwAGSBvAGIAagBlAHQAIABkAGUAIABsAGEAIABtAGkAcwBlACAA4AAgAGoAbwB1AHIALgAgAMAAIABjAG8AbQBwAHQAZQByACAAZABlACAAbAAZIGkAbgBzAHQAYQBsAGwAYQB0AGkAbwBuACAAZABlACAAbABhACAAbQBpAHMAZQAgAOAAIABqAG8AdQByACwAIAB2AG8AdQBzACAAbgAZIOoAdABlAHMAIABwAGwAdQBzACAAYQB1AHQAbwByAGkAcwDpACAA4AAgAHUAdABpAGwAaQBzAGUAcgAgAGwAZQAgAGwAbwBnAGkAYwBpAGUAbAAgAGkAbgBpAHQAaQBhAGwAIABxAHUAaQAgAGEAIABmAG8AbgBkAOkAIAB2AG8AdAByAGUAIABkAHIAbwBpAHQAIADgACAAbABhACAAbQBpAHMAZQAgAOAAIABqAG8AdQByACwAIABlAHgAYwBlAHAAdADpACAAZQBuACAAdABhAG4AdAAgAHEAdQBlACAAcABhAHIAdABpAGUAIABkAHUAIABsAG8AZwBpAGMAaQBlAGwAIABtAGkAcwAgAOAAIABqAG8AdQByAC4ACgAxADAALgAJAEwATwBHAEkAQwBJAEUATAAgAEUATgAgAFIARQBWAEUATgBUAEUAIABJAE4AVABFAFIARABJAFQARQAuACAAUwBpACAAbABlACAATABvAGcAaQBjAGkAZQBsACAAcABvAHIAdABlACAAbABhACAAbQBlAG4AdABpAG8AbgAgAKsAoABSAGUAdgBlAG4AdABlACAAaQBuAH"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\11.0\Registration\{9011040C-6000-11D3-8CFE-0150048383C9}]
"Current3"="QAZQByAGQAaQB0AGUAoAC7ACAAbwB1ACAAqwCgAE4ARgBSAKAAuwAgACgATgBvAHQAIABGAG8AcgAgAFIAZQBzAGEAbABlACkALAAgAHYAbwB1AHMAIABuABkg6gB0AGUAcwAgAHAAYQBzACAAYQB1AHQAbwByAGkAcwDpACAA4AAgAHIAZQB2AGUAbgBkAHIAZQAgAGwAZQAgAEwAbwBnAGkAYwBpAGUAbAAgAG8AdQAgAOAAIABsAGUAIAB0AHIAYQBuAHMAZgDpAHIAZQByACAA4AAgAHQAaQB0AHIAZQAgAG8AbgDpAHIAZQB1AHgALAAgAG4AaQAgAOAAIABsABkgdQB0AGkAbABpAHMAZQByACAA4AAgAGQAZQBzACAAZgBpAG4AcwAgAGEAdQB0AHIAZQBzACAAcQB1AGUAIABkAGUAIABkAOkAbQBvAG4AcwB0AHIAYQB0AGkAbwBuACwAIABkAGUAIAB0AGUAcwB0ACAAbwB1ACAAZAAZIOkAdgBhAGwAdQBhAHQAaQBvAG4ALgAKADEAMQAuAAkATABPAEcASQBDAEkARQBMACAARQBOACAAVgBFAFIAUwBJAE8ATgAgAMkARABVAEMAQQBUAEkATwBOAC4AIABQAG8AdQByACAAdQB0AGkAbABpAHMAZQByACAAdQBuACAATABvAGcAaQBjAGkAZQBsACAAcABvAHIAdABhAG4AdAAgAGwAYQAgAG0AZQBuAHQAaQBvAG4AIACrAKAAVgBlAHIAcwBpAG8AbgAgAMkAZAB1AGMAYQB0AGkAbwBuAKAAuwAgAG8AdQAgAKsAoABBAEUAoAC7ACAAKABBAGMAYQBkAGUAbQBpAGMAIABFAGQAaQB0AGkAbwBuACkALAAgAHYAbwB1AHMAIABkAGUAdgBlAHoAIABhAHYAbwBpAHIAIABsAGEAIABxAHUAYQBsAGkAdADpACAAZAAZIKsAoABVAHQAaQBsAGkAcwBhAHQAZQB1AHIAIADJAGQAdQBjAGEAdABpAG8AbgAgAEEAdQB0AG8AcgBpAHMA6QCgALsAIAAoAFEAdQBhAGwAaQBmAGkAZQBkACAARQBkAHUAYwBhAHQAaQBvAG4AYQBsACAAVQBzAGUAcgApAC4AIABQAG8AdQByACAAdABvAHUAdABlACAAcQB1AGUAcwB0AGkAbwBuACAAcgBlAGwAYQB0AGkAdgBlACAA4AAgAGMAZQB0AHQAZQAgAHEAdQBhAGwAaQB0AOkALAAgAHYAZQB1AGkAbABsAGUAegAgAGMAbwBuAHQAYQBjAHQAZQByACAATQBpAGMAcgBvAHMAbwBmAHQAIABTAGEAbABlAHMAIABJAG4AZgBvAHIAbQBhAHQAaQBvAG4AIABDAGUAbgB0AGUAcgAvAE8AbgBlACAATQBpAGMAcgBvAHMAbwBmAHQAIABXAGEAeQAsACAAUgBlAGQAbQBvAG4AZAAsACAAVwBBAKAAOQA4ADAANQAyAC0ANgAzADkAOQAgAG8AdQAgAGwAYQAgAGYAaQBsAGkAYQBsAGUAIABNAGkAYwByAG8AcwBvAGYAdAAgAHEAdQBpACAAZABlAHMAcwBlAHIAdAAgAHYAbwB0AHIAZQAgAHAAYQB5AHMALgAKADEAMgAuAAkAUgBFAFMAVABSAEkAQwBUAEkATwBOAFMAIADAACAATAAZIEUAWABQAE8AUgBUAEEAVABJAE8ATgAuACAAVgBvAHUAcwAgAHIAZQBjAG8AbgBuAGEAaQBzAHMAZQB6ACAAcQB1AGUAIABsAGUAIABMAG8AZwBpAGMAaQBlAGwAIABlAHMAdAAgAHMAbwB1AG0AaQBzACAA4AAgAGwAYQAgAHIA6QBnAGwAZQBtAGUAbgB0AGEAdABpAG8AbgAgAGEAbQDpAHIAaQBjAGEAaQBuAGUAIABlAG4AIABtAGEAdABpAOgAcgBlACAAZAAZIGUAeABwAG8AcgB0AGEAdABpAG8AbgAuACAAVgBvAHUAcwAgAHYAbwB1AHMAIABlAG4AZwBhAGcAZQB6ACAA4AAgAHIAZQBzAHAAZQBjAHQAZQByACAAdABvAHUAdABlAHMAIABsAGUAcwAgAGwAbwBpAHMAIABlAHQAIAByAOkAZwBsAGUAbQBlAG4AdABhAHQAaQBvAG4AcwAgAG4AYQB0AGkAbwBuAGEAbABlAHMAIABlAHQAIABpAG4AdABlAHIAbgBhAHQAaQBvAG4AYQBsAGUAcwAgAGEAcABwAGwAaQBjAGEAYgBsAGUAcwAgAGEAdQAgAEwAbwBnAGkAYwBpAGUAbAAsACAAeQAgAGMAbwBtAHAAcgBpAHMAIABsAGUAcwAgAEUAeABwAG8AcgB0ACAAQQBkAG0AaQBuAGkAcwB0AHIAYQB0AGkAbwBuACAAUgBlAGcAdQBsAGEAdABpAG8AbgBzACAAZQBuACAAdgBpAGcAdQBlAHUAcgAgAGEAdQB4ACAAyQB0AGEAdABzAC0AVQBuAGkAcwAsACAAYQBpAG4AcwBpACAAcQB1AGUAIABsAGUAcwAgAHIAZQBzAHQAcgBpAGMAdABpAG8AbgBzACAAaQBtAHAAbwBzAOkAZQBzACAAcABhAHIAIABsAGUAcwAgAGcAbwB1AHYAZQByAG4AZQBtAGUAbgB0AHMAIABkAGUAcwAgAMkAdABhAHQAcwAtAFUAbgBpAHMAIABkABkgQQBtAOkAcgBpAHEAdQBlACAAZQB0ACAAZAAZIGEAdQB0AHIAZQBzACAAcABhAHkAcwAgAGMAbwBuAGMAZQByAG4AYQBuAHQAIABsAGUAcwAgAHUAdABpAGwAaQBzAGEAdABlAHUAcgBzACAAZgBpAG4AYQB1AHgALAAgAGwAZQBzACAAdQB0AGkAbABpAHMAYQB0AGkAbwBuAHMAIABmAGkAbgBhAGwAZQBzACAAZQB0ACAAbABlAHMAIABwAGEAeQBzACAAZABlAHMAdABpAG4AYQB0AGEAaQByAGUAcwAuACAARABlAHMAIABpAG4AZgBvAHIAbQBhAHQAaQBvAG4AcwAgAHMAdQBwAHAAbADpAG0AZQBuAHQAYQBpAHIAZQBzACAAcwBvAG4AdAAgAGQAaQBzAHAAbwBuAGkAYgBsAGUAcwAgAHMAdQByACAAbABlACAAcwBpAHQAZQAgAEkAbgB0AGUAcgBuAGUAdAAgADwAaAB0AHQAcAA6AC8ALwB3AHcAdwAuAG0AaQBjAHIAbwBzAG8AZgB0AC4AYwBvAG0ALwBlAHgAcABvAHIAdABpAG4AZwAvAD4ALgAKADEAMwAuAAkARABJAFMAUwBPAEMASQBBAFQASQBPAE4AIABEAEUAIABDAE8ATQBQAE8AUwBBAE4AVABTAC4AIABMAGUAIABMAG8AZwBpAGMAaQBlAGwAIABlAHMAdAAgAGMAbwBuAGMA6QBkAOkAIABzAG8AdQBzACAAbABpAGMAZQBuAGMAZQAgAGUAbgAgAHQAYQBuAHQAIABxAHUAZQAgAHAAcgBvAGQAdQBpAHQAIAB1AG4AaQBxAHUAZQAuACAASQBsACAAbgAZIGUAcwB0ACAAcABhAHMAIABwAGUAcgBtAGkAcwAgAGQAZQAgAGQAaQBzAHMAbwBjAGkAZQByACAAcwBlAHMAIABjAG8AbQBwAG8AcwBhAG4AdABzACAAcABvAHUAcgAgAGwAZQBzACAAdQB0AGkAbABpAHMAZQByACAAcwB1AHIAIABwAGwAdQBzACAAZAAZIHUAbgAgAGQAaQBzAHAAbwBzAGkAdABpAGYALgAKADEANAAuAAkAVABSAEEATgBTAEYARQBSAFQAIABEAEUAIABMAE8ARwBJAEMASQBFAEwALgAgAEkAbgB0AGUAcgBuAGUALgAgAFYAbwB1AHMAIADqAHQAZQBzACAAYQB1AHQAbwByAGkAcwDpACAA4AAgAHQAcgBhAG4AcwBmAOkAcgBlAHIAIAB2AG8AdAByAGUAIABlAHgAZQBtAHAAbABhAGkAcgBlACAAZAB1ACAATABvAGcAaQBjAGkAZQBsACAAcwB1AHIAIAB1AG4AIABhAHUAdAByAGUAIABkAGkAcwBwAG8AcwBpAHQAaQBmAC4AIABVAG4AZQAgAGYAbwBpAHMAIABsAGUAIAB0AHIAYQBuAHMAZgBlAHIAdAAgAHQAZQByAG0AaQBuAOkALAAgAHYAbwB1AHMAIABkAGUAdgBlAHoAIABzAHUAcABwAHIAaQBtAGUAcgAgAGwAYQAgAHQAbwB0AGEAbABpAHQA6QAgAGQAdQAgAEwAbwBnAGkAYwBpAGUAbAAgAGQAdQAgAHAAcgBlAG0AaQBlAHIAIABkAGkAcwBwAG8AcwBpAHQAaQBmAC4AIABUAHIAYQBuAHMAZgBlAHIAdAAgAOAAIAB1AG4AIAB0AGkAZQByAHMALgAgAFMAaQAgAHYAbwB1AHMAIADqAHQAZQBzACAAbABhACAAcABlAHIAcwBvAG4AbgBlACAA4AAgAHEAdQBpACAAbABlACAATABvAGcAaQBjAGkAZQBsACAAYQAgAOkAdADpACAAaQBuAGkAdABpAGEAbABlAG0AZQBuAHQAIABjAG8AbgBjAOkAZADpACAAcwBvAHUAcwAgAGwAaQBjAGUAbgBjAGUALAAgAHYAbwB1AHMAIADqAHQAZQBzACAAYQB1AHQAbwByAGkAcwDpACAA4AAgAHQAcgBhAG4AcwBmAOkAcgBlAHIAIABsAGUAIABwAHIA6QBzAGUAbgB0ACAAQwBMAFUARgAsACAAbABlACAATABvAGcAaQBjAGkAZQBsACAAZQB0ACAAbABlACAAQwBlAHIAdABpAGYAaQBjAGEAdAAgAGQAGSBBAHUAdABoAGUAbgB0AGkAYwBpAHQA6QAgACgAcwAZIGkAbAAgAGUAeABpAHMAdABlACkAIAB1AG4AZQAgAHMAZQB1AGwAZQAgAGYAbwBpAHMALAAgAOAAIAB0AGkAdAByAGUAIABwAGUAcgBtAGEAbgBlAG4AdAAsACAAZQB0ACAAZABpAHIAZQBjAHQAZQBtAGUAbgB0ACAA4AAgAHUAbgAgAGEAdQB0AHIAZQAgAHUAdABpAGwAaQBzAGEAdABlAHUAcgAgAGYAaQBuAGEAbAAsACAA4AAgAGMAbwBuAGQAaQB0AGkAbwBuACAAcQB1AGUAIAB2AG8AdQBzACAAbgBlACAAYwBvAG4AcwBlAHIAdgBpAGUAegAgAGEAdQBjAHUAbgAgAGUAeABlAG0AcABsAGEAaQByAGUAIABkAHUAIABMAG8AZwBpAGMAaQBlAGwALgAgAEMAZQAgAHQAcgBhAG4AcwBmAGUAcgB0ACAAZABvAGkAdAAgAGMAbwBtAHAAcgBlAG4AZAByAGUAIABsAGEAIAB0AG8AdABhAGwAaQB0AOkAIABkAHUAIABMAG8AZwBpAGMAaQBlAGwALAAgAHkAIABjAG8AbQBwAHIAaQBzACAAdABvAHUAcwAgAHMAZQBzACAAYwBvAG0AcABvAHMAYQBuAHQAcwAsACAAbABlAHMAIABzAHUAcABwAG8AcgB0AHMAIABlAHQAIABsAGEAIABkAG8AYwB1AG0AZQBuAHQAYQB0AGkAbwBuACAAaQBtAHAAcgBpAG0A6QBlACwAIAB0AG8AdQB0AGUAIABtAGkAcwBlACAA4AAgAGoAbwB1AHIALAAgAGwAZQAgAHAAcgDpAHMAZQBuAHQAIABDAEwAVQBGACAAZQB0ACwAIABzABkgaQBsACAAZQB4AGkAcwB0AGUALAAgAGwAZQAgAEMAZQByAHQAaQBmAGkAYwBhAHQAIABkABkgQQB1AHQAaABlAG4AdABpAGMAaQB0AOkALgAgAEwAZQAgAHQAcgBhAG4AcwBmAGUAcgB0ACAAbgBlACAAZABvAGkAdAAgAHAAYQBzACAA6gB0AHIAZQAgAGUAZgBmAGUAYwB0AHUA6QAgAHAAYQByACAAbABlACAAYgBpAGEAaQBzACAAZAAZIHUAbgAgAGUAbgB2AG8AaQAgAG8AdQAgAGQAZQAgAHQAbwB1AHQAIABhAHUAdAByAGUAIAB0AHIAYQBuAHMAZgBlAHIAdAAgAGkAbgBkAGkAcgBlAGMAdAAuACAAQQB2AGEAbgB0ACAAbABlACAAdAByAGEAbgBzAGYAZQByAHQALAAgAGwAGSB1AHQAaQBsAGkAcwBhAHQAZQB1AHIAIABmAGkAbgBhAGwAIABiAOkAbgDpAGYAaQBjAGkAYQBpAHIAZQAgAGQAbwBpAHQAIABhAGMAYwBlAHAAdABlAHIAIABkAGUAIABzAGUAIABjAG8AbgBmAG8AcgBtAGUAcgAgAGEAdQB4ACAAdABlAHIAbQBlAHMAIABkAHUAIABwAHIA6QBzAGUAbgB0ACAAQwBMAFUARgAuAAoAMQA1AC4ACQBSAMkAUwBJAEwASQBBAFQASQBPAE4ALgAgAFMAYQBuAHMAIABwAHIA6QBqAHUAZABpAGMAZQAgAGQAZQAgAHQAbwB1AHMAIABhAHUAdAByAGUAcwAgAGQAcgBvAGkAdABzACwAIABNAGkAYwByAG8AcwBvAGYAdAAgAHAAbwB1AHIAcgBhACAAcgDpAHMAaQBsAGkAZQByACAAbABlACAAcAByAOkAcwBlAG4AdAAgAEMATABVAEYAIABzAGkAIAB2AG8AdQBzACAAbgAZIGUAbgAgAHIAZQBzAHAAZQBjAHQAZQB6ACAAcABhAHMAIABsAGUAcwAgAHQAZQByAG0AZQBzAC4AIABEAGEAbgBzACAAYwBlACAAYwBhAHMALAAgAHYAbwB1AHMAIABkAGUAdgByAGUAegAgAGQA6QB0AHIAdQBpAHIAZQAgAHQAbwB1AHMAIABsAGUAcwAgAGUAeABlAG0AcABsAGEAaQByAGUAcwAgAGQAdQAgAEwAbwBnAGkAYwBpAGUAbAAgAGUAdAAgAHQAbwB1AHMAIABzAGUAcwAgAGMAbwBtAHAAbwBzAGEAbgB0AHMALgAKADEANgAuAAkASQBOAFQAyQBHAFIAQQBMAEkAVADJACAARABFAFMAIABBAEMAQwBPAFIARABTAKAAOwAgAEkATgBEAMkAUABFAE4ARABBAE4AQwBFACAARABFAFMAIABDAEwAQQBVAFMARQBTAC4AIABMAGUAIABwAHIA6QBzAGUAbgB0ACAAQwBMAFUARgAgACgAeQAgAGMAbwBtAHAAcgBpAHMAIAB0AG8AdQB0ACAAYQBkAGQAZQBuAGQAdQBtACAAbwB1ACAAYQB2AGUAbgBhAG4AdAAgAGEAdQAgAHAAcgDpAHMAZQBuAHQAIABDAEwAVQBGACAAcQB1AGkAIABlAHMAdAAgAGkAbgBjAGwAdQBzACAAYQB2AGUAYwAgAGwAZQAgAEwAbwBnAGkAYwBpAGUAbAApACAAYwBvAG4AcwB0AGkAdAB1AGUAIABsABkgaQBuAHQA6QBnAHIAYQBsAGkAdADpACAAZABlAHMAIABhAGMAYwBvAHIAZABzACAAZQBuAHQAcgBlACAAdgBvAHUAcwAgAGUAdAAgAE0AaQBjAHIAbwBzAG8AZgB0ACAAYwBvAG4AYwBlAHIAbgBhAG4AdAAgAGwAZQAgAEwAbwBnAGkAYwBpAGUAbAAgAGUAdAAgAGwAZQBzACAAcwBlAHIAdgBpAGMAZQBzACAAZAAZIGEAcwBzAGkAcwB0AGEAbgBjAGUAIAAoAHMAGSBpAGwAcwAgAGUAeABpAHMAdABlAG4AdAApACAAZQB0ACAAYQBuAG4AdQBsAGUAIABlAHQAIAByAGUAbQBwAGwAYQBjAGUAIAB0AG8AdQB0AGUAcwAgAGwAZQBzACAAYwBvAG0AbQB1AG4AaQBjAGEAdABpAG8AbgBzACwAIABwAHIAbwBwAG8AcwBpAHQAaQBvAG4AcwAgAGUAdAAgAGQA6QBjAGwAYQByAGEAdABpAG8AbgBzACAAYQBuAHQA6QByAGkAZQB1AHIAZQBzACAAbwB1ACAAcAByAOkAcwBlAG4AdABlAHMALAAgAG8AcgBhAGwAZQBzACAAbwB1ACAA6QBjAHIAaQB0AGUAcwAsACAAcgBlAGwAYQB0AGkAdgBlAHMAIABhAHUAIABMAG8AZwBpAGMAaQBlAGwAIABvAHUAIADgACAAdABvAHUAdAAgAGEAdQB0AHIAZQAgAG8AYgBqAGUAdAAgAHYAaQBzAOkAIABwAGEAcgAgAGwAZQAgAHAAcgDpAHMAZQBuAHQAIABDAEwAVQBGAC4AIABEAGEAbgBzACAAbABhACAAbQBlAHMAdQByAGUAIABvAPkAIABsAGUAcwAgAHQAZQByAG0AZQBzACAAZABlAHMAIAByAOgAZwBsAGUAcwAgAG8AdQAgAHAAcgBvAGcAcgBhAG0AbQBlAHMAIABkAGUAIABNAGkAYwByAG8AcwBvAGYAdAAgAHIAZQBsAGEAdABpAGYAcwAgAGEAdQB4ACAAcwBlAHIAdgBpAGMAZQBzACAAZAAZIGEAcwBzAGkAcwB0AGEAbgBjAGUAIABzAGUAcgBhAGkAZQBuAHQAIABlAG4AIABjAG8AbgBmAGwAaQB0ACAAYQB2AGUAYwAgAGwAZQBzACAAcwB0AGkAcAB1AGwAYQB0AGkAbwBuAHMAIABkAHUAIABwAHIA6QBzAGUAbgB0ACAAQwBMAFUARgAsACAAbABlAHMAIABzAHQAaQBwAHUAbABhAHQAaQBvAG4AcwAgAGQAZQAgAGMAZQAgAEMATABVAEYAIABwAHIA6QB2AGEAdQBkAHIAbwBuAHQALgAgAFMAaQAgAHUAbgBlACAAcQB1AGUAbABjAG8AbgBxAHUAZQAgAHMAdABpAHAAdQBsAGEAdABpAG8AbgAgAGQAdQAgAHAAcgDpAHMAZQBuAHQAIABDAEwAVQBGACAAZQBzAHQAIABqAHUAZwDpAGUAIABuAHUAbABsAGUALAAgAG4AbwBuACAAdgBhAGwAYQBiAGwAZQAsACAAaQBsAGwAaQBjAGkAdABlACAAbwB1ACAAaQBuAGEAcABwAGwAaQBjAGEAYgBsAGUAIABwAGEAcgAgAHUAbgBlACAAagB1AHIAaQBkAGkAYwB0AGkAbwBuACAAYwBvAG0AcADpAHQAZQBuAHQAZQAsACAAbABlAHMAIABhAHUAdAByAGUAcwAgAHMAdABpAHAAdQBsAGEAdABpAG8AbgBzACAAZABlACAAYwBlACAAQwBMAFUARgAgAGQAZQBtAGUAdQByAGUAcgBvAG4AdAAgAHAAbABlAGkAbgBlAG0AZQBuAHQAIABhAHAAcABsAGkAYwBhAGIAbABlAHMALgAKAAoATABhACAAZwBhAHIAYQBuAHQAaQBlACAAbABpAG0AaQB0AOkAZQAgAGMAaQAtAGQAZQBzAHMAbwB1AHMAIABzABkgYQBwAHAAbABpAHEAdQBlACAAcwBpACAAdgBvAHUAcwAgAGEAdgBlAHoAIABhAGMAcQB1AGkAcwAgAGwAZQAgAHAAcgBvAGQAdQBpAHQAIABhAHUAIABDAGEAbgBhAGQAYQAKAEcAQQBSAEEATgBUAEkARQAgAEwASQBNAEkAVADJAEUACgBHAEEAUgBBAE4AVABJAEUAIABMAEkATQBJAFQAyQBFACAAFCAgAE0AaQBjAHIAbwBzAG8AZgB0ACAAZwBhAHIAYQBuAHQAaQB0ACAAcQB1AGUAIAAoAGEAKQAgAGwAZQAgAGYAbwBuAGMAdABpAG8AbgBuAGUAbQBlAG4AdAAgAGQAdQAgAEwATwBHAEkAQwBJAEUATAAgAHMAZQByAGEAIABjAG8AbgBmAG8AcgBtAGUALAAgAHAAbwB1AHIAIABsABkgZQBzAHMAZQBuAHQAaQBlAGwALAAgAOAAIABsAGEAIABkAGUAcwBjAHIAaQBwAHQAaQBvAG4AIABxAHUAaQAgAGYAaQBnAHUAcgBlACAAZABhAG4AcwAgAGwAYQAgAGQAbwBjAHUAbQBlAG4AdABhAHQAaQBvAG4AIABxAHUAaQAgAGEAYwBjAG8AbQBwAGEAZwBuAGUAIABsAGUAIABMAE8ARwBJAEMASQBFAEwALAAgAHAAZQBuAGQAYQBuAHQAIAB1AG4AZQAgAGQAdQByAOkAZQAgAGQAZQAgAHEAdQBhAHQAcgBlAC0AdgBpAG4AZwB0AC0AZABpAHgAIAAoADkAMAApACAAagBvAHUAcgBzACAA4AAgAGMAbwBtAHAAdABlAHIAIABkAGUAIABsAGEAIABkAGEAdABlACAAZABlACAAcgDpAGMAZQBwAHQAaQBvAG4AIAA7ACAAZQB0ACAAcQB1AGUAIAAoAGIAKQAgAGwAZQBzACAAcwBlAHIAdgBpAGMAZQBzACAAZAAZIGEAcwBzAGkAcwB0AGEAbgBjAGUAIABmAG8AdQByAG4AaQBzACAAcABhAHIAIABNAGkAYwByAG8AcwBvAGYAdAAgAHMAZQByAG8AbgB0ACAAYwBvAG4AZgBvAHIAbQBlAHMALAAgAHAAbwB1AHIAIABsABkgZQBzAHMAZQBuAHQAaQBlAGwALAAgAOAAIABsAGEAIABkAGUAcwBjAHIAaQBwAHQAaQBvAG4AIABxAHUAaQAgAGUAbgAgAGUAcwB0ACAAZgBhAGkAdABlACAAZABhAG4AcwAgAGwAZQBzACAAZABvAGMAdQBtAGUAbgB0AHMAIABhAHAAcABsAGkAYwBhAGIAbABlAHMAIABxAHUAaQAgAHYAbwB1AHMAIABzAG8AbgB0ACAAcgBlAG0AaQBzACAAcABhAHIAIABNAGkAYwByAG8AcwBvAGYAdAAsACAAZQB0ACAAcQB1AGUAIABsAGUAcwAgAG0AZQBtAGIAcgBlAHMAIABkAHUAIAAgAHMAdQBwAHAAbwByAHQAIABkAGUAIABNAGkAYwByAG8AcwBvAGYAdAAgAGYAZQByAG8AbgB0ACAAZABlAHMAIABlAGYAZgBvAHIAdABzACAAcgBhAGkAcwBvAG4AbgBhAGIAbABlAHMAIABwAG8AdQByACAAcgDpAHMAbwB1AGQAcgBlACAAdABvAHUAdABlACAAZABpAGYAZgBpAGMAdQBsAHQA6QAgAHQAZQBjAGgAbgBpAHEAdQBlACAAZADpAGMAbwB1AGwAYQBuAHQAIABkAGUAIABsABkgdQB0AGkAbABpAHMAYQB0AGkAbwBuACAAZAB1ACAATABPAEcASQBDAEkARQBMAC4AIABDAGUAcgB0AGEAaQBuAGUAcwAgAGoAdQByAGkAZABpAGMAdABpAG8AbgBzACAAbgBlACAAcABlAHIAbQBlAHQAdABlAG4AdAAgAHAAYQBzACAAbABlAHMAIABsAGkAbQBpAHQAYQB0AGkAbwBuAHMAIABkAGUAIABkAHUAcgDpAGUAIABkABkgdQBuAGUAIABnAGEAcgBhAG4AdABpAGUALAAgAGQAZQAgAHMAbwByAHQAZQAgAHEAdQBlACAAbABhACAAbABpAG0AaQB0AGEAdABpAG8AbgAgAGMAaQAtAGQAZQBzAHMAdQBzACAAcABlAHUAdAAgAG4AZQAgAHAAYQBzACAAdgBvAHUAcwAgAOoAdAByAGUAIABhAHAAcABsAGkAYwBhAGIAbABlAC4AIABEAGEAbgBzACAAbABhACAAbQBlAHMAdQByAGUAIABwAGUAcgBtAGkAcwBlACAAcABhAHIAIABsAGEAIABsAG8AaQAgAGEAcABwAGwAaQBjAGEAYgBsAGUALAAgAHQAbwB1AHQAZQAgAGcAYQByAGEAbgB0AGkAZQAgAGkAbQBwAGwAaQBjAGkAdABlACAAZAB1ACAATABPAEcASQBDAEkARQBMACwAIABsAGUAIABjAGEAcwAgAOkAYwBoAOkAYQBuAHQALAAgAGUAcwB0ACAAbABpAG0AaQB0AOkAZQAgAOAAIABxAHUAYQB0AHIAZQAtAHYAaQBuAGcAdAAtAGQAaQB4ACAAKAA5ADAAKQAgAGoAbwB1AHIAcwAuAAoAUgBFAEMATwBVAFIAUwAgAEQAVQAgAEMATABJAEUATgBUACAAFCAgAEwAGSBlAG4AdABpAOgAcgBlACAAcgBlAHMAcABvAG4AcwBhAGIAaQBsAGkAdADpACAAZABlACAATQBpAGMAcgBvAHMAbwBmAHQAIABlAHQAIABkAGUAIABzAGUAcwAgAGYAbwB1AHIAbgBpAHMAcwBlAHUAcgBzACAAYQBpAG4AcwBpACAAcQB1AGUAIAB2AG8AdAByAGUAIABzAGUAdQBsACAAcgBlAGMAbwB1AHIAcwAgAHMAZQAgAGwAaQBtAGkAdABlAHIAbwBuAHQALAAgAGEAdQAgAGMAaABvAGkAeAAgAGQAZQAgAE0AaQBjAHIAbwBzAG8AZgB0ACwAIABzAG8AaQB0ACAAKABhACkAIABhAHUAIAByAGUAbQBiAG8AdQByAHMAZQBtAGUAbgB0ACAAZAB1ACAAcAByAGkAeAAgAHAAYQB5AOkALAAgAGwAZQAgAGMAYQBzACAA6QBjAGgA6QBhAG4AdAAsACAAbwB1ACAAKABiACkAIADgACAAbABhACAAcgDpAHAAYQByAGEAdABpAG8AbgAgAG8AdQAgAGEAdQAgAHIAZQBtAHAAbABhAGMAZQBtAGUAbgB0ACAAZAB1ACAATABPAEcASQBDAEkARQBMACAAcQB1AGkAIABuABkgZQBzAHQAIABwAGEAcwAgAGMAbwBuAGYAbwByAG0AZQAgAOAAIABsAGEAIABHAGEAcgBhAG4AdABpAGUAIABMAGkAbQBpAHQA6QBlACAAZABlACAATQBpAGMAcgBvAHMAbwBmAHQAIABlAHQAIABxAHUAaQAgAGUAcwB0ACAAcgBlAHQAbwB1AHIAbgDpACAA4AAgAE0AaQBjAHIAbwBzAG8AZgB0ACAAYQBjAGMAbwBtAHAAYQBnAG4A6QAgAGQAGSB1AG4AZQAgAGMAbwBwAGkAZQAgAGQAZQAgAHYAbwB0AHIAZQAgAHIAZQDnAHUALgAgAEMAZQB0AHQAZQAgAEcAYQByAGEAbgB0AGkAZQAgAEwAaQBtAGkAdADpAGUAIABuAGUAIABzAGUAcgBhACAAcABhAHMAIABhAHAAcABsAGkAYwBhAGIAbABlACAAcwBpACAAbABlACAAZADpAGYAYQB1AHQAIABkAHUAIABMAE8ARwBJAEMASQBFAEwAIAByAOkAcwB1AGwAdABlACAAZAAZIHUAbgAgAGEAYwBjAGkAZABlAG4AdAAsACAAZAAZIHUAbgAgAHUAcwBhAGcAZQAgAGEAeQBhAG4AdAAgAGUAbgB0AHIAYQDuAG4A6QAgAHUAbgBlACAAZADpAHQA6QByAGkAbwByAGEAdABpAG8AbgAgAG8AdQAgAGQAGSB1AG4AZQAgAHUAdABpAGwAaQBzAGEAdABpAG8AbgAgAGkAbgBhAHAAcAByAG8AcAByAGkA6QBlAC4AIABUAG8AdQB0ACAATABPAEcASQBDAEkARQBMACAAbwB1ACAAbQBhAHQA6QByAGkAZQBsACAAZABlACAAcgBlAG0AcABsAGEAYwBlAG0AZQBuAHQAIABzAGUAcgBhACAAZwBhAHIAYQBuAHQAaQAgAHMAbwBpAHQAIABwAG8AdQByACAAbABhACAAcADpAHIAaQBvAGQAZQAgAGQAZQAgAGcAYQByAGEAbgB0AGkAZQAgAGkAbgBpAHQAaQBhAGwAZQAgAHIAZQBzAHQAYQBuAHQAIADgACAAYwBvAHUAcgBpAHIAIABzAG8AaQB0ACAAcABlAG4AZABhAG4AdAAgAHQAcgBlAG4AdABlACAAKAAzADAAKQAgAGoAbwB1AHIAcwAsACAAbABhACAAcADpAHIAaQBvAGQAZQAgAGwAYQAgAHAAbAB1AHMAIABsAG8AbgBnAHUAZQAgAOkAdABhAG4AdAAgAGEAcABwAGwAaQBjAGEAYgBsAGUALgAgAEUAbgAgAGQAZQBoAG8AcgBzACAAZABlAHMAIABFAHQAYQB0AHMALQBVAG4AaQBzACwAIAB2AG8AdQBzACAAbgBlACAAcABvAHUAdgBlAHoAIABiAOkAbgDpAGYAaQBjAGkAZQByACAAbgBpACAAZABlACAAYwBlAHMAIAByAGUAYwBvAHUAcgBzACAAbgBpACAAZABlACAAdABvAHUAdAAgAHMAZQByAHYAaQBjAGUAIABkABkgYQBzAHMAaQBzAHQAYQBuAGMAZQAgAHAAcgBvAGQAdQBpAHQAIABwAHIAbwBwAG8AcwDpACAAcABhAHIAIABNAGkAYwByAG8AcwBvAGYAdAAgACAAcwBhAG4AcwAgAHUAbgBlACAAcAByAGUAdQB2AGUAIABkABkgYQBjAGgAYQB0ACAAcAByAG8AdgBlAG4AYQBuAHQAIABkABkgdQBuAGUAIABzAG8AdQByAGMAZQAgAGkAbgB0AGUAcgBuAGEAdABpAG8AbgBhAGwAZQAgAGEAdQB0AG8AcgBpAHMA6QBlAC4AIAAgACAACgBBAFUAQwBVAE4ARQAgAEEAVQBUAFIARQAgAEcAQQBSAEEATgBUAEkARQAgABQgIABEAEEATgBTACAATABBACAATQBFAFMAVQBSAEUAIABQAEUAUgBNAEkAUwBFACAAUABBAFIAIABMAEEAIABMAE8ASQAgAEEAUABQAEwASQBDAEEAQgBMAEUALAAgAE0ASQBDAFIATwBTAE8ARgBUACAARQBUACAAUwBFAFMAIABGAE8AVQBSAE4ASQBTAFMARQBVAFIAUwAgAEUAWABDAEwAVQBFAE4AVAAgAFQATwBVAFQARQAgAEEAVQBUAFIARQAgAEcAQQBSAEEATgBUAEkARQAgAE8AVQAgAEMATwBOAEQASQBUAEkATwBOACwAIABFAFgAUABSAEUAUwBTAEUAIABPAFUAIABJAE0AUABMAEkAQwBJAFQARQAsACAAUgBFAEwAQQBUAEkAVgBFACAAQQBVACAATABPAEcASQBDAEkARQBMACwAIADAACAATABBACAARABPAEMAVQBNAEUATgBUAEEAVABJAE8ATgAgAMkAQwBSAEkAVABFACAAUQBVAEkAIABMABkgQQBDAEMATwBNAFAAQQBHAE4ARQAgAEUAVAAgAMAAIABMAEEAIABGAE8AVQBSAE4ASQBUAFUAUgBFACAATwBVACAAQQBVACAARADJAEYAQQBVAFQAIABEAEUAIABGAE8AVQBSAE4ASQBUAFUAUgBFACAARABFAFMAIABTAEUAUgBWAEkAQwBFAFMAIABEABkgQQBTAFMASQBTAFQAQQBOAEMARQAsACAATgBPAFQAQQBNAE0ARQBOAFQAIABMAEUAUwAgAEcAQQBSAEEATgBUAEkARQBTACAASQBNAFAATABJAEMASQBUAEUAUwAgAEQARQAgAFEAVQBBAEwASQBUAMkALAAgAEQAGSBBAEQAyQBRAFUAQQBUAEkATwBOACAAUABPAFUAUgAgAEwAQQAgAEMATwBNAE0ARQBSAEMASQBBAEwASQBTAEEAVABJAE8ATgAgAE8AVQAgAMAAIABVAE4AIABVAFMAQQBHAEUAIABQAEEAUgBUAEkAQwBVAEwASQBFAFIALAAgAEQARQAgAFAAUgBPAFAAUgBJAMkAVADJACAARQBUACAARAAZIEEAQgBTAEUATgBDAEUAIABEAEUAIABDAE8ATgBUAFIARQBGAEEAxwBPAE4ALgAgAEMARQBUAFQARQAgAEcAQQBSAEEATgBUAEkARQAgAEwASQBNAEkAVADJAEUAIABWAE8AVQBTACAAQwBPAE4ARgDIAFIARQAgAEQARQBTACAARABSAE8ASQBUAFMAIABTAFAAyQBDAEkARgBJAFEAVQBFAFMALgAgAAoAQQBCAFMARQBOAEMARQAgAEQARQAgAFIARQBTAFAATwBOAFMAQQBCAEkATABJAFQAyQAgAFAATwBVAFIAIABMAEUAUwAgAEQATwBNAE0AQQBHAEUAUwAgAEkATgBEAEkAUgBFAEMAVABTACAAFCAgAEQAQQBOAFMAIABUAE8AVQBUAEUAIABMAEEAIABNAEUAUwBVAFIARQAgAFAARQBSAE0ASQBTAEUAIABQAEEAUgAgAEwAQQAgA"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\11.0\Registration\{9011040C-6000-11D3-8CFE-0150048383C9}]
