VIRUS Fermé

Question

Bonjour

Je viens de trouver ce message sur mon écran et je ne sais pas quoi faire.
Mon antivirus est NORTON Antivirus Corporate Edition
AVG, lui, n détecte rien

Merci pour votre aide

Type d'analyse :  Analyse Protection en temps réel
Evénement :  Virus détecté !
Nom du virus :Trojan.Skintrim
Fichier :  C:\WINDOWS\system32\srdezfejpu.exe
Emplacement :  C:\WINDOWS\system32
Ordinateur :  ARMELLE
Utilisateur :  SERVICE RÉSEAU
Opération :  Nettoyer  - échec : Quarantaine  - échec : Accès refusé
Date de détection : Mon Jul 09 16:05:09 2007

Utilisateur anonyme · Answer

Bonjour

Fas ceci :

Télécharge HijackThis : 
---> http://www.trendsecure.com/portal/en-US/threat_analytics/HiJackThis_v2.exe

Installe le dans son propre dossier :
- clic droit sur le bureau, tu choisis "nouveau dossier" puis installe-le à l'intérieur.
Fais un clic droit sur Hijackthis, choisis "renommer" puis marque ceci : abcde.exe 
Double-clic sur HijackThis. Clic sur "I Accept" puis clic sur "do a system scan and save logfile" 
Puis copie et colle ici le rapport qu'il va te générer.

Démo pour HijackThis si besoin  :
http://pageperso.aol.fr/balltrap34/demohijack.htm

Utilisateur anonyme · Answer

Désinstalle Avast et AVG inutile d'avoir trois anti-virus sur le PC.

¤ Télécharge et installe AVG anti-spyware : mets le à jour
Tu fais un scan complet de ton système, dès qu'il a fini.
Si il te trouve des espions,supprime les. Enregistre le rapport et colle le ici stp 

Téléchargeable et tutoriel sur cette page :
--> http://redir.fr/gsel

ARMELLE · Answer

J'ai déjà AVG anti spyware, et j'ai fait une analyse hier, mais je vais d'en lancer une nouvelle.

ARMELLE · Answer

---------------------------------------------------------
AVG Anti-Spyware - Rapport d'analyse
---------------------------------------------------------

 + Créé à:	17:22:03 10/07/2007

 + Résultat de l'analyse:	



C:\System Volume Information\_restore{B1AF9EEE-D04B-4C0B-BDC1-0D995925B199}\RP1010\A0062097.exe -> Adware.Casino : Nettoyé.
C:\System Volume Information\_restore{B1AF9EEE-D04B-4C0B-BDC1-0D995925B199}\RP1010\A0062098.exe -> Adware.Casino : Nettoyé.
C:\System Volume Information\_restore{B1AF9EEE-D04B-4C0B-BDC1-0D995925B199}\RP1010\A0062099.exe -> Adware.Casino : Nettoyé.
C:\System Volume Information\_restore{B1AF9EEE-D04B-4C0B-BDC1-0D995925B199}\RP1010\A0062100.exe -> Adware.Casino : Nettoyé.
C:\System Volume Information\_restore{B1AF9EEE-D04B-4C0B-BDC1-0D995925B199}\RP1011\A0062133.exe -> Adware.Casino : Nettoyé.


Fin du rapport

CI JOINT RAPPORT  AVG ANTI SPYWARE

ARMELLE · Answer

NORTON vient de faire la même alerte qu'hier, alors qu'aucune application n'était lancée !

^^Marie^^ · Answer

Salut

Juste pour avancer
Il me semble que Boulepate t'avait dit ==> Désinstalle Avast et AVG inutile d'avoir trois anti-virus sur le PC. 
L'as tu fait ?

ARMELLE · Answer

J'ai des pubs intempestives de plus en plus

^^Marie^^ · Answer

Fais un clic droit sur ce lien : 

http://perso.orange.fr/il.mafioso/Navifix/Navilog1.zip 

Enregistrer la cible (du lien) sous... et enregistre-le sur ton bureau. 
Fais un clic droit sur navilog1.zip et choisis "tout extraire" 
Ensuite double clique sur navilog1.exe pour lancer l'installation. 
Une fois l'installation terminée, le fix s'exécutera automatiquement. 
(Si ce n'est pas le cas, double-clique sur le raccourci Navilog1 présent sur le bureau). 

Laisse-toi guider. Au menu principal, choisis 1 et valides. 
(ne fais pas le choix 2,3 ou 4 sans mon avis/accord) 

Patiente jusqu'au message : 
*** Analyse Termine le ..... *** 
Appuie sur une touche comme demandé, le blocnote va s'ouvrir. 
Copie-colle l'intégralité dans une réponse. Referme le blocnote. 
Le rapport est en outre sauvegardé à la racine du disque (fixnavi.txt)

ARMELLE · Answer

Voilà le rapport.
Les fichiers ont le même nom que ceux déetctés par NORTON ????
C'est plutot bon signe non ?

Clean Navipromo version 2.0.5 commencé le 10/07/2007 à 20:49:40,18

Fix lancé depuis C:\Program Files
avilog1
Mise a jour le 01.07.2007 a 12h00 by IL-MAFIOSO

Mode suppression automatique avec prise en charge résultats Blacklight


*** Creation backups fichiers trouvés par Blacklight *** 

Copie vers "C:\Program Files
avilog1\Backupnavi"


*** Suppression des fichiers trouvés avec Blacklight ***

c:\WINDOWS\system32\srdezfejpu.dat supprimé ! 
C:\windows\system32\srdezfejpu.exe supprimé ! 
c:\WINDOWS\system32\srdezfejpu_nav.dat supprimé ! 
c:\WINDOWS\system32\srdezfejpu_navps.dat supprimé ! 
 
** 2ème passage ** 
 
C:\WINDOWS\system32\srdezfejpu.exe absent ! 
C:\WINDOWS\system32\srdezfejpu.dat absent ! 
C:\WINDOWS\system32\srdezfejpu_nav.dat absent ! 
C:\WINDOWS\system32\srdezfejpu_navps.dat absent ! 
C:\WINDOWS\system32\srdezfejpu_navup.dat absent ! 
C:\WINDOWS\system32\srdezfejpu_navtmp.dat absent ! 
C:\WINDOWS\system32\srdezfejpu_m2s.xml absent ! 


C:\WINDOWS\prefetch\srdezfejpu*.pf trouvé ! 
Copie C:\WINDOWS\prefetch\srdezfejpu*.pf réalise avec succes !
C:\WINDOWS\prefetch\srdezfejpu*.pf supprimé !

*** Suppression dossiers dans C:\WINDOWS ***


*** Suppression dossiers dans C:\Program Files ***


*** Suppression dossiers dans C:\Documents and Settings\All Users\Application Data ***


*** Suppression dossiers dans C:\Documents and Settings\Propri‚taire\Application Data ***



*** Suppression fichiers ***

C:\WINDOWS\pack.epk supprimé !
C:\WINDOWS\system32
vs2.inf supprimé !

*** Suppression fichiers temporaires ***

Nettoyage contenu C:\WINDOWS\Temp effectué !
Nettoyage contenu C:\Documents and Settings\Propri‚taire\Local Settings\Temp effectué !

 
*** Sauvegarde du registre vers dossier Backupnavi*** 
 
 
sauvegarde du registre réalise avec succes !


*** Nettoyage registre ***


Nettoyage registre Ok

*** Traitement Recherche complémentaire ***
(Recherche fichiers spécifiques)

1)Recherche fichiers connus:


2)Recherche et Suppression Heuristique :

* 
** 
*** 
**** 
***** 
****** 
******* 
******** 

3)Contrôle présence clés Rootkit dans le registre :

Aucune autre clés présente dans le registre !

4)Certificats :

Certificat Egroup supprimé !

*** Nettoyage termine le 10/07/2007 à 20:53:47,81 ***

^^Marie^^ · Answer

OK

Tu supprimes Navilog et ses composants
Tu refais un log Hitjakthis
stp

tu es dans le Var ?

Utilisateur anonyme · Answer

Bonjour

Fais ce scan anti-virus en ligne avec Internet Explorer, accepte l'active X; la barre anti-popup du SP2 (en haut) va se mettre à clignoter, clic dessus et choisis "accepter l'active X" pour  faire fonctionner le scan anti-virus.
Une fois qu'il a terminé colle le rapport ici stp

https://www.bitdefender.com/toolbox/

ARMELLE · Answer

Ci-joint rapport

BitDefender Online Scanner - Real Time Virus Report
	

 
	

 

Generated at: Wed, Jul 11, 2007 - 14:13:51

 
	

 
	

 

Scan Info
	

 
	

 

Scanned Files
	

190923

Infected Files
	

1
	

 
	

 

 
	

 
	

 

Virus Detected
	

 
	

 

Generic.Adw.SaveNow.F5FEB660
	

1
	

 
	

 

 
	

 
	

 

 
	

 
	

 

This summary of the scan process will be used by the BitDefender Antivirus Lab to create agregate statistics about virus activity around the world.

Utilisateur anonyme · Answer

Où en est ton problème ?

Qu'as-tu comme pare-feu ?

++ ;-)

Utilisateur anonyme · Answer

ok, fais ceci :

¤ Télécharge ce programme puis double clic dessus (ferme ton antivirus s'il te détecte quoi que ce soit)
http://www.suspectfile.com/systemscan/

* Coche uniquement ces cases, décoche tout le reste :

- Recent Files, 60 days
- Registry Run Key


Puis clic sur scan now, soit patient.
Une fois qu'il aura terminé, un rapport va s'ouvrir, copie et colle son contenu ici et vérifie qu'il soit bien en entier, si besoin crée deux messages.


