Analyse de log SVP

André B. -  
aranjuez31 Messages postés 8161 Date d'inscription   Statut Contributeur -
Logfile of HijackThis v1.99.1
Scan saved at 18:44:10, on 7/03/2006
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\rundll32.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe
C:\WINDOWS\win32ssr.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\MediaKey\MediaKey.EXE
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\WINDOWS\System32\rundll32.exe
C:\Adobe\Photoshop Album Edition Découverte\3.0\Apps\apdproxy.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Java\jre1.5.0\bin\jusched.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\Hewlett-Packard\Digital Imaging\bin\hpohmr08.exe
C:\WINDOWS\System32\NotifyPhoneBook.exe
C:\WINDOWS\twain_32\A4CIS\WATCH.exe
C:\NaturallySpeaking\Program\natspeak.exe
C:\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe
C:\Hewlett-Packard\Digital Imaging\Bin\hpoSTS08.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\System32\HPZipm12.exe
C:\PROGRA~1\WINZIP\wzqkpick.exe
C:\Hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.google.be/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.be/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.be/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [MediaKey] C:\PROGRA~1\MediaKey\MediaKey.EXE
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [AME_CSA] rundll32 amecsa.cpl,RUN_DLL
O4 - HKLM\..\Run: [CloseDNF] C:\WINDOWS\System32\Utility.exe \1008
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Adobe\Photoshop Album Edition Découverte\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [system_service] drivers32.exe
O4 - HKLM\..\Run: [winsysupd] C:\\winsysupd12.exe
O4 - HKLM\..\Run: [gimmygames] C:\\gimmygames12.exe
O4 - HKLM\..\Run: [winsysban] C:\\winsysban12.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0\bin\jusched.exe
O4 - HKLM\..\RunServices: [system_service] drivers32.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [WINSOS VERIFY] "C:\Program Files\WINSOS\WINSOS.EXE" MINI
O4 - HKCU\..\RunServices: [Windows Service] windowz.exe
O4 - Startup: Watch.lnk = C:\WINDOWS\twain_32\A4CIS\WATCH.exe
O4 - Startup: Dragon NaturallySpeaking.lnk = C:\NaturallySpeaking\Program\natspeak.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: hpoddt01.exe.lnk = ?
O4 - Global Startup: hp psc 1000 series.lnk = ?
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: &Traduire à partir de l'anglais - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html
O8 - Extra context menu item: Pages liées - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Pages similaires - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Recherche &Google - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: Version de la page actuelle disponible dans le cache Google - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O16 - DPF: Dexia netbanking - http://netbanking.dexia.be/PC//Dynamic/Shared/Applet//DexiaIIA.cab
O16 - DPF: {6E5A37BF-FD42-463A-877C-4EB7002E68AE} (Housecall ActiveX 6.5) - http://us-housecall.trendmicro-europe.com/housecall/applet/html/native/x86/win32/activex/hcImpl.cab
O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} (Zylom Games Player) - http://game05.zylom.com/activex/zylomgamesplayer.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{84648578-34D6-4E17-A1CA-973F72E85B71}: NameServer = 195.238.2.21 195.238.2.22
O20 - Winlogon Notify: Controls Folder - C:\WINDOWS\system32\f40o0ed3eh0.dll
O20 - Winlogon Notify: WRNotifier - C:\WINDOWS\SYSTEM32\WRLogonNTF.dll
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: Boonty Games - BOONTY - C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe
O23 - Service: Win32Sr - Unknown owner - C:\WINDOWS\win32ssr.exe

Merci à ceux qui pourront m'aider

8 réponses

  1.
    aranjuez31 Messages postés 8161 Date d'inscription   Statut Contributeur 354
     
    hello
    un bonjour te serait salutaire pour que je prenne ta dde en compte
    merci
    http://www.technicland.com/malpolitus.swf
    0
    1. André B.
       
      BONJOUR

      Tu as parfaitement raison et ça ne m'arrive pratiquement jamais d'être malpoli à ce point.

      Voilà une semaine que je suis embêté et très énervé par mon problème de fenêtres qui s'ouvrent continuellement sur ma machine. Je me suis laissé emporter par l'espoir d'avoir enfin une solution.

      Merci de ne pas avoir coupé court : je l'aurais bien mérité. Allez, un bon mouvement.

      Mille excuses.
      0
  2. aranjuez31 Messages postés 8161 Date d'inscription   Statut Contributeur 354
     
    hello
    pas grave
    pré-nettoyage ds l ordre , cela simplifie le boulot du helper pour la suite

    1/ - telech
    ewido (dowload)
    http://www.ewido.net/fr/download/
    copie/COLLE rapport entier

    2/ - scan online sous IE
    http://www.bitdefender.fr/bd/site/search.php#
    copie/COLLE rapport entier

    c est l heure de l apéro
    tu auras ttes les instructions au courant de la nuit
    0
  3. aranjuez31 Messages postés 8161 Date d'inscription   Statut Contributeur 354
     
    hello
    ouvre hijack
    fixe ceci de cette manière
    (http://pageperso.aol.fr/balltrap34/demohijack.htm)

    O16 - DPF: Dexia netbanking - http://netbanking.dexia.be/PC//Dynamic/Shared/Applet//DexiaIIA.cab
    O16 - DPF: {6E5A37BF-FD42-463A-877C-4EB7002E68AE} (Housecall ActiveX 6.5) - http://us-housecall.trendmicro-europe.com/housecall/applet/html/native/x86/win32/activex/hcImpl.cab
    O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} (Zylom Games Player) - http://game05.zylom.com/activex/zylomgamesplayer.cab
    +
    O4 - Global Startup: hpoddt01.exe.lnk = ?
    O4 - Global Startup: hp psc 1000 series.lnk = ?
    O4 - HKLM\..\Run: [winsysupd] C:\\winsysupd12.exe
    O4 - HKLM\..\Run: [gimmygames] C:\\gimmygames12.exe
    O4 - HKLM\..\Run: [winsysban] C:\\winsysban12.exe
    ===============
    version de IE périmée
    =======
    pas de pare- feu actif ???
    en voilà un gratuit et de bonne qualité
    http://www.clubic.com/telecharger-fiche11071-kerio-personal-firewall.html
    son tuto
    http://www.pcentraide.com/index.php?showtopic=110
    ========
    j attends rapports ddés au post 3
    0
    1. André B.
       
      Bonjour.
      Je n'ai pas oublié, mais depuis hier, des fenêtres intempestives continuent à apparaître quel que soit le programme où je me trouve.
      Comme tu l'as demandé, je colle les deux rapports que tu as demandé.


      Bitdefender

      Statistiques

      Temps
      01:16:28

      Fichiers
      356520

      Directoires
      3894

      Secteurs de boot
      3

      Archives
      3481

      Paquets programmes
      41177




      Résultats

      Virus identifiés
      7

      Fichiers infectés
      14

      Fichiers suspects
      2

      Avertissements
      0

      Désinfectés
      0

      Fichiers effacés
      16




      Info sur les moteurs

      Définition virus
      300777

      Version des moteurs
      AVCORE v1.0 (build 2292) (i386) (Mar 3 2005 11:57:29)

      Analyse des plugins
      13

      Archive des plugins
      39

      Unpack des plugins
      4

      E-mail plugins
      6

      Système plugins
      1




      Paramètres d'analyse

      Première action
      Désinfecté

      Seconde Action
      Supprimé

      Heuristique
      Oui

      Acceptez les avertissements
      Oui

      Extensions analysées
      *;

      Excludez les extensions


      Analyse d'emails
      Oui

      Analyse des Archives
      Oui

      Analyser paquets programmes
      Oui

      Analyse des fichiers
      Oui

      Analyse de boot
      Oui




      Fichier analysé
      Statut

      C:\WINDOWS\system32\guard.tmp
      Détecté avec: Adware.Dinky.A.Trojan

      C:\WINDOWS\system32\guard.tmp
      Supprimé

      C:\WINDOWS\system32\__delete_on_reboot__desapi.dll
      Détecté avec: Adware.Dinky.A.Trojan

      C:\WINDOWS\system32\__delete_on_reboot__desapi.dll
      Echec de la désinfection

      C:\WINDOWS\system32\__delete_on_reboot__desapi.dll
      Echec de la suppression

      C:\Documents and Settings\a\.housecall\Quarantine\A0020450.exe.bac_a01904=>(Quarantine-4)
      Infecté par: Backdoor.SDBot.ANS

      C:\Documents and Settings\a\.housecall\Quarantine\A0020450.exe.bac_a01904=>(Quarantine-4)
      Echec de la désinfection

      C:\Documents and Settings\a\.housecall\Quarantine\A0020450.exe.bac_a01904=>(Quarantine-4)
      Supprimé

      C:\System Volume Information\_restore{90B0E1B4-2DB5-41F8-8C23-57CD0153BCB7}\RP67\A0021649.exe
      Suspecté de: Generic.Malware.Ssp.426B0BAA

      C:\System Volume Information\_restore{90B0E1B4-2DB5-41F8-8C23-57CD0153BCB7}\RP67\A0021649.exe
      Echec de la désinfection

      C:\System Volume Information\_restore{90B0E1B4-2DB5-41F8-8C23-57CD0153BCB7}\RP67\A0021649.exe
      Supprimé

      C:\System Volume Information\_restore{90B0E1B4-2DB5-41F8-8C23-57CD0153BCB7}\RP67\A0021668.dll
      Détecté avec: Adware.Dinky.A.Trojan

      C:\System Volume Information\_restore{90B0E1B4-2DB5-41F8-8C23-57CD0153BCB7}\RP67\A0021668.dll
      Supprimé

      C:\System Volume Information\_restore{90B0E1B4-2DB5-41F8-8C23-57CD0153BCB7}\RP67\A0021669.dll
      Détecté avec: Adware.Dinky.A.Trojan

      C:\System Volume Information\_restore{90B0E1B4-2DB5-41F8-8C23-57CD0153BCB7}\RP67\A0021669.dll
      Supprimé

      C:\attente\ripper\setupcdripper.exe=>wise0017
      Infecté par: Trojan.Downloader.Adload.A

      C:\attente\ripper\setupcdripper.exe=>wise0017
      Echec de la désinfection

      C:\attente\ripper\setupcdripper.exe=>wise0017
      Supprimé

      C:\attente\ripper\setupcdripper.exe
      Echec de la mise à jour

      C:\attente\ripper\setupcdripper.exe=>wise0019=>(ZIP Sfx o)=>v2.0.4a.cab=>NHelper.dll
      Détecté avec: Adware.Navexcel.A

      C:\attente\ripper\setupcdripper.exe=>wise0019=>(ZIP Sfx o)=>v2.0.4a.cab=>NHelper.dll
      Echec de la désinfection

      C:\attente\ripper\setupcdripper.exe=>wise0019=>(ZIP Sfx o)=>v2.0.4a.cab=>NHelper.dll
      Supprimé

      C:\attente\ripper\setupcdripper.exe=>wise0019=>(ZIP Sfx o)=>v2.0.4a.cab
      Echec de la mise à jour

      C:\attente\ripper\setupcdripper.exe=>wise0019=>(ZIP Sfx o)=>v2.0.4a.cab=>NHUninstaller.exe
      Détecté avec: Adware.Navexcel.A

      C:\attente\ripper\setupcdripper.exe=>wise0019=>(ZIP Sfx o)=>v2.0.4a.cab=>NHUninstaller.exe
      Echec de la désinfection

      C:\attente\ripper\setupcdripper.exe=>wise0019=>(ZIP Sfx o)=>v2.0.4a.cab=>NHUninstaller.exe
      Supprimé

      C:\attente\ripper\setupcdripper.exe=>wise0019=>(ZIP Sfx o)=>v2.0.4a.cab
      Echec de la mise à jour

      C:\attente\ripper\setupcdripper.exe=>wise0019=>(ZIP Sfx o)=>v2.0.4a.cab=>NHUpdater.exe
      Détecté avec: Adware.Navexcel.A

      C:\attente\ripper\setupcdripper.exe=>wise0019=>(ZIP Sfx o)=>v2.0.4a.cab=>NHUpdater.exe
      Echec de la désinfection

      C:\attente\ripper\setupcdripper.exe=>wise0019=>(ZIP Sfx o)=>v2.0.4a.cab=>NHUpdater.exe
      Supprimé

      C:\attente\ripper\setupcdripper.exe=>wise0019=>(ZIP Sfx o)=>v2.0.4a.cab
      Echec de la mise à jour

