SVP virus, pc ki rame je veu faire le menage Résolu

Question

Bonjour,

J'ai mon ordi qui rame... Mon antivirus est perimé je souhaiterais en acheter un bon sur le net.

J'ai besoin de conseil pour remettre mon ordi en etat svp.

Je n'arrive plus a aller dans panneau de configuration ni dans mon poste de travaille.

Je comp^rend plus rien...

Aider moi a faire le menage dans mon ordi...

J'arrive a me connecter sur le net une fois sur deux

pouvais vous m'aider svp ...?????

Merci d'avance

Utilisateur anonyme · Answer

Salut ,

&#8594; Télécharge TrendMicro™ HijackThis™



Place le dans '  C:\programmes\  '  Une fois cela fait , merci de renommer l'icône ( clique droit > renommer )' Hijackthis.exe 'située dans le dossier dans C:\ , en ' HJT.exe '  <<<<<<<<< Important !!! <<<<<<<

Le chemin d'accés du programme doit être ressemblant à celui-ci  :  C:\Programme\Trend Micro\Hijackthis\HJT.exe

&#8594; Ne pas renommer l'icône du raccourci sur le bureau bien entendu ... 

/!\ Ferme toute les fenêtres encore ouvertes , et déconnecte toi du web /!\

&#8594; Puis lance-le et choisi l'option '' do a system scan and save a logfile '' et poste moi le rapport ( qui apparait sur le bloc-note )


(CTRL+A Pour tout selectionner  , CTRL+C pour copier et CTRL+V pour coller )

Tuto si tu n'y arrive pas : http://pageperso.aol.fr/balltrap34/demohijack.htm


A+

Sophie · Answer

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 13:36:07, on 04/11/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe
C:\WINDOWS\system32\PSIService.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\MAFWTray.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\ATI Technologies\ATI.ACE\CLI.EXE
C:\Program Files\SyncroSoft\Pos\H2O\cledx.exe
C:\Program Files\Trust\DS-4500X Wireless Laser Deskset\Mouse\mouse32a.exe
C:\Program Files\Trust\DS-4500X Wireless Laser Deskset\Keyboard\kbdap32a.EXE
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\WINDOWS\system32\drwtsn32.exe
C:\WINDOWS\system32\drwtsn32.exe
C:\WINDOWS\system32undll32.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = https://www.bing.com/?FORM=TOOLBR&cc=fr&toHttps=1&redig=4527FFF1C12746FC9EDB535C75E80ECC
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Multi Media France Toolbar - {7009fcd4-05be-44f4-9583-93fe419ab7b0} - C:\Program Files\Multi_Media_France	bMul0.dll
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Multi Media France Toolbar - {7009fcd4-05be-44f4-9583-93fe419ab7b0} - C:\Program Files\Multi_Media_France	bMul0.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O3 - Toolbar: Multi Media France Toolbar - {7009fcd4-05be-44f4-9583-93fe419ab7b0} - C:\Program Files\Multi_Media_France	bMul0.dll
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [MAFWTaskbarApp] C:\WINDOWS\system32\MAFWTray.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [PKR Pal] "C:\Program Files\PKR\pkrpal.exe" -osboot
O4 - HKLM\..\Run: [H2O] C:\Program Files\SyncroSoft\Pos\H2O\cledx.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [devenv] C:\WINDOWS\system\smvss.exe /w
O4 - HKLM\..\Run: [FLMOFFICE4DMOUSE] C:\Program Files\Trust\DS-4500X Wireless Laser Deskset\Mouse\mouse32a.exe
O4 - HKLM\..\Run: [OFFICEKB] C:\Program Files\Trust\DS-4500X Wireless Laser Deskset\Keyboard\kbdap32a.EXE
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: Ajouter à Kaspersky Anti-Banner - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\ie_banner_deny.htm
O9 - Extra button: Statistiques d’Anti-Virus Internet - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\scieplugin.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O20 - AppInit_DLLs: C:\PROGRA~1\KASPER~1\KASPER~1.0\adialhk.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Kaspersky Internet Security 6.0 (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe
O23 - Service: MSSQL$SONY_MEDIAMGR - Unknown owner - C:\Program Files\Sony\Shared Plug-Ins\Media Manager\MSSQL$SONY_MEDIAMGR\Binn\sqlservr.exe (file missing)
O23 - Service: ProtexisLicensing - Unknown owner - C:\WINDOWS\system32\PSIService.exe
O23 - Service: SQLAgent$SONY_MEDIAMGR - Unknown owner - C:\Program Files\Sony\Shared Plug-Ins\Media Manager\MSSQL$SONY_MEDIAMGR\Binn\sqlagent.EXE (file missing)

Sophie · Answer

J'espere ke j'ai fais les bonne manip :)

Utilisateur anonyme · Answer

Re ,,

&#8594; Imprime ces instructions car il faudra fermer toutes les fenêtres et applications lors de l'installation et de l'analyse.

&#8594; Télécharge Malwarebytes' Anti-Malware (MBAM) et enregistre le sur ton Bureau.

&#8594; A la fin du téléchargement, ferme toutes les fenêtres et programmes, y compris celui-ci.

&#8594; Double-clique sur l'icône Download_mbam-setup.exe sur ton bureau pour démarrer le programme d'installation.

&#8594; Pendant l'installation, suis les indications (en particulier le choix de la langue et l'autorisation d'accession à Internet). N'apporte aucune modification aux réglages par défaut et, en fin d'installation, vérifie que les options Update Malwarebytes' Anti-Malware et Launch Malwarebytes' Anti-Malware sont cochées.

&#8594; MBAM démarrera automatiquement et enverra un message demandant à mettre à jour le programme avant de lancer une analyse. Comme MBAM se met automatiquement à jour en fin d'installation, clique sur OK pour fermer la boîte de dialogue. La fenêtre principale de MBAM s'affiche :

&#8594; Dans l'onglet analyse, vérifie que "Exécuter un examen complet" est coché et clique sur le bouton Rechercher pour démarrer l'analyse.

&#8594; MBAM analyse ton ordinateur. L'analyse peut prendre un certain temps. Il suffit de vérifier de temps en temps son avancement.

&#8594; A la fin de l'analyse, un message s'affiche indiquant la fin de l'analyse. Clique sur OK pour poursuivre.

&#8594; Si des malwares ont été détectés, leur liste s'affiche.
En cliquant sur Suppression (?) , MBAM va détruire les fichiers et clés de registre et en mettre une copie dans la quarantaine.

&#8594; MBAM va ouvrir le Bloc-notes et y copier le rapport d'analyse. Ferme le Bloc-notes. (Le rapport peut être retrouvé sous l'onglet Rapports/logs)

&#8594; Ferme MBAM en cliquant sur Quitter.

&#8594; Poste le rapport dans ta réponse


A+

Sophie · Answer

Mon pc a planté je dois recommencer lanalyse

Sophie · Answer

Je n'arrive plus a faire d'analyse 

quand je clik sur le logiciel  sa me marque malwear est en cours c'execution

Comment je dois fairer

Utilisateur anonyme · Answer

Redémarre et recommence ( au plus simple )
A+

Sophie · Answer

il est payant??? jvois po commenty jsois lenregistrer

Utilisateur anonyme · Answer

J'ai édité.
Redémarre et recommence.
a+

Sophie · Answer

je reinstalle mbam alors??? c ca??? :) :)

Utilisateur anonyme · Answer

Non...
Tu rédémarres , et tu relances MBAM :)

A++

Sophie · Answer

Apres 50 minute d'analyse 

sa plante sa marque un probleme est survenu pareil ke tt az lheure

Utilisateur anonyme · Answer

Re !

Cette fois-ci on passe avec SAS. ( gratuit )


Télécharge SAS 

&#8594; Choisis "enregistrer" et enregistre-le sur ton bureau.

&#8594; Double-clique sur l'icône d'installation qui vient de se créer et suis les instructions.

[ Créé une icône sur le bureau. ]

&#8594; Double-clique sur l'icône de SAS (une tête dans un cercle rouge barré) pour le lancer.

-> Si l'outil te demande de mettre à jour le programme >> 'update the program definitions', clique sur yes.
-> Sous 'Configuration and Preferences', clique sur le bouton 'Preferences'
-> Clique sur l'onglet 'Scanning Control'
-> Dans 'Scanner Options', assure toi que la case devant les lignes suivantes est cochée :

- Close browsers before scanning -

- Scan for tracking cookies -

- Terminate memory threats before quarantining -

-> Laisse les autres lignes décochées.

&#8594; Clique sur le bouton "Close" pour quitter l'écran du centre de contrôle.

&#8594; Dans la fenêtre principale, clique dans "Scan for Harmful Software", sur "Scan your computer".

__Dans la colonne de gauche, coche   'C:\Fixed Drive'.

__Dans la colonne de droite, sous "Complete scan", clique sur "Perform Complete Scan"

Clique sur "next" pour lancer le scan. Patiente pendant la durée du scan.

A la fin du scan, une fenêtre de résultats s'ouvre . Clique sur OK.

->Assure toi que toutes les lignes de la fenêtre blanche sont cochées et clique sur "Next".

->Tout ce qui a été trouvé sera mis en quarantaine. S'il t'es demandé de redémarrer l'ordi ("reboot"), clique sur Yes.

->Pour recopier les informations sur le forum, fais ceci :

- après le redémarrage de l'ordi, double-clique sur l'icône pour lancer SAS.
- Clique sur "Preferences" puis sur l'onglet "Statistics/Logs ".
- Dans "scanners logs", double-clique sur SUPERAntiSpyware Scan Log.

- Le rapport va s'ouvrir dans ton éditeur de texte par défaut.

&#8594; Copie son contenu dans ta réponse.


(CTRL+A Pour tout selectionner  , CTRL+C pour copier et CTRL+V pour coller )

A+

Sophie · Answer

Jsui desoler mais on me demande de payer...

Sophie · Answer

C bon c juste que sa mavait bloker le telechargement dsl je continu :)

Sophie · Answer

l'analyse ne marche pas ...

Utilisateur anonyme · Answer

Développe stp.

Sophie · Answer

j'arrive meme pas a fermer le programme sa me dit que c'est verrouillé par le système...

Utilisateur anonyme · Answer

Re ,

C'est quoi le message d'erreur exactement ?

A++

Sophie · Answer

Scanning progress  je suis a 43 minut sa a rien trouvé je peu appuyé sur suivant mais sa me marque 

scanning is not complete, do you wish to continu without complening the scan..

Oui ou non jfais un des deux et sa reviens au meme.

Sophie · Answer

le programme ne repond po voila ce que sa me dis 


et quand je veu le fermer sa marque le programme est verouiller par le systeme

Utilisateur anonyme · Answer

Re ,
Ok abandonne.


&#8594; Télécharge sur ton bureau DSS (ex Comboscan) de Deckard:

(choisis enregistrer, puis Bureau comme emplacement)

Ferme toutes les applications en cours.

&#8594; Double-clic sur DSS.exe pour lancer l'outil.

&#8594; Une fenêtre s'ouvre, invitant à fermer toutes les applications, clique sur OK.

&#8594; A la fin de l'analyse, une fenêtre s'ouvre, clique sur OK.

Le rapport main.txt va s'afficher, copie le dans ta prochaine réponse.
Si un rapport complémentaire a été créé, poste le aussi dans ta réponse.


(CTRL+A Pour tout selectionner  , CTRL+C pour copier et CTRL+V pour coller )



A++

Sophie · Answer

Je peu pas fermer superentispyware

Utilisateur anonyme · Answer

Redémarre alors.

A++

Sophie · Answer

Deckard's System Scanner v20071014.68
Run by Propriétaire on 2008-11-04 18:18:34
Computer is in Normal Mode.
--------------------------------------------------------------------------------

-- System Restore --------------------------------------------------------------



-- Last 5 Restore Point(s) --
7: 2008-11-04 17:14:42 UTC - RP191 - Deckard's System Scanner Restore Point
6: 2008-11-04 16:15:01 UTC - RP190 - Installed SUPERAntiSpyware Free Edition
5: 2008-11-04 11:47:47 UTC - RP189 - Supprimé Windows Live Toolbar
4: 2008-11-04 11:45:20 UTC - RP188 - Removed AVIVO Codecs
3: 2008-11-04 11:44:09 UTC - RP187 - Supprimé ATI Problem Report Wizard


-- First Restore Point -- 
1: 2008-09-09 17:35:24 UTC - RP185 - Point de vérification système


Backed up registry hives.
Performed disk cleanup.



-- HijackThis (run as Propriétaire.exe) ----------------------------------------

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:18:57, on 04/11/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe
C:\WINDOWS\system32\PSIService.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\MAFWTray.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\ATI Technologies\ATI.ACE\CLI.EXE
C:\Program Files\SyncroSoft\Pos\H2O\cledx.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Documents and Settings\Propriétaire\Bureau\dss.exe
C:\PROGRA~1\TRENDM~1\HIJACK~1\PROPRI~1.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = https://www.bing.com/?FORM=TOOLBR&cc=fr&toHttps=1&redig=4527FFF1C12746FC9EDB535C75E80ECC
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Multi Media France Toolbar - {7009fcd4-05be-44f4-9583-93fe419ab7b0} - C:\Program Files\Multi_Media_France	bMul0.dll
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Multi Media France Toolbar - {7009fcd4-05be-44f4-9583-93fe419ab7b0} - C:\Program Files\Multi_Media_France	bMul0.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O3 - Toolbar: Multi Media France Toolbar - {7009fcd4-05be-44f4-9583-93fe419ab7b0} - C:\Program Files\Multi_Media_France	bMul0.dll
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [MAFWTaskbarApp] C:\WINDOWS\system32\MAFWTray.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [PKR Pal] "C:\Program Files\PKR\pkrpal.exe" -osboot
O4 - HKLM\..\Run: [H2O] C:\Program Files\SyncroSoft\Pos\H2O\cledx.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [devenv] C:\WINDOWS\system\smvss.exe /w
O4 - HKLM\..\Run: [FLMOFFICE4DMOUSE] C:\Program Files\Trust\DS-4500X Wireless Laser Deskset\Mouse\mouse32a.exe
O4 - HKLM\..\Run: [OFFICEKB] C:\Program Files\Trust\DS-4500X Wireless Laser Deskset\Keyboard\kbdap32a.EXE
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: Ajouter à Kaspersky Anti-Banner - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\ie_banner_deny.htm
O9 - Extra button: Statistiques d’Anti-Virus Internet - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\scieplugin.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O20 - AppInit_DLLs: C:\PROGRA~1\KASPER~1\KASPER~1.0\adialhk.dll
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Kaspersky Internet Security 6.0 (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe
O23 - Service: MSSQL$SONY_MEDIAMGR - Unknown owner - C:\Program Files\Sony\Shared Plug-Ins\Media Manager\MSSQL$SONY_MEDIAMGR\Binn\sqlservr.exe (file missing)
O23 - Service: ProtexisLicensing - Unknown owner - C:\WINDOWS\system32\PSIService.exe
O23 - Service: SQLAgent$SONY_MEDIAMGR - Unknown owner - C:\Program Files\Sony\Shared Plug-Ins\Media Manager\MSSQL$SONY_MEDIAMGR\Binn\sqlagent.EXE (file missing)

Utilisateur anonyme · Answer

J'analyse et je reviens.
A+

Sophie · Answer

Deckard's System Scanner v20071014.68
Extra logfile - please post this as an attachment with your post.
--------------------------------------------------------------------------------

-- System Information ----------------------------------------------------------

Microsoft Windows XP Édition familiale (build 2600) SP 2.0
Architecture: X86; Language: French

CPU 0: Intel(R) Core(TM)2 CPU          6420  @ 2.13GHz
CPU 1: Intel(R) Core(TM)2 CPU          6420  @ 2.13GHz
Percentage of Memory in Use: 29%
Physical Memory (total/avail): 2047.23 MiB / 1436.6 MiB
Pagefile Memory (total/avail): 3943.76 MiB / 3401.17 MiB
Virtual Memory (total/avail): 2047.88 MiB / 1933.82 MiB

C: is Fixed (NTFS) - 465.75 GiB total, 417.32 GiB free. 
D: is CDROM (No Media)

\.\PHYSICALDRIVE0 - SAMSUNG HD501LJ - 465.76 GiB - 1 partition
  \PARTITION0 (bootable) - Système de fichiers installable - 465.75 GiB - C:



-- Security Center -------------------------------------------------------------

AUOptions is scheduled to auto-install.
Windows Internal Firewall is enabled.