On verra une fois que c'est propre pour le pare-feu.

ARMELLE · Answer

SystemScan - www.suspectfile.com - ver. 3.2.0

Running on: Windows XP HOME Edition, Service Pack 2 (2600.5.1)
System directory: C:\WINDOWS

Date: 11/07/2007
Time: 21:59:53

Output limited to:
-Recent files
-Registry Run Keys

===================== Recent files (60 days old)=====================

----- recent files in C:\
20/05/2007 10:57:41 (DIR) 0 byte 52 days old -- coktel
29/06/2007 13:02:52 (DIR) 0 byte 12 days old -- Mes téléchargements
04/07/2007 11:13:26 (DIR) 0 byte 7 days old -- Documents and Settings
05/07/2007 09:26:25 (DIR) 0 byte 6 days old -- Config.Msi
09/07/2007 13:24:54 2672 byte 2 days old -- devicetable.log
10/07/2007 20:19:32 (DIR) 0 byte 1 days old -- Program Files
10/07/2007 20:53:47 2346 byte 1 days old -- cleannavi.txt
11/07/2007 10:23:10 805306368 byte 0 days old -- pagefile.sys
11/07/2007 11:56:21 (DIR) 0 byte 0 days old -- WINDOWS
11/07/2007 21:59:53 (DIR) 0 byte 0 days old -- suspectfile

----- recent files in C:\WINDOWS\
20/05/2007 10:56:53 (DIR) 0 byte 52 days old -- Fonts
23/05/2007 22:13:13 (DIR) 0 byte 49 days old -- $NtUninstallKB927891$
23/05/2007 22:13:26 7671 byte 49 days old -- KB927891.log
07/06/2007 13:39:37 16574 byte 34 days old -- EPISMF00.SWB
13/06/2007 04:37:00 105335 byte 28 days old -- updspapi.log
13/06/2007 04:37:20 22343 byte 28 days old -- KB933566-IE7.log
13/06/2007 04:37:24 (DIR) 0 byte 28 days old -- $NtUninstallKB935839$
13/06/2007 04:37:28 16658 byte 28 days old -- KB935839.log
13/06/2007 04:38:58 (DIR) 0 byte 28 days old -- $NtUninstallKB935840$
13/06/2007 04:39:02 17012 byte 28 days old -- KB935840.log
13/06/2007 04:39:09 (DIR) 0 byte 28 days old -- $NtUninstallKB929123$
13/06/2007 04:39:14 1374 byte 28 days old -- imsins.BAK
13/06/2007 04:39:14 17727 byte 28 days old -- KB929123.log
22/06/2007 09:28:35 (DIR) 0 byte 19 days old -- Help
22/06/2007 09:28:35 (DIR) 0 byte 19 days old -- SoftwareDistribution
26/06/2007 11:11:25 878 byte 15 days old -- system.ini
26/06/2007 11:15:05 (DIR) 0 byte 15 days old -- Tasks
26/06/2007 11:23:23 37 byte 15 days old -- vbaddin.ini
26/06/2007 11:23:32 (DIR) 0 byte 15 days old -- ShellNew
26/06/2007 11:27:36 54156 byte 15 days old -- QTFont.qfn
26/06/2007 11:27:36 1409 byte 15 days old -- QTFont.for
27/06/2007 13:18:06 (DIR) 0 byte 14 days old -- WinSxS
04/07/2007 10:54:12 (DIR) 0 byte 7 days old -- Crystal
04/07/2007 12:22:48 (DIR) 0 byte 7 days old -- Installer
05/07/2007 09:26:25 (DIR) 0 byte 6 days old -- SxsCaPendDel
05/07/2007 12:07:46 68179 byte 6 days old -- wmsetup.log
09/07/2007 21:31:56 185623 byte 2 days old -- setupact.log
10/07/2007 11:53:28 0 byte 1 days old -- nsreg.dat
10/07/2007 11:57:34 1156 byte 1 days old -- mozver.dat
10/07/2007 18:31:47 (DIR) 0 byte 1 days old -- system
10/07/2007 20:53:48 (DIR) 0 byte 1 days old -- system32
11/07/2007 03:34:26 32530 byte 0 days old -- SchedLgU.Txt
11/07/2007 10:23:12 2048 byte 0 days old -- bootstat.dat
11/07/2007 10:23:28 50 byte 0 days old -- wiaservc.log
11/07/2007 10:23:34 157 byte 0 days old -- wiadebug.log
11/07/2007 10:23:35 0 byte 0 days old -- 0.log
11/07/2007 10:23:41 (DIR) 0 byte 0 days old -- Temp
11/07/2007 10:26:20 (DIR) 0 byte 0 days old -- LastGood
11/07/2007 10:26:21 (DIR) 0 byte 0 days old -- $hf_mig$
11/07/2007 11:18:18 (DIR) 0 byte 0 days old -- Downloaded Program Files
11/07/2007 11:56:11 (DIR) 0 byte 0 days old -- $NtUninstallKB936357$
11/07/2007 11:56:25 520231 byte 0 days old -- ocgen.log
11/07/2007 11:56:25 (DIR) 0 byte 0 days old -- inf
11/07/2007 11:56:25 52877 byte 0 days old -- msgsocm.log
11/07/2007 11:56:25 1048897 byte 0 days old -- FaxSetup.log
11/07/2007 11:56:25 843998 byte 0 days old -- setupapi.log
11/07/2007 11:56:26 48994 byte 0 days old -- ocmsn.log
11/07/2007 11:56:26 199207 byte 0 days old -- ntdtcsetup.log
11/07/2007 11:56:26 406342 byte 0 days old -- tsoc.log
11/07/2007 11:56:26 329906 byte 0 days old -- comsetup.log
11/07/2007 11:56:26 1374 byte 0 days old -- imsins.log
11/07/2007 11:56:26 164897 byte 0 days old -- iis6.log
11/07/2007 11:56:26 10795 byte 0 days old -- KB936357.log
11/07/2007 11:58:36 1372465 byte 0 days old -- WindowsUpdate.log
11/07/2007 14:13:51 (DIR) 0 byte 0 days old -- BDOSCAN8
11/07/2007 21:59:09 (DIR) 0 byte 0 days old -- Prefetch

----- recent files in C:\WINDOWS\Downloaded Program Files\

----- recent files in C:\WINDOWS\system\

----- recent files in C:\WINDOWS\system32\
16/05/2007 17:13:53 683520 byte 56 days old -- inetcomm.dll
18/05/2007 09:24:36 (DIR) 0 byte 54 days old -- config
20/05/2007 11:00:55 1507 byte 52 days old -- Adiboud'chou.lnk
26/06/2007 11:13:21 (DIR) 0 byte 15 days old -- Adobe
26/06/2007 11:22:18 (DIR) 0 byte 15 days old -- Macromed
26/06/2007 11:38:53 190592 byte 15 days old -- FNTCACHE.DAT
28/06/2007 09:57:27 16256984 byte 13 days old -- MRT.exe
29/06/2007 13:07:43 278528 byte 12 days old -- pncrt.dll
29/06/2007 13:08:02 6656 byte 12 days old -- pndx5016.dll
29/06/2007 13:08:02 5632 byte 12 days old -- pndx5032.dll
29/06/2007 13:08:59 185952 byte 12 days old -- rmoc3260.dll
10/07/2007 19:17:40 3072 byte 1 days old -- CONFIG.NT
11/07/2007 10:24:30 2206 byte 0 days old -- wpa.dbl
11/07/2007 10:26:20 (DIR) 0 byte 0 days old -- CatRoot2
11/07/2007 11:56:13 (DIR) 0 byte 0 days old -- dllcache
11/07/2007 11:56:13 (DIR) 0 byte 0 days old -- drivers

----- recent files in C:\WINDOWS\system32\drivers\
18/05/2007 14:34:45 639224 byte 54 days old -- sptd.sys
30/05/2007 14:10:42 10872 byte 42 days old -- AvgAsCln.sys

----- recent files in C:\WINDOWS\temp\
11/07/2007 10:23:15 255 byte 0 days old -- WGAErrLog.txt
11/07/2007 10:23:28 16384 byte 0 days old -- Perflib_Perfdata_1cc.dat
11/07/2007 10:24:46 409 byte 0 days old -- WGANotify.settings

----- recent files in C:\Program Files\
17/05/2007 10:07:44 (DIR) 0 byte 55 days old -- Alwil Software
17/05/2007 10:30:02 (DIR) 0 byte 55 days old -- Lavasoft
18/05/2007 14:50:15 (DIR) 0 byte 54 days old -- DAEMON Tools
28/05/2007 14:43:53 (DIR) 0 byte 44 days old -- VirtualDub
09/06/2007 21:45:01 (DIR) 0 byte 32 days old -- eMule
13/06/2007 04:37:01 (DIR) 0 byte 28 days old -- Internet Explorer
13/06/2007 04:39:11 (DIR) 0 byte 28 days old -- Outlook Express
19/06/2007 12:32:47 (DIR) 0 byte 22 days old -- Leroy Merlin
22/06/2007 19:16:23 (DIR) 0 byte 19 days old -- EZFace
25/06/2007 23:06:06 (DIR) 0 byte 16 days old -- Grisoft
26/06/2007 11:15:09 (DIR) 0 byte 15 days old -- Apple Software Update
26/06/2007 11:22:23 (DIR) 0 byte 15 days old -- Magic Karaoke Maker
26/06/2007 11:25:58 (DIR) 0 byte 15 days old -- Nvu
26/06/2007 11:27:04 (DIR) 0 byte 15 days old -- InstallShield Installation Information
26/06/2007 11:27:05 (DIR) 0 byte 15 days old -- epson
26/06/2007 11:37:10 (DIR) 0 byte 15 days old -- Yahoo!
29/06/2007 13:09:52 (DIR) 0 byte 12 days old -- Fichiers communs
02/07/2007 15:19:28 (DIR) 0 byte 9 days old -- IKEA HomePlanner
04/07/2007 12:20:47 (DIR) 0 byte 7 days old -- Adobe
10/07/2007 11:58:29 (DIR) 0 byte 1 days old -- Mozilla Firefox
10/07/2007 21:12:33 (DIR) 0 byte 1 days old -- Navilog1
10/07/2007 23:15:15 (DIR) 0 byte 1 days old -- Everest Poker.net

