Virus Win64/Patched.A et Luhe.Sirefef.A?

pokchips -  
Fish66 Messages postés 18337 Statut Contributeur sécurité -
Bonjour,

J'ai en détection ces deux jolies virus qui me prenne pas mal la tête + le backdoor.generic16 aussi. Résultat mon ordi est très très vérolé sachant que je n'arrive même pas a lancé le mode sans echec pour supprimer les clés de registres... Car F5 ouF8 ou F11 ne fonctionne pas au démarage...

voici le rapport obtenu avec OTL :

http://pjjoint.malekal.com/files.php?id=20130117_w5y14f5l14l15

Merci d'avance de votre aide !!

5 réponses

  1.
    Fish66 Messages postés 18337 Statut Contributeur sécurité 1 318
     
    Salut,
    Avant d'utiliser ComboFix :

    Les logiciels d'émulation de CD comme Daemon Tools peuvent gêner les outils de désinfection. Utilise Defogger pour les désactiver temporairement :

    si tu as ce genre de d'outils sur ton pc Utilise Defogger pour les désactiver temporairement : sinon passe directement à combofix

    * Télécharge Defogger (de jpshortstuff) sur ton Bureau
    * Lance le

    * Une fenêtre apparait : clique sur "Disable"

    * Fais redémarrer l'ordinateur si l'outil te le demande

    Note : Quand nous aurons terminé la désinfection, tu pourras réactiver ces logiciels en relançant Defogger et en cliquant sur "Re-enable"

    ===================================================

    Attention, avant de commencer, lis attentivement la procédure

    ********************************************************

    /!\ Ne pas utiliser ce logiciel en dehors du cadre de cette désinfection : DANGEUREUX /!\

    * Fais un clic droit sur ce lien, enregistre le dans ton bureau sous un autre nom exemple « ton pseudo.exe »
    Voici Aide combofix

    * /!\ Déconnecte-toi du net et ARRÊTE TES LOGICIELS DE PROTECTION /!\


    *Double-clique sur ComboFix.exe (ou exécuter en tant qu'administrateur pour vista et seven)

    Un "pop-up" va apparaître qui dit que ComboFix est utilisé à vos risques et avec aucune garantie... Clique sur oui pour accepter

    ** SURTOUT INSTALLES LA CONSOLE DE RECUPERATION
    (si il te propose de l'installer remets internet)

    ? Ne touche à rien(souris, clavier) tant que le scan n'est pas terminé, car tu risques de planter ton PC

    *En fin de scan, il est possible que ComboFix ait besoin de redémarrer le PC pour finaliser la désinfection, laisse-le faire.

    * Une fois le scan achevé, un rapport va s'afficher : Poste son contenu

    ** /!\ Réactive la protection en temps réel de ton antivirus et de ton antispyware avant de te reconnecter à Internet. /!\

    *Note : Le rapport se trouve également là : C:\ComboFix.txt
    0
  2. pokchips
     
    Bonjour,

    J'ai semble t'il correctemetn utilisé combo fix car de nombreuses clés du registres sont maintenant manquante et notamment le registre concernant les connection internet... En effet je ne peux plus me connecter a internet que ce soit en filaire ou en wifi...

    Voici le rapport de combofix ci dessous, merci d'avance pour la marche a suivre pour restaurer mon registre et ainsi pouvoir réutiliser internet