      C:\sonia\chargementnet\netpumper-1.23-setup.exe=>(Instyler o)=>(Instyler Module 78)
      Infecté par: Trojan.Downloader.Swizzor.DO

      C:\sonia\chargementnet\netpumper-1.23-setup.exe=>(Instyler o)=>(Instyler Module 78)
      Supprimé

      C:\sonia\chargementnet\netpumper-1.23-setup.exe=>(Instyler o)
      Echec de la mise à jour

      D:\System Volume Information\_restore{90B0E1B4-2DB5-41F8-8C23-57CD0153BCB7}\RP67\A0021650.exe
      Suspecté de: Generic.Malware.Ssp.426B0BAA

      D:\System Volume Information\_restore{90B0E1B4-2DB5-41F8-8C23-57CD0153BCB7}\RP67\A0021650.exe
      Echec de la désinfection

      D:\System Volume Information\_restore{90B0E1B4-2DB5-41F8-8C23-57CD0153BCB7}\RP67\A0021650.exe
      Supprimé

      D:\attente\ripper\setupcdripper.exe=>wise0017
      Infecté par: Trojan.Downloader.Adload.A

      D:\attente\ripper\setupcdripper.exe=>wise0017
      Echec de la désinfection

      D:\attente\ripper\setupcdripper.exe=>wise0017
      Supprimé

      D:\attente\ripper\setupcdripper.exe
      Echec de la mise à jour

      D:\attente\ripper\setupcdripper.exe=>wise0019=>(ZIP Sfx o)=>v2.0.4a.cab=>NHelper.dll
      Détecté avec: Adware.Navexcel.A

      D:\attente\ripper\setupcdripper.exe=>wise0019=>(ZIP Sfx o)=>v2.0.4a.cab=>NHelper.dll
      Echec de la désinfection

      D:\attente\ripper\setupcdripper.exe=>wise0019=>(ZIP Sfx o)=>v2.0.4a.cab=>NHelper.dll
      Supprimé

      D:\attente\ripper\setupcdripper.exe=>wise0019=>(ZIP Sfx o)=>v2.0.4a.cab
      Echec de la mise à jour

      D:\attente\ripper\setupcdripper.exe=>wise0019=>(ZIP Sfx o)=>v2.0.4a.cab=>NHUninstaller.exe
      Détecté avec: Adware.Navexcel.A

      D:\attente\ripper\setupcdripper.exe=>wise0019=>(ZIP Sfx o)=>v2.0.4a.cab=>NHUninstaller.exe
      Echec de la désinfection

      D:\attente\ripper\setupcdripper.exe=>wise0019=>(ZIP Sfx o)=>v2.0.4a.cab=>NHUninstaller.exe
      Supprimé

      D:\attente\ripper\setupcdripper.exe=>wise0019=>(ZIP Sfx o)=>v2.0.4a.cab
      Echec de la mise à jour

      D:\attente\ripper\setupcdripper.exe=>wise0019=>(ZIP Sfx o)=>v2.0.4a.cab=>NHUpdater.exe
      Détecté avec: Adware.Navexcel.A

      D:\attente\ripper\setupcdripper.exe=>wise0019=>(ZIP Sfx o)=>v2.0.4a.cab=>NHUpdater.exe
      Echec de la désinfection

      D:\attente\ripper\setupcdripper.exe=>wise0019=>(ZIP Sfx o)=>v2.0.4a.cab=>NHUpdater.exe
      Supprimé

      D:\attente\ripper\setupcdripper.exe=>wise0019=>(ZIP Sfx o)=>v2.0.4a.cab


      ewido
      + Résultats du scan:

      [1088] C:\WINDOWS\system32\swftpub.dll -> Adware.Look2Me : Erreur durant le nettoyage
      [1564] C:\WINDOWS\system32\swftpub.dll -> Adware.Look2Me : Erreur durant le nettoyage
      C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\G445SXJA\rp5[1].exe -> Backdoor.SdBot.aad : Nettoyer et sauvegarder
      C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\G445SXJA\rp5[2].exe -> Backdoor.SdBot.aad : Nettoyer et sauvegarder
      C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\ILST83YZ\rp5[1].exe -> Backdoor.SdBot.aad : Nettoyer et sauvegarder
      C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\VOKI1NTR\rp5[1].exe -> Backdoor.SdBot.aad : Nettoyer et sauvegarder
      C:\WINDOWS\system32\__delete_on_reboot__swftpub.dll -> Adware.Look2Me : Nettoyer et sauvegarder
      C:\WINDOWS\system32\a.exe -> Backdoor.SdBot.aad : Nettoyer et sauvegarder
      C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\0AK34WFG\ErrorSafeScannerInstallFR[1].cab/UERSV_0001_N68M0602NetInstaller.exe -> Not-A-Virus.Downloader.Win32.WinFixer.d : Nettoyer et sauvegarder
      C:\WINDOWS\Temp\Cookies\a@ad.yieldmanager[2].txt -> TrackingCookie.Yieldmanager : Nettoyer et sauvegarder
      C:\WINDOWS\Temp\Cookies\a@cpvfeed[2].txt -> TrackingCookie.Cpvfeed : Nettoyer et sauvegarder
      C:\WINDOWS\Temp\Cookies\a@stats1.reliablestats[1].txt -> TrackingCookie.Reliablestats : Nettoyer et sauvegarder
      C:\WINDOWS\__delete_on_reboot__win32ssr.exe -> Backdoor.SdBot.aad : Nettoyer et sauvegarder
      C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\C4Q9S2OM\rp5[1].exe -> Backdoor.SdBot.aad : Nettoyer et sauvegarder
      C:\Documents and Settings\a\Local Settings\Temp\Cookies\a@weborama[2].txt -> TrackingCookie.Weborama : Nettoyer et sauvegarder
      C:\Documents and Settings\a\Local Settings\Temp\Cookies\a@com[2].txt -> TrackingCookie.Com : Nettoyer et sauvegarder
      C:\Documents and Settings\a\Local Settings\Temp\Cookies\a@h.starware[1].txt -> TrackingCookie.Starware : Nettoyer et sauvegarder
      C:\Documents and Settings\a\Local Settings\Temp\Cookies\a@tacoda[1].txt -> TrackingCookie.Tacoda : Nettoyer et sauvegarder
      C:\Documents and Settings\a\Local Settings\Temp\Cookies\a@burstnet[2].txt -> TrackingCookie.Burstnet : Nettoyer et sauvegarder
      C:\Documents and Settings\a\Local Settings\Temp\Cookies\a@ivwbox[2].txt -> TrackingCookie.Ivwbox : Nettoyer et sauvegarder
      C:\Documents and Settings\a\Local Settings\Temp\Cookies\a@adopt.euroclick[2].txt -> TrackingCookie.Euroclick : Nettoyer et sauvegarder
      C:\Documents and Settings\a\Local Settings\Temp\Cookies\a@cpvfeed[2].txt -> TrackingCookie.Cpvfeed : Nettoyer et sauvegarder
      C:\Documents and Settings\a\Local Settings\Temp\Cookies\a@ad.yieldmanager[1].txt -> TrackingCookie.Yieldmanager : Nettoyer et sauvegarder
      C:\Documents and Settings\a\Local Settings\Temp\Cookies\a@stats1.reliablestats[1].txt -> TrackingCookie.Reliablestats : Nettoyer et sauvegarder
      C:\Documents and Settings\a\Local Settings\Temp\Cookies\a@promo.casinotropez[2].txt -> TrackingCookie.Casinotropez : Nettoyer et sauvegarder
      C:\Documents and Settings\a\Cookies\a@cpvfeed[1].txt -> TrackingCookie.Cpvfeed : Nettoyer et sauvegarder
      C:\Documents and Settings\a\Cookies\a@stats1.reliablestats[1].txt -> TrackingCookie.Reliablestats : Nettoyer et sauvegarder
      C:\Documents and Settings\a\Cookies\a@ad.yieldmanager[2].txt -> TrackingCookie.Yieldmanager : Nettoyer et sauvegarder
      :mozilla.7:C:\Documents and Settings\a\Application Data\Mozilla\Firefox\Profiles\rymhwl1s.default\cookies.txt -> TrackingCookie.Yieldmanager : Nettoyer et sauvegarder
      :mozilla.8:C:\Documents and Settings\a\Application Data\Mozilla\Firefox\Profiles\rymhwl1s.default\cookies.txt -> TrackingCookie.Yieldmanager : Nettoyer et sauvegarder
      :mozilla.14:C:\Documents and Settings\a\Application Data\Mozilla\Firefox\Profiles\rymhwl1s.default\cookies.txt -> TrackingCookie.Com : Nettoyer et sauvegarder
      :mozilla.15:C:\Documents and Settings\a\Application Data\Mozilla\Firefox\Profiles\rymhwl1s.default\cookies.txt -> TrackingCookie.Com : Nettoyer et sauvegarder
      C:\System Volume Information\_restore{90B0E1B4-2DB5-41F8-8C23-57CD0153BCB7}\RP49\A0014389.exe -> Adware.NewDotNet : Nettoyer et sauvegarder
      C:\System Volume Information\_restore{90B0E1B4-2DB5-41F8-8C23-57CD0153BCB7}\RP63\A0017755.exe -> Not-A-Virus.Downloader.Win32.WinFixer.d : Nettoyer et sauvegarder
      C:\System Volume Information\_restore{90B0E1B4-2DB5-41F8-8C23-57CD0153BCB7}\RP66\A0020497.exe -> Backdoor.SdBot.aad : Nettoyer et sauvegarder
      C:\System Volume Information\_restore{90B0E1B4-2DB5-41F8-8C23-57CD0153BCB7}\RP66\A0020508.exe -> Backdoor.SdBot.aad : Nettoyer et sauvegarder
      C:\System Volume Information\_restore{90B0E1B4-2DB5-41F8-8C23-57CD0153BCB7}\RP66\A0021528.exe -> Backdoor.SdBot.aad : Nettoyer et sauvegarder
      C:\System Volume Information\_restore{90B0E1B4-2DB5-41F8-8C23-57CD0153BCB7}\RP66\A0021550.exe -> Backdoor.SdBot.aad : Nettoyer et sauvegarder
      C:\System Volume Information\_restore{90B0E1B4-2DB5-41F8-8C23-57CD0153BCB7}\RP66\A0021559.exe -> Backdoor.SdBot.aad : Nettoyer et sauvegarder
      C:\System Volume Information\_restore{90B0E1B4-2DB5-41F8-8C23-57CD0153BCB7}\RP66\A0021568.exe -> Backdoor.SdBot.aad : Nettoyer et sauvegarder
      C:\System Volume Information\_restore{90B0E1B4-2DB5-41F8-8C23-57CD0153BCB7}\RP66\A0021589.exe -> Backdoor.SdBot.aad : Nettoyer et sauvegarder
      C:\System Volume Information\_restore{90B0E1B4-2DB5-41F8-8C23-57CD0153BCB7}\RP66\A0021603.exe -> Backdoor.SdBot.aad : Nettoyer et sauvegarder
      C:\attente\protection\WinAntiSpyware2006FreeInstall.exe -> Not-A-Virus.Downloader.Win32.WinFixer.d : Nettoyer et sauvegarder
      C:\sonia\chargementnet\jeux\HongKong_Mahjong1024-dm.exe -> Adware.Trymedia : Nettoyer et sauvegarder


      Merci pour l'aide et la patience
      0
  4. aranjuez31 Messages postés 8161 Date d'inscription   Statut Contributeur 354
     
    'soir
    ahah c est à toi qu il va falloir de la patience
    tu as des infections de ttes sortes
    certaines sont parties, mais les plus méchantes sont tjrs bien accrochées
    c est le résultat d un ordi insuffisament protégé et surtout de ta façon de surfer - tu as de mauvaises fréquentations
    rires, c est de ta faute !
    ========================
    Installer L2mfix là (nettoie ligne O20 de Hijackthis)
    http://www.atribune.org/downloads/l2mfix.exe
    http://www.downloads.subratam.org/l2mfix.exe
    http://users.skynet.be/BernieClub/tools.html
    1. extraire le fichier sur le bureau
    2. désactiver l'antivirus (car process est détecté faussement comme virus malware par certains antivirus)
    3. lancer l2mfix.bat et sélectionner l'option #1 et faire Enter pour faire apparaître le log (cela prend qqs minutes)
    4. Copie le log et colle

    attendre mon feu vert pour la suite

    5. Fermes toutes tes fenêtres windows
    6. Relances l2mfix.bat et sélectionne l'option #2
    7. l'ordi va redémarrer automatiquement sinon le faire manuellement
    8. Recopie le log et colle-le à nouveau sur un FORUM approprié pour une aide
    9. Lances un Hijackthis http://www.merijn.org/files/hijackthis.zip ou là http://users.skynet.be/BernieClub/tools.html
    tu le lances " Do a system scan and save log " et tu copie/colle le rapport sur un FORUM approprié pour une aide (avec cliq droit de la souris).
    ==============================
    un contrôle

    Télécharger ceci (merci a S!RI pour ce petit programme) :
    http://siri.urz.free.fr/Fix/SmitfraudFix.zip
    L'exécuter, puis double-cliquer sur Smitfraudfix.cmd
    Choisir l’option 1, il va générer un rapport
    Copier-coller ce dernier dans un message sur le forum.
    En image :
    http://siri.urz.free.fr/Fix/SmitfraudFix.php

    applique-toi dans tes devoirs , dd

    0

  5. Vous n’avez pas trouvé la réponse que vous recherchez ?

    Posez votre question
  6. André B.
     