----- recent files in C:\Program Files\Fichiers communs\
13/06/2007 04:39:10 (DIR) 0 byte 28 days old -- System
26/06/2007 11:23:50 (DIR) 0 byte 15 days old -- Microsoft Shared
29/06/2007 13:09:24 (DIR) 0 byte 12 days old -- Real
29/06/2007 13:09:52 (DIR) 0 byte 12 days old -- xing shared
02/07/2007 14:10:02 (DIR) 0 byte 9 days old -- Wise Installation Wizard
04/07/2007 12:21:47 (DIR) 0 byte 7 days old -- Adobe

----- recent files in C:\Documents and Settings\Propriétaire\Application Data\
17/05/2007 11:27:16 (DIR) 0 byte 55 days old -- Lavasoft
25/06/2007 23:07:07 (DIR) 0 byte 16 days old -- Grisoft
26/06/2007 11:27:57 (DIR) 0 byte 15 days old -- Apple Computer
27/06/2007 13:20:18 (DIR) 0 byte 14 days old -- Adobe
10/07/2007 11:53:21 (DIR) 0 byte 1 days old -- Mozilla
10/07/2007 16:00:08 (DIR) 0 byte 1 days old -- dvdcss

----- recent files in C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\
11/07/2007 10:23:20 (DIR) 0 byte 0 days old -- WPDNSE
11/07/2007 11:00:21 1452 byte 0 days old -- wmplog00.sqm
11/07/2007 21:25:36 (DIR) 0 byte 0 days old -- OIS
11/07/2007 21:59:02 16384 byte 0 days old -- ~DF2B14.tmp
11/07/2007 21:59:03 (DIR) 0 byte 0 days old -- nsc14D.tmp

===================== REGISTRY SCAN =====================

-----HKLM\Software\Microsoft\Windows\CurrentVersion\Run-----

[Run]
"NvCplDaemon"="RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup"
"vptray"="C:\Program Files\NavNT\vptray.exe"
"nwiz"="nwiz.exe /install"
"AdaptecDirectCD"="\"C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe\""
"TPP Auto Loader"="C:\WINDOWS\TPPALDR.EXE"
"Picasa Media Detector"="C:\Program Files\Picasa2\PicasaMediaDetector.exe"
"EoEngine"=""
"EoWeather"=""
"DAEMON Tools"="\"C:\Program Files\DAEMON Tools\daemon.exe\" -lang 1033"
"!AVG Anti-Spyware"="\"C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe\" /minimized"
"TkBellExe"="\"C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe\" -osboot"
"Adobe Reader Speed Launcher"="\"C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe\""

[Run\OptionalComponents]
@=""

[Run\OptionalComponents\IMAIL]
"Installed"="1"
@=""

[Run\OptionalComponents\MAPI]
"Installed"="1"
"NoChange"="1"
@=""

[Run\OptionalComponents\MSFS]
"Installed"="1"
@=""

-----HKCU\Software\Microsoft\Windows\CurrentVersion\Run-----

[Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe"
"MoneyAgent"="\"C:\Program Files\Microsoft Money\System\mnyexpr.exe\""

-----HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Run-----

[Run]
"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE"

-----HKLM\Software\Microsoft\Windows\CurrentVersion\policies\Explorer\Run-----

-----HKCU\Software\Microsoft\Windows\CurrentVersion\policies\Explorer\Run-----

-----HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows-----

[Windows]
"AppInit_DLLs"=""

-----HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad-----

[ShellServiceObjectDelayLoad]
"PostBootReminder"="{7849596a-48ea-486e-8937-a2a3009f31a9}"
#### HKCR\CLSID\{7849596a-48ea-486e-8937-a2a3009f31a9}\InprocServer32 @=expand:"%SystemRoot%\system32\SHELL32.dll"
"CDBurn"="{fbeb8a05-beee-4442-804e-409d6c4515e9}"
#### HKCR\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InprocServer32 @=expand:"%SystemRoot%\system32\SHELL32.dll"
"WebCheck"="{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"
#### HKCR\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\InprocServer32 @=expand:"C:\WINDOWS\system32\webcheck.dll"
"SysTray"="{35CEC8A3-2BE6-11D2-8773-92E220524153}"
#### HKCR\CLSID\{35CEC8A3-2BE6-11D2-8773-92E220524153}\InprocServer32 @="C:\WINDOWS\System32\stobject.dll"
"WPDShServiceObj"="{AAA288BA-9A4C-45B0-95D7-94D524869DB5}"
#### HKCR\CLSID\{AAA288BA-9A4C-45B0-95D7-94D524869DB5}\InprocServer32 @="C:\WINDOWS\system32\WPDShServiceObj.dll"

-----HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks-----

[ShellExecuteHooks]
"{AEB6717E-7E19-11d0-97EE-00C04FD91972}"=""
#### HKCR\CLSID\{AEB6717E-7E19-11d0-97EE-00C04FD91972}\InprocServer32 @="shell32.dll"
"{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="AVG Anti-Spyware 7.5"
#### HKCR\CLSID\{57B86673-276A-48B2-BAE7-C6DBB3020EB8}\InprocServer32 @="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\shellexecutehook.dll"

-----HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon-----

[Winlogon]
"Shell"="Explorer.exe"
"System"=""
"Userinit"="C:\WINDOWS\system32\userinit.exe,"
"VmApplet"="rundll32 shell32,Control_RunDLL \"sysdm.cpl\""
"UIHost"=expand:"logonui.exe"
"LogonType"=dword:00000001
"WinStationsDisabled"="0"

[Winlogon\GPExtensions]

[Winlogon\GPExtensions\{3610eda5-77ef-11d2-8dc5-00c04fa31a66}]
"@="Quota du disque Microsoft"
"DllName"=expand:"dskquota.dll"

[Winlogon\GPExtensions\{4CFB60C1-FAA6-47f1-89AA-0B18730C9FD3}]
"@="Internet Explorer Zonemapping"
"DllName"=expand:"iedkcs32.dll"

[Winlogon\GPExtensions\{827D319E-6EAC-11D2-A4EA-00C04F79F83A}]
"DllName"=expand:"scecli.dll"
"@="Security"

[Winlogon\GPExtensions\{A2E30F80-D7DE-11d2-BBDE-00C04F86AE3B}]
"DllName"="iedkcs32.dll"
"@="Internet Explorer Branding"

[Winlogon\GPExtensions\{B1BE8D72-6EAC-11D2-A4EA-00C04F79F83A}]
"DllName"=expand:"scecli.dll"
"@="EFS recovery"

[Winlogon\GPExtensions\{c6dc5466-785a-11d2-84d0-00c04fb169f7}]
"@="Installation de logiciel"
"DllName"=expand:"appmgmts.dll"

[Winlogon\Notify]

[Winlogon\Notify\crypt32chain]
"DllName"=expand:"crypt32.dll"
"Logoff"="ChainWlxLogoffEvent"

[Winlogon\Notify\cryptnet]
"DllName"=expand:"cryptnet.dll"
"Logoff"="CryptnetWlxLogoffEvent"

[Winlogon\Notify\cscdll]
"DLLName"="cscdll.dll"
"Logon"="WinlogonLogonEvent"
"Logoff"="WinlogonLogoffEvent"
"ScreenSaver"="WinlogonScreenSaverEvent"
"Startup"="WinlogonStartupEvent"
"StartShell"="WinlogonStartShellEvent"

[Winlogon\Notify\NavLogon]
"DllName"="C:\WINDOWS\System32\NavLogon.dll"
"Logoff"="NavLogoffEvent"
"StartShell"="NavStartShellEvent"

[Winlogon\Notify\ScCertProp]
"DLLName"="wlnotify.dll"
"Logon"="SCardStartCertProp"
"Logoff"="SCardStopCertProp"
"Lock"="SCardSuspendCertProp"
"Unlock"="SCardResumeCertProp"
"Enabled"=dword:00000001

[Winlogon\Notify\Schedule]
"DllName"=expand:"wlnotify.dll"
"StartShell"="SchedStartShell"
"Logoff"="SchedEventLogOff"

[Winlogon\Notify\sclgntfy]
"Logoff"="WLEventLogoff"
"DllName"=expand:"sclgntfy.dll"

[Winlogon\Notify\SensLogn]
"DLLName"="WlNotify.dll"
"Lock"="SensLockEvent"
"Logon"="SensLogonEvent"
"Logoff"="SensLogoffEvent"
"Safe"=dword:00000001
"MaxWait"=dword:00000258
"StartScreenSaver"="SensStartScreenSaverEvent"
"StopScreenSaver"="SensStopScreenSaverEvent"
"Startup"="SensStartupEvent"
"StartShell"="SensStartShellEvent"
"PostShell"="SensPostShellEvent"
"Disconnect"="SensDisconnectEvent"
"Reconnect"="SensReconnectEvent"
"Unlock"="SensUnlockEvent"

