fentres indésirables firefox: supecte malware Fermé

Question

Bonjour,Symptomes: page active orintée soudainement vers  des sites commerciauxJe trouve des malwares en mode sans échec. J'ai un peu investigué. Apparemment il y a un lien avec winlogon en 020. Le nettoyage classique avec suppression de la dll (même en mode console) ne sufit pas: la régénération se fait automatiquement: au reboot ? au shutdown ?Visiblement ce que j'ai ressemble à la famille de look2me  J'ai fait l'essai la cle de registre " HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify" est chaque foi modifiée et des dll sont créées du type x5gfg3Fs0.dll même date même poids!  Je n'ai pas trouvé l'origine. J'ai suivi la méthode préconisée:nettoyagemode sans echec : A2, ad-aware, spybot, cwshredder ( à chaque fois j'ai trouvé qqchose de différent). J'ai gardé les logs correspondant.Comme cela ne suffisait pas j'ai lancé HJT.Logfile of HijackThis v1.99.1Scan saved at 07:21:39, on 28/10/2005Platform: Windows XP SP2 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)Windows folder: C:\WINDOWSSystem folder: C:\WINDOWS\system32Hosts file: C:\WINDOWS\System32\drivers\etc\hostsR0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = O4 - HKLM\..\Run: [SunServer] D:\Program Files\Sunbelt Software\CounterSpy\Consumer\sunserver.exeO4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartupO4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_02\bin\jusched.exeO4 - HKLM\..\Run: [ezShieldProtector for Px] C:\WINDOWS\System32\ezSP_Px.exeO4 - HKLM\..\Run: [AWMON] "D:\Program Files\Lavasoft\Ad-Aware SE Plus\Ad-Watch.exe"O4 - HKLM\..\Run: [QuickTime Task] "D:\Program Files\QuickTime\qttask.exe" -atboottimeO4 - HKLM\..\Run: [OfficeScanNT Monitor] "C:\Program Files\OfficeScan NT\pccntmon.exe" -HideWindowO4 - HKLM\..\Run: [MXOBG] C:\WINDOWS\MXOALDR.EXEO4 - HKLM\..\Run: [MaxtorOneTouch] C:\Program Files\Maxtor\OneTouch\Utils\OneTouch.exeO4 - HKLM\..\Run: [DSLAGENTEXE] dslagent.exe USBO4 - HKLM\..\Run: [GSICONEXE] GSICON.EXEO4 - HKLM\..\Run: [InCD] D:\Program Files\Ahead\InCD\InCD.exeO4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startupO4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exeO16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204O16 - DPF: {2FC9A21E-2069-4E47-8235-36318989DB13} (PPSDKActiveXScanner.MainScreen) - http://ppupdates.ca.com/downloads/scanner/axscanner.cabO16 - DPF: {3EB4F9EA-51A6-48DA-846A-0D69DCBA39EF} (DownloadManager Control) - http://download.akamaitools.com.edgesuite.net/dlmanager/dev/code/IE_1070/DownloadManager.cabO16 - DPF: {72C23FEC-3AF9-48FC-9597-241A8EBDFE0A} (InstallShield International Setup Player) - http://www.newsstand.com/downloads/reader/live/Disk1/isetupml.cabO16 - DPF: {B942A249-D1E7-4C11-98AE-FCB76B08747F} (RealArcadeRdxIE Class) - http://games-dl.real.com/gameconsole/Bundler/CAB/RealArcadeRdxIE.cabO20 - Winlogon Notify: ThemeManager - C:\WINDOWS\system32\jtn8075ue.dllO23 - Service: Autodesk Licensing Service - Unknown owner - C:\Program Files\Fichiers communs\Autodesk Shared\Service\AdskScSrv.exeO23 - Service: DCPFLICS - Unknown owner - C:\Program Files\DCPFLICS\DCPFLICS.exeO23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exeO23 - Service: InCD Helper (InCDsrv) - Nero AG - D:\Program Files\Ahead\InCD\InCDsrv.exeO23 - Service: Macromedia Licensing Service - Macromedia - C:\Program Files\Fichiers communs\Macromedia Shared\Service\Macromedia Licensing.exeO23 - Service: OfficeScanNT RealTime Scan (ntrtscan) - Trend Micro Inc. - C:\Program Files\OfficeScan NT
trtscan.exeO23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32
vsvc32.exeO23 - Service: OfficeScanNT Personal Firewall (OfcPfwSvc) - Trend Micro Inc. - C:\Program Files\OfficeScan NT\OfcPfwSvc.exeO23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\PACSPTISVR.exeO23 - Service: Qbdclchpfp - Sonic Solutions - (no file)O23 - Service: RaySat_3dsmax7 Server (RaySat_3dsmax7Server) - Unknown owner - D:\Program Files\3ds max7\mentalray\satelliteaysat_3dsmax7server.exeO23 - Service: Assistant Retrospect (RetroExp Helper) - Dantz Development Corporation - C:\PROGRA~1\Dantz\RETROS~1thlpsvc.exeO23 - Service: Retrospect Express HD Launcher (RetroExpLauncher) - Dantz Development Corporation - C:\Program Files\Dantz\Retrospect Express HDetrorun.exeO23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\SPTISRV.exeO23 - Service: TabletService - Wacom Technology, Corp. - C:\WINDOWS\System32\Tablet.exeO23 - Service: OfficeScanNT Listener (tmlisten) - Trend Micro Inc. - C:\Program Files\OfficeScan NT	mlisten.exeJ'ai aussi généré d'autres logs "uninstal list",  "hosts", "process",  "startup".Merci d'avancejemit

Real Mona · Answer

Re,Je regarde et je reviens vers toi.M.

Real Mona · Answer

Oups, il manque des lignes dans ton rapport HT !Peux tu recommencer et le recopier entièrement ?Par ailleurs tu as quoi comme antivirus et comme parefeu ?A+M.

jemit · Answer

Bonjour Je ne suis pas chez moi je ne sias pas ce que j'ai m... avec le log mais j'ai  la liste des process générée avec HT:Process list saved on 07:18:47, on 28/10/2005Platform: Windows XP SP2 (WinNT 5.01.2600)[pid]	[full path to filename]		[file version]	[company name]448	C:\WINDOWS\System32\smss.exe		5.1.2600.2180	Microsoft Corporation532	C:\WINDOWS\system32\winlogon.exe		5.1.2600.2180	Microsoft Corporation576	C:\WINDOWS\system32\services.exe		5.1.2600.2180	Microsoft Corporation588	C:\WINDOWS\system32\lsass.exe		5.1.2600.2180	Microsoft Corporation768	C:\WINDOWS\system32\svchost.exe		5.1.2600.2180	Microsoft Corporation888	C:\WINDOWS\System32\svchost.exe		5.1.2600.2180	Microsoft Corporation920	D:\Program Files\Ahead\InCD\InCDsrv.exe		4.3.20.1	Nero AG1120	C:\WINDOWS\system32\spoolsv.exe		5.1.2600.2696	Microsoft Corporation1216	C:\Program Files\Fichiers communs\Autodesk Shared\Service\AdskScSrv.exe		2.51.0.1	1260	C:\Program Files\DCPFLICS\DCPFLICS.exe			1308	C:\WINDOWS\System32\inetsrv\inetinfo.exe		5.1.2600.2180	Microsoft Corporation1336	C:\Program Files\OfficeScan NT
trtscan.exe		7.0.0.1160	Trend Micro Inc.1372	C:\WINDOWS\System32
vsvc32.exe		6.14.10.7801	NVIDIA Corporation1412	D:\Program Files\3ds max7\mentalray\satelliteaysat_3dsmax7server.exe			1432	C:\Program Files\Dantz\Retrospect Express HDetrorun.exe		1.0.196.0	Dantz Development Corporation1484	C:\WINDOWS\System32	cpsvcs.exe		5.1.2600.0	Microsoft Corporation1548	C:\WINDOWS\System32\svchost.exe		5.1.2600.2180	Microsoft Corporation1616	C:\WINDOWS\System32\Tablet.exe		4.7.1.4	Wacom Technology, Corp.1648	C:\WINDOWS\system32undll32.exe		5.1.2600.2180	Microsoft Corporation1728	C:\Program Files\OfficeScan NT	mlisten.exe		7.0.0.1160	Trend Micro Inc.1944	C:\Program Files\OfficeScan NT\OfcPfwSvc.exe		7.0.0.1160	Trend Micro Inc.2088	C:\WINDOWS\TEMP\ME9130.EXE			2632	D:\Program Files\Sunbelt Software\CounterSpy\Consumer\sunThreatEngine.exe		1.2.0.89	Sunbelt Software3428	D:\Program Files\Sunbelt Software\CounterSpy\Consumer\SunProtectionServer.exe		1.2.0.89	Sunbelt Software3556	D:\Program Files\Sunbelt Software\CounterSpy\Consumer\sunserver.exe		1.5.0.77	Sunbelt Software3604	C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe		5.0.20.9	Sun Microsystems, Inc.3684	C:\WINDOWS\System32\ezSP_Px.exe		1.0.0.0	Easy Systems Japan Ltd.3784	D:\Program Files\Lavasoft\Ad-Aware SE Plus\Ad-Watch.exe		3.1.2.17	Lavasoft Sweden3840	D:\Program Files\QuickTime\qttask.exe		7.0.2.120	Apple Computer, Inc.3864	C:\Program Files\OfficeScan NT\pccntmon.exe		7.0.0.1160	Trend Micro Inc.3908	C:\WINDOWS\MXOALDR.EXE		6.1.1000.0	Cypress Semiconductor3916	C:\WINDOWS\system32\dslagent.exe			3940	C:\WINDOWS\system32\GSICON.EXE		3.1.0.0	GlobeSpan, Inc.4060	D:\Program Files\Ahead\InCD\InCD.exe		4.3.20.1	Nero AG4084	C:\WINDOWS\Mixer.exe		1.4.6.0	C-Media Electronic Inc. (www.cmedia.com.tw)6012	E:\Téléchargements\house call trend\HijackThis.exe		1.99.0.1	Soeperman Enterprises Ltd.1904	C:\WINDOWS\explorer.exe		6.0.2900.2180	Microsoft CorporationSi ça ne suffit pas j'en regénerai un chez moi cet apres midi. Comme antivirus j'ai pc-cillin trendPour le parefeu j'ai celui de SP2 et un service de mon FAI (club-internet). Pour la petite histoire j'avais jusque là ZA mais il est incompatible avec Xsi Softimage (log 3D). J'ai du le desinstaller.Au vu de ce que j'ai pu lire sur d'autres forum j'ai un truc coriace. J'ai un peu les b.. car c'est moi m^me qui me suis infecté en téléchargeant  et installant un truc pour quicktime pro.est-il possible qu'un malware ou du moins une partie s'installe dans la zone d'amorcage ? A+Jemit

Real Mona · Answer

Tu sais, hélas, tout est possible, mais ne t'inquiète surtout pas, on va trouver LA solution !Dommage pour ZA... c'est pourtant un très bon parefeu et sans aucun doute bien plus efficace que celui d'XP et sûrement de celui de club-internet.Bon, quand tu rentres chez toi fais ceci, ca va un peu nettoyer :Fais ces deux scans en ligne (avec Internet Explorer) :http://www.bitdefender.com/scan/licence.php Copie/colle le rapport iciethttp://www.ewido.net/fr/download/Tu l'installes et tu le mets à jour.Fais un scan en mode complet.Sauvegardes le rapport et copie le iciDans la foulée copie un autre log HT avec.A tout à l'heure,Mona

Real Mona · Answer

Non, ne t'inquiète pas !Mais surtout fais tes scans avec IE !A touteMona

Real Mona · Answer

Re,ouh la il y a du ménage de fait ! c'est bien.En attendant que j'analyse ton log, ZoneAlarm est une super idée !!!http://download.zonelabs.com/bin/free/fr/download/comparison.html Il faut désactiver ton firewall Windows XP, tu fais la chose suivante :clique sur le bouton Démarrer, sur Paramètres, puis double clique sur Connexion Réseau. Sélectionne ta connexion puis clique dessus avec le bouton droit de la souris. Choisis la commande Propriétés. Dans l'onglet Avancé, décoche la case Protéger mon ordinateur et le réseau... Valide par OKPour configurer les programmes qui peuvent avoir accès à internet, ouvre ZoneAlarm, va dans "contrôle des programmes" clique sur l'onglet programme. Tu vas voir tous tes programmes. Quand tu cliques dans les colonnes "accès" et "serveur" tu as la possibilité d'autoriser de bloquer ou de demander.Tuto : http://www.zebulon.fr/articles/configurationZA_1.phpImprime ceci pour ne rien oublier de faire :Méthode à suivre dans l'ordre... ---------------------------------------------------------------------------- Télécharge ces logiciels (si tu ne les as pas) mais que tu n‘utilises pas tout de suite: 1/Spybot S&D 1.4 <<nouvelle versionhttp://www.safer-networking.org/fr/index.html Démo d’utilisation (merci à Balltrap34 pour cette réalisation)http://pageperso.aol.fr/Balltrap34/demo%20spybot.htm2/Ad-Aware SE 1.06 <<nouvelle versionhttp://www.lavasoftusa.com/software/adaware/ -Une aide:http://www.tutopat.com/viewtopic.php?t=1191 - installe le patch français, tu pourras le trouver ici: http://download.lavasoft.de.edgesuite.net/public/pllangs.exe et une petite vidéo d'utilisation ici:(merci à Moe31 pour cette réalisation)http://pageperso.aol.fr/balltrap34/adawrevid.asf ---------------------------------------------------------------------------- Démarre en mode sans échec :Pour cela, tu tapotes la touche F8 dès le début de l’allumage du pc sans t’arrêter Une fenêtre va s’ouvrir tu te déplaces avec les flèches du clavier sur démarrer en mode sans échec puis tape entrée. Une fois sur le bureau s’il n’y a pas toutes les couleurs et autres c’est normal ! (Si F8 ne marche pas utilise la touche F5) ---------------------------------------------------------------------------- Désactive ta restauration système (si tu es sous XP):Clic droit sur poste de travail puis, propriété, tu cliques sur onglet restauration système tu coches la case « désactiver la restauration » et applique ---------------------------------------------------------------------------- Affiche tous les fichiers et dossiers :Clique sur démarrer/panneau de configuration/option des dossiers/affichage Coche « afficher les fichiers et dossiers cachés » Décoche la case "Masquer les fichiers protégés du système d'exploitation (recommandé)" Décoche « masquer les extensions dont le type est connu » Puis fais «Ok» pour valider les changements. Et appliquer ! ---------------------------------------------------------------------------- Vide tes fichiers temps et tempory internet file::: Supprimer les fichiers temporaires :: vider tout le contenu de ces dossiers. * C:\Documents and Settings	on compte\Local Settings\Temp * C:\Documents and Settings	ous les autres comptes\Local Settings\Temp * C:\Windows\Temp :: Le contenu du dossier prefetch :: * C:\WINDOWS\Prefetch <= sauf le fichier layout.ini * Ne pas oublier de vider la corbeille ! ---------------------------------------------------------------------------- Relance HijackThis, coche les cases devant ces lignes et ensuite clique sur fix checked :O16 - DPF: {3EB4F9EA-51A6-48DA-846A-0D69DCBA39EF} (DownloadManager Control) - http://download.akamaitools.com.edgesuite.net/dlmanager/dev/code/IE_1070/Downloa dManager.cabO20 - Winlogon Notify: SharedDLLs - C:\WINDOWS\system32\g622lgfo162c.dll----------------------------------------------------------------------------Passe Ad-Aware et vire tout ce qu’il trouve + vide la quarantaine----------------------------------------------------------------------------Passe Spybot et vire tout ce qu’il trouve + vide la quarantaine----------------------------------------------------------------------------> Tu vides ta poubelle et tu redémarres en mode normal et refais un HijackThis que tu postes ici. A+M.

balltrap34 · Answer

saluttelecharge cecihttp://www.downloads.subratam.org/l2mfix.exedecompresse le double clik sur l2mfix.bat appuie sur n importe quelle touche et ensuite choisi l option 1attend il vas faire un rapport fait un copier coller de celui cine fait surtout rien d autres

Real Mona · Answer

Bonjour,Tenace la ligne, on va faire autrement1/ Télécharge: Pocket Killbox icihttp://www.downloads.subratam.org/KillBox.exe----------------------------------------------------------------------------2/ Désactive ta restauration système----------------------------------------------------------------------------3/Démarre en mode sans échec----------------------------------------------------------------------------4/ Affiche tous les fichiers et dossiers----------------------------------------------------------------------------5/ Vide tes fichiers temps et tempory internet file----------------------------------------------------------------------------6/ Relance HijackThis, coche les cases devant ces lignes et ensuite clique sur fix checked :O20 - Winlogon Notify: BITS - C:\WINDOWS\system32\mv66l9js1.dll (ou sur la ligne 020 car la dll va surement changer de nom, mais note le nom exact, on en a besoin plus bas)7/Double clic sur killbox.exe (Pocket Killbox)- coche: delete on reboot- Dans "Full Path of File to Delete"copie et colle:C:\WINDOWS\system32\mv66l9js1.dll (ou tout autre nom de dll que prendra le fichier en ligne 020)- clique sur la croix rouge- une fenêtre va apparaître pour confirmation clique sur YES- une seconde fenêtre te demande si tu veux redémarrer clique sur YESLaisse le pc redémarrer.Et après reposte un log HijackThis.Tu as fait ce que Balltrap t'a recommandé (post <10> ?Sinon, fais le avant ma manipEt le log HijackThis, fais le en mode normal avant de me l'envoyer (en effet, certaines lignes n'apparaissent pas en MSE)A+M.