    Salut.

    Maintenant, les fenêtres intempestives ne s'ouvrent plus, mais je te soumets quand même les rapports générés.

    L2mfix
    L2MFIX find log 1.04a
    These are the registry keys present
    **********************************************************************************
    Winlogon/notify:
    Windows Registry Editor Version 5.00

    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify]

    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain]
    "Asynchronous"=dword:00000000
    "Impersonate"=dword:00000000
    "DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,33,00,32,00,2e,00,64,00,6c,00,\
    6c,00,00,00
    "Logoff"="ChainWlxLogoffEvent"

    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet]
    "Asynchronous"=dword:00000000
    "Impersonate"=dword:00000000
    "DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,6e,00,65,00,74,00,2e,00,64,00,\
    6c,00,6c,00,00,00
    "Logoff"="CryptnetWlxLogoffEvent"

    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll]
    "DLLName"="cscdll.dll"
    "Logon"="WinlogonLogonEvent"
    "Logoff"="WinlogonLogoffEvent"
    "ScreenSaver"="WinlogonScreenSaverEvent"
    "Startup"="WinlogonStartupEvent"
    "Shutdown"="WinlogonShutdownEvent"
    "StartShell"="WinlogonStartShellEvent"
    "Impersonate"=dword:00000000
    "Asynchronous"=dword:00000001

    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp]
    "DLLName"="wlnotify.dll"
    "Logon"="SCardStartCertProp"
    "Logoff"="SCardStopCertProp"
    "Lock"="SCardSuspendCertProp"
    "Unlock"="SCardResumeCertProp"
    "Enabled"=dword:00000001
    "Impersonate"=dword:00000001
    "Asynchronous"=dword:00000001

    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule]
    "Asynchronous"=dword:00000000
    "DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\
    6c,00,6c,00,00,00
    "Impersonate"=dword:00000000
    "StartShell"="SchedStartShell"
    "Logoff"="SchedEventLogOff"

    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy]
    "Logoff"="WLEventLogoff"
    "Impersonate"=dword:00000000
    "Asynchronous"=dword:00000001
    "DllName"=hex(2):73,00,63,00,6c,00,67,00,6e,00,74,00,66,00,79,00,2e,00,64,00,\
    6c,00,6c,00,00,00

    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn]
    "DLLName"="WlNotify.dll"
    "Lock"="SensLockEvent"
    "Logon"="SensLogonEvent"
    "Logoff"="SensLogoffEvent"
    "Safe"=dword:00000001
    "MaxWait"=dword:00000258
    "StartScreenSaver"="SensStartScreenSaverEvent"
    "StopScreenSaver"="SensStopScreenSaverEvent"
    "Startup"="SensStartupEvent"
    "Shutdown"="SensShutdownEvent"
    "StartShell"="SensStartShellEvent"
    "PostShell"="SensPostShellEvent"
    "Disconnect"="SensDisconnectEvent"
    "Reconnect"="SensReconnectEvent"
    "Unlock"="SensUnlockEvent"
    "Impersonate"=dword:00000001
    "Asynchronous"=dword:00000001

    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv]
    "Asynchronous"=dword:00000000
    "DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\
    6c,00,6c,00,00,00
    "Impersonate"=dword:00000000
    "Logoff"="TSEventLogoff"
    "Logon"="TSEventLogon"
    "PostShell"="TSEventPostShell"
    "Shutdown"="TSEventShutdown"
    "StartShell"="TSEventStartShell"
    "Startup"="TSEventStartup"
    "MaxWait"=dword:00000258
    "Reconnect"="TSEventReconnect"
    "Disconnect"="TSEventDisconnect"

    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon]
    "DLLName"="wlnotify.dll"
    "Logon"="RegisterTicketExpiredNotificationEvent"
    "Logoff"="UnregisterTicketExpiredNotificationEvent"
    "Impersonate"=dword:00000001
    "Asynchronous"=dword:00000001

    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WRNotifier]
    "Asynchronous"=dword:00000000
    "DllName"="WRLogonNTF.dll"
    "Impersonate"=dword:00000001
    "Lock"="WRLock"
    "StartScreenSaver"="WRStartScreenSaver"
    "StartShell"="WRStartShell"
    "Startup"="WRStartup"
    "StopScreenSaver"="WRStopScreenSaver"
    "Unlock"="WRUnlock"
    "Shutdown"="WRShutdown"
    "Logoff"="WRLogoff"
    "Logon"="WRLogon"

    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wzcnotif]
    "DLLName"="wzcdlg.dll"
    "Logon"="WZCEventLogon"
    "Logoff"="WZCEventLogoff"
    "Impersonate"=dword:00000000
    "Asynchronous"=dword:00000000

    RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
    Copyright (c) 1999-2001 Frank Heyne Software (http://www.heysoft.de)
    This program is Freeware, use it on your own risk!

    Access Control List for Registry key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify:
    (CI) DENY --C------- BUILTIN\Administrateurs
    (NI) ALLOW Full access AUTORITE NT\SYSTEM
    (IO) ALLOW Full access AUTORITE NT\SYSTEM
    (NI) ALLOW Full access AUTORITE NT\SYSTEM
    (IO) ALLOW Full access AUTORITE NT\SYSTEM
    (ID-NI) ALLOW Read BUILTIN\Utilisateurs
    (ID-IO) ALLOW Read BUILTIN\Utilisateurs
    (ID-NI) ALLOW Read BUILTIN\Utilisateurs avec pouvoir
    (ID-IO) ALLOW Read BUILTIN\Utilisateurs avec pouvoir
    (ID-NI) ALLOW Full access BUILTIN\Administrateurs
    (ID-IO) ALLOW Full access BUILTIN\Administrateurs
    (ID-NI) ALLOW Full access AUTORITE NT\SYSTEM
    (ID-IO) ALLOW Full access AUTORITE NT\SYSTEM
    (ID-IO) ALLOW Full access CREATEUR PROPRIETAIRE

    **********************************************************************************
    useragent:
    Windows Registry Editor Version 5.00

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
    "{F58D120A-BA27-DEE7-20CC-9C58DA8F0DCF}"=""

    **********************************************************************************
    Shell Extension key:
    Windows Registry Editor Version 5.00