[Winlogon\Notify\termsrv]
"DllName"=expand:"wlnotify.dll"
"Logoff"="TSEventLogoff"
"Logon"="TSEventLogon"
"PostShell"="TSEventPostShell"
"StartShell"="TSEventStartShell"
"Startup"="TSEventStartup"
"MaxWait"=dword:00000258
"Reconnect"="TSEventReconnect"
"Disconnect"="TSEventDisconnect"

[Winlogon\Notify\WgaLogon]
"Logon"="WLEventLogon"
"Logoff"="WLEventLogoff"
"Startup"="WLEventStartup"
"StartScreenSaver"="WLEventStartScreenSaver"
"StopScreenSaver"="WLEventStopScreenSaver"
"Lock"="WLEventLock"
"Unlock"="WLEventUnlock"
"StartShell"="WLEventStartShell"
"PostShell"="WLEventPostShell"
"Disconnect"="WLEventDisconnect"
"Reconnect"="WLEventReconnect"
"SafeMode"=dword:00000001
"MaxWait"=dword:ffffffff
"DllName"=expand:"WgaLogon.dll"

[Winlogon\Notify\WgaLogon\Settings]

[Winlogon\Notify\wlballoon]
"DLLName"="wlnotify.dll"
"Logon"="RegisterTicketExpiredNotificationEvent"
"Logoff"="UnregisterTicketExpiredNotificationEvent"

[Winlogon\SpecialAccounts]

[Winlogon\SpecialAccounts\UserList]
"HelpAssistant"=dword:00000000
"TsInternetUser"=dword:00000000
"SQLAgentCmdExec"=dword:00000000
"NetShowServices"=dword:00000000
"IWAM_"=dword:00010000
"IUSR_"=dword:00010000
"VUSR_"=dword:00010000

-----HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon-----

[Winlogon]
"ParseAutoexec"="1"
"ExcludeProfileDirs"="Local Settings;Temporary Internet Files;Historique;Temp;Local Settings\Application Data\Microsoft\Outlook"
"BuildNumber"=dword:00000a28

-----HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options-----

[Image File Execution Options\Your Image File Name Here without a path]
"Debugger"="ntsd -d"

-----HKLM\System\CurrentControlSet\Control\Session Manager\-----

[Session Manager]
"BootExecute"=multi:"autocheck autochk *\00\00"

[Session Manager\SubSystems]
"Windows"=expand:"%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,3072,512 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ProfileControl=Off MaxRequestThreads=16"

-----HKLM\SYSTEM\CurrentControlSet\Control\WOW-----

[WOW]
"cmdline"=expand:"%SystemRoot%\system32\ntvdm.exe"
"wowcmdline"=expand:"%SystemRoot%\system32\ntvdm.exe -a %SystemRoot%\system32\krnl386"

-----HKLM\Software\Microsoft\Windows NT\CurrentVersion\Run-----

-----HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce-----

[RunOnce]

-----HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx-----

[RunOnceEx]

-----HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices-----

-----HKLM\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce-----

-----HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce-----

[RunOnce]

-----HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnceEx-----

-----HKCU\Software\Microsoft\Windows\CurrentVersion\RunServices-----

[RunServices]

-----HKCU\Software\Microsoft\Windows NT\CurrentVersion\Run-----

-----HKCU\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce-----

-----HKLM\Software\Microsoft\Command Processor\Autorun-----

-----HKCU\Software\Microsoft\Command Processor\Autorun-----

-----HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows\Load-----

-----HKLM\Software\Policies\Microsoft\Windows\System\Scripts\Startup-----

-----HKCU\Software\Policies\Microsoft\Windows\System\Scripts\Logon-----

-----HKLM\Software\Policies\Microsoft\Windows\System\Scripts\Logon-----

-----HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\TerminalServer\Install\Software\Microsoft\Windows\CurrentVersion\Runonce-----

-----HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\TerminalServer\Install\Software\Microsoft\Windows\CurrentVersion\Run-----

-----HKLM\System\CurrentControlSet\Control\Terminal Server\Wds\rdpwd\StartupPrograms-----

-----HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\TerminalServer\Install\Software\Microsoft\Windows\CurrentVersion\Runonce-----

-----HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler-----

[SharedTaskScheduler]
"{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Pré-chargeur Browseui"
#### HKCR\CLSID\{438755C2-A8BA-11D1-B96B-00A0C90312E1}\InprocServer32 @=expand:"%SystemRoot%\System32\browseui.dll"
"{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Démon de cache des catégories de composant"
#### HKCR\CLSID\{8C7461EF-2B13-11d2-BE35-3078302C2030}\InprocServer32 @=expand:"%SystemRoot%\System32\browseui.dll"

-----HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects-----

[Browser Helper Objects]

[Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
@=""

[Browser Helper Objects\{243B17DE-77C7-46BF-B94B-0B5F309A0E64}]
#### HKCR\CLSID\{243B17DE-77C7-46BF-B94B-0B5F309A0E64}\InprocServer32 @="C:\Program Files\Microsoft Money\System\mnyside.dll"

[Browser Helper Objects\{64F56FC1-1272-44CD-BA6E-39723696E350}]
#### HKCR\CLSID\{64F56FC1-1272-44CD-BA6E-39723696E350}\InprocServer32 @="C:\PROGRA~1\eoRezo\EoAdv\EOREZO~1.DLL"
@="EoRezoBHO"

[Browser Helper Objects\{E99421FB-68DD-40F0-B4AC-B7027CAE2F1A}]
#### HKCR\CLSID\{E99421FB-68DD-40F0-B4AC-B7027CAE2F1A}\InprocServer32 @="C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll"

[Browser Helper Objects\{E99421FB-68DD-40F0-B4AC-B7027CAE2F1A}\EWPP]
"InternetExplore"="Called\00\00¼Ü\12\00\19ƒóu`ö\15\00H\00\00\00\15\00\00\00\01\00\00\00 Ý\12\00\00\00\00\00\01\00\00\00\00\00\00\00‚†óuÁ@ôw\00\00\00\00\00\00\06\02 Ý\12\00¼ˆrw¤Ü\12\00V‚ñup!\15\00h‚\01\00\09\00\00\00øÛ\12\00\05@\00€ìÜ\12\00\18î‘|p\05’|ÿÿÿÿm\05’|Ùõÿ\01\00\00\06\02\00\00\00\00\18\1f\06\02\01\00\00\00TÝ\12\00p!\15\00XÅ\17\00øÜ\12\00dJ\0ew%}swÚ\15\00\01\00\00\00@Ý\12\00 \16\00\02È\00\02ÿÿÿÿLÝ\12\00 êÿ\01\18\1f\06\02êpÿ\01\18\1f\06\02\01\00\00\00¿¼ÿ\01\01\00\00\00\00\00\00\00\08\00\06\02\00\00\00\00\Å\17\00Ï!úw\0b\00\12\00\00\00\00\00\01\00\00\00\08¼ÿ\01\0cà\12"
"FileExplorer"="Called\00\00üíB\01\19ƒóu¸½×\00H\00\00\00\15\00\00\00\00\00\00\00`îB\01\00\00\00\00\00\00\00\00\00\00\00\00‚†óuÁ@ôw\00\00\00\00\00\00+\01`îB\01¼ˆrwäíB\01V‚ñu\18\02\0f\00h‚\01\00\09\00\00\008íB\01\05@\00€,îB\01\18î‘|p\05’|ÿÿÿÿm\05’|Ùõ¼\02\00\00+\01\00\00\00\00p/+\01\00\00\00\00”îB\01\18\02\0f\00¨7Ô\008îB\01dJ\0ew%}sw€¹×\00\00\00\00\00€îB\01 \16½\02È½\02ÿÿÿÿŒîB\01 ê¼\02p/+\01êp¼\02p/+\01\01\00\00\00¿¼¼\02\01\00\00\00\01\00\00\00\08\00+\01\00\00\00\00¬7Ô\00Ï!úw\0b\00B\01\00\00\00\00\00\00\00\00\08¼¼\02dñB\01"
"FileBrowser"="Called\00\00\14î»\00\19ƒóuHzÕ\00H\00\00\00\15\00\00\00\00\00\00\00xî»\00\00\00\00\00\00\00\00\00\00\00\00\00‚†óuÁ@ôw\00\00\00\00\00\00+\01xî»\00¼ˆrwüí»\00V‚ñuÐsÓ\00h‚\01\00\09\00\00\00Pí»\00\05@\00€Dî»\00\18î‘|p\05’|ÿÿÿÿm\05’|Ùõ¼\02\00\00+\01\00\00\00\00p/+\01\00\00\00\00¬î»\00ÐsÓ\00hô\10\00Pî»\00dJ\0ew%}swÐ÷Õ\00\00\00\00\00˜î»\00 \16½\02È½\02ÿÿÿÿ¤î»\00 ê¼\02p/+\01êp¼\02p/+\01\01\00\00\00¿¼¼\02\01\00\00\00\02\00\00\00\08\00+\01\00\00\00\00lô\10\00Ï!úw\0b\00»\00\00\00\00\00\00\00\00\00\08¼¼\02dñ»"

[Browser Helper Objects\{FDD3B846-8D59-4ffb-8758-209B6AD74ACC}]