FirstRunDisabled is set.
AntivirusOverride is set.

FW: Kaspersky Internet Security v6.0.2.621 () [COLOR=RED]Disabled/COLOR
AV: Kaspersky Internet Security v6.0.2.621 () [COLOR=RED]Disabled/COLOR [COLOR=RED]Outdated/COLOR

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\MSN Messenger\msnmsgr.exe"="C:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
"C:\Program Files\MSN Messenger\livecall.exe"="C:\Program Files\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\eMule\emule.exe"="C:\Program Files\eMule\emule.exe:*:Enabled:eMule"
"C:\Program Files\MSN Messenger\msnmsgr.exe"="C:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
"C:\Program Files\MSN Messenger\livecall.exe"="C:\Program Files\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"
"C:\Program Files\Resolume 2.41\resolume.exe"="C:\Program Files\Resolume 2.41\resolume.exe:*:Enabled:Resolume 2.41"
"C:\Program Files\Messenger\msmsgs.exe"="C:\Program Files\Messenger\msmsgs.exe:*:Enabled:Windows Messenger"
"C:\Documents and Settings\Propriétaire\Local Settings\Temp\Rar$EX02.937\emule.exe"="C:\Documents and Settings\Propriétaire\Local Settings\Temp\Rar$EX02.937\emule.exe:*:Disabled:eMule"
"C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\0exinjs.aa.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\0exinjs.aa.exe:*:Enabled:Microsoft Update"
"C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\22exinjs.aa.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\22exinjs.aa.exe:*:Enabled:Microsoft Update"
"C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\23exinjs.aa.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\23exinjs.aa.exe:*:Enabled:Microsoft Update"
"C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\83exinjs.aa.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\83exinjs.aa.exe:*:Enabled:Microsoft Update"
"C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\86exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\86exinjs.ab.exe:*:Enabled:Microsoft Update"
"C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\82exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\82exinjs.ab.exe:*:Enabled:Microsoft Update"
"C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\42exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\42exinjs.ab.exe:*:Enabled:Microsoft Update"
"C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\98exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\98exinjs.ab.exe:*:Enabled:Microsoft Update"
"C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\36exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\36exinjs.ab.exe:*:Enabled:Microsoft Update"
"C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\59exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\59exinjs.ab.exe:*:Enabled:Microsoft Update"
"C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\49exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\49exinjs.ab.exe:*:Enabled:Microsoft Update"
"C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\73exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\73exinjs.ab.exe:*:Enabled:Microsoft Update"
"C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\75exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\75exinjs.ab.exe:*:Enabled:Microsoft Update"
"C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\8exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\8exinjs.ab.exe:*:Enabled:Microsoft Update"
"C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\47exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\47exinjs.ab.exe:*:Enabled:Microsoft Update"
"C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\20exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\20exinjs.ab.exe:*:Enabled:Microsoft Update"
"C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\78exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\78exinjs.ab.exe:*:Enabled:Microsoft Update"
"C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\80exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\80exinjs.ab.exe:*:Enabled:Microsoft Update"
"C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\74exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\74exinjs.ab.exe:*:Enabled:Microsoft Update"
"C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\18exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\18exinjs.ab.exe:*:Enabled:Microsoft Update"
"C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\64exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\64exinjs.ab.exe:*:Enabled:Microsoft Update"
"C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\57exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\57exinjs.ab.exe:*:Enabled:Microsoft Update"
"C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\92exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\92exinjs.ab.exe:*:Enabled:Microsoft Update"
"C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\11exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\11exinjs.ab.exe:*:Enabled:Microsoft Update"
"C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\50exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\50exinjs.ab.exe:*:Enabled:Microsoft Update"
"C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\43exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\43exinjs.ab.exe:*:Enabled:Microsoft Update"
"C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\95exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\95exinjs.ab.exe:*:Enabled:Microsoft Update"
"C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\52exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\52exinjs.ab.exe:*:Enabled:Microsoft Update"
"C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\23exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\23exinjs.ab.exe:*:Enabled:Microsoft Update"
"C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\6exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\6exinjs.ab.exe:*:Enabled:Microsoft Update"
"C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\39exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\39exinjs.ab.exe:*:Enabled:Microsoft Update"
"C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\68exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\68exinjs.ab.exe:*:Enabled:Microsoft Update"
"C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\61exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\61exinjs.ab.exe:*:Enabled:Microsoft Update"
"C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\26exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\26exinjs.ab.exe:*:Enabled:Microsoft Update"
"C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\34exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\34exinjs.ab.exe:*:Enabled:Microsoft Update"
"C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\19exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\19exinjs.ab.exe:*:Enabled:Microsoft Update"
"C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\32exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\32exinjs.ab.exe:*:Enabled:Microsoft Update"
"C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\14exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\14exinjs.ab.exe:*:Enabled:Microsoft Update"
"C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\60exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\60exinjs.ab.exe:*:Enabled:Microsoft Update"
"C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\29exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\29exinjs.ab.exe:*:Enabled:Microsoft Update"
"C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\66exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\66exinjs.ab.exe:*:Enabled:Microsoft Update"
"C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\99exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\99exinjs.ab.exe:*:Enabled:Microsoft Update"
"C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\54exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\54exinjs.ab.exe:*:Enabled:Microsoft Update"
"C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\94exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\94exinjs.ab.exe:*:Enabled:Microsoft Update"
"C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\85exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\85exinjs.ab.exe:*:Enabled:Microsoft Update"
"C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe"="C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe:*:Disabled:Kaspersky Anti-Virus"
"C:\Program Files\uTorrent\uTorrent.exe"="C:\Program Files\uTorrent\uTorrent.exe:*:Enabled:µTorrent"
"C:\Program Files\BitDownload\BitDownload.exe"="C:\Program Files\BitDownload\BitDownload.exe:*:Enabled:Torrent P2P application"
"C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\16ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\16ex:*:Enabled:Microsoft Update"
"C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\25ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\25ex:*:Enabled:Microsoft Update"
"C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\35ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\35ex:*:Enabled:Microsoft Update"
"C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\43ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\43ex:*:Enabled:Microsoft Update"
"C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\58ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\58ex:*:Enabled:Microsoft Update"
"C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\26ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\26ex:*:Enabled:Microsoft Update"
"C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\87ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\87ex:*:Enabled:Microsoft Update"
"C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\60ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\60ex:*:Enabled:Microsoft Update"
"C:\Program Files\Ahead\Nero ShowTime\ShowTime.exe"="C:\Program Files\Ahead\Nero ShowTime\ShowTime.exe:*:Enabled:Nero ShowTime"
"C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\44ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\44ex:*:Enabled:Microsoft Update"
"C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\50ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\50ex:*:Enabled:Microsoft Update"
"C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\7ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\7ex:*:Enabled:Microsoft Update"
"C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\42ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\42ex:*:Enabled:Microsoft Update"
"C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\3ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\3ex:*:Enabled:Microsoft Update"
"C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\21ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\21ex:*:Enabled:Microsoft Update"
"C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\40ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\40ex:*:Enabled:Microsoft Update"
"C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\2ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\2ex:*:Enabled:Microsoft Update"
"C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\4ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\4ex:*:Enabled:Microsoft Update"
"C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\65ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\65ex:*:Enabled:Microsoft Update"
"C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\37ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\37ex:*:Enabled:Microsoft Update"
"C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\31ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\31ex:*:Enabled:Microsoft Update"
"C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\72ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\72ex:*:Enabled:Microsoft Update"
"C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\92ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\92ex:*:Enabled:Microsoft Update"
"C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\68ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\68ex:*:Enabled:Microsoft Update"
"C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\45ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\45ex:*:Enabled:Microsoft Update"
"C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\96ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\96ex:*:Enabled:Microsoft Update"
"C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\33ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\33ex:*:Enabled:Microsoft Update"
"C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\79ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\79ex:*:Enabled:Microsoft Update"
"C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\10ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\10ex:*:Enabled:Microsoft Update"
"C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\22ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\22ex:*:Enabled:Microsoft Update"
"C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\55ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\55ex:*:Enabled:Microsoft Update"
"C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\66ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\66ex:*:Enabled:Microsoft Update"
"C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\94ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\94ex:*:Enabled:Microsoft Update"
"C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\52ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\52ex:*:Enabled:Microsoft Update"
"C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\0ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\0ex:*:Enabled:Microsoft Update"
"C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\63ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\63ex:*:Enabled:Microsoft Update"
"C:\Documents and Settings\Propriétaire\Local Settings\Temp\10exmdnk23.exe"="C:\Documents and Settings\Propriétaire\Local Settings\Temp\10exmdnk23.exe:*:Disabled:10exmdnk23"
"C:\Documents and Settings\Propriétaire\Local Settings\Temp\33exmdnk25.exe"="C:\Documents and Settings\Propriétaire\Local Settings\Temp\33exmdnk25.exe:*:Disabled:33exmdnk25"
"C:\Documents and Settings\Propriétaire\Local Settings\Temp\0exmdnk26.exe"="C:\Documents and Settings\Propriétaire\Local Settings\Temp\0exmdnk26.exe:*:Disabled:0exmdnk26"
"C:\Documents and Settings\Propriétaire\Local Settings\Temp\58exmdnk30.exe"="C:\Documents and Settings\Propriétaire\Local Settings\Temp\58exmdnk30.exe:*:Disabled:58exmdnk30"
"C:\kav\kis7.0\french\setup.exe"="C:\kav\kis7.0\french\setup.exe:*:Enabled:Programme d'installation de Kaspersky Internet Security 7.0"
"C:\kav\kav7.0\french\setup.exe"="C:\kav\kav7.0\french\setup.exe:*:Enabled:Programme d'installation de Kaspersky Anti-Virus 7.0"


-- Environment Variables -------------------------------------------------------

ALLUSERSPROFILE=C:\Documents and Settings\All Users
APPDATA=C:\Documents and Settings\Propri‚taire\Application Data
CommonProgramFiles=C:\Program Files\Fichiers communs
COMPUTERNAME=PSKT-EA8ECFA3F7
ComSpec=C:\WINDOWS\system32\cmd.exe
FP_NO_HOST_CHECK=NO
HOMEDRIVE=C:
HOMEPATH=\Documents and Settings\Propri‚taire
LOGONSERVER=\PSKT-EA8ECFA3F7
NewEnvironment1=C:\Program Files\ATI Technologies\ATI.ACE\
NUMBER_OF_PROCESSORS=2
OS=Windows_NT
Path=C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\Program Files\Microsoft SQL Server\80\Tools\Binn\
PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
PROCESSOR_ARCHITECTURE=x86
PROCESSOR_IDENTIFIER=x86 Family 6 Model 15 Stepping 6, GenuineIntel
PROCESSOR_LEVEL=6
PROCESSOR_REVISION=0f06
ProgramFiles=C:\Program Files
PROMPT=$P$G
SESSIONNAME=Console
SystemDrive=C:
SystemRoot=C:\WINDOWS
TEMP=C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp
TMP=C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp
USERDOMAIN=PSKT-EA8ECFA3F7
USERNAME=Propri‚taire
USERPROFILE=C:\Documents and Settings\Propri‚taire
windir=C:\WINDOWS