    Cordialement

    ComboFix 13-01-22.01 - Etienne 22/01/2013 18:41:35.2.4 - x64
    Microsoft Windows 7 Professionnel 6.1.7601.1.1252.33.1036.18.7862.6062 [GMT 1:00]
    Lancé depuis: c:\users\Etienne\Desktop\ComboFix.exe
    AV: AVG Anti-Virus 2013 *Enabled/Updated* {0E9420C4-06B3-7FA0-3AB1-6E49CB52ECD9}
    AV: Trend Micro Security Agent *Disabled/Updated* {68F968AC-2AA0-091D-848C-803E83E35902}
    SP: AVG Anti-Virus 2013 *Enabled/Updated* {B5F5C120-2089-702E-0001-553BB0D5A664}
    SP: Trend Micro Security Agent *Disabled/Updated* {D3988948-0C9A-0693-BE3C-BB4CF86413BF}
    SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
    .
    .
    (((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    ---- Exécution préalable -------
    .
    C:\Install.exe
    c:\programdata\Roaming
    c:\users\Etienne\AppData\Local\Temp\win32\svchost2.exe
    c:\users\Etienne\AppData\Roaming\.#
    c:\users\Etienne\AppData\Roaming\FrameWork\Worker
    c:\users\Etienne\AppData\Roaming\system32
    c:\users\Etienne\AppData\Roaming\Win32
    c:\windows\assembly\GAC_32\Desktop.ini
    c:\windows\assembly\GAC_64\Desktop.ini
    c:\windows\Installer\{85000b3e-e895-2be8-0880-54450005b1fd}\@
    c:\windows\Installer\{85000b3e-e895-2be8-0880-54450005b1fd}\L\00000004.@
    c:\windows\Installer\{85000b3e-e895-2be8-0880-54450005b1fd}\L\201d3dde
    c:\windows\Installer\{85000b3e-e895-2be8-0880-54450005b1fd}\L\76603ac3
    c:\windows\Installer\{85000b3e-e895-2be8-0880-54450005b1fd}\U\00000004.@
    c:\windows\Installer\{85000b3e-e895-2be8-0880-54450005b1fd}\U\00000008.@
    c:\windows\Installer\{85000b3e-e895-2be8-0880-54450005b1fd}\U\000000cb.@
    c:\windows\Installer\{85000b3e-e895-2be8-0880-54450005b1fd}\U\80000000.@
    c:\windows\Installer\{85000b3e-e895-2be8-0880-54450005b1fd}\U\80000032.@
    c:\windows\Installer\{85000b3e-e895-2be8-0880-54450005b1fd}\U\80000064.@
    .
    .
    ((((((((((((((((((((((((((((( Fichiers créés du 2012-12-22 au 2013-01-22 ))))))))))))))))))))))))))))))))))))
    .
    .
    2013-01-22 17:44 . 2013-01-22 17:44 -------- d-----w- c:\users\Default\AppData\Local\temp
    2013-01-17 09:52 . 2013-01-17 09:52 512 ----a-w- C:\PhysicalMBR.bin
    2013-01-16 18:20 . 2013-01-16 18:22 -------- d-----w- C:\TDSSKiller_Quarantine
    2013-01-16 17:26 . 2013-01-16 17:26 -------- d-----w- c:\users\Etienne\AppData\Roaming\AVG2013
    2013-01-16 17:25 . 2013-01-16 17:25 -------- d-----w- c:\users\Etienne\AppData\Roaming\TuneUp Software
    2013-01-16 17:25 . 2013-01-16 18:20 -------- d-----w- c:\programdata\AVG2013
    2013-01-16 17:25 . 2013-01-16 17:25 -------- d-----w- C:\$AVG
    2013-01-16 17:25 . 2013-01-16 17:25 -------- d-----w- c:\program files (x86)\AVG
    2013-01-16 17:23 . 2013-01-22 16:50 -------- d-----w- c:\programdata\MFAData
    2013-01-16 17:23 . 2013-01-16 17:43 -------- d-----w- c:\users\Etienne\AppData\Local\Avg2013
    2013-01-16 17:23 . 2013-01-16 17:23 -------- d--h--w- c:\programdata\Common Files
    2013-01-16 17:23 . 2013-01-16 17:23 -------- d-----w- c:\users\Etienne\AppData\Local\MFAData
    2013-01-12 13:05 . 2013-01-12 13:05 -------- d-sh--w- c:\windows\SysWow64\%APPDATA%
    2013-01-01 22:12 . 2012-11-08 17:24 9125352 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{E5FD626C-E460-463E-A61B-B9247F4118E7}\mpengine.dll
    2012-12-26 02:00 . 2012-12-16 17:11 46080 ----a-w- c:\windows\system32\atmlib.dll
    2012-12-26 02:00 . 2012-12-16 14:45 367616 ----a-w- c:\windows\system32\atmfd.dll
    2012-12-26 02:00 . 2012-12-16 14:13 295424 ----a-w- c:\windows\SysWow64\atmfd.dll
    2012-12-26 02:00 . 2012-12-16 14:13 34304 ----a-w- c:\windows\SysWow64\atmlib.dll
    .
    .
    .
    (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2013-01-22 17:39 . 2012-02-15 09:27 22368 ----a-w- c:\windows\system32\drivers\AFD.SYS
    2013-01-22 17:39 . 2009-07-14 00:10 22368 ----a-w- c:\windows\system32\drivers\WS2IFSL.SYS
    2013-01-11 02:01 . 2010-07-18 23:34 67599240 ----a-w- c:\windows\system32\MRT.exe
    2013-01-10 19:13 . 2012-04-04 16:10 697864 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
    2013-01-10 19:13 . 2011-05-13 12:10 74248 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
    2012-11-30 04:45 . 2013-01-09 18:43 44032 ----a-w- c:\windows\apppatch\acwow64.dll
    2012-11-15 22:33 . 2012-11-15 22:33 111968 ----a-w- c:\windows\system32\drivers\avgmfx64.sys
    2012-11-14 07:06 . 2012-12-16 02:00 17811968 ----a-w- c:\windows\system32\mshtml.dll
    2012-11-14 06:32 . 2012-12-16 02:00 10925568 ----a-w- c:\windows\system32\ieframe.dll
    2012-11-14 06:11 . 2012-12-16 02:00 2312704 ----a-w- c:\windows\system32\jscript9.dll
    2012-11-14 06:04 . 2012-12-16 02:00 1346048 ----a-w- c:\windows\system32\urlmon.dll
    2012-11-14 06:04 . 2012-12-16 02:00 1392128 ----a-w- c:\windows\system32\wininet.dll
    2012-11-14 06:02 . 2012-12-16 02:00 1494528 ----a-w- c:\windows\system32\inetcpl.cpl
    2012-11-14 06:02 . 2012-12-16 02:00 237056 ----a-w- c:\windows\system32\url.dll
    2012-11-14 05:59 . 2012-12-16 02:00 85504 ----a-w- c:\windows\system32\jsproxy.dll
    2012-11-14 05:58 . 2012-12-16 02:00 816640 ----a-w- c:\windows\system32\jscript.dll
    2012-11-14 05:57 . 2012-12-16 02:00 599040 ----a-w- c:\windows\system32\vbscript.dll
    2012-11-14 05:57 . 2012-12-16 02:00 173056 ----a-w- c:\windows\system32\ieUnatt.exe
    2012-11-14 05:55 . 2012-12-16 02:00 2144768 ----a-w- c:\windows\system32\iertutil.dll
    2012-11-14 05:55 . 2012-12-16 02:00 729088 ----a-w- c:\windows\system32\msfeeds.dll
    2012-11-14 05:53 . 2012-12-16 02:00 96768 ----a-w- c:\windows\system32\mshtmled.dll
    2012-11-14 05:52 . 2012-12-16 02:00 2382848 ----a-w- c:\windows\system32\mshtml.tlb
    2012-11-14 05:46 . 2012-12-16 02:00 248320 ----a-w- c:\windows\system32\ieui.dll
    2012-11-14 02:09 . 2012-12-16 02:00 1800704 ----a-w- c:\windows\SysWow64\jscript9.dll
    2012-11-14 01:58 . 2012-12-16 02:00 1427968 ----a-w- c:\windows\SysWow64\inetcpl.cpl
    2012-11-14 01:57 . 2012-12-16 02:00 1129472 ----a-w- c:\windows\SysWow64\wininet.dll
    2012-11-14 01:49 . 2012-12-16 02:00 142848 ----a-w- c:\windows\SysWow64\ieUnatt.exe
    2012-11-14 01:48 . 2012-12-16 02:00 420864 ----a-w- c:\windows\SysWow64\vbscript.dll
    2012-11-14 01:44 . 2012-12-16 02:00 2382848 ----a-w- c:\windows\SysWow64\mshtml.tlb
    2012-11-13 20:29 . 2012-11-13 20:29 354216 ----a-w- c:\windows\SysWow64\DivXControlPanelApplet.cpl
    2012-11-09 05:45 . 2012-12-13 08:29 2048 ----a-w- c:\windows\system32\tzres.dll
    2012-11-09 04:42 . 2012-12-13 08:29 2048 ----a-w- c:\windows\SysWow64\tzres.dll
    2012-11-02 05:59 . 2012-12-13 08:29 478208 ----a-w- c:\windows\system32\dpnet.dll
    2012-11-02 05:11 . 2012-12-13 08:29 376832 ----a-w- c:\windows\SysWow64\dpnet.dll
    .
    .
    ((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
    REGEDIT4
    .
    c:\users\Etienne\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
    Adobe Gamma.lnk - c:\program files (x86)\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-3-16 113664]
    .
    c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
    Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2009-9-4 1081632]
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
    "ConsentPromptBehaviorAdmin"= 0 (0x0)
    "ConsentPromptBehaviorUser"= 3 (0x3)
    "EnableUIADesktopToggle"= 0 (0x0)
    "DisableCAD"= 1 (0x1)
    .
    [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
    "mixer9"=wdmaud.drv
    .
    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
    Notification Packages REG_MULTI_SZ scecli c:\program files\Protector Suite\psqlpwd.dll
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
    @=""
    .
    R2 Amsp;Trend Micro Solution Platform;c:\program files\Trend Micro\AMSP\coreServiceShell.exe coreFrameworkHost.exe [x]
    R2 CanalPlus.VOD;CanalPlus.VOD;c:\program files (x86)\Canal+\CANAL+ CANALSAT A LA DEMANDE\VOD\CanalPlus.VOD.exe [2010-07-06 188416]
    R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
    R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe [2012-11-09 160944]
    R3 BTHprint;Classe d'imprimantes Bluetooth Microsoft;c:\windows\system32\DRIVERS\bthprint.sys [2009-07-14 67072]
    R3 btusbflt;Bluetooth USB Filter;c:\windows\system32\drivers\btusbflt.sys [2010-02-18 52264]
    R3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\DRIVERS\btwl2cap.sys [2010-02-18 35104]
    R3 GemCCID;GemCCID;c:\windows\system32\Drivers\GemCCID.sys [2009-08-10 119680]
    R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 59392]
    R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [2012-09-28 53760]
    R3 VAIO Power Management;VAIO Power Management;c:\program files\Sony\VAIO Power Management\SPMService.exe [2010-01-20 574320]
    R3 VCService;VCService;c:\program files\Sony\VAIO Care\VCService.exe [2011-02-14 44736]
    R3 VUAgent;VUAgent;c:\program files\Sony\VAIO Update Common\VUAgent.exe [2011-09-23 1429608]
    R3 WatAdminSvc;Service Windows Activation Technologies;c:\windows\system32\Wat\WatAdminSvc.exe [2010-07-18 1255736]
    S0 AVGIDSHA;AVGIDSHA;c:\windows\system32\DRIVERS\avgidsha.sys [2012-10-15 63328]
    S0 Avgloga;AVG Logging Driver;c:\windows\system32\DRIVERS\avgloga.sys [2012-09-21 225120]