-----HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks-----

[URLSearchHooks]
"{CFBFAE00-17A6-11D0-99CB-00C04FD64497}"=""
#### HKCR\CLSID\{CFBFAE00-17A6-11D0-99CB-00C04FD64497}\InprocServer32 @="C:\WINDOWS\system32\ieframe.dll"

-----HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder-----

[startupfolder]

-----HKCU\Control Panel\Desktop\-----

[Desktop]

[Desktop\WindowMetrics]

-----HKEY_CLASSES_ROOT\exefile\shell\open\command-----

[command]
@="\"%1\" %*"

-----HKEY_CLASSES_ROOT\comfile\shell\open\command-----

[command]
@="\"%1\" %*"

-----HKEY_CLASSES_ROOT\batfile\shell\open\command-----

[command]
@="\"%1\" %*"

-----HKEY_CLASSES_ROOT\piffile\shell\open\command-----

[command]
@="\"%1\" %*"

-----HKEY_CLASSES_ROOT\scrFile\shell\open\command-----

[command]
@="\"%1\" /S"

-----HKEY_CLASSES_ROOT\htafile\shell\open\command-----

[Command]
@="C:\WINDOWS\system32\mshta.exe \"%1\" %*"

-----HKEY_CLASSES_ROOT\logfile\shell\open\command-----

-----HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\URL-----

[URL]

[URL\DefaultPrefix]
@="http://"

[URL\Prefixes]
"ftp"="ftp://"
"gopher"="gopher://"
"home"="http://"
"mosaic"="http://"
"www"="http://"

-----HKLM\SYSTEM\CurrentControlSet\Control\Lsa-----

[Lsa]
"Authentication Packages"=multi:"msv1_0\00\00"
"Bounds"=hex:00,30,00,00,00,20,00,00
"Security Packages"=multi:"kerberos\00msv1_0\00schannel\00wdigest\00\00"
"LsaPid"=dword:000002f8
"SecureBoot"=dword:00000001
"auditbaseobjects"=dword:00000000
"crashonauditfail"=dword:00000000
"disabledomaincreds"=dword:00000000
"everyoneincludesanonymous"=dword:00000000
"fipsalgorithmpolicy"=dword:00000000
"forceguest"=dword:00000001
"fullprivilegeauditing"=hex:00
"limitblankpassworduse"=dword:00000001
"lmcompatibilitylevel"=dword:00000000
"nodefaultadminowner"=dword:00000001
"nolmhash"=dword:00000000
"restrictanonymous"=dword:00000000
"restrictanonymoussam"=dword:00000001
"Notification Packages"=multi:"scecli\00\00"
"ImpersonatePrivilegeUpgradeToolHasRun"=dword:00000001

[Lsa\AccessProviders]
"ProviderOrder"=multi:"Windows NT Access Provider\00\00"

[Lsa\AccessProviders\Windows NT Access Provider]
"ProviderPath"=expand:"%SystemRoot%\system32\ntmarta.dll"

[Lsa\Audit]

[Lsa\Audit\PerUserAuditing]

[Lsa\Audit\PerUserAuditing\System]

[Lsa\Data]
@Class="f3ac557d"
"Pattern"=hex:6f,73,b8,1a,09,94,27,8f,04,1c,a8,6e,17,41,03,62,66,33,61,63,35,\
35,37,64,00,68,07,00,01,00,00,00,d8,00,00,00,dc,00,00,00,48,fa,06,00,d6,48,\
51,74,04,00,00,00,a0,fd,06,00,b8,fd,06,00,cc,ae,a5,53

[Lsa\GBG]
@Class="cc4934b4"
"GrafBlumGroup"=hex:bd,67,e4,35,64,1e,83,c1,f8

[Lsa\JD]
@Class="be575313"
"Lookup"=hex:51,fb,0c,ca,47,60

[Lsa\Kerberos]

[Lsa\Kerberos\Domains]

[Lsa\Kerberos\SidCache]

[Lsa\msv1_0]
"ntlmminclientsec"=dword:00000000
"ntlmminserversec"=dword:00000000

[Lsa\Skew1]
@Class="a5ae92e5"
"SkewMatrix"=hex:08,3e,ec,73,26,28,51,33,db,48,1c,ff,c9,03,81,91

[Lsa\SSO]

[Lsa\SSO\Passport1.4]
"SSOURL"="http://www.passport.com"

[Lsa\SspiCache]
"Time"=hex:70,94,e7,3f,a5,76,c5,01

[Lsa\SspiCache\digest.dll]
"Name"="Digest"
"Comment"="Digest SSPI Authentication Package"
"Capabilities"=dword:00004050
"RpcId"=dword:0000ffff
"Version"=dword:00000001
"TokenSize"=dword:0000ffff
"Time"=hex:00,fd,fd,8f,41,86,c4,01
"Type"=dword:00000031

[Lsa\SspiCache\msapsspc.dll]
"Name"="DPA"
"Comment"="DPA Security Package"
"Capabilities"=dword:00000037
"RpcId"=dword:00000011
"Version"=dword:00000001
"TokenSize"=dword:00000300
"Time"=hex:80,74,8c,96,41,86,c4,01
"Type"=dword:00000031

[Lsa\SspiCache\msnsspc.dll]
"Name"="MSN"
"Comment"="MSN Security Package"
"Capabilities"=dword:00000037
"RpcId"=dword:00000012
"Version"=dword:00000001
"TokenSize"=dword:00000300
"Time"=hex:80,74,8c,96,41,86,c4,01
"Type"=dword:00000031

-----HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess-----

[SharedAccess]
"Type"=dword:00000020
"Start"=dword:00000002
"ErrorControl"=dword:00000001
"ImagePath"=expand:"%SystemRoot%\System32\svchost.exe -k netsvcs"
"DisplayName"="Pare-feu Windows / Partage de connexion Internet"
"DependOnService"=multi:"Netman\00WinMgmt\00\00"
"DependOnGroup"=multi:"\00"
"ObjectName"="LocalSystem"
"Description"="Assure la traduction d'adresses de réseau, l'adressage, les services de résolution de noms et/ou les services de prévention d'intrusion pour un réseau de petite entreprise ou un réseau domestique."

[SharedAccess\Epoch]
"Epoch"=dword:00000c05

[SharedAccess\Parameters]
"ServiceDll"=expand:"%SystemRoot%\System32\ipnathlp.dll"

[SharedAccess\Parameters\FirewallPolicy]

[SharedAccess\Parameters\FirewallPolicy\DomainProfile]

[SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications]

[SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

[SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall"=dword:00000001
"DoNotAllowExceptions"=dword:00000000
"DisableNotifications"=dword:00000000

[SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications]

[SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\WINDOWS\system32\sessmgr.exe"="C:\WINDOWS\system32\sessmgr.exe:*:Disabled:@xpsp2res.dll,-22019"
"C:\Documents and Settings\Propriétaire\Mes documents\Mes fichiers reçus\Freeplayer\vlc\vlc.exe"="C:\Documents and Settings\Propriétaire\Mes documents\Mes fichiers reçus\Freeplayer\vlc\vlc.exe:*:Enabled:VLC media player"
"C:\Program Files\Internet Explorer\iexplore.exe"="C:\Program Files\Internet Explorer\iexplore.exe:*:Enabled:Internet Explorer"
"C:\Program Files\Freeplayer\vlc\vlc.exe"="C:\Program Files\Freeplayer\vlc\vlc.exe:*:Enabled:VLC media player"
"C:\Program Files\VideoLAN\VLC\vlc.exe"="C:\Program Files\VideoLAN\VLC\vlc.exe:*:Enabled:VLC media player"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\eMule\emule.exe"="C:\Program Files\eMule\emule.exe:*:Enabled:eMule"

[SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts]

[SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]

[SharedAccess\Setup]
"ServiceUpgrade"=dword:00000001

[SharedAccess\Setup\InterfacesUnfirewalledAtUpdate]
"{051545BD-CDC9-4321-80A6-1E88EAA1DD65}"=dword:00000001

-----HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Firewall\-----

-----HKEY_LOCAL_MACHINE\SOFTWARE\Winsock2-----

-----HKLM\Software\Microsoft\Ole-----

[Ole]
"DefaultLaunchPermission"=hex:01,00,04,80,64,00,00,00,80,00,00,00,00,00,00,00,\
14,00,00,00,02,00,50,00,03,00,00,00,00,00,18,00,01,00,00,00,01,01,00,00,00,\
00,00,05,12,00,00,00,00,00,00,00,00,00,18,00,01,00,00,00,01,01,00,00,00,00,\
00,05,04,00,00,00,00,00,00,00,00,00,18,00,01,00,00,00,01,02,00,00,00,00,00,\
05,20,00,00,00,20,02,00,00,01,05,00,00,00,00,00,05,15,00,00,00,a0,5f,84,1f,\
5e,2e,6b,49,ce,12,03,03,f4,01,00,00,01,05,00,00,00,00,00,05,15,00,00,00,a0,\
5f,84,1f,5e,2e,6b,49,ce,12,03,03,f4,01,00,00
"EnableDCOM"="Y"
"EnableRemoteConnect"="Y"
"MachineLaunchRestriction"=hex:01,00,04,80,48,00,00,00,58,00,00,00,00,00,00,00,\
14,00,00,00,02,00,34,00,02,00,00,00,00,00,18,00,1f,00,00,00,01,02,00,00,00,\
00,00,05,20,00,00,00,20,02,00,00,00,00,14,00,0b,00,00,00,01,01,00,00,00,00,\
00,01,00,00,00,00,01,02,00,00,00,00,00,05,20,00,00,00,20,02,00,00,01,02,00,\
00,00,00,00,05,20,00,00,00,20,02,00,00
"MachineAccessRestriction"=hex:01,00,04,80,44,00,00,00,54,00,00,00,00,00,00,00,\
14,00,00,00,02,00,30,00,02,00,00,00,00,00,14,00,03,00,00,00,01,01,00,00,00,\
00,00,05,07,00,00,00,00,00,14,00,07,00,00,00,01,01,00,00,00,00,00,01,00,00,\
00,00,01,02,00,00,00,00,00,05,20,00,00,00,20,02,00,00,01,02,00,00,00,00,00,\
05,20,00,00,00,20,02,00,00