-- User Profiles ---------------------------------------------------------------

Propriétaire [I](admin)/I


-- Add/Remove Programs ---------------------------------------------------------

 --> C:\Program Files\Ahead
ero\uninstall\UNNERO.exe /UNINSTALL
 --> C:\WINDOWS\UNNeroVision.exe /UNINSTALL
 --> C:\WINDOWS\UNNMP.exe /UNINSTALL
 --> rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf
Ableton Live v5.0.3 --> C:\DOCUME~1\PROPRI~1\Bureau\LOGICI~1\Ableton\LIVE50~1.3\UNWISE.EXE C:\DOCUME~1\PROPRI~1\Bureau\LOGICI~1\Ableton\LIVE50~1.3\INSTALL.LOG
Ad-Aware 2007 --> MsiExec.exe /I{DED53B0B-B67C-4244-AE6A-D6FD3C28D1EF}
Adobe Flash Player ActiveX --> C:\WINDOWS\system32\Macromed\Flash\uninstall_activeX.exe
Adobe Reader 8.1.0 - Français --> MsiExec.exe /I{AC76BA86-7AD7-1036-7B44-A81000000003}
Archiveur WinRAR --> C:\Program Files\WinRAR\uninstall.exe
ATI - Utilitaire de désinstallation du logiciel --> C:\Program Files\ATI Technologies\UninstallAll\AtiCimUn.exe
ATI Catalyst Control Center --> MsiExec.exe /I{685755F8-C74B-4613-8137-C90AF458228D}
ATI Display Driver --> rundll32 C:\WINDOWS\system32\atiiiexx.dll,_InfEngUnInstallINFFile_RunDLL@16 -force_restart -flags:0x2010001 -inf_class:DISPLAY -clean
ATI HYDRAVISION --> RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{083F79E4-6FE9-46FB-A6C6-4F8862742947}\setup.exe" 
ATI Parental Control & Encoder --> MsiExec.exe /I{36CDA33B-909B-4719-97D1-C4B99309BDC7}
AVG Anti-Spyware 7.5 --> C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\Uninstall.exe
CCleaner (remove only) --> "C:\Program Files\CCleaner\uninst.exe"
CiD Help --> C:\DOCUME~1\PROPRI~1\APPLIC~1\AIMHTM~1\SoftwareEqNurb.exe -uninstall
Collab --> C:\Program Files\Image-Line\Collab\uninstall.exe
Correctif pour Windows XP (KB935448) --> "C:\WINDOWS\$NtUninstallKB935448$\spuninst\spuninst.exe"
Correctif Windows XP - KB873339 --> C:\WINDOWS\$NtUninstallKB873339$\spuninst\spuninst.exe
Correctif Windows XP - KB885835 --> C:\WINDOWS\$NtUninstallKB885835$\spuninst\spuninst.exe
Correctif Windows XP - KB885836 --> C:\WINDOWS\$NtUninstallKB885836$\spuninst\spuninst.exe
Correctif Windows XP - KB886185 --> C:\WINDOWS\$NtUninstallKB886185$\spuninst\spuninst.exe
Correctif Windows XP - KB887472 --> C:\WINDOWS\$NtUninstallKB887472$\spuninst\spuninst.exe
Correctif Windows XP - KB888302 --> C:\WINDOWS\$NtUninstallKB888302$\spuninst\spuninst.exe
Correctif Windows XP - KB890859 --> "C:\WINDOWS\$NtUninstallKB890859$\spuninst\spuninst.exe"
Correctif Windows XP - KB891781 --> C:\WINDOWS\$NtUninstallKB891781$\spuninst\spuninst.exe
DivX Codec --> C:\Program Files\DivX\DivXCodecUninstall.exe /CODEC
eMule --> "C:\Program Files\eMule\Uninstall.exe"
Firewire Audiophile 1.0.1.1 --> C:\WINDOWS\iun6002.exe "C:\Program Files\M-Audio Firewire Audiophile\irunin.ini"
FL Studio 7 --> C:\Program Files\Image-Line\FL Studio 7\uninstall.exe
Google Toolbar for Firefox --> MsiExec.exe /X{2CCBABCB-6427-4A55-B091-49864623C43F}
Google Toolbar for Internet Explorer --> MsiExec.exe /I{DBEA1034-5882-4A88-8033-81C4EF0CFA29}
Google Toolbar for Internet Explorer --> regsvr32 /u /s "c:\program files\google\googletoolbar1.dll"
High Definition Audio Driver Package - KB888111 --> "C:\WINDOWS\$NtUninstallKB888111WXPSP2$\spuninst\spuninst.exe"
HijackThis 2.0.2 --> "C:\Program Files\Trend Micro\HijackThis\HijackThis.exe" /uninstall
Kaspersky Internet Security 6.0 --> MsiExec.exe /I{D0DCD54F-C829-41A5-AF32-71E632BB0E2C}
Kaspersky Internet Security 6.0 --> MsiExec.exe /I{D0DCD54F-C829-41A5-AF32-71E632BB0E2C}
KORG K-Series Editor --> MsiExec.exe /I{79D57C50-A329-4A58-8340-9B08D67E3010}
Korg Legacy Collection v1.0.0.2 --> C:\PROGRA~1\KORG\KORGLE~1\UNWISE.EXE C:\PROGRA~1\KORG\KORGLE~1\INSTALL.LOG
KORG M1 Le --> MsiExec.exe /I{4C1C6622-4FA5-4827-886D-E4022CA988F1}
KORG M1 Le RTAS --> MsiExec.exe /I{7BFA637A-857C-4FF9-99DB-EFC577174B6E}
KORG M1 Le VST --> MsiExec.exe /I{68FE6296-02F9-4F43-B116-FCEFED533A55}
Le Centre de Contrôle de Licences de Syncrosoft --> C:\PROGRA~1\SYNCRO~1\UNWISE.EXE C:\PROGRA~1\SYNCRO~1\INSTALL.LOG
Microsoft SQL Server Desktop Engine (SONY_MEDIAMGR) --> MsiExec.exe /X{E09B48B5-E141-427A-AB0C-D3605127224A}
Microsoft Visual C++ 2005 Redistributable --> MsiExec.exe /X{7299052b-02a4-4627-81f2-1818da5d550d}
Mise à jour de sécurité pour Lecteur Windows Media (KB911564) --> "C:\WINDOWS\$NtUninstallKB911564$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Lecteur Windows Media 6.4 (KB925398) --> "C:\WINDOWS\$NtUninstallKB925398_WMP64$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Lecteur Windows Media 9 (KB917734) --> "C:\WINDOWS\$NtUninstallKB917734_WMP9$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Lecteur Windows Media 9 (KB936782) --> "C:\WINDOWS\$NtUninstallKB936782_WMP9$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB890046) --> "C:\WINDOWS\$NtUninstallKB890046$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB893756) --> "C:\WINDOWS\$NtUninstallKB893756$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB896358) --> "C:\WINDOWS\$NtUninstallKB896358$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB896423) --> "C:\WINDOWS\$NtUninstallKB896423$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB896428) --> "C:\WINDOWS\$NtUninstallKB896428$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB899587) --> "C:\WINDOWS\$NtUninstallKB899587$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB899591) --> "C:\WINDOWS\$NtUninstallKB899591$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB900725) --> "C:\WINDOWS\$NtUninstallKB900725$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB901017) --> "C:\WINDOWS\$NtUninstallKB901017$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB901214) --> "C:\WINDOWS\$NtUninstallKB901214$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB902400) --> "C:\WINDOWS\$NtUninstallKB902400$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB904706) --> "C:\WINDOWS\$NtUninstallKB904706$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB905414) --> "C:\WINDOWS\$NtUninstallKB905414$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB905749) --> "C:\WINDOWS\$NtUninstallKB905749$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB908519) --> "C:\WINDOWS\$NtUninstallKB908519$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB911562) --> "C:\WINDOWS\$NtUninstallKB911562$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB911927) --> "C:\WINDOWS\$NtUninstallKB911927$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB913580) --> "C:\WINDOWS\$NtUninstallKB913580$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB914388) --> "C:\WINDOWS\$NtUninstallKB914388$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB914389) --> "C:\WINDOWS\$NtUninstallKB914389$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB917344) --> "C:\WINDOWS\$NtUninstallKB917344$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB917953) --> "C:\WINDOWS\$NtUninstallKB917953$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB918118) --> "C:\WINDOWS\$NtUninstallKB918118$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB918439) --> "C:\WINDOWS\$NtUninstallKB918439$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB919007) --> "C:\WINDOWS\$NtUninstallKB919007$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB920213) --> "C:\WINDOWS\$NtUninstallKB920213$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB920670) --> "C:\WINDOWS\$NtUninstallKB920670$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB920683) --> "C:\WINDOWS\$NtUninstallKB920683$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB920685) --> "C:\WINDOWS\$NtUninstallKB920685$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB921503) --> "C:\WINDOWS\$NtUninstallKB921503$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB922819) --> "C:\WINDOWS\$NtUninstallKB922819$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB923191) --> "C:\WINDOWS\$NtUninstallKB923191$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB923414) --> "C:\WINDOWS\$NtUninstallKB923414$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB923689) --> "C:\WINDOWS\$NtUninstallKB923689$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB923980) --> "C:\WINDOWS\$NtUninstallKB923980$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB924191) --> "C:\WINDOWS\$NtUninstallKB924191$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB924270) --> "C:\WINDOWS\$NtUninstallKB924270$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB924496) --> "C:\WINDOWS\$NtUninstallKB924496$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB924667) --> "C:\WINDOWS\$NtUninstallKB924667$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB925902) --> "C:\WINDOWS\$NtUninstallKB925902$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB926255) --> "C:\WINDOWS\$NtUninstallKB926255$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB926436) --> "C:\WINDOWS\$NtUninstallKB926436$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB927779) --> "C:\WINDOWS\$NtUninstallKB927779$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB927802) --> "C:\WINDOWS\$NtUninstallKB927802$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB928255) --> "C:\WINDOWS\$NtUninstallKB928255$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB928843) --> "C:\WINDOWS\$NtUninstallKB928843$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB929123) --> "C:\WINDOWS\$NtUninstallKB929123$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB929969) --> "C:\WINDOWS\$NtUninstallKB929969$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB930178) --> "C:\WINDOWS\$NtUninstallKB930178$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB931261) --> "C:\WINDOWS\$NtUninstallKB931261$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB931784) --> "C:\WINDOWS\$NtUninstallKB931784$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB932168) --> "C:\WINDOWS\$NtUninstallKB932168$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB933566) --> "C:\WINDOWS\$NtUninstallKB933566$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB933729) --> "C:\WINDOWS\$NtUninstallKB933729$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB935839) --> "C:\WINDOWS\$NtUninstallKB935839$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB935840) --> "C:\WINDOWS\$NtUninstallKB935840$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB936021) --> "C:\WINDOWS\$NtUninstallKB936021$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB937143) --> "C:\WINDOWS\$NtUninstallKB937143$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB938127) --> "C:\WINDOWS\$NtUninstallKB938127$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB938829) --> "C:\WINDOWS\$NtUninstallKB938829$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB939653) --> "C:\WINDOWS\$NtUninstallKB939653$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB941202) --> "C:\WINDOWS\$NtUninstallKB941202$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB941568) --> "C:\WINDOWS\$NtUninstallKB941568$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB941569) --> "C:\WINDOWS\$NtUninstallKB941569$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB941644) --> "C:\WINDOWS\$NtUninstallKB941644$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB942615) --> "C:\WINDOWS\$NtUninstallKB942615$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB943460) --> "C:\WINDOWS\$NtUninstallKB943460$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB943485) --> "C:\WINDOWS\$NtUninstallKB943485$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB944533) --> "C:\WINDOWS\$NtUninstallKB944533$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB944653) --> "C:\WINDOWS\$NtUninstallKB944653$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB946026) --> "C:\WINDOWS\$NtUninstallKB946026$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB894391) --> "C:\WINDOWS\$NtUninstallKB894391$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB898461) --> "C:\WINDOWS\$NtUninstallKB898461$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB900485) --> "C:\WINDOWS\$NtUninstallKB900485$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB908531) --> "C:\WINDOWS\$NtUninstallKB908531$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB910437) --> "C:\WINDOWS\$NtUninstallKB910437$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB911164) --> 
Mise à jour pour Windows XP (KB911280) --> "C:\WINDOWS\$NtUninstallKB911280$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB916595) --> "C:\WINDOWS\$NtUninstallKB916595$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB920872) --> "C:\WINDOWS\$NtUninstallKB920872$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB922582) --> "C:\WINDOWS\$NtUninstallKB922582$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB927891) --> "C:\WINDOWS\$NtUninstallKB927891$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB930916) --> "C:\WINDOWS\$NtUninstallKB930916$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB931836) --> "C:\WINDOWS\$NtUninstallKB931836$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB933360) --> "C:\WINDOWS\$NtUninstallKB933360$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB936357) --> "C:\WINDOWS\$NtUninstallKB936357$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB938828) --> "C:\WINDOWS\$NtUninstallKB938828$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB942763) --> "C:\WINDOWS\$NtUninstallKB942763$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB942840) --> "C:\WINDOWS\$NtUninstallKB942840$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB946627) --> "C:\WINDOWS\$NtUninstallKB946627$\spuninst\spuninst.exe"
Multi Media France Toolbar --> C:\PROGRA~1\MULTI_~2\UNWISE.EXE C:\PROGRA~1\MULTI_~2\INSTALL.LOG
MultiMedia France Toolbar --> C:\PROGRA~1\MULTIM~2\UNWISE.EXE C:\PROGRA~1\MULTIM~2\INSTALL.LOG
MultiMedia Toolbar --> C:\PROGRA~1\MULTIM~1\UNWISE.EXE C:\PROGRA~1\MULTIM~1\INSTALL.LOG
MySpaceIM --> C:\Program Files\MySpace\IM\Uninstall.exe
Nero Suite --> C:\Program Files\Fichiers communs\Nero\Uninstall\setupx.exe /uninstall ExtraUninstallID=""
Realtek High Definition Audio Driver --> RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}\Setup.exe" -l0x40c  -removeonly
REALTEK PCIE NIC Driver --> RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{17E2F183-BAC4-4D01-BD7A-59F781E17EFA}\Setup.exe" -l0x40c REMOVE
Reason 4.0 --> "C:\Documents and Settings\Propriétaire\Bureau\Nouveau dossier\Reason\Uninstall Reason\unins000.exe"
Reason version 4 Screensaver --> C:\WINDOWS\system32\Reason version 4 Screensaver.scr /u
ShopperReports --> C:\Program Files\ShoppingReport\Uninst.exe
Sony Media Manager 2.2 --> MsiExec.exe /X{2B5A75F0-FD85-4094-AB00-94902398D192}
Sony Noise Reduction Plug-In 2.0e --> MsiExec.exe /X{D533C9D4-ED96-4191-B9C3-279C0DD6BABA}
Spybot - Search & Destroy --> "C:\Program Files\Spybot - Search & Destroy\unins000.exe"
SUPERAntiSpyware Free Edition --> MsiExec.exe /X{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}
SyncroSoft Emu (Remove only) --> C:\Program Files\SyncroSoft\Pos\H2O\Uninst.exe
TRUST DS-4500X Wireless Laser Deskset_Keyboard --> C:\Program Files\Trust\DS-4500X Wireless Laser Deskset\Keyboard\uninst00.exe
TRUST DS-4500X Wireless Laser Deskset_Mouse --> C:\Program Files\Trust\DS-4500X Wireless Laser Deskset\Mouse\uninst01.exe
Windows Live Messenger --> MsiExec.exe /I{F6326B60-1B1D-4ABF-BFCD-7B7404F44411}
Windows Live Sign-in Assistant --> MsiExec.exe /I{49672EC2-171B-47B4-8CE7-50D7806360D7}


-- Application Event Log -------------------------------------------------------

Event Record #/Type6102 / Error
Event Submitted/Written: 11/04/2008 06:15:33 PM
Event ID/Source: 1000 / Application Error
Event Description:
Application défaillante dss.exe, version 3.2.8.1, module défaillant dss.exe, version 3.2.8.1, adresse de défaillance 0x0001a27c.
Traitement de l'événement propre au support pour [dss.exe!ws!]

Event Record #/Type6101 / Error
Event Submitted/Written: 11/04/2008 06:07:43 PM
Event ID/Source: 1002 / Application Hang
Event Description:
Application bloquée SUPERAntiSpyware.exe, version 4.15.0.1000, module bloqué hungapp, version 0.0.0.0, adresse de blocage 0x00000000.

Event Record #/Type6100 / Error
Event Submitted/Written: 11/04/2008 06:00:19 PM
Event ID/Source: 1002 / Application Hang
Event Description:
Application bloquée SUPERAntiSpyware.exe, version 4.15.0.1000, module bloqué hungapp, version 0.0.0.0, adresse de blocage 0x00000000.

Event Record #/Type6099 / Error
Event Submitted/Written: 11/04/2008 05:40:19 PM
Event ID/Source: 1002 / Application Hang
Event Description:
Application bloquée SUPERAntiSpyware.exe, version 4.15.0.1000, module bloqué hungapp, version 0.0.0.0, adresse de blocage 0x00000000.

Event Record #/Type6097 / Error
Event Submitted/Written: 11/04/2008 05:03:22 PM
Event ID/Source: 1002 / Application Hang
Event Description:
Application bloquée IEXPLORE.EXE, version 6.0.2900.2180, module bloqué hungapp, version 0.0.0.0, adresse de blocage 0x00000000.



-- Security Event Log ----------------------------------------------------------

No Errors/Warnings found.


-- System Event Log ------------------------------------------------------------

Event Record #/Type15936 / Error
Event Submitted/Written: 11/04/2008 05:08:59 PM
Event ID/Source: 1002 / Dhcp
Event Description:
Le bail de l'adresse IP 192.168.1.100 pour la carte réseau dont l'adresse réseau est 0019660FFBB4
a été refusé par le serveur DHCP 0.0.0.0 (celui-ci a envoyé un message DHCPNACK).

Event Record #/Type15935 / Warning
Event Submitted/Written: 11/04/2008 05:08:45 PM
Event ID/Source: 1003 / Dhcp
Event Description:
Votre ordinateur n'a pas pu renouveler son adresse à partir du réseau (à partir
du serveur DHCP) pour la carte réseau dont l'adresse réseau est 0019660FFBB4. Il s'est
produit l'erreur suivante : 
%%1223.
Votre ordinateur va continuer à essayer d'obtenir sa propre adresse auprès du
serveur d'adresse réseau (DHCP).