"Current4"="EwATwBJACAAQQBQAFAATABJAEMAQQBCAEwARQAsACAATQBJAEMAUgBPAFMATwBGAFQAIABPAFUAIABTAEUAUwAgAEYATwBVAFIATgBJAFMAUwBFAFUAUgBTACAATgBFACAAUABPAFUAUgBSAE8ATgBUACAARQBOACAAQQBVAEMAVQBOACAAQwBBAFMAIABFAFQAUgBFACAAVABFAE4AVQBTACAAUgBFAFMAUABPAE4AUwBBAEIATABFAFMAIABEAEUAIABUAE8AVQBUACAARABPAE0ATQBBAEcARQAgAFMAUADJAEMASQBBAEwALAAgAEkATgBDAEkARABFAE4AVAAsACAASQBOAEQASQBSAEUAQwBUACAATwBVACAAQQBDAEMARQBTAFMATwBJAFIARQAgAEQARQAgAFEAVQBFAEwAUQBVAEUAIABOAEEAVABVAFIARQAgAFEAVQBFACAAQwBFACAAUwBPAEkAVAAgACgATgBPAFQAQQBNAE0ARQBOAFQAIABMAEUAUwAgAFAARQBSAFQARQBTACAARABFACAAQgDJAE4AyQBGAEkAQwBFAFMALAAgAEkATgBUAEUAUgBSAFUAUABUAEkATwBOAFMAIABEABkgQQBDAFQASQBWAEkAVADJACwAIABQAEUAUgBUAEUAUwAgAEQAGSBJAE4ARgBPAFIATQBBAFQASQBPAE4AUwAgAE8AVQAgAFQATwBVAFQARQAgAEEAVQBUAFIARQAgAFAARQBSAFQARQAgAFAAyQBDAFUATgBJAEEASQBSAEUAKQAgAEQAyQBDAE8AVQBMAEEATgBUACAARABFACAATAAZIFUAVABJAEwASQBTAEEAVABJAE8ATgAgAE8AVQAgAEQARQAgAEwAGSBJAE0AUABPAFMAUwBJAEIASQBMAEkAVADJACAARAAZIFUAVABJAEwASQBTAEUAUgAgAEwARQAgAEwATwBHAEkAQwBJAEUATAAsACAATwBVACAARABFACAATABBACAARgBPAFUAUgBOAEkAVABVAFIARQAgAE8AVQAgAEQAVQAgAEQAyQBGAEEAVQBUACAARABFACAARgBPAFUAUgBOAEkAVABVAFIARQAgAEQARQBTACAAUwBFAFIAVgBJAEMARQBTACAARAAZIEEAUwBTAEkAUwBUAEEATgBDAEUALAAgAE0AygBNAEUAIABTAEkAIABNAEkAQwBSAE8AUwBPAEYAVAAgAEEAIADJAFQAyQAgAEEAVgBJAFMAyQBFACAARABFACAATAAZIMkAVgBFAE4AVABVAEEATABJAFQAyQAgAEQARQAgAFQARQBMAFMAIABEAE8ATQBNAEEARwBFAFMALgAgAEwAQQAgAFIARQBTAFAATwBOAFMAQQBCAEkATABJAFQAyQAgAEQARQAgAE0ASQBDAFIATwBTAE8ARgBUACAARQBOACAAVgBFAFIAVABVACAARABFACAAVABPAFUAVABFACAARABJAFMAUABPAFMASQBUAEkATwBOACAARABVACAAUABSAMkAUwBFAE4AVAAgAEMATABVAEYAIABOAEUAIABTAEEAVQBSAEEASQBUACAARQBYAEMAyQBEAEUAUgAgAEwARQAgAEwARQAgAFAATABVAFMAIABFAEwARQBWAEUAIABFAE4AVABSAEUAIABJACkATABFACAATQBPAE4AVABBAE4AVAAgAFEAVQBFACAAVgBPAFUAUwAgAEEAVgBFAFoAIABFAEYARgBFAEMAVABJAFYARQBNAEUATgBUACAAUABBAFkAyQAgAFAATwBVAFIAIABMAEUAIABMAE8ARwBJAEMASQBFAEwAIABPAFUAIABJAEkAKQAgAFUATgAgAE0ATwBOAFQAQQBOAFQAIADJAFEAVQBJAFYAQQBMAEUATgBUACAAwAAgADUAIABEAE8ATABMAEEAUgBTACAAVQBTACAAKABVAFMAJAAgADUALAAwADAAKQAgAEUATgAgAEQARQBWAEkAUwBFACAAyQBUAFIAQQBOAEcAyABSAEUALgAgAFQATwBVAFQARQBGAE8ASQBTACwAIABTAEkAIABWAE8AVQBTACAAQQBWAEUAWgAgAEMATwBOAEMATABVACAAVQBOACAAQwBPAE4AVABSAEEAVAAgAEQARQAgAFAAUgBFAFMAVABBAFQASQBPAE4AUwAgAEQARQAgAFMARQBSAFYASQBDAEUAUwAgAEEAVgBFAEMAIABNAEkAQwBSAE8AUwBPAEYAVAAsACAAVgBPAFUAUwAgAFMARQBSAEUAWgAgAEwASQDJACAAUABBAFIAIABMAEUAUwAgAFQARQBSAE0ARQBTACAARABVAEQASQBUACAAQwBPAE4AVABSAEEAVAAuACAACgBMAGUAIABwAHIA6QBzAGUAbgB0ACAAQwBMAFUARgAgAGUAcwB0ACAAcgDpAGcAaQAgAHAAYQByACAAbABlAHMAIABsAG8AaQBzACAAZABlACAAbABhACAAcAByAG8AdgBpAG4AYwBlACAAZABlACAAbAAZIE8AbgB0AGEAcgBpAG8ALAAgAEMAYQBuAGEAZABhAC4AIABDAGgAYQBjAHUAbgBlACAAZABlAHMAIABwAGEAcgB0AGkAZQBzACAAYQB1AHgAIABwAHIA6QBzAGUAbgB0AGUAcwAgAHIAZQBjAG8AbgBuAGEA7gB0ACAAaQByAHIA6QB2AG8AYwBhAGIAbABlAG0AZQBuAHQAIABsAGEAIABjAG8AbQBwAOkAdABlAG4AYwBlACAAZABlAHMAIAB0AHIAaQBiAHUAbgBhAHUAeAAgAGQAZQAgAGwAYQAgAHAAcgBvAHYAaQBuAGMAZQAgAGQAZQAgAGwAGSBPAG4AdABhAHIAaQBvACAAZQB0ACAAYwBvAG4AcwBlAG4AdAAgAOAAIABlAG4AZwBhAGcAZQByACAAdABvAHUAdABlACAAYQBjAHQAaQBvAG4AIABxAHUAaQAgAHAAbwB1AHIAcgBhAGkAdAAgAGQA6QBjAG8AdQBsAGUAcgAgAGQAZQBzACAAcAByAOkAcwBlAG4AdABlAHMAIABkAGUAdgBhAG4AdAAgAGwAZQBzACAAdAByAGkAYgB1AG4AYQB1AHgAIABkAHUAIABkAGkAcwB0AHIAaQBjAHQAIABqAHUAZABpAGMAaQBhAGkAcgBlACAAZABlACAAWQBvAHIAawAsACAAcAByAG8AdgBpAG4AYwBlACAAZABlACAAbAAZIE8AbgB0AGEAcgBpAG8ALgAKAFAAbwB1AHIAIAB0AG8AdQB0AGUAIABxAHUAZQBzAHQAaQBvAG4AIABxAHUAZQAgAHYAbwB1AHMAIABzAG8AdQBoAGEAaQB0AGUAcgBpAGUAegAgAHAAbwBzAGUAcgAgAGMAbwBuAGMAZQByAG4AYQBuAHQAIABjAGUAIABDAEwAVQBGACAAbwB1ACAAcwBpACAAdgBvAHUAcwAgAGQA6QBzAGkAcgBlAHoAIABjAG8AbgB0AGEAYwB0AGUAcgAgACAATQBpAGMAcgBvAHMAbwBmAHQAIABwAG8AdQByACAAcQB1AGUAbABxAHUAZQAgAHIAYQBpAHMAbwBuACAAcQB1AGUAIABjAGUAIABzAG8AaQB0ACwAIAB2AGUAdQBpAGwAbABlAHoAIABjAG8AbgB0AGEAYwB0AGUAcgAgAGwAYQAgAGYAaQBsAGkAYQBsAGUAIABNAGkAYwByAG8AcwBvAGYAdAAgAGQAZQBzAHMAZQByAHYAYQBuAHQAIAB2AG8AdAByAGUAIABwAGEAeQBzACAA4AAgAGwAGSBhAGQAcgBlAHMAcwBlACAAaQBuAGQAaQBxAHUA6QBlACAAZABhAG4AcwAgAGMAZQAgAHAAcgBvAGQAdQBpAHQAIABvAHUAIADpAGMAcgBpAHIAZQAgAOAAoAA6ACAATQBpAGMAcgBvAHMAbwBmAHQAIABTAGEAbABlAHMAIABJAG4AZgBvAHIAbQBhAHQAaQBvAG4AIABDAGUAbgB0AGUAcgAsACAATwBuAGUAIABNAGkAYwByAG8AcwBvAGYAdAAgAFcAYQB5ACwAIABSAGUAZABtAG8AbgBkACwAIABXAGEAcwBoAGkAbgBnAHQAbwBuAKAAOQA4ADAANQAyAC0ANgAzADkAOQAuAAoACgAKAEwAQQAgAEcAQQBSAEEATgBUAEkARQAgAEMASQAtAEEAUABSAMgAUwAgACAAUwBFAFIAQQAgAEEAUABQAEwASQBDAEEAQgBMAEUAIABTAEkAIABWAE8AVQBTACAAQQBWAEUAWgAgAEEAQwBRAFUASQBTACAAIABMAEUAIABQAFIATwBEAFUASQBUACAARABBAE4AUwAgAFQATwBVAFQAIABBAFUAVABSAEUAIABQAEEAWQBTAAoACgBHAGEAcgBhAG4AdABpAGUAIABNAGkAYwByAG8AcwBvAGYAdAAuACAATABhACAAcAByAOkAcwBlAG4AdABlACAAZwBhAHIAYQBuAHQAaQBlACAAbgAZIGEAIABhAHUAYwB1AG4AZQAgAGkAbgBjAGkAZABlAG4AYwBlACAAcwB1AHIAIABsAGUAcwAgAGQAcgBvAGkAdABzACAAbADpAGcAYQB1AHgAIAATICAATABhACAAZwBhAHIAYQBuAHQAaQBlACAAYwBpAC0AYQBwAHIA6ABzACAAbgAZIGUAcwB0ACAAcABhAHMAIABsAGkAbQBpAHQA6QBlACAA4AAgAHUAbgAgAHEAdQBlAGwAYwBvAG4AcQB1AGUAIAB0AGUAcgByAGkAdABvAGkAcgBlACAAZQB0ACAAbgAZIGEAIABhAHUAYwB1AG4AZQAgAGkAbgBjAGkAZABlAG4AYwBlACAAcwB1AHIAIAB1AG4AIABxAHUAZQBsAGMAbwBuAHEAdQBlACAAZAByAG8AaQB0ACAAbADpAGcAYQBsACAAZABvAG4AdAAgAHYAbwB1AHMAIABwAG8AdQByAHIAaQBlAHoAIABiAOkAbgDpAGYAaQBjAGkAZQByACAAZABlACAAbABhACAAcABhAHIAdAAgAGQAZQAgAHYAbwB0AHIAZQAgAHIAZQB2AGUAbgBkAGUAdQByACAAbwB1ACAAZABlACAATQBpAGMAcgBvAHMAbwBmAHQAIABzAGkAIAB2AG8AdQBzACAAYQB2AGUAegAgAGEAYwBxAHUAaQBzACAAbABlACAAUAByAG8AZAB1AGkAdAAgAGQAaQByAGUAYwB0AGUAbQBlAG4AdAAgAGEAdQBwAHIA6ABzACAAZABlACAATQBpAGMAcgBvAHMAbwBmAHQALgAgAAoACgBMAGEAIABnAGEAcgBhAG4AdABpAGUAIAATICAATABlACAAUAByAG8AZAB1AGkAdAAgAGUAcwB0ACAAYwBvAG4A5wB1ACAAZQB0ACAAcAByAG8AcABvAHMA6QAgAGMAbwBtAG0AZQAgAOkAdABhAG4AdAAgAHUAbgAgAHAAcgBvAGQAdQBpAHQAIADgACAAdQBzAGEAZwBlACAAZwDpAG4A6QByAGEAbAAgAGUAdAAgAG4AGSBlAHMAdAAgAHAAYQBzACAAZABlAHMAdABpAG4A6QAgAOAAIAByAOkAcABvAG4AZAByAGUAIABhAHUAeAAgAGIAZQBzAG8AaQBuAHMAIABwAGEAcgB0AGkAYwB1AGwAaQBlAHIAcwAgAGQAGSB1AG4AIABxAHUAZQBsAGMAbwBuAHEAdQBlACAAdQB0AGkAbABpAHMAYQB0AGUAdQByAC4AIABWAG8AdQBzACAAcgBlAGMAbwBuAG4AYQBpAHMAcwBlAHoAIABxAHUAZQAgAGwAZQAgAFAAcgBvAGQAdQBpAHQAIABuABkgZQBzAHQAIABwAGEAcwAgAGUAeABlAG0AcAB0ACAAZAAZIGUAcgByAGUAdQByAHMAIABlAHQAIABxAHUAZQAgAG4AbwB1AHMAIAB2AG8AdQBzACAAYQB2AG8AbgBzACAAZgBvAHIAdABlAG0AZQBuAHQAIAByAGUAYwBvAG0AbQBhAG4AZADpACAAZABlACAAcwBhAHUAdgBlAGcAYQByAGQAZQByACAAcgDpAGcAdQBsAGkA6AByAGUAbQBlAG4AdAAgAHYAbwBzACAAZgBpAGMAaABpAGUAcgBzAC4AIABTAG8AdQBzACAAcgDpAHMAZQByAHYAZQAgAHEAdQBlACAAdgBvAHUAcwAgAGQAaQBzAHAAbwBzAGkAZQB6ACAAZAAZIHUAbgBlACAAbABpAGMAZQBuAGMAZQAgAHYAYQBsAGEAYgBsAGUALAAgAE0AaQBjAHIAbwBzAG8AZgB0ACAAZwBhAHIAYQBuAHQAaQB0ACAAcQB1AGUAIABhACkAIABsAGUAIABmAG8AbgBjAHQAaQBvAG4AbgBlAG0AZQBuAHQAIABkAHUAIABQAHIAbwBkAHUAaQB0ACAAcwBlAHIAYQAgAGMAbwBuAGYAbwByAG0AZQAsACAAcABvAHUAcgAgAGwAGSBlAHMAcwBlAG4AdABpAGUAbAAsACAA4AAgAGwAYQAgAGQAZQBzAGMAcgBpAHAAdABpAG8AbgAgAHEAdQBpACAAZgBpAGcAdQByAGUAIABkAGEAbgBzACAAbABhACAAZABvAGMAdQBtAGUAbgB0AGEAdABpAG8AbgAgAOkAYwByAGkAdABlACAAcQB1AGkAIABhAGMAYwBvAG0AcABhAGcAbgBlACAAbABlACAAUAByAG8AZAB1AGkAdAAsACAAcABlAG4AZABhAG4AdAAgAHUAbgBlACAAZAB1AHIA6QBlACAAZABlACAAcQB1AGEAdAByAGUALQB2AGkAbgBnAHQALQBkAGkAeAAgACgAOQAwACkAIABqAG8AdQByAHMAIADgACAAYwBvAG0AcAB0AGUAcgAgAGQAZQAgAGwAYQAgAGQAYQB0AGUAIABkAGUAIAByAOkAYwBlAHAAdABpAG8AbgAgAGQAZQAgAHYAbwB0AHIAZQAgAGwAaQBjAGUAbgBjAGUAIABkABkgdQB0AGkAbABpAHMAYQB0AGkAbwBuACAAZAB1ACAAUAByAG8AZAB1AGkAdAAgAG8AdQAgAHAAZQBuAGQAYQBuAHQAIABsAGEAIABkAHUAcgDpAGUAIABsAGEAIABwAGwAdQBzACAAYwBvAHUAcgB0AGUAIABhAHUAdABvAHIAaQBzAOkAZQAgAHAAYQByACAAbABhACAAcgDpAGcAbABlAG0AZQBuAHQAYQB0AGkAbwBuACAAYQBwAHAAbABpAGMAYQBiAGwAZQAsACAAZQB0ACAAcQB1AGUAIABiACkAIABsAGUAcwAgAHMAZQByAHYAaQBjAGUAcwAgAGQAGSBhAHMAcwBpAHMAdABhAG4AYwBlACAAZgBvAHUAcgBuAGkAcwAgAHAAYQByACAATQBpAGMAcgBvAHMAbwBmAHQAIABzAGUAcgBvAG4AdAAgAGMAbwBuAGYAbwByAG0AZQBzACwAIABwAG8AdQByACAAbAAZIGUAcwBzAGUAbgB0AGkAZQBsACwAIADgACAAbABhACAAZABlAHMAYwByAGkAcAB0AGkAbwBuACAAcQB1AGkAIABlAG4AIABlAHMAdAAgAGYAYQBpAHQAZQAgAGQAYQBuAHMAIABsAGUAcwAgAGQAbwBjAHUAbQBlAG4AdABzACAAaQBtAHAAcgBpAG0A6QBzACAAYQBwAHAAbABpAGMAYQBiAGwAZQBzACAAcQB1AGkAIAB2AG8AdQBzACAAcwBvAG4AdAAgAHIAZQBtAGkAcwAgAHAAYQByACAATQBpAGMAcgBvAHMAbwBmAHQALAAgAGUAdAAgAGwAZQBzACAAaQBuAGcA6QBuAGkAZQB1AHIAcwAgAHMAdQBwAHAAbwByAHQAIABkAGUAIABNAGkAYwByAG8AcwBvAGYAdAAgAGQA6QBwAGwAbwBpAGUAcgBvAG4AdAAgAGQAZQBzACAAZQBmAGYAbwByAHQAcwAgAHIAYQBpAHMAbwBuAG4AYQBiAGwAZQBzACAAZQB0ACAAZgBlAHIAbwBuAHQAIABhAHAAcABlAGwAIADgACAAdABvAHUAdABlAHMAIABsAGUAdQByAHMAIABjAG8AbQBwAOkAdABlAG4AYwBlAHMAIABwAG8AdQByACAAcgDpAHMAbwB1AGQAcgBlACAAdABvAHUAdAAgAHAAcgBvAGIAbADoAG0AZQAgAHMAbwB1AG0AaQBzAC4AIABEAGEAbgBzACAAbAAZIGgAeQBwAG8AdABoAOgAcwBlACAAbwD5ACAAbABlACAAUAByAG8AZAB1AGkAdAAgAG4AZQAgAHMAZQByAGEAaQB0ACAAcABhAHMAIABjAG8AbgBmAG8AcgBtAGUAIADgACAAbABhACAAcAByAOkAcwBlAG4AdABlACAAZwBhAHIAYQBuAHQAaQBlACwAIABNAGkAYwByAG8AcwBvAGYAdAAgAHAAbwB1AHIAcgBhACAAcwBvAGkAdAAgACgAYQApACAAcgDpAHAAYQByAGUAcgAgAG8AdQAgAHIAZQBtAHAAbABhAGMAZQByACAAbABlACAAUAByAG8AZAB1AGkAdAAgAHMAbwBpAHQAIAAoAGIAKQAgAHIAZQBtAGIAbwB1AHIAcwBlAHIAIABsAGUAIABwAHIAaQB4ACAAcQB1AGUAIAB2AG8AdQBzACAAYQB2AGUAegAgAHAAYQB5AOkALgAgAEMAZQB0AHQAZQAgAGcAYQByAGEAbgB0AGkAZQAgAG4AZQAgAHMAZQByAGEAIABwAGEAcwAgAGEAcABwAGwAaQBjAGEAYgBsAGUAIABzAGkAIABsAGUAIABkAOkAZgBhAHUAdAAgAGQAdQAgAFAAcgBvAGQAdQBpAHQAIAByAOkAcwB1AGwAdABlACAAZAAZIHUAbgAgAGEAYwBjA