[Ole\AppCompat]

[Ole\AppCompat\ActivationSecurityCheckExemptionList]
"{A50398B8-9075-4FBF-A7A1-456BF21937AD}"="1"
"{AD65A69D-3831-40D7-9629-9B0B50A93843}"="1"
"{0040D221-54A1-11D1-9DE0-006097042D69}"="1"
"{2A6D72F1-6E7E-4702-B99C-E40D3DED33C3}"="1"

-----HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WindowsUpdate\AU\-----

-----HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\-----

[Security Center]
"AntiVirusDisableNotify"=dword:00000000
"FirewallDisableNotify"=dword:00000000
"UpdatesDisableNotify"=dword:00000000
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000000

[Security Center\Monitoring]

[Security Center\Monitoring\AhnlabAntiVirus]

[Security Center\Monitoring\ComputerAssociatesAntiVirus]

[Security Center\Monitoring\KasperskyAntiVirus]

[Security Center\Monitoring\McAfeeAntiVirus]

[Security Center\Monitoring\McAfeeFirewall]

[Security Center\Monitoring\PandaAntiVirus]

[Security Center\Monitoring\PandaFirewall]

[Security Center\Monitoring\SophosAntiVirus]

[Security Center\Monitoring\SymantecAntiVirus]

[Security Center\Monitoring\SymantecFirewall]

[Security Center\Monitoring\TinyFirewall]

[Security Center\Monitoring\TrendAntiVirus]

[Security Center\Monitoring\TrendFirewall]

[Security Center\Monitoring\ZoneLabsFirewall]

-----HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore\-----

[SystemRestore]
"DisableSR"=dword:00000000
"CreateFirstRunRp"=dword:00000001
"DSMin"=dword:000000c8
"DSMax"=dword:00000190
"RPSessionInterval"=dword:00000000
"RPGlobalInterval"=dword:00015180
"RPLifeInterval"=dword:0076a700
"CompressionBurst"=dword:0000003c
"TimerInterval"=dword:00000078
"DiskPercent"=dword:0000000c
"ThawInterval"=dword:00000384
"RestoreDiskSpaceError"=dword:00000000

[SystemRestore\Cfg]
"DiskPercent"=dword:0000000c
"MachineGuid"="{B1AF9EEE-D04B-4C0B-BDC1-0D995925B199}"

[SystemRestore\SnapshotCallbacks]
@=""

-----HKEY_CURRENT_USER\Software\VB and VBA Program Settings-----

[VB and VBA Program Settings]

[VB and VBA Program Settings\Euro Add-in]

[VB and VBA Program Settings\Euro Add-in\Wizard Options]

[VB and VBA Program Settings\rootphsv4_prod_PROD]

[VB and VBA Program Settings\rootphsv4_prod_PROD\ActivexUpload]

[VB and VBA Program Settings\rootphsv4_prod_PROD\ActivexUpload\Internet Settings]

[VB and VBA Program Settings\rootphsv4_prod_PROD\ActivexUpload\Version]

[VB and VBA Program Settings\UploadPhS]

[VB and VBA Program Settings\UploadPhS\CommonDlg]

-----HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\-----

[MountPoints2]

[MountPoints2\A]
"BaseClass"="Drive"

[MountPoints2\C]
"BaseClass"="Drive"

[MountPoints2\D]
"BaseClass"="Drive"

[MountPoints2\E]
"BaseClass"="Drive"

[MountPoints2\F]
"BaseClass"="Drive"

[MountPoints2\{0ee8ee78-44ab-11da-9b65-0007e9716902}]
"BaseClass"="Drive"
"_AutorunStatus"=hex:01,00,01,00,00,01,00,df,df,5f,df,5f,5f,5f,5f,df,df,5f,5f,\
5f,df,df,df,5f,5f,5f,df,df,df,5f,5f,df,5f,5f,5f,5f,5f,cf,5f,5f,5f,5f,5f,cf,\
cf,5f,5f,5f,5f,cf,cf,cf,cf,cf,01,01,01,ee,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,\
ff,ff,00,00,10,00,00,08,00,00,00

[MountPoints2\{0ee8ee78-44ab-11da-9b65-0007e9716902}\shell]
@="None"

[MountPoints2\{0ee8ee78-44ab-11da-9b65-0007e9716902}\shell\Autoplay]
"MUIVerb"="@shell32.dll,-8504"

[MountPoints2\{0ee8ee78-44ab-11da-9b65-0007e9716902}\shell\Autoplay\DropTarget]
"CLSID"="{f26a669a-bcbb-4e37-abf9-7325da15f931}"
#### HKCR\CLSID\{f26a669a-bcbb-4e37-abf9-7325da15f931}\InprocServer32 @=expand:"%SystemRoot%\system32\SHELL32.dll"

[MountPoints2\{13a7eede-053e-11dc-9d02-0007e9716902}]
"BaseClass"="Drive"
"_AutorunStatus"=hex:01,00,01,00,00,01,00,df,df,5f,01,00,01,01,ee,ff,ff,ff,ff,\
ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,\
ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,\
ff,ff,00,20,00,00,00,09,00,00,00

[MountPoints2\{13a7eede-053e-11dc-9d02-0007e9716902}\Shell]
@="AutoRun"

[MountPoints2\{13a7eede-053e-11dc-9d02-0007e9716902}\Shell\AutoRun]
@="&Exécution automatique"

[MountPoints2\{13a7eede-053e-11dc-9d02-0007e9716902}\Shell\AutoRun\command]
@="F:\autorun\autorun.exe"

[MountPoints2\{13a7eede-053e-11dc-9d02-0007e9716902}\_Autorun]

[MountPoints2\{13a7eede-053e-11dc-9d02-0007e9716902}\_Autorun\DefaultIcon]
@="F:\autorun\CDRomIcon.ico"

[MountPoints2\{143a9d46-6313-11d8-9980-0007e9716902}]
"BaseClass"="Drive"
"_AutorunStatus"=hex:01,00,01,00,00,01,00,df,df,5f,df,5f,5f,5f,5f,df,df,5f,5f,\
5f,df,df,df,5f,5f,5f,df,df,df,5f,5f,df,5f,5f,5f,5f,5f,01,00,01,01,ee,ff,ff,\
ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,\
ff,ff,00,01,00,00,00,08,03,00,00

[MountPoints2\{143a9d46-6313-11d8-9980-0007e9716902}\shell]
@="None"

[MountPoints2\{143a9d46-6313-11d8-9980-0007e9716902}\shell\Autoplay]
"MUIVerb"="@shell32.dll,-8504"

[MountPoints2\{143a9d46-6313-11d8-9980-0007e9716902}\shell\Autoplay\DropTarget]
"CLSID"="{f26a669a-bcbb-4e37-abf9-7325da15f931}"
#### HKCR\CLSID\{f26a669a-bcbb-4e37-abf9-7325da15f931}\InprocServer32 @=expand:"%SystemRoot%\system32\SHELL32.dll"

[MountPoints2\{23eb6074-cefa-11da-9bf3-0007e9716902}]
"BaseClass"="Drive"
"_AutorunStatus"=hex:01,00,01,00,00,01,00,df,df,5f,df,5f,5f,5f,5f,df,df,5f,5f,\
5f,df,df,df,5f,5f,5f,df,df,df,5f,5f,df,5f,5f,5f,5f,5f,cf,5f,5f,5f,5f,5f,cf,\
cf,5f,5f,5f,5f,cf,cf,cf,cf,cf,01,01,01,ee,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,\
ff,ff,00,00,10,00,00,08,00,00,00

[MountPoints2\{23eb6074-cefa-11da-9bf3-0007e9716902}\shell]
@="None"

[MountPoints2\{23eb6074-cefa-11da-9bf3-0007e9716902}\shell\Autoplay]
"MUIVerb"="@shell32.dll,-8504"

[MountPoints2\{23eb6074-cefa-11da-9bf3-0007e9716902}\shell\Autoplay\DropTarget]
"CLSID"="{f26a669a-bcbb-4e37-abf9-7325da15f931}"
#### HKCR\CLSID\{f26a669a-bcbb-4e37-abf9-7325da15f931}\InprocServer32 @=expand:"%SystemRoot%\system32\SHELL32.dll"

[MountPoints2\{2b8b733d-fc61-11da-9c08-0007e9716902}]
"BaseClass"="Drive"
"_AutorunStatus"=hex:01,00,01,00,00,01,00,df,df,5f,df,5f,5f,5f,5f,df,df,5f,5f,\
5f,df,df,df,5f,5f,5f,df,df,df,5f,5f,df,5f,5f,5f,5f,5f,01,00,01,01,ee,ff,ff,\
ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,\
ff,ff,00,00,10,00,00,08,06,00,00

[MountPoints2\{2b8b733d-fc61-11da-9c08-0007e9716902}\shell]
@="None"

[MountPoints2\{2b8b733d-fc61-11da-9c08-0007e9716902}\shell\Autoplay]
"MUIVerb"="@shell32.dll,-8504"