balltrap34 · Answer

fait se que je t est mis plus hauttu as une infection par vx2

balltrap34 · Answer

avais pas vu lol

jemit · Answer

je balance le log l2m L2MFIX find log 1.04a These are the registry keys present ********************************************************************************** Winlogon/notify: Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Extensions] "Asynchronous"=dword:00000000 "DllName"="C:\WINDOWS\system32\rWsapi32.dll" "Impersonate"=dword:00000000 "Logon"="WinLogon" "Logoff"="WinLogoff" "Shutdown"="WinShutdown" RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above Copyright (c) 1999-2001 Frank Heyne Software (http://www.heysoft.de) This program is Freeware, use it on your own risk! Access Control List for Registry key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify: (NI) ALLOW Full access AUTORITE NT\SYSTEM (IO) ALLOW Full access AUTORITE NT\SYSTEM (ID-NI) ALLOW Read BUILTIN\Utilisateurs (ID-IO) ALLOW Read BUILTIN\Utilisateurs (ID-NI) ALLOW Read BUILTIN\Utilisateurs avec pouvoir (ID-IO) ALLOW Read BUILTIN\Utilisateurs avec pouvoir (ID-NI) ALLOW Full access BUILTIN\Administrateurs (ID-IO) ALLOW Full access BUILTIN\Administrateurs (ID-NI) ALLOW Full access AUTORITE NT\SYSTEM (ID-IO) ALLOW Full access AUTORITE NT\SYSTEM (ID-IO) ALLOW Full access CREATEUR PROPRIETAIRE ********************************************************************************** useragent: Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform] "{DF3E2E7D-A2F2-6EF3-0720-224ACAA63EDA}"="" ********************************************************************************** Shell Extension key: Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved] "{00022613-0000-0000-C000-000000000046}"="Feuille de propri‚t‚s du fichier multim‚dia" "{176d6597-26d3-11d1-b350-080036a75b03}"="Gestion de scanneur ICM" "{1F2E5C40-9550-11CE-99D2-00AA006E086C}"="Page de s‚curit‚ NTFS" "{3EA48300-8CF6-101B-84FB-666CCB9BCD32}"="Page des propri‚t‚s de OLE DocFile" "{40dd6e20-7c17-11ce-a804-00aa003ca9f6}"="Extensions de l'environnement pour le partage" "{41E300E0-78B6-11ce-849B-444553540000}"="PlusPack CPL Extension" "{42071712-76d4-11d1-8b24-00a0c9068ff3}"="Extension Affichage Carte du Panneau de configuration" "{42071713-76d4-11d1-8b24-00a0c9068ff3}"="Extension Affichage cran du Panneau de configuration" "{42071714-76d4-11d1-8b24-00a0c9068ff3}"="Extension Affichage Panorama du Panneau de configuration" "{4E40F770-369C-11d0-8922-00A024AB2DBB}"="Page de s‚curit‚ DS" "{513D916F-2A8E-4F51-AEAB-0CBC76FB1AF8}"="Page de compatibilit‚" "{56117100-C0CD-101B-81E2-00AA004AE837}"="Gestionnaire de donn‚es endommag‚es de l'environnement" "{59099400-57FF-11CE-BD94-0020AF85B590}"="Extension copie de disquette" "{59be4990-f85c-11ce-aff7-00aa003ca9f6}"="Extensions de l'environnement pour les objets r‚seau de Microsoft Windows" "{5DB2625A-54DF-11D0-B6C4-0800091AA605}"="Gestion d'‚cran ICM" "{675F097E-4C4D-11D0-B6C1-0800091AA605}"="Gestion d'imprimante ICM" "{764BF0E1-F219-11ce-972D-00AA00A14F56}"="Extensions de l'environnement de compression de fichiers" "{77597368-7b15-11d0-a0c2-080036af3f03}"="Extension de l'environnement d'imprimante Web" "{7988B573-EC89-11cf-9C00-00AA00A14F56}"="Disk Quota UI" "{853FE2B1-B769-11d0-9C4E-00C04FB6C6FA}"="Menu contextuel de cryptage" "{85BBD920-42A0-1069-A2E4-08002B30309D}"="Porte-documents" "{88895560-9AA2-1069-930E-00AA0030EBC8}"="Extension ic“ne HyperTerminal" "{BD84B380-8CA2-1069-AB1D-08000948F534}"="Fonts" "{DBCE2480-C732-101B-BE72-BA78E9AD5B27}"="Profil ICC" "{F37C5810-4D3F-11d0-B4BF-00AA00BBB723}"="Page de s‚curit‚ des imprimantes" "{f81e9010-6ea4-11ce-a7ff-00aa003ca9f6}"="Extensions de l'environnement pour le partage" "{f92e8c40-3d33-11d2-b1aa-080036a75b03}"="Display TroubleShoot CPL Extension" "{7444C717-39BF-11D1-8CD9-00C04FC29D45}"="Extension de cryptographie PKO" "{7444C719-39BF-11D1-8CD9-00C04FC29D45}"="Extension de cryptographie Sign" "{7007ACC7-3202-11D1-AAD2-00805FC1270E}"="Connexions r‚seau" "{992CFFA0-F557-101A-88EC-00DD010CCC48}"="Connexions r‚seau" "{E211B736-43FD-11D1-9EFB-0000F8757FCD}"="&Scanneurs et appareils photo" "{FB0C9C8A-6C50-11D1-9F1D-0000F8757FCD}"="&Scanneurs et appareils photo" "{905667aa-acd6-11d2-8080-00805f6596d2}"="&Scanneurs et appareils photo" "{3F953603-1008-4f6e-A73A-04AAC7A992F1}"="&Scanneurs et appareils photo" "{83bbcbf3-b28a-4919-a5aa-73027445d672}"="&Scanneurs et appareils photo" "{F0152790-D56E-4445-850E-4F3117DB740C}"="Remote Sessions CPL Extension" "{5F327514-6C5E-4d60-8F16-D07FA08A78ED}"="Auto Update Property Sheet Extension" "{60254CA5-953B-11CF-8C96-00AA00B8708C}"="Extension de l'interpr‚teur de commande pour Windows Script Host" "{2206CDB2-19C1-11D1-89E0-00C04FD7A829}"="Liaison de donn‚es Microsoft" "{DD2110F0-9EEF-11cf-8D8E-00AA0060F5BF}"="Tasks Folder Icon Handler" "{797F1E90-9EDD-11cf-8D8E-00AA0060F5BF}"="Tasks Folder Shell Extension" "{D6277990-4C6A-11CF-8D87-00AA0060F5BF}"="Tƒches planifi‚es" "{0DF44EAA-FF21-4412-828E-260A8728E7F1}"="Barre des tƒches et menu D‚marrer" "{2559a1f0-21d7-11d4-bdaf-00c04f60b9f0}"="Rechercher" "{2559a1f1-21d7-11d4-bdaf-00c04f60b9f0}"="Aide et support" "{2559a1f2-21d7-11d4-bdaf-00c04f60b9f0}"="Aide et support" "{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}"="Ex‚cuter..." "{2559a1f4-21d7-11d4-bdaf-00c04f60b9f0}"="Internet" "{2559a1f5-21d7-11d4-bdaf-00c04f60b9f0}"="Courrier ‚lectronique" "{D20EA4E1-3957-11d2-A40B-0C5020524152}"="Polices" "{D20EA4E1-3957-11d2-A40B-0C5020524153}"="Outils d'administration" "{875CB1A1-0F29-45de-A1AE-CFB4950D0B78}"="Audio Media Properties Handler" "{40C3D757-D6E4-4b49-BB41-0E5BBEA28817}"="Video Media Properties Handler" "{E4B29F9D-D390-480b-92FD-7DDB47101D71}"="Wav Properties Handler" "{87D62D94-71B3-4b9a-9489-5FE6850DC73E}"="Avi Properties Handler" "{A6FD9E45-6E44-43f9-8644-08598F5A74D9}"="Midi Properties Handler" "{c5a40261-cd64-4ccf-84cb-c394da41d590}"="Video Thumbnail Extractor" "{5E6AB780-7743-11CF-A12B-00AA004AE837}"="Barre d'outils Internet Microsoft" "{22BF0C20-6DA7-11D0-B373-00A0C9034938}"="tat du t‚l‚chargement" "{91EA3F8B-C99B-11d0-9815-00C04FD91972}"="Dossier Bureau ‚tendu" "{6413BA2C-B461-11d1-A18A-080036B11A03}"="Dossier du shell augment‚" "{F61FFEC1-754F-11d0-80CA-00AA005B4383}"="BandProxy" "{7BA4C742-9E81-11CF-99D3-00AA004AE837}"="Bande du navigateur Microsoft" "{30D02401-6A81-11d0-8274-00C04FD5AE38}"="Bande de recherche" "{32683183-48a0-441b-a342-7c2a440a9478}"="Media Band" "{169A0691-8DF9-11d1-A1C4-00C04FD75D13}"="Volet int‚gr‚ de recherche" "{07798131-AF23-11d1-9111-00A0C98BA67D}"="Recherche Web" "{AF4F6510-F982-11d0-8595-00AA004CD6D8}"="Utilitaire des options de l'arborescence du Registre" "{01E04581-4EEE-11d0-BFE9-00AA005B4383}"="&Adresse" "{A08C11D2-A228-11d0-825B-00AA005B4383}"="BoŒte d'entr‚e de l'adresse" "{00BB2763-6A77-11D0-A535-00C04FD7D062}"="Saisie semi-automatique Microsoft" "{7376D660-C583-11d0-A3A5-00C04FD706EC}"="TridentImageExtractor" "{6756A641-DE71-11d0-831B-00AA005B4383}"="Liste de saisie semi-automatique MRU" "{6935DB93-21E8-4ccc-BEB9-9FE3C77A297A}"="Liste de saisie semi-automatique personnalis‚e MRU" "{7e653215-fa25-46bd-a339-34a2790f3cb7}"="Accessible" "{acf35015-526e-4230-9596-becbe19f0ac9}"="Barre de progrŠs auto-ouvrante" "{E0E11A09-5CB8-4B6C-8332-E00720A168F2}"="Analyseur de la barre d'adresses" "{00BB2764-6A77-11D0-A535-00C04FD7D062}"="Liste de saisie semi-automatique de l'historique Microsoft" "{03C036F1-A186-11D0-824A-00AA005B4383}"="Liste de saisie semi-automatique du dossier Shell Microsoft" "{00BB2765-6A77-11D0-A535-00C04FD7D062}"="Conteneur de la liste de saisie semi-automatique multiple Microsoft" "{ECD4FC4E-521C-11D0-B792-00A0C90312E1}"="Menu Site de bandes" "{3CCF8A41-5C85-11d0-9796-00AA00B90ADF}"="Shell DeskBarApp" "{ECD4FC4C-521C-11D0-B792-00A0C90312E1}"="Barre du Bureau" "{ECD4FC4D-521C-11D0-B792-00A0C90312E1}"="Shell Rebar BandSite" "{DD313E04-FEFF-11d1-8ECD-0000F87A470C}"="Assistance utilisateur" "{EF8AD2D1-AE36-11D1-B2D2-006097DF8C11}"="ParamŠtres du dossier global" "{EFA24E61-B078-11d0-89E4-00C04FC9E26E}"="Favorites Band" "{0A89A860-D7B1-11CE-8350-444553540000}"="Shell Automation Inproc Service" "{E7E4BC40-E76A-11CE-A9BB-00AA004AE837}"="Shell DocObject Viewer" "{A5E46E3A-8849-11D1-9D8C-00C04FC99D61}"="Microsoft Browser Architecture" "{FBF23B40-E3F0-101B-8488-00AA003E56F8}"="InternetShortcut" "{3C374A40-BAE4-11CF-BF7D-00AA006946EE}"="Microsoft Url History Service" "{FF393560-C2A7-11CF-BFF4-444553540000}"="Historique" "{7BD29E00-76C1-11CF-9DD0-00A0C9034933}"="Temporary Internet Files" "{7BD29E01-76C1-11CF-9DD0-00A0C9034933}"="Temporary Internet Files" "{CFBFAE00-17A6-11D0-99CB-00C04FD64497}"="Microsoft Url Search Hook" "{A2B0DD40-CC59-11d0-A3A5-00C04FD706EC}"="Image de d‚marrage de la Suite IE4" "{67EA19A0-CCEF-11d0-8024-00C04FD75D13}"="CDF Extension Copy Hook" "{131A6951-7F78-11D0-A979-00C04FD705A2}"="ISFBand OC" "{9461b922-3c5a-11d2-bf8b-00c04fb93661}"="Search Assistant OC" "{3DC7A020-0ACD-11CF-A9BB-00AA004AE837}"="Internet" "{871C5380-42A0-1069-A2EA-08002B30309D}"="Internet Name Space" "{EFA24E64-B078-11d0-89E4-00C04FC9E26E}"="Explorer Band" "{9E56BE60-C50F-11CF-9A2C-00A0C90A90CE}"="Sendmail service" "{9E56BE61-C50F-11CF-9A2C-00A0C90A90CE}"="Sendmail service" "{88C6C381-2E85-11D0-94DE-444553540000}"="Dossier ActiveX Cache" "{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"="WebCheck" "{ABBE31D0-6DAE-11D0-BECA-00C04FD940BE}"="Subscription Mgr" "{F5175861-2688-11d0-9C5E-00AA00A45957}"="Dossier Inscription" "{08165EA0-E946-11CF-9C87-00AA005127ED}"="WebCheckWebCrawler" "{E3A8BDE6-ABCE-11d0-BC4B-00C04FD929DB}"="WebCheckChannelAgent" "{E8BB6DC0-6B4E-11d0-92DB-00A0C90C2BD7}"="TrayAgent" "{7D559C10-9FE9-11d0-93F7-00AA0059CE02}"="Code Download Agent" "{E6CC6978-6B6E-11D0-BECA-00C04FD940BE}"="ConnectionAgent" "{D8BD2030-6FC9-11D0-864F-00AA006809D9}"="PostAgent" "{7FC0B86E-5FA7-11d1-BC7C-00C04FD929DB}"="WebCheck SyncMgr Handler" "{352EC2B7-8B9A-11D1-B8AE-006008059382}"="Gestionnaire d'applications d'environnement" "{0B124F8F-91F0-11D1-B8B5-006008059382}"="num‚rateur d'applications install‚es" "{CFCCC7A0-A282-11D1-9082-006008059382}"="Publication d'application Darwin" "{e84fda7c-1d6a-45f6-b725-cb260c236066}"="Shell Image Verbs" "{66e4e4fb-f385-4dd0-8d74-a2efd1bc6178}"="Shell Image Data Factory" "{3F30C968-480A-4C6C-862D-EFC0897BB84B}"="Extracteur de miniatures de fichier + GDI" "{9DBD2C50-62AD-11d0-B806-00C04FD706EC}"="Gestionnaire de miniatures - Informations de r‚sum‚ (DOCFILES)" "{EAB841A0-9550-11cf-8C16-00805F1408F3}"="Extracteur de miniatures HTML" "{eb9b1153-3b57-4e68-959a-a3266bc3d7fe}"="Shell Image Property Handler" "{CC6EEFFB-43F6-46c5-9619-51D571967F7D}"="Assistant Publication de sites Web" "{add36aa8-751a-4579-a266-d66f5202ccbb}"="Commande d'impressions via le Web" "{6b33163c-76a5-4b6c-bf21-45de9cd503a1}"="Objet Assistant de publication Shell" "{58f1f272-9240-4f51-b6d4-fd63d1618591}"="Assistant Obtenir une identit‚ Passport" "{7A9D77BD-5403-11d2-8785-2E0420524153}"="Comptes d'utilisateurs" "{BD472F60-27FA-11cf-B8B4-444553540000}"="Compressed (zipped) Folder Right Drag Handler" "{888DCA60-FC0A-11CF-8F0F-00C04FD7D062}"="Compressed (zipped) Folder SendTo Target" "{63da6ec0-2e98-11cf-8d82-444553540000}"="FTP Folders Webview" "{883373C3-BF89-11D1-BE35-080036B11A03}"="Microsoft DocProp Shell Ext" "{A9CF0EAE-901A-4739-A481-E35B73E47F6D}"="Microsoft DocProp Inplace Edit Box Control" "{8EE97210-FD1F-4B19-91DA-67914005F020}"="Microsoft DocProp Inplace ML Edit Box Control" "{0EEA25CC-4362-4A12-850B-86EE61B0D3EB}"="Microsoft DocProp Inplace Droplist Combo Control" "{6A205B57-2567-4A2C-B881-F787FAB579A3}"="Microsoft DocProp Inplace Calendar Control" "{28F8A4AC-BBB3-4D9B-B177-82BFC914FA33}"="Microsoft DocProp Inplace Time Control" "{8A23E65E-31C2-11d0-891C-00A024AB2DBB}"="Directory Query UI" "{9E51E0D0-6E0F-11d2-9601-00C04FA31A86}"="Shell properties for a DS object" "{163FDC20-2ABC-11d0-88F0-00A024AB2DBB}"="Directory Object Find" "{F020E586-5264-11d1-A532-0000F8757D7E}"="Directory Start/Search Find" "{0D45D530-764B-11d0-A1CA-00AA00C16E65}"="Directory Property UI" "{62AE1F9A-126A-11D0-A14B-0800361B1103}"="Directory Context Menu Verbs" "{ECF03A33-103D-11d2-854D-006008059367}"="MyDocs Copy Hook" "{ECF03A32-103D-11d2-854D-006008059367}"="MyDocs Drop Target" "{4a7ded0a-ad25-11d0-98a8-0800361b1103}"="MyDocs Properties" "{750fdf0e-2a26-11d1-a3ea-080036587f03}"="Offline Files Menu" "{10CFC467-4392-11d2-8DB4-00C04FA31A66}"="Offline Files Folder Options" "{AFDB1F70-2A4C-11d2-9039-00C04F8EEB3E}"="Dossier Fichiers hors connexion" "{143A62C8-C33B-11D1-84FE-00C04FA34A14}"="Microsoft Agent Character Property Sheet Handler" "{ECCDF543-45CC-11CE-B9BF-0080C87CDBA6}"="DfsShell" "{60fd46de-f830-4894-a628-6fa81bc0190d}"="%DESC_PublishDropTarget%" "{7A80E4A8-8005-11D2-BCF8-00C04F72C717}"="MMC Icon Handler" "{0CD7A5C0-9F37-11CE-AE65-08002B2E1262}"=".CAB