DaKoala · Answer

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\avg8emc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\avg8emc]
"DisplayName"="AVG8 E-mail Scanner"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\avg8emc\Security]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\avg8emc\Enum]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\avg8emc\Enum]
"0"="Root\LEGACY_AVG8EMC\0000"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\avg8wd]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\avg8wd]
"DisplayName"="AVG8 WatchDog"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\avg8wd\Security]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\avg8wd\Enum]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\avg8wd\Enum]
"0"="Root\LEGACY_AVG8WD\0000"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\AvgLdx86]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\AvgLdx86]
"DisplayName"="AVG AVI Loader Driver x86"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\AvgLdx86]
"Group"="AVG"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\AvgLdx86\Parameters]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\AvgLdx86\Parameters]
"LogPath"="\??\C:\Documents and Settings\All Users\Application Data\avg8\Log\avildr.log"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\AvgLdx86\Security]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\AvgLdx86\Enum]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\AvgLdx86\Enum]
"0"="Root\LEGACY_AVGLDX86\0000"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\AvgMfx86]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\AvgMfx86]
"DisplayName"="AVG On-access Scanner Minifilter Driver x86"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\AvgMfx86]
"Group"="AVG"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\AvgMfx86\Instances]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\AvgMfx86\Instances]
"DefaultInstance"="Avgmfx86 Instance"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\AvgMfx86\Instances\AvgMfx86 Instance]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\AvgMfx86\Parameters]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\AvgMfx86\Security]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\AvgMfx86\Enum]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\AvgMfx86\Enum]
"0"="Root\LEGACY_AVGMFX86\0000"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\AvgTdiX]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\AvgTdiX]
"DisplayName"="AVG8 Network Redirector"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\AvgTdiX\Security]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\AvgTdiX\Enum]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\AvgTdiX\Enum]
"0"="Root\LEGACY_AVGTDIX\0000"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\AvgEms]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\AvgEms]
"EventMessageFile"="C:\PROGRA~1\AVG\AVG8\avgemc.exe"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\AVG\AVG8\avgupd.exe"="C:\Program Files\AVG\AVG8\avgupd.exe:*:Enabled:avgupd.exe"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\AVG\AVG8\avgemc.exe"="C:\Program Files\AVG\AVG8\avgemc.exe:*:Enabled:avgemc.exe"

[HKEY_USERS\.DEFAULT\Software\Avg]

[HKEY_USERS\.DEFAULT\Software\Avg\Avg8]

[HKEY_USERS\S-1-5-19\Software\Avg]

[HKEY_USERS\S-1-5-19\Software\Avg\Avg8]

[HKEY_USERS\S-1-5-20\Software\Avg]

[HKEY_USERS\S-1-5-20\Software\Avg\Avg8]

[HKEY_USERS\S-1-5-21-1229272821-1214440339-682003330-500\Software\Adobe\Acrobat Reader\6.0\AVGeneral]

[HKEY_USERS\S-1-5-21-1229272821-1214440339-682003330-500\Software\Adobe\Acrobat Reader\6.0\AVGeneral\cButtonsExternal]

[HKEY_USERS\S-1-5-21-1229272821-1214440339-682003330-500\Software\Adobe\Acrobat Reader\6.0\AVGeneral\cButtonsInternal]

[HKEY_USERS\S-1-5-21-1229272821-1214440339-682003330-500\Software\Adobe\Acrobat Reader\6.0\AVGeneral\cPalettes]

[HKEY_USERS\S-1-5-21-1229272821-1214440339-682003330-500\Software\Adobe\Acrobat Reader\6.0\AVGeneral\cPalettes\c0]

[HKEY_USERS\S-1-5-21-1229272821-1214440339-682003330-500\Software\Adobe\Acrobat Reader\6.0\AVGeneral\cRecentFiles]

[HKEY_USERS\S-1-5-21-1229272821-1214440339-682003330-500\Software\Adobe\Acrobat Reader\6.0\AVGeneral\cRecentFiles\c1]

[HKEY_USERS\S-1-5-21-1229272821-1214440339-682003330-500\Software\Adobe\Acrobat Reader\6.0\AVGeneral\cRecentFiles\c2]

[HKEY_USERS\S-1-5-21-1229272821-1214440339-682003330-500\Software\Adobe\Acrobat Reader\6.0\AVGeneral\cRecentFiles\c3]

[HKEY_USERS\S-1-5-21-1229272821-1214440339-682003330-500\Software\Adobe\Acrobat Reader\6.0\AVGeneral\cRecentFiles\c4]

[HKEY_USERS\S-1-5-21-1229272821-1214440339-682003330-500\Software\Adobe\Acrobat Reader\6.0\AVGeneral\cRecentFiles\c5]

[HKEY_USERS\S-1-5-21-1229272821-1214440339-682003330-500\Software\Adobe\Acrobat Reader\6.0\AVGeneral\cToolbars]

[HKEY_USERS\S-1-5-21-1229272821-1214440339-682003330-500\Software\Adobe\Acrobat Reader\6.0\AVGeneral\cToolbars\c0]

[HKEY_USERS\S-1-5-21-1229272821-1214440339-682003330-500\Software\Adobe\Acrobat Reader\6.0\AVGeneral\cToolbars\c1]

[HKEY_USERS\S-1-5-21-1229272821-1214440339-682003330-500\Software\Adobe\Acrobat Reader\6.0\AVGeneral\cToolbars\c10]

[HKEY_USERS\S-1-5-21-1229272821-1214440339-682003330-500\Software\Adobe\Acrobat Reader\6.0\AVGeneral\cToolbars\c11]

[HKEY_USERS\S-1-5-21-1229272821-1214440339-682003330-500\Software\Adobe\Acrobat Reader\6.0\AVGeneral\cToolbars\c12]

[HKEY_USERS\S-1-5-21-1229272821-1214440339-682003330-500\Software\Adobe\Acrobat Reader\6.0\AVGeneral\cToolbars\c13]

[HKEY_USERS\S-1-5-21-1229272821-1214440339-682003330-500\Software\Adobe\Acrobat Reader\6.0\AVGeneral\cToolbars\c14]

[HKEY_USERS\S-1-5-21-1229272821-1214440339-682003330-500\Software\Adobe\Acrobat Reader\6.0\AVGeneral\cToolbars\c15]

[HKEY_USERS\S-1-5-21-1229272821-1214440339-682003330-500\Software\Adobe\Acrobat Reader\6.0\AVGeneral\cToolbars\c16]

[HKEY_USERS\S-1-5-21-1229272821-1214440339-682003330-500\Software\Adobe\Acrobat Reader\6.0\AVGeneral\cToolbars\c17]

[HKEY_USERS\S-1-5-21-1229272821-1214440339-682003330-500\Software\Adobe\Acrobat Reader\6.0\AVGeneral\cToolbars\c18]

[HKEY_USERS\S-1-5-21-1229272821-1214440339-682003330-500\Software\Adobe\Acrobat Reader\6.0\AVGeneral\cToolbars\c2]

[HKEY_USERS\S-1-5-21-1229272821-1214440339-682003330-500\Software\Adobe\Acrobat Reader\6.0\AVGeneral\cToolbars\c3]

[HKEY_USERS\S-1-5-21-1229272821-1214440339-682003330-500\Software\Adobe\Acrobat Reader\6.0\AVGeneral\cToolbars\c4]

[HKEY_USERS\S-1-5-21-1229272821-1214440339-682003330-500\Software\Adobe\Acrobat Reader\6.0\AVGeneral\cToolbars\c5]

[HKEY_USERS\S-1-5-21-1229272821-1214440339-682003330-500\Software\Adobe\Acrobat Reader\6.0\AVGeneral\cToolbars\c6]

[HKEY_USERS\S-1-5-21-1229272821-1214440339-682003330-500\Software\Adobe\Acrobat Reader\6.0\AVGeneral\cToolbars\c7]

[HKEY_USERS\S-1-5-21-1229272821-1214440339-682003330-500\Software\Adobe\Acrobat Reader\6.0\AVGeneral\cToolbars\c8]

[HKEY_USERS\S-1-5-21-1229272821-1214440339-682003330-500\Software\Adobe\Acrobat Reader\6.0\AVGeneral\cToolbars\c9]

[HKEY_USERS\S-1-5-21-1229272821-1214440339-682003330-500\Software\Avg]

[HKEY_USERS\S-1-5-21-1229272821-1214440339-682003330-500\Software\Avg\Avg8]

[HKEY_USERS\S-1-5-21-1229272821-1214440339-682003330-500\Software\Avg\Avg8\Dialogs]

[HKEY_USERS\S-1-5-21-1229272821-1214440339-682003330-500\Software\Avg\Avg8\Dialogs\Layout]

[HKEY_USERS\S-1-5-21-1229272821-1214440339-682003330-500\Software\Avg\Avg8\Dialogs\ListCtrl]

[HKEY_USERS\S-1-5-21-1229272821-1214440339-682003330-500\Software\Avg\Avg8\Dialogs\ListCtrl\2950]

[HKEY_USERS\S-1-5-21-1229272821-1214440339-682003330-500\Software\Avg\Avg8\Dialogs\ListCtrl\5870]

[HKEY_USERS\S-1-5-21-1229272821-1214440339-682003330-500\Software\Avg\Avg8\MainWnd]

[HKEY_USERS\S-1-5-21-1229272821-1214440339-682003330-500\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU\*]
"f"="C:\Documents and Settings\Administrateur\Bureau\ErreurAVG.txt"

[HKEY_USERS\S-1-5-21-1229272821-1214440339-682003330-500\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU	xt]
"e"="C:\Documents and Settings\Administrateur\Bureau\ErreurAVG.txt"

[HKEY_USERS\S-1-5-21-1229272821-1214440339-682003330-500\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Start Menu2\Programs\AVG Free 8.0]

[HKEY_USERS\S-1-5-21-1229272821-1214440339-682003330-500\Software\Microsoft\Windows\ShellNoRoam\MUICache]
"C:\PROGRA~1\AVG\AVG8\avgtray.exe"="AVG Tray Monitor"

[HKEY_USERS\S-1-5-21-1229272821-1214440339-682003330-500\Software\Microsoft\Windows\ShellNoRoam\MUICache]
"C:\Documents and Settings\Administrateur\Bureau\avg-antivirus-free-edition_avg_antivirus_free_edition_8.5.339a1525_francais_10997.exe"="AVG Setup Self-Extractor based on 7-Zip"

[HKEY_USERS\S-1-5-21-1229272821-1214440339-682003330-500\Software\Microsoft\Windows\ShellNoRoam\MUICache]
"C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\7zS1D.tmp\avgsetup.exe"="AVG Setup"

[HKEY_USERS\S-1-5-21-1229272821-1214440339-682003330-500\Software\NVIDIA Corporation\Global
View\WindowManagement\avgemc]

[HKEY_USERS\S-1-5-21-1229272821-1214440339-682003330-500\Software\NVIDIA Corporation\Global
View\WindowManagement\avgtray]

[HKEY_USERS\S-1-5-21-1229272821-1214440339-682003330-500\Software\NVIDIA Corporation\Global
View\WindowManagement\avgui]

[HKEY_USERS\S-1-5-18\Software\Avg]

[HKEY_USERS\S-1-5-18\Software\Avg\Avg8]

*******************
     [Fichier] 
*******************

c:\Program Files\AVG
c:\Program Files\AVG\AVG8\avg.snu
c:\WINDOWS\system32\drivers\Avg