[MountPoints2\{2b8b733d-fc61-11da-9c08-0007e9716902}\shell\Autoplay\DropTarget]
"CLSID"="{f26a669a-bcbb-4e37-abf9-7325da15f931}"
#### HKCR\CLSID\{f26a669a-bcbb-4e37-abf9-7325da15f931}\InprocServer32 @=expand:"%SystemRoot%\system32\SHELL32.dll"

[MountPoints2\{4285d32a-2910-11db-9c23-0007e9716902}]
"BaseClass"="Drive"
"_AutorunStatus"=hex:01,00,01,00,00,01,00,df,df,5f,df,5f,5f,5f,5f,df,df,5f,5f,\
5f,df,df,df,5f,5f,5f,df,df,df,5f,5f,df,5f,5f,5f,5f,5f,00,5f,5f,5f,5f,5f,cf,\
cf,5f,5f,5f,5f,01,01,00,ee,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,\
ff,ff,00,00,10,00,00,08,02,00,00

[MountPoints2\{4285d32a-2910-11db-9c23-0007e9716902}\shell]
@="None"

[MountPoints2\{4285d32a-2910-11db-9c23-0007e9716902}\shell\Autoplay]
"MUIVerb"="@shell32.dll,-8504"

[MountPoints2\{4285d32a-2910-11db-9c23-0007e9716902}\shell\Autoplay\DropTarget]
"CLSID"="{f26a669a-bcbb-4e37-abf9-7325da15f931}"
#### HKCR\CLSID\{f26a669a-bcbb-4e37-abf9-7325da15f931}\InprocServer32 @=expand:"%SystemRoot%\system32\SHELL32.dll"

[MountPoints2\{4285d32b-2910-11db-9c23-0007e9716902}]
"BaseClass"="Drive"

[MountPoints2\{94b6f63b-4c02-11d8-a381-806d6172696f}]
"BaseClass"="Drive"

[MountPoints2\{abb66482-1c7c-11db-9c17-0007e9716902}]
"BaseClass"="Drive"
"_AutorunStatus"=hex:01,00,01,00,00,01,00,df,df,5f,df,5f,5f,5f,5f,df,df,5f,5f,\
5f,df,df,df,5f,5f,5f,df,df,df,5f,5f,df,5f,5f,5f,5f,5f,00,5f,5f,5f,5f,5f,cf,\
cf,5f,5f,5f,5f,01,01,00,ee,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,\
ff,ff,00,00,10,00,00,08,01,00,00

[MountPoints2\{abb66482-1c7c-11db-9c17-0007e9716902}\shell]
@="None"

[MountPoints2\{abb66482-1c7c-11db-9c17-0007e9716902}\shell\Autoplay]
"MUIVerb"="@shell32.dll,-8504"

[MountPoints2\{abb66482-1c7c-11db-9c17-0007e9716902}\shell\Autoplay\DropTarget]
"CLSID"="{f26a669a-bcbb-4e37-abf9-7325da15f931}"
#### HKCR\CLSID\{f26a669a-bcbb-4e37-abf9-7325da15f931}\InprocServer32 @=expand:"%SystemRoot%\system32\SHELL32.dll"

[MountPoints2\{b1ff43c6-c60c-11d9-9adb-0007e9716902}]
"BaseClass"="Drive"
"_AutorunStatus"=hex:01,00,01,00,00,01,00,df,df,5f,df,5f,5f,5f,5f,df,df,5f,5f,\
5f,df,df,df,5f,5f,5f,df,df,df,5f,5f,df,5f,5f,5f,5f,5f,00,5f,5f,5f,5f,5f,cf,\
cf,5f,5f,5f,5f,01,01,00,ee,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,\
ff,ff,00,00,10,00,00,08,02,00,00

[MountPoints2\{b1ff43c6-c60c-11d9-9adb-0007e9716902}\shell]
@="None"

[MountPoints2\{b1ff43c6-c60c-11d9-9adb-0007e9716902}\shell\Autoplay]
"MUIVerb"="@shell32.dll,-8504"

[MountPoints2\{b1ff43c6-c60c-11d9-9adb-0007e9716902}\shell\Autoplay\DropTarget]
"CLSID"="{f26a669a-bcbb-4e37-abf9-7325da15f931}"
#### HKCR\CLSID\{f26a669a-bcbb-4e37-abf9-7325da15f931}\InprocServer32 @=expand:"%SystemRoot%\system32\SHELL32.dll"

[MountPoints2\{d7641fc1-4bfa-11d8-993d-806d6172696f}]
"BaseClass"="Drive"

[MountPoints2\{d7641fc2-4bfa-11d8-993d-806d6172696f}]
"BaseClass"="Drive"
"_AutorunStatus"=hex:01,00,01,00,00,01,00,df,df,5f,cf,5f,5f,5f,5f,cf,cf,5f,5f,\
5f,cf,01,01,00,5f,5f,ee,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,\
ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,\
ff,ff,00,20,00,00,00,0c,00,00,00

[MountPoints2\{d7641fc2-4bfa-11d8-993d-806d6172696f}\_Autorun]

[MountPoints2\{d7641fc2-4bfa-11d8-993d-806d6172696f}\_Autorun\DefaultIcon]
@="D:\Install.ico"

[MountPoints2\{d7641fc3-4bfa-11d8-993d-806d6172696f}]
"BaseClass"="Drive"
"_AutorunStatus"=hex:01,00,01,00,00,01,00,df,df,5f,cf,5f,5f,5f,5f,cf,cf,5f,5f,\
5f,cf,cf,cf,5f,5f,5f,cf,cf,cf,5f,5f,cf,5f,5f,5f,5f,5f,00,5f,5f,5f,5f,5f,df,\
df,5f,5f,5f,5f,00,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,\
ff,ff,00,e0,00,00,00,08,01,00,00

[MountPoints2\{d7641fc3-4bfa-11d8-993d-806d6172696f}\_Autorun]

[MountPoints2\{d7641fc3-4bfa-11d8-993d-806d6172696f}\_Autorun\DefaultIcon]
@="E:\Install.ico"

-----HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\AdvancedOptions-----

[AdvancedOptions]

[AdvancedOptions\INTERNATIONAL]
"Text"="International*"

[AdvancedOptions\INTERNATIONAL\IDN]
"Text"="Send IDN server names"

[AdvancedOptions\INTERNATIONAL\IDN_INFOBAR]
"Text"="Show Information bar for encoded addresses"

[AdvancedOptions\INTERNATIONAL\IDN_INTRANET]
"Text"="Send IDN server names for Intranet addresses"

[AdvancedOptions\INTERNATIONAL\IDN_SHOWPUNY]
"Text"="Always show encoded addresses"

[AdvancedOptions\INTERNATIONAL\UTF8_MAILTO]
"Text"="Use UTF-8 for mailto links"

[AdvancedOptions\INTERNATIONAL\UTF8_URL]
"Text"="Send UTF-8 URLs"

-----HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\AdvancedOptions-----

-----HKLM\Software\Microsoft\Active Setup\Installed Components-----

[Installed Components]

[Installed Components\<{12d0ed0d-0ee0-4f90-8827-78cefb8f4988}]
"@="IE7 Uninstall Stub"
"ComponentID"="IEUDINIT"
"StubPath"="C:\WINDOWS\system32\ieudinit.exe"

[Installed Components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}]
#### HKCR\CLSID\{22d6f312-b0f6-11d0-94ab-0080c74c7e95}\InprocServer32 @="C:\WINDOWS\system32\wmpdxm.dll"
"Stubpath"="C:\WINDOWS\inf\unregmp2.exe /ShowWMP"
"@="Lecteur Windows Media"
"ComponentID"="WMPACCESS"

[Installed Components\>{26923b43-4d38-484f-9b9e-de460746276c}]
"@="Internet Explorer"
"ComponentID"="IEACCESS"
"StubPath"="C:\WINDOWS\system32\ie4uinit.exe -UserIconConfig"

[Installed Components\>{34CD4C6A-0C6B-4A5A-A2DD-524B749F5B11}]
"StubPath"="RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP"
"@="Personnalisation du navigateur"
"ComponentID"="BRANDING.CAB"

[Installed Components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"@="Browser Customizations"
"ComponentiD"="BRANDING.CAB"
"StubPath"="RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP"

[Installed Components\>{881dd1c5-3dcf-431b-b061-f3f88e8be88a}]
"@="Outlook Express"
"ComponentID"="OEACCESS"
"StubPath"=expand:"%systemroot%\system32\shmgrate.exe OCInstallUserConfigOE"

[Installed Components\WriteRegStr]

[Installed Components\{03F998B2-0E00-11D3-A498-00104B6EB52E}]
#### HKCR\CLSID\{03F998B2-0E00-11D3-A498-00104B6EB52E}\InprocServer32 @="C:\Program Files\Viewpoint\Viewpoint Media Player\AxMetaStream_0302021C_.dll"
"@="Viewpoint Media Player"
"ComponentID"="Viewpoint"

[Installed Components\{057997dd-71e4-43cc-b161-3f8180691a9e}]
"@="Q824145"
"ComponentID"="Q824145"

[Installed Components\{08B0E5C0-4FCB-11CF-AAA5-00401C608500}]
"@="Microsoft VM"
"ComponentID"="JAVAVM"
"KeyFileName"="C:\WINDOWS\System32\msjava.dll"

[Installed Components\{08B0E5C0-4FCB-11CF-AAA5-00401C608555}]
"@="Internet Explorer Classes for Java"
"ComponentID"="IEJAVA"