    S0 Avgmfx64;AVG Mini-Filter Resident Anti-Virus Shield;c:\windows\system32\DRIVERS\avgmfx64.sys [2012-11-15 111968]
    S0 Avgrkx64;AVG Anti-Rootkit Driver;c:\windows\system32\DRIVERS\avgrkx64.sys [2012-09-14 40800]
    S0 PxHlpa64;PxHlpa64;c:\windows\System32\Drivers\PxHlpa64.sys [2010-06-09 55856]
    S1 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\DRIVERS\avgidsdrivera.sys [2012-10-22 154464]
    S1 Avgldx64;AVG AVI Loader Driver;c:\windows\system32\DRIVERS\avgldx64.sys [2012-10-02 185696]
    S1 Avgtdia;AVG TDI Driver;c:\windows\system32\DRIVERS\avgtdia.sys [2012-09-21 200032]
    S2 AVGIDSAgent;AVGIDSAgent;c:\program files (x86)\AVG\AVG2013\avgidsagent.exe [2012-11-15 5814904]
    S2 avgwd;AVG WatchDog;c:\program files (x86)\AVG\AVG2013\avgwdsvc.exe [2012-10-22 196664]
    S2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [2010-03-04 13336]
    S2 MCTUISvr;MCTUISvr;c:\program files (x86)\MCT\VGA0007\Utility\MCTUISvr.exe [2009-11-12 198008]
    S2 rimspci;rimspci;c:\windows\system32\drivers\rimssne64.sys [2010-02-18 93184]
    S2 risdsnpe;risdsnpe;c:\windows\system32\drivers\risdsne64.sys [2010-02-18 77312]
    S2 SampleCollector;VAIO Care Performance Service;c:\program files\Sony\VAIO Care\VCPerfService.exe [2011-01-29 259192]
    S2 tmevtmgr;tmevtmgr;c:\windows\system32\DRIVERS\tmevtmgr.sys [2011-02-25 69904]
    S2 UNS;Intel(R) Management & Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2010-02-23 2320920]
    S2 VSNService;VSNService;c:\program files\Sony\VAIO Smart Network\VSNService.exe [2010-08-11 845312]
    S3 e1kexpress;Intel(R) PRO/1000 PCI Express Network Connection Driver K;c:\windows\system32\DRIVERS\e1k62x64.sys [2010-03-08 294064]
    S3 HECIx64;Intel(R) Management Engine Interface;c:\windows\system32\drivers\HECIx64.sys [2009-09-17 56344]
    S3 Impcd;Impcd;c:\windows\system32\drivers\Impcd.sys [2010-02-19 151936]
    S3 NETw5s64;Pilote de carte de la série Intel(R) Wireless WiFi Link 5000 pour Windows 7 64 bits ;c:\windows\system32\DRIVERS\NETw5s64.sys [2010-05-31 7689216]
    S3 SFEP;Sony Firmware Extension Parser;c:\windows\system32\drivers\SFEP.sys [2010-01-21 12032]
    S3 WsAudio_DeviceS(1);WsAudio_DeviceS(1);c:\windows\system32\drivers\WsAudio_DeviceS(1).sys [2010-09-14 29288]
    S3 WsAudio_DeviceS(2);WsAudio_DeviceS(2);c:\windows\system32\drivers\WsAudio_DeviceS(2).sys [2010-09-14 29288]
    S3 WsAudio_DeviceS(3);WsAudio_DeviceS(3);c:\windows\system32\drivers\WsAudio_DeviceS(3).sys [2010-09-14 29288]
    S3 WsAudio_DeviceS(4);WsAudio_DeviceS(4);c:\windows\system32\drivers\WsAudio_DeviceS(4).sys [2010-09-14 29288]
    S3 WsAudio_DeviceS(5);WsAudio_DeviceS(5);c:\windows\system32\drivers\WsAudio_DeviceS(5).sys [2010-09-14 29288]
    .
    .
    [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost]
    Akamai REG_MULTI_SZ Akamai
    .
    Contenu du dossier 'Tâches planifiées'
    .
    2013-01-11 c:\windows\Tasks\Adobe Flash Player Updater.job
    - c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-04 19:14]
    .
    2012-07-12 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-58989932-2979699653-4125608483-1001Core1cd60295007bad9.job
    - c:\users\Etienne\AppData\Local\Facebook\Update\FacebookUpdate.exe [2011-10-23 12:24]
    .
    2011-10-25 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-58989932-2979699653-4125608483-1001UA.job
    - c:\users\Etienne\AppData\Local\Facebook\Update\FacebookUpdate.exe [2011-10-23 12:24]
    .
    2013-01-22 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
    - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-07-01 09:26]
    .
    2012-10-02 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
    - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-07-01 09:26]
    .
    .
    --------- X64 Entries -----------
    .
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\UEAFOverlay]
    @="{F2F31467-B1AC-4df0-AE79-FD5FA085E22B}"
    [HKEY_CLASSES_ROOT\CLSID\{F2F31467-B1AC-4df0-AE79-FD5FA085E22B}]
    2009-10-29 17:08 5948168 ----a-w- c:\program files\Protector Suite\farchns.dll
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\UEAFOverlayOpen]
    @="{A3E208F7-0E3A-4182-A7A6-B169D5D691AA}"
    [HKEY_CLASSES_ROOT\CLSID\{A3E208F7-0E3A-4182-A7A6-B169D5D691AA}]
    2009-10-29 17:08 5948168 ----a-w- c:\program files\Protector Suite\farchns.dll
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "IgfxTray"="c:\windows\system32\igfxtray.exe" [2010-02-22 166424]
    "HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2010-02-22 390680]
    "Persistence"="c:\windows\system32\igfxpers.exe" [2010-02-22 410136]
    "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2010-01-19 16414824]
    "RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2010-02-16 9962016]
    "PSQLLauncher"="c:\program files\Protector Suite\launcher.exe" [2009-10-29 84744]
    "Trend Micro Client Framework"="c:\program files\Trend Micro\UniClient\UiFrmWrk\UIWatchDog.exe" [2011-03-26 204584]
    .
    ------- Examen supplémentaire -------
    .
    uLocal Page = c:\windows\system32\blank.htm
    uStart Page = hxxp://www.google.fr/
    mLocal Page = c:\windows\SysWOW64\blank.htm
    uInternet Settings,ProxyOverride = *.local
    IE: &Envoyer à OneNote - c:\progra~2\MICROS~1\Office14\ONBttnIE.dll/105
    IE: E&xporter vers Microsoft Excel - c:\progra~2\MICROS~1\Office14\EXCEL.EXE/3000
    IE: Envoyer au périphérique &Bluetooth... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
    IE: Envoyer l'&image au périphérique Bluetooth... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
    IE: {{90EAE591-7E7E-434a-8E28-ECFD00071806} - c:\program files (x86)\PokerStars.FR\PokerStarsUpdate.exe
    TCP: Interfaces\{8B9218F7-9A87-4080-88BC-01A05528F982}: NameServer = 10.36.204.200
    DPF: {F92211F4-3913-4DC2-A275-756374D848B0} - hxxp://192.168.1.49/MP4DVR.cab
    FF - ProfilePath - c:\users\Etienne\AppData\Roaming\Mozilla\Firefox\Profiles\230okyz3.default\
    .
    - - - - ORPHELINS SUPPRIMES - - - -
    .
    SafeBoot-59990329.sys
    HKLM-Run-SynTPEnh - c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe
    .
    .
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\SampleCollector]
    "ImagePath"="\"c:\program files\Sony\VAIO Care\VCPerfService.exe\" \"/service\" \"/sstates\" \"/sampleinterval=5000\" \"/procinterval=5\" \"/dllinterval=120\" \"/counter=\Processor(_Total)\% Processor Time:1/counter=\PhysicalDisk(_Total)\Disk Bytes/sec:1\" \"/counter=\Network Interface(*)\Bytes Total/sec:1\" \"/expandcounter=\Processor Information(*)\Processor Frequency:1\" \"/expandcounter=\Processor(*)\% Idle Time:1\" \"/expandcounter=\Processor(*)\% C1 Time:1\" \"/expandcounter=\Processor(*)\% C2 Time:1\" \"/expandcounter=\Processor(*)\% C3 Time:1\" \"/expandcounter=\Processor(*)\% Processor Time:1\" \"/directory=c:\programdata\Sony Corporation\VAIO Care\inteldata\""
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\.NET CLR Data]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\.NET CLR Networking]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\.NET CLR Networking 4.0.0.0]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\.NET Data Provider for Oracle]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\.NET Data Provider for SqlServer]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\.NETFramework]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\1394ohci]
    "ImagePath"="\SystemRoot\system32\drivers\1394ohci.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\ACDaemon]
    "ImagePath"="c:\program files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\ACPI]
    "ImagePath"="system32\drivers\ACPI.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AcpiPmi]
    "ImagePath"="\SystemRoot\system32\drivers\acpipmi.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Adobe LM Service]
    "ImagePath"="\"c:\program files (x86)\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe\""
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AdobeARMservice]
    "ImagePath"="\"c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe\""
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AdobeFlashPlayerUpdateSvc]
    "ImagePath"="c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\adp94xx]
    "ImagePath"="\SystemRoot\system32\drivers\adp94xx.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\adpahci]
    "ImagePath"="\SystemRoot\system32\drivers\adpahci.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\adpu320]
    "ImagePath"="\SystemRoot\system32\drivers\adpu320.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\adsi]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AeLookupSvc]
    "ServiceDll"="%SystemRoot%\System32\aelupsvc.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\agp440]
    "ImagePath"="\SystemRoot\system32\drivers\agp440.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\ALG]
    "ImagePath"="%SystemRoot%\System32\alg.exe"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\aliide]
    "ImagePath"="\SystemRoot\system32\drivers\aliide.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\amdide]
    "ImagePath"="\SystemRoot\system32\drivers\amdide.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AmdK8]
    "ImagePath"="\SystemRoot\system32\drivers\amdk8.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AmdPPM]