file viewer" "{32714800-2E5F-11d0-8B85-00AA0044F941}"="Des &personnes..." "{8DD448E6-C188-4aed-AF92-44956194EB1F}"="Windows Media Player Play as Playlist Context Menu Handler" "{CE3FB1D1-02AE-4a5f-A6E9-D9F1B4073E6C}"="Windows Media Player Burn Audio CD Context Menu Handler" "{F1B9284F-E9DC-4e68-9D7E-42362A59F0FD}"="Windows Media Player Add to Playlist Context Menu Handler" "{f39a0dc0-9cc8-11d0-a599-00c04fd64433}"="Fichier de chaŒne" "{f3aa0dc0-9cc8-11d0-a599-00c04fd64434}"="Raccourci de chaŒne" "{f3ba0dc0-9cc8-11d0-a599-00c04fd64435}"="Channel Handler Object" "{f3da0dc0-9cc8-11d0-a599-00c04fd64437}"="Channel Menu" "{f3ea0dc0-9cc8-11d0-a599-00c04fd64438}"="Channel Properties" "{7EFFF3DD-71B3-11D4-A25E-005056DCFB89}"="DIALux 2.0 ULDShellHandler Class" "{950FF917-7A57-46BC-8017-59D9BF474000}"="Shell Extension for CDRW" "{0006F045-0000-0000-C000-000000000046}"="Microsoft Outlook Custom Icon Handler" "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"="WinRAR shell extension" "{D25B2CAB-8A9A-4517-A9B2-CB5F68A5A802}"="Adobe.Acrobat.ContextMenu" "{2559a1f7-21d7-11d4-bdaf-00c04f60b9f0}"="Set Program Access and Defaults" "{596AB062-B4D2-4215-9F74-E9109B0A8153}"="Previous Versions Property Page" "{9DB7A13C-F208-4981-8353-73CC61AE2783}"="Previous Versions" "{640167b4-59b0-47a6-b335-a6b3c0695aea}"="Portable Media Devices" "{cc86590a-b60a-48e6-996b-41d25ed39a1e}"="Portable Media Devices Menu" "{F0CB00CD-5A07-4D91-97F5-A8C92CDA93E4}"="Shell Extensions for RealOne Player" "{7059DA7A-7E60-11d2-A355-00C04FB9D26E}"="Maxtor Locked Drives" "{1D2680C9-0E2A-469d-B787-065558BC7D43}"="Fusion Cache" "{D9872D13-7651-4471-9EEE-F0A00218BEBB}"="Multiscan" "{1CDB2949-8F65-4355-8456-263E7C208A5D}"="Desktop Explorer" "{1E9B04FB-F9E5-4718-997B-B8DA88302A47}"="Desktop Explorer Menu" "{A70C977A-BF00-412C-90B7-034C51DA2439}"="NvCpl DesktopContext Class" "{1E9B04FB-F9E5-4718-997B-B8DA88302A48}"="nView Desktop Context Menu" "{FFB699E0-306A-11d3-8BD1-00104B6F7516}"="Play on my TV helper" "{5a61f7a0-cde1-11cf-9113-00aa00425c62}"="IIS Shell Extension" "{692F0339-CBAA-47e6-B5B5-3B84DB604E87}"="Extensions Manager Folder" "{AB77609F-2178-4E6F-9C4B-44AC179D937A}"="aý Context Menu Shell Extension" "{73F00216-5C4C-401A-AA93-581830996BBA}"="" ********************************************************************************** HKEY ROOT CLASSIDS: Windows Registry Editor Version 5.00 [HKEY_CLASSES_ROOT\CLSID\{73F00216-5C4C-401A-AA93-581830996BBA}] @="" [HKEY_CLASSES_ROOT\CLSID\{73F00216-5C4C-401A-AA93-581830996BBA}\Implemented Categories] @="" [HKEY_CLASSES_ROOT\CLSID\{73F00216-5C4C-401A-AA93-581830996BBA}\Implemented Categories\{00021492-0000-0000-C000-000000000046}] @="" [HKEY_CLASSES_ROOT\CLSID\{73F00216-5C4C-401A-AA93-581830996BBA}\InprocServer32] @="C:\WINDOWS\system32\mwr.dll" "ThreadingModel"="Apartment" ********************************************************************************** Files Found are not all bad files: C:\WINDOWS\SYSTEM32\ browseui.dll Sat 3 Sep 2005 2:06:12 A.... 1 020 416 996,50 K cdfview.dll Sat 3 Sep 2005 2:06:12 A.... 152 064 148,50 K cdosys.dll Sat 10 Sep 2005 3:55:14 A.... 2 067 968 1,97 M danim.dll Sat 3 Sep 2005 2:06:12 A.... 1 056 256 1,00 M dilmsc32.dll Sat 29 Oct 2005 6:59:46 ..S.R 235 546 230,02 K divx.dll Wed 10 Aug 2005 0:14:00 A.... 692 736 676,50 K divx_x~1.dll Wed 10 Aug 2005 0:13:52 A.... 688 128 672,00 K divx_x~2.dll Wed 10 Aug 2005 0:13:54 A.... 688 128 672,00 K divx_x~3.dll Wed 10 Aug 2005 0:13:52 A.... 671 744 656,00 K dpl100.dll Wed 10 Aug 2005 0:12:30 A.... 86 016 84,00 K dpu11.dll Wed 10 Aug 2005 0:12:28 A.... 245 760 240,00 K dpugui11.dll Wed 10 Aug 2005 0:12:30 A.... 581 632 568,00 K dpus11.dll Wed 10 Aug 2005 0:12:28 A.... 303 104 296,00 K dpv11.dll Wed 10 Aug 2005 0:12:28 A.... 57 344 56,00 K dtu100.dll Wed 10 Aug 2005 0:12:30 A.... 200 704 196,00 K dwskmon.dll Sat 29 Oct 2005 7:43:24 ..S.R 237 265 231,70 K dxtrans.dll Sat 3 Sep 2005 2:06:12 A.... 205 312 200,50 K dzcore.dll Mon 12 Sep 2005 15:27:22 A.... 4 182 067 3,99 M dzwrap~1.dll Mon 12 Sep 2005 15:29:54 A.... 102 466 100,06 K etfpix~1.dll Sat 29 Oct 2005 6:16:20 ..S.R 236 664 231,12 K extmgr.dll Sat 3 Sep 2005 2:06:12 ..... 55 808 54,50 K gwfspi~1.dll Mon 29 Aug 2005 13:27:06 A.... 23 304 22,76 K iepeers.dll Sat 3 Sep 2005 2:06:12 A.... 251 392 245,50 K imsins~2.dll Fri 16 Sep 2005 12:56:14 A.... 30 384 29,67 K inseng.dll Sat 3 Sep 2005 2:06:12 A.... 96 768 94,50 K jlit500.dll Sat 29 Oct 2005 7:36:58 ..S.R 236 664 231,12 K jvit500.dll Sat 29 Oct 2005 5:59:46 ..S.R 236 664 231,12 K ksdfr.dll Sat 29 Oct 2005 5:51:10 ..S.R 235 546 230,02 K l08mla~1.dll Sat 29 Oct 2005 10:17:02 ..S.R 236 664 231,12 K legitc~1.dll Mon 29 Aug 2005 13:27:12 A.... 520 968 508,76 K libeay32.dll Wed 10 Aug 2005 0:13:32 A.... 831 488 812,00 K linkinfo.dll Thu 1 Sep 2005 3:43:38 A.... 19 968 19,50 K mcrd2x40.dll Sat 29 Oct 2005 10:52:04 ..S.R 237 265 231,70 K meminst.dll Sat 29 Oct 2005 6:09:38 ..S.R 235 546 230,02 K mshtml.dll Tue 4 Oct 2005 17:26:06 A.... 3 013 120 2,87 M mshtmled.dll Sat 3 Sep 2005 2:06:12 A.... 448 512 438,00 K msrating.dll Sat 3 Sep 2005 2:06:12 A.... 146 432 143,00 K mstime.dll Sat 3 Sep 2005 2:06:12 A.... 530 432 518,00 K msvbvm60.dll Tue 6 Sep 2005 14:14:10 A.... 1 386 496 1,32 M mv22l9~1.dll Sat 29 Oct 2005 11:00:20 ..S.R 233 862 228,38 K mwr.dll Sat 29 Oct 2005 11:00:20 ..S.R 237 265 231,70 K ndwrshu.dll Sat 29 Oct 2005 5:09:10 ..S.R 235 546 230,02 K netman.dll Mon 22 Aug 2005 20:35:10 A.... 197 632 193,00 K nfwdmcpl.dll Sat 29 Oct 2005 7:21:52 ..S.R 236 664 231,12 K nv4_disp.dll Tue 2 Aug 2005 16:35:00 A.... 3 908 864 3,73 M nvcod.dll Tue 2 Aug 2005 16:35:00 A.... 32 768 32,00 K nvcodins.dll Tue 2 Aug 2005 16:35:00 A.... 32 768 32,00 K nvcpl.dll Tue 2 Aug 2005 16:35:00 A.... 7 110 656 6,78 M nvhwvid.dll Tue 2 Aug 2005 16:35:00 A.... 540 672 528,00 K nview.dll Tue 2 Aug 2005 16:35:00 A.... 1 466 368 1,40 M nvmctray.dll Tue 2 Aug 2005 16:35:00 A.... 86 016 84,00 K nvnt4cpl.dll Tue 2 Aug 2005 16:35:00 A.... 286 720 280,00 K nvoglnt.dll Tue 2 Aug 2005 16:35:00 A.... 5 140 480 4,90 M nvrsar.dll Tue 2 Aug 2005 16:35:00 A.... 315 392 308,00 K nvrscs.dll Tue 2 Aug 2005 16:35:00 A.... 233 472 228,00 K nvrsda.dll Tue 2 Aug 2005 16:35:00 A.... 241 664 236,00 K nvrsde.dll Tue 2 Aug 2005 16:35:00 A.... 266 240 260,00 K nvrsel.dll Tue 2 Aug 2005 16:35:00 A.... 270 336 264,00 K nvrseng.dll Tue 2 Aug 2005 16:35:00 A.... 237 568 232,00 K nvrses.dll Tue 2 Aug 2005 16:35:00 A.... 270 336 264,00 K nvrsesm.dll Tue 2 Aug 2005 16:35:00 A.... 262 144 256,00 K nvrsfi.dll Tue 2 Aug 2005 16:35:00 A.... 237 568 232,00 K nvrsfr.dll Tue 2 Aug 2005 16:35:00 A.... 270 336 264,00 K nvrshe.dll Tue 2 Aug 2005 16:35:00 A.... 311 296 304,00 K nvrshu.dll Tue 2 Aug 2005 16:35:00 A.... 245 760 240,00 K nvrsit.dll Tue 2 Aug 2005 16:35:00 A.... 270 336 264,00 K nvrsja.dll Tue 2 Aug 2005 16:35:00 A.... 253 952 248,00 K nvrsko.dll Tue 2 Aug 2005 16:35:00 A.... 249 856 244,00 K nvrsnl.dll Tue 2 Aug 2005 16:35:00 A.... 262 144 256,00 K nvrsno.dll Tue 2 Aug 2005 16:35:00 A.... 241 664 236,00 K nvrspl.dll Tue 2 Aug 2005 16:35:00 A.... 241 664 236,00 K nvrspt.dll Tue 2 Aug 2005 16:35:00 A.... 262 144 256,00 K nvrsptb.dll Tue 2 Aug 2005 16:35:00 A.... 253 952 248,00 K nvrsru.dll Tue 2 Aug 2005 16:35:00 A.... 258 048 252,00 K nvrssk.dll Tue 2 Aug 2005 16:35:00 A.... 245 760 240,00 K nvrssl.dll Tue 2 Aug 2005 16:35:00 A.... 241 664 236,00 K nvrssv.dll Tue 2 Aug 2005 16:35:00 A.... 241 664 236,00 K nvrstr.dll Tue 2 Aug 2005 16:35:00 A.... 245 760 240,00 K nvrszhc.dll Tue 2 Aug 2005 16:35:00 A.... 212 992 208,00 K nvrszht.dll Tue 2 Aug 2005 16:35:00 A.... 114 688 112,00 K nvshell.dll Tue 2 Aug 2005 16:35:00 A.... 466 944 456,00 K nvwddi.dll Tue 2 Aug 2005 16:35:00 A.... 81 920 80,00 K nvwdmcpl.dll Tue 2 Aug 2005 16:35:00 A.... 1 662 976 1,59 M nvwimg.dll Tue 2 Aug 2005 16:35:00 A.... 1 019 904 996,00 K nvwrsar.dll Tue 2 Aug 2005 16:35:00 A.... 282 624 276,00 K nvwrscs.dll Tue 2 Aug 2005 16:35:00 A.... 286 720 280,00 K nvwrsda.dll Tue 2 Aug 2005 16:35:00 A.... 294 912 288,00 K nvwrsde.dll Tue 2 Aug 2005 16:35:00 A.... 311 296 304,00 K nvwrsel.dll Tue 2 Aug 2005 16:35:00 A.... 335 872 328,00 K nvwrseng.dll Tue 2 Aug 2005 16:35:00 A.... 286 720 280,00 K nvwrses.dll Tue 2 Aug 2005 16:35:00 A.... 335 872 328,00 K nvwrsesm.dll Tue 2 Aug 2005 16:35:00 A.... 327 680 320,00 K nvwrsfi.dll Tue 2 Aug 2005 16:35:00 A.... 303 104 296,00 K nvwrsfr.dll Tue 2 Aug 2005 16:35:00 A.... 327 680 320,00 K nvwrshe.dll Tue 2 Aug 2005 16:35:00 A.... 278 528 272,00 K nvwrshu.dll Tue 2 Aug 2005 16:35:00 A.... 315 392 308,00 K nvwrsit.dll Tue 2 Aug 2005 16:35:00 A.... 323 584 316,00 K nvwrsja.dll Tue 2 Aug 2005 16:35:00 A.... 212 992 208,00 K nvwrsko.dll Tue 2 Aug 2005 16:35:00 A.... 196 608 192,00 K nvwrsnl.dll Tue 2 Aug 2005 16:35:00 A.... 319 488 312,00 K nvwrsno.dll Tue 2 Aug 2005 16:35:00 A.... 299 008 292,00 K nvwrspl.dll Tue 2 Aug 2005 16:35:00 A.... 294 912 288,00 K nvwrspt.dll Tue 2 Aug 2005 16:35:00 A.... 323 584 316,00 K nvwrsptb.dll Tue 2 Aug 2005 16:35:00 A.... 319 488 312,00 K nvwrsru.dll Tue 2 Aug 2005 16:35:00 A.... 315 392 308,00 K nvwrssk.dll Tue 2 Aug 2005 16:35:00 A.... 299 008 292,00 K nvwrssl.dll Tue 2 Aug 2005 16:35:00 A.... 303 104 296,00 K nvwrssv.dll Tue 2 Aug 2005 16:35:00 A.... 294 912 288,00 K nvwrstr.dll Tue 2 Aug 2005 16:35:00 A.... 303 104 296,00 K nvwrszhc.dll Tue 2 Aug 2005 16:35:00 A.... 163 840 160,00 K nvwrszht.dll Tue 2 Aug 2005 16:35:00 A.... 167 936 164,00 K nwwks.dll Thu 11 Aug 2005 17:11:40 A.... 65 024 63,50 K nytfxp~1.dll Sat 29 Oct 2005 7:30:22 ..S.R 237 265 231,70 K pfdrv.dll Sat 29 Oct 2005 6:30:00 ..S.R 236 664 231,12 K pkudsrv.dll Sat 29 Oct 2005 5:18:22 ..S.R 236 664 231,12 K pngfilt.dll Sat 3 Sep 2005 2:06:12 A.... 39 424 38,50 K pwrupcid.dll Tue 6 Sep 2005 14:14:10 A.... 163 840 160,00 K qt-dx331.dll Wed 10 Aug 2005 0:12:30 A.... 3 596 288 3,43 M quartz.dll Tue 30 Aug 2005 5:55:44 A.... 1 293 312 1,23 M rwsapi32.dll Sat 29 Oct 2005 10:18:34 ..S.R 237 265 231,70 K shdocvw.dll Sat 3 Sep 2005 2:06:12 A.... 1 484 288 1,41 M shell32.dll Fri 23 Sep 2005 5:07:00 A.... 8 506 880 8,11 M shlwapi.dll Sat 3 Sep 2005 2:06:12 A.... 474 112 463,00 K soesrv.dll Sat 29 Oct 2005 6:21:28 ..S.R 235 546 230,02 K ssleay32.dll Wed 10 Aug 2005 0:13:32 A.... 159 744 156,00 K umpnpmgr.dll Tue 23 Aug 2005 5:39:36 A.... 124 928 122,00 K unicows.dll Wed 10 Aug 2005 0:13:32 A.... 245 408 239,66 K urlmon.dll Sat 3 Sep 2005 2:06:12 A.... 605 696 591,50 K uupnpmgr.dll Sat 29 Oct 2005 6:49:06 ..S.R 236 664 231,12 K wbpasf.dll Sat 29 Oct 2005 7:06:56 ..S.R 236 664 231,12 K wininet.dll Sat 3 Sep 2005 2:06:12 A.... 662 528 647,00 K winsrv.dll Thu 1 Sep 2005 3:43:38 A.... 292 352 285,50 K wlpcore.dll Sat 29 Oct 2005 7:15:48 ..S.R 234 072 228,59 K wpatools.dll Wed 26 Oct 2005 23:56:18 A.... 45 056 44,00 K wzvadve.dll Sat 29 Oct 2005 6:41:02 ..S.R 235 546 230,02 K xipopup.dll Tue 6 Sep 2005 14:14:10 A.... 98 304 96,00 K xipush.dll Tue 6 Sep 2005 14:14:10 A.... 90 112 88,00 K xirepctl.dll Tue 6 Sep 2005 14:14:10 A.... 270 336 264,00 K xislide.dll Tue 6 Sep 2005 14:14:10 A.... 94 208 92,00 K xisuictl.dll Tue 6 Sep 2005 14:14:10 A.... 397 312 388,00 K xitabs.dll Tue 6 Sep 2005 14:14:10 A.... 442 368 432,00 K xithreed.dll Tue 6 Sep 2005 14:14:10 A.... 339 968 332,00 K xitray.dll Tue 6 Sep 2005 14:14:10 A.... 45 056 44,00 K xitree.dll Tue 6 Sep 2005 14:14:10 A.... 282 624 276,00 K 144 items found: 144 files (22 H/S), 0 directories. Total of file sizes: 81 990 044 bytes 78,19 M Locate .tmp files: No matches found. ********************************************************************************** Directory Listing of system files: Le volume dans le lecteur C s'appelle SYSTEME Le num‚ro de s‚rie du volume est FCF9-D086 R‚pertoire de C:\WINDOWS\System32 29/10/2005 11:00 237ÿ265 mwr.dll 29/10/2005 11:00 233ÿ862 mv22l9fo1.dll 29/10/2005 10:52 237ÿ265 mcrd2x40.dll 29/10/2005 10:18 237ÿ265 rWsapi32.dll 29/10/2005 10:17 236ÿ664 l08mlal11dq.dll 29/10/2005 07:43 237ÿ265 dwskmon.dll 29/10/2005 07:36 236ÿ664 JLIT500.DLL 29/10/2005 07:30 237ÿ265 nytfxperf.dll 29/10/2005 07:21 236ÿ664 nfwdmcpl.dll 29/10/2005 07:15 234ÿ072 wlpcore.dll 29/10/2005 07:06 236ÿ664 wbpasf.dll 29/10/2005 06:59 235ÿ546 DILMSC32.dll 29/10/2005 06:49 236ÿ664 uupnpmgr.dll 29/10/2005 06:41 235ÿ546 WZVADVE.DLL 29/10/2005 06:29 236ÿ664 pfdrv.dll 29/10/2005 06:21 235ÿ546 soesrv.dll 29/10/2005 06:16 236ÿ664 etfpixio130.dll 29/10/2005 06:09 235ÿ546 meminst.dll 29/10/2005 05:59 236ÿ664 JVIT500.DLL 29/10/2005 05:51 235ÿ546 ksdfr.dll 29/10/2005 05:18 236ÿ664 pkudsrv.dll 29/10/2005 05:09 235ÿ546 ndwrshu.dll 19/10/2005 22:34 dllcache 03/10/2004 20:35 56 ABAEFF85CD.sys 24/08/2004 18:41 56 F08598D612.sys 05/08/2004 21:22 Microsoft 24 fichier(s) 5ÿ197ÿ623 octets 2 R‚p(s) 7ÿ372ÿ804ÿ096 octets libres Que dois-je faire ensuite ? Kill box ou l2m fix ? Merci Jemit