[Installed Components\{0fde1f56-0d59-4fd7-9624-e3df6b419d0e}]
"@="Fichier Lisez-moi d'Internet Explorer"
"ComponentID"="IEREADME"

[Installed Components\{0fde1f56-0d59-4fd7-9624-e3df6b419d0f}]
"@="IEEX"
"ComponentID"="IEEX"

[Installed Components\{10072CEC-8CC1-11D1-986E-00A0C955B42F}]
"@="Rendu VML (Vector Graphics Rendering)"
"ComponentID"="MSVML"

[Installed Components\{12322000-FC00-BC00-0000-123220000001}]
"@="Free - Kit de connexion"
"ComponentID"="Free - Kit de connexion"

[Installed Components\{1B00725B-C455-4DE6-BFB6-AD540AD427CD}]
#### HKCR\CLSID\{1B00725B-C455-4DE6-BFB6-AD540AD427CD}\InprocServer32 @="C:\Program Files\Viewpoint\Viewpoint Media Player\AxMetaStream_0302021C_.dll"
"@="Viewpoint Media Player"
"ComponentID"="Viewpoint"

[Installed Components\{2179C5D3-EBFF-11CF-B6FD-00AA00B4E220}]
#### HKCR\CLSID\{2179C5D3-EBFF-11CF-B6FD-00AA00B4E220}\InprocServer32 @="C:\WINDOWS\system32\wmpdxm.dll"
"ComponentID"="NetShow"
"StubPath"=""

[Installed Components\{22d6f312-b0f6-11d0-94ab-0080c74c7e95}]
#### HKCR\CLSID\{22d6f312-b0f6-11d0-94ab-0080c74c7e95}\InprocServer32 @="C:\WINDOWS\system32\wmpdxm.dll"
"ComponentID"="Microsoft Windows Media Player"
"StubPath"=""
"@="Microsoft Windows Media Player 6.4"

[Installed Components\{283807B5-2C60-11D0-A31D-00AA00B92C03}]
"@="DirectAnimation"
"ComponentID"="DirectAnimation"

[Installed Components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}]
"@="Themes Setup"
"ComponentID"="Theme Component"
"StubPath"=expand:"%SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll"

[Installed Components\{36f8ec70-c29a-11d1-b5c7-0000f8051515}]
"@="Liaison de données Dynamic HTML pour Java"
"ComponentID"="TridataJava"

[Installed Components\{3af36230-a269-11d1-b5bf-0000f8051515}]
"@="Offline Browsing Pack"
"ComponentID"="MobilePk"

[Installed Components\{3bf42070-b3b1-11d1-b5c5-0000f8051515}]
"@="Uniscribe"
"ComponentID"="USP10"

[Installed Components\{4278c270-a269-11d1-b5bf-0000f8051515}]
"@="Création avancée"
"ComponentID"="AdvAuth"

[Installed Components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}]
"@="Microsoft Outlook Express 6"
"ComponentID"="MailNews"
"StubPath"=expand:"\"%ProgramFiles%\Outlook Express\setup50.exe\" /APP:OE /CALLER:WINNT /user /install"

[Installed Components\{44BBA842-CC51-11CF-AAFA-00AA00B6015B}]
"@="NetMeeting 3.01"
"ComponentID"="NetMeeting"
"StubPath"="rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT"

[Installed Components\{44BBA848-CC51-11CF-AAFA-00AA00B6015C}]
"@="DirectShow"
"ComponentID"="activemovie"

[Installed Components\{44BBA855-CC51-11CF-AAFA-00AA00B6015F}]
"@="DirectDrawEx"
"ComponentID"="DirectDrawEx"

[Installed Components\{45ea75a0-a269-11d1-b5bf-0000f8051515}]
"@="Internet Explorer Help"
"ComponentID"="HelpCont"

[Installed Components\{4f216970-c90c-11d1-b5c7-0000f8051515}]
"@="Classes Java DirectAnimation"
"ComponentID"="DAJava"

[Installed Components\{4f645220-306d-11d2-995d-00c04f98bbc9}]
"@="Microsoft Windows Script 5.6"
"ComponentID"="MSVBScript"

[Installed Components\{5945c046-1e7d-11d1-bc44-00c04fd912be}]
"ComponentID"="Messenger"
"StubPath"="rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser"
"@="Windows Messenger 4.7"
"KeyFileName"="C:\Program Files\Messenger\msmsgs.exe"

[Installed Components\{5A8D6EE0-3E18-11D0-821E-444553540000}]
"(Default)"="Internet Connection Wizard"
"ComponentID"="ICW"

[Installed Components\{5c9ff2bf-938d-47fe-85d9-9dbab4f65018}]
"@="KB897715"
"ComponentID"="KB897715"

[Installed Components\{5DB0C8C8-885F-4917-8D3A-A4F13F6C1C2F}]
"@="Sun Java Runtime Environment"
"ComponentID"="CUSTOM1"

[Installed Components\{5fd399c0-a70a-11d1-9948-00c04f98bbc9}]
"@="Internet Explorer Setup Tools"
"ComponentID"="GenSetup"

[Installed Components\{630b1da0-b465-11d1-9948-00c04f98bbc9}]
"@="Browsing Enhancements"
"ComponentID"="ExtraPack"
"KeyFileName"="C:\WINDOWS\System32\msieftp.dll"

[Installed Components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}]
#### HKCR\CLSID\{6BF52A52-394A-11d3-B153-00C04F79FAA6}\InprocServer32 @="C:\WINDOWS\system32\wmp.dll"
"@="Microsoft Windows Media Player"
"ComponentID"="Microsoft Windows Media Player"
"StubPath"="rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\wmp11.inf,PerUserStub"

[Installed Components\{6fab99d0-bab8-11d1-994a-00c04f98bbc9}]
"@="MSN Site Access"
"ComponentID"="MSN_Auth"

[Installed Components\{73FA19D0-2D75-11D2-995D-00C04F98BBC9}]
"@="Dossiers Web"
"ComponentID"="WebFolders"
"StubPath"=""

[Installed Components\{7790769C-0471-11d2-AF11-00C04FA35D02}]
"@="Carnet d'adresses 6"
"ComponentID"="WAB"
"StubPath"=expand:"\"%ProgramFiles%\Outlook Express\setup50.exe\" /APP:WAB /CALLER:WINNT /user /install"

[Installed Components\{79844cfb-ac65-4e10-a06a-c974234f40d0}]
"@="KB883939"
"ComponentID"="KB883939"

[Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4340}]
"@="Mise à jour du Bureau Windows"
"ComponentID"="IE4Shell_NT"
"StubPath"=expand:"regsvr32.exe /s /n /i:U shell32.dll"

[Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4383}]
"@="Internet Explorer"
"ComponentID"="BASEIE40_W2K"
"StubPath"="C:\WINDOWS\system32\ie4uinit.exe -BaseSettings"

[Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4383}\AuthorizedCDFPrefix]

[Installed Components\{9381D8F2-0288-11D0-9501-00AA00B911A5}]
"@="Dynamic HTML Data Binding"
"ComponentID"="Tridata"

[Installed Components\{abcdf74f-9a64-4e6e-b8eb-6e5a41de6550}]

[Installed Components\{abcdf74f-9a64-4e6e-b8eb-6e5a41de6550}\040C]

[Installed Components\{C9E9A340-D1F1-11D0-821E-444553540600}]
"@="Internet Explorer Core Fonts"
"ComponentID"="Fontcore"

[Installed Components\{CC2A9BA0-3BDD-11D0-821E-444553540000}]
"@="Planificateur de tâches"
"ComponentID"="MSTASK"

[Installed Components\{CDD7975E-60F8-41d5-8149-19E51D6F71D0}]
"ComponentID"="Windows Movie Maker v2.1"

[Installed Components\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
"@="Adobe Flash Player 9 ActiveX"
"ComponentID"="Flash"

[Installed Components\{de5aed00-a4bf-11d1-9948-00c04f98bbc9}]
"@="HTML Help"
"ComponentID"="HTMLHelp"

[Installed Components\{E92B03AB-B707-11d2-9CBD-0000F87A369E}]
"@="Active Directory Service Interface"
"ComponentID"="ADSI"

[Installed Components\{eddbec60-89cb-44ef-8291-0850fd28ff6a}]
"@="Q832894"
"ComponentID"="Q832894"

[Installed Components\{F5776D81-AE53-4935-8E84-B0B283D8BCEF}]
"@="Q330994"
"ComponentID"="Q330994"

-----Comparing registry keys CCS1 vs CCS2 -----
< Value: HKEY_LOCAL_MACHINE\system\controlset001\services

Result compared: Identical

-----Comparing registry keys CCS1 vs CCS3 -----
< Value: HKEY_LOCAL_MACHINE\system\controlset001\services\Dhcp\Parameters {8B514851-4F64-4C5B-A1A8-F0A37DA4B401} REG_BINARY FC000000000000000000000000000000F893944606000000000000000800000000000000F2CD9D46D41B35FCD41B36FC03000000000000000400000000000000F2CD9D46524359FE01000000000000000400000000000000F2CD9D46FFFFFF0033000000000000000400000000000000F2CD9D4600093A80360000000

Utilisateur anonyme · Answer

Mets à jour Norton
Redémarre en mode sans échec (- Redémarre ton PC. Dès l'allumage de celui-ci tapote la touche F8 (ou F5 si F8 ne fonctionne pas), à l'écran qui va apparaître choisis "mode sans echec" attends un peu.. )
Puis scanne complétement ton PC avec Norton toujours en mode sans échec et vois ce que ça donne

VIRUS

16 réponses

Discussions similaires