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]
    "{00022613-0000-0000-C000-000000000046}"="Feuille de propri‚t‚s du fichier multim‚dia"
    "{176d6597-26d3-11d1-b350-080036a75b03}"="Gestion de scanneur ICM"
    "{1F2E5C40-9550-11CE-99D2-00AA006E086C}"="Page de s‚curit‚ NTFS"
    "{3EA48300-8CF6-101B-84FB-666CCB9BCD32}"="Page des propri‚t‚s de OLE DocFile"
    "{40dd6e20-7c17-11ce-a804-00aa003ca9f6}"="Extensions de l'environnement pour le partage"
    "{41E300E0-78B6-11ce-849B-444553540000}"="PlusPack CPL Extension"
    "{42071712-76d4-11d1-8b24-00a0c9068ff3}"="Extension Affichage Carte du Panneau de configuration"
    "{42071713-76d4-11d1-8b24-00a0c9068ff3}"="Extension Affichage cran du Panneau de configuration"
    "{42071714-76d4-11d1-8b24-00a0c9068ff3}"="Extension Affichage Panorama du Panneau de configuration"
    "{4E40F770-369C-11d0-8922-00A024AB2DBB}"="Page de s‚curit‚ DS"
    "{513D916F-2A8E-4F51-AEAB-0CBC76FB1AF8}"="Page de compatibilit‚"
    "{56117100-C0CD-101B-81E2-00AA004AE837}"="Gestionnaire de donn‚es endommag‚es de l'environnement"
    "{59099400-57FF-11CE-BD94-0020AF85B590}"="Extension copie de disquette"
    "{59be4990-f85c-11ce-aff7-00aa003ca9f6}"="Extensions de l'environnement pour les objets r‚seau de Microsoft Windows"
    "{5DB2625A-54DF-11D0-B6C4-0800091AA605}"="Gestion d'‚cran ICM"
    "{675F097E-4C4D-11D0-B6C1-0800091AA605}"="Gestion d'imprimante ICM"
    "{764BF0E1-F219-11ce-972D-00AA00A14F56}"="Extensions de l'environnement de compression de fichiers"
    "{77597368-7b15-11d0-a0c2-080036af3f03}"="Extension de l'environnement d'imprimante Web"
    "{7988B573-EC89-11cf-9C00-00AA00A14F56}"="Disk Quota UI"
    "{853FE2B1-B769-11d0-9C4E-00C04FB6C6FA}"="Menu contextuel de cryptage"
    "{85BBD920-42A0-1069-A2E4-08002B30309D}"="Porte-documents"
    "{88895560-9AA2-1069-930E-00AA0030EBC8}"="Extension ic“ne HyperTerminal"
    "{BD84B380-8CA2-1069-AB1D-08000948F534}"="Fonts"
    "{DBCE2480-C732-101B-BE72-BA78E9AD5B27}"="Profil ICC"
    "{F37C5810-4D3F-11d0-B4BF-00AA00BBB723}"="Page de s‚curit‚ des imprimantes"
    "{f81e9010-6ea4-11ce-a7ff-00aa003ca9f6}"="Extensions de l'environnement pour le partage"
    "{f92e8c40-3d33-11d2-b1aa-080036a75b03}"="Display TroubleShoot CPL Extension"
    "{7444C717-39BF-11D1-8CD9-00C04FC29D45}"="Extension de cryptographie PKO"
    "{7444C719-39BF-11D1-8CD9-00C04FC29D45}"="Extension de cryptographie Sign"
    "{7007ACC7-3202-11D1-AAD2-00805FC1270E}"="Connexions r‚seau"
    "{992CFFA0-F557-101A-88EC-00DD010CCC48}"="Connexions r‚seau"
    "{E211B736-43FD-11D1-9EFB-0000F8757FCD}"="&Scanneurs et appareils photo"
    "{FB0C9C8A-6C50-11D1-9F1D-0000F8757FCD}"="&Scanneurs et appareils photo"
    "{905667aa-acd6-11d2-8080-00805f6596d2}"="&Scanneurs et appareils photo"
    "{3F953603-1008-4f6e-A73A-04AAC7A992F1}"="&Scanneurs et appareils photo"
    "{83bbcbf3-b28a-4919-a5aa-73027445d672}"="&Scanneurs et appareils photo"
    "{F0152790-D56E-4445-850E-4F3117DB740C}"="Remote Sessions CPL Extension"
    "{5F327514-6C5E-4d60-8F16-D07FA08A78ED}"="Extension de la page de propri‚t‚s de mise … jour automatique"
    "{60254CA5-953B-11CF-8C96-00AA00B8708C}"="Extensions de l'interpr‚teur de commandes pour l'environnement d'ex‚cution de scripts Windows"
    "{2206CDB2-19C1-11D1-89E0-00C04FD7A829}"="Liaison de donn‚es Microsoft"
    "{DD2110F0-9EEF-11cf-8D8E-00AA0060F5BF}"="Tasks Folder Icon Handler"
    "{797F1E90-9EDD-11cf-8D8E-00AA0060F5BF}"="Tasks Folder Shell Extension"
    "{D6277990-4C6A-11CF-8D87-00AA0060F5BF}"="Tƒches planifi‚es"
    "{0DF44EAA-FF21-4412-828E-260A8728E7F1}"="Barre des tƒches et menu D‚marrer"
    "{2559a1f0-21d7-11d4-bdaf-00c04f60b9f0}"="Rechercher"
    "{2559a1f1-21d7-11d4-bdaf-00c04f60b9f0}"="Aide et support"
    "{2559a1f2-21d7-11d4-bdaf-00c04f60b9f0}"="Aide et support"
    "{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}"="Ex‚cuter..."
    "{2559a1f4-21d7-11d4-bdaf-00c04f60b9f0}"="Internet"
    "{2559a1f5-21d7-11d4-bdaf-00c04f60b9f0}"="Courrier ‚lectronique"
    "{D20EA4E1-3957-11d2-A40B-0C5020524152}"="Polices"
    "{D20EA4E1-3957-11d2-A40B-0C5020524153}"="Outils d'administration"
    "{875CB1A1-0F29-45de-A1AE-CFB4950D0B78}"="Audio Media Properties Handler"
    "{40C3D757-D6E4-4b49-BB41-0E5BBEA28817}"="Video Media Properties Handler"
    "{E4B29F9D-D390-480b-92FD-7DDB47101D71}"="Wav Properties Handler"
    "{87D62D94-71B3-4b9a-9489-5FE6850DC73E}"="Avi Properties Handler"
    "{A6FD9E45-6E44-43f9-8644-08598F5A74D9}"="Midi Properties Handler"
    "{c5a40261-cd64-4ccf-84cb-c394da41d590}"="Video Thumbnail Extractor"
    "{5E6AB780-7743-11CF-A12B-00AA004AE837}"="Barre d'outils Internet Microsoft"
    "{22BF0C20-6DA7-11D0-B373-00A0C9034938}"="tat du t‚l‚chargement"
    "{91EA3F8B-C99B-11d0-9815-00C04FD91972}"="Dossier Bureau ‚tendu"
    "{6413BA2C-B461-11d1-A18A-080036B11A03}"="Dossier du shell augment‚"
    "{F61FFEC1-754F-11d0-80CA-00AA005B4383}"="BandProxy"
    "{7BA4C742-9E81-11CF-99D3-00AA004AE837}"="Bande du navigateur Microsoft"
    "{30D02401-6A81-11d0-8274-00C04FD5AE38}"="Bande de recherche"
    "{32683183-48a0-441b-a342-7c2a440a9478}"="Media Band"
    "{169A0691-8DF9-11d1-A1C4-00C04FD75D13}"="Volet int‚gr‚ de recherche"
    "{07798131-AF23-11d1-9111-00A0C98BA67D}"="Recherche Web"
    "{AF4F6510-F982-11d0-8595-00AA004CD6D8}"="Utilitaire des options de l'arborescence du Registre"
    "{01E04581-4EEE-11d0-BFE9-00AA005B4383}"="&Adresse"
    "{A08C11D2-A228-11d0-825B-00AA005B4383}"="BoŒte d'entr‚e de l'adresse"
    "{00BB2763-6A77-11D0-A535-00C04FD7D062}"="Saisie semi-automatique Microsoft"
    "{7376D660-C583-11d0-A3A5-00C04FD706EC}"="TridentImageExtractor"
    "{6756A641-DE71-11d0-831B-00AA005B4383}"="Liste de saisie semi-automatique MRU"
    "{6935DB93-21E8-4ccc-BEB9-9FE3C77A297A}"="Liste de saisie semi-automatique personnalis‚e MRU"
    "{7e653215-fa25-46bd-a339-34a2790f3cb7}"="Accessible"
    "{acf35015-526e-4230-9596-becbe19f0ac9}"="Barre de progrŠs auto-ouvrante"
    "{E0E11A09-5CB8-4B6C-8332-E00720A168F2}"="Analyseur de la barre d'adresses"
    "{00BB2764-6A77-11D0-A535-00C04FD7D062}"="Liste de saisie semi-automatique de l'historique Microsoft"
    "{03C036F1-A186-11D0-824A-00AA005B4383}"="Liste de saisie semi-automatique du dossier Shell Microsoft"
    "{00BB2765-6A77-11D0-A535-00C04FD7D062}"="Conteneur de la liste de saisie semi-automatique multiple Microsoft"
    "{ECD4FC4E-521C-11D0-B792-00A0C90312E1}"="Menu Site de bandes"
    "{3CCF8A41-5C85-11d0-9796-00AA00B90ADF}"="Shell DeskBarApp"
    "{ECD4FC4C-521C-11D0-B792-00A0C90312E1}"="Barre du Bureau"
    "{ECD4FC4D-521C-11D0-B792-00A0C90312E1}"="Shell Rebar BandSite"
    "{DD313E04-FEFF-11d1-8ECD-0000F87A470C}"="Assistance utilisateur"
    "{EF8AD2D1-AE36-11D1-B2D2-006097DF8C11}"="ParamŠtres du dossier global"
    "{EFA24E61-B078-11d0-89E4-00C04FC9E26E}"="Favorites Band"
    "{0A89A860-D7B1-11CE-8350-444553540000}"="Shell Automation Inproc Service"
    "{E7E4BC40-E76A-11CE-A9BB-00AA004AE837}"="Shell DocObject Viewer"
    "{A5E46E3A-8849-11D1-9D8C-00C04FC99D61}"="Microsoft Browser Architecture"
    "{FBF23B40-E3F0-101B-8488-00AA003E56F8}"="InternetShortcut"
    "{3C374A40-BAE4-11CF-BF7D-00AA006946EE}"="Microsoft Url History Service"
    "{FF393560-C2A7-11CF-BFF4-444553540000}"="Historique"
    "{7BD29E00-76C1-11CF-9DD0-00A0C9034933}"="Temporary Internet Files"
    "{7BD29E01-76C1-11CF-9DD0-00A0C9034933}"="Temporary Internet Files"
    "{CFBFAE00-17A6-11D0-99CB-00C04FD64497}"="Microsoft Url Search Hook"
    "{A2B0DD40-CC59-11d0-A3A5-00C04FD706EC}"="Image de d‚marrage de la Suite IE4"
    "{67EA19A0-CCEF-11d0-8024-00C04FD75D13}"="CDF Extension Copy Hook"
    "{131A6951-7F78-11D0-A979-00C04FD705A2}"="ISFBand OC"
    "{9461b922-3c5a-11d2-bf8b-00c04fb93661}"="Search Assistant OC"
    "{3DC7A020-0ACD-11CF-A9BB-00AA004AE837}"="Internet"
    "{871C5380-42A0-1069-A2EA-08002B30309D}"="Internet Name Space"
    "{EFA24E64-B078-11d0-89E4-00C04FC9E26E}"="Explorer Band"
    "{9E56BE60-C50F-11CF-9A2C-00A0C90A90CE}"="Sendmail service"
    "{9E56BE61-C50F-11CF-9A2C-00A0C90A90CE}"="Sendmail service"
    "{88C6C381-2E85-11D0-94DE-444553540000}"="Dossier ActiveX Cache"
    "{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"="WebCheck"
    "{ABBE31D0-6DAE-11D0-BECA-00C04FD940BE}"="Subscription Mgr"
    "{F5175861-2688-11d0-9C5E-00AA00A45957}"="Dossier Inscription"
    "{08165EA0-E946-11CF-9C87-00AA005127ED}"="WebCheckWebCrawler"
    "{E3A8BDE6-ABCE-11d0-BC4B-00C04FD929DB}"="WebCheckChannelAgent"
    "{E8BB6DC0-6B4E-11d0-92DB-00A0C90C2BD7}"="TrayAgent"
    "{7D559C10-9FE9-11d0-93F7-00AA0059CE02}"="Code Download Agent"
    "{E6CC6978-6B6E-11D0-BECA-00C04FD940BE}"="ConnectionAgent"
    "{D8BD2030-6FC9-11D0-864F-00AA006809D9}"="PostAgent"
    "{7FC0B86E-5FA7-11d1-BC7C-00C04FD929DB}"="WebCheck SyncMgr Handler"
    "{352EC2B7-8B9A-11D1-B8AE-006008059382}"="Gestionnaire d'applications d'environnement"
    "{0B124F8F-91F0-11D1-B8B5-006008059382}"="num‚rateur d'applications install‚es"
    "{CFCCC7A0-A282-11D1-9082-006008059382}"="Publication d'application Darwin"
    "{e84fda7c-1d6a-45f6-b725-cb260c236066}"="Shell Image Verbs"
    "{66e4e4fb-f385-4dd0-8d74-a2efd1bc6178}"="Shell Image Data Factory"
    "{3F30C968-480A-4C6C-862D-EFC0897BB84B}"="Extracteur de miniatures de fichier + GDI"
    "{9DBD2C50-62AD-11d0-B806-00C04FD706EC}"="Gestionnaire de miniatures - Informations de r‚sum‚ (DOCFILES)"
    "{EAB841A0-9550-11cf-8C16-00805F1408F3}"="Extracteur de miniatures HTML"
    "{eb9b1153-3b57-4e68-959a-a3266bc3d7fe}"="Shell Image Property Handler"
    "{CC6EEFFB-43F6-46c5-9619-51D571967F7D}"="Assistant Publication de sites Web"
    "{add36aa8-751a-4579-a266-d66f5202ccbb}"="Commande d'impressions via le Web"
    "{6b33163c-76a5-4b6c-bf21-45de9cd503a1}"="Objet Assistant de publication Shell"
    "{58f1f272-9240-4f51-b6d4-fd63d1618591}"="Assistant Obtenir une identit‚ Passport"
    "{7A9D77BD-5403-11d2-8785-2E0420524153}"="Comptes d'utilisateurs"
    "{BD472F60-27FA-11cf-B8B4-444553540000}"="Compressed (zipped) Folder Right Drag Handler"
    "{888DCA60-FC0A-11CF-8F0F-00C04FD7D062}"="Compressed (zipped) Folder SendTo Target"
    "{f39a0dc0-9cc8-11d0-a599-00c04fd64433}"="Fichier de chaŒne"
    "{f3aa0dc0-9cc8-11d0-a599-00c04fd64434}"="Raccourci de chaŒne"
    "{f3ba0dc0-9cc8-11d0-a599-00c04fd64435}"="Channel Handler Object"
    "{f3da0dc0-9cc8-11d0-a599-00c04fd64437}"="Channel Menu"
    "{f3ea0dc0-9cc8-11d0-a599-00c04fd64438}"="Channel Properties"
    "{63da6ec0-2e98-11cf-8d82-444553540000}"="FTP Folders Webview"
    "{883373C3-BF89-11D1-BE35-080036B11A03}"="Microsoft DocProp Shell Ext"
    "{A9CF0EAE-901A-4739-A481-E35B73E47F6D}"="Microsoft DocProp Inplace Edit Box Control"
    "{8EE97210-FD1F-4B19-91DA-67914005F020}"="Microsoft DocProp Inplace ML Edit Box Control"
    "{0EEA25CC-4362-4A12-850B-86EE61B0D3EB}"="Microsoft DocProp Inplace Droplist Combo Control"
    "{6A205B57-2567-4A2C-B881-F787FAB579A3}"="Microsoft DocProp Inplace Calendar Control"
    "{28F8A4AC-BBB3-4D9B-B177-82BFC914FA33}"="Microsoft DocProp Inplace Time Control"
    "{8A23E65E-31C2-11d0-891C-00A024AB2DBB}"="Directory Query UI"
    "{9E51E0D0-6E0F-11d2-9601-00C04FA31A86}"="Shell properties for a DS object"
    "{163FDC20-2ABC-11d0-88F0-00A024AB2DBB}"="Directory Object Find"
    "{F020E586-5264-11d1-A532-0000F8757D7E}"="Directory Start/Search Find"
    "{0D45D530-764B-11d0-A1CA-00AA00C16E65}"="Directory Property UI"
    "{62AE1F9A-126A-11D0-A14B-0800361B1103}"="Directory Context Menu Verbs"
    "{ECF03A33-103D-11d2-854D-006008059367}"="MyDocs Copy Hook"
    "{ECF03A32-103D-11d2-854D-006008059367}"="MyDocs Drop Target"
    "{4a7ded0a-ad25-11d0-98a8-0800361b1103}"="MyDocs Properties"
    "{750fdf0e-2a26-11d1-a3ea-080036587f03}"="Offline Files Menu"
    "{10CFC467-4392-11d2-8DB4-00C04FA31A66}"="Offline Files Folder Options"
    "{AFDB1F70-2A4C-11d2-9039-00C04F8EEB3E}"="Dossier Fichiers hors connexion"
    "{143A62C8-C33B-11D1-84FE-00C04FA34A14}"="Microsoft Agent Character Property Sheet Handler"
    "{ECCDF543-45CC-11CE-B9BF-0080C87CDBA6}"="DfsShell"
    "{60fd46de-f830-4894-a628-6fa81bc0190d}"="%DESC_PublishDropTarget%"
    "{7A80E4A8-8005-11D2-BCF8-00C04F72C717}"="MMC Icon Handler"
    "{0CD7A5C0-9F37-11CE-AE65-08002B2E1262}"=".CAB file viewer"
    "{32714800-2E5F-11d0-8B85-00AA0044F941}"="Des &personnes..."
    "{8DD448E6-C188-4aed-AF92-44956194EB1F}"="Windows Media Player Play as Playlist Context Menu Handler"
    "{CE3FB1D1-02AE-4a5f-A6E9-D9F1B4073E6C}"="Windows Media Player Burn Audio CD Context Menu Handler"
    "{F1B9284F-E9DC-4e68-9D7E-42362A59F0FD}"="Windows Media Player Add to Playlist Context Menu Handler"
    "{9F97547E-4609-42C5-AE0C-81C61FFAEBC3}"="AVG7 Shell Extension"
    "{9F97547E-460A-42C5-AE0C-81C61FFAEBC3}"="AVG7 Find Extension"
    "{0006F045-0000-0000-C000-000000000046}"="Microsoft Outlook Custom Icon Handler"
    "{640167b4-59b0-47a6-b335-a6b3c0695aea}"="Portable Media Devices"
    "{cc86590a-b60a-48e6-996b-41d25ed39a1e}"="Portable Media Devices Menu"
    "{6ECA2FB0-62EF-4630-A1DD-78DAC42CF145}"=""
    "{F20E5895-ACF0-4642-BE12-6ABDE4EE6D09}"=""
    "{880C2C7A-1E4D-4E04-8FB3-63ACE9F90F09}"=""
    "{99111813-2001-48DF-8B72-1E6431634E57}"=""
    "{833E5E02-D5A3-4193-963D-9B341169FB10}"=""
    "{C70701D5-9572-4E14-902F-8643620FC804}"=""
    "{E0E1B0FC-9553-4FFD-8D87-ED8FE559E657}"=""
    "{035C34C6-ECBC-4B14-9A99-DA2AF7B09603}"=""
    "{6E908BF4-3177-455C-A578-1E65A9AD1FDD}"=""
    "{E77A1E53-BE45-418F-8180-963777468497}"=""
    "{C1801722-AF34-4312-BEFE-E51ADE4FAC72}"=""
    "{837B32FB-537F-40B7-85C1-0599B8D92247}"=""
    "{10C34609-6D99-41D4-B1EF-89D98A25FD27}"=""
    "{9F17ED66-B84C-4058-9A7B-03038AF52CFF}"=""
    "{B3EB4BB7-6898-4366-8527-67BB57CF5995}"=""
    "{F3E9A8F8-2122-4647-8193-DFB8CB9BFD38}"=""
    "{12738F5B-C926-4165-A98C-F67309EFDB8D}"=""
    "{20123D40-B69A-4FC7-964E-D94DD619DA25}"=""
    "{37DA1A67-5A59-415F-86D6-0695E8592CA7}"=""
    "{877B5B9A-CE56-4A5B-9BAB-FE0462DF7B7C}"=""
    "{0B914558-9339-43BE-9173-46D5629B38A2}"=""
    "{D8E5A654-50E0-4CBC-AF15-DABA25F73F02}"=""
    "{F8B1A498-076B-4E94-B625-DDBAF79B9E0A}"=""
    "{83B890AC-8419-4AD8-B2DB-E7C4201E569F}"=""
    "{F988377B-3034-4490-94F9-5F5E011C3CED}"=""
    "{7F8F0D01-F3EC-4376-8A89-473C787C666D}"=""
    "{E8502DE9-6C78-4BF2-AFF3-181763BF15A3}"=""
    "{3C64B6A8-BDFE-47A8-8B14-81688BB75D53}"=""
    "{3DD11F13-4F6A-4F2D-BB01-51FC8FDF658C}"=""
    "{001BE213-639A-404B-8ADE-22EFC7CAB2B9}"=""
    "{D87DF34C-E28F-4D4D-B81B-685C1D2D5AE2}"=""
    "{96002481-697A-47D7-B549-BE61C39648B0}"=""
    "{6BF4CCDA-1BD3-4F65-A974-0E734EFB6C24}"=""
    "{0275A895-D7DF-446E-BBBE-4ACE60F64B82}"=""
    "{826EC28E-7525-4F8C-8D5E-72E6E4EFEFE4}"=""
    "{E24E67D3-0351-449C-9C6E-9BE37D9E3D91}"=""
    "{747310C2-6609-4CA8-8A4C-B75C1075C97A}"=""
    "{61D3B9F2-6F1B-4DE2-89E4-369B8E61DE63}"=""
    "{E0D79304-84BE-11CE-9641-444553540000}"="WinZip"
    "{E0D79305-84BE-11CE-9641-444553540000}"="WinZip"
    "{E0D79306-84BE-11CE-9641-444553540000}"="WinZip"
    "{E0D79307-84BE-11CE-9641-444553540000}"="WinZip"
    "{00B39376-26B2-46C0-81A5-71171D8A299C}"=""
    "{1EEF2096-A5FF-4ED4-9F46-40BADD259336}"=""
    "{6426F663-3413-4657-B9AF-4D2349BBC6F3}"=""
    "{AE9E9485-69EC-47D4-8C9D-80A6CF9A1A0A}"=""
    "{3424E7C6-7E44-4F50-9053-4429C62F8179}"=""
    "{F7D90A67-852A-4774-8DE1-D69BCA65E7CF}"=""
    "{C4961849-209A-455B-8E16-D4F9CD53DB74}"=""