balltrap34 · Answer

relance l2mfix et clik sur l2mfix.bat et cette foix clik sur l option2 et laisse le faire et met moi le rapport et un nouveau rapport hijack

jemit · Answer

Il a rbooté mais ensuite il ne c'est rien passé. J'ai mis du temps car au reboot il aplanté j'ai du passer en mode sans échec pour désactiver ad-watch et reprendre la main. J'ai relancé l2m une deuxieme fois en scan seul toujours le même rapport avec en plus une dll supplémentaire!! J'ai ensuite lancer avec la commande 2 idem reboot j'ai retrouvé l'interface XP j'ai attendu au moins 5mn mais rien ne c'est passé à nouveau. Je joint le dernier scan. L2MFIX find log 1.04a These are the registry keys present ********************************************************************************** Winlogon/notify: Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain] "Asynchronous"=dword:00000000 "Impersonate"=dword:00000000 "DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,33,00,32,00,2e,00,64,00,6c,00,\ 6c,00,00,00 "Logoff"="ChainWlxLogoffEvent" [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet] "Asynchronous"=dword:00000000 "Impersonate"=dword:00000000 "DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,6e,00,65,00,74,00,2e,00,64,00,\ 6c,00,6c,00,00,00 "Logoff"="CryptnetWlxLogoffEvent" [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll] "DLLName"="cscdll.dll" "Logon"="WinlogonLogonEvent" "Logoff"="WinlogonLogoffEvent" "ScreenSaver"="WinlogonScreenSaverEvent" "Startup"="WinlogonStartupEvent" "Shutdown"="WinlogonShutdownEvent" "StartShell"="WinlogonStartShellEvent" "Impersonate"=dword:00000000 "Asynchronous"=dword:00000001 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp] "DLLName"="wlnotify.dll" "Logon"="SCardStartCertProp" "Logoff"="SCardStopCertProp" "Lock"="SCardSuspendCertProp" "Unlock"="SCardResumeCertProp" "Enabled"=dword:00000001 "Impersonate"=dword:00000001 "Asynchronous"=dword:00000001 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule] "Asynchronous"=dword:00000000 "DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\ 6c,00,6c,00,00,00 "Impersonate"=dword:00000000 "StartShell"="SchedStartShell" "Logoff"="SchedEventLogOff" [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy] "Logoff"="WLEventLogoff" "Impersonate"=dword:00000000 "Asynchronous"=dword:00000001 "DllName"=hex(2):73,00,63,00,6c,00,67,00,6e,00,74,00,66,00,79,00,2e,00,64,00,\ 6c,00,6c,00,00,00 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn] "DLLName"="WlNotify.dll" "Lock"="SensLockEvent" "Logon"="SensLogonEvent" "Logoff"="SensLogoffEvent" "Safe"=dword:00000001 "MaxWait"=dword:00000258 "StartScreenSaver"="SensStartScreenSaverEvent" "StopScreenSaver"="SensStopScreenSaverEvent" "Startup"="SensStartupEvent" "Shutdown"="SensShutdownEvent" "StartShell"="SensStartShellEvent" "PostShell"="SensPostShellEvent" "Disconnect"="SensDisconnectEvent" "Reconnect"="SensReconnectEvent" "Unlock"="SensUnlockEvent" "Impersonate"=dword:00000001 "Asynchronous"=dword:00000001 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify ermsrv] "Asynchronous"=dword:00000000 "DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\ 6c,00,6c,00,00,00 "Impersonate"=dword:00000000 "Logoff"="TSEventLogoff" "Logon"="TSEventLogon" "PostShell"="TSEventPostShell" "Shutdown"="TSEventShutdown" "StartShell"="TSEventStartShell" "Startup"="TSEventStartup" "MaxWait"=dword:00000258 "Reconnect"="TSEventReconnect" "Disconnect"="TSEventDisconnect" [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon] "DLLName"="wlnotify.dll" "Logon"="RegisterTicketExpiredNotificationEvent" "Logoff"="UnregisterTicketExpiredNotificationEvent" "Impersonate"=dword:00000001 "Asynchronous"=dword:00000001 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wzcnotif] "DLLName"="wzcdlg.dll" "Logon"="WZCEventLogon" "Logoff"="WZCEventLogoff" "Impersonate"=dword:00000000 "Asynchronous"=dword:00000000 RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above Copyright (c) 1999-2001 Frank Heyne Software (http://www.heysoft.de) This program is Freeware, use it on your own risk! Access Control List for Registry key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify: (CI) DENY --C------- BUILTIN\Administrateurs (NI) ALLOW Full access AUTORITE NT\SYSTEM (IO) ALLOW Full access AUTORITE NT\SYSTEM (ID-NI) ALLOW Read BUILTIN\Utilisateurs (ID-IO) ALLOW Read BUILTIN\Utilisateurs (ID-NI) ALLOW Read BUILTIN\Utilisateurs avec pouvoir (ID-IO) ALLOW Read BUILTIN\Utilisateurs avec pouvoir (ID-NI) ALLOW Full access BUILTIN\Administrateurs (ID-IO) ALLOW Full access BUILTIN\Administrateurs (ID-NI) ALLOW Full access AUTORITE NT\SYSTEM (ID-IO) ALLOW Full access AUTORITE NT\SYSTEM (ID-IO) ALLOW Full access CREATEUR PROPRIETAIRE ********************************************************************************** useragent: Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform] "{DF3E2E7D-A2F2-6EF3-0720-224ACAA63EDA}"="" ********************************************************************************** Shell Extension key: Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved] "{00022613-0000-0000-C000-000000000046}"="Feuille de propri‚t‚s du fichier multim‚dia" "{176d6597-26d3-11d1-b350-080036a75b03}"="Gestion de scanneur ICM" "{1F2E5C40-9550-11CE-99D2-00AA006E086C}"="Page de s‚curit‚ NTFS" "{3EA48300-8CF6-101B-84FB-666CCB9BCD32}"="Page des propri‚t‚s de OLE DocFile" "{40dd6e20-7c17-11ce-a804-00aa003ca9f6}"="Extensions de l'environnement pour le partage" "{41E300E0-78B6-11ce-849B-444553540000}"="PlusPack CPL Extension" "{42071712-76d4-11d1-8b24-00a0c9068ff3}"="Extension Affichage Carte du Panneau de configuration" "{42071713-76d4-11d1-8b24-00a0c9068ff3}"="Extension Affichage cran du Panneau de configuration" "{42071714-76d4-11d1-8b24-00a0c9068ff3}"="Extension Affichage Panorama du Panneau de configuration" "{4E40F770-369C-11d0-8922-00A024AB2DBB}"="Page de s‚curit‚ DS" "{513D916F-2A8E-4F51-AEAB-0CBC76FB1AF8}"="Page de compatibilit‚" "{56117100-C0CD-101B-81E2-00AA004AE837}"="Gestionnaire de donn‚es endommag‚es de l'environnement" "{59099400-57FF-11CE-BD94-0020AF85B590}"="Extension copie de disquette" "{59be4990-f85c-11ce-aff7-00aa003ca9f6}"="Extensions de l'environnement pour les objets r‚seau de Microsoft Windows" "{5DB2625A-54DF-11D0-B6C4-0800091AA605}"="Gestion d'‚cran ICM" "{675F097E-4C4D-11D0-B6C1-0800091AA605}"="Gestion d'imprimante ICM" "{764BF0E1-F219-11ce-972D-00AA00A14F56}"="Extensions de l'environnement de compression de fichiers" "{77597368-7b15-11d0-a0c2-080036af3f03}"="Extension de l'environnement d'imprimante Web" "{7988B573-EC89-11cf-9C00-00AA00A14F56}"="Disk Quota UI" "{853FE2B1-B769-11d0-9C4E-00C04FB6C6FA}"="Menu contextuel de cryptage" "{85BBD920-42A0-1069-A2E4-08002B30309D}"="Porte-documents" "{88895560-9AA2-1069-930E-00AA0030EBC8}"="Extension ic“ne HyperTerminal" "{BD84B380-8CA2-1069-AB1D-08000948F534}"="Fonts" "{DBCE2480-C732-101B-BE72-BA78E9AD5B27}"="Profil ICC" "{F37C5810-4D3F-11d0-B4BF-00AA00BBB723}"="Page de s‚curit‚ des imprimantes" "{f81e9010-6ea4-11ce-a7ff-00aa003ca9f6}"="Extensions de l'environnement pour le partage" "{f92e8c40-3d33-11d2-b1aa-080036a75b03}"="Display TroubleShoot CPL Extension" "{7444C717-39BF-11D1-8CD9-00C04FC29D45}"="Extension de cryptographie PKO" "{7444C719-39BF-11D1-8CD9-00C04FC29D45}"="Extension de cryptographie Sign" "{7007ACC7-3202-11D1-AAD2-00805FC1270E}"="Connexions r‚seau" "{992CFFA0-F557-101A-88EC-00DD010CCC48}"="Connexions r‚seau" "{E211B736-43FD-11D1-9EFB-0000F8757FCD}"="&Scanneurs et appareils photo" "{FB0C9C8A-6C50-11D1-9F1D-0000F8757FCD}"="&Scanneurs et appareils photo" "{905667aa-acd6-11d2-8080-00805f6596d2}"="&Scanneurs et appareils photo" "{3F953603-1008-4f6e-A73A-04AAC7A992F1}"="&Scanneurs et appareils photo" "{83bbcbf3-b28a-4919-a5aa-73027445d672}"="&Scanneurs et appareils photo" "{F0152790-D56E-4445-850E-4F3117DB740C}"="Remote Sessions CPL Extension" "{5F327514-6C5E-4d60-8F16-D07FA08A78ED}"="Auto Update Property Sheet Extension" "{60254CA5-953B-11CF-8C96-00AA00B8708C}"="Extension de l'interpr‚teur de commande pour Windows Script Host" "{2206CDB2-19C1-11D1-89E0-00C04FD7A829}"="Liaison de donn‚es Microsoft" "{DD2110F0-9EEF-11cf-8D8E-00AA0060F5BF}"="Tasks Folder Icon Handler" "{797F1E90-9EDD-11cf-8D8E-00AA0060F5BF}"="Tasks Folder Shell Extension" "{D6277990-4C6A-11CF-8D87-00AA0060F5BF}"="Tƒches planifi‚es" "{0DF44EAA-FF21-4412-828E-260A8728E7F1}"="Barre des tƒches et menu D‚marrer" "{2559a1f0-21d7-11d4-bdaf-00c04f60b9f0}"="Rechercher" "{2559a1f1-21d7-11d4-bdaf-00c04f60b9f0}"="Aide et support" "{2559a1f2-21d7-11d4-bdaf-00c04f60b9f0}"="Aide et support" "{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}"="Ex‚cuter..." "{2559a1f4-21d7-11d4-bdaf-00c04f60b9f0}"="Internet" "{2559a1f5-21d7-11d4-bdaf-00c04f60b9f0}"="Courrier ‚lectronique" "{D20EA4E1-3957-11d2-A40B-0C5020524152}"="Polices" "{D20EA4E1-3957-11d2-A40B-0C5020524153}"="Outils d'administration" "{875CB1A1-0F29-45de-A1AE-CFB4950D0B78}"="Audio Media Properties Handler" "{40C3D757-D6E4-4b49-BB41-0E5BBEA28817}"="Video Media Properties Handler" "{E4B29F9D-D390-480b-92FD-7DDB47101D71}"="Wav Properties Handler" "{87D62D94-71B3-4b9a-9489-5FE6850DC73E}"="Avi Properties Handler" "{A6FD9E45-6E44-43f9-8644-08598F5A74D9}"="Midi Properties Handler" "{c5a40261-cd64-4ccf-84cb-c394da41d590}"="Video Thumbnail Extractor" "{5E6AB780-7743-11CF-A12B-00AA004AE837}"="Barre d'outils Internet Microsoft" "{22BF0C20-6DA7-11D0-B373-00A0C9034938}"="tat du t‚l‚chargement" "{91EA3F8B-C99B-11d0-9815-00C04FD91972}"="Dossier Bureau ‚tendu" "{6413BA2C-B461-11d1-A18A-080036B11A03}"="Dossier du shell augment‚" "{F61FFEC1-754F-11d0-80CA-00AA005B4383}"="BandProxy" "{7BA4C742-9E81-11CF-99D3-00AA004AE837}"="Bande du navigateur Microsoft" "{30D02401-6A81-11d0-8274-00C04FD5AE38}"="Bande de recherche" "{32683183-48a0-441b-a342-7c2a440a9478}"="Media Band" "{169A0691-8DF9-11d1-A1C4-00C04FD75D13}"="Volet int‚gr‚ de recherche" "{07798131-AF23-11d1-9111-00A0C98BA67D}"="Recherche Web" "{AF4F6510-F982-11d0-8595-00AA004CD6D8}"="Utilitaire des options de l'arborescence du Registre" "{01E04581-4EEE-11d0-BFE9-00AA005B4383}"="&Adresse" "{A08C11D2-A228-11d0-825B-00AA005B4383}"="BoŒte d'entr‚e de l'adresse" "{00BB2763-6A77-11D0-A535-00C04FD7D062}"="Saisie semi-automatique Microsoft" "{7376D660-C583-11d0-A3A5-00C04FD706EC}"="TridentImageExtractor" "{6756A641-DE71-11d0-831B-00AA005B4383}"="Liste de saisie semi-automatique MRU" "{6935DB93-21E8-4ccc-BEB9-9FE3C77A297A}"="Liste de saisie semi-automatique personnalis‚e MRU" "{7e653215-fa25-46bd-a339-34a2790f3cb7}"="Accessible" "{acf35015-526e-4230-9596-becbe19f0ac9}"="Barre de progrŠs auto-ouvrante" "{E0E11A09-5CB8-4B6C-8332-E00720A168F2}"="Analyseur de la barre d'adresses" "{00BB2764-6A77-11D0-A535-00C04FD7D062}"="Liste de saisie semi-automatique de l'historique Microsoft" "{03C036F1-A186-11D0-824A-00AA005B4383}"="Liste de saisie semi-automatique du dossier Shell Microsoft" "{00BB2765-6A77-11D0-A535-00C04FD7D062}"="Conteneur de la liste de saisie semi-automatique multiple Microsoft" "{ECD4FC4E-521C-11D0-B792-00A0C90312E1}"="Menu Site de bandes" "{3CCF8A41-5C85-11d0-9796-00AA00B90ADF}"="Shell DeskBarApp" "{ECD4FC4C-521C-11D0-B792-00A0C90312E1}"="Barre du Bureau" "{ECD4FC4D-521C-11D0-B792-00A0C90312E1}"="Shell Rebar BandSite" "{DD313E04-FEFF-11d1-8ECD-0000F87A470C}"="Assistance utilisateur" "{EF8AD2D1-AE36-11D1-B2D2-006097DF8C11}"="ParamŠtres du dossier global" "{EFA24E61-B078-11d0-89E4-00C04FC9E26E}"="Favorites Band" "{0A89A860-D7B1-11CE-8350-444553540000}"="Shell Automation Inproc Service" "{E7E4BC40-E76A-11CE-A9BB-00AA004AE837}"="Shell DocObject Viewer" "{A5E46E3A-8849-11D1-9D8C-00C04FC99D61}"="Microsoft Browser Architecture" "{FBF23B40-E3F0-101B-8488-00AA003E56F8}"="InternetShortcut" "{3C374A40-BAE4-11CF-BF7D-00AA006946EE}"="Microsoft Url History Service" "{FF393560-C2A7-11CF-BFF4-444553540000}"="Historique" "{7BD29E00-76C1-11CF-9DD0-00A0C9034933}"="Temporary Internet Files" "{7BD29E01-76C1-11CF-9DD0-00A0C9034933}"="Temporary Internet Files" "{CFBFAE00-17A6-11D0-99CB-00C04FD64497}"="Microsoft Url Search Hook" "{A2B0DD40-CC59-11d0-A3A5-00C04FD706EC}"="Image de d‚marrage de la Suite IE4" "{67EA19A0-CCEF-11d0-8024-00C04FD75D13}"="CDF Extension Copy Hook" "{131A6951-7F78-11D0-A979-00C04FD705A2}"="ISFBand OC" "{9461b922-3c5a-11d2-bf8b-00c04fb93661}"="Search Assistant OC" "{3DC7A020-0ACD-11CF-A9BB-00AA004AE837}"="Internet" "{871C5380-42A0-1069-A2EA-08002B30309D}"="Internet Name Space" "{EFA24E64-B078-11d0-89E4-00C04FC9E26E}"="Explorer Band" "{9E56BE60-C50F-11CF-9A2C-00A0C90A90CE}"="Sendmail service" "{9E56BE61-C50F-11CF-9A2C-00A0C90A90CE}"="Sendmail service" "{88C6C381-2E85-11D0-94DE-444553540000}"="Dossier ActiveX Cache" "{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"="WebCheck" "{ABBE31D0-6DAE-11D0-BECA-00C04FD940BE}"="Subscription Mgr" "{F5175861-2688-11d0-9C5E-00AA00A45957}"="Dossier Inscription" "{08165EA0-E946-11CF-9C87-00AA005127ED}"="WebCheckWebCrawler" "{E3A8BDE6-ABCE-11d0-BC4B-00C04FD929DB}"="WebCheckChannelAgent" "{E8BB6DC0-6B4E-11d0-92DB-00A0C90C2BD7}"="TrayAgent" "{7D559C10-9FE9-11d0-93F7-00AA0059CE02}"="Code Download Agent" "{E6CC6978-6B6E-11D0-BECA-00C04FD940BE}"="ConnectionAgent" "{D8BD2030-6FC9-11D0-864F-00AA006809D9}"="PostAgent" "{7FC0B86E-5FA7-11d1-BC7C-00C04FD929DB}"="WebCheck SyncMgr Handler" "{352EC2B7-8B9A-11D1-B8AE-006008059382}"="Gestionnaire d'applications d'environnement" "{0B124F8F-91F0-11D1-B8B5-006008059382}"="num‚rateur d'applications install‚es" "{CFCCC7A0-A282-11D1-9082-006008059382}"="Publication d'application Darwin" "{e84fda7c-1d6a-45f6-b725-cb260c236066}"="Shell Image Verbs" "{66e4e4fb-f385-4dd0-8d74-a2efd1bc6178}"="Shell Image Data Factory" "{3F30C968-480A-4C6C-862D-EFC0897BB84B}"="Extracteur de miniatures de fichier + GDI" "{9DBD2C50-62AD-11d0-B806-00C04FD706EC}"="Gestionnaire de miniatures - Informations de r‚sum‚ (DOCFILES)" "{EAB841A0-9550-11cf-8C16-00805F1408F3}"="Extracteur de miniatures HTML" "{eb9b1153-3b57-4e68-959a-a3266bc3d7fe}"="Shell Image Property Handler" "{CC6EEFFB-43F6-46c5-9619-51D571967F7D}"="Assistant Publication de sites Web" "{add36aa8-751a-4579-a266-d66f5202ccbb}"="Commande d'impressions via le Web" "{6b33163c-76a5-4b6c-bf21-45de9cd503a1}"="Objet Assistant de publication Shell" "{58f1f272-9240-4f51-b6d4-fd63d1618591}"="Assistant Obtenir une identit‚ Passport" "{7A9D77BD-5403-11d2-8785-2E0420524153}"="Comptes d'utilisateurs" "{BD472F60-27FA-11cf-B8B4-444553540000}"="Compressed (zipped) Folder Right Drag Handler" "{888DCA60-FC0A-11CF-8F0F-00C04FD7D062}"="Compressed (zipped) Folder SendTo Target" "{63da6ec0-2e98-11cf-8d82-444553540000}"="FTP Folders Webview" "{883373C3-BF89-11D1-BE35-080036B11A03}"="Microsoft DocProp