    "ImagePath"="\SystemRoot\system32\drivers\amdppm.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\amdsata]
    "ImagePath"="\SystemRoot\system32\drivers\amdsata.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\amdsbs]
    "ImagePath"="\SystemRoot\system32\drivers\amdsbs.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\amdxata]
    "ImagePath"="system32\drivers\amdxata.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Amsp]
    "ImagePath"="\"c:\program files\Trend Micro\AMSP\coreServiceShell.exe\" coreFrameworkHost.exe -m=qb -dt=60000"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AppID]
    "ImagePath"="\SystemRoot\system32\drivers\appid.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AppIDSvc]
    "ServiceDll"="%SystemRoot%\System32\appidsvc.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Appinfo]
    "ServiceDll"="%SystemRoot%\System32\appinfo.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Apple Mobile Device]
    "ImagePath"="\"c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe\""
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AppMgmt]
    "ServiceDll"="%SystemRoot%\System32\appmgmts.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\arc]
    "ImagePath"="\SystemRoot\system32\drivers\arc.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\arcsas]
    "ImagePath"="\SystemRoot\system32\drivers\arcsas.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AsyncMac]
    "ImagePath"="system32\DRIVERS\asyncmac.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\atapi]
    "ImagePath"="\SystemRoot\system32\drivers\atapi.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioEndpointBuilder]
    "ServiceDll"="%SystemRoot%\System32\Audiosrv.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioSrv]
    "ServiceDll"="%SystemRoot%\System32\Audiosrv.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Avg]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AVGIDSAgent]
    "ImagePath"="\"c:\program files (x86)\AVG\AVG2013\avgidsagent.exe\""
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AVGIDSDriver]
    "ImagePath"="system32\DRIVERS\avgidsdrivera.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AVGIDSHA]
    "ImagePath"="system32\DRIVERS\avgidsha.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Avgldx64]
    "ImagePath"="system32\DRIVERS\avgldx64.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Avgloga]
    "ImagePath"="system32\DRIVERS\avgloga.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Avgmfx64]
    "ImagePath"="system32\DRIVERS\avgmfx64.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Avgrkx64]
    "ImagePath"="system32\DRIVERS\avgrkx64.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Avgtdia]
    "ImagePath"="system32\DRIVERS\avgtdia.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\avgwd]
    "ImagePath"="\"c:\program files (x86)\AVG\AVG2013\avgwdsvc.exe\""
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AxInstSV]
    "ServiceDll"="%SystemRoot%\System32\AxInstSV.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\b06bdrv]
    "ImagePath"="\SystemRoot\system32\drivers\bxvbda.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\b57nd60a]
    "ImagePath"="system32\DRIVERS\b57nd60a.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BattC]
    "MofImagePath"="system32\drivers\battc.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BDESVC]
    "ServiceDll"="%SystemRoot%\System32\bdesvc.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Beep]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BFE]
    "ServiceDll"="%SystemRoot%\System32\bfe.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BITS]
    "ServiceDll"="%systemroot%\system32\qmgr.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\blbdrive]
    "ImagePath"="\SystemRoot\system32\drivers\blbdrive.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Bonjour Service]
    "ImagePath"="\"c:\program files\Bonjour\mDNSResponder.exe\""
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\bowser]
    "ImagePath"="system32\DRIVERS\bowser.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BrFiltLo]
    "ImagePath"="\SystemRoot\system32\drivers\BrFiltLo.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BrFiltUp]
    "ImagePath"="\SystemRoot\system32\drivers\BrFiltUp.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BridgeMP]
    "ImagePath"="system32\DRIVERS\bridge.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Browser]
    "ServiceDll"="%SystemRoot%\System32\browser.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Brserid]
    "ImagePath"="\SystemRoot\System32\Drivers\Brserid.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BrSerWdm]
    "ImagePath"="\SystemRoot\System32\Drivers\BrSerWdm.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BrUsbMdm]
    "ImagePath"="\SystemRoot\System32\Drivers\BrUsbMdm.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BrUsbSer]
    "ImagePath"="\SystemRoot\System32\Drivers\BrUsbSer.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BthEnum]
    "ImagePath"="\SystemRoot\system32\drivers\BthEnum.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BTHMODEM]
    "ImagePath"="system32\DRIVERS\bthmodem.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BthPan]
    "ImagePath"="system32\DRIVERS\bthpan.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BTHPORT]
    "ImagePath"="\SystemRoot\System32\Drivers\BTHport.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BTHprint]
    "ImagePath"="system32\DRIVERS\bthprint.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\bthserv]
    "ServiceDll"="%SystemRoot%\system32\bthserv.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BTHUSB]
    "ImagePath"="\SystemRoot\System32\Drivers\BTHUSB.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\btusbflt]
    "ImagePath"="system32\drivers\btusbflt.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\btwaudio]
    "ImagePath"="system32\drivers\btwaudio.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\btwavdt]
    "ImagePath"="system32\drivers\btwavdt.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\btwdins]
    "ImagePath"="c:\program files\WIDCOMM\Bluetooth Software\btwdins.exe"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\btwl2cap]
    "ImagePath"="system32\DRIVERS\btwl2cap.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\btwrchid]
    "ImagePath"="system32\DRIVERS\btwrchid.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CanalPlus.VOD]
    "ImagePath"="\"c:\program files (x86)\Canal+\CANAL+ CANALSAT A LA DEMANDE\VOD\CanalPlus.VOD.exe\""
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\cdfs]
    "ImagePath"="system32\DRIVERS\cdfs.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\cdrom]
    "ImagePath"="\SystemRoot\system32\drivers\cdrom.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CertPropSvc]
    "ServiceDll"="%SystemRoot%\System32\certprop.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\circlass]
    "ImagePath"="\SystemRoot\system32\drivers\circlass.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CLFS]
    "ImagePath"="System32\CLFS.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\clr_optimization_v2.0.50727_32]
    "ImagePath"="%systemroot%\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\clr_optimization_v2.0.50727_64]
    "ImagePath"="%systemroot%\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\clr_optimization_v4.0.30319_32]
    "ImagePath"="c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\clr_optimization_v4.0.30319_64]
    "ImagePath"="c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CmBatt]
    "ImagePath"="\SystemRoot\system32\drivers\CmBatt.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\cmdide]
    "ImagePath"="\SystemRoot\system32\drivers\cmdide.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CNG]
    "ImagePath"="System32\Drivers\cng.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Compbatt]
    "ImagePath"="system32\drivers\compbatt.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CompositeBus]
    "ImagePath"="\SystemRoot\system32\drivers\CompositeBus.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\COMSysApp]
    "ImagePath"="%SystemRoot%\system32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235}"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\crcdisk]
    "ImagePath"="\SystemRoot\system32\drivers\crcdisk.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\crypt32]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CryptSvc]
    "ServiceDll"="%SystemRoot%\system32\cryptsvc.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CSC]
    "ImagePath"="system32\drivers\csc.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CscService]
    "ServiceDll"="%SystemRoot%\System32\cscsvc.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\DCLocator]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\DcomLaunch]
    "ServiceDll"="%SystemRoot%\system32\rpcss.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\defragsvc]
    "ServiceDll"="%Systemroot%\System32\defragsvc.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\DfsC]
    "ImagePath"="System32\Drivers\dfsc.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Dhcp]
    "ServiceDll"="%SystemRoot%\system32\dhcpcore.dll"
    0
  3. pokchips
     