    **********************************************************************************
    HKEY ROOT CLASSIDS:
    Windows Registry Editor Version 5.00

    [HKEY_CLASSES_ROOT\CLSID\{6ECA2FB0-62EF-4630-A1DD-78DAC42CF145}]
    @=""
    "IDEx"="ADDR"

    [HKEY_CLASSES_ROOT\CLSID\{6ECA2FB0-62EF-4630-A1DD-78DAC42CF145}\Implemented Categories]
    @=""

    [HKEY_CLASSES_ROOT\CLSID\{6ECA2FB0-62EF-4630-A1DD-78DAC42CF145}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
    @=""

    [HKEY_CLASSES_ROOT\CLSID\{6ECA2FB0-62EF-4630-A1DD-78DAC42CF145}\InprocServer32]
    @="C:\\WINDOWS\\system32\\iyxpromn.dll"
    "ThreadingModel"="Apartment"

    Windows Registry Editor Version 5.00

    [HKEY_CLASSES_ROOT\CLSID\{F20E5895-ACF0-4642-BE12-6ABDE4EE6D09}]
    @=""

    [HKEY_CLASSES_ROOT\CLSID\{F20E5895-ACF0-4642-BE12-6ABDE4EE6D09}\Implemented Categories]
    @=""

    [HKEY_CLASSES_ROOT\CLSID\{F20E5895-ACF0-4642-BE12-6ABDE4EE6D09}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
    @=""

    [HKEY_CLASSES_ROOT\CLSID\{F20E5895-ACF0-4642-BE12-6ABDE4EE6D09}\InprocServer32]
    @="C:\\WINDOWS\\system32\\mpsign32.dll"
    "ThreadingModel"="Apartment"

    Windows Registry Editor Version 5.00

    [HKEY_CLASSES_ROOT\CLSID\{880C2C7A-1E4D-4E04-8FB3-63ACE9F90F09}]
    @=""

    [HKEY_CLASSES_ROOT\CLSID\{880C2C7A-1E4D-4E04-8FB3-63ACE9F90F09}\Implemented Categories]
    @=""

    [HKEY_CLASSES_ROOT\CLSID\{880C2C7A-1E4D-4E04-8FB3-63ACE9F90F09}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
    @=""

    [HKEY_CLASSES_ROOT\CLSID\{880C2C7A-1E4D-4E04-8FB3-63ACE9F90F09}\InprocServer32]
    @="C:\\WINDOWS\\system32\\gntuname.dll"
    "ThreadingModel"="Apartment"

    Windows Registry Editor Version 5.00

    [HKEY_CLASSES_ROOT\CLSID\{99111813-2001-48DF-8B72-1E6431634E57}]
    @=""

    [HKEY_CLASSES_ROOT\CLSID\{99111813-2001-48DF-8B72-1E6431634E57}\Implemented Categories]
    @=""

    [HKEY_CLASSES_ROOT\CLSID\{99111813-2001-48DF-8B72-1E6431634E57}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
    @=""

    [HKEY_CLASSES_ROOT\CLSID\{99111813-2001-48DF-8B72-1E6431634E57}\InprocServer32]
    @="C:\\WINDOWS\\system32\\qx-dx331.dll"
    "ThreadingModel"="Apartment"

    Windows Registry Editor Version 5.00

    [HKEY_CLASSES_ROOT\CLSID\{833E5E02-D5A3-4193-963D-9B341169FB10}]
    @=""

    [HKEY_CLASSES_ROOT\CLSID\{833E5E02-D5A3-4193-963D-9B341169FB10}\Implemented Categories]
    @=""

    [HKEY_CLASSES_ROOT\CLSID\{833E5E02-D5A3-4193-963D-9B341169FB10}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
    @=""

    [HKEY_CLASSES_ROOT\CLSID\{833E5E02-D5A3-4193-963D-9B341169FB10}\InprocServer32]
    @="C:\\WINDOWS\\system32\\svayerxp.dll"
    "ThreadingModel"="Apartment"

    Windows Registry Editor Version 5.00

    [HKEY_CLASSES_ROOT\CLSID\{C70701D5-9572-4E14-902F-8643620FC804}]
    @=""

    [HKEY_CLASSES_ROOT\CLSID\{C70701D5-9572-4E14-902F-8643620FC804}\Implemented Categories]
    @=""

    [HKEY_CLASSES_ROOT\CLSID\{C70701D5-9572-4E14-902F-8643620FC804}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
    @=""

    [HKEY_CLASSES_ROOT\CLSID\{C70701D5-9572-4E14-902F-8643620FC804}\InprocServer32]
    @="C:\\WINDOWS\\system32\\guard.tmp"
    "ThreadingModel"="Apartment"

    Windows Registry Editor Version 5.00

    [HKEY_CLASSES_ROOT\CLSID\{E0E1B0FC-9553-4FFD-8D87-ED8FE559E657}]
    @=""

    [HKEY_CLASSES_ROOT\CLSID\{E0E1B0FC-9553-4FFD-8D87-ED8FE559E657}\Implemented Categories]
    @=""

    [HKEY_CLASSES_ROOT\CLSID\{E0E1B0FC-9553-4FFD-8D87-ED8FE559E657}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
    @=""

    [HKEY_CLASSES_ROOT\CLSID\{E0E1B0FC-9553-4FFD-8D87-ED8FE559E657}\InprocServer32]
    @="C:\\WINDOWS\\system32\\tMpiperf.dll"
    "ThreadingModel"="Apartment"

    Windows Registry Editor Version 5.00

    [HKEY_CLASSES_ROOT\CLSID\{035C34C6-ECBC-4B14-9A99-DA2AF7B09603}]
    @=""

    [HKEY_CLASSES_ROOT\CLSID\{035C34C6-ECBC-4B14-9A99-DA2AF7B09603}\Implemented Categories]
    @=""

    [HKEY_CLASSES_ROOT\CLSID\{035C34C6-ECBC-4B14-9A99-DA2AF7B09603}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
    @=""

    [HKEY_CLASSES_ROOT\CLSID\{035C34C6-ECBC-4B14-9A99-DA2AF7B09603}\InprocServer32]
    @="C:\\WINDOWS\\system32\\guard.tmp"
    "ThreadingModel"="Apartment"

    Windows Registry Editor Version 5.00

    [HKEY_CLASSES_ROOT\CLSID\{6E908BF4-3177-455C-A578-1E65A9AD1FDD}]
    @=""

    [HKEY_CLASSES_ROOT\CLSID\{6E908BF4-3177-455C-A578-1E65A9AD1FDD}\Implemented Categories]
    @=""

    [HKEY_CLASSES_ROOT\CLSID\{6E908BF4-3177-455C-A578-1E65A9AD1FDD}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
    @=""