*********************
     [Même date] 
*********************

[25/04/2008 ] --- REP ---> C:\Program Files\.   
[25/04/2008 ] --- REP ---> C:\Program Files\..   
[25/04/2008 ] --- REP ---> C:\Program Files\Adobe   
[25/04/2008 ] --- REP ---> C:\Program Files\adslTV   
[25/04/2008 ] --- REP ---> C:\Program Files\Ahead   
[25/04/2008 ] --- REP ---> C:\Program Files\Alcohol Soft  
[25/04/2008 ] --- REP ---> C:\Program Files\AMD   
[25/04/2008 ] --- REP ---> C:\Program Files\antispy   
[25/04/2008 ] --- REP ---> C:\Program Files\ASUS   
[25/04/2008 ] --- REP ---> C:\Program Files\AVG   
[25/04/2008 ] --- REP ---> C:\Program Files\Bonjour   
[25/04/2008 ] --- REP ---> C:\Program Files\ComPlus Applications  
[25/04/2008 ] --- REP ---> C:\Program Files\CyberLink   
[25/04/2008 ] --- REP ---> C:\Program Files\DIFX   
[25/04/2008 ] --- REP ---> C:\Program Files\Fichiers communs  
[25/04/2008 ] --- REP ---> C:\Program Files\InstallShield Installation Information 
[25/04/2008 ] --- REP ---> C:\Program Files\Internet Explorer  
[25/04/2008 ] --- REP ---> C:\Program Files\Microsoft Office  
[25/04/2008 ] --- REP ---> C:\Program Files\Microsoft Plus!  
[25/04/2008 ] --- REP ---> C:\Program Files\Microsoft Plus! Digital Media Edition 
[25/04/2008 ] --- REP ---> C:\Program Files\Microsoft.NET   
[25/04/2008 ] --- REP ---> C:\Program Files\Movie Maker  
[25/04/2008 ] --- REP ---> C:\Program Files\Mozilla Firefox  
[25/04/2008 ] --- REP ---> C:\Program Files\MSN Gaming Zone 
[25/04/2008 ] --- REP ---> C:\Program Files\My Company Name 
[25/04/2008 ] --- REP ---> C:\Program Files\NetMeeting   
[25/04/2008 ] --- REP ---> C:\Program Files\NVIDIA Corporation  
[25/04/2008 ] --- REP ---> C:\Program Files\Outlook Express  
[25/04/2008 ] --- REP ---> C:\Program Files\QuickTime   
[25/04/2008 ] --- REP ---> C:\Program Files\Realtek   
[25/04/2008 ] --- REP ---> C:\Program Files\Services en ligne 
[25/04/2008 ] --- REP ---> C:\Program Files\SuperCopier   
[25/04/2008 ] --- REP ---> C:\Program Files\TP-LINK   
[25/04/2008 ] --- REP ---> C:\Program Files\Uninstall Information  
[25/04/2008 ] --- REP ---> C:\Program Files\utiles   
[25/04/2008 ] --- REP ---> C:\Program Files\Winamp   
[25/04/2008 ] --- REP ---> C:\Program Files\Windows Media Player 
[25/04/2008 ] --- REP ---> C:\Program Files\Windows NT  
[25/04/2008 ] --- REP ---> C:\Program Files\WindowsUpdate   
[25/04/2008 ] --- REP ---> C:\Program Files\WinRAR   
[25/04/2008 ] ---> C:\.rnd   
[25/04/2008 ] ---> C:\AUTOEXEC.BAT   
[25/04/2008 ] ---> C:\boot.ini   
[25/04/2008 ] ---> C:\CONFIG.SYS   
[25/04/2008 ] ---> C:\IO.SYS   
[25/04/2008 ] ---> C:\MSDOS.SYS   
[25/04/2008 ] ---> C:\pagefile.sys   
[25/04/2008 ] ---> C:\RHDSetup.log   
[25/04/2008 ] ---> C:\WINDOWS\0.log   
[25/04/2008 ] ---> C:\WINDOWS\0701.ROM   
[25/04/2008 ] ---> C:\WINDOWS\0701.txt   
[25/04/2008 ] ---> C:\WINDOWS\Alcmtr.exe   
[25/04/2008 ] ---> C:\WINDOWS\alcwzrd.exe   
[25/04/2008 ] ---> C:\WINDOWS\AS_Debug.txt   
[25/04/2008 ] ---> C:\WINDOWS\Ascd_log.ini   
[25/04/2008 ] ---> C:\WINDOWS\Ascd_tmp.ini   
[25/04/2008 ] ---> C:\WINDOWS\ATKKBService.exe   
[25/04/2008 ] ---> C:\WINDOWS\audio.log   
[25/04/2008 ] ---> C:\WINDOWS\bootstat.dat   
[25/04/2008 ] ---> C:\WINDOWS\Bulles de savon.bmp 
[25/04/2008 ] ---> C:\WINDOWS\cmsetacl.log   
[25/04/2008 ] ---> C:\WINDOWS\comsetup.log   
[25/04/2008 ] ---> C:\WINDOWS\control.ini   
[25/04/2008 ] ---> C:\WINDOWS\desktop.ini   
[25/04/2008 ] ---> C:\WINDOWS\DirectX.log   
[25/04/2008 ] ---> C:\WINDOWS\DPINST.LOG   
[25/04/2008 ] ---> C:\WINDOWS\DtcInstall.log   
[25/04/2008 ] ---> C:\WINDOWS\FaxSetup.log   
[25/04/2008 ] ---> C:\WINDOWS\FileName   
[25/04/2008 ] ---> C:\WINDOWS\filespec7x   
[25/04/2008 ] ---> C:\WINDOWS\Granit vert.bmp  
[25/04/2008 ] ---> C:\WINDOWS\HideWin.exe   
[25/04/2008 ] ---> C:\WINDOWS\iis6.log   
[25/04/2008 ] ---> C:\WINDOWS\imsins.BAK   
[25/04/2008 ] ---> C:\WINDOWS\imsins.log   
[25/04/2008 ] ---> C:\WINDOWS\Jour de pˆche.bmp 
[25/04/2008 ] ---> C:\WINDOWS\KB834707.log   
[25/04/2008 ] ---> C:\WINDOWS\KB884020.log   
[25/04/2008 ] ---> C:\WINDOWS\KB885894.log   
[25/04/2008 ] ---> C:\WINDOWS\KB888111.log   
[25/04/2008 ] ---> C:\WINDOWS\KB893803v2.log   
[25/04/2008 ] ---> C:\WINDOWS\MedCtrOC.log   
[25/04/2008 ] ---> C:\WINDOWS\MicCal.exe   
[25/04/2008 ] ---> C:\WINDOWS\mozver.dat   
[25/04/2008 ] ---> C:\WINDOWS\msgsocm.log   
[25/04/2008 ] ---> C:\WINDOWS\msmqinst.log   
[25/04/2008 ] ---> C:\WINDOWS\Mur de Santa Fe.bmp 
[25/04/2008 ] ---> C:\WINDOWS
etfxocm.log   
[25/04/2008 ] ---> C:\WINDOWS\NOTEPAD.EXE   
[25/04/2008 ] ---> C:\WINDOWS
sreg.dat   
[25/04/2008 ] ---> C:\WINDOWS
sw.log   
[25/04/2008 ] ---> C:\WINDOWS
tdtcsetup.log   
[25/04/2008 ] ---> C:\WINDOWS
vidia.log   
[25/04/2008 ] ---> C:\WINDOWS\ocgen.log   
[25/04/2008 ] ---> C:\WINDOWS\ocmsn.log   
[25/04/2008 ] ---> C:\WINDOWS\ODBC.INI   
[25/04/2008 ] ---> C:\WINDOWS\ODBCINST.INI   
[25/04/2008 ] ---> C:\WINDOWS\OEWABLog.txt   
[25/04/2008 ] ---> C:\WINDOWS\oobeact.log   
[25/04/2008 ] ---> C:\WINDOWS\Plume.bmp   
[25/04/2008 ] ---> C:\WINDOWS\REGLOCS.OLD   
[25/04/2008 ] ---> C:\WINDOWSegopt.log   
[25/04/2008 ] ---> C:\WINDOWS\Rhododendron.bmp   
[25/04/2008 ] ---> C:\WINDOWS\RiviŠre Sumida.bmp  
[25/04/2008 ] ---> C:\WINDOWS\Rosace bleue 16.bmp 
[25/04/2008 ] ---> C:\WINDOWS\RTHDCPL.exe   
[25/04/2008 ] ---> C:\WINDOWS\RTLCPL.exe   
[25/04/2008 ] ---> C:\WINDOWS\RtlExUpd.dll   
[25/04/2008 ] ---> C:\WINDOWS\RtlUpd.exe   
[25/04/2008 ] ---> C:\WINDOWS\SchedLgU.Txt   
[25/04/2008 ] ---> C:\WINDOWS\sessmgr.setup.log   
[25/04/2008 ] ---> C:\WINDOWS\SET29.tmp   
[25/04/2008 ] ---> C:\WINDOWS\SET2A.tmp   
[25/04/2008 ] ---> C:\WINDOWS\SET2B.tmp   
[25/04/2008 ] ---> C:\WINDOWS\SET3.tmp   
[25/04/2008 ] ---> C:\WINDOWS\SET4.tmp   
[25/04/2008 ] ---> C:\WINDOWS\SET8.tmp   
[25/04/2008 ] ---> C:\WINDOWS\setupact.log   
[25/04/2008 ] ---> C:\WINDOWS\setupapi.log   
[25/04/2008 ] ---> C:\WINDOWS\setuperr.log   
[25/04/2008 ] ---> C:\WINDOWS\setuplog.txt   
[25/04/2008 ] ---> C:\WINDOWS\SkyTel.exe   
[25/04/2008 ] ---> C:\WINDOWS\SoundMan.exe   
[25/04/2008 ] ---> C:\WINDOWS\Sti_Trace.log   
[25/04/2008 ] ---> C:\WINDOWS\system32\$winnt$.inf   
[25/04/2008 ] ---> C:\WINDOWS\system32\access.cpl   
[25/04/2008 ] ---> C:\WINDOWS\system32\acctres.dll   
[25/04/2008 ] ---> C:\WINDOWS\system32\accwiz.exe   
[25/04/2008 ] ---> C:\WINDOWS\system32\AegisI5.exe   
[25/04/2008 ] ---> C:\WINDOWS\system32\ALSndMgr.cpl   
[25/04/2008 ] ---> C:\WINDOWS\system32\amcompat.tlb   
[25/04/2008 ] ---> C:\WINDOWS\system32\aschs.dll   
[25/04/2008 ] ---> C:\WINDOWS\system32\ASCHT.dll   
[25/04/2008 ] ---> C:\WINDOWS\system32\aseng.dll   
[25/04/2008 ] ---> C:\WINDOWS\system32\asfrench.dll   
[25/04/2008 ] ---> C:\WINDOWS\system32\asgerman.dll   
[25/04/2008 ] ---> C:\WINDOWS\system32\asjapan.dll   
[25/04/2008 ] ---> C:\WINDOWS\system32\askorean.dll   
[25/04/2008 ] ---> C:\WINDOWS\system32\asrussian.dll   
[25/04/2008 ] ---> C:\WINDOWS\system32\ATKDISP.dll   
[25/04/2008 ] ---> C:\WINDOWS\system32\ATKDispCPL.dll   
[25/04/2008 ] ---> C:\WINDOWS\system32\atkdsoff.rc0   
[25/04/2008 ] ---> C:\WINDOWS\system32\atkdson.rc0   
[25/04/2008 ] ---> C:\WINDOWS\system32\atkdst.rc0   
[25/04/2008 ] ---> C:\WINDOWS\system32\ATKF12.rc0   
[25/04/2008 ] ---> C:\WINDOWS\system32\ATKF12.rc1   
[25/04/2008 ] ---> C:\WINDOWS\system32\ATKF16.rc0   
[25/04/2008 ] ---> C:\WINDOWS\system32\ATKF16.rc1   
[25/04/2008 ] ---> C:\WINDOWS\system32\atkgfoff.rc0   
[25/04/2008 ] ---> C:\WINDOWS\system32\atkgfon.rc0   
[25/04/2008 ] ---> C:\WINDOWS\system32\atkgft.rc0   
[25/04/2008 ] ---> C:\WINDOWS\system32\atkgtvoff.rc0   
[25/04/2008 ] ---> C:\WINDOWS\system32\atkgtvon.rc0   
[25/04/2008 ] ---> C:\WINDOWS\system32\atkgtvt.rc0   
[25/04/2008 ] ---> C:\WINDOWS\system32\atkid.ini   
[25/04/2008 ] ---> C:\WINDOWS\system32\ATKOGL32.dll   
[25/04/2008 ] ---> C:\WINDOWS\system32\atkosdCHS.rc0   
[25/04/2008 ] ---> C:\WINDOWS\system32\atkosdCHT.rc0   
[25/04/2008 ] ---> C:\WINDOWS\system32\atkosdENG.rc0   
[25/04/2008 ] ---> C:\WINDOWS\system32\atkosdFRA.rc0   
[25/04/2008 ] ---> C:\WINDOWS\system32\atkosdGER.rc0   
[25/04/2008 ] ---> C:\WINDOWS\system32\atkosdJPN.rc0   
[25/04/2008 ] ---> C:\WINDOWS\system32\atkosdKOR.rc0   
[25/04/2008 ] ---> C:\WINDOWS\system32\ATKOSDMini.DLL   
[25/04/2008 ] ---> C:\WINDOWS\system32\atkosdRUS.rc0   
[25/04/2008 ] ---> C:\WINDOWS\system32\ATKOSDX32.dll   
[25/04/2008 ] ---> C:\WINDOWS\system32\atkrec.rc0   
[25/04/2008 ] ---> C:\WINDOWS\system32\atrace.dll   
[25/04/2008 ] ---> C:\WINDOWS\system32\avgrsstx.dll   
[25/04/2008 ] ---> C:\WINDOWS\system32\avmeter.dll   
[25/04/2008 ] ---> C:\WINDOWS\system32\avtapi.dll   
[25/04/2008 ] ---> C:\WINDOWS\system32\avwav.dll   
[25/04/2008 ] ---> C:\WINDOWS\system32\batt.dll   
[25/04/2008 ] ---> C:\WINDOWS\system32\bdco1.dll   
[25/04/2008 ] ---> C:\WINDOWS\system32\bdco1ins.dll   
[25/04/2008 ] ---> C:\WINDOWS\system32\bitsprx2.dll   
[25/04/2008 ] ---> C:\WINDOWS\system32\bitsprx3.dll   
[25/04/2008 ] ---> C:\WINDOWS\system32\bopomofo.uce   
[25/04/2008 ] ---> C:\WINDOWS\system32\BuzzingBee.wav   
[25/04/2008 ] ---> C:\WINDOWS\system32\c_10006.nls   
[25/04/2008 ] ---> C:\WINDOWS\system32\c_10007.nls   
[25/04/2008 ] ---> C:\WINDOWS\system32\c_10010.nls   
[25/04/2008 ] ---> C:\WINDOWS\system32\c_10017.nls   
[25/04/2008 ] ---> C:\WINDOWS\system32\c_10029.nls   