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\discache]
    "ImagePath"="System32\drivers\discache.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Disk]
    "ImagePath"="system32\drivers\disk.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Dnscache]
    "ServiceDll"="%SystemRoot%\System32\dnsrslvr.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\dot3svc]
    "ServiceDll"="%SystemRoot%\System32\dot3svc.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\dot4]
    "ImagePath"="system32\DRIVERS\Dot4.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Dot4Print]
    "ImagePath"="system32\DRIVERS\Dot4Prt.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\dot4usb]
    "ImagePath"="system32\DRIVERS\dot4usb.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\DPS]
    "ServiceDll"="%SystemRoot%\system32\dps.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\drmkaud]
    "ImagePath"="system32\drivers\drmkaud.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\DXGKrnl]
    "ImagePath"="\SystemRoot\System32\drivers\dxgkrnl.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\e1kexpress]
    "ImagePath"="system32\DRIVERS\e1k62x64.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\EapHost]
    "ServiceDll"="%SystemRoot%\System32\eapsvc.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\ebdrv]
    "ImagePath"="\SystemRoot\system32\drivers\evbda.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\EFS]
    "ImagePath"="%SystemRoot%\System32\lsass.exe"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\ehRecvr]
    "ImagePath"="%systemroot%\ehome\ehRecvr.exe"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\ehSched]
    "ImagePath"="%systemroot%\ehome\ehsched.exe"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\elxstor]
    "ImagePath"="\SystemRoot\system32\drivers\elxstor.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\ErrDev]
    "ImagePath"="\SystemRoot\system32\drivers\errdev.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\ESENT]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\eventlog]
    "ServiceDll"="%SystemRoot%\System32\wevtsvc.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\EventSystem]
    "ServiceDll"="%systemroot%\system32\es.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\EvtEng]
    "ImagePath"="c:\program files\Intel\WiFi\bin\EvtEng.exe"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\exfat]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\fastfat]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Fax]
    "ImagePath"="%systemroot%\system32\fxssvc.exe"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\fdc]
    "ImagePath"="\SystemRoot\system32\drivers\fdc.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\fdPHost]
    "ServiceDll"="%SystemRoot%\system32\fdPHost.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\FDResPub]
    "ServiceDll"="%SystemRoot%\system32\fdrespub.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\FileInfo]
    "ImagePath"="system32\drivers\fileinfo.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Filetrace]
    "ImagePath"="system32\drivers\filetrace.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\flpydisk]
    "ImagePath"="\SystemRoot\system32\drivers\flpydisk.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\FltMgr]
    "ImagePath"="system32\drivers\fltmgr.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\FontCache]
    "ServiceDll"="%SystemRoot%\system32\FntCache.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\FontCache3.0.0.0]
    "ImagePath"="%systemroot%\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\FsDepends]
    "ImagePath"="System32\drivers\FsDepends.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\fssfltr]
    "ImagePath"="system32\DRIVERS\fssfltr.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\fsssvc]
    "ImagePath"="\"c:\program files (x86)\Windows Live\Family Safety\fsssvc.exe\""
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Fs_Rec]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\fvevol]
    "ImagePath"="System32\DRIVERS\fvevol.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\gagp30kx]
    "ImagePath"="\SystemRoot\system32\drivers\gagp30kx.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\GEARAspiWDM]
    "ImagePath"="system32\DRIVERS\GEARAspiWDM.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\GemCCID]
    "ImagePath"="System32\Drivers\GemCCID.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\gpsvc]
    "ServiceDll"="%SystemRoot%\System32\gpsvc.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\gupdate]
    "ImagePath"="\"c:\program files (x86)\Google\Update\GoogleUpdate.exe\" /svc"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\gupdatem]
    "ImagePath"="\"c:\program files (x86)\Google\Update\GoogleUpdate.exe\" /medsvc"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\gusvc]
    "ImagePath"="\"c:\program files (x86)\Google\Common\Google Updater\GoogleUpdaterService.exe\""
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\hcw85cir]
    "ImagePath"="\SystemRoot\system32\drivers\hcw85cir.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\HdAudAddService]
    "ImagePath"="\SystemRoot\system32\drivers\HdAudio.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\HDAudBus]
    "ImagePath"="\SystemRoot\system32\drivers\HDAudBus.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\HECIx64]
    "ImagePath"="\SystemRoot\system32\drivers\HECIx64.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\HidBatt]
    "ImagePath"="\SystemRoot\system32\drivers\HidBatt.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\HidBth]
    "ImagePath"="system32\DRIVERS\hidbth.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\HidIr]
    "ImagePath"="\SystemRoot\system32\drivers\hidir.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\hidserv]
    "ServiceDll"="%SystemRoot%\System32\hidserv.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\HidUsb]
    "ImagePath"="system32\DRIVERS\hidusb.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\hkmsvc]
    "ServiceDLL"="%SystemRoot%\system32\kmsvc.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\HomeGroupListener]
    "ServiceDll"="%SystemRoot%\system32\ListSvc.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\HomeGroupProvider]
    "ServiceDll"="%SystemRoot%\system32\provsvc.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\HpSAMD]
    "ImagePath"="\SystemRoot\system32\drivers\HpSAMD.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\HTTP]
    "ImagePath"="system32\drivers\HTTP.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\hwpolicy]
    "ImagePath"="System32\drivers\hwpolicy.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\i8042prt]
    "ImagePath"="\SystemRoot\system32\drivers\i8042prt.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\iaStor]
    "ImagePath"="system32\drivers\iaStor.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\IAStorDataMgrSvc]
    "ImagePath"="\"c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe\""
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\iaStorV]
    "ImagePath"="\SystemRoot\system32\drivers\iaStorV.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\idsvc]
    "ImagePath"="\"%systemroot%\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\infocard.exe\""
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\iirsp]
    "ImagePath"="\SystemRoot\system32\drivers\iirsp.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\IKEEXT]
    "ServiceDll"="%SystemRoot%\System32\ikeext.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Impcd]
    "ImagePath"="\SystemRoot\system32\drivers\Impcd.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\inetaccs]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\IntcAzAudAddService]
    "ImagePath"="system32\drivers\RTKVHD64.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\intelide]
    "ImagePath"="\SystemRoot\system32\drivers\intelide.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\intelppm]
    "ImagePath"="system32\DRIVERS\intelppm.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\IPBusEnum]
    "ServiceDll"="%SystemRoot%\system32\ipbusenum.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\IpFilterDriver]
    "ImagePath"="system32\DRIVERS\ipfltdrv.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\iphlpsvc]
    "ServiceDll"="%SystemRoot%\System32\iphlpsvc.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\IPMIDRV]
    "ImagePath"="\SystemRoot\system32\drivers\IPMIDrv.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\IPNAT]
    "ImagePath"="System32\drivers\ipnat.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\iPod Service]
    "ImagePath"="\"c:\program files\iPod\bin\iPodService.exe\""
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\IRENUM]
    "ImagePath"="system32\drivers\irenum.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\isapnp]
    "ImagePath"="\SystemRoot\system32\drivers\isapnp.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\iScsiPrt]
    "ImagePath"="\SystemRoot\system32\drivers\msiscsi.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\kbdclass]
    "ImagePath"="\SystemRoot\system32\drivers\kbdclass.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\kbdhid]
    "ImagePath"="\SystemRoot\system32\drivers\kbdhid.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\KeyIso]
    "ImagePath"="%SystemRoot%\system32\lsass.exe"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\KSecDD]
    "ImagePath"="System32\Drivers\ksecdd.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\KSecPkg]
    "ImagePath"="System32\Drivers\ksecpkg.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\ksthunk]
    "ImagePath"="\SystemRoot\system32\drivers\ksthunk.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\KtmRm]
    "ServiceDll"="%systemroot%\system32\msdtckrm.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\LanmanServer]
    "ServiceDll"="%SystemRoot%\System32\srvsvc.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\LanmanWorkstation]
    "ServiceDll"="%SystemRoot%\System32\wkssvc.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\ldap]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\lltdio]
    "ImagePath"="system32\DRIVERS\lltdio.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\lltdsvc]
    "ServiceDll"="%SystemRoot%\System32\lltdsvc.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\lmhosts]
    "ServiceDll"="%SystemRoot%\System32\lmhsvc.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\LMS]
    "ImagePath"="c:\program files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Lsa]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\LSI_FC]
    "ImagePath"="\SystemRoot\system32\drivers\lsi_fc.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\LSI_SAS]
    "ImagePath"="\SystemRoot\system32\drivers\lsi_sas.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\LSI_SAS2]
    "ImagePath"="\SystemRoot\system32\drivers\lsi_sas2.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\LSI_SCSI]
    "ImagePath"="\SystemRoot\system32\drivers\lsi_scsi.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\luafv]
    "ImagePath"="\SystemRoot\system32\drivers\luafv.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\MCTUISvr]
    "ImagePath"="c:\program files (x86)\MCT\VGA0007\Utility\MCTUISvr.exe"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Mcx2Svc]
    "ServiceDll"="%SystemRoot%\system32\Mcx2Svc.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\megasas]
    "ImagePath"="\SystemRoot\system32\drivers\megasas.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\MegaSR]
    "ImagePath"="\SystemRoot\system32\drivers\MegaSR.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\MMCSS]
    "ServiceDll"="%SystemRoot%\system32\mmcss.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Modem]
    "ImagePath"="system32\drivers\modem.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\monitor]
    "ImagePath"="system32\DRIVERS\monitor.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\mouclass]
    "ImagePath"="system32\DRIVERS\mouclass.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\mouhid]
    "ImagePath"="system32\DRIVERS\mouhid.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\mountmgr]
    "ImagePath"="System32\drivers\mountmgr.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\MozillaMaintenance]
    "ImagePath"="c:\program files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\mpio]
    "ImagePath"="\SystemRoot\system32\drivers\mpio.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\mpsdrv]
    "ImagePath"="System32\drivers\mpsdrv.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\MpsSvc]
    "ServiceDll"="%SystemRoot%\system32\mpssvc.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\MRxDAV]
    "ImagePath"="\SystemRoot\system32\drivers\mrxdav.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\mrxsmb]
    "ImagePath"="system32\DRIVERS\mrxsmb.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\mrxsmb10]
    "ImagePath"="system32\DRIVERS\mrxsmb10.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\mrxsmb20]
    "ImagePath"="system32\DRIVERS\mrxsmb20.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\msahci]
    "ImagePath"="\SystemRoot\system32\drivers\msahci.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\msdsm]
    "ImagePath"="\SystemRoot\system32\drivers\msdsm.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\MSDTC]
    "ImagePath"="%SystemRoot%\System32\msdtc.exe"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\MSDTC Bridge 3.0.0.0]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\MSDTC Bridge 4.0.0.0]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\MSExchangeIMC]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Msfs]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\mshidkmdf]
    "ImagePath"="\SystemRoot\System32\drivers\mshidkmdf.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\msisadrv]
    "ImagePath"="system32\drivers\msisadrv.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\MSiSCSI]
    "ServiceDll"="%systemroot%\system32\iscsiexe.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\msiserver]
    "ImagePath"="%systemroot%\system32\msiexec.exe /V"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\MSKSSRV]
    "ImagePath"="system32\drivers\MSKSSRV.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\MSPCLOCK]
    "ImagePath"="system32\drivers\MSPCLOCK.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\MSPQM]
    "ImagePath"="system32\drivers\MSPQM.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\MsRPC]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\MSSCNTRS]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\mssmbios]
    "ImagePath"="\SystemRoot\system32\drivers\mssmbios.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\MSTEE]
    "ImagePath"="system32\drivers\MSTEE.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\MTConfig]
    "ImagePath"="\SystemRoot\system32\drivers\MTConfig.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Mup]
    "ImagePath"="System32\Drivers\mup.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\napagent]
    "ServiceDLL"="%SystemRoot%\system32\qagentRT.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\NativeWifiP]
    "ImagePath"="system32\DRIVERS\nwifi.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\NDIS]
    "ImagePath"="system32\drivers\ndis.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\NdisCap]
    "ImagePath"="system32\DRIVERS\ndiscap.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\NdisTapi]
    "ImagePath"="system32\DRIVERS\ndistapi.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Ndisuio]
    "ImagePath"="system32\DRIVERS\ndisuio.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\NdisWan]
    "ImagePath"="system32\DRIVERS\ndiswan.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\NDProxy]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\NetBIOS]
    "ImagePath"="system32\DRIVERS\netbios.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\NetBT]
    "ImagePath"="System32\DRIVERS\netbt.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Netlogon]
    "ImagePath"="%SystemRoot%\system32\lsass.exe"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Netman]
    "ServiceDll"="%SystemRoot%\System32\netman.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\netprofm]
    "ServiceDll"="%SystemRoot%\System32\netprofm.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\NetTcpPortSharing]
    "ImagePath"="\"%systemroot%\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\SMSvcHost.exe\""
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\NETw5s64]
    "ImagePath"="system32\DRIVERS\NETw5s64.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\nfrd960]
    "ImagePath"="\SystemRoot\system32\drivers\nfrd960.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\NlaSvc]