    [HKEY_CLASSES_ROOT\CLSID\{6E908BF4-3177-455C-A578-1E65A9AD1FDD}\InprocServer32]
    @="C:\\WINDOWS\\system32\\guard.tmp"
    "ThreadingModel"="Apartment"

    Windows Registry Editor Version 5.00

    [HKEY_CLASSES_ROOT\CLSID\{E77A1E53-BE45-418F-8180-963777468497}]
    @=""

    [HKEY_CLASSES_ROOT\CLSID\{E77A1E53-BE45-418F-8180-963777468497}\Implemented Categories]
    @=""

    [HKEY_CLASSES_ROOT\CLSID\{E77A1E53-BE45-418F-8180-963777468497}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
    @=""

    [HKEY_CLASSES_ROOT\CLSID\{E77A1E53-BE45-418F-8180-963777468497}\InprocServer32]
    @="C:\\WINDOWS\\system32\\liexpand.dll"
    "ThreadingModel"="Apartment"

    Windows Registry Editor Version 5.00

    [HKEY_CLASSES_ROOT\CLSID\{C1801722-AF34-4312-BEFE-E51ADE4FAC72}]
    @=""

    [HKEY_CLASSES_ROOT\CLSID\{C1801722-AF34-4312-BEFE-E51ADE4FAC72}\Implemented Categories]
    @=""

    [HKEY_CLASSES_ROOT\CLSID\{C1801722-AF34-4312-BEFE-E51ADE4FAC72}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
    @=""

    [HKEY_CLASSES_ROOT\CLSID\{C1801722-AF34-4312-BEFE-E51ADE4FAC72}\InprocServer32]
    @="C:\\WINDOWS\\system32\\nktui2.dll"
    "ThreadingModel"="Apartment"

    Windows Registry Editor Version 5.00

    [HKEY_CLASSES_ROOT\CLSID\{837B32FB-537F-40B7-85C1-0599B8D92247}]
    @=""

    [HKEY_CLASSES_ROOT\CLSID\{837B32FB-537F-40B7-85C1-0599B8D92247}\Implemented Categories]
    @=""

    [HKEY_CLASSES_ROOT\CLSID\{837B32FB-537F-40B7-85C1-0599B8D92247}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
    @=""

    [HKEY_CLASSES_ROOT\CLSID\{837B32FB-537F-40B7-85C1-0599B8D92247}\InprocServer32]
    @="C:\\WINDOWS\\system32\\guard.tmp"
    "ThreadingModel"="Apartment"

    Windows Registry Editor Version 5.00

    [HKEY_CLASSES_ROOT\CLSID\{10C34609-6D99-41D4-B1EF-89D98A25FD27}]
    @=""

    [HKEY_CLASSES_ROOT\CLSID\{10C34609-6D99-41D4-B1EF-89D98A25FD27}\Implemented Categories]
    @=""

    [HKEY_CLASSES_ROOT\CLSID\{10C34609-6D99-41D4-B1EF-89D98A25FD27}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
    @=""

    [HKEY_CLASSES_ROOT\CLSID\{10C34609-6D99-41D4-B1EF-89D98A25FD27}\InprocServer32]
    @="C:\\WINDOWS\\system32\\guard.tmp"
    "ThreadingModel"="Apartment"

    Windows Registry Editor Version 5.00

    [HKEY_CLASSES_ROOT\CLSID\{9F17ED66-B84C-4058-9A7B-03038AF52CFF}]
    @=""

    [HKEY_CLASSES_ROOT\CLSID\{9F17ED66-B84C-4058-9A7B-03038AF52CFF}\Implemented Categories]
    @=""

    [HKEY_CLASSES_ROOT\CLSID\{9F17ED66-B84C-4058-9A7B-03038AF52CFF}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
    @=""

    [HKEY_CLASSES_ROOT\CLSID\{9F17ED66-B84C-4058-9A7B-03038AF52CFF}\InprocServer32]
    @="C:\\WINDOWS\\system32\\dbserver.dll"
    "ThreadingModel"="Apartment"

    Windows Registry Editor Version 5.00

    [HKEY_CLASSES_ROOT\CLSID\{B3EB4BB7-6898-4366-8527-67BB57CF5995}]
    @=""

    [HKEY_CLASSES_ROOT\CLSID\{B3EB4BB7-6898-4366-8527-67BB57CF5995}\Implemented Categories]
    @=""

    [HKEY_CLASSES_ROOT\CLSID\{B3EB4BB7-6898-4366-8527-67BB57CF5995}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
    @=""

    [HKEY_CLASSES_ROOT\CLSID\{B3EB4BB7-6898-4366-8527-67BB57CF5995}\InprocServer32]
    @="C:\\WINDOWS\\system32\\ibv6mon.dll"
    "ThreadingModel"="Apartment"

    Windows Registry Editor Version 5.00

    [HKEY_CLASSES_ROOT\CLSID\{F3E9A8F8-2122-4647-8193-DFB8CB9BFD38}]
    @=""

    [HKEY_CLASSES_ROOT\CLSID\{F3E9A8F8-2122-4647-8193-DFB8CB9BFD38}\Implemented Categories]
    @=""

    [HKEY_CLASSES_ROOT\CLSID\{F3E9A8F8-2122-4647-8193-DFB8CB9BFD38}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
    @=""

    [HKEY_CLASSES_ROOT\CLSID\{F3E9A8F8-2122-4647-8193-DFB8CB9BFD38}\InprocServer32]
    @="C:\\WINDOWS\\system32\\dxmsrpcn.dll"
    "ThreadingModel"="Apartment"

    Windows Registry Editor Version 5.00

    [HKEY_CLASSES_ROOT\CLSID\{12738F5B-C926-4165-A98C-F67309EFDB8D}]
    @=""

    [HKEY_CLASSES_ROOT\CLSID\{12738F5B-C926-4165-A98C-F67309EFDB8D}\Implemented Categories]
    @=""

    [HKEY_CLASSES_ROOT\CLSID\{12738F5B-C926-4165-A98C-F67309EFDB8D}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
    @=""

    [HKEY_CLASSES_ROOT\CLSID\{12738F5B-C926-4165-A98C-F67309EFDB8D}\InprocServer32]
    @="C:\\WINDOWS\\system32\\mdaatext.dll"
    "ThreadingModel"="Apartment"

    Windows Registry Editor Version 5.00

    [HKEY_CLASSES_ROOT\CLSID\{20123D40-B69A-4FC7-964E-D94DD619DA25}]
    @=""

    [HKEY_CLASSES_ROOT\CLSID\{20123D40-B69A-4FC7-964E-D94DD619DA25}\Implemented Categories]
    @=""

    [HKEY_CLASSES_ROOT\CLSID\{20123D40-B69A-4FC7-964E-D94DD619DA25}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
    @=""

    [HKEY_CLASSES_ROOT\CLSID\{20123D40-B69A-4FC7-964E-D94DD619DA25}\InprocServer32]
    @="C:\\WINDOWS\\system32\\guard.tmp"
    "ThreadingModel"="Apartment"

    Windows Registry Editor Version 5.00

    [HKEY_CLASSES_ROOT\CLSID\{37DA1A67-5A59-415F-86D6-0695E8592CA7}]
    @=""

    [HKEY_CLASSES_ROOT\CLSID\{37DA1A67-5A59-415F-86D6-0695E8592CA7}\Implemented Categories]
    @=""

    [HKEY_CLASSES_ROOT\CLSID\{37DA1A67-5A59-415F-86D6-0695E8592CA7}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
    @=""

    [HKEY_CLASSES_ROOT\CLSID\{37DA1A67-5A59-415F-86D6-0695E8592CA7}\InprocServer32]
    @="C:\\WINDOWS\\system32\\cgmpobj.dll"
    "ThreadingModel"="Apartment"

    Windows Registry Editor Version 5.00

    [HKEY_CLASSES_ROOT\CLSID\{877B5B9A-CE56-4A5B-9BAB-FE0462DF7B7C}]
    @=""

    [HKEY_CLASSES_ROOT\CLSID\{877B5B9A-CE56-4A5B-9BAB-FE0462DF7B7C}\Implemented Categories]
    @=""

    [HKEY_CLASSES_ROOT\CLSID\{877B5B9A-CE56-4A5B-9BAB-FE0462DF7B7C}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
    @=""

    [HKEY_CLASSES_ROOT\CLSID\{877B5B9A-CE56-4A5B-9BAB-FE0462DF7B7C}\InprocServer32]
    @="C:\\WINDOWS\\system32\\srcurity.dll"
    "ThreadingModel"="Apartment"

    Windows Registry Editor Version 5.00

    [HKEY_CLASSES_ROOT\CLSID\{0B914558-9339-43BE-9173-46D5629B38A2}]
    @=""

    [HKEY_CLASSES_ROOT\CLSID\{0B914558-9339-43BE-9173-46D5629B38A2}\Implemented Categories]
    @=""

    [HKEY_CLASSES_ROOT\CLSID\{0B914558-9339-43BE-9173-46D5629B38A2}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
    @=""

    [HKEY_CLASSES_ROOT\CLSID\{0B914558-9339-43BE-9173-46D5629B38A2}\InprocServer32]
    @="C:\\WINDOWS\\system32\\mmisip.dll"
    "ThreadingModel"="Apartment"

    Windows Registry Editor Version 5.00

    [HKEY_CLASSES_ROOT\CLSID\{D8E5A654-50E0-4CBC-AF15-DABA25F73F02}]
    @=""

    [HKEY_CLASSES_ROOT\CLSID\{D8E5A654-50E0-4CBC-AF15-DABA25F73F02}\Implemented Categories]
    @=""

    [HKEY_CLASSES_ROOT\CLSID\{D8E5A654-50E0-4CBC-AF15-DABA25F73F02}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
    @=""

    [HKEY_CLASSES_ROOT\CLSID\{D8E5A654-50E0-4CBC-AF15-DABA25F73F02}\InprocServer32]
    @="C:\\WINDOWS\\system32\\nzprint.dll"
    "ThreadingModel"="Apartment"

    Windows Registry Editor Version 5.00

    [HKEY_CLASSES_ROOT\CLSID\{F8B1A498-076B-4E94-B625-DDBAF79B9E0A}]
    @=""

    [HKEY_CLASSES_ROOT\CLSID\{F8B1A498-076B-4E94-B625-DDBAF79B9E0A}\Implemented Categories]
    @=""

    [HKEY_CLASSES_ROOT\CLSID\{F8B1A498-076B-4E94-B625-DDBAF79B9E0A}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
    @=""

    [HKEY_CLASSES_ROOT\CLSID\{F8B1A498-076B-4E94-B625-DDBAF79B9E0A}\InprocServer32]
    @="C:\\WINDOWS\\system32\\oiecli.dll"
    "ThreadingModel"="Apartment"

    Windows Registry Editor Version 5.00

    [HKEY_CLASSES_ROOT\CLSID\{83B890AC-8419-4AD8-B2DB-E7C4201E569F}]
    @=""

    [HKEY_CLASSES_ROOT\CLSID\{83B890AC-8419-4AD8-B2DB-E7C4201E569F}\Implemented Categories]
    @=""

    [HKEY_CLASSES_ROOT\CLSID\{83B890AC-8419-4AD8-B2DB-E7C4201E569F}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
    @=""

    [HKEY_CLASSES_ROOT\CLSID\{83B890AC-8419-4AD8-B2DB-E7C4201E569F}\InprocServer32]
    @="C:\\WINDOWS\\system32\\dpactfrm.dll"
    "ThreadingModel"="Apartment"

    Windows Registry Editor Version 5.00

    [HKEY_CLASSES_ROOT\CLSID\{F988377B-3034-4490-94F9-5F5E011C3CED}]
    @=""

    [HKEY_CLASSES_ROOT\CLSID\{F988377B-3034-4490-94F9-5F5E011C3CED}\Implemented Categories]
    @=""

    [HKEY_CLASSES_ROOT\CLSID\{F988377B-3034-4490-94F9-5F5E011C3CED}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
    @=""

    [HKEY_CLASSES_ROOT\CLSID\{F988377B-3034-4490-94F9-5F5E011C3CED}\InprocServer32]
    @="C:\\WINDOWS\\system32\\ozbc16gt.dll"
    "ThreadingModel"="Apartment"

    Windows Registry Editor Version 5.00

    [HKEY_CLASSES_ROOT\CLSID\{7F8F0D01-F3EC-4376-8A89-473C787C666D}]
    @=""