Event Record #/Type15927 / Error
Event Submitted/Written: 11/04/2008 04:58:01 PM
Event ID/Source: 10010 / DCOM
Event Description:
Le serveur {8BC3F05E-D86B-11D0-A075-00C04FB68820} ne s'est pas enregistré sur DCOM avant la fin du temps imparti.

Event Record #/Type15926 / Error
Event Submitted/Written: 11/04/2008 04:57:11 PM
Event ID/Source: 29 / W32Time
Event Description:
Le fournisseur de temps NtpClient est configuré pour acquérir le temps à partir d'une
ou plusieurs sources de temps, cependant aucune source n'est actuellement accessible.
Aucune tentative pour en contacter une ne sera effectuée d'ici 14 minutes.
NtpClient n'a pas de source de temps précis.

Event Record #/Type15925 / Error
Event Submitted/Written: 11/04/2008 04:57:11 PM
Event ID/Source: 17 / W32Time
Event Description:
Fournisseur de temps NtpClient : une erreur s'est produite lors de la recherche DNS de
l'homologue manuellement configuré 'time.windows.com,0x1'. NtpClient va essayer à nouveau
la recherche DNS dans 15 minutes.
L'erreur était : Une opération a été tentée sur un hôte impossible à atteindre. (0x80072751)



-- End of Deckard's System Scanner: finished at 2008-11-04 18:19:43 ------------

Sophie · Answer

voila les deux rapport du dernier truc que tu ma fais installer jespère que c bon :)

Utilisateur anonyme · Answer

Re ,


Va sur ce site -->  https://www.virustotal.com/gui/

Copie/colle cette ligne en gras dans le champs de saisie :


C:\Program Files\Multi_Media_France	bMul0.dll 



Clique sur ' Envoyer le fichier ' 

Un rapport va s'élaborer ligne à ligne.

Attends la fin. Il doit comprendre la taille du fichier envoyé.

Sauvegarde le rapport avec le bloc-note.

-> Poste le moi stp.

(CTRL+A Pour tout selectionner  , CTRL+C pour copier et CTRL+V pour coller )


Recommence avec :  C:\Program Files\MySpace\IM\MySpaceIM.exe 

*************************************************

Hijackthis ce trouve ici -> C:\PROGRAMFILES\TRENDMICRO\HIJACKTHIS\PROPRIETAIRE.EXE

*************************************************

&#8594; Relance hijackthis , en menu principal choisis ' Do a system scan only' Et fixe ces/cette ligne(s) : ( coche la case à leurs gauches )


O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" 
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe 
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') 






Ferme toutes les fenêtres (hormis Hijackthis), y compris ton navigateur web. 

&#8594; clique sur  ' fixchecked '


*************************************************

/!\ Manip crée spécialement pour cet utilisateur , ne pas reproduire chez soi ... /!\


1)Télécharge  OTMoveIt2 ( de Old Timer ) 

2)Une fois téléchargé  double-clique sur OTMoveIt2.exe pour le lancer.

Assure toi que la case Unregister Dll's and Ocx's soit bien cochée

3)puis copie les lignes en gras qui se trouvent en dessous :


C:\WINDOWS\system\smvss.exe
C:\Program Files\SUPERAntiSpyware
C:\WINDOWS\Alcmtr.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\devenv




et colle-les dans le cadre de gauche de OTMoveIt :   "Paste List Of Files/Folders to Move."
clique sur MoveIt! pour lancer la suppression.
le résultat apparaitra dans le cadre Results.
clique sur Exit pour fermer.
4) Poste le rapport situé dans C:\_OTMoveIt\MovedFiles.


(CTRL+A Pour tout selectionner  , CTRL+C pour copier et CTRL+V pour coller )

5) Il te sera peut-être demander de redémarrer le pc pour achever la suppression -> Accepte ( si il ne fait pas automatiquement , fait-le toi même )

/!\ Note : Au démarrage ton bureau RISQUE de ne plus apparaître , dans ce cas fait --> CTRL+ALT+SUPP pour ouvrir le Gestionnaire des tâches.
Puis rends toi à l'onglet "Processus". Clique en haut à gauche sur Fichiers et choisis "Exécuter"

Tape explorer.exe et valide. Cela fera re-apparaître le Bureau.



*************************************************

*************************************************************

/!\ Outils très puissant , ne pas reproduire la manip ci-dessous sur son pc sans y avoir été autorisé par une personne compétente /!\


_________________________________________________

1)Désactive ta restauration système
Clic sur « Démarrer »
Clic droit sur « Poste de travail », puis sur « Propriétés »,
Vas sur l’onglet « Restauration système »
Tu y coches la case « Désactiver la restauration »
Termine par [Appliquer] [OK] 

_________________________________________________


2)Télécharge ComboFix ici &#8594; http://download.bleepingcomputer.com/sUBs/ComboFix.exe  

Et enregistre le sur le bureau >>> /!\ IMPORTANT /!\

Regardes ici, si tu souhaites te familiariser avec son utilisation: https://www.google.fr/?gws_rd=ssl

 AVANT d'utiliser ComboFix :
&#8594; Déconnecte ton PC d'Internet et referme les fenêtres de tous les programmes en cours.   /!\
&#8594; Désactive provisoirement (et seulement le temps de l'utilisation de ComboFix), la protection en temps réel de ton Antivirus et de tes Antispywares et de TOUT tes logiciels de protection !!!, (activés, ils pourraient gêner fortement la procédure de recherche et de nettoyage de l'outil). /!\

3)Sur ton bureau double clic sur Combofix.exe.
Appuies sur la touche 1, pour que le programme commence à s'exécuter et suis les instructions à l'écran.

/!\ PENDANT TOUTE la durée (ça peut être assez long si le pc est très infecté) du scan de ComboFix, n'ouvres aucun programme, ne touche pas à ta souris et ne surfe pas sur le net /!\

Soit patient (même si tu penses que le PC est arrêté) ; les temps « d'arrêt apparent » sont parfois de plusieurs minutes (il y a ± 40 étapes d’analyse).

En cours de nettoyage il est possible, que tu reçoives un avertissement te disant que le pc va redémarrer, laisse le faire.

Après le redemarrage du pc, un rapport s'ouvrira dans le Bloc notes en fin d'analyse, copie et colle tout son contenu dans ton prochain message.

(Le fichier rapport Combofix.txt , est ensuite automatiquement sauvegardé dans C:\Combofix.txt)


_________________________________________________

4)Ensuite réactive ta restauration système
Clic droit sur « Poste de travail », puis sur « Propriétés »,
Vas sur l’onglet « Restauration système »
Tu décoches la case « Désactiver la restauration »
Termine par [Appliquer] [OK] 

_________________________________________________

Tutorial ( aide ): 

http://bibou0007.com/outils-specifiques-f78/tutorial-combofix-t121.htm

https://www.bleepingcomputer.com/combofix/fr/comment-utiliser-combofix


*************************************************************






Voila.
Fait bienTOUTE les manip' dans l'ordre.

Et poste les rapports les un après les autres.
Bonne chance
a++

Sophie · Answer

Quand je fais la première chose que tu ma demander...

lanalyse se met en route mais ensuite une fenètre saffiche en me disant que internet explorer a du fermer car il a rencontrer un probleme.

Sophie · Answer

En essayant plusieur fois sa ne fonctionne po c la galère.....

Utilisateur anonyme · Answer

qu'est-ce qui ne fonctionne pas ?

virus total ?

Met à jour IE -> https://support.microsoft.com/fr-fr/allproducts

Et réessaye.

Sophie · Answer

J'ai mis a jours in,eternet explorer et puis impossible de me reconnecter jusqua maintenant  pour me reconnecter je suis passer par poste de travaille programme files internet explorer et en clik sur celui ci jai pu me retrouvé ma page google galère grave....


Bon jvais tester a nouveau la première chose ke tu ma demander :)

Sophie · Answer

Virus total marche tjrs po 

tjrs le meme probleme une fenetre s'ouvre qui marque que internet a rencontrer un probleme ect 

Voilouu :)

Utilisateur anonyme · Answer

Re ,
Laisse Tomber Virustotal.

Essaye la :

Va sur ce site > http://virusscan.jotti.org/de/ 


Et fait analyser ces fichiers :

C:\Program Files\Multi_Media_France	bMul0.dll 


C:\Program Files\MySpace\IM\MySpaceIM.exe 


( clique sur ' parcourir ' cherche le fichier et une fois sélectionné , clique sur " Abschicken "
Recommence avec le 2 ème.

-> poste le rapport. (sélectionner les résultats qui se seront affichés , copier/coller sur le forum. )

A+

sophie · Answer

A-Squared  Trojan-Downloader.Win32.Bagle.qe  
AntiVir  TR/Dldr.Bagle.QD  
ArcaVir  Adware.Admoke.Amb  
Avast  Win32:Beagle-ADZ  
AVG Antivirus  X  
BitDefender  Trojan.Downloader.Bagle.IK  
ClamAV  PUA.Packed.Themida  
CPsecure  Troj.Downloader.W32.Bagle.qe  
Dr.Web  Win32.HLLM.Beagle.220  
F-Prot Antivirus  X  
F-Secure Anti-Virus  Trojan-Downloader.Win32.Bagle.qe  
Fortinet  W32/Bagle.QE!tr.dldr  
Ikarus  Trojan-Downloader.Win32.Bagle  
Kaspersky Anti-Virus  Trojan-Downloader.Win32.Bagle.qe  
NOD32  Win32/Bagle.OT  
Norman Virus Control  W32/Malware.CXLT  
Panda Antivirus  X  
Sophos Antivirus  Mal/Generic-A  
VirusBuster  Worm.Bagle.ZZA.Gen!Pac  
VBA32  Win32.Bagle.OT

Utilisateur anonyme · Answer

Re ,
C'est quel fichier le rapport d'au dessus ?

a++

Sophie · Answer

A-Squared  X  
AntiVir  X  
ArcaVir  X  
Avast  X  
AVG Antivirus  Obfustat.PRG  
BitDefender  X  
ClamAV  X  
CPsecure  X  
Dr.Web  X  
F-Prot Antivirus  X  
F-Secure Anti-Virus  X  
Fortinet  X  
Ikarus  X  
Kaspersky Anti-Virus  X  
NOD32  X  
Norman Virus Control  X  
Panda Antivirus  X  
Sophos Antivirus  Mal/Packer  
VirusBuster  X  
VBA32  X  

A-Squared  Keine Viren gefunden 
AntiVir  Keine Viren gefunden 
ArcaVir  Keine Viren gefunden 
Avast  Keine Viren gefunden 
AVG Antivirus  Keine Viren gefunden 
BitDefender  Keine Viren gefunden 
ClamAV  Keine Viren gefunden 
CPsecure  Keine Viren gefunden 
Dr.Web  Keine Viren gefunden 
F-Prot Antivirus  Keine Viren gefunden 
F-Secure Anti-Virus  Keine Viren gefunden 
Fortinet  Keine Viren gefunden 
Ikarus  Keine Viren gefunden 
Kaspersky Anti-Virus  Keine Viren gefunden 
NOD32  Keine Viren gefunden 
Norman Virus Control  Keine Viren gefunden 
Panda Antivirus  Keine Viren gefunden 
Sophos Antivirus  Keine Viren gefunden 
VirusBuster  Keine Viren gefunden 
VBA32  Scanning, bitte warten... 


Je c pas trop si c ca ki fallai ke je poste mais aucun rapport est sorti voilou 

A+++

Sophie · Answer

myspace le premier


le deuxieme c lautre :)

Sophie · Answer

Jtai pas dis mais jpeu pas me connecter sur le net si je desactive po mon antivirus en plus il est perimé pourrai tu m'orienté vers un bon antivirus gratuit et me dir si jdois d'abord d'esinstaller celui ke j'ai kapersky...

Mici :) :)

Utilisateur anonyme · Answer

Re ,

Supprime ce dossier :

C:\Program Files\MySpace\IM

Dis moi quand c'est fini.
si il résiste , tente en MSE

Autre tutorials :

https://www.micro-astuce.com/depannage/demarrer-mode-sans-echec.php
http://www.coupdepoucepc.com/modules/news/article.php?storyid=253


Je reviens demain.
A++

Sophie · Answer

C bon il est supprimmer sans difficulté :)

Utilisateur anonyme · Answer

Re ,
Oki.
continu maintenant.

( cf : http://www.commentcamarche.net/forum/affich 6711956 svp virus pc ki rame je veu faire le menage?page=2#30 )

++

Sophie · Answer

OTMoveIt2 by OldTimer - Version 1.0.4.2 log created on 11062008_091742

Voila jespere que c le bon rapport

Je continu avec combofix   :) :)

Sophie · Answer

Je n'arrive pas a utiliser combofix...

Je l'enregistre sur le bureau comme tu me la demander apres je fais executer puis combofix ca lance la page noir apparait et la desuite elle se retire est un encadré ressort en marquant:  current dates 6/11/2008
                                                                                                    This copy combofix has expired
                                                                                                    please dowload and apladet copy

Utilisateur anonyme · Answer

Re ,
Le rapport d'OtmoveIT n'est pas complet.
poste le complet avant de faire autre chose.

-> supprime ta version de Combofix.

A++

Sophie · Answer

File/Folder C:\WINDOWS\system\smvss.exe not found.
File/Folder C:\Program Files\SUPERAntiSpyware not found.
File/Folder C:\WINDOWS\Alcmtr.exe not found.
< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\devenv  >
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\devenv  not found.
 
OTMoveIt2 by OldTimer - Version 1.0.4.2 log created on 11062008_145909


Voici le rapport :) jpense ke la il doit etre complet enfin jespere :)

Utilisateur anonyme · Answer

Re !
Oki =)


Re-télécharge et refais la manip Combofix stp ( il y a eu une mise à jour )
-> oublie pas de désactiver les protections !


http://www.commentcamarche.net/forum/affich 6711956 svp virus pc ki rame je veu faire le menage?page=2#30

Li bien tout.

a++

Sophie · Answer

C:\WINDOWS\system\smvss.exe moved successfully.
C:\Program Files\SUPERAntiSpyware moved successfully.
C:\WINDOWS\Alcmtr.exe moved successfully.
< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\devenv  >
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\devenv  not found.
 
OTMoveIt2 by OldTimer - Version 1.0.4.2 log created on 11062008_091730

Jpense ke c plutot celui la ????  Desoler jsui un boulet en ordi lol

Sophie · Answer

Desoler mais combofix ne marche tjrs po sa fais pareil que tt a lheure...

Utilisateur anonyme · Answer

Re ,
Tout d'abord as-tu supprimé ton ancienne version de Combofix ?

a++

Sophie · Answer

oui dans programe files je lai supprimé et j'ai vider la corbeille

Francois Pé · Answer

Les antivirus, il y'en a des gratuits de très bons.

Utilisateur anonyme · Answer

Re ,

Sophie , redémarre et clique sur ce lien : ( enregistre-le )

http://download.bleepingcomputer.com/sUBs/ComboFix.exe 


Réésaye.
a++

Sophie · Answer

Nan idem .... C po possible pourtant je fais les bonne manip:)

Utilisateur anonyme · Answer

Re ,
Pas grave.
pour la vérif :

Va sur ce site :

http://www.zonavirus.com/datos/descargas/95/elibagla.asp

En bas de cette page tu trouveras un outil à télécharger, clique sur "Descargar Elibagla" (le numéro de version change au fur et à mesure des mises à jour)
installe ce fichier sur le bureau.
ensuite double-clic sur Elibagla.exe

Vérifie que la case "eliminar ficheros automaticamente" est cochée

Clique sur  "explorar"  puis laisse-le travailler.
                     