[25/04/2008 ] ---> C:\WINDOWS\system32\c_10081.nls   
[25/04/2008 ] ---> C:\WINDOWS\system32\c_10082.nls   
[25/04/2008 ] ---> C:\WINDOWS\system32\c_20127.nls   
[25/04/2008 ] ---> C:\WINDOWS\system32\C_28594.NLS   
[25/04/2008 ] ---> C:\WINDOWS\system32\C_28595.NLS   
[25/04/2008 ] ---> C:\WINDOWS\system32\C_28597.NLS   
[25/04/2008 ] ---> C:\WINDOWS\system32\c_28599.nls   
[25/04/2008 ] ---> C:\WINDOWS\system32\c_28603.nls   
[25/04/2008 ] ---> C:\WINDOWS\system32\c_737.nls   
[25/04/2008 ] ---> C:\WINDOWS\system32\c_852.nls   
[25/04/2008 ] ---> C:\WINDOWS\system32\c_855.nls   
[25/04/2008 ] ---> C:\WINDOWS\system32\c_857.nls   
[25/04/2008 ] ---> C:\WINDOWS\system32\c_866.nls   
[25/04/2008 ] ---> C:\WINDOWS\system32\c_869.nls   
[25/04/2008 ] ---> C:\WINDOWS\system32\c_875.nls   
[25/04/2008 ] ---> C:\WINDOWS\system32\calc.exe   
[25/04/2008 ] ---> C:\WINDOWS\system32\CapabilityTable.exe   
[25/04/2008 ] ---> C:\WINDOWS\system32\catsrv.dll   
[25/04/2008 ] ---> C:\WINDOWS\system32\catsrvps.dll   
[25/04/2008 ] ---> C:\WINDOWS\system32\catsrvut.dll   
[25/04/2008 ] ---> C:\WINDOWS\system32\cdmodem.dll   
[25/04/2008 ] ---> C:\WINDOWS\system32\cdplayer.exe.manifest   
[25/04/2008 ] ---> C:\WINDOWS\system32\cfgbkend.dll   
[25/04/2008 ] ---> C:\WINDOWS\system32\charmap.exe   
[25/04/2008 ] ---> C:\WINDOWS\system32\ChCfg.exe   
[25/04/2008 ] ---> C:\WINDOWS\system32\clbcatex.dll   
[25/04/2008 ] ---> C:\WINDOWS\system32\clbcatq.dll   
[25/04/2008 ] ---> C:\WINDOWS\system32\clipbrd.exe   
[25/04/2008 ] ---> C:\WINDOWS\system32\cmprops.dll   
[25/04/2008 ] ---> C:\WINDOWS\system32\colbact.dll   
[25/04/2008 ] ---> C:\WINDOWS\system32\comaddin.dll   
[25/04/2008 ] ---> C:\WINDOWS\system32\comrepl.dll   
[25/04/2008 ] ---> C:\WINDOWS\system32\comsnap.dll   
[25/04/2008 ] ---> C:\WINDOWS\system32\comsvcs.dll   
[25/04/2008 ] ---> C:\WINDOWS\system32\comuid.dll   
[25/04/2008 ] ---> C:\WINDOWS\system32\CONFIG.TMP   
[25/04/2008 ] ---> C:\WINDOWS\system32\ctrldll.dll   
[25/04/2008 ] ---> C:\WINDOWS\system32\d3dx9_24.dll   
[25/04/2008 ] ---> C:\WINDOWS\system32\d3dx9_25.dll   
[25/04/2008 ] ---> C:\WINDOWS\system32\d3dx9_26.dll   
[25/04/2008 ] ---> C:\WINDOWS\system32\d3dx9_27.dll   
[25/04/2008 ] ---> C:\WINDOWS\system32\d3dx9_28.dll   
[25/04/2008 ] ---> C:\WINDOWS\system32\d3dx9_29.dll   
[25/04/2008 ] ---> C:\WINDOWS\system32\d3dx9_30.dll   
[25/04/2008 ] ---> C:\WINDOWS\system32\dcomcnfg.exe   
[25/04/2008 ] ---> C:\WINDOWS\system32\desktop.ini   
[25/04/2008 ] ---> C:\WINDOWS\system32\dgrpsetu.dll   
[25/04/2008 ] ---> C:\WINDOWS\system32\dgsetup.dll   
[25/04/2008 ] ---> C:\WINDOWS\system32\drivers\aec.sys   
[25/04/2008 ] ---> C:\WINDOWS\system32\drivers\AegisP.sys   
[25/04/2008 ] ---> C:\WINDOWS\system32\drivers\AmdK8.sys   
[25/04/2008 ] ---> C:\WINDOWS\system32\drivers\AmdLLD.sys   
[25/04/2008 ] ---> C:\WINDOWS\system32\drivers\ASACPI.sys   
[25/04/2008 ] ---> C:\WINDOWS\system32\drivers\ASUSHWIO.SYS   
[25/04/2008 ] ---> C:\WINDOWS\system32\drivers\atkkbnt.sys   
[25/04/2008 ] ---> C:\WINDOWS\system32\drivers\audstub.sys   
[25/04/2008 ] ---> C:\WINDOWS\system32\drivers\avgldx86.sys   
[25/04/2008 ] ---> C:\WINDOWS\system32\drivers\avgmfx86.sys   
[25/04/2008 ] ---> C:\WINDOWS\system32\drivers\avgtdix.sys   
[25/04/2008 ] ---> C:\WINDOWS\system32\drivers\Bravo_a_crystal.sys   
[25/04/2008 ] ---> C:\WINDOWS\system32\drivers\Bravo_a_enriched.sys   
[25/04/2008 ] ---> C:\WINDOWS\system32\drivers\Bravo_a_theater.sys   
[25/04/2008 ] ---> C:\WINDOWS\system32\drivers\Bravo_a_vivid.sys   
[25/04/2008 ] ---> C:\WINDOWS\system32\drivers\Bravo_n_crystal.sys   
[25/04/2008 ] ---> C:\WINDOWS\system32\drivers\Bravo_n_enriched.sys   
[25/04/2008 ] ---> C:\WINDOWS\system32\drivers\Bravo_n_theater.sys   
[25/04/2008 ] ---> C:\WINDOWS\system32\drivers\Bravo_n_vivid.sys   
[25/04/2008 ] ---> C:\WINDOWS\system32\drivers\cdr4_xp.sys   
[25/04/2008 ] ---> C:\WINDOWS\system32\drivers\cdralw2k.sys   
[25/04/2008 ] ---> C:\WINDOWS\system32\drivers\DMusic.sys   
[25/04/2008 ] ---> C:\WINDOWS\system32\drivers\drmk.sys   
[25/04/2008 ] ---> C:\WINDOWS\system32\drivers\drmkaud.sys   
[25/04/2008 ] ---> C:\WINDOWS\system32\drivers\EIO.sys   
[25/04/2008 ] ---> C:\WINDOWS\system32\drivers\enum1394.sys   
[25/04/2008 ] ---> C:\WINDOWS\system32\drivers\fltmgr.sys   
[25/04/2008 ] ---> C:\WINDOWS\system32\drivers\imagedrv.sys   
[25/04/2008 ] ---> C:\WINDOWS\system32\drivers\imagesrv.sys   
[25/04/2008 ] ---> C:\WINDOWS\system32\drivers\irenum.sys   
[25/04/2008 ] ---> C:\WINDOWS\system32\drivers\kmixer.sys   
[25/04/2008 ] ---> C:\WINDOWS\system32\drivers\MSKSSRV.sys   
[25/04/2008 ] ---> C:\WINDOWS\system32\drivers\MSPCLOCK.sys   
[25/04/2008 ] ---> C:\WINDOWS\system32\drivers\MSPQM.sys   
[25/04/2008 ] ---> C:\WINDOWS\system32\drivers\NVENETFD.sys   
[25/04/2008 ] ---> C:\WINDOWS\system32\drivers
vnetbus.sys   
[25/04/2008 ] ---> C:\WINDOWS\system32\drivers
vnrm.sys   
[25/04/2008 ] ---> C:\WINDOWS\system32\drivers
vphy.bin   
[25/04/2008 ] ---> C:\WINDOWS\system32\drivers
vsnpu.sys   
[25/04/2008 ] ---> C:\WINDOWS\system32\drivers
vtcp.sys   
[25/04/2008 ] ---> C:\WINDOWS\system32\drivers\PxHelp20.sys   
[25/04/2008 ] ---> C:\WINDOWS\system32\driversdpdr.sys   
[25/04/2008 ] ---> C:\WINDOWS\system32\driversdpwd.sys   
[25/04/2008 ] ---> C:\WINDOWS\system32\driversedbook.sys   
[25/04/2008 ] ---> C:\WINDOWS\system32\driverst2500usb.SYS   
[25/04/2008 ] ---> C:\WINDOWS\system32\driverst73.bin   
[25/04/2008 ] ---> C:\WINDOWS\system32\driverst73.sys   
[25/04/2008 ] ---> C:\WINDOWS\system32\drivers\RtkHDAud.sys   
[25/04/2008 ] ---> C:\WINDOWS\system32\drivers\splitter.sys   
[25/04/2008 ] ---> C:\WINDOWS\system32\drivers\sptd.sys   
[25/04/2008 ] ---> C:\WINDOWS\system32\drivers\sr.sys   
[25/04/2008 ] ---> C:\WINDOWS\system32\drivers\swmidi.sys   
[25/04/2008 ] ---> C:\WINDOWS\system32\drivers\sysaudio.sys   
[25/04/2008 ] ---> C:\WINDOWS\system32\drivers	dpipe.sys   
[25/04/2008 ] ---> C:\WINDOWS\system32\drivers	dtcp.sys   
[25/04/2008 ] ---> C:\WINDOWS\system32\drivers	ermdd.sys   
[25/04/2008 ] ---> C:\WINDOWS\system32\drivers\usbprint.sys   
[25/04/2008 ] ---> C:\WINDOWS\system32\drivers\USBSTOR.SYS   
[25/04/2008 ] ---> C:\WINDOWS\system32\drivers\wdmaud.sys   
[25/04/2008 ] ---> C:\WINDOWS\system32\emptyregdb.dat   
[25/04/2008 ] ---> C:\WINDOWS\system32\EqnClass.Dll   
[25/04/2008 ] ---> C:\WINDOWS\system32\fdco1.dll   
[25/04/2008 ] ---> C:\WINDOWS\system32\fdco1ins.dll   
[25/04/2008 ] ---> C:\WINDOWS\system32\fltlib.dll   
[25/04/2008 ] ---> C:\WINDOWS\system32\fltmc.exe   
[25/04/2008 ] ---> C:\WINDOWS\system32\FNTCACHE.DAT   
[25/04/2008 ] ---> C:\WINDOWS\system32\freecell.exe   
[25/04/2008 ] ---> C:\WINDOWS\system32\gb2312.uce   
[25/04/2008 ] ---> C:\WINDOWS\system32\getuname.dll   
[25/04/2008 ] ---> C:\WINDOWS\system32\h323log.txt   
[25/04/2008 ] ---> C:\WINDOWS\system32\hticons.dll   
[25/04/2008 ] ---> C:\WINDOWS\system32\hypertrm.dll   
[25/04/2008 ] ---> C:\WINDOWS\system32\icaapi.dll   
[25/04/2008 ] ---> C:\WINDOWS\system32\icfgnt5.dll   
[25/04/2008 ] ---> C:\WINDOWS\system32\icwdial.dll   
[25/04/2008 ] ---> C:\WINDOWS\system32\icwphbk.dll   
[25/04/2008 ] ---> C:\WINDOWS\system32\ideograf.uce   
[25/04/2008 ] ---> C:\WINDOWS\system32\ils.dll   
[25/04/2008 ] ---> C:\WINDOWS\system32\ImagX7.dll   
[25/04/2008 ] ---> C:\WINDOWS\system32\ImagXpr7.dll   
[25/04/2008 ] ---> C:\WINDOWS\system32\ImagXR7.dll   
[25/04/2008 ] ---> C:\WINDOWS\system32\ImagXRA7.dll   
[25/04/2008 ] ---> C:\WINDOWS\system32\inetcfg.dll   
[25/04/2008 ] ---> C:\WINDOWS\system32\inetcomm.dll   
[25/04/2008 ] ---> C:\WINDOWS\system32\inetres.dll   
[25/04/2008 ] ---> C:\WINDOWS\system32\Install7x.dll   
[25/04/2008 ] ---> C:\WINDOWS\system32\irclass.dll   
[25/04/2008 ] ---> C:\WINDOWS\system32\isign32.dll   
[25/04/2008 ] ---> C:\WINDOWS\system32\isrdbg32.dll   
[25/04/2008 ] ---> C:\WINDOWS\system32\kanji_1.uce   
[25/04/2008 ] ---> C:\WINDOWS\system32\kanji_2.uce   
[25/04/2008 ] ---> C:\WINDOWS\system32\KBDAL.DLL   
[25/04/2008 ] ---> C:\WINDOWS\system32\kbdaze.dll   
[25/04/2008 ] ---> C:\WINDOWS\system32\kbdazel.dll   
[25/04/2008 ] ---> C:\WINDOWS\system32\kbdblr.dll   
[25/04/2008 ] ---> C:\WINDOWS\system32\kbdbu.dll   
[25/04/2008 ] ---> C:\WINDOWS\system32\kbdcr.dll   
[25/04/2008 ] ---> C:\WINDOWS\system32\kbdcz.dll   
[25/04/2008 ] ---> C:\WINDOWS\system32\kbdcz1.dll   
[25/04/2008 ] ---> C:\WINDOWS\system32\kbdcz2.dll   
[25/04/2008 ] ---> C:\WINDOWS\system32\kbdest.dll   
[25/04/2008 ] ---> C:\WINDOWS\system32\kbdgkl.dll   
[25/04/2008 ] ---> C:\WINDOWS\system32\kbdhe.dll   
[25/04/2008 ] ---> C:\WINDOWS\system32\kbdhe220.dll   
[25/04/2008 ] ---> C:\WINDOWS\system32\kbdhe319.dll   
[25/04/2008 ] ---> C:\WINDOWS\system32\kbdhela2.dll   
[25/04/2008 ] ---> C:\WINDOWS\system32\kbdhela3.dll   
[25/04/2008 ] ---> C:\WINDOWS\system32\kbdhept.dll   
[25/04/2008 ] ---> C:\WINDOWS\system32\kbdhu.dll   
[25/04/2008 ] ---> C:\WINDOWS\system32\kbdhu1.dll   
[25/04/2008 ] ---> C:\WINDOWS\system32\kbdkaz.dll   
[25/04/2008 ] ---> C:\WINDOWS\system32\kbdkyr.dll   
[25/04/2008 ] ---> C:\WINDOWS\system32\kbdlt.dll   
[25/04/2008 ] ---> C:\WINDOWS\system32\kbdlt1.dll   
[25/04/2008 ] ---> C:\WINDOWS\system32\kbdlv.dll   
[25/04/2008 ] ---> C:\WINDOWS\system32\kbdlv1.dll   
[25/04/2008 ] ---> C:\WINDOWS\system32\kbdmon.dll   