    [HKEY_CLASSES_ROOT\CLSID\{7F8F0D01-F3EC-4376-8A89-473C787C666D}\Implemented Categories]
    @=""

    [HKEY_CLASSES_ROOT\CLSID\{7F8F0D01-F3EC-4376-8A89-473C787C666D}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
    @=""

    [HKEY_CLASSES_ROOT\CLSID\{7F8F0D01-F3EC-4376-8A89-473C787C666D}\InprocServer32]
    @="C:\\WINDOWS\\system32\\sqdoclc.dll"
    "ThreadingModel"="Apartment"

    Windows Registry Editor Version 5.00

    [HKEY_CLASSES_ROOT\CLSID\{E8502DE9-6C78-4BF2-AFF3-181763BF15A3}]
    @=""

    [HKEY_CLASSES_ROOT\CLSID\{E8502DE9-6C78-4BF2-AFF3-181763BF15A3}\Implemented Categories]
    @=""

    [HKEY_CLASSES_ROOT\CLSID\{E8502DE9-6C78-4BF2-AFF3-181763BF15A3}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
    @=""

    [HKEY_CLASSES_ROOT\CLSID\{E8502DE9-6C78-4BF2-AFF3-181763BF15A3}\InprocServer32]
    @="C:\\WINDOWS\\system32\\mqrecr40.dll"
    "ThreadingModel"="Apartment"

    Windows Registry Editor Version 5.00

    [HKEY_CLASSES_ROOT\CLSID\{3C64B6A8-BDFE-47A8-8B14-81688BB75D53}]
    @=""

    [HKEY_CLASSES_ROOT\CLSID\{3C64B6A8-BDFE-47A8-8B14-81688BB75D53}\Implemented Categories]
    @=""

    [HKEY_CLASSES_ROOT\CLSID\{3C64B6A8-BDFE-47A8-8B14-81688BB75D53}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
    @=""

    [HKEY_CLASSES_ROOT\CLSID\{3C64B6A8-BDFE-47A8-8B14-81688BB75D53}\InprocServer32]
    @="C:\\WINDOWS\\system32\\lvghours.dll"
    "ThreadingModel"="Apartment"

    Windows Registry Editor Version 5.00

    [HKEY_CLASSES_ROOT\CLSID\{3DD11F13-4F6A-4F2D-BB01-51FC8FDF658C}]
    @=""

    [HKEY_CLASSES_ROOT\CLSID\{3DD11F13-4F6A-4F2D-BB01-51FC8FDF658C}\Implemented Categories]
    @=""

    [HKEY_CLASSES_ROOT\CLSID\{3DD11F13-4F6A-4F2D-BB01-51FC8FDF658C}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
    @=""

    [HKEY_CLASSES_ROOT\CLSID\{3DD11F13-4F6A-4F2D-BB01-51FC8FDF658C}\InprocServer32]
    @="C:\\WINDOWS\\system32\\mfwdat10.dll"
    "ThreadingModel"="Apartment"

    Windows Registry Editor Version 5.00

    [HKEY_CLASSES_ROOT\CLSID\{001BE213-639A-404B-8ADE-22EFC7CAB2B9}]
    @=""

    [HKEY_CLASSES_ROOT\CLSID\{001BE213-639A-404B-8ADE-22EFC7CAB2B9}\Implemented Categories]
    @=""

    [HKEY_CLASSES_ROOT\CLSID\{001BE213-639A-404B-8ADE-22EFC7CAB2B9}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
    @=""

    [HKEY_CLASSES_ROOT\CLSID\{001BE213-639A-404B-8ADE-22EFC7CAB2B9}\InprocServer32]
    @="C:\\WINDOWS\\system32\\chmpobj.dll"
    "ThreadingModel"="Apartment"

    Windows Registry Editor Version 5.00

    [HKEY_CLASSES_ROOT\CLSID\{D87DF34C-E28F-4D4D-B81B-685C1D2D5AE2}]
    @=""

    [HKEY_CLASSES_ROOT\CLSID\{D87DF34C-E28F-4D4D-B81B-685C1D2D5AE2}\Implemented Categories]
    @=""

    [HKEY_CLASSES_ROOT\CLSID\{D87DF34C-E28F-4D4D-B81B-685C1D2D5AE2}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
    @=""

    [HKEY_CLASSES_ROOT\CLSID\{D87DF34C-E28F-4D4D-B81B-685C1D2D5AE2}\InprocServer32]
    @="C:\\WINDOWS\\system32\\silwoa.dll"
    "ThreadingModel"="Apartment"

    Windows Registry Editor Version 5.00

    [HKEY_CLASSES_ROOT\CLSID\{96002481-697A-47D7-B549-BE61C39648B0}]
    @=""

    [HKEY_CLASSES_ROOT\CLSID\{96002481-697A-47D7-B549-BE61C39648B0}\Implemented Categories]
    @=""

    [HKEY_CLASSES_ROOT\CLSID\{96002481-697A-47D7-B549-BE61C39648B0}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
    @=""

    [HKEY_CLASSES_ROOT\CLSID\{96002481-697A-47D7-B549-BE61C39648B0}\InprocServer32]
    @="C:\\WINDOWS\\system32\\kddhept.dll"
    "ThreadingModel"="Apartment"

    Windows Registry Editor Version 5.00

    [HKEY_CLASSES_ROOT\CLSID\{6BF4CCDA-1BD3-4F65-A974-0E734EFB6C24}]
    @=""

    [HKEY_CLASSES_ROOT\CLSID\{6BF4CCDA-1BD3-4F65-A974-0E734EFB6C24}\Implemented Categories]
    @=""

    [HKEY_CLASSES_ROOT\CLSID\{6BF4CCDA-1BD3-4F65-A974-0E734EFB6C24}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
    @=""

    [HKEY_CLASSES_ROOT\CLSID\{6BF4CCDA-1BD3-4F65-A974-0E734EFB6C24}\InprocServer32]
    @="C:\\WINDOWS\\system32\\dzcpcsvc.dll"
    "ThreadingModel"="Apartment"

    Windows Registry Editor Version 5.00

    [HKEY_CLASSES_ROOT\CLSID\{0275A895-D7DF-446E-BBBE-4ACE60F64B82}]
    @=""

    [HKEY_CLASSES_ROOT\CLSID\{0275A895-D7DF-446E-BBBE-4ACE60F64B82}\Implemented Categories]
    @=""

    [HKEY_CLASSES_ROOT\CLSID\{0275A895-D7DF-446E-BBBE-4ACE60F64B82}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
    @=""

    [HKEY_CLASSES_ROOT\CLSID\{0275A895-D7DF-446E-BBBE-4ACE60F64B82}\InprocServer32]
    @="C:\\WINDOWS\\system32\\guard.tmp"
    "ThreadingModel"="Apartment"

    Windows Registry Editor Version 5.00

    [HKEY_CLASSES_ROOT\CLSID\{826EC28E-7525-4F8C-8D5E-72E6E4EFEFE4}]
    @=""

    [HKEY_CLASSES_ROOT\CLSID\{826EC28E-7525-4F8C-8D5E-72E6E4EFEFE4}\Implemented Categories]
    @=""

    [HKEY_CLASSES_ROOT\CLSID\{826EC28E-7525-4F8C-8D5E-72E6E4EFEFE4}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
    @=""

    [HKEY_CLASSES_ROOT\CLSID\{826EC28E-7525-4F8C-8D5E-72E6E4EFEFE4}\InprocServer32]
    @="C:\\WINDOWS\\system32\\kpdmon.dll"
    "ThreadingModel"="Apartment"

    Windows Registry Editor Version 5.00

    [HKEY_CLASSES_ROOT\CLSID\{E24E67D3-0351-449C-9C6E-9BE37D9E3D91}]
    @=""

    [HKEY_CLASSES_ROOT\CLSID\{E24E67D3-0351-449C-9C6E-9BE37D9E3D91}\Implemented Categories]
    @=""

    [HKEY_CLASSES_ROOT\CLSID\{E24E67D3-0351-449C-9C6E-9BE37D9E3D91}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
    @=""

    [HKEY_CLASSES_ROOT\CLSID\{E24E67D3-0351-449C-9C6E-9BE37D9E3D91}\InprocServer32]
    @="C:\\WINDOWS\\system32\\npobjapi.dll"
    "ThreadingModel"="Apartment"

    Windows Registry Editor Version 5.00

    [HKEY_CLASSES_ROOT\CLSID\{747310C2-6609-4CA8-8A4C-B75C1075C97A}]
    @=""

    [HKEY_CLASSES_ROOT\CLSID\{747310C2-6609-4CA8-8A4C-B75C1075C97A}\Implemented Categories]
    @=""

    [HKEY_CLASSES_ROOT\CLSID\{747310C2-6609-4CA8-8A4C-B75C1075C97A}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
    @=""

    [HKEY_CLASSES_ROOT\CLSID\{747310C2-6609-4CA8-8A4C-B75C1075C97A}\InprocServer32]
    @="C:\\WINDOWS\\system32\\nrapi16.dll"
    "ThreadingModel"="Apartment"

    Windows Registry Editor Version 5.00

    [HKEY_CLASSES_ROOT\CLSID\{61D3B9F2-6F1B-4DE2-89E4-369B8E61DE63}]
    @=""

    [HKEY_CLASSES_ROOT\CLSID\{61D3B9F2-6F1B-4DE2-89E4-369B8E61DE63}\Implemented Categories]
    @=""

    [HKEY_CLASSES_ROOT\CLSID\{61D3B9F2-6F1B-4DE2-89E4-369B8E61DE63}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
    @=""

    [HKEY_CLASSES_ROOT\CLSID\{61D3B9F2-6F1B-4DE2-89E4-369B8E61DE63}\InprocServer32]
    @="C:\\WINDOWS\\system32\\swftpub.dll"
    "ThreadingModel"="Apartment"

    Windows Registry Editor Version 5.00

    [HKEY_CLASSES_ROOT\CLSID\{00B39376-26B2-46C0-81A5-71171D8A299C}]
    @=""

    [HKEY_CLASSES_ROOT\CLSID\{00B39376-26B2-46C0-81A5-71171D8A299C}\Implemented Categories]
    @=""

    [HKEY_CLASSES_ROOT\CLSID\{00B39376-26B2-46C0-81A5-71171D8A299C}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
    @=""

    [HKEY_CLASSES_ROOT\CLSID\{00B39376-26B2-46C0-81A5-71171D8A299C}\InprocServer32]
    @="C:\\WINDOWS\\system32\\fTultrep.dll"
    "ThreadingModel"="Apartment"

    Windows Registry Editor Version 5.00

    [HKEY_CLASSES_ROOT\CLSID\{1EEF2096-A5FF-4ED4-9F46-40BADD259336}]
    @=""

    [HKEY_CLASSES_ROOT\CLSID\{1EEF2096-A5FF-4ED4-9F46-40BADD259336}\Implemented Categories]
    @=""

    [HKEY_CLASSES_ROOT\CLSID\{1EEF2096-A5FF-4ED4-9F46-40BADD259336}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
    @=""

    [HKEY_CLASSES_ROOT\CLSID\{1EEF2096-A5FF-4ED4-9F46-40BADD259336}\InprocServer32]
    @="C:\\WINDOWS\\system32\\desapi.dll"
    "ThreadingModel"="Apartment"

    Windows Registry Editor Version 5.00

    [HKEY_CLASSES_ROOT\CLSID\{6426F663-3413-4657-B9AF-4D2349BBC6F3}]
    @=""

    [HKEY_CLASSES_ROOT\CLSID\{6426F663-3413-4657-B9AF-4D2349BBC6F3}\Implemented Categories]
    @=""

    [HKEY_CLASSES_ROOT\CLSID\{6426F663-3413-4657-B9AF-4D2349BBC6F3}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
    @=""

    [HKEY_CLASSES_ROOT\CLSID\{6426F663-3413-4657-B9AF-4D2349BBC6F3}\InprocServer32]
    @="C:\\WINDOWS\\system32\\miiqtz32.dll"
    "ThreadingModel"="Apartment"

    Windows Registry Editor Version 5.00

    [HKEY_CLASSES_ROOT\CLSID\{AE9E9485-69EC-47D4-8C9D-80A6CF9A1A0A}]
    @=""

    [HKEY_CLASSES_ROOT\CLSID\{AE9E9485-69EC-47D4-8C9D-80A6CF9A1A0A}\Implemented Categories]
    @=""