Shell Ext" "{A9CF0EAE-901A-4739-A481-E35B73E47F6D}"="Microsoft DocProp Inplace Edit Box Control" "{8EE97210-FD1F-4B19-91DA-67914005F020}"="Microsoft DocProp Inplace ML Edit Box Control" "{0EEA25CC-4362-4A12-850B-86EE61B0D3EB}"="Microsoft DocProp Inplace Droplist Combo Control" "{6A205B57-2567-4A2C-B881-F787FAB579A3}"="Microsoft DocProp Inplace Calendar Control" "{28F8A4AC-BBB3-4D9B-B177-82BFC914FA33}"="Microsoft DocProp Inplace Time Control" "{8A23E65E-31C2-11d0-891C-00A024AB2DBB}"="Directory Query UI" "{9E51E0D0-6E0F-11d2-9601-00C04FA31A86}"="Shell properties for a DS object" "{163FDC20-2ABC-11d0-88F0-00A024AB2DBB}"="Directory Object Find" "{F020E586-5264-11d1-A532-0000F8757D7E}"="Directory Start/Search Find" "{0D45D530-764B-11d0-A1CA-00AA00C16E65}"="Directory Property UI" "{62AE1F9A-126A-11D0-A14B-0800361B1103}"="Directory Context Menu Verbs" "{ECF03A33-103D-11d2-854D-006008059367}"="MyDocs Copy Hook" "{ECF03A32-103D-11d2-854D-006008059367}"="MyDocs Drop Target" "{4a7ded0a-ad25-11d0-98a8-0800361b1103}"="MyDocs Properties" "{750fdf0e-2a26-11d1-a3ea-080036587f03}"="Offline Files Menu" "{10CFC467-4392-11d2-8DB4-00C04FA31A66}"="Offline Files Folder Options" "{AFDB1F70-2A4C-11d2-9039-00C04F8EEB3E}"="Dossier Fichiers hors connexion" "{143A62C8-C33B-11D1-84FE-00C04FA34A14}"="Microsoft Agent Character Property Sheet Handler" "{ECCDF543-45CC-11CE-B9BF-0080C87CDBA6}"="DfsShell" "{60fd46de-f830-4894-a628-6fa81bc0190d}"="%DESC_PublishDropTarget%" "{7A80E4A8-8005-11D2-BCF8-00C04F72C717}"="MMC Icon Handler" "{0CD7A5C0-9F37-11CE-AE65-08002B2E1262}"=".CAB file viewer" "{32714800-2E5F-11d0-8B85-00AA0044F941}"="Des &personnes..." "{8DD448E6-C188-4aed-AF92-44956194EB1F}"="Windows Media Player Play as Playlist Context Menu Handler" "{CE3FB1D1-02AE-4a5f-A6E9-D9F1B4073E6C}"="Windows Media Player Burn Audio CD Context Menu Handler" "{F1B9284F-E9DC-4e68-9D7E-42362A59F0FD}"="Windows Media Player Add to Playlist Context Menu Handler" "{f39a0dc0-9cc8-11d0-a599-00c04fd64433}"="Fichier de chaŒne" "{f3aa0dc0-9cc8-11d0-a599-00c04fd64434}"="Raccourci de chaŒne" "{f3ba0dc0-9cc8-11d0-a599-00c04fd64435}"="Channel Handler Object" "{f3da0dc0-9cc8-11d0-a599-00c04fd64437}"="Channel Menu" "{f3ea0dc0-9cc8-11d0-a599-00c04fd64438}"="Channel Properties" "{7EFFF3DD-71B3-11D4-A25E-005056DCFB89}"="DIALux 2.0 ULDShellHandler Class" "{950FF917-7A57-46BC-8017-59D9BF474000}"="Shell Extension for CDRW" "{0006F045-0000-0000-C000-000000000046}"="Microsoft Outlook Custom Icon Handler" "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"="WinRAR shell extension" "{D25B2CAB-8A9A-4517-A9B2-CB5F68A5A802}"="Adobe.Acrobat.ContextMenu" "{2559a1f7-21d7-11d4-bdaf-00c04f60b9f0}"="Set Program Access and Defaults" "{596AB062-B4D2-4215-9F74-E9109B0A8153}"="Previous Versions Property Page" "{9DB7A13C-F208-4981-8353-73CC61AE2783}"="Previous Versions" "{640167b4-59b0-47a6-b335-a6b3c0695aea}"="Portable Media Devices" "{cc86590a-b60a-48e6-996b-41d25ed39a1e}"="Portable Media Devices Menu" "{F0CB00CD-5A07-4D91-97F5-A8C92CDA93E4}"="Shell Extensions for RealOne Player" "{7059DA7A-7E60-11d2-A355-00C04FB9D26E}"="Maxtor Locked Drives" "{1D2680C9-0E2A-469d-B787-065558BC7D43}"="Fusion Cache" "{D9872D13-7651-4471-9EEE-F0A00218BEBB}"="Multiscan" "{1CDB2949-8F65-4355-8456-263E7C208A5D}"="Desktop Explorer" "{1E9B04FB-F9E5-4718-997B-B8DA88302A47}"="Desktop Explorer Menu" "{A70C977A-BF00-412C-90B7-034C51DA2439}"="NvCpl DesktopContext Class" "{1E9B04FB-F9E5-4718-997B-B8DA88302A48}"="nView Desktop Context Menu" "{FFB699E0-306A-11d3-8BD1-00104B6F7516}"="Play on my TV helper" "{5a61f7a0-cde1-11cf-9113-00aa00425c62}"="IIS Shell Extension" "{692F0339-CBAA-47e6-B5B5-3B84DB604E87}"="Extensions Manager Folder" "{AB77609F-2178-4E6F-9C4B-44AC179D937A}"="aý Context Menu Shell Extension" "{73F00216-5C4C-401A-AA93-581830996BBA}"="" ********************************************************************************** HKEY ROOT CLASSIDS: Windows Registry Editor Version 5.00 [HKEY_CLASSES_ROOT\CLSID\{73F00216-5C4C-401A-AA93-581830996BBA}] @="" [HKEY_CLASSES_ROOT\CLSID\{73F00216-5C4C-401A-AA93-581830996BBA}\Implemented Categories] @="" [HKEY_CLASSES_ROOT\CLSID\{73F00216-5C4C-401A-AA93-581830996BBA}\Implemented Categories\{00021492-0000-0000-C000-000000000046}] @="" [HKEY_CLASSES_ROOT\CLSID\{73F00216-5C4C-401A-AA93-581830996BBA}\InprocServer32] @="C:\WINDOWS\system32\mwr.dll" "ThreadingModel"="Apartment" ********************************************************************************** Files Found are not all bad files: C:\WINDOWS\SYSTEM32\ afobepdf.dll Sat 29 Oct 2005 11:31:24 ..S.R 237 265 231,70 K browseui.dll Sat 3 Sep 2005 2:06:12 A.... 1 020 416 996,50 K cdfview.dll Sat 3 Sep 2005 2:06:12 A.... 152 064 148,50 K cdosys.dll Sat 10 Sep 2005 3:55:14 A.... 2 067 968 1,97 M danim.dll Sat 3 Sep 2005 2:06:12 A.... 1 056 256 1,00 M dilmsc32.dll Sat 29 Oct 2005 6:59:46 ..S.R 235 546 230,02 K divx.dll Wed 10 Aug 2005 0:14:00 A.... 692 736 676,50 K divx_x~1.dll Wed 10 Aug 2005 0:13:52 A.... 688 128 672,00 K divx_x~2.dll Wed 10 Aug 2005 0:13:54 A.... 688 128 672,00 K divx_x~3.dll Wed 10 Aug 2005 0:13:52 A.... 671 744 656,00 K dpl100.dll Wed 10 Aug 2005 0:12:30 A.... 86 016 84,00 K dpu11.dll Wed 10 Aug 2005 0:12:28 A.... 245 760 240,00 K dpugui11.dll Wed 10 Aug 2005 0:12:30 A.... 581 632 568,00 K dpus11.dll Wed 10 Aug 2005 0:12:28 A.... 303 104 296,00 K dpv11.dll Wed 10 Aug 2005 0:12:28 A.... 57 344 56,00 K dtu100.dll Wed 10 Aug 2005 0:12:30 A.... 200 704 196,00 K dwskmon.dll Sat 29 Oct 2005 7:43:24 ..S.R 237 265 231,70 K dxtrans.dll Sat 3 Sep 2005 2:06:12 A.... 205 312 200,50 K dzcore.dll Mon 12 Sep 2005 15:27:22 A.... 4 182 067 3,99 M dzwrap~1.dll Mon 12 Sep 2005 15:29:54 A.... 102 466 100,06 K etfpix~1.dll Sat 29 Oct 2005 6:16:20 ..S.R 236 664 231,12 K extmgr.dll Sat 3 Sep 2005 2:06:12 ..... 55 808 54,50 K fasdrv.dll Sat 29 Oct 2005 12:08:42 ..S.R 237 265 231,70 K gwfspi~1.dll Mon 29 Aug 2005 13:27:06 A.... 23 304 22,76 K iepeers.dll Sat 3 Sep 2005 2:06:12 A.... 251 392 245,50 K imsins~2.dll Fri 16 Sep 2005 12:56:14 A.... 30 384 29,67 K inseng.dll Sat 3 Sep 2005 2:06:12 A.... 96 768 94,50 K jlit500.dll Sat 29 Oct 2005 7:36:58 ..S.R 236 664 231,12 K jvit500.dll Sat 29 Oct 2005 5:59:46 ..S.R 236 664 231,12 K ksdfr.dll Sat 29 Oct 2005 5:51:10 ..S.R 235 546 230,02 K l08mla~1.dll Sat 29 Oct 2005 10:17:02 ..S.R 236 664 231,12 K legitc~1.dll Mon 29 Aug 2005 13:27:12 A.... 520 968 508,76 K libeay32.dll Wed 10 Aug 2005 0:13:32 A.... 831 488 812,00 K linkinfo.dll Thu 1 Sep 2005 3:43:38 A.... 19 968 19,50 K mcrd2x40.dll Sat 29 Oct 2005 10:52:04 ..S.R 237 265 231,70 K meminst.dll Sat 29 Oct 2005 6:09:38 ..S.R 235 546 230,02 K mshtml.dll Tue 4 Oct 2005 17:26:06 A.... 3 013 120 2,87 M mshtmled.dll Sat 3 Sep 2005 2:06:12 A.... 448 512 438,00 K msrating.dll Sat 3 Sep 2005 2:06:12 A.... 146 432 143,00 K mstime.dll Sat 3 Sep 2005 2:06:12 A.... 530 432 518,00 K msvbvm60.dll Tue 6 Sep 2005 14:14:10 A.... 1 386 496 1,32 M mv22l9~1.dll Sat 29 Oct 2005 11:00:20 ..S.R 233 862 228,38 K mwr.dll Sat 29 Oct 2005 11:00:20 ..S.R 237 265 231,70 K ndwrshu.dll Sat 29 Oct 2005 5:09:10 ..S.R 235 546 230,02 K netman.dll Mon 22 Aug 2005 20:35:10 A.... 197 632 193,00 K nfwdmcpl.dll Sat 29 Oct 2005 7:21:52 ..S.R 236 664 231,12 K nv4_disp.dll Tue 2 Aug 2005 16:35:00 A.... 3 908 864 3,73 M nvcod.dll Tue 2 Aug 2005 16:35:00 A.... 32 768 32,00 K nvcodins.dll Tue 2 Aug 2005 16:35:00 A.... 32 768 32,00 K nvcpl.dll Tue 2 Aug 2005 16:35:00 A.... 7 110 656 6,78 M nvhwvid.dll Tue 2 Aug 2005 16:35:00 A.... 540 672 528,00 K nview.dll Tue 2 Aug 2005 16:35:00 A.... 1 466 368 1,40 M nvmctray.dll Tue 2 Aug 2005 16:35:00 A.... 86 016 84,00 K nvnt4cpl.dll Tue 2 Aug 2005 16:35:00 A.... 286 720 280,00 K nvoglnt.dll Tue 2 Aug 2005 16:35:00 A.... 5 140 480 4,90 M nvrsar.dll Tue 2 Aug 2005 16:35:00 A.... 315 392 308,00 K nvrscs.dll Tue 2 Aug 2005 16:35:00 A.... 233 472 228,00 K nvrsda.dll Tue 2 Aug 2005 16:35:00 A.... 241 664 236,00 K nvrsde.dll Tue 2 Aug 2005 16:35:00 A.... 266 240 260,00 K nvrsel.dll Tue 2 Aug 2005 16:35:00 A.... 270 336 264,00 K nvrseng.dll Tue 2 Aug 2005 16:35:00 A.... 237 568 232,00 K nvrses.dll Tue 2 Aug 2005 16:35:00 A.... 270 336 264,00 K nvrsesm.dll Tue 2 Aug 2005 16:35:00 A.... 262 144 256,00 K nvrsfi.dll Tue 2 Aug 2005 16:35:00 A.... 237 568 232,00 K nvrsfr.dll Tue 2 Aug 2005 16:35:00 A.... 270 336 264,00 K nvrshe.dll Tue 2 Aug 2005 16:35:00 A.... 311 296 304,00 K nvrshu.dll Tue 2 Aug 2005 16:35:00 A.... 245 760 240,00 K nvrsit.dll Tue 2 Aug 2005 16:35:00 A.... 270 336 264,00 K nvrsja.dll Tue 2 Aug 2005 16:35:00 A.... 253 952 248,00 K nvrsko.dll Tue 2 Aug 2005 16:35:00 A.... 249 856 244,00 K nvrsnl.dll Tue 2 Aug 2005 16:35:00 A.... 262 144 256,00 K nvrsno.dll Tue 2 Aug 2005 16:35:00 A.... 241 664 236,00 K nvrspl.dll Tue 2 Aug 2005 16:35:00 A.... 241 664 236,00 K nvrspt.dll Tue 2 Aug 2005 16:35:00 A.... 262 144 256,00 K nvrsptb.dll Tue 2 Aug 2005 16:35:00 A.... 253 952 248,00 K nvrsru.dll Tue 2 Aug 2005 16:35:00 A.... 258 048 252,00 K nvrssk.dll Tue 2 Aug 2005 16:35:00 A.... 245 760 240,00 K nvrssl.dll Tue 2 Aug 2005 16:35:00 A.... 241 664 236,00 K nvrssv.dll Tue 2 Aug 2005 16:35:00 A.... 241 664 236,00 K nvrstr.dll Tue 2 Aug 2005 16:35:00 A.... 245 760 240,00 K nvrszhc.dll Tue 2 Aug 2005 16:35:00 A.... 212 992 208,00 K nvrszht.dll Tue 2 Aug 2005 16:35:00 A.... 114 688 112,00 K nvshell.dll Tue 2 Aug 2005 16:35:00 A.... 466 944 456,00 K nvwddi.dll Tue 2 Aug 2005 16:35:00 A.... 81 920 80,00 K nvwdmcpl.dll Tue 2 Aug 2005 16:35:00 A.... 1 662 976 1,59 M nvwimg.dll Tue 2 Aug 2005 16:35:00 A.... 1 019 904 996,00 K nvwrsar.dll Tue 2 Aug 2005 16:35:00 A.... 282 624 276,00 K nvwrscs.dll Tue 2 Aug 2005 16:35:00 A.... 286 720 280,00 K nvwrsda.dll Tue 2 Aug 2005 16:35:00 A.... 294 912 288,00 K nvwrsde.dll Tue 2 Aug 2005 16:35:00 A.... 311 296 304,00 K nvwrsel.dll Tue 2 Aug 2005 16:35:00 A.... 335 872 328,00 K nvwrseng.dll Tue 2 Aug 2005 16:35:00 A.... 286 720 280,00 K nvwrses.dll Tue 2 Aug 2005 16:35:00 A.... 335 872 328,00 K nvwrsesm.dll Tue 2 Aug 2005 16:35:00 A.... 327 680 320,00 K nvwrsfi.dll Tue 2 Aug 2005 16:35:00 A.... 303 104 296,00 K nvwrsfr.dll Tue 2 Aug 2005 16:35:00 A.... 327 680 320,00 K nvwrshe.dll Tue 2 Aug 2005 16:35:00 A.... 278 528 272,00 K nvwrshu.dll Tue 2 Aug 2005 16:35:00 A.... 315 392 308,00 K nvwrsit.dll Tue 2 Aug 2005 16:35:00 A.... 323 584 316,00 K nvwrsja.dll Tue 2 Aug 2005 16:35:00 A.... 212 992 208,00 K nvwrsko.dll Tue 2 Aug 2005 16:35:00 A.... 196 608 192,00 K nvwrsnl.dll Tue 2 Aug 2005 16:35:00 A.... 319 488 312,00 K nvwrsno.dll Tue 2 Aug 2005 16:35:00 A.... 299 008 292,00 K nvwrspl.dll Tue 2 Aug 2005 16:35:00 A.... 294 912 288,00 K nvwrspt.dll Tue 2 Aug 2005 16:35:00 A.... 323 584 316,00 K nvwrsptb.dll Tue 2 Aug 2005 16:35:00 A.... 319 488 312,00 K nvwrsru.dll Tue 2 Aug 2005 16:35:00 A.... 315 392 308,00 K nvwrssk.dll Tue 2 Aug 2005 16:35:00 A.... 299 008 292,00 K nvwrssl.dll Tue 2 Aug 2005 16:35:00 A.... 303 104 296,00 K nvwrssv.dll Tue 2 Aug 2005 16:35:00 A.... 294 912 288,00 K nvwrstr.dll Tue 2 Aug 2005 16:35:00 A.... 303 104 296,00 K nvwrszhc.dll Tue 2 Aug 2005 16:35:00 A.... 163 840 160,00 K nvwrszht.dll Tue 2 Aug 2005 16:35:00 A.... 167 936 164,00 K nwwks.dll Thu 11 Aug 2005 17:11:40 A.... 65 024 63,50 K nytfxp~1.dll Sat 29 Oct 2005 7:30:22 ..S.R 237 265 231,70 K pfdrv.dll Sat 29 Oct 2005 6:30:00 ..S.R 236 664 231,12 K pkudsrv.dll Sat 29 Oct 2005 5:18:22 ..S.R 236 664 231,12 K pngfilt.dll Sat 3 Sep 2005 2:06:12 A.... 39 424 38,50 K pwrupcid.dll Tue 6 Sep 2005 14:14:10 A.... 163 840 160,00 K qt-dx331.dll Wed 10 Aug 2005 0:12:30 A.... 3 596 288 3,43 M quartz.dll Tue 30 Aug 2005 5:55:44 A.... 1 293 312 1,23 M shdocvw.dll Sat 3 Sep 2005 2:06:12 A.... 1 484 288 1,41 M shell32.dll Fri 23 Sep 2005 5:07:00 A.... 8 506 880 8,11 M shlwapi.dll Sat 3 Sep 2005 2:06:12 A.... 474 112 463,00 K soesrv.dll Sat 29 Oct 2005 6:21:28 ..S.R 235 546 230,02 K ssleay32.dll Wed 10 Aug 2005 0:13:32 A.... 159 744 156,00 K umpnpmgr.dll Tue 23 Aug 2005 5:39:36 A.... 124 928 122,00 K unicows.dll Wed 10 Aug 2005 0:13:32 A.... 245 408 239,66 K urlmon.dll Sat 3 Sep 2005 2:06:12 A.... 605 696 591,50 K uupnpmgr.dll Sat 29 Oct 2005 6:49:06 ..S.R 236 664 231,12 K wbpasf.dll Sat 29 Oct 2005 7:06:56 ..S.R 236 664 231,12 K wininet.dll Sat 3 Sep 2005 2:06:12 A.... 662 528 647,00 K winsrv.dll Thu 1 Sep 2005 3:43:38 A.... 292 352 285,50 K wlpcore.dll Sat 29 Oct 2005 7:15:48 ..S.R 234 072 228,59 K wpatools.dll Wed 26 Oct 2005 23:56:18 A.... 45 056 44,00 K wzvadve.dll Sat 29 Oct 2005 6:41:02 ..S.R 235 546 230,02 K xipopup.dll Tue 6 Sep 2005 14:14:10 A.... 98 304 96,00 K xipush.dll Tue 6 Sep 2005 14:14:10 A.... 90 112 88,00 K xirepctl.dll Tue 6 Sep 2005 14:14:10 A.... 270 336 264,00 K xislide.dll Tue 6 Sep 2005 14:14:10 A.... 94 208 92,00 K xisuictl.dll Tue 6 Sep 2005 14:14:10 A.... 397 312 388,00 K xitabs.dll Tue 6 Sep 2005 14:14:10 A.... 442 368 432,00 K xithreed.dll Tue 6 Sep 2005 14:14:10 A.... 339 968 332,00 K xitray.dll Tue 6 Sep 2005 14:14:10 A.... 45 056 44,00 K xitree.dll Tue 6 Sep 2005 14:14:10 A.... 282 624 276,00 K 145 items found: 145 files (23 H/S), 0 directories. Total of file sizes: 82 227 309 bytes 78,42 M Locate .tmp files: C:\WINDOWS\SYSTEM32\ guard.tmp Sat 29 Oct 2005 11:29:20 ..S.R 237 265 231,70 K 1 item found: 1 file (1 H/S), 0 directories. Total of file sizes: 237 265 bytes 231,70 K ********************************************************************************** Directory Listing of system files: Le volume dans le lecteur C s'appelle SYSTEME Le num‚ro de s‚rie du volume est FCF9-D086 R‚pertoire de C:\WINDOWS\System32 29/10/2005 12:08 237ÿ265 fasdrv.dll 29/10/2005 11:31 237ÿ265 AfobePDF.dll 29/10/2005 11:29 237ÿ265 guard.tmp 29/10/2005 11:00 237ÿ265 mwr.dll 29/10/2005 11:00 233ÿ862 mv22l9fo1.dll 29/10/2005 10:52 237ÿ265 mcrd2x40.dll 29/10/2005 10:17 236ÿ664 l08mlal11dq.dll 29/10/2005 07:43 237ÿ265 dwskmon.dll 29/10/2005 07:36 236ÿ664 JLIT500.DLL 29/10/2005 07:30 237ÿ265 nytfxperf.dll 29/10/2005 07:21 236ÿ664 nfwdmcpl.dll 29/10/2005 07:15 234ÿ072 wlpcore.dll 29/10/2005 07:06 236ÿ664 wbpasf.dll 29/10/2005 06:59 235ÿ546 DILMSC32.dll 29/10/2005 06:49 236ÿ664 uupnpmgr.dll 29/10/2005 06:41 235ÿ546 WZVADVE.DLL 29/10/2005 06:29 236ÿ664 pfdrv.dll 29/10/2005 06:21 235ÿ546 soesrv.dll 29/10/2005 06:16 236ÿ664 etfpixio130.dll 29/10/2005 06:09 235ÿ546 meminst.dll 29/10/2005 05:59 236ÿ664 JVIT500.DLL 29/10/2005 05:51 235ÿ546 ksdfr.dll 29/10/2005 05:18 236ÿ664 pkudsrv.dll 29/10/2005 05:09 235ÿ546 ndwrshu.dll 19/10/2005 22:34 dllcache 03/10/2004 20:35 56 ABAEFF85CD.sys 24/08/2004 18:41 56 F08598D612.sys 05/08/2004 21:22 Microsoft 26 fichier(s) 5ÿ672ÿ153 octets 2 R‚p(s) 7ÿ391ÿ838ÿ208 octets libres Là je commence à paniquer ..... Jemit