[25/04/2008 ] ---> C:\WINDOWS\system32\kbdpl.dll   
[25/04/2008 ] ---> C:\WINDOWS\system32\kbdpl1.dll   
[25/04/2008 ] ---> C:\WINDOWS\system32\kbdro.dll   
[25/04/2008 ] ---> C:\WINDOWS\system32\kbdru.dll   
[25/04/2008 ] ---> C:\WINDOWS\system32\kbdru1.dll   
[25/04/2008 ] ---> C:\WINDOWS\system32\kbdsl.dll   
[25/04/2008 ] ---> C:\WINDOWS\system32\kbdsl1.dll   
[25/04/2008 ] ---> C:\WINDOWS\system32\kbdtat.dll   
[25/04/2008 ] ---> C:\WINDOWS\system32\kbdtuf.dll   
[25/04/2008 ] ---> C:\WINDOWS\system32\kbdtuq.dll   
[25/04/2008 ] ---> C:\WINDOWS\system32\kbdur.dll   
[25/04/2008 ] ---> C:\WINDOWS\system32\kbduzb.dll   
[25/04/2008 ] ---> C:\WINDOWS\system32\kbdycc.dll   
[25/04/2008 ] ---> C:\WINDOWS\system32\kbdycl.dll   
[25/04/2008 ] ---> C:\WINDOWS\system32\korean.uce   
[25/04/2008 ] ---> C:\WINDOWS\system32\ksproxy.ax   
[25/04/2008 ] ---> C:\WINDOWS\system32\ksuser.dll   
[25/04/2008 ] ---> C:\WINDOWS\system32\licwmi.dll   
[25/04/2008 ] ---> C:\WINDOWS\system32\logoff.exe   
[25/04/2008 ] ---> C:\WINDOWS\system32\logonui.exe.manifest   
[25/04/2008 ] ---> C:\WINDOWS\system32\LoopyMusic.wav   
[25/04/2008 ] ---> C:\WINDOWS\system32\mapi32.dll   
[25/04/2008 ] ---> C:\WINDOWS\system32\mdimon.dll   
[25/04/2008 ] ---> C:\WINDOWS\system32\mmfutil.dll   
[25/04/2008 ] ---> C:\WINDOWS\system32\mnmdd.dll   
[25/04/2008 ] ---> C:\WINDOWS\system32\mnmsrvc.exe   
[25/04/2008 ] ---> C:\WINDOWS\system32\mplay32.exe   
[25/04/2008 ] ---> C:\WINDOWS\system32\msconf.dll   
[25/04/2008 ] ---> C:\WINDOWS\system32\msdtc.exe   
[25/04/2008 ] ---> C:\WINDOWS\system32\msdtclog.dll   
[25/04/2008 ] ---> C:\WINDOWS\system32\msdtcprf.h   
[25/04/2008 ] ---> C:\WINDOWS\system32\msdtcprf.ini   
[25/04/2008 ] ---> C:\WINDOWS\system32\msdtcprx.dll   
[25/04/2008 ] ---> C:\WINDOWS\system32\msdtctm.dll   
[25/04/2008 ] ---> C:\WINDOWS\system32\msdtcuiu.dll   
[25/04/2008 ] ---> C:\WINDOWS\system32\msg.exe   
[25/04/2008 ] ---> C:\WINDOWS\system32\msg723.acm   
[25/04/2008 ] ---> C:\WINDOWS\system32\msh261.drv   
[25/04/2008 ] ---> C:\WINDOWS\system32\mshearts.exe   
[25/04/2008 ] ---> C:\WINDOWS\system32\msoeacct.dll   
[25/04/2008 ] ---> C:\WINDOWS\system32\msoert2.dll   
[25/04/2008 ] ---> C:\WINDOWS\system32\mspaint.exe   
[25/04/2008 ] ---> C:\WINDOWS\system32\mstask.dll   
[25/04/2008 ] ---> C:\WINDOWS\system32\mstinit.exe   
[25/04/2008 ] ---> C:\WINDOWS\system32\mstsc.exe   
[25/04/2008 ] ---> C:\WINDOWS\system32\mstscax.dll   
[25/04/2008 ] ---> C:\WINDOWS\system32\mtxdm.dll   
[25/04/2008 ] ---> C:\WINDOWS\system32\mtxex.dll   
[25/04/2008 ] ---> C:\WINDOWS\system32\mtxlegih.dll   
[25/04/2008 ] ---> C:\WINDOWS\system32\mtxoci.dll   
[25/04/2008 ] ---> C:\WINDOWS\system32
cpa.cpl.manifest   
[25/04/2008 ] ---> C:\WINDOWS\system32\NeroCheck.exe   
[25/04/2008 ] ---> C:\WINDOWS\system32
mevtmsg.dll   
[25/04/2008 ] ---> C:\WINDOWS\system32
mmkcert.dll   
[25/04/2008 ] ---> C:\WINDOWS\system32
mp.log   
[25/04/2008 ] ---> C:\WINDOWS\system32\NPSWF32.dll   
[25/04/2008 ] ---> C:\WINDOWS\system32\NPSWF32_FlashUtil.exe   
[25/04/2008 ] ---> C:\WINDOWS\system32
scompat.tlb   
[25/04/2008 ] ---> C:\WINDOWS\system32
vapps.xml   
[25/04/2008 ] ---> C:\WINDOWS\system32
vconrm.dll   
[25/04/2008 ] ---> C:\WINDOWS\system32
vdisp.nvu   
[25/04/2008 ] ---> C:\WINDOWS\system32
vnrm.nvu   
[25/04/2008 ] ---> C:\WINDOWS\system32
vsmb.nvu   
[25/04/2008 ] ---> C:\WINDOWS\system32
vudisp.exe   
[25/04/2008 ] ---> C:\WINDOWS\system32\NVUNINST.EXE   
[25/04/2008 ] ---> C:\WINDOWS\system32
vunrm.exe   
[25/04/2008 ] ---> C:\WINDOWS\system32
vusmb.exe   
[25/04/2008 ] ---> C:\WINDOWS\system32
wc.cpl.manifest   
[25/04/2008 ] ---> C:\WINDOWS\system32\PerfStringBackup.INI   
[25/04/2008 ] ---> C:\WINDOWS\system32\px.dll   
[25/04/2008 ] ---> C:\WINDOWS\system32\pxafs.dll   
[25/04/2008 ] ---> C:\WINDOWS\system32\pxcpya64.exe   
[25/04/2008 ] ---> C:\WINDOWS\system32\pxdrv.dll   
[25/04/2008 ] ---> C:\WINDOWS\system32\pxhpinst.exe   
[25/04/2008 ] ---> C:\WINDOWS\system32\pxinsa64.exe   
[25/04/2008 ] ---> C:\WINDOWS\system32\pxmas.dll   
[25/04/2008 ] ---> C:\WINDOWS\system32\pxsfs.dll   
[25/04/2008 ] ---> C:\WINDOWS\system32\pxwave.dll   
[25/04/2008 ] ---> C:\WINDOWS\system32\qappsrv.exe   
[25/04/2008 ] ---> C:\WINDOWS\system32\qmgr.dll   
[25/04/2008 ] ---> C:\WINDOWS\system32\qmgrprxy.dll   
[25/04/2008 ] ---> C:\WINDOWS\system32\qprocess.exe   
[25/04/2008 ] ---> C:\WINDOWS\system32\qtplugin.log   
[25/04/2008 ] ---> C:\WINDOWS\system32\qwinsta.exe   
[25/04/2008 ] ---> C:\WINDOWS\system32acpldlg.dll   
[25/04/2008 ] ---> C:\WINDOWS\system32dchost.dll   
[25/04/2008 ] ---> C:\WINDOWS\system32dpcfgex.dll   
[25/04/2008 ] ---> C:\WINDOWS\system32dpclip.exe   
[25/04/2008 ] ---> C:\WINDOWS\system32dpsnd.dll   
[25/04/2008 ] ---> C:\WINDOWS\system32dpwsx.dll   
[25/04/2008 ] ---> C:\WINDOWS\system32dsaddin.exe   
[25/04/2008 ] ---> C:\WINDOWS\system32dshost.exe   
[25/04/2008 ] ---> C:\WINDOWS\system32egini.exe   
[25/04/2008 ] ---> C:\WINDOWS\system32emotepg.dll   
[25/04/2008 ] ---> C:\WINDOWS\system32eset.exe   
[25/04/2008 ] ---> C:\WINDOWS\system32mctrl.exe   
[25/04/2008 ] ---> C:\WINDOWS\system32\RTSndMgr.cpl   
[25/04/2008 ] ---> C:\WINDOWS\system32winsta.exe   
[25/04/2008 ] ---> C:\WINDOWS\system32\safrcdlg.dll   
[25/04/2008 ] ---> C:\WINDOWS\system32\safrdm.dll   
[25/04/2008 ] ---> C:\WINDOWS\system32\safrslv.dll   
[25/04/2008 ] ---> C:\WINDOWS\system32\sapi.cpl.manifest   
[25/04/2008 ] ---> C:\WINDOWS\system32\schedsvc.dll   
[25/04/2008 ] ---> C:\WINDOWS\system32\servdeps.dll   
[25/04/2008 ] ---> C:\WINDOWS\system32\sessmgr.exe   
[25/04/2008 ] ---> C:\WINDOWS\system32\shadow.exe   
[25/04/2008 ] ---> C:\WINDOWS\system32\shiftjis.uce   
[25/04/2008 ] ---> C:\WINDOWS\system32\sndrec32.exe   
[25/04/2008 ] ---> C:\WINDOWS\system32\sol.exe   
[25/04/2008 ] ---> C:\WINDOWS\system32\spider.exe   
[25/04/2008 ] ---> C:\WINDOWS\system32\spmsg.dll   
[25/04/2008 ] ---> C:\WINDOWS\system32\spupdsvc.exe   
[25/04/2008 ] ---> C:\WINDOWS\system32\spxcoins.dll   
[25/04/2008 ] ---> C:\WINDOWS\system32\srclient.dll   
[25/04/2008 ] ---> C:\WINDOWS\system32\srrstr.dll   
[25/04/2008 ] ---> C:\WINDOWS\system32\srsvc.dll   
[25/04/2008 ] ---> C:\WINDOWS\system32\stclient.dll   
[25/04/2008 ] ---> C:\WINDOWS\system32\storprop.dll   
[25/04/2008 ] ---> C:\WINDOWS\system32\subrange.uce   
[25/04/2008 ] ---> C:\WINDOWS\system32	ermsrv.dll   
[25/04/2008 ] ---> C:\WINDOWS\system32	scfgwmi.dll   
[25/04/2008 ] ---> C:\WINDOWS\system32	scon.exe   
[25/04/2008 ] ---> C:\WINDOWS\system32	scupgrd.exe   
[25/04/2008 ] ---> C:\WINDOWS\system32	sdiscon.exe   
[25/04/2008 ] ---> C:\WINDOWS\system32	skill.exe   
[25/04/2008 ] ---> C:\WINDOWS\system32	slabels.h   
[25/04/2008 ] ---> C:\WINDOWS\system32	slabels.ini   
[25/04/2008 ] ---> C:\WINDOWS\system32	sshutdn.exe   
[25/04/2008 ] ---> C:\WINDOWS\system32\TwnLib20.dll   
[25/04/2008 ] ---> C:\WINDOWS\system32\usbui.dll   
[25/04/2008 ] ---> C:\WINDOWS\system32\usrlogon.cmd   
[25/04/2008 ] ---> C:\WINDOWS\system32\vxblock.dll   
[25/04/2008 ] ---> C:\WINDOWS\system32\winchat.exe   
[25/04/2008 ] ---> C:\WINDOWS\system32\WindowsLogon.manifest   
[25/04/2008 ] ---> C:\WINDOWS\system32\winmine.exe   
[25/04/2008 ] ---> C:\WINDOWS\system32\wmimgmt.msc   
[25/04/2008 ] ---> C:\WINDOWS\system32\write.exe   
[25/04/2008 ] ---> C:\WINDOWS\system32\wuapi.dll   
[25/04/2008 ] ---> C:\WINDOWS\system32\wuauclt.exe   
[25/04/2008 ] ---> C:\WINDOWS\system32\wuauclt1.exe   
[25/04/2008 ] ---> C:\WINDOWS\system32\wuaucpl.cpl   
[25/04/2008 ] ---> C:\WINDOWS\system32\wuaucpl.cpl.manifest   
[25/04/2008 ] ---> C:\WINDOWS\system32\wuaueng.dll   
[25/04/2008 ] ---> C:\WINDOWS\system32\wuaueng1.dll   
[25/04/2008 ] ---> C:\WINDOWS\system32\wuauserv.dll   
[25/04/2008 ] ---> C:\WINDOWS\system32\wucltui.dll   
[25/04/2008 ] ---> C:\WINDOWS\system32\wups.dll   
[25/04/2008 ] ---> C:\WINDOWS\system32\wuweb.dll   
[25/04/2008 ] ---> C:\WINDOWS\system32\x3daudio1_0.dll   
[25/04/2008 ] ---> C:\WINDOWS\system32\xactengine2_0.dll   
[25/04/2008 ] ---> C:\WINDOWS\system32\xactengine2_1.dll   
[25/04/2008 ] ---> C:\WINDOWS\system32\xactengine2_2.dll   
[25/04/2008 ] ---> C:\WINDOWS\system32\xactengine2_3.dll   
[25/04/2008 ] ---> C:\WINDOWS\system32\xinput1_1.dll   
[25/04/2008 ] ---> C:\WINDOWS\system32\xinput1_2.dll   
[25/04/2008 ] ---> C:\WINDOWS\system32\xinput9_1_0.dll   
[25/04/2008 ] ---> C:\WINDOWS\system32\xolehlp.dll   
[25/04/2008 ] ---> C:\WINDOWS	abletoc.log   
[25/04/2008 ] ---> C:\WINDOWS\TASKMAN.EXE   
[25/04/2008 ] ---> C:\WINDOWS\Tasse … caf‚.bmp 
[25/04/2008 ] ---> C:\WINDOWS	soc.log   
[25/04/2008 ] ---> C:\WINDOWS\unvise32qt.exe   
[25/04/2008 ] ---> C:\WINDOWS\vb.ini   
[25/04/2008 ] ---> C:\WINDOWS\vbaddin.ini   
[25/04/2008 ] ---> C:\WINDOWS\Vent de prairie.bmp 
[25/04/2008 ] ---> C:\WINDOWS\wiadebug.log   
[25/04/2008 ] ---> C:\WINDOWS\wiaservc.log   
[25/04/2008 ] ---> C:\WINDOWS\WindowsShell.Manifest   
[25/04/2008 ] ---> C:\WINDOWS\WindowsUpdate.log   
[25/04/2008 ] ---> C:\WINDOWS\winnt.bmp   
[25/04/2008 ] ---> C:\WINDOWS\winnt256.bmp   
[25/04/2008 ] ---> C:\WINDOWS\wmsetup.log   
[25/04/2008 ] ---> C:\WINDOWS\wmsetup10.log   
[25/04/2008 ] ---> C:\WINDOWS\WMSysPr9.prx   
[25/04/2008 ] ---> C:\WINDOWS\Zapotec.bmp   
[R‚pertoire ] --- REP ---> C:\Program Files\Files   