    "ServiceDll"="%SystemRoot%\System32\nlasvc.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\NMSAccess]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\NMSAccessU]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Npfs]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\nsi]
    "ServiceDll"="%systemroot%\system32\nsisvc.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\nsiproxy]
    "ImagePath"="system32\drivers\nsiproxy.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\NTDS]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Ntfs]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Null]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\NVHDA]
    "ImagePath"="system32\drivers\nvhda64v.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\nvlddmkm]
    "ImagePath"="system32\DRIVERS\nvlddmkm.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\nvraid]
    "ImagePath"="\SystemRoot\system32\drivers\nvraid.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\nvstor]
    "ImagePath"="\SystemRoot\system32\drivers\nvstor.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\nvsvc]
    "ImagePath"="c:\windows\system32\nvvsvc.exe"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\nv_agp]
    "ImagePath"="\SystemRoot\system32\drivers\nv_agp.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\ohci1394]
    "ImagePath"="\SystemRoot\system32\drivers\ohci1394.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\ose]
    "ImagePath"="\"c:\program files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE\""
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\osppsvc]
    "ImagePath"="\"c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE\""
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Outlook]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\p2pimsvc]
    "ServiceDll"="%SystemRoot%\system32\pnrpsvc.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\p2psvc]
    "ServiceDll"="%SystemRoot%\system32\p2psvc.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Parport]
    "ImagePath"="\SystemRoot\system32\drivers\parport.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\partmgr]
    "ImagePath"="System32\drivers\partmgr.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PcaSvc]
    "ServiceDll"="%SystemRoot%\System32\pcasvc.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\pci]
    "ImagePath"="system32\drivers\pci.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\pciide]
    "ImagePath"="\SystemRoot\system32\drivers\pciide.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\pcmcia]
    "ImagePath"="\SystemRoot\system32\drivers\pcmcia.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\pcw]
    "ImagePath"="System32\drivers\pcw.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PEAUTH]
    "ImagePath"="system32\drivers\peauth.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PeerDistSvc]
    "ServiceDll"="%SystemRoot%\system32\peerdistsvc.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PerfDisk]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PerfHost]
    "ImagePath"="%SystemRoot%\SysWow64\perfhost.exe"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PerfNet]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PerfOS]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PerfProc]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\pla]
    "ServiceDll"="%systemroot%\system32\pla.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PlugPlay]
    "ServiceDll"="%SystemRoot%\system32\umpnpmgr.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Pml Driver HPZ12]
    "ServiceDll"="c:\windows\system32\HPZipm12.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PNRPAutoReg]
    "ServiceDll"="%SystemRoot%\system32\pnrpauto.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PNRPsvc]
    "ServiceDll"="%SystemRoot%\system32\pnrpsvc.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PolicyAgent]
    "ServiceDll"="%SystemRoot%\System32\ipsecsvc.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PortProxy]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Power]
    "ServiceDll"="%SystemRoot%\system32\umpo.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PptpMiniport]
    "ImagePath"="system32\DRIVERS\raspptp.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Processor]
    "ImagePath"="\SystemRoot\system32\drivers\processr.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\ProfSvc]
    "ServiceDll"="%systemroot%\system32\profsvc.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\ProtectedStorage]
    "ImagePath"="%SystemRoot%\system32\lsass.exe"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Psched]
    "ImagePath"="system32\DRIVERS\pacer.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PSI_SVC_2]
    "ImagePath"="\"c:\program files (x86)\Common Files\Protexis\License Service\PsiService_2.exe\""
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PxHlpa64]
    "ImagePath"="System32\Drivers\PxHlpa64.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\ql2300]
    "ImagePath"="\SystemRoot\system32\drivers\ql2300.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\ql40xx]
    "ImagePath"="\SystemRoot\system32\drivers\ql40xx.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\QWAVE]
    "ServiceDll"="%windir%\system32\qwave.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\QWAVEdrv]
    "ImagePath"="\SystemRoot\system32\drivers\qwavedrv.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RasAcd]
    "ImagePath"="System32\DRIVERS\rasacd.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RasAgileVpn]
    "ImagePath"="system32\DRIVERS\AgileVpn.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RasAuto]
    "ServiceDll"="%SystemRoot%\System32\rasauto.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Rasl2tp]
    "ImagePath"="system32\DRIVERS\rasl2tp.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RasMan]
    "ServiceDll"="%SystemRoot%\System32\rasmans.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RasPppoe]
    "ImagePath"="system32\DRIVERS\raspppoe.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RasSstp]
    "ImagePath"="system32\DRIVERS\rassstp.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\rdbss]
    "ImagePath"="system32\DRIVERS\rdbss.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\rdpbus]
    "ImagePath"="system32\DRIVERS\rdpbus.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RDPCDD]
    "ImagePath"="System32\DRIVERS\RDPCDD.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RDPDD]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RDPDR]
    "ImagePath"="System32\drivers\rdpdr.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RDPENCDD]
    "ImagePath"="system32\drivers\rdpencdd.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RDPNP]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RDPREFMP]
    "ImagePath"="system32\drivers\rdprefmp.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RDPWD]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\rdyboost]
    "ImagePath"="System32\drivers\rdyboost.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RegSrvc]
    "ImagePath"="c:\program files\Common Files\Intel\WirelessCommon\RegSrvc.exe"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RemoteAccess]
    "ServiceDLL"="%SystemRoot%\System32\mprdim.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RemoteRegistry]
    "ServiceDll"="%SystemRoot%\system32\regsvc.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RFCOMM]
    "ImagePath"="system32\DRIVERS\rfcomm.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\rimspci]
    "ImagePath"="\SystemRoot\system32\drivers\rimssne64.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RimUsb]
    "ImagePath"="System32\Drivers\RimUsb_AMD64.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RimVSerPort]
    "ImagePath"="system32\DRIVERS\RimSerial_AMD64.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\risdsnpe]
    "ImagePath"="\SystemRoot\system32\drivers\risdsne64.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\ROOTMODEM]
    "ImagePath"="System32\Drivers\RootMdm.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RpcEptMapper]
    "ServiceDll"="%SystemRoot%\System32\RpcEpMap.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RpcLocator]
    "ImagePath"="%SystemRoot%\system32\locator.exe"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RpcSs]
    "ServiceDll"="%SystemRoot%\system32\rpcss.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\rspndr]
    "ImagePath"="system32\DRIVERS\rspndr.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\s3cap]
    "ImagePath"="\SystemRoot\system32\drivers\vms3cap.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\SampleCollector]
    "ImagePath"="\"c:\program files\Sony\VAIO Care\VCPerfService.exe\" \"/service\" \"/sstates\" \"/sampleinterval=5000\" \"/procinterval=5\" \"/dllinterval=120\" \"/counter=\Processor(_Total)\% Processor Time:1/counter=\PhysicalDisk(_Total)\Disk Bytes/sec:1\" \"/counter=\Network Interface(*)\Bytes Total/sec:1\" \"/expandcounter=\Processor Information(*)\Processor Frequency:1\" \"/expandcounter=\Processor(*)\% Idle Time:1\" \"/expandcounter=\Processor(*)\% C1 Time:1\" \"/expandcounter=\Processor(*)\% C2 Time:1\" \"/expandcounter=\Processor(*)\% C3 Time:1\" \"/expandcounter=\Processor(*)\% Processor Time:1\" \"/directory=c:\programdata\Sony Corporation\VAIO Care\inteldata\""
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\SamSs]
    "ImagePath"="%SystemRoot%\system32\lsass.exe"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\sbp2port]
    "ImagePath"="\SystemRoot\system32\drivers\sbp2port.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\SCardSvr]
    "ServiceDll"="%SystemRoot%\System32\SCardSvr.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\scfilter]
    "ImagePath"="System32\DRIVERS\scfilter.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Schedule]
    "ServiceDll"="%systemroot%\system32\schedsvc.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\SCPolicySvc]
    "ServiceDll"="%SystemRoot%\System32\certprop.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\sdbus]
    "ImagePath"="\SystemRoot\system32\drivers\sdbus.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\SDRSVC]
    "ServiceDll"="%Systemroot%\System32\SDRSVC.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\secdrv]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\seclogon]
    "ServiceDll"="%windir%\system32\seclogon.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\SENS]
    "ServiceDll"="%SystemRoot%\system32\sens.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\SensrSvc]
    "ServiceDll"="%SystemRoot%\system32\sensrsvc.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Serenum]
    "ImagePath"="\SystemRoot\system32\drivers\serenum.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Serial]
    "ImagePath"="\SystemRoot\system32\drivers\serial.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\sermouse]
    "ImagePath"="\SystemRoot\system32\drivers\sermouse.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\ServiceModelEndpoint 3.0.0.0]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\ServiceModelOperation 3.0.0.0]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\ServiceModelService 3.0.0.0]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\SessionEnv]
    "ServiceDLL"="%SystemRoot%\system32\sessenv.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\SFEP]
    "ImagePath"="\SystemRoot\system32\drivers\SFEP.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\sffdisk]
    "ImagePath"="\SystemRoot\system32\drivers\sffdisk.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\sffp_mmc]
    "ImagePath"="\SystemRoot\system32\drivers\sffp_mmc.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\sffp_sd]
    "ImagePath"="\SystemRoot\system32\drivers\sffp_sd.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\sfloppy]
    "ImagePath"="\SystemRoot\system32\drivers\sfloppy.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\SharedAccess]
    "ServiceDll"="%SystemRoot%\System32\ipnathlp.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\ShellHWDetection]
    "ServiceDll"="%SystemRoot%\System32\shsvcs.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\SiSRaid2]
    "ImagePath"="\SystemRoot\system32\drivers\SiSRaid2.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\SiSRaid4]
    "ImagePath"="\SystemRoot\system32\drivers\sisraid4.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\SkypeUpdate]
    "ImagePath"="\"c:\program files (x86)\Skype\Updater\Updater.exe\""
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Smb]
    "ImagePath"="system32\DRIVERS\smb.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\SMSvcHost 3.0.0.0]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\SMSvcHost 4.0.0.0]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\SNMPTRAP]
    "ImagePath"="%SystemRoot%\System32\snmptrap.exe"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\spldr]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Spooler]
    "ImagePath"="%SystemRoot%\System32\spoolsv.exe"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\sppsvc]
    "ImagePath"="%SystemRoot%\system32\sppsvc.exe"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\sppuinotify]
    "ServiceDll"="%SystemRoot%\system32\sppuinotify.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\srv]
    "ImagePath"="System32\DRIVERS\srv.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\srv2]
    "ImagePath"="System32\DRIVERS\srv2.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\srvnet]
    "ImagePath"="System32\DRIVERS\srvnet.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\SSDPSRV]
    "ServiceDll"="%SystemRoot%\System32\ssdpsrv.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\SstpSvc]
    "ServiceDll"="%SystemRoot%\system32\sstpsvc.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\stexstor]
    "ImagePath"="\SystemRoot\system32\drivers\stexstor.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\stisvc]
    "ServiceDll"="%SystemRoot%\System32\wiaservc.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\storflt]
    "ImagePath"="system32\drivers\vmstorfl.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\StorSvc]
    "ServiceDll"="%SystemRoot%\system32\storsvc.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\storvsc]
    "ImagePath"="\SystemRoot\system32\drivers\storvsc.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\swenum]
    "ImagePath"="\SystemRoot\system32\drivers\swenum.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\swprv]
    "ServiceDll"="%Systemroot%\System32\swprv.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\SynTP]
    "ImagePath"="system32\DRIVERS\SynTP.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\SysMain]
    "ServiceDll"="%systemroot%\system32\sysmain.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\TabletInputService]
    "ServiceDll"="%SystemRoot%\System32\TabSvc.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\TapiSrv]
    "ServiceDll"="%SystemRoot%\System32\tapisrv.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\TBS]
    "ServiceDll"="%SystemRoot%\System32\tbssvc.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Tcpip]
    "ImagePath"="System32\drivers\tcpip.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\TCPIP6]
    "ImagePath"="system32\DRIVERS\tcpip.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\TCPIP6TUNNEL]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\tcpipreg]
    "ImagePath"="System32\drivers\tcpipreg.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\TCPIPTUNNEL]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\TDPIPE]
    "ImagePath"="system32\drivers\tdpipe.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\TDTCP]
    "ImagePath"="system32\drivers\tdtcp.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\tdx]
    "ImagePath"="system32\DRIVERS\tdx.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\TermDD]
    "ImagePath"="\SystemRoot\system32\drivers\termdd.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\TermService]
    "ServiceDll"="%SystemRoot%\System32\termsrv.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Themes]
    "ServiceDll"="%SystemRoot%\system32\themeservice.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\THREADORDER]
    "ServiceDll"="%SystemRoot%\system32\mmcss.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\tmactmon]
    "ImagePath"="system32\DRIVERS\tmactmon.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\tmcomm]
    "ImagePath"="system32\DRIVERS\tmcomm.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\tmevtmgr]
    "ImagePath"="system32\DRIVERS\tmevtmgr.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\TmListen]
    "ImagePath"="\"c:\program files\Trend Micro\Security Agent\tmlisten.exe\""
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\tmtdi]
    "ImagePath"="system32\DRIVERS\tmtdi.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\TPM]
    "ImagePath"="system32\drivers\tpm.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\TrkWks]
    "ServiceDll"="%SystemRoot%\System32\trkwks.dll"
    0
  4. pokchips
     