balltrap34 · Answer

desactive adwatch en mode normalpasse l option 2 en mode normal et remet le rapport

balltrap34 · Answer

refait le stp

jemit · Answer

ok voila L2MFIX find log 1.04a These are the registry keys present ********************************************************************************** Winlogon/notify: Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain] "Asynchronous"=dword:00000000 "Impersonate"=dword:00000000 "DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,33,00,32,00,2e,00,64,00,6c,00,\ 6c,00,00,00 "Logoff"="ChainWlxLogoffEvent" [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet] "Asynchronous"=dword:00000000 "Impersonate"=dword:00000000 "DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,6e,00,65,00,74,00,2e,00,64,00,\ 6c,00,6c,00,00,00 "Logoff"="CryptnetWlxLogoffEvent" [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll] "DLLName"="cscdll.dll" "Logon"="WinlogonLogonEvent" "Logoff"="WinlogonLogoffEvent" "ScreenSaver"="WinlogonScreenSaverEvent" "Startup"="WinlogonStartupEvent" "Shutdown"="WinlogonShutdownEvent" "StartShell"="WinlogonStartShellEvent" "Impersonate"=dword:00000000 "Asynchronous"=dword:00000001 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp] "DLLName"="wlnotify.dll" "Logon"="SCardStartCertProp" "Logoff"="SCardStopCertProp" "Lock"="SCardSuspendCertProp" "Unlock"="SCardResumeCertProp" "Enabled"=dword:00000001 "Impersonate"=dword:00000001 "Asynchronous"=dword:00000001 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule] "Asynchronous"=dword:00000000 "DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\ 6c,00,6c,00,00,00 "Impersonate"=dword:00000000 "StartShell"="SchedStartShell" "Logoff"="SchedEventLogOff" [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy] "Logoff"="WLEventLogoff" "Impersonate"=dword:00000000 "Asynchronous"=dword:00000001 "DllName"=hex(2):73,00,63,00,6c,00,67,00,6e,00,74,00,66,00,79,00,2e,00,64,00,\ 6c,00,6c,00,00,00 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn] "DLLName"="WlNotify.dll" "Lock"="SensLockEvent" "Logon"="SensLogonEvent" "Logoff"="SensLogoffEvent" "Safe"=dword:00000001 "MaxWait"=dword:00000258 "StartScreenSaver"="SensStartScreenSaverEvent" "StopScreenSaver"="SensStopScreenSaverEvent" "Startup"="SensStartupEvent" "Shutdown"="SensShutdownEvent" "StartShell"="SensStartShellEvent" "PostShell"="SensPostShellEvent" "Disconnect"="SensDisconnectEvent" "Reconnect"="SensReconnectEvent" "Unlock"="SensUnlockEvent" "Impersonate"=dword:00000001 "Asynchronous"=dword:00000001 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify ermsrv] "Asynchronous"=dword:00000000 "DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\ 6c,00,6c,00,00,00 "Impersonate"=dword:00000000 "Logoff"="TSEventLogoff" "Logon"="TSEventLogon" "PostShell"="TSEventPostShell" "Shutdown"="TSEventShutdown" "StartShell"="TSEventStartShell" "Startup"="TSEventStartup" "MaxWait"=dword:00000258 "Reconnect"="TSEventReconnect" "Disconnect"="TSEventDisconnect" [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon] "DLLName"="wlnotify.dll" "Logon"="RegisterTicketExpiredNotificationEvent" "Logoff"="UnregisterTicketExpiredNotificationEvent" "Impersonate"=dword:00000001 "Asynchronous"=dword:00000001 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wzcnotif] "DLLName"="wzcdlg.dll" "Logon"="WZCEventLogon" "Logoff"="WZCEventLogoff" "Impersonate"=dword:00000000 "Asynchronous"=dword:00000000 RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above Copyright (c) 1999-2001 Frank Heyne Software (http://www.heysoft.de) This program is Freeware, use it on your own risk! Access Control List for Registry key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify: (CI) DENY --C------- BUILTIN\Administrateurs (NI) ALLOW Full access AUTORITE NT\SYSTEM (IO) ALLOW Full access AUTORITE NT\SYSTEM (ID-NI) ALLOW Read BUILTIN\Utilisateurs (ID-IO) ALLOW Read BUILTIN\Utilisateurs (ID-NI) ALLOW Read BUILTIN\Utilisateurs avec pouvoir (ID-IO) ALLOW Read BUILTIN\Utilisateurs avec pouvoir (ID-NI) ALLOW Full access BUILTIN\Administrateurs (ID-IO) ALLOW Full access BUILTIN\Administrateurs (ID-NI) ALLOW Full access AUTORITE NT\SYSTEM (ID-IO) ALLOW Full access AUTORITE NT\SYSTEM (ID-IO) ALLOW Full access CREATEUR PROPRIETAIRE ********************************************************************************** useragent: Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform] "{DF3E2E7D-A2F2-6EF3-0720-224ACAA63EDA}"="" ********************************************************************************** Shell Extension key: Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved] "{00022613-0000-0000-C000-000000000046}"="Feuille de propri‚t‚s du fichier multim‚dia" "{176d6597-26d3-11d1-b350-080036a75b03}"="Gestion de scanneur ICM" "{1F2E5C40-9550-11CE-99D2-00AA006E086C}"="Page de s‚curit‚ NTFS" "{3EA48300-8CF6-101B-84FB-666CCB9BCD32}"="Page des propri‚t‚s de OLE DocFile" "{40dd6e20-7c17-11ce-a804-00aa003ca9f6}"="Extensions de l'environnement pour le partage" "{41E300E0-78B6-11ce-849B-444553540000}"="PlusPack CPL Extension" "{42071712-76d4-11d1-8b24-00a0c9068ff3}"="Extension Affichage Carte du Panneau de configuration" "{42071713-76d4-11d1-8b24-00a0c9068ff3}"="Extension Affichage cran du Panneau de configuration" "{42071714-76d4-11d1-8b24-00a0c9068ff3}"="Extension Affichage Panorama du Panneau de configuration" "{4E40F770-369C-11d0-8922-00A024AB2DBB}"="Page de s‚curit‚ DS" "{513D916F-2A8E-4F51-AEAB-0CBC76FB1AF8}"="Page de compatibilit‚" "{56117100-C0CD-101B-81E2-00AA004AE837}"="Gestionnaire de donn‚es endommag‚es de l'environnement" "{59099400-57FF-11CE-BD94-0020AF85B590}"="Extension copie de disquette" "{59be4990-f85c-11ce-aff7-00aa003ca9f6}"="Extensions de l'environnement pour les objets r‚seau de Microsoft Windows" "{5DB2625A-54DF-11D0-B6C4-0800091AA605}"="Gestion d'‚cran ICM" "{675F097E-4C4D-11D0-B6C1-0800091AA605}"="Gestion d'imprimante ICM" "{764BF0E1-F219-11ce-972D-00AA00A14F56}"="Extensions de l'environnement de compression de fichiers" "{77597368-7b15-11d0-a0c2-080036af3f03}"="Extension de l'environnement d'imprimante Web" "{7988B573-EC89-11cf-9C00-00AA00A14F56}"="Disk Quota UI" "{853FE2B1-B769-11d0-9C4E-00C04FB6C6FA}"="Menu contextuel de cryptage" "{85BBD920-42A0-1069-A2E4-08002B30309D}"="Porte-documents" "{88895560-9AA2-1069-930E-00AA0030EBC8}"="Extension ic“ne HyperTerminal" "{BD84B380-8CA2-1069-AB1D-08000948F534}"="Fonts" "{DBCE2480-C732-101B-BE72-BA78E9AD5B27}"="Profil ICC" "{F37C5810-4D3F-11d0-B4BF-00AA00BBB723}"="Page de s‚curit‚ des imprimantes" "{f81e9010-6ea4-11ce-a7ff-00aa003ca9f6}"="Extensions de l'environnement pour le partage" "{f92e8c40-3d33-11d2-b1aa-080036a75b03}"="Display TroubleShoot CPL Extension" "{7444C717-39BF-11D1-8CD9-00C04FC29D45}"="Extension de cryptographie PKO" "{7444C719-39BF-11D1-8CD9-00C04FC29D45}"="Extension de cryptographie Sign" "{7007ACC7-3202-11D1-AAD2-00805FC1270E}"="Connexions r‚seau" "{992CFFA0-F557-101A-88EC-00DD010CCC48}"="Connexions r‚seau" "{E211B736-43FD-11D1-9EFB-0000F8757FCD}"="&Scanneurs et appareils photo" "{FB0C9C8A-6C50-11D1-9F1D-0000F8757FCD}"="&Scanneurs et appareils photo" "{905667aa-acd6-11d2-8080-00805f6596d2}"="&Scanneurs et appareils photo" "{3F953603-1008-4f6e-A73A-04AAC7A992F1}"="&Scanneurs et appareils photo" "{83bbcbf3-b28a-4919-a5aa-73027445d672}"="&Scanneurs et appareils photo" "{F0152790-D56E-4445-850E-4F3117DB740C}"="Remote Sessions CPL Extension" "{5F327514-6C5E-4d60-8F16-D07FA08A78ED}"="Auto Update Property Sheet Extension" "{60254CA5-953B-11CF-8C96-00AA00B8708C}"="Extension de l'interpr‚teur de commande pour Windows Script Host" "{2206CDB2-19C1-11D1-89E0-00C04FD7A829}"="Liaison de donn‚es Microsoft" "{DD2110F0-9EEF-11cf-8D8E-00AA0060F5BF}"="Tasks Folder Icon Handler" "{797F1E90-9EDD-11cf-8D8E-00AA0060F5BF}"="Tasks Folder Shell Extension" "{D6277990-4C6A-11CF-8D87-00AA0060F5BF}"="Tƒches planifi‚es" "{0DF44EAA-FF21-4412-828E-260A8728E7F1}"="Barre des tƒches et menu D‚marrer" "{2559a1f0-21d7-11d4-bdaf-00c04f60b9f0}"="Rechercher" "{2559a1f1-21d7-11d4-bdaf-00c04f60b9f0}"="Aide et support" "{2559a1f2-21d7-11d4-bdaf-00c04f60b9f0}"="Aide et support" "{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}"="Ex‚cuter..." "{2559a1f4-21d7-11d4-bdaf-00c04f60b9f0}"="Internet" "{2559a1f5-21d7-11d4-bdaf-00c04f60b9f0}"="Courrier ‚lectronique" "{D20EA4E1-3957-11d2-A40B-0C5020524152}"="Polices" "{D20EA4E1-3957-11d2-A40B-0C5020524153}"="Outils d'administration" "{875CB1A1-0F29-45de-A1AE-CFB4950D0B78}"="Audio Media Properties Handler" "{40C3D757-D6E4-4b49-BB41-0E5BBEA28817}"="Video Media Properties Handler" "{E4B29F9D-D390-480b-92FD-7DDB47101D71}"="Wav Properties Handler" "{87D62D94-71B3-4b9a-9489-5FE6850DC73E}"="Avi Properties Handler" "{A6FD9E45-6E44-43f9-8644-08598F5A74D9}"="Midi Properties Handler" "{c5a40261-cd64-4ccf-84cb-c394da41d590}"="Video Thumbnail Extractor" "{5E6AB780-7743-11CF-A12B-00AA004AE837}"="Barre d'outils Internet Microsoft" "{22BF0C20-6DA7-11D0-B373-00A0C9034938}"="tat du t‚l‚chargement" "{91EA3F8B-C99B-11d0-9815-00C04FD91972}"="Dossier Bureau ‚tendu" "{6413BA2C-B461-11d1-A18A-080036B11A03}"="Dossier du shell augment‚" "{F61FFEC1-754F-11d0-80CA-00AA005B4383}"="BandProxy" "{7BA4C742-9E81-11CF-99D3-00AA004AE837}"="Bande du navigateur Microsoft" "{30D02401-6A81-11d0-8274-00C04FD5AE38}"="Bande de recherche" "{32683183-48a0-441b-a342-7c2a440a9478}"="Media Band" "{169A0691-8DF9-11d1-A1C4-00C04FD75D13}"="Volet int‚gr‚ de recherche" "{07798131-AF23-11d1-9111-00A0C98BA67D}"="Recherche Web" "{AF4F6510-F982-11d0-8595-00AA004CD6D8}"="Utilitaire des options de l'arborescence du Registre" "{01E04581-4EEE-11d0-BFE9-00AA005B4383}"="&Adresse" "{A08C11D2-A228-11d0-825B-00AA005B4383}"="BoŒte d'entr‚e de l'adresse" "{00BB2763-6A77-11D0-A535-00C04FD7D062}"="Saisie semi-automatique Microsoft" "{7376D660-C583-11d0-A3A5-00C04FD706EC}"="TridentImageExtractor" "{6756A641-DE71-11d0-831B-00AA005B4383}"="Liste de saisie semi-automatique MRU" "{6935DB93-21E8-4ccc-BEB9-9FE3C77A297A}"="Liste de saisie semi-automatique personnalis‚e MRU" "{7e653215-fa25-46bd-a339-34a2790f3cb7}"="Accessible" "{acf35015-526e-4230-9596-becbe19f0ac9}"="Barre de progrŠs auto-ouvrante" "{E0E11A09-5CB8-4B6C-8332-E00720A168F2}"="Analyseur de la barre d'adresses" "{00BB2764-6A77-11D0-A535-00C04FD7D062}"="Liste de saisie semi-automatique de l'historique Microsoft" "{03C036F1-A186-11D0-824A-00AA005B4383}"="Liste de saisie semi-automatique du dossier Shell Microsoft" "{00BB2765-6A77-11D0-A535-00C04FD7D062}"="Conteneur de la liste de saisie semi-automatique multiple Microsoft" "{ECD4FC4E-521C-11D0-B792-00A0C90312E1}"="Menu Site de bandes" "{3CCF8A41-5C85-11d0-9796-00AA00B90ADF}"="Shell DeskBarApp" "{ECD4FC4C-521C-11D0-B792-00A0C90312E1}"="Barre du Bureau" "{ECD4FC4D-521C-11D0-B792-00A0C90312E1}"="Shell Rebar BandSite" "{DD313E04-FEFF-11d1-8ECD-0000F87A470C}"="Assistance utilisateur" "{EF8AD2D1-AE36-11D1-B2D2-006097DF8C11}"="ParamŠtres du dossier global" "{EFA24E61-B078-11d0-89E4-00C04FC9E26E}"="Favorites Band" "{0A89A860-D7B1-11CE-8350-444553540000}"="Shell Automation Inproc Service" "{E7E4BC40-E76A-11CE-A9BB-00AA004AE837}"="Shell DocObject Viewer" "{A5E46E3A-8849-11D1-9D8C-00C04FC99D61}"="Microsoft Browser Architecture" "{FBF23B40-E3F0-101B-8488-00AA003E56F8}"="InternetShortcut" "{3C374A40-BAE4-11CF-BF7D-00AA006946EE}"="Microsoft Url History Service" "{FF393560-C2A7-11CF-BFF4-444553540000}"="Historique" "{7BD29E00-76C1-11CF-9DD0-00A0C9034933}"="Temporary Internet Files" "{7BD29E01-76C1-11CF-9DD0-00A0C9034933}"="Temporary Internet Files" "{CFBFAE00-17A6-11D0-99CB-00C04FD64497}"="Microsoft Url Search Hook" "{A2B0DD40-CC59-11d0-A3A5-00C04FD706EC}"="Image de d‚marrage de la Suite IE4" "{67EA19A0-CCEF-11d0-8024-00C04FD75D13}"="CDF Extension Copy Hook" "{131A6951-7F78-11D0-A979-00C04FD705A2}"="ISFBand OC" "{9461b922-3c5a-11d2-bf8b-00c04fb93661}"="Search Assistant OC" "{3DC7A020-0ACD-11CF-A9BB-00AA004AE837}"="Internet" "{871C5380-42A0-1069-A2EA-08002B30309D}"="Internet Name Space" "{EFA24E64-B078-11d0-89E4-00C04FC9E26E}"="Explorer Band" "{9E56BE60-C50F-11CF-9A2C-00A0C90A90CE}"="Sendmail service" "{9E56BE61-C50F-11CF-9A2C-00A0C90A90CE}"="Sendmail service" "{88C6C381-2E85-11D0-94DE-444553540000}"="Dossier ActiveX Cache" "{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"="WebCheck" "{ABBE31D0-6DAE-11D0-BECA-00C04FD940BE}"="Subscription Mgr" "{F5175861-2688-11d0-9C5E-00AA00A45957}"="Dossier Inscription" "{08165EA0-E946-11CF-9C87-00AA005127ED}"="WebCheckWebCrawler" "{E3A8BDE6-ABCE-11d0-BC4B-00C04FD929DB}"="WebCheckChannelAgent" "{E8BB6DC0-6B4E-11d0-92DB-00A0C90C2BD7}"="TrayAgent" "{7D559C10-9FE9-11d0-93F7-00AA0059CE02}"="Code Download Agent" "{E6CC6978-6B6E-11D0-BECA-00C04FD940BE}"="ConnectionAgent" "{D8BD2030-6FC9-11D0-864F-00AA006809D9}"="PostAgent" "{7FC0B86E-5FA7-11d1-BC7C-00C04FD929DB}"="WebCheck SyncMgr Handler" "{352EC2B7-8B9A-11D1-B8AE-006008059382}"="Gestionnaire d'applications d'environnement" "{0B124F8F-91F0-11D1-B8B5-006008059382}"="num‚rateur d'applications install‚es" "{CFCCC7A0-A282-11D1-9082-006008059382}"="Publication d'application Darwin" "{e84fda7c-1d6a-45f6-b725-cb260c236066}"="Shell Image Verbs" "{66e4e4fb-f385-4dd0-8d74-a2efd1bc6178}"="Shell Image Data Factory" "{3F30C968-480A-4C6C-862D-EFC0897BB84B}"="Extracteur de miniatures de fichier + GDI" "{9DBD2C50-62AD-11d0-B806-00C04FD706EC}"="Gestionnaire de miniatures - Informations de r‚sum‚ (DOCFILES)" "{EAB841A0-9550-11cf-8C16-00805F1408F3}"="Extracteur de miniatures HTML" "{eb9b1153-3b57-4e68-959a-a3266bc3d7fe}"="Shell Image Property Handler" "{CC6EEFFB-43F6-46c5-9619-51D571967F7D}"="Assistant Publication de sites Web" "{add36aa8-751a-4579-a266-d66f5202ccbb}"="Commande d'impressions via le Web" "{6b33163c-76a5-4b6c-bf21-45de9cd503a1}"="Objet Assistant de publication Shell" "{58f1f272-9240-4f51-b6d4-fd63d1618591}"="Assistant Obtenir une identit‚ Passport" "{7A9D77BD-5403-11d2-8785-2E0420524153}"="Comptes d'utilisateurs" "{BD472F60-27FA-11cf-B8B4-444553540000}"="Compressed (zipped) Folder Right Drag Handler" "{888DCA60-FC0A-11CF-8F0F-00C04FD7D062}"="Compressed (zipped) Folder SendTo Target" "{63da6ec0-2e98-11cf-8d82-444553540000}"="FTP Folders Webview" "{883373C3-BF89-11D1-BE35-080036B11A03}"="Microsoft DocProp Shell Ext" "{A9CF0EAE-901A-4739-A481-E35B73E47F6D}"="Microsoft DocProp Inplace Edit Box Control" "{8EE97210-FD1F-4B19-91DA-67914005F020}"="Microsoft DocProp Inplace ML Edit Box Control" "{0EEA25CC-4362-4A12-850B-86EE61B0D3EB}"="Microsoft DocProp Inplace Droplist Combo Control" "{6A205B57-2567-4A2C-B881-F787FAB579A3}"="Microsoft DocProp Inplace Calendar Control" "{28F8A4AC-BBB3-4D9B-B177-82BFC914FA33}"="Microsoft DocProp Inplace Time Control" "{8A23E65E-31C2-11d0-891C-00A024AB2DBB}"="Directory Query UI" "{9E51E0D0-6E0F-11d2-9601-00C04FA31A86}"="Shell properties for a DS object" "{163FDC20-2ABC-11d0-88F0-00A024AB2DBB}"="Directory Object Find" "{F020E586-5264-11d1-A532-0000F8757D7E}"="Directory Start/Search Find" "{0D45D530-764B-11d0-A1CA-00AA00C16E65}"="Directory Property UI" "{62AE1F9A-126A-11D0-A14B-0800361B1103}"="Directory Context Menu Verbs" "{ECF03A33-103D-11d2-854D-006008059367}"="MyDocs Copy Hook" "{ECF03A32-103D-11d2-854D-006008059367}"="MyDocs Drop Target" "{4a7ded0a-ad25-11d0-98a8-0800361b1103}"="MyDocs Properties" "{750fdf0e-2a26-11d1-a3ea-080036587f03}"="Offline Files Menu" "{10CFC467-4392-11d2-8DB4-00C04FA31A66}"="Offline Files Folder Options" "{AFDB1F70-2A4C-11d2-9039-00C04F8EEB3E}"="Dossier Fichiers hors connexion" "{143A62C8-C33B-11D1-84FE-00C04FA34A14}"="Microsoft Agent Character Property Sheet Handler" "{ECCDF543-45CC-11CE-B9BF-0080C87CDBA6}"="DfsShell" "{60fd46de-f830-4894-a628-6fa81bc0190d}"="%DESC_PublishDropTarget%" "{7A80E4A8-8005-11D2-BCF8-00C04F72C717}"="MMC Icon Handler" "{0CD7A5C0-9F37-11CE-AE65-08002B2E1262}"=".CAB file viewer" "{32714800-2E5F-11d0-8B85-00AA0044F941}"="Des &personnes..." "{8DD448E6-C188-4aed-AF92-44956194EB1F}"="Windows Media Player Play as Playlist Context Menu Handler" "{CE3FB1D1-02AE-4a5f-A6E9-D9F1B4073E6C}"="Windows Media Player Burn Audio CD Context Menu Handler" "{F1B9284F-E9DC-4e68-9D7E-42362A59F0FD}"="Windows Media Player Add to Playlist Context Menu Handler" "{f39a0dc0-9cc8-11d0-a599-00c04fd64433}"="Fichier de chaŒne" "{f3aa0dc0-9cc8-11d0-a599-00c04fd64434}"="Raccourci de chaŒne" "{f3ba0dc0-9cc8-11d0-a599-00c04fd64435}"="Channel Handler Object" "{f3da0dc0-9cc8-11d0-a599-00c04fd64437}"="Channel Menu" "{f3ea0dc0-9cc8-11d0-a599-00c04fd64438}"="Channel Properties" "{7EFFF3DD-71B3-11D4-A25E-005056DCFB89}"="DIALux 2.0 ULDShellHandler Class" "{950FF917-7A57-46BC-8017-59D9BF474000}"="Shell Extension for CDRW" "{0006F045-0000-0000-C000-000000000046}"="Microsoft Outlook Custom Icon Handler" "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"="WinRAR shell