Puis poste moi le rapport situé dans C:\infosat.txt

(CTRL+A Pour tout selectionner  , CTRL+C pour copier et CTRL+V pour coller )


A++

Sophie · Answer

kan je clic decu une page sort en me disant the page cannot be found

Sophie · Answer

Kan je clik sur Descargar Elibagla la page que je t'ai dite sur la page avant apparait :)

Utilisateur anonyme · Answer

Tu l'as téléchargé oui ou non ?

Sophie · Answer

bein non jpeu pas quand je clik sur Descargar Elibagla  sa maffiche la page : the page cannot be found

Utilisateur anonyme · Answer

Re ,

On recommence de zero.



&#8594; Ferme toutes les applications en cours, puis télécharge ToolsCleaner2 sur ton Bureau.

&#8594; Double clique sur ToolsCleaner2.exe >
&#8594; Clique sur .Recherche
&#8594; puis sur Suppression quand la liste est trouvée.
&#8594; Poste le rapport (TCleaner.txt) qui se trouve à la racine de ton disque dur (C:\). 


(CTRL+A Pour tout selectionner  , CTRL+C pour copier et CTRL+V pour coller )
 
Note : ton bureau RISQUE de disparaître, c'est normal. S'il n'apparaît pas à la fin du scan, fais la manip suivante :

CTRL+ALT+SUPP pour ouvrir le Gestionnaire des tâches.
Puis rends toi à l'onglet "Processus". Clique en haut à gauche sur Fichiers et choisis "Exécuter"

Tape explorer.exe et valide. Cela fera re-apparaître le Bureau

Tuto : http://www.commentcamarche.net/faq/sujet 8341 toolscleaner suppression des fix de force brute ( merci espion3004 )

*****************************************************


/!\ Outils très puissant , ne pas reproduire la manip ci-dessous sur son pc sans y avoir été autorisé par une personne comptétente /!\


Désactive ta restauration système
Clic sur « Démarrer »
Clic droit sur « Poste de travail », puis sur « Propriétés »,
Vas sur l’onglet « Restauration système »
Tu y coches la case « Désactiver la restauration »
Termine par [Appliquer] [OK] 


Télécharge ComboFix ici &#8594; http://download.bleepingcomputer.com/sUBs/ComboFix.exe  

RENOMME LE , tutorial ici  , une fois renommé 

enregistre le sur le bureau >>> /!\ IMPORTANT /!\

Regardes ici, si tu souhaites te familiariser avec son utilisation: https://www.google.fr/?gws_rd=ssl

 AVANT d'utiliser ComboFix :
&#8594; Déconnecte ton PC d'Internet et referme les fenêtres de tous les programmes en cours.   /!\
&#8594; Désactive provisoirement (et seulement le temps de l'utilisation de ComboFix), la protection en temps réel de ton Antivirus et de tes Antispywares et de TOUT tes logiciels de protection !!!, (activés, ils pourraient gêner fortement la procédure de recherche et de nettoyage de l'outil). /!\

Sur ton bureau double clic sur Combofix.exe.
Appuies sur la touche 1, pour que le programme commence à s'exécuter et suis les instructions à l'écran.

/!\ PENDANT TOUTE la durée (ça peut être assez long si le pc est très infecté) du scan de ComboFix, n'ouvres aucun programme, ne touche pas à ta souris et ne surfe pas sur le net /!\

Soit patient (même si tu penses que le PC est arrêté) ; les temps « d'arrêt apparent » sont parfois de plusieurs minutes (il y a ± 40 étapes d’analyse).

En cours de nettoyage il est possible, que tu reçoives un avertissement te disant que le pc va redémarrer, laisse le faire.

Après le redemarrage du pc, un rapport s'ouvrira dans le Bloc notes en fin d'analyse, copie et colle tout son contenu dans ton prochain message.

(Le fichier rapport Combofix.txt , est ensuite automatiquement sauvegardé dans C:\Combofix.txt)

Ensuite réactive ta restauration système
Clic droit sur « Poste de travail », puis sur « Propriétés »,
Vas sur l’onglet « Restauration système »
Tu décoches la case « Désactiver la restauration »
Termine par [Appliquer] [OK] 

Tutorial ( aide ): 

http://bibou0007.com/outils-specifiques-f78/tutorial-combofix-t121.htm

https://www.bleepingcomputer.com/combofix/fr/comment-utiliser-combofix


A+

Sophie · Answer

-->- Recherche: 

C:\Combofix: trouvé !
C:\_OtMoveIt: trouvé !
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\HJT.exe\HijackThis.lnk: trouvé !
C:\Documents and Settings\Propriétaire\Bureau\Dss.exe: trouvé !
C:\Documents and Settings\Propriétaire\Bureau\HijackThis.lnk: trouvé !
C:\Documents and Settings\Propriétaire\Bureau\reason4\Msnfix.zip: trouvé !
C:\Documents and Settings\Propriétaire\Bureau\reason4\MsnFix: trouvé !
C:\Documents and Settings\Propriétaire\Bureau\reason4\MSNFix\MsnFix: trouvé !
C:\Program Files\Trend Micro\HijackThis: trouvé !
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe: trouvé !

---------------------------------
-->- Suppression: 

C:\Documents and Settings\All Users\Menu Démarrer\Programmes\HJT.exe\HijackThis.lnk: supprimé !
C:\Documents and Settings\Propriétaire\Bureau\Dss.exe: supprimé !
C:\Documents and Settings\Propriétaire\Bureau\HijackThis.lnk: supprimé !
C:\Documents and Settings\Propriétaire\Bureau\reason4\Msnfix.zip: supprimé !
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe: supprimé !
C:\Combofix: supprimé !
C:\_OtMoveIt: supprimé !
C:\Documents and Settings\Propriétaire\Bureau\reason4\MsnFix: supprimé !
C:\Program Files\Trend Micro\HijackThis: supprimé !

Voila le premier rapport ke tu ma demander :)

Sophie · Answer

desoler mais combofix marche tjrs po... sa fais pareil

Utilisateur anonyme · Answer

Re ,

ça m'embête au plus haut point  x)


Fait ceci :

Télécharge http://www.suspectfile.com/systemscan/   ( Systemscan )
  

&#8594; Double clic dessus (ferme ton antivirus le temps du téléchargement s'il te détecte quoi que ce soit et réactive le après)

&#8594; Clique sur Unselect all

Coche uniquement ces cases :

_ Recent Files, 30 days

_ Registry run keys

_ Suspicious files


Puis clique sur scan now, sois patient.
Une fois le scan terminé, un rapport va s'ouvrir, copie et colle son contenu ici et vérifie qu'il soit bien en entier, si besoin crée deux messages.

(CTRL+A Pour tout selectionner  , CTRL+C pour copier et CTRL+V pour coller )


A++

Sophie · Answer

SystemScan - www.suspectfile.com - ver. 3.5.5 (code: holifay & bReAkdOWn)

Running on: Windows XP HOME Edition, Service Pack 2 (2600.5.1)
System directory: C:\WINDOWS
SystemScan file: C:\Documents and Settings\Propriétaire\Local Settings\Temporary Internet Files\Content.IE5\HLWUXMAW\sys78712[1].exe
Running in: User mode
Date: 06/11/2008
Time: 17:29:43
  
Output limited to: 
 -Recent files
 -Registry Run Keys
 -Suspicious Files

===================== RECENT FILES =====================

Showing files newer than  30 days

----- recent files in C:\
04/11/2008 18:14:33 (DIR)        0 byte      2 days old -- Deckard
06/11/2008 16:34:07      2145386496 byte      0 days old -- pagefile.sys
06/11/2008 16:54:38 (DIR)        0 byte      0 days old -- Program Files
06/11/2008 16:56:08 (DIR)        0 byte      0 days old -- Config.Msi
06/11/2008 17:05:02           1264 byte      0 days old -- TCleaner.txt
06/11/2008 17:07:23 (DIR)        0 byte      0 days old -- System Volume Information
06/11/2008 17:09:19 (DIR)        0 byte      0 days old -- ComboFix
06/11/2008 17:17:41           3660 byte      0 days old -- Bug.txt
06/11/2008 17:17:42 (DIR)        0 byte      0 days old -- Combo-Fix
06/11/2008 17:17:47 (DIR)        0 byte      0 days old -- WINDOWS

----- recent files in C:\WINDOWS\
04/11/2008 12:27:54 (DIR)        0 byte      2 days old -- Minidump
04/11/2008 12:47:51 (DIR)        0 byte      2 days old -- Tasks
04/11/2008 12:51:02              0 byte      2 days old -- setuperr.log
04/11/2008 12:53:08           9170 byte      2 days old -- KB943055Uninst.log
04/11/2008 18:14:42 (DIR)        0 byte      2 days old -- ERDNT
04/11/2008 20:49:01 (DIR)        0 byte      2 days old -- Debug
04/11/2008 20:49:46 (DIR)        0 byte      2 days old -- $NtUninstallKB943055$
04/11/2008 20:49:49          11413 byte      2 days old -- KB943055.log
04/11/2008 20:49:52 (DIR)        0 byte      2 days old -- $NtUninstallKB950749$
04/11/2008 20:49:56          14173 byte      2 days old -- KB950749.log
04/11/2008 20:49:58 (DIR)        0 byte      2 days old -- $NtUninstallKB945553$
04/11/2008 20:49:59          12373 byte      2 days old -- KB945553.log
04/11/2008 20:50:02 (DIR)        0 byte      2 days old -- $NtUninstallKB944338$
04/11/2008 20:50:03          13476 byte      2 days old -- KB944338.log
04/11/2008 20:50:05 (DIR)        0 byte      2 days old -- $NtUninstallKB948590$
04/11/2008 20:50:06          12774 byte      2 days old -- KB948590.log
04/11/2008 20:50:07 (DIR)        0 byte      2 days old -- $NtUninstallKB941693$
04/11/2008 20:50:09          12974 byte      2 days old -- KB941693.log
04/11/2008 20:50:13 (DIR)        0 byte      2 days old -- $NtUninstallKB947864$
04/11/2008 20:50:19          20085 byte      2 days old -- KB947864.log
04/11/2008 20:50:20 (DIR)        0 byte      2 days old -- $NtUninstallKB948881$
04/11/2008 20:50:22          11204 byte      2 days old -- KB948881.log
05/11/2008 12:58:01 (DIR)        0 byte      1 days old -- $NtUninstallKB904942$
05/11/2008 12:58:04          11030 byte      1 days old -- KB904942.log
05/11/2008 12:58:06 (DIR)        0 byte      1 days old -- $NtUninstallKB914440$
05/11/2008 12:58:07 (DIR)        0 byte      1 days old -- network diagnostic
05/11/2008 12:58:08           5198 byte      1 days old -- KB914440.log
05/11/2008 12:58:53 (DIR)        0 byte      1 days old -- $NtUninstallKB915865$
05/11/2008 12:58:57           6278 byte      1 days old -- KB915865.log
05/11/2008 12:59:06 (DIR)        0 byte      1 days old -- $NtServicePackUninstallNLSDownlevelMapping$
05/11/2008 12:59:09           7177 byte      1 days old -- NLSDownlevelMapping.log
05/11/2008 12:59:16 (DIR)        0 byte      1 days old -- $NtServicePackUninstallIDNMitigationAPIs$
05/11/2008 12:59:20           7485 byte      1 days old -- IDNMitigationAPIs.log
05/11/2008 13:00:09 (DIR)        0 byte      1 days old -- ie7
05/11/2008 13:00:17 (DIR)        0 byte      1 days old -- Media
05/11/2008 13:00:21 (DIR)        0 byte      1 days old -- WBEM
05/11/2008 13:00:27          57821 byte      1 days old -- ie7.log
05/11/2008 13:00:49 (DIR)        0 byte      1 days old -- ie7updates
05/11/2008 13:01:00          72190 byte      1 days old -- KB944533-IE7.log
05/11/2008 13:01:11          45658 byte      1 days old -- updspapi.log
05/11/2008 13:01:15          50000 byte      1 days old -- KB947864-IE7.log
05/11/2008 13:01:36          35377 byte      1 days old -- ie7_main.log
05/11/2008 13:02:42 (DIR)        0 byte      1 days old -- Help
05/11/2008 13:03:16           6286 byte      1 days old -- spupdsvc.log
05/11/2008 13:33:23             60 byte      1 days old -- setupact.log
05/11/2008 18:18:13         117714 byte      1 days old -- ntbtlog.txt
06/11/2008 09:00:51 (DIR)        0 byte      0 days old -- $hf_mig$
06/11/2008 09:17:30 (DIR)        0 byte      0 days old -- system
06/11/2008 10:18:12 (DIR)        0 byte      0 days old -- $NtUninstallKB932823-v3$
06/11/2008 10:18:18          10097 byte      0 days old -- KB932823-v3.log
06/11/2008 10:18:19           1374 byte      0 days old -- imsins.BAK
06/11/2008 10:18:25          75274 byte      0 days old -- ocgen.log
06/11/2008 10:18:25          56446 byte      0 days old -- tsoc.log
06/11/2008 10:18:25          48869 byte      0 days old -- setupapi.log
06/11/2008 10:18:25           8054 byte      0 days old -- ocmsn.log
06/11/2008 10:18:25           1374 byte      0 days old -- imsins.log
06/11/2008 10:18:25 (DIR)        0 byte      0 days old -- inf
06/11/2008 10:18:25          21821 byte      0 days old -- iis6.log
06/11/2008 10:18:25          48411 byte      0 days old -- comsetup.log
06/11/2008 10:18:25         139927 byte      0 days old -- FaxSetup.log
06/11/2008 10:18:25           7402 byte      0 days old -- msgsocm.log
06/11/2008 10:18:25          10950 byte      0 days old -- KB938127-IE7.log
06/11/2008 10:18:25          31031 byte      0 days old -- ntdtcsetup.log
06/11/2008 15:53:02 (DIR)        0 byte      0 days old -- Prefetch
06/11/2008 16:33:10          23478 byte      0 days old -- SchedLgU.Txt
06/11/2008 16:34:11           2048 byte      0 days old -- bootstat.dat
06/11/2008 16:34:12              0 byte      0 days old -- 0.log
06/11/2008 16:34:23             50 byte      0 days old -- wiaservc.log
06/11/2008 16:34:26            159 byte      0 days old -- wiadebug.log
06/11/2008 16:35:13         696959 byte      0 days old -- WindowsUpdate.log
06/11/2008 16:56:08 (DIR)        0 byte      0 days old -- WinSxS
06/11/2008 16:56:15 (DIR)        0 byte      0 days old -- Installer
06/11/2008 17:02:30 (DIR)        0 byte      0 days old -- Temp
06/11/2008 17:17:41 (DIR)        0 byte      0 days old -- system32