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\TrustedInstaller]
    "ImagePath"="%SystemRoot%\servicing\TrustedInstaller.exe"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\TSDDD]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\tssecsrv]
    "ImagePath"="System32\DRIVERS\tssecsrv.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\TsUsbFlt]
    "ImagePath"="System32\drivers\tsusbflt.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\tunnel]
    "ImagePath"="system32\DRIVERS\tunnel.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\uagp35]
    "ImagePath"="\SystemRoot\system32\drivers\uagp35.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\udfs]
    "ImagePath"="system32\DRIVERS\udfs.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\UGatherer]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\UGTHRSVC]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\UI0Detect]
    "ImagePath"="%SystemRoot%\system32\UI0Detect.exe"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\uliagpkx]
    "ImagePath"="\SystemRoot\system32\drivers\uliagpkx.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\umbus]
    "ImagePath"="\SystemRoot\system32\drivers\umbus.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\UmPass]
    "ImagePath"="\SystemRoot\system32\drivers\umpass.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\UmRdpService]
    "ServiceDll"="%SystemRoot%\System32\umrdp.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\UNS]
    "ImagePath"="\"c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe\""
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\upnphost]
    "ServiceDll"="%SystemRoot%\System32\upnphost.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\USBAAPL64]
    "ImagePath"="System32\Drivers\usbaapl64.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\usbccgp]
    "ImagePath"="system32\DRIVERS\usbccgp.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\usbcir]
    "ImagePath"="\SystemRoot\system32\drivers\usbcir.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\usbehci]
    "ImagePath"="\SystemRoot\system32\drivers\usbehci.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\usbhub]
    "ImagePath"="system32\DRIVERS\usbhub.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\usbohci]
    "ImagePath"="\SystemRoot\system32\drivers\usbohci.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\usbprint]
    "ImagePath"="system32\DRIVERS\usbprint.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\USBSTOR]
    "ImagePath"="system32\DRIVERS\USBSTOR.SYS"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\usbuhci]
    "ImagePath"="\SystemRoot\system32\drivers\usbuhci.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\usbvideo]
    "ImagePath"="\SystemRoot\System32\Drivers\usbvideo.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\UxSms]
    "ServiceDll"="%SystemRoot%\System32\uxsms.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VAIO Event Service]
    "ImagePath"="\"c:\program files (x86)\Sony\VAIO Event Service\VESMgr.exe\""
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VAIO Power Management]
    "ImagePath"="\"c:\program files\Sony\VAIO Power Management\SPMService.exe\""
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VaultSvc]
    "ImagePath"="%SystemRoot%\system32\lsass.exe"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VCService]
    "ImagePath"="\"c:\program files\Sony\VAIO Care\VCService.exe\""
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\vdrvroot]
    "ImagePath"="system32\drivers\vdrvroot.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\vds]
    "ImagePath"="%SystemRoot%\System32\vds.exe"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\vga]
    "ImagePath"="system32\DRIVERS\vgapnp.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VgaSave]
    "ImagePath"="\SystemRoot\System32\drivers\vga.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\vhdmp]
    "ImagePath"="\SystemRoot\system32\drivers\vhdmp.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\viaide]
    "ImagePath"="\SystemRoot\system32\drivers\viaide.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\vmbus]
    "ImagePath"="system32\drivers\vmbus.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VMBusHID]
    "ImagePath"="\SystemRoot\system32\drivers\VMBusHID.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\volmgr]
    "ImagePath"="system32\drivers\volmgr.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\volmgrx]
    "ImagePath"="System32\drivers\volmgrx.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\volsnap]
    "ImagePath"="system32\drivers\volsnap.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\vsmraid]
    "ImagePath"="\SystemRoot\system32\drivers\vsmraid.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSNService]
    "ImagePath"="\"c:\program files\Sony\VAIO Smart Network\VSNService.exe\""
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS]
    "ImagePath"="%systemroot%\system32\vssvc.exe"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VUAgent]
    "ImagePath"="\"c:\program files\Sony\VAIO Update Common\VUAgent.exe\""
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\vwifibus]
    "ImagePath"="system32\DRIVERS\vwifibus.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\vwififlt]
    "ImagePath"="system32\DRIVERS\vwififlt.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\vwifimp]
    "ImagePath"="system32\DRIVERS\vwifimp.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\W32Time]
    "ServiceDll"="%systemroot%\system32\w32time.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\W3SVC]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WacomPen]
    "ImagePath"="\SystemRoot\system32\drivers\wacompen.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WANARP]
    "ImagePath"="system32\DRIVERS\wanarp.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Wanarpv6]
    "ImagePath"="system32\DRIVERS\wanarp.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WatAdminSvc]
    "ImagePath"="%SystemRoot%\system32\Wat\WatAdminSvc.exe"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\wbengine]
    "ImagePath"="\"%systemroot%\system32\wbengine.exe\""
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WbioSrvc]
    "ServiceDll"="%SystemRoot%\System32\wbiosrvc.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\wcncsvc]
    "ServiceDll"="%SystemRoot%\System32\wcncsvc.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WcsPlugInService]
    "ServiceDll"="%SystemRoot%\System32\WcsPlugInService.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Wd]
    "ImagePath"="\SystemRoot\system32\drivers\wd.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Wdf01000]
    "ImagePath"="system32\drivers\Wdf01000.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WdiServiceHost]
    "ServiceDll"="%SystemRoot%\system32\wdi.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WdiSystemHost]
    "ServiceDll"="%SystemRoot%\system32\wdi.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WebClient]
    "ServiceDll"="%SystemRoot%\System32\webclnt.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Wecsvc]
    "ServiceDll"="%SystemRoot%\system32\wecsvc.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\wercplsupport]
    "ServiceDll"="%SystemRoot%\System32\wercplsupport.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WerSvc]
    "ServiceDll"="%SystemRoot%\System32\WerSvc.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WfpLwf]
    "ImagePath"="system32\DRIVERS\wfplwf.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WIMMount]
    "ImagePath"="system32\drivers\wimmount.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WinDefend]
    "ServiceDll"="%ProgramFiles%\Windows Defender\mpsvc.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Windows Workflow Foundation 3.0.0.0]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WinHttpAutoProxySvc]
    "ServiceDll"="winhttp.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Winmgmt]
    "ServiceDll"="%SystemRoot%\system32\wbem\WMIsvc.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WinRM]
    "ServiceDll"="%SystemRoot%\system32\WsmSvc.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Winsock]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WinSock2]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WinUsb]
    "ImagePath"="system32\DRIVERS\WinUSB.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Wlansvc]
    "ServiceDll"="%SystemRoot%\System32\wlansvc.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\wlidsvc]
    "ImagePath"="\"c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE\""
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WmiAcpi]
    "ImagePath"="\SystemRoot\system32\drivers\wmiacpi.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WmiApRpl]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\wmiApSrv]
    "ImagePath"="%systemroot%\system32\wbem\WmiApSrv.exe"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WMPNetworkSvc]
    "ImagePath"="\"%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe\""
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WPCSvc]
    "ServiceDll"="%SystemRoot%\System32\wpcsvc.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WPDBusEnum]
    "ServiceDll"="%SystemRoot%\system32\wpdbusenum.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WsAudio_DeviceS(1)]
    "ImagePath"="system32\drivers\WsAudio_DeviceS(1).sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WsAudio_DeviceS(2)]
    "ImagePath"="system32\drivers\WsAudio_DeviceS(2).sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WsAudio_DeviceS(3)]
    "ImagePath"="system32\drivers\WsAudio_DeviceS(3).sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WsAudio_DeviceS(4)]
    "ImagePath"="system32\drivers\WsAudio_DeviceS(4).sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WsAudio_DeviceS(5)]
    "ImagePath"="system32\drivers\WsAudio_DeviceS(5).sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WSearch]
    "ImagePath"="%systemroot%\system32\SearchIndexer.exe /Embedding"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WSearchIdxPi]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\wuauserv]
    "ServiceDll"="%systemroot%\system32\wuaueng.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WudfPf]
    "ImagePath"="system32\drivers\WudfPf.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WUDFRd]
    "ImagePath"="system32\DRIVERS\WUDFRd.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\wudfsvc]
    "ServiceDll"="%SystemRoot%\System32\WUDFSvc.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WwanSvc]
    "ServiceDll"="%SystemRoot%\System32\wwansvc.dll"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\xmlprov]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\xMrMini64]
    "ImagePath"="system32\DRIVERS\xMrMini64.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\xVGAMINI64]
    "ImagePath"="system32\DRIVERS\xVgaMini64.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\xVGAUSB64]
    "ImagePath"="system32\drivers\xvgausb64.sys"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\{07171AC2-0D2A-427d-BCE5-B6C2D6C7058B}]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\{505C5777-BDFE-4990-A45F-18F800A71028}]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\{6F1DF927-4D22-4DC8-933B-4F0103D37F72}]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\{8B9218F7-9A87-4080-88BC-01A05528F982}]
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\{DBDFFFB1-6217-4A25-8388-D76D3A05459F}]
    .
    --------------------- CLES DE REGISTRE BLOQUEES ---------------------
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
    @Denied: (A 2) (Everyone)
    @="FlashBroker"
    "LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_5_502_146_ActiveX.exe,-101"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
    "Enabled"=dword:00000001
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
    @="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_5_502_146_ActiveX.exe"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
    @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
    @Denied: (A 2) (Everyone)
    @="IFlashBroker5"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
    @="{00020424-0000-0000-C000-000000000046}"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
    @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
    "Version"="1.0"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
    @Denied: (A 2) (Everyone)
    @="FlashBroker"
    "LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_5_502_146_ActiveX.exe,-101"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
    "Enabled"=dword:00000001
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
    @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_5_502_146_ActiveX.exe"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
    @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
    @Denied: (A 2) (Everyone)
    @="Shockwave Flash Object"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
    @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_5_502_146.ocx"
    "ThreadingModel"="Apartment"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
    @="0"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
    @="ShockwaveFlash.ShockwaveFlash.11"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
    @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_5_502_146.ocx, 1"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
    @="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
    @="1.0"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
    @="ShockwaveFlash.ShockwaveFlash"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
    @Denied: (A 2) (Everyone)
    @="Macromedia Flash Factory Object"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
    @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_5_502_146.ocx"
    "ThreadingModel"="Apartment"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
    @="FlashFactory.FlashFactory.1"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
    @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_5_502_146.ocx, 1"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
    @="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
    @="1.0"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
    @="FlashFactory.FlashFactory"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
    @Denied: (A 2) (Everyone)
    @="IFlashBroker5"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
    @="{00020424-0000-0000-C000-000000000046}"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
    @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
    "Version"="1.0"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]
    @Denied: (A) (Everyone)
    "Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3]
    @Denied: (A) (Everyone)
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0]
    "Key"="ActionsPane3"
    "Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
    @Denied: (A) (Users)
    @Denied: (A) (Everyone)
    @Allowed: (B 1 2 3 4 5) (S-1-5-20)
    "BlindDial"=dword:00000000
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
    @Denied: (A) (Users)
    @Denied: (A) (Everyone)
    @Allowed: (B 1 2 3 4 5) (S-1-5-20)
    "BlindDial"=dword:00000000
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
    @Denied: (A) (Users)
    @Denied: (A) (Everyone)
    @Allowed: (B 1 2 3 4 5) (S-1-5-20)
    "BlindDial"=dword:00000000
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]
    @Denied: (A) (Users)
    @Denied: (A) (Everyone)
    @Allowed: (B 1 2 3 4 5) (S-1-5-20)
    "BlindDial"=dword:00000000
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0004\AllUserSettings]
    @Denied: (A) (Users)
    @Denied: (A) (Everyone)
    @Allowed: (B 1 2 3 4 5) (S-1-5-20)
    "BlindDial"=dword:00000000
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0005\AllUserSettings]
    @Denied: (A) (Users)
    @Denied: (A) (Everyone)
    @Allowed: (B 1 2 3 4 5) (S-1-5-20)
    "BlindDial"=dword:00000000
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
    @Denied: (Full) (Everyone)
    .
    ------------------------ Autres processus actifs ------------------------
    .
    c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
    c:\program files (x86)\Common Files\Protexis\License Service\PsiService_2.exe
    c:\program files (x86)\Sony\VAIO Event Service\VESMgr.exe
    c:\windows\SysWOW64\DllHost.exe
    c:\program files (x86)\Sony\VAIO Event Service\VESMgrSub.exe
    c:\program files\Sony\VAIO Care\listener.exe
    .
    **************************************************************************
    .
    Heure de fin: 2013-01-22 18:49:34 - La machine a redémarré
    ComboFix-quarantined-files.txt 2013-01-22 17:49
    .
    Avant-CF: 24 006 381 568 octets libres
    Après-CF: 23 384 485 888 octets libres
    .
    - - End Of File - - 855760FF571C897272D81069D6CD12ED
    0