    [HKEY_CLASSES_ROOT\CLSID\{AE9E9485-69EC-47D4-8C9D-80A6CF9A1A0A}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
    @=""

    [HKEY_CLASSES_ROOT\CLSID\{AE9E9485-69EC-47D4-8C9D-80A6CF9A1A0A}\InprocServer32]
    @="C:\\WINDOWS\\system32\\snayerxp.dll"
    "ThreadingModel"="Apartment"

    Windows Registry Editor Version 5.00

    [HKEY_CLASSES_ROOT\CLSID\{3424E7C6-7E44-4F50-9053-4429C62F8179}]
    @=""

    [HKEY_CLASSES_ROOT\CLSID\{3424E7C6-7E44-4F50-9053-4429C62F8179}\Implemented Categories]
    @=""

    [HKEY_CLASSES_ROOT\CLSID\{3424E7C6-7E44-4F50-9053-4429C62F8179}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
    @=""

    [HKEY_CLASSES_ROOT\CLSID\{3424E7C6-7E44-4F50-9053-4429C62F8179}\InprocServer32]
    @="C:\\WINDOWS\\system32\\shbcsp.dll"
    "ThreadingModel"="Apartment"

    Windows Registry Editor Version 5.00

    [HKEY_CLASSES_ROOT\CLSID\{F7D90A67-852A-4774-8DE1-D69BCA65E7CF}]
    @=""

    [HKEY_CLASSES_ROOT\CLSID\{F7D90A67-852A-4774-8DE1-D69BCA65E7CF}\Implemented Categories]
    @=""

    [HKEY_CLASSES_ROOT\CLSID\{F7D90A67-852A-4774-8DE1-D69BCA65E7CF}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
    @=""

    [HKEY_CLASSES_ROOT\CLSID\{F7D90A67-852A-4774-8DE1-D69BCA65E7CF}\InprocServer32]
    @="C:\\WINDOWS\\system32\\IiagXpr6.dll"
    "ThreadingModel"="Apartment"

    Windows Registry Editor Version 5.00

    [HKEY_CLASSES_ROOT\CLSID\{C4961849-209A-455B-8E16-D4F9CD53DB74}]
    @=""

    [HKEY_CLASSES_ROOT\CLSID\{C4961849-209A-455B-8E16-D4F9CD53DB74}\Implemented Categories]
    @=""

    [HKEY_CLASSES_ROOT\CLSID\{C4961849-209A-455B-8E16-D4F9CD53DB74}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
    @=""

    [HKEY_CLASSES_ROOT\CLSID\{C4961849-209A-455B-8E16-D4F9CD53DB74}\InprocServer32]
    @="C:\\WINDOWS\\system32\\cKpesnpn.dll"
    "ThreadingModel"="Apartment"

    **********************************************************************************
    Files Found are not all bad files:

    C:\WINDOWS\SYSTEM32\
    wrlogo~1.dll Wed 14 Dec 2005 19:25:10 A.... 492.544 481,00 K

    1 item found: 1 file, 0 directories.
    Total of file sizes: 492.544 bytes 481,00 K
    Locate .tmp files:

    No matches found.
    **********************************************************************************
    Directory Listing of system files:
    Le volume dans le lecteur C n'a pas de nom.
    Le num‚ro de s‚rie du volume est 0B20-14FA

    R‚pertoire de C:\WINDOWS\System32

    13/10/2005 17:05 <REP> Microsoft
    10/10/2005 13:41 <REP> dllcache
    0 fichier(s) 0 octets
    2 R‚p(s) 33.703.264.256 octets libres

    HijackThis

    Logfile of HijackThis v1.99.1
    Scan saved at 12:09:05, on 10/03/2006
    Platform: Windows XP (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 (6.00.2600.0000)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
    C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
    C:\ewido anti-malware\ewidoctrl.exe
    C:\ewido anti-malware\ewidoguard.exe
    C:\Sunbelt Software\Personal Firewall 4\kpf4ss.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe
    C:\Sunbelt Software\Personal Firewall 4\kpf4gui.exe
    C:\WINDOWS\Explorer.EXE
    C:\Sunbelt Software\Personal Firewall 4\kpf4gui.exe
    C:\PROGRA~1\MediaKey\MediaKey.EXE
    C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
    C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
    C:\WINDOWS\System32\rundll32.exe
    C:\WINDOWS\System32\NotifyPhoneBook.exe
    C:\Adobe\Photoshop Album Edition Découverte\3.0\Apps\apdproxy.exe
    C:\Program Files\QuickTime\qttask.exe
    C:\Program Files\Java\jre1.5.0\bin\jusched.exe
    C:\WINDOWS\System32\ctfmon.exe
    C:\Program Files\Messenger\msmsgs.exe
    C:\Program Files\WinZip\WZQKPICK.EXE
    C:\WINDOWS\twain_32\A4CIS\WATCH.exe
    C:\NaturallySpeaking\Program\natspeak.exe
    C:\Program Files\Internet Explorer\IEXPLORE.EXE
    C:\Hijackthis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.be/
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
    O4 - HKLM\..\Run: [MediaKey] C:\PROGRA~1\MediaKey\MediaKey.EXE
    O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
    O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [AME_CSA] rundll32 amecsa.cpl,RUN_DLL
    O4 - HKLM\..\Run: [CloseDNF] C:\WINDOWS\System32\Utility.exe \1008
    O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Adobe\Photoshop Album Edition Découverte\3.0\Apps\apdproxy.exe"
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [system_service] drivers32.exe
    O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0\bin\jusched.exe
    O4 - HKLM\..\RunServices: [system_service] drivers32.exe
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
    O4 - HKCU\..\Run: [WINSOS VERIFY] "C:\Program Files\WINSOS\WINSOS.EXE" MINI
    O4 - HKCU\..\RunServices: [Windows Service] windowz.exe
    O4 - Startup: Watch.lnk = C:\WINDOWS\twain_32\A4CIS\WATCH.exe
    O4 - Startup: Dragon NaturallySpeaking.lnk = C:\NaturallySpeaking\Program\natspeak.exe
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
    O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
    O8 - Extra context menu item: &Traduire à partir de l'anglais - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html
    O8 - Extra context menu item: Pages liées - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
    O8 - Extra context menu item: Pages similaires - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
    O8 - Extra context menu item: Recherche &Google - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
    O8 - Extra context menu item: Version de la page actuelle disponible dans le cache Google - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll
    O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll
    O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
    O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
    O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan8/oscan8.cab
    O17 - HKLM\System\CCS\Services\Tcpip\..\{84648578-34D6-4E17-A1CA-973F72E85B71}: NameServer = 195.238.2.21 195.238.2.22
    O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
    O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
    O23 - Service: Boonty Games - BOONTY - C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe
    O23 - Service: ewido security suite control - ewido networks - C:\ewido anti-malware\ewidoctrl.exe
    O23 - Service: ewido security suite guard - ewido networks - C:\ewido anti-malware\ewidoguard.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: Sunbelt Kerio Personal Firewall 4 (KPF4) - Sunbelt Software - C:\Sunbelt Software\Personal Firewall 4\kpf4ss.exe
    O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
    O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe
    O23 - Service: Win32Sr - Unknown owner - C:\WINDOWS\win32ssr.exe (file missing)

    SmitFraudFix

    SmitFraudFix v2.23

    Rapport fait à 12:12:06,60 le ven. 10/03/2006
    Executé à partir de C:\attente\protection\d‚pannage\smitfraudFix\SmitfraudFix
    OS: Microsoft Windows XP [version 5.1.2600]

    »»»»»»»»»»»»»»»»»»»»»»»» Recherche C:\

    »»»»»»»»»»»»»»»»»»»»»»»» Recherche C:\WINDOWS

    »»»»»»»»»»»»»»»»»»»»»»»» Recherche C:\WINDOWS\system

    »»»»»»»»»»»»»»»»»»»»»»»» Recherche C:\WINDOWS\Web

    »»»»»»»»»»»»»»»»»»»»»»»» Recherche C:\WINDOWS\system32

    »»»»»»»»»»»»»»»»»»»»»»»» Recherche ...\Application Data

    »»»»»»»»»»»»»»»»»»»»»»»» Recherche Menu Démarrer

    »»»»»»»»»»»»»»»»»»»»»»»» Recherche Bureau

    »»»»»»»»»»»»»»»»»»»»»»»» Recherche C:\Program Files

    »»»»»»»»»»»»»»»»»»»»»»»» Recherche présence de clés corrompues

    »»»»»»»»»»»»»»»»»»»»»»»» Recherche éléments du bureau

    »»»»»»»»»»»»»»»»»»»»»»»» Recherche Sharedtaskscheduler

    SrchSTS.exe by S!Ri
    Search SharedTaskScheduler's .dll

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
    "{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Pré-chargeur Browseui"

    [HKEY_CLASSES_ROOT\CLSID\{438755C2-A8BA-11D1-B96B-00A0C90312E1}\InProcServer32]
    @="%SystemRoot%\System32\browseui.dll"

    [HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{438755C2-A8BA-11D1-B96B-00A0C90312E1}\InProcServer32]
    @="%SystemRoot%\System32\browseui.dll"

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
    "{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Démon de cache des catégories de composant"

    [HKEY_CLASSES_ROOT\CLSID\{8C7461EF-2B13-11d2-BE35-3078302C2030}\InProcServer32]
    @="%SystemRoot%\System32\browseui.dll"

    [HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{8C7461EF-2B13-11d2-BE35-3078302C2030}\InProcServer32]
    @="%SystemRoot%\System32\browseui.dll"

    »»»»»»»»»»»»»»»»»»»»»»»» Recherche infection wininet.dll

    »»»»»»»»»»»»»»»»»»»»»»»» Fin du rapport

    J'espère qu'après ceci, il n'y a plus rien.

    Un grand merci et encore toutes mes excuses pour mon entrée en matière quelque peu cavalière.
    0
  7. aranjuez31 Messages postés 8161 Date d'inscription   Statut Contributeur 354
     
    hello

    lm2fix correct - pas besoin de passer l option 2
    ========================
    un ti nettoyage
    smitfraud
    http://siri.urz.free.fr/Fix/SmitfraudFix.php
    ----------------------------------------------------------------------------
    Démarre en mode sans échec :
    Pour cela, tu tapotes la touche F8 dès le début de l’allumage du PC sans t’arrêter
    Une fenêtre va s’ouvrir tu te déplaces avec les flèches du clavier sur démarrer en mode sans échec puis tape entrée.
    Une fois sur le bureau s’il n’y a pas toutes les couleurs et autres c’est normal !
    (Si F8 ne marche pas utilise la touche F5).
    ----------------------------------------------------------------------------
    Relance le programme Smitfraud,
    Cette fois choisit l’option 2, répond oui a tous ;
    Sauvegarde le rapport, redémarre en mode normal, copie-colle le rapport sauvegardé sur le forum.
    =====================
    ras sur ton log
    =====================
    as-tu tjrs des blems ?
    0
  8. André B.
     
    J'ai comme l'impression que c'est la dernière fois que je te contacte. Tout semble bien se passer.
    Tu m'as été d'un grand secours. Mille fois merci.

    SmitFraudFix v2.23

    Rapport fait à 23:38:00,84 le ven. 10/03/2006
    Executé à partir de C:\attente\protection\d‚pannage\smitfraudFix\SmitfraudFix
    OS: Microsoft Windows XP [version 5.1.2600]

    »»»»»»»»»»»»»»»»»»»»»»»» Arret des processus

    »»»»»»»»»»»»»»»»»»»»»»»» Suppression des fichiers infectés

    »»»»»»»»»»»»»»»»»»»»»»»» Nettoyage Fichiers Temporaires

    »»»»»»»»»»»»»»»»»»»»»»»» Nettoyage du registre

    Nettoyage terminé.

    »»»»»»»»»»»»»»»»»»»»»»»» Fin du rapport
    0
  9. aranjuez31 Messages postés 8161 Date d'inscription   Statut Contributeur 354
     
    Inch'Allah
    0

Discussions similaires

Huawei P8 Lite "nouveau tag ajouté"
ArianeKathleen -
Mn -

25 réponses
Nouveau tag ajouté | Nouvelle option activé sans permission?
BountyFullChest -
CCMBot -

1 réponse
Nouveau tag ajouté - Utilité
Eerfers -
madmyke -

1 réponse
Google Chrome "  Échec de l'analyse antivirus "
jmpower -
RBmoon -

18 réponses
" Échec de l'analyse antivirus " la solution.
bazfile -
bazfile -

0 réponse