----- recent files in C:\WINDOWS\Downloaded Program Files\

----- recent files in C:\WINDOWS\system\

----- recent files in C:\WINDOWS\system32\
04/11/2008 12:11:54          13702 byte      2 days old -- wpa.dbl
04/11/2008 12:14:58        1070888 byte      2 days old -- PerfStringBackup.INI
04/11/2008 12:15:00          83620 byte      2 days old -- perfc00C.dat
04/11/2008 12:15:00          70106 byte      2 days old -- perfc009.dat
04/11/2008 12:15:00         485868 byte      2 days old -- perfh00C.dat
04/11/2008 12:15:00         418590 byte      2 days old -- perfh009.dat
05/11/2008 10:53:41          91888 byte      1 days old -- FNTCACHE.DAT
05/11/2008 13:00:55 (DIR)        0 byte      1 days old -- fr-fr
06/11/2008 10:18:24 (DIR)        0 byte      0 days old -- dllcache
06/11/2008 15:04:53 (DIR)        0 byte      0 days old -- CatRoot2
06/11/2008 16:20:13           3121 byte      0 days old -- CONFIG.NT
06/11/2008 16:28:07 (DIR)        0 byte      0 days old -- drivers
06/11/2008 17:07:23 (DIR)        0 byte      0 days old -- Restore

----- recent files in C:\WINDOWS\system32\drivers\

----- recent files in C:\WINDOWS	emp\
06/11/2008 16:17:38         965569 byte      0 days old -- fa56d7ec.$$$
06/11/2008 16:34:16          16384 byte      0 days old -- Perflib_Perfdata_658.dat
06/11/2008 17:03:51 (DIR)        0 byte      0 days old -- _avast4_

----- recent files in C:\Program Files\
04/11/2008 12:44:13 (DIR)        0 byte      2 days old -- ATI Technologies
04/11/2008 12:55:53 (DIR)        0 byte      2 days old -- Windows Live Toolbar
05/11/2008 16:09:17 (DIR)        0 byte      1 days old -- eMule
05/11/2008 16:17:51 (DIR)        0 byte      1 days old -- Internet Explorer
05/11/2008 20:34:33 (DIR)        0 byte      1 days old -- Messenger
05/11/2008 20:34:33 (DIR)        0 byte      1 days old -- M-Audio Firewire Audiophile
05/11/2008 20:34:33 (DIR)        0 byte      1 days old -- DivX
05/11/2008 20:36:52 (DIR)        0 byte      1 days old -- MySpace
06/11/2008 15:02:36 (DIR)        0 byte      0 days old -- PKR
06/11/2008 16:55:02 (DIR)        0 byte      0 days old -- Fichiers communs
06/11/2008 16:56:30 (DIR)        0 byte      0 days old -- SPYWAREfighter
06/11/2008 17:04:44 (DIR)        0 byte      0 days old -- Trend Micro

----- recent files in C:\Program Files\Fichiers communs\
06/11/2008 16:55:02 (DIR)        0 byte      0 days old -- Application

----- recent files in C:\Documents and Settings\Propriétaire\Application Data\
04/11/2008 13:48:47 (DIR)        0 byte      2 days old -- Malwarebytes
05/11/2008 13:09:44 (DIR)        0 byte      1 days old -- SUPERAntiSpyware.com

----- recent files in C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\
04/11/2008 18:20:11          16384 byte      2 days old -- ~DF3333.tmp
04/11/2008 18:46:09         239104 byte      2 days old -- 71exhmunmlclr14.exe
04/11/2008 18:46:09         239104 byte      2 days old -- 75exhmunmlclr14.exe
04/11/2008 18:46:09         239104 byte      2 days old -- 88exhmunmlclr14.exe
04/11/2008 18:46:09         239104 byte      2 days old -- 24exhmunmlclr14.exe
04/11/2008 19:05:45          16384 byte      2 days old -- ~DF8B63.tmp
04/11/2008 19:14:04          32768 byte      2 days old -- ~DF3D4F.tmp
04/11/2008 20:48:26          16384 byte      2 days old -- ~DF6387.tmp
05/11/2008 11:05:41          22704 byte      1 days old -- Danish.bin
05/11/2008 11:05:41          25670 byte      1 days old -- Dutch.bin
05/11/2008 11:05:41          16913 byte      1 days old -- TradChin.bin
05/11/2008 11:05:41          24256 byte      1 days old -- Japanese.bin
05/11/2008 11:05:41          20101 byte      1 days old -- Korean.bin
05/11/2008 11:05:42          27178 byte      1 days old -- French.bin
05/11/2008 11:05:43          24028 byte      1 days old -- SWEDISH.bin
05/11/2008 11:05:43          25684 byte      1 days old -- German.bin
05/11/2008 11:05:43          26062 byte      1 days old -- Russian.bin
05/11/2008 11:05:43          27689 byte      1 days old -- Spanish.bin
05/11/2008 11:05:43          27330 byte      1 days old -- Italian.bin
05/11/2008 11:05:44          26187 byte      1 days old -- Portuguese.bin
05/11/2008 11:05:44          21913 byte      1 days old -- Thai.bin
05/11/2008 11:05:44          20919 byte      1 days old -- Arabic.bin
05/11/2008 11:05:44          21857 byte      1 days old -- English.bin
05/11/2008 11:05:44          16374 byte      1 days old -- SimChin.bin
05/11/2008 11:05:45          24999 byte      1 days old -- Portuguese(Brazil).bin
05/11/2008 11:05:45          24147 byte      1 days old -- Polish.bin
05/11/2008 11:05:45          25003 byte      1 days old -- Greek.bin
05/11/2008 11:05:45          24252 byte      1 days old -- Czech.bin
05/11/2008 11:05:46          22793 byte      1 days old -- Finnish.bin
05/11/2008 11:05:47          19487 byte      1 days old -- Hebrew.bin
05/11/2008 11:05:47          26001 byte      1 days old -- Hungarian.bin
05/11/2008 11:05:48          21901 byte      1 days old -- Norwegian.bin
05/11/2008 11:05:48          22194 byte      1 days old -- Turkish.bin
05/11/2008 11:27:14          32768 byte      1 days old -- ~DF6515.tmp
05/11/2008 11:31:17          16384 byte      1 days old -- ~DF9D46.tmp
05/11/2008 11:31:34          16384 byte      1 days old -- ~DF7191.tmp
05/11/2008 11:31:58          16384 byte      1 days old -- ~DF1672.tmp
05/11/2008 11:32:48          16384 byte      1 days old -- ~DFD13B.tmp
05/11/2008 11:33:22          16384 byte      1 days old -- ~DFA2FD.tmp
05/11/2008 11:42:31          32768 byte      1 days old -- ~DF638.tmp
05/11/2008 11:44:33          32768 byte      1 days old -- ~DF34FC.tmp
05/11/2008 11:49:16          16384 byte      1 days old -- ~DF23B5.tmp
05/11/2008 11:49:16          16384 byte      1 days old -- ~DF2494.tmp
05/11/2008 11:50:14          16384 byte      1 days old -- ~DF23C4.tmp
05/11/2008 11:53:30          16384 byte      1 days old -- ~DF45C4.tmp
05/11/2008 11:54:23          32768 byte      1 days old -- ~DF7AF.tmp
05/11/2008 11:57:13          16384 byte      1 days old -- ~DF214A.tmp
05/11/2008 11:57:40          32768 byte      1 days old -- ~DFD70B.tmp
05/11/2008 12:06:58          16384 byte      1 days old -- ~DFA66A.tmp
05/11/2008 12:09:48          32768 byte      1 days old -- ~DFB01E.tmp
05/11/2008 12:20:27          16384 byte      1 days old -- ~DF1DB1.tmp
05/11/2008 12:20:50          16384 byte      1 days old -- ~DFBA1E.tmp
05/11/2008 12:22:24          32768 byte      1 days old -- ~DF3E3D.tmp
05/11/2008 12:25:54          16384 byte      1 days old -- ~DF5412.tmp
05/11/2008 12:26:21          32768 byte      1 days old -- ~DF150A.tmp
05/11/2008 12:28:38          32768 byte      1 days old -- ~DF60E8.tmp
05/11/2008 12:30:18          32768 byte      1 days old -- ~DF6AD1.tmp
05/11/2008 12:34:10          16384 byte      1 days old -- ~DFEBB.tmp
05/11/2008 12:50:14          32768 byte      1 days old -- ~DF8F7A.tmp
05/11/2008 12:51:34          16384 byte      1 days old -- ~DFFCE4.tmp
05/11/2008 13:03:17             54 byte      1 days old -- hmunmlclr14.exe.conf
05/11/2008 13:06:05          16384 byte      1 days old -- ~DF3079.tmp
05/11/2008 13:07:32          16384 byte      1 days old -- ~DF4070.tmp
05/11/2008 13:09:58          16384 byte      1 days old -- ~DF8638.tmp
05/11/2008 13:11:45          16384 byte      1 days old -- ~DF1BF6.tmp
05/11/2008 13:11:46              0 byte      1 days old -- 88313.dmp
05/11/2008 13:12:32          16384 byte      1 days old -- ~DF9948.tmp
05/11/2008 13:12:49          16384 byte      1 days old -- ~DF430A.tmp
05/11/2008 13:14:44          16384 byte      1 days old -- ~DF8882.tmp
05/11/2008 13:30:14          16316 byte      1 days old -- 6394_appcompat.txt
05/11/2008 13:30:20          75860 byte      1 days old -- 196E60.dmp
05/11/2008 13:30:50 (DIR)        0 byte      1 days old -- WERea67.dir00
05/11/2008 13:30:50 (DIR)        0 byte      1 days old -- WERe1a5.dir00
05/11/2008 13:32:24          16384 byte      1 days old -- ~DF7932.tmp
05/11/2008 13:33:08 (DIR)        0 byte      1 days old -- WERf61a.dir00
05/11/2008 13:39:59          16384 byte      1 days old -- ~DFD7EB.tmp
05/11/2008 13:40:18 (DIR)        0 byte      1 days old -- WER8f52.dir00
05/11/2008 13:40:20 (DIR)        0 byte      1 days old -- WER918b.dir00
05/11/2008 13:43:22          16384 byte      1 days old -- ~DFDB6A.tmp
05/11/2008 13:43:50          32298 byte      1 days old -- de41_appcompat.txt
05/11/2008 13:44:49 (DIR)        0 byte      1 days old -- ~nsu.tmp
05/11/2008 13:53:45          16384 byte      1 days old -- ~DFEEDF.tmp
05/11/2008 13:53:56          16384 byte      1 days old -- Perflib_Perfdata_808.dat
05/11/2008 13:54:45 (DIR)        0 byte      1 days old -- WER3a07.dir00
05/11/2008 13:56:10          16384 byte      1 days old -- ~DF5FA5.tmp
05/11/2008 13:57:24          16384 byte      1 days old -- ~DF536A.tmp
05/11/2008 13:57:59          16384 byte      1 days old -- ~DF4193.tmp
05/11/2008 13:59:31          16384 byte      1 days old -- ~DF7F9F.tmp
05/11/2008 14:01:28          16384 byte      1 days old -- ~DF89.tmp
05/11/2008 14:02:16          16384 byte      1 days old -- ~DF34F.tmp
05/11/2008 15:08:31         239104 byte      1 days old -- 60exhmunmlclr15.exe
05/11/2008 15:08:31         239104 byte      1 days old -- 46exhmunmlclr15.exe
05/11/2008 15:08:31         239104 byte      1 days old -- 79exhmunmlclr15.exe
05/11/2008 15:47:47          16384 byte      1 days old -- ~DF2136.tmp
05/11/2008 15:48:43          16316 byte      1 days old -- efda_appcompat.txt
05/11/2008 15:48:48          79711 byte      1 days old -- 2FB0F.dmp
05/11/2008 15:48:53          16384 byte      1 days old -- ~DF9F2B.tmp
05/11/2008 15:51:44          10144 byte      1 days old -- MPC5.tmp
05/11/2008 15:54:52          16384 byte      1 days old -- ~DFC6BC.tmp
05/11/2008 16:09:05             54 byte      1 days old -- hmunmlclr15.exe.conf
05/11/2008 16:13:12          16384 byte      1 days old -- ~DF6329.tmp
05/11/2008 16:18:17          16384 byte      1 days old -- ~DFBFC8.tmp
05/11/2008 16:18:33          16384 byte      1 days old -- ~DF7EC1.tmp
05/11/2008 16:19:06          16384 byte      1 days old -- ~DF16CD.tmp
05/11/2008 16:21:01          32768 byte      1 days old -- ~DF18AE.tmp
05/11/2008 16:31:24 (DIR)        0 byte      1 days old -- {E09B48B5-E141-427A-AB0C-D3605127224A}
05/11/2008 16:35:48          16384 byte      1 days old -- ~DFE243.tmp
05/11/2008 16:39:53          16384 byte      1 days old -- ~DF9898.tmp
05/11/2008 16:40:07          16384 byte      1 days old -- ~DF4EDB.tmp
05/11/2008 16:41:25          16384 byte      1 days old -- ~DF5CB1.tmp
05/11/2008 18:58:45          32768 byte      1 days old -- ~DF84C.tmp
05/11/2008 20:54:31          16384 byte      1 days old -- ~DF1F42.tmp
05/11/2008 20:54:57          16384 byte      1 days old -- ~DF7E1A.tmp
06/11/2008 09:10:34          16384 byte      0 days old -- ~DFF265.tmp
06/11/2008 09:11:12          16384 byte      0 days old -- ~DFC471.tmp
06/11/2008 09:13:00          32768 byte      0 days old -- ~DFCC98.tmp
06/11/2008 09:20:46          32768 byte      0 days old -- ~DFF5DB.tmp
06/11/2008 09:29:12          32768 byte      0 days old -- ~DF2C5F.tmp
06/11/2008 09:35:02          32768 byte      0 days old -- ~DF9840.tmp
06/11/2008 10:00:04          32768 byte      0 days old -- ~DF4304.tmp
06/11/2008 10:08:16          16384 byte      0 days old -- ~DFA144.tmp
06/11/2008 14:52:12          16384 byte      0 days old -- ~DF60BA.tmp
06/11/2008 14:54:17          32768 byte      0 days old -- ~DFACD8.tmp
06/11/2008 15:02:40          16384 byte      0 days old -- ~DF3CC3.tmp
06/11/2008 15:09:50          16384 byte      0 days old -- ~DFF540.tmp
06/11/2008 15:10:17          32768 byte      0 days old -- ~DFC9B4.tmp
06/11/2008 15:12:34          16384 byte      0 days old -- ~DF490C.tmp
06/11/2008 15:13:29          32768 byte      0 days old -- ~DFC226.tmp
06/11/2008 15:29:11           9450 byte      0 days old -- caevents.log
06/11/2008 15:35:01          16384 byte      0 days old -- ~DF41F7.tmp
06/11/2008 15:39:08          16384 byte      0 days old -- ~DFAA9.tmp
06/11/2008 15:40:37          16384 byte      0 days old -- ~DF7B1F.tmp
06/11/2008 15:41:13         311296 byte      0 days old -- ~DF1CE7.tmp
06/11/2008 15:43:01          32768 byte      0 days old -- ~DF4734.tmp
06/11/2008 15:58:44          16384 byte      0 days old -- ~DF3D3C.tmp
06/11/2008 15:59:27          16384 byte      0 days old -- ~DF98B.tmp
06/11/2008 16:00:06          32768 byte      0 days old -- ~DF172F.tmp
06/11/2008 16:10:56          16384 byte      0 days old -- ~DFD933.tmp
06/11/2008 16:11:18          16384 byte      0 days old -- ~DF9687.tmp
06/11/2008 16:12:14 (DIR)        0 byte      0 days old -- AVSETUP_4913094e
06/11/2008 16:13:05          32768 byte      0 days old -- ~DFE54A.tmp
06/11/2008 16:15:30          16384 byte      0 days old -- ~DF9A12.tmp
06/11/2008 16:15:43          32768 byte      0 days old -- ~DFEFB6.tmp
06/11/2008 16:20:14 (DIR)        0 byte      0 days old -- _avast4_
06/11/2008 16:24:21          16384 byte      0 days old -- ~DFE2D5.tmp
06/11/2008 16:25:23          16384 byte      0 days old -- ~DF5EFD.tmp
06/11/2008 16:26:07          16384 byte      0 days old -- ~DFF440.tmp
06/11/2008 16:29:07          16384 byte      0 days old -- ~DFED0F.tmp
06/11/2008 16:31:14          16384 byte      0 days old -- ~DF3471.tmp
06/11/2008 16:31:50          16384 byte      0 days old -- ~DFD017.tmp
06/11/2008 16:34:47          16384 byte      0 days old -- Perflib_Perfdata_a00.dat
06/11/2008 16:34:51          16384 byte      0 days old -- Perflib_Perfdata_dac.dat
06/11/2008 16:34:51          16384 byte      0 days old -- Perflib_Perfdata_da4.dat
06/11/2008 16:54:17              0 byte      0 days old -- is6.tmp
06/11/2008 16:54:36              0 byte      0 days old -- isA.tmp
06/11/2008 16:58:05          49152 byte      0 days old -- ~DF4FF4.tmp
06/11/2008 17:05:33          32768 byte      0 days old -- ~DF1D19.tmp
06/11/2008 17:09:48          32768 byte      0 days old -- ~DF2612.tmp
06/11/2008 17:14:09          32768 byte      0 days old -- ~DF1B2A.tmp
06/11/2008 17:24:18          32768 byte      0 days old -- ~DF3066.tmp
06/11/2008 17:26:00          32768 byte      0 days old -- ~DF659E.tmp
06/11/2008 17:27:27          32768 byte      0 days old -- ~DFCA23.tmp
06/11/2008 17:28:37          16384 byte      0 days old -- ~DFFE93.tmp
06/11/2008 17:28:37            115 byte      0 days old -- systemscan.ini
06/11/2008 17:28:37 (DIR)        0 byte      0 days old -- nsl3D.tmp