  5. Vous n’avez pas trouvé la réponse que vous recherchez ?

    Posez votre question
  6. Fish66 Messages postés 18337 Statut Contributeur sécurité 1 318
     
    Salut,
    1/
    Héberge le rapport combofix comme suit stp :
    * Rends toi sur pjjoint.malekal.com
    * Clique sur le bouton Parcourir
    * Sélectionne le fichier que tu veux héberger et clique sur Ouvrir
    * Clique sur le bouton Envoyer
    * Un message de confirmation s'affiche (L'upload a réussi ! - Le lien à transmettre à vos correspondant pour visualiser le fichier est : https://pjjoint.malekal.com/files.php?id=df5ea299241015

    * Copie le lien dans ta prochaine réponse.

    2/
    * Télécharge puis enregistre sur le bureau de ton PC ZHPDiag(de Nicolas Coolman) à partir : ce lien
    * Lance-le, (Clic droit "exécuter en tant qu'administrateur" si tu es sous Vista/7)
    * Clique sur l'icône en forme de loupe pour lancer le diagnostique
    * Héberge le rapport ZHPDiag.txt de ton bureau sur : malekal.com ou cjoint.com
    * Fais copier/coller le lien fourni dans ta prochaine réponse
    * Aide ZHPDiag : <<< ICI >>>

    @+

    ¤¤¤ Le meilleur remède pour tous les problèmes, c'est la patience.... ¤¤¤
    0

Discussions similaires

Win64 malware gen
jules555 -
bazfile -

1 réponse
Win64:Malware-gen
ptb35 -
MisteryBean -

3 réponses
Chrome://newtab
Nova -
snoopy35_ -

14 réponses
Softonic,est-ce un virus ?
techmel1 -
techmel1 -

6 réponses
Désinstaller Softonic
Diguimette -
lilidurhone -

5 réponses