extension" "{D25B2CAB-8A9A-4517-A9B2-CB5F68A5A802}"="Adobe.Acrobat.ContextMenu" "{2559a1f7-21d7-11d4-bdaf-00c04f60b9f0}"="Set Program Access and Defaults" "{596AB062-B4D2-4215-9F74-E9109B0A8153}"="Previous Versions Property Page" "{9DB7A13C-F208-4981-8353-73CC61AE2783}"="Previous Versions" "{640167b4-59b0-47a6-b335-a6b3c0695aea}"="Portable Media Devices" "{cc86590a-b60a-48e6-996b-41d25ed39a1e}"="Portable Media Devices Menu" "{F0CB00CD-5A07-4D91-97F5-A8C92CDA93E4}"="Shell Extensions for RealOne Player" "{7059DA7A-7E60-11d2-A355-00C04FB9D26E}"="Maxtor Locked Drives" "{1D2680C9-0E2A-469d-B787-065558BC7D43}"="Fusion Cache" "{D9872D13-7651-4471-9EEE-F0A00218BEBB}"="Multiscan" "{1CDB2949-8F65-4355-8456-263E7C208A5D}"="Desktop Explorer" "{1E9B04FB-F9E5-4718-997B-B8DA88302A47}"="Desktop Explorer Menu" "{A70C977A-BF00-412C-90B7-034C51DA2439}"="NvCpl DesktopContext Class" "{1E9B04FB-F9E5-4718-997B-B8DA88302A48}"="nView Desktop Context Menu" "{FFB699E0-306A-11d3-8BD1-00104B6F7516}"="Play on my TV helper" "{5a61f7a0-cde1-11cf-9113-00aa00425c62}"="IIS Shell Extension" "{692F0339-CBAA-47e6-B5B5-3B84DB604E87}"="Extensions Manager Folder" "{AB77609F-2178-4E6F-9C4B-44AC179D937A}"="aý Context Menu Shell Extension" "{73F00216-5C4C-401A-AA93-581830996BBA}"="" ********************************************************************************** HKEY ROOT CLASSIDS: Windows Registry Editor Version 5.00 [HKEY_CLASSES_ROOT\CLSID\{73F00216-5C4C-401A-AA93-581830996BBA}] @="" [HKEY_CLASSES_ROOT\CLSID\{73F00216-5C4C-401A-AA93-581830996BBA}\Implemented Categories] @="" [HKEY_CLASSES_ROOT\CLSID\{73F00216-5C4C-401A-AA93-581830996BBA}\Implemented Categories\{00021492-0000-0000-C000-000000000046}] @="" [HKEY_CLASSES_ROOT\CLSID\{73F00216-5C4C-401A-AA93-581830996BBA}\InprocServer32] @="C:\WINDOWS\system32\mwr.dll" "ThreadingModel"="Apartment" ********************************************************************************** Files Found are not all bad files: C:\WINDOWS\SYSTEM32\ afobepdf.dll Sat 29 Oct 2005 11:31:24 ..S.R 237 265 231,70 K browseui.dll Sat 3 Sep 2005 2:06:12 A.... 1 020 416 996,50 K cdfview.dll Sat 3 Sep 2005 2:06:12 A.... 152 064 148,50 K cdosys.dll Sat 10 Sep 2005 3:55:14 A.... 2 067 968 1,97 M danim.dll Sat 3 Sep 2005 2:06:12 A.... 1 056 256 1,00 M dilmsc32.dll Sat 29 Oct 2005 6:59:46 ..S.R 235 546 230,02 K divx.dll Wed 10 Aug 2005 0:14:00 A.... 692 736 676,50 K divx_x~1.dll Wed 10 Aug 2005 0:13:52 A.... 688 128 672,00 K divx_x~2.dll Wed 10 Aug 2005 0:13:54 A.... 688 128 672,00 K divx_x~3.dll Wed 10 Aug 2005 0:13:52 A.... 671 744 656,00 K dpl100.dll Wed 10 Aug 2005 0:12:30 A.... 86 016 84,00 K dpu11.dll Wed 10 Aug 2005 0:12:28 A.... 245 760 240,00 K dpugui11.dll Wed 10 Aug 2005 0:12:30 A.... 581 632 568,00 K dpus11.dll Wed 10 Aug 2005 0:12:28 A.... 303 104 296,00 K dpv11.dll Wed 10 Aug 2005 0:12:28 A.... 57 344 56,00 K dtu100.dll Wed 10 Aug 2005 0:12:30 A.... 200 704 196,00 K dwskmon.dll Sat 29 Oct 2005 7:43:24 ..S.R 237 265 231,70 K dxtrans.dll Sat 3 Sep 2005 2:06:12 A.... 205 312 200,50 K dzcore.dll Mon 12 Sep 2005 15:27:22 A.... 4 182 067 3,99 M dzwrap~1.dll Mon 12 Sep 2005 15:29:54 A.... 102 466 100,06 K etfpix~1.dll Sat 29 Oct 2005 6:16:20 ..S.R 236 664 231,12 K extmgr.dll Sat 3 Sep 2005 2:06:12 ..... 55 808 54,50 K fasdrv.dll Sat 29 Oct 2005 12:08:42 ..S.R 237 265 231,70 K gwfspi~1.dll Mon 29 Aug 2005 13:27:06 A.... 23 304 22,76 K iepeers.dll Sat 3 Sep 2005 2:06:12 A.... 251 392 245,50 K imsins~2.dll Fri 16 Sep 2005 12:56:14 A.... 30 384 29,67 K inseng.dll Sat 3 Sep 2005 2:06:12 A.... 96 768 94,50 K jlit500.dll Sat 29 Oct 2005 7:36:58 ..S.R 236 664 231,12 K jvit500.dll Sat 29 Oct 2005 5:59:46 ..S.R 236 664 231,12 K ksdfr.dll Sat 29 Oct 2005 5:51:10 ..S.R 235 546 230,02 K l08mla~1.dll Sat 29 Oct 2005 10:17:02 ..S.R 236 664 231,12 K legitc~1.dll Mon 29 Aug 2005 13:27:12 A.... 520 968 508,76 K libeay32.dll Wed 10 Aug 2005 0:13:32 A.... 831 488 812,00 K linkinfo.dll Thu 1 Sep 2005 3:43:38 A.... 19 968 19,50 K mcrd2x40.dll Sat 29 Oct 2005 10:52:04 ..S.R 237 265 231,70 K meminst.dll Sat 29 Oct 2005 6:09:38 ..S.R 235 546 230,02 K mshtml.dll Tue 4 Oct 2005 17:26:06 A.... 3 013 120 2,87 M mshtmled.dll Sat 3 Sep 2005 2:06:12 A.... 448 512 438,00 K msrating.dll Sat 3 Sep 2005 2:06:12 A.... 146 432 143,00 K mstime.dll Sat 3 Sep 2005 2:06:12 A.... 530 432 518,00 K msvbvm60.dll Tue 6 Sep 2005 14:14:10 A.... 1 386 496 1,32 M mv22l9~1.dll Sat 29 Oct 2005 11:00:20 ..S.R 233 862 228,38 K mwr.dll Sat 29 Oct 2005 11:00:20 ..S.R 237 265 231,70 K ndwrshu.dll Sat 29 Oct 2005 5:09:10 ..S.R 235 546 230,02 K netman.dll Mon 22 Aug 2005 20:35:10 A.... 197 632 193,00 K nfwdmcpl.dll Sat 29 Oct 2005 7:21:52 ..S.R 236 664 231,12 K nv4_disp.dll Tue 2 Aug 2005 16:35:00 A.... 3 908 864 3,73 M nvcod.dll Tue 2 Aug 2005 16:35:00 A.... 32 768 32,00 K nvcodins.dll Tue 2 Aug 2005 16:35:00 A.... 32 768 32,00 K nvcpl.dll Tue 2 Aug 2005 16:35:00 A.... 7 110 656 6,78 M nvhwvid.dll Tue 2 Aug 2005 16:35:00 A.... 540 672 528,00 K nview.dll Tue 2 Aug 2005 16:35:00 A.... 1 466 368 1,40 M nvmctray.dll Tue 2 Aug 2005 16:35:00 A.... 86 016 84,00 K nvnt4cpl.dll Tue 2 Aug 2005 16:35:00 A.... 286 720 280,00 K nvoglnt.dll Tue 2 Aug 2005 16:35:00 A.... 5 140 480 4,90 M nvrsar.dll Tue 2 Aug 2005 16:35:00 A.... 315 392 308,00 K nvrscs.dll Tue 2 Aug 2005 16:35:00 A.... 233 472 228,00 K nvrsda.dll Tue 2 Aug 2005 16:35:00 A.... 241 664 236,00 K nvrsde.dll Tue 2 Aug 2005 16:35:00 A.... 266 240 260,00 K nvrsel.dll Tue 2 Aug 2005 16:35:00 A.... 270 336 264,00 K nvrseng.dll Tue 2 Aug 2005 16:35:00 A.... 237 568 232,00 K nvrses.dll Tue 2 Aug 2005 16:35:00 A.... 270 336 264,00 K nvrsesm.dll Tue 2 Aug 2005 16:35:00 A.... 262 144 256,00 K nvrsfi.dll Tue 2 Aug 2005 16:35:00 A.... 237 568 232,00 K nvrsfr.dll Tue 2 Aug 2005 16:35:00 A.... 270 336 264,00 K nvrshe.dll Tue 2 Aug 2005 16:35:00 A.... 311 296 304,00 K nvrshu.dll Tue 2 Aug 2005 16:35:00 A.... 245 760 240,00 K nvrsit.dll Tue 2 Aug 2005 16:35:00 A.... 270 336 264,00 K nvrsja.dll Tue 2 Aug 2005 16:35:00 A.... 253 952 248,00 K nvrsko.dll Tue 2 Aug 2005 16:35:00 A.... 249 856 244,00 K nvrsnl.dll Tue 2 Aug 2005 16:35:00 A.... 262 144 256,00 K nvrsno.dll Tue 2 Aug 2005 16:35:00 A.... 241 664 236,00 K nvrspl.dll Tue 2 Aug 2005 16:35:00 A.... 241 664 236,00 K nvrspt.dll Tue 2 Aug 2005 16:35:00 A.... 262 144 256,00 K nvrsptb.dll Tue 2 Aug 2005 16:35:00 A.... 253 952 248,00 K nvrsru.dll Tue 2 Aug 2005 16:35:00 A.... 258 048 252,00 K nvrssk.dll Tue 2 Aug 2005 16:35:00 A.... 245 760 240,00 K nvrssl.dll Tue 2 Aug 2005 16:35:00 A.... 241 664 236,00 K nvrssv.dll Tue 2 Aug 2005 16:35:00 A.... 241 664 236,00 K nvrstr.dll Tue 2 Aug 2005 16:35:00 A.... 245 760 240,00 K nvrszhc.dll Tue 2 Aug 2005 16:35:00 A.... 212 992 208,00 K nvrszht.dll Tue 2 Aug 2005 16:35:00 A.... 114 688 112,00 K nvshell.dll Tue 2 Aug 2005 16:35:00 A.... 466 944 456,00 K nvwddi.dll Tue 2 Aug 2005 16:35:00 A.... 81 920 80,00 K nvwdmcpl.dll Tue 2 Aug 2005 16:35:00 A.... 1 662 976 1,59 M nvwimg.dll Tue 2 Aug 2005 16:35:00 A.... 1 019 904 996,00 K nvwrsar.dll Tue 2 Aug 2005 16:35:00 A.... 282 624 276,00 K nvwrscs.dll Tue 2 Aug 2005 16:35:00 A.... 286 720 280,00 K nvwrsda.dll Tue 2 Aug 2005 16:35:00 A.... 294 912 288,00 K nvwrsde.dll Tue 2 Aug 2005 16:35:00 A.... 311 296 304,00 K nvwrsel.dll Tue 2 Aug 2005 16:35:00 A.... 335 872 328,00 K nvwrseng.dll Tue 2 Aug 2005 16:35:00 A.... 286 720 280,00 K nvwrses.dll Tue 2 Aug 2005 16:35:00 A.... 335 872 328,00 K nvwrsesm.dll Tue 2 Aug 2005 16:35:00 A.... 327 680 320,00 K nvwrsfi.dll Tue 2 Aug 2005 16:35:00 A.... 303 104 296,00 K nvwrsfr.dll Tue 2 Aug 2005 16:35:00 A.... 327 680 320,00 K nvwrshe.dll Tue 2 Aug 2005 16:35:00 A.... 278 528 272,00 K nvwrshu.dll Tue 2 Aug 2005 16:35:00 A.... 315 392 308,00 K nvwrsit.dll Tue 2 Aug 2005 16:35:00 A.... 323 584 316,00 K nvwrsja.dll Tue 2 Aug 2005 16:35:00 A.... 212 992 208,00 K nvwrsko.dll Tue 2 Aug 2005 16:35:00 A.... 196 608 192,00 K nvwrsnl.dll Tue 2 Aug 2005 16:35:00 A.... 319 488 312,00 K nvwrsno.dll Tue 2 Aug 2005 16:35:00 A.... 299 008 292,00 K nvwrspl.dll Tue 2 Aug 2005 16:35:00 A.... 294 912 288,00 K nvwrspt.dll Tue 2 Aug 2005 16:35:00 A.... 323 584 316,00 K nvwrsptb.dll Tue 2 Aug 2005 16:35:00 A.... 319 488 312,00 K nvwrsru.dll Tue 2 Aug 2005 16:35:00 A.... 315 392 308,00 K nvwrssk.dll Tue 2 Aug 2005 16:35:00 A.... 299 008 292,00 K nvwrssl.dll Tue 2 Aug 2005 16:35:00 A.... 303 104 296,00 K nvwrssv.dll Tue 2 Aug 2005 16:35:00 A.... 294 912 288,00 K nvwrstr.dll Tue 2 Aug 2005 16:35:00 A.... 303 104 296,00 K nvwrszhc.dll Tue 2 Aug 2005 16:35:00 A.... 163 840 160,00 K nvwrszht.dll Tue 2 Aug 2005 16:35:00 A.... 167 936 164,00 K nwwks.dll Thu 11 Aug 2005 17:11:40 A.... 65 024 63,50 K nytfxp~1.dll Sat 29 Oct 2005 7:30:22 ..S.R 237 265 231,70 K pfdrv.dll Sat 29 Oct 2005 6:30:00 ..S.R 236 664 231,12 K pkudsrv.dll Sat 29 Oct 2005 5:18:22 ..S.R 236 664 231,12 K pngfilt.dll Sat 3 Sep 2005 2:06:12 A.... 39 424 38,50 K pwrupcid.dll Tue 6 Sep 2005 14:14:10 A.... 163 840 160,00 K qt-dx331.dll Wed 10 Aug 2005 0:12:30 A.... 3 596 288 3,43 M quartz.dll Tue 30 Aug 2005 5:55:44 A.... 1 293 312 1,23 M shdocvw.dll Sat 3 Sep 2005 2:06:12 A.... 1 484 288 1,41 M shell32.dll Fri 23 Sep 2005 5:07:00 A.... 8 506 880 8,11 M shlwapi.dll Sat 3 Sep 2005 2:06:12 A.... 474 112 463,00 K soesrv.dll Sat 29 Oct 2005 6:21:28 ..S.R 235 546 230,02 K ssleay32.dll Wed 10 Aug 2005 0:13:32 A.... 159 744 156,00 K umpnpmgr.dll Tue 23 Aug 2005 5:39:36 A.... 124 928 122,00 K unicows.dll Wed 10 Aug 2005 0:13:32 A.... 245 408 239,66 K urlmon.dll Sat 3 Sep 2005 2:06:12 A.... 605 696 591,50 K uupnpmgr.dll Sat 29 Oct 2005 6:49:06 ..S.R 236 664 231,12 K wbpasf.dll Sat 29 Oct 2005 7:06:56 ..S.R 236 664 231,12 K wininet.dll Sat 3 Sep 2005 2:06:12 A.... 662 528 647,00 K winsrv.dll Thu 1 Sep 2005 3:43:38 A.... 292 352 285,50 K wlpcore.dll Sat 29 Oct 2005 7:15:48 ..S.R 234 072 228,59 K wpatools.dll Wed 26 Oct 2005 23:56:18 A.... 45 056 44,00 K wzvadve.dll Sat 29 Oct 2005 6:41:02 ..S.R 235 546 230,02 K xipopup.dll Tue 6 Sep 2005 14:14:10 A.... 98 304 96,00 K xipush.dll Tue 6 Sep 2005 14:14:10 A.... 90 112 88,00 K xirepctl.dll Tue 6 Sep 2005 14:14:10 A.... 270 336 264,00 K xislide.dll Tue 6 Sep 2005 14:14:10 A.... 94 208 92,00 K xisuictl.dll Tue 6 Sep 2005 14:14:10 A.... 397 312 388,00 K xitabs.dll Tue 6 Sep 2005 14:14:10 A.... 442 368 432,00 K xithreed.dll Tue 6 Sep 2005 14:14:10 A.... 339 968 332,00 K xitray.dll Tue 6 Sep 2005 14:14:10 A.... 45 056 44,00 K xitree.dll Tue 6 Sep 2005 14:14:10 A.... 282 624 276,00 K 145 items found: 145 files (23 H/S), 0 directories. Total of file sizes: 82 227 309 bytes 78,42 M Locate .tmp files: C:\WINDOWS\SYSTEM32\ guard.tmp Sat 29 Oct 2005 11:29:20 ..S.R 237 265 231,70 K 1 item found: 1 file (1 H/S), 0 directories. Total of file sizes: 237 265 bytes 231,70 K ********************************************************************************** Directory Listing of system files: Le volume dans le lecteur C s'appelle SYSTEME Le num‚ro de s‚rie du volume est FCF9-D086 R‚pertoire de C:\WINDOWS\System32 29/10/2005 12:08 237ÿ265 fasdrv.dll 29/10/2005 11:31 237ÿ265 AfobePDF.dll 29/10/2005 11:29 237ÿ265 guard.tmp 29/10/2005 11:00 237ÿ265 mwr.dll 29/10/2005 11:00 233ÿ862 mv22l9fo1.dll 29/10/2005 10:52 237ÿ265 mcrd2x40.dll 29/10/2005 10:17 236ÿ664 l08mlal11dq.dll 29/10/2005 07:43 237ÿ265 dwskmon.dll 29/10/2005 07:36 236ÿ664 JLIT500.DLL 29/10/2005 07:30 237ÿ265 nytfxperf.dll 29/10/2005 07:21 236ÿ664 nfwdmcpl.dll 29/10/2005 07:15 234ÿ072 wlpcore.dll 29/10/2005 07:06 236ÿ664 wbpasf.dll 29/10/2005 06:59 235ÿ546 DILMSC32.dll 29/10/2005 06:49 236ÿ664 uupnpmgr.dll 29/10/2005 06:41 235ÿ546 WZVADVE.DLL 29/10/2005 06:29 236ÿ664 pfdrv.dll 29/10/2005 06:21 235ÿ546 soesrv.dll 29/10/2005 06:16 236ÿ664 etfpixio130.dll 29/10/2005 06:09 235ÿ546 meminst.dll 29/10/2005 05:59 236ÿ664 JVIT500.DLL 29/10/2005 05:51 235ÿ546 ksdfr.dll 29/10/2005 05:18 236ÿ664 pkudsrv.dll 29/10/2005 05:09 235ÿ546 ndwrshu.dll 19/10/2005 22:34 dllcache 03/10/2004 20:35 56 ABAEFF85CD.sys 24/08/2004 18:41 56 F08598D612.sys 05/08/2004 21:22 Microsoft 26 fichier(s) 5ÿ672ÿ153 octets 2 R‚p(s) 7ÿ392ÿ645ÿ120 octets libres Je rajoute HT Logfile of HijackThis v1.99.1 Scan saved at 12:31:59, on 29/10/2005 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe D:\Program Files\Ahead\InCD\InCDsrv.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Fichiers communs\Autodesk Shared\Service\AdskScSrv.exe C:\Program Files\DCPFLICS\DCPFLICS.exe C:\WINDOWS\System32\inetsrv\inetinfo.exe C:\Program Files\OfficeScan NT trtscan.exe C:\WINDOWS\System32 vsvc32.exe D:\Program Files\3ds max7\mentalray\satellite aysat_3dsmax7server.exe C:\Program Files\Dantz\Retrospect Express HD etrorun.exe C:\WINDOWS\System32 cpsvcs.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\Tablet.exe C:\Program Files\OfficeScan NT mlisten.exe C:\WINDOWS\Explorer.EXE C:\Program Files\OfficeScan NT\OfcPfwSvc.exe C:\WINDOWS\TEMP\VPA8EF.EXE C:\WINDOWS\system32 undll32.exe C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe C:\WINDOWS\System32\ezSP_Px.exe D:\Program Files\QuickTime\qttask.exe C:\Program Files\OfficeScan NT\pccntmon.exe C:\WINDOWS\MXOALDR.EXE C:\WINDOWS\system32\dslagent.exe C:\WINDOWS\system32\GSICON.EXE D:\Program Files\Ahead\InCD\InCD.exe C:\WINDOWS\Mixer.exe C:\Program Files\Windows NT\Accessoires\WORDPAD.EXE C:\Program Files\Mozilla Firefox\firefox.exe E:\Téléchargements\house call trend\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.microsoft.com/isapi/redir.dll?prd={SUB_PRD}&clcid={SUB_CLSID}&pver={SUB_PVER}&ar=home R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.google.com/keyword/%s R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe O4 - HKLM\..\Run: [ezShieldProtector for Px] C:\WINDOWS\System32\ezSP_Px.exe O4 - HKLM\..\Run: [QuickTime Task] "D:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [OfficeScanNT Monitor] "C:\Program Files\OfficeScan NT\pccntmon.exe" -HideWindow O4 - HKLM\..\Run: [MXOBG] C:\WINDOWS\MXOALDR.EXE O4 - HKLM\..\Run: [MaxtorOneTouch] C:\Program Files\Maxtor\OneTouch\Utils\OneTouch.exe O4 - HKLM\..\Run: [DSLAGENTEXE] dslagent.exe USB O4 - HKLM\..\Run: [GSICONEXE] GSICON.EXE O4 - HKLM\..\Run: [InCD] D:\Program Files\Ahead\InCD\InCD.exe O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup O4 - HKLM\..\Run: [Zone Labs Client] D:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe O4 - HKLM\..\Run: [SunServer] D:\Program Files\Sunbelt Software\CounterSpy\Consumer\sunserver.exe O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing) O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing) O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {2FC9A21E-2069-4E47-8235-36318989DB13} (PPSDKActiveXScanner.MainScreen) - http://ppupdates.ca.com/downloads/scanner/axscanner.cab O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.com/scan8/oscan8.cab O16 - DPF: {72C23FEC-3AF9-48FC-9597-241A8EBDFE0A} (InstallShield International Setup Player) - http://www.newsstand.com/downloads/reader/live/Disk1/isetupml.cab O16 - DPF: {B942A249-D1E7-4C11-98AE-FCB76B08747F} (RealArcadeRdxIE Class) - http://games-dl.real.com/gameconsole/Bundler/CAB/RealArcadeRdxIE.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{7CF19126-C8ED-4968-87D5-0BCBEC4F203D}: NameServer = 194.117.200.10 194.117.200.15 O23 - Service: Autodesk Licensing Service - Unknown owner - C:\Program Files\Fichiers communs\Autodesk Shared\Service\AdskScSrv.exe O23 - Service: DCPFLICS - Unknown owner - C:\Program Files\DCPFLICS\DCPFLICS.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: InCD Helper (InCDsrv) - Nero AG - D:\Program Files\Ahead\InCD\InCDsrv.exe O23 - Service: Macromedia Licensing Service - Macromedia - C:\Program Files\Fichiers communs\Macromedia Shared\Service\Macromedia Licensing.exe O23 - Service: OfficeScanNT RealTime Scan (ntrtscan) - Trend Micro Inc. - C:\Program Files\OfficeScan NT trtscan.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32 vsvc32.exe O23 - Service: OfficeScanNT Personal Firewall (OfcPfwSvc) - Trend Micro Inc. - C:\Program Files\OfficeScan NT\OfcPfwSvc.exe O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\PACSPTISVR.exe O23 - Service: Qbdclchpfp - Sonic Solutions - (no file) O23 - Service: RaySat_3dsmax7 Server (RaySat_3dsmax7Server) - Unknown owner - D:\Program Files\3ds max7\mentalray\satellite aysat_3dsmax7server.exe O23 - Service: Assistant Retrospect (RetroExp Helper) - Dantz Development Corporation - C:\PROGRA~1\Dantz\RETROS~1 thlpsvc.exe O23 - Service: Retrospect Express HD Launcher (RetroExpLauncher) - Dantz Development Corporation - C:\Program Files\Dantz\Retrospect Express HD etrorun.exe O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\SPTISRV.exe O23 - Service: TabletService - Wacom Technology, Corp. - C:\WINDOWS\System32\Tablet.exe O23 - Service: OfficeScanNT Listener (tmlisten) - Trend Micro Inc. - C:\Program Files\OfficeScan NT mlisten.exe Jemit