Outil Aide Diagnostic By !aur3n7 Version 1.1
----------------------------------
§§§§§ Fin Rapport §§§§§ 
----------------------------------

DaKoala · Answer

Ya un truc que je trouve bizarre. J'ai avg 8.0 sur ce pc que j'essaye d'enlever. Et sur un autre pc qui partage la meme connection internet j'ai avg 8.5free. avg 8.5 me dit qu'il ny a pas de composants valides dc mon antivirus ne sert a rien non plus. les deux antivir qui marche plus en meme temps c bizarre. Bon

gen-hackman · Answer

je crois qu'il y a une histoire comme quoi avg aurait arrêté ses mises à jour mais je ne sais plus si c est pour tout avg ou certains programmes de ce dernier

renvoie le log sur ce site et donne le lien obtenu en echange

http://www.cijoint.fr/

Electricien 69 · Answer

hello Gen  ;-)
excuse pour l'intrusion, mais c'est pour la bonne cause  :-)
sujet en doublon  :
http://www.commentcamarche.net/forum/affich-15323540-uc-a-50-alors-que-rien-ne-tourne-help-merci

j'ai demandé la suppression de l'autre

bonne chasse  ;-)

Message pour Dakoala

reste sur le même topic du début à la fin. si tu suis deux voir plus de type de désinfection, tu planteras ton pc et toutes tes données seront perdues !!!

à toi de voir

bonne journée

gen-hackman · Answer

heu...electricien.....il a 6 mois ce topic ^^

Electricien 69 · Answer

re,
mais l'autre est tout neuf, en fin était  mdr

à +

gen-hackman · Answer

lol

Electricien 69 · Answer

bonne journée ;-)

BESION D'UN COACH pr désinfection pc Merci! - Page 3

Newsletters