===================== REGISTRY SCAN =====================


-----HKLM\Software\Microsoft\Windows\CurrentVersion\Run-----

[Run]
  "ATICCC"="\"C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe\""
  "NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe"
  "MAFWTaskbarApp"="C:\WINDOWS\system32\MAFWTray.exe"
  "RTHDCPL"="RTHDCPL.EXE"
  "SkyTel"="SkyTel.EXE"
  "Alcmtr"="ALCMTR.EXE"
  "PKR Pal"="\"C:\Program Files\PKR\pkrpal.exe\" -osboot"
  "H2O"="C:\Program Files\SyncroSoft\Pos\H2O\cledx.exe"
  "devenv"="C:\WINDOWS\system\smvss.exe /w"
  "FLMOFFICE4DMOUSE"="C:\Program Files\Trust\DS-4500X Wireless Laser Deskset\Mouse\mouse32a.exe"
  "OFFICEKB"="C:\Program Files\Trust\DS-4500X Wireless Laser Deskset\Keyboard\kbdap32a.EXE"
  "avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe"
  "spywarefighterguard"="C:\Program Files\SPYWAREfighter\spftray.exe"
  @=""

[Run\avp6_post_uninstall]

[Run\OptionalComponents]
  @=""

[Run\OptionalComponents\IMAIL]
  "Installed"="1"
  @=""

[Run\OptionalComponents\MAPI]
  "NoChange"="1"
  "Installed"="1"
  @=""

[Run\OptionalComponents\MSFS]
  "Installed"="1"
  @=""

-----HKCU\Software\Microsoft\Windows\CurrentVersion\Run-----

[Run]
  "MsnMsgr"="\"C:\Program Files\MSN Messenger\MsnMsgr.Exe\" /background"
  "MySpaceIM"="C:\Program Files\MySpace\IM\MySpaceIM.exe"
  "SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe"
  "SUPERAntiSpyware"="C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe"
  "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe"

-----HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Run-----

[Run]
  "MySpaceIM"="C:\Program Files\MySpace\IM\MySpaceIM.exe"

-----HKLM\Software\Microsoft\Windows\CurrentVersion\policies\Explorer\Run-----

[Run]

-----HKCU\Software\Microsoft\Windows\CurrentVersion\policies\Explorer\Run-----

[Run]

-----HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows-----

[Windows]
  "AppInit_DLLs"=""

-----HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad-----

[ShellServiceObjectDelayLoad]
  "PostBootReminder"="{7849596a-48ea-486e-8937-a2a3009f31a9}"
    #### HKCR\CLSID\{7849596a-48ea-486e-8937-a2a3009f31a9}\InprocServer32 @=expand:"%SystemRoot%\system32\SHELL32.dll"
  "CDBurn"="{fbeb8a05-beee-4442-804e-409d6c4515e9}"
    #### HKCR\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InprocServer32 @=expand:"%SystemRoot%\system32\SHELL32.dll"
  "WebCheck"="{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"
    #### HKCR\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\InprocServer32 @=expand:"C:\WINDOWS\system32\webcheck.dll"
  "SysTray"="{35CEC8A3-2BE6-11D2-8773-92E220524153}"
    #### HKCR\CLSID\{35CEC8A3-2BE6-11D2-8773-92E220524153}\InprocServer32 @="C:\WINDOWS\system32\stobject.dll"

-----HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks-----

[ShellExecuteHooks]
  "{AEB6717E-7E19-11d0-97EE-00C04FD91972}"=""
    #### HKCR\CLSID\{AEB6717E-7E19-11d0-97EE-00C04FD91972}\InprocServer32 @="shell32.dll"

-----HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon-----

[Winlogon]
  "Shell"="Explorer.exe"
  "System"=""
  "Userinit"="C:\WINDOWS\system32\userinit.exe,"
  "VmApplet"="rundll32 shell32,Control_RunDLL \"sysdm.cpl\""
  "UIHost"=expand:"logonui.exe"
  "LogonType"=dword:00000001
  "WinStationsDisabled"="0"

[Winlogon\GPExtensions]

[Winlogon\GPExtensions\{3610eda5-77ef-11d2-8dc5-00c04fa31a66}]
  "@="Quota du disque Microsoft"
  "DllName"=expand:"dskquota.dll"

[Winlogon\GPExtensions\{4CFB60C1-FAA6-47f1-89AA-0B18730C9FD3}]
  "@="Internet Explorer Zonemapping"
  "DllName"=expand:"iedkcs32.dll"

[Winlogon\GPExtensions\{827D319E-6EAC-11D2-A4EA-00C04F79F83A}]
  "DllName"=expand:"scecli.dll"
  "@="Security"

[Winlogon\GPExtensions\{A2E30F80-D7DE-11d2-BBDE-00C04F86AE3B}]
  "DllName"="iedkcs32.dll"
  "@="Internet Explorer Branding"

[Winlogon\GPExtensions\{B1BE8D72-6EAC-11D2-A4EA-00C04F79F83A}]
  "DllName"=expand:"scecli.dll"
  "@="EFS recovery"

[Winlogon\GPExtensions\{C631DF4C-088F-4156-B058-4375F0853CD8}]
  "@="Microsoft Offline Files"
  "DllName"=expand:"%SystemRoot%\System32\cscui.dll"

[Winlogon\GPExtensions\{c6dc5466-785a-11d2-84d0-00c04fb169f7}]
  "@="Installation de logiciel"
  "DllName"=expand:"appmgmts.dll"

[Winlogon\Notify]

[Winlogon\Notify\!SASWinLogon]

[Winlogon\Notify\AtiExtEvent]
  "DLLName"="Ati2evxx.dll"

[Winlogon\Notify\crypt32chain]
  "DllName"=expand:"crypt32.dll"

[Winlogon\Notify\cryptnet]
  "DllName"=expand:"cryptnet.dll"

[Winlogon\Notify\cscdll]
  "DLLName"="cscdll.dll"

[Winlogon\Notify\ScCertProp]
  "DLLName"="wlnotify.dll"

[Winlogon\Notify\Schedule]
  "DllName"=expand:"wlnotify.dll"

[Winlogon\Notify\sclgntfy]
  "DllName"=expand:"sclgntfy.dll"

[Winlogon\Notify\SensLogn]
  "DLLName"="WlNotify.dll"

[Winlogon\Notify	ermsrv]
  "DllName"=expand:"wlnotify.dll"

[Winlogon\Notify\wlballoon]
  "DLLName"="wlnotify.dll"

[Winlogon\SpecialAccounts]

[Winlogon\SpecialAccounts\UserList]
  "HelpAssistant"=dword:00000000
  "TsInternetUser"=dword:00000000
  "SQLAgentCmdExec"=dword:00000000
  "NetShowServices"=dword:00000000
  "IWAM_"=dword:00010000
  "IUSR_"=dword:00010000
  "VUSR_"=dword:00010000

-----HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon-----

[Winlogon]
  "ParseAutoexec"="1"
  "ExcludeProfileDirs"="Local Settings;Temporary Internet Files;Historique;Temp"
  "BuildNumber"=dword:00000a28

-----HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options-----

[Image File Execution Options\Your Image File Name Here without a path]
  "Debugger"="ntsd -d"

-----HKLM\System\CurrentControlSet\Control\Session Manager\-----

[Session Manager]
  "BootExecute"=multi:"autocheck autochk *\00\00"

[Session Manager\SubSystems]
  "Windows"=expand:"%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,3072,512 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ProfileControl=Off MaxRequestThreads=16"

-----HKLM\SYSTEM\CurrentControlSet\Control\WOW-----

[WOW]
  "cmdline"=expand:"%SystemRoot%\system32
tvdm.exe"
  "wowcmdline"=expand:"%SystemRoot%\system32
tvdm.exe -a %SystemRoot%\system32\krnl386"

-----HKLM\Software\Microsoft\Windows NT\CurrentVersion\Run-----

[run]

-----HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce-----

[RunOnce]

-----HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx-----

[RunOnceEx]

-----HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices-----

[RunServices]

-----HKLM\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce-----

[RunServicesOnce]

-----HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce-----

[RunOnce]

-----HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnceEx-----

-----HKCU\Software\Microsoft\Windows\CurrentVersion\RunServices-----

[RunServices]

-----HKCU\Software\Microsoft\Windows NT\CurrentVersion\Run-----

-----HKCU\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce-----

[RunServicesOnce]

-----HKLM\Software\Microsoft\Command Processor\Autorun-----

-----HKCU\Software\Microsoft\Command Processor\Autorun-----

-----HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows\Load-----

-----HKLM\Software\Policies\Microsoft\Windows\System\Scripts\Startup-----

-----HKCU\Software\Policies\Microsoft\Windows\System\Scripts\Logon-----

-----HKLM\Software\Policies\Microsoft\Windows\System\Scripts\Logon-----

-----HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\TerminalServer\Install\Software\Microsoft\Windows\CurrentVersion\Runonce-----

-----HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\TerminalServer\Install\Software\Microsoft\Windows\CurrentVersion\Run-----

-----HKLM\System\CurrentControlSet\Control\Terminal Server\Wdsdpwd\StartupPrograms-----

-----HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\TerminalServer\Install\Software\Microsoft\Windows\CurrentVersion\Runonce-----

-----HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler-----

[SharedTaskScheduler]
  "{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Pré-chargeur Browseui"
    #### HKCR\CLSID\{438755C2-A8BA-11D1-B96B-00A0C90312E1}\InprocServer32 @=expand:"%SystemRoot%\system32\browseui.dll"
  "{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Démon de cache des catégories de composant"
    #### HKCR\CLSID\{8C7461EF-2B13-11d2-BE35-3078302C2030}\InprocServer32 @=expand:"%SystemRoot%\system32\browseui.dll"

-----HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects-----

[Browser Helper Objects]
  @=""

[Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
  @=""

[Browser Helper Objects\{53707962-6F74-2D53-2644-206D7942484F}]
    #### HKCR\CLSID\{53707962-6F74-2D53-2644-206D7942484F}\InprocServer32 @="C:\PROGRA~1\SPYBOT~1\SDHelper.dll"

[Browser Helper Objects\{7009fcd4-05be-44f4-9583-93fe419ab7b0}]
    #### HKCR\CLSID\{7009fcd4-05be-44f4-9583-93fe419ab7b0}\InprocServer32 @="C:\Program Files\Multi_Media_France	bMul0.dll"
  @=""

[Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
    #### HKCR\CLSID\{9030D464-4C02-4ABF-8ECC-5164760863C6}\InprocServer32 @="C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll"

-----HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks-----

[URLSearchHooks]
  "{CFBFAE00-17A6-11D0-99CB-00C04FD64497}"=""
    #### HKCR\CLSID\{CFBFAE00-17A6-11D0-99CB-00C04FD64497}\InprocServer32 @="C:\WINDOWS\system32\ieframe.dll"

-----HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig-----

-----HKCU\Control Panel\Desktop\-----

[Desktop]
  "SCRNSAVE.EXE"="C:\WINDOWS\system32\ssstars.scr"

[Desktop\WindowMetrics]

-----HKEY_CLASSES_ROOT\exefile\shell\open\command-----

[command]
  @="\"%1\" %*"

-----HKEY_CLASSES_ROOT\comfile\shell\open\command-----

[command]
  @="\"%1\" %*"

-----HKEY_CLASSES_ROOT\batfile\shell\open\command-----

[command]
  @="\"%1\" %*"

-----HKEY_CLASSES_ROOT\piffile\shell\open\command-----

[command]
  @="\"%1\" %*"

-----HKEY_CLASSES_ROOT\scrFile\shell\open\command-----

[command]
  @="\"%1\" %*"

-----HKEY_CLASSES_ROOT\htafile\shell\open\command-----

[Command]
  @="C:\WINDOWS\system32\mshta.exe \"%1\" %*"

-----HKEY_CLASSES_ROOT\logfile\shell\open\command-----

-----HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\URL-----

[URL]

[URL\DefaultPrefix]
  @="http://"

[URL\Prefixes]
  "ftp"="ftp://"
  "gopher"="gopher://"
  "home"="http://"
  "mosaic"="http://"
  "www"="http://"

-----HKLM\SYSTEM\CurrentControlSet\Control\Lsa-----

[Lsa]

[Lsa\AccessProviders]

[Lsa\AccessProviders\Windows NT Access Provider]
  "ProviderPath"=expand:"%SystemRoot%\system32
tmarta.dll"

[Lsa\Audit]

[Lsa\Audit\PerUserAuditing]

[Lsa\Audit\PerUserAuditing\System]

[Lsa\Data]

[Lsa\SSO]

[Lsa\SSO\Passport1.4]
  "SSOURL"="http://www.passport.com"

[Lsa\SspiCache]

[Lsa\SspiCache\digest.dll]
  "Name"="Digest"
  "Comment"="Digest SSPI Authentication Package"

[Lsa\SspiCache\msapsspc.dll]
  "Name"="DPA"
  "Comment"="DPA Security Package"

[Lsa\SspiCache\msnsspc.dll]
  "Name"="MSN"
  "Comment"="MSN Security Package"