balltrap34 · Answer

c est le rapport de l option 2 qui m interesse stp

jemit · Answer

Oui je sais mais je n'en n'ai pas le processus ne se déroule pas correctement. Apres le reboot je revient dans XP puis rienJemit

balltrap34 · Answer

tu doit l avoir dans le dossier de l2mfix

jemit · Answer

De retourL2Mfix 1.04a Running From:G:\0 ATELIER\Securit‚\L2m\l2mfix  RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and aboveCopyright (c) 1999-2001 Frank Heyne Software (http://www.heysoft.de)This program is Freeware, use it on your own risk!Access Control List for Registry key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify:(NI)    ALLOW  Full access 	AUTORITE NT\SYSTEM(IO)    ALLOW  Full access 	AUTORITE NT\SYSTEM(ID-NI) ALLOW  Read        	BUILTIN\Utilisateurs(ID-IO) ALLOW  Read        	BUILTIN\Utilisateurs(ID-NI) ALLOW  Read        	BUILTIN\Utilisateurs avec pouvoir(ID-IO) ALLOW  Read        	BUILTIN\Utilisateurs avec pouvoir(ID-NI) ALLOW  Full access 	BUILTIN\Administrateurs(ID-IO) ALLOW  Full access 	BUILTIN\Administrateurs(ID-NI) ALLOW  Full access 	AUTORITE NT\SYSTEM(ID-IO) ALLOW  Full access 	AUTORITE NT\SYSTEM(ID-IO) ALLOW  Full access 	CREATEUR PROPRIETAIRE Setting registry permissions: RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and aboveCopyright (c) 1999-2001 Frank Heyne Software (http://www.heysoft.de)This program is Freeware, use it on your own risk!Denying C(CI) access for predefined group "Administrators" - adding new ACCESS DENY entry Registry Permissions set too:RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and aboveCopyright (c) 1999-2001 Frank Heyne Software (http://www.heysoft.de)This program is Freeware, use it on your own risk!Access Control List for Registry key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify:(CI)    DENY   --C-------   	BUILTIN\Administrateurs(NI)    ALLOW  Full access 	AUTORITE NT\SYSTEM(IO)    ALLOW  Full access 	AUTORITE NT\SYSTEM(ID-NI) ALLOW  Read        	BUILTIN\Utilisateurs(ID-IO) ALLOW  Read        	BUILTIN\Utilisateurs(ID-NI) ALLOW  Read        	BUILTIN\Utilisateurs avec pouvoir(ID-IO) ALLOW  Read        	BUILTIN\Utilisateurs avec pouvoir(ID-NI) ALLOW  Full access 	BUILTIN\Administrateurs(ID-IO) ALLOW  Full access 	BUILTIN\Administrateurs(ID-NI) ALLOW  Full access 	AUTORITE NT\SYSTEM(ID-IO) ALLOW  Full access 	AUTORITE NT\SYSTEM(ID-IO) ALLOW  Full access 	CREATEUR PROPRIETAIRE Setting up for Reboot  Starting Reboot!A+Jemit

Fentres indésirables firefox: supecte malware

23 réponses

Discussions similaires