-----HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess-----

[SharedAccess]
  "DependOnGroup"=multi:"\00"
  "DependOnService"=multi:"Netman\00WinMgmt\00\00"
  "Description"="Assure la traduction d'adresses de réseau, l'adressage, les services de résolution de noms et/ou les services de prévention d'intrusion pour un réseau de petite entreprise ou un réseau domestique."
  "DisplayName"="Pare-feu Windows / Partage de connexion Internet"
  "ErrorControl"=dword:00000001
  "ImagePath"=expand:"%SystemRoot%\system32\svchost.exe -k netsvcs"
  "ObjectName"="LocalSystem"
  "Start"=dword:00000002
  "Type"=dword:00000020

[SharedAccess\Epoch]
  "Epoch"=dword:00002473

[SharedAccess\Parameters]
  "ServiceDll"=expand:"%SystemRoot%\System32\ipnathlp.dll"

[SharedAccess\Parameters\FirewallPolicy]

[SharedAccess\Parameters\FirewallPolicy\DomainProfile]

[SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications]

[SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
  "%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enaxxxxx@xxxxxres.dll,-22019"
  "C:\Program Files\MSN Messenger\msnmsgr.exe"="C:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
  "C:\Program Files\MSN Messenger\livecall.exe"="C:\Program Files\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"
  "%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enaxxxxx@xxxxxres.dll,-20000"

[SharedAccess\Parameters\FirewallPolicy\StandardProfile]
  "EnableFirewall"=dword:00000001
  "DoNotAllowExceptions"=dword:00000000

[SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications]

[SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
  "%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enaxxxxx@xxxxxres.dll,-22019"
  "C:\Program Files\eMule\emule.exe"="C:\Program Files\eMule\emule.exe:*:Enabled:eMule"
  "C:\Program Files\MSN Messenger\msnmsgr.exe"="C:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
  "C:\Program Files\MSN Messenger\livecall.exe"="C:\Program Files\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"
  "C:\Program Files\Resolume 2.41esolume.exe"="C:\Program Files\Resolume 2.41esolume.exe:*:Enabled:Resolume 2.41"
  "C:\Program Files\Messenger\msmsgs.exe"="C:\Program Files\Messenger\msmsgs.exe:*:Enabled:Windows Messenger"
  "C:\Documents and Settings\Propriétaire\Local Settings\Temp\Rar$EX02.937\emule.exe"="C:\Documents and Settings\Propriétaire\Local Settings\Temp\Rar$EX02.937\emule.exe:*:Disabled:eMule"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\0exinjs.aa.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\0exinjs.aa.exe:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\22exinjs.aa.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\22exinjs.aa.exe:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\23exinjs.aa.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\23exinjs.aa.exe:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\83exinjs.aa.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\83exinjs.aa.exe:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\86exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\86exinjs.ab.exe:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\82exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\82exinjs.ab.exe:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\42exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\42exinjs.ab.exe:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\98exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\98exinjs.ab.exe:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\36exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\36exinjs.ab.exe:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\59exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\59exinjs.ab.exe:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\49exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\49exinjs.ab.exe:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\73exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\73exinjs.ab.exe:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\75exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\75exinjs.ab.exe:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\8exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\8exinjs.ab.exe:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\47exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\47exinjs.ab.exe:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\20exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\20exinjs.ab.exe:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\78exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\78exinjs.ab.exe:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\80exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\80exinjs.ab.exe:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\74exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\74exinjs.ab.exe:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\18exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\18exinjs.ab.exe:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\64exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\64exinjs.ab.exe:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\57exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\57exinjs.ab.exe:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\92exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\92exinjs.ab.exe:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\11exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\11exinjs.ab.exe:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\50exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\50exinjs.ab.exe:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\43exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\43exinjs.ab.exe:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\95exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\95exinjs.ab.exe:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\52exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\52exinjs.ab.exe:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\23exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\23exinjs.ab.exe:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\6exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\6exinjs.ab.exe:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\39exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\39exinjs.ab.exe:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\68exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\68exinjs.ab.exe:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\61exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\61exinjs.ab.exe:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\26exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\26exinjs.ab.exe:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\34exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\34exinjs.ab.exe:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\19exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\19exinjs.ab.exe:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\32exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\32exinjs.ab.exe:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\14exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\14exinjs.ab.exe:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\60exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\60exinjs.ab.exe:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\29exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\29exinjs.ab.exe:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\66exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\66exinjs.ab.exe:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\99exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\99exinjs.ab.exe:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\54exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\54exinjs.ab.exe:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\94exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\94exinjs.ab.exe:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\85exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\85exinjs.ab.exe:*:Enabled:Microsoft Update"
  "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe"="C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe:*:Disabled:Kaspersky Anti-Virus"
  "C:\Program Files\uTorrent\uTorrent.exe"="C:\Program Files\uTorrent\uTorrent.exe:*:Enabled:µTorrent"
  "C:\Program Files\BitDownload\BitDownload.exe"="C:\Program Files\BitDownload\BitDownload.exe:*:Enabled:Torrent P2P application"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\16ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\16ex:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\25ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\25ex:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\35ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\35ex:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\43ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\43ex:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\58ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\58ex:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\26ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\26ex:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\87ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\87ex:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\60ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\60ex:*:Enabled:Microsoft Update"
  "C:\Program Files\Ahead\Nero ShowTime\ShowTime.exe"="C:\Program Files\Ahead\Nero ShowTime\ShowTime.exe:*:Enabled:Nero ShowTime"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\44ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\44ex:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\50ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\50ex:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\7ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\7ex:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\42ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\42ex:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\3ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\3ex:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\21ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\21ex:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\40ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\40ex:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\2ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\2ex:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\4ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\4ex:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\65ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\65ex:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\37ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\37ex:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\31ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\31ex:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\72ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\72ex:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\92ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\92ex:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\68ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\68ex:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\45ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\45ex:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\96ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\96ex:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\33ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\33ex:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\79ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\79ex:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\10ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\10ex:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\22ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\22ex:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\55ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\55ex:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\66ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\66ex:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\94ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\94ex:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\52ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\52ex:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\0ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\0ex:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\63ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\63ex:*:Enabled:Microsoft Update"
  "C:\Documents and Settings\Propriétaire\Local Settings\Temp\10exmdnk23.exe"="C:\Documents and Settings\Propriétaire\Local Settings\Temp\10exmdnk23.exe:*:Disabled:10exmdnk23"
  "C:\Documents and Settings\Propriétaire\Local Settings\Temp\33exmdnk25.exe"="C:\Documents and Settings\Propriétaire\Local Settings\Temp\33exmdnk25.exe:*:Disabled:33exmdnk25"
  "C:\Documents and Settings\Propriétaire\Local Settings\Temp\0exmdnk26.exe"="C:\Documents and Settings\Propriétaire\Local Settings\Temp\0exmdnk26.exe:*:Disabled:0exmdnk26"
  "C:\Documents and Settings\Propriétaire\Local Settings\Temp\58exmdnk30.exe"="C:\Documents and Settings\Propriétaire\Local Settings\Temp\58exmdnk30.exe:*:Disabled:58exmdnk30"
  "C:\kav\kis7.0\french\setup.exe"="C:\kav\kis7.0\french\setup.exe:*:Enabled:Programme d'installation de Kaspersky Internet Security 7.0"
  "C:\kav\kav7.0\french\setup.exe"="C:\kav\kav7.0\french\setup.exe:*:Enabled:Programme d'installation de Kaspersky Anti-Virus 7.0"
  "%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enaxxxxx@xxxxxres.dll,-20000"

[SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts]

[SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
  "1900:UDP"="1900:UDP:LocalSubNet:Disaxxxxx@xxxxxres.dll,-22007"
  "2869:TCP"="2869:TCP:LocalSubNet:Disaxxxxx@xxxxxres.dll,-22008"
  "17053:TCP"="17053:TCP:*:Enabled:NortonAV"
  "12192:TCP"="12192:TCP:*:Enabled:NortonAV"

[SharedAccess\Setup]
  "ServiceUpgrade"=dword:00000001

[SharedAccess\Setup\InterfacesUnfirewalledAtUpdate]
  "All"=dword:00000001

-----HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Firewall\-----

-----HKEY_LOCAL_MACHINE\SOFTWARE\Winsock2-----

-----HKLM\Software\Microsoft\Ole-----

[Ole]
  "DefaultLaunchPermission"=hex:01,00,04,80,5c,00,00,00,6c,00,00,00,00,00,00,00,\
  "MachineLaunchRestriction"=hex:01,00,04,80,48,00,00,00,58,00,00,00,00,00,00,00,\
  "MachineAccessRestriction"=hex:01,00,04,80,44,00,00,00,54,00,00,00,00,00,00,00,\
  "EnableDCOM"="Y"

[Ole\AppCompat]

[Ole\AppCompat\ActivationSecurityCheckExemptionList]
  "{A50398B8-9075-4FBF-A7A1-456BF21937AD}"="1"
  "{AD65A69D-3831-40D7-9629-9B0B50A93843}"="1"
  "{0040D221-54A1-11D1-9DE0-006097042D69}"="1"
  "{2A6D72F1-6E7E-4702-B99C-E40D3DED33C3}"="1"

[Ole\NONREDIST]
  "System.EnterpriseServices.Thunk.dll"=""

-----HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WindowsUpdate\AU\-----

-----HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\-----

[Security Center]
  "FirstRunDisabled"=dword:00000001
  "AntiVirusDisableNotify"=dword:00000000
  "FirewallDisableNotify"=dword:00000000
  "UpdatesDisableNotify"=dword:00000000
  "AntiVirusOverride"=dword:00000001
  "FirewallOverride"=dword:00000000

[Security Center\Monitoring]

[Security Center\Monitoring\AhnlabAntiVirus]

[Security Center\Monitoring\ComputerAssociatesAntiVirus]

[Security Center\Monitoring\KasperskyAntiVirus]

[Security Center\Monitoring\McAfeeAntiVirus]

[Security Center\Monitoring\McAfeeFirewall]

[Security Center\Monitoring\PandaAntiVirus]

[Security Center\Monitoring\PandaFirewall]

[Security Center\Monitoring\SophosAntiVirus]

[Security Center\Monitoring\SymantecAntiVirus]

[Security Center\Monitoring\SymantecFirewall]

[Security Center\Monitoring\TinyFirewall]

[Security Center\Monitoring\TrendAntiVirus]

[Security Center\Monitoring\TrendFirewall]

[Security Center\Monitoring\ZoneLabsFirewall]

-----HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore\-----

[SystemRestore]
  "DisableSR"=dword:00000000
  "CreateFirstRunRp"=dword:00000001
  "DSMin"=dword:000000c8
  "DSMax"=dword:00000190
  "RPSessionInterval"=dword:00000000
  "RPGlobalInterval"=dword:00015180
  "RPLifeInterval"=dword:0076a700
  "CompressionBurst"=dword:0000003c
  "TimerInterval"=dword:00000078
  "DiskPercent"=dword:0000000c
  "ThawInterval"=dword:00000384
  "RestoreDiskSpaceError"=dword:00000000
  "RestoreStatus"=dword:00000000
  "RestoreSafeModeStatus"=dword:00000001

[SystemRestore\Cfg]
  "DiskPercent"=dword:0000000c
  "MachineGuid"="{D88DDE61-D342-465C-AFF5-295FBD9AB56F}"

[SystemRestore\SnapshotCallbacks]
  @=""

-----HKEY_CURRENT_USER\Software\VB and VBA Program Settings-----

[VB and VBA Program Settings]

[VB and VBA Program Settings\CCleaner]

[VB and VBA Program Settings\CCleaner\Options]

-----HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\-----

-----HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\AdvancedOptions-----

[AdvancedOptions]

-----HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\AdvancedOptions-----

-----HKLM\Software\Microsoft\Active Setup\Installed Components-----

[Installed Components]

[Installed Components\<{12d0ed0d-0ee0-4f90-8827-78cefb8f4988}]
  "@="IE7 Uninstall Stub"
  "ComponentID"="IEUDINIT"
  "StubPath"="C:\WINDOWS\system32\ieudinit.exe"

[Installed Components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}]
    #### HKCR\CLSID\{22d6f312-b0f6-11d0-94ab-0080c74c7e95}\InprocServer32 @="C:\WINDOWS\system32\wmpdxm.dll"
  "Stubpath"="C:\WINDOWS\inf\unregmp2.exe /ShowWMP"
  "@="Microsoft Windows Media Player"
  "ComponentID"="WMPACCESS"

[Installed Components\>{26923b43-4d38-484f-9b9e-de460746276c}]
  "@="Internet Explorer"
  "ComponentID"="IEACCESS"
  "StubPath"="C:\WINDOWS\system32\ie4uinit.exe -UserIconConfig"

[Installed Components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
  "@="Browser Customizations"
  "ComponentiD"="BRANDING.CAB"
  "StubPath"="RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP"

[Installed Components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS]
  "@="Personnalisation du navigateur"
  "ComponentID"="BRANDING.CAB"
  "StubPath"="RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP"

[Installed Components\>{881dd1c5-3dcf-431b-b061-f3f88e8be88a}]
  "@="Outlook Express"
  "ComponentID"="OEACCESS"
  "StubPath"=expand:"%systemroot%\system32\shmgrate.exe OCInstallUserConfigOE"

[Installed Components\{0E92DD42-76F5-4EF2-B381-F9C1D72BE23D}]
  "@="Security Update for Microsoft .NET Framework 2.0 (KB922770)"
  "ComponentID"="KB922770"

[Installed Components\{10072CEC-8CC1-11D1-986E-00A0C955B42F}]
  "@="Rendu VML (Vector Graphics Rendering)"
  "ComponentID"="MSVML"

[Installed Components\{2179C5D3-EBFF-11CF-B6FD-00AA00B4E220}]
    #### HKCR\CLSID\{2179C5D3-EBFF-11CF-B6FD-00AA00B4E220}\InprocServer32 @="C:\WINDOWS\system32\wmpdxm.dll"
  "ComponentID"="NetShow"
  "StubPath"=""

[Installed Components\{22d6f312-b0f6-11d0-94ab-0080c74c7e95}]
    #### HKCR\CLSID\{22d6f312-b0f6-11d0-94ab-0080c74c7e95}\InprocServer32 @="C:\WINDOWS\system32\wmpdxm.dll"
  "ComponentID"="Microsoft Windows Media Player"
  "StubPath"=""
  "@="Lecteur Windows Media Microsoft 6.4"

[Installed Components\{283807B5-2C60-11D0-A31D-00AA00B92C03}]
  "@="DirectAnimation"
  "ComponentID"="DirectAnimation"

[Installed Components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}]
  "@="Themes Setup"
  "ComponentID"="Theme Component"
  "StubPath"=expand:"%SystemRoot%\system32egsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32	hemeui.dll"

[Installed Components\{36f8ec70-c29a-11d1-b5c7-0000f8051515}]
  "@="Liaison de données Dynami

Sophie · Answer

SystemScan - www.suspectfile.com - ver. 3.5.5 (code: holifay & bReAkdOWn)

Running on: Windows XP HOME Edition, Service Pack 2 (2600.5.1)
System directory: C:\WINDOWS
SystemScan file: C:\Documents and Settings\Propriétaire\Local Settings\Temporary Internet Files\Content.IE5\HLWUXMAW\sys78712[1].exe
Running in: User mode
Date: 06/11/2008
Time: 17:29:43
  
Output limited to: 
 -Recent files
 -Registry Run Keys
 -Suspicious Files

===================== RECENT FILES =====================

Showing files newer than  30 days

----- recent files in C:\
04/11/2008 18:14:33 (DIR)        0 byte      2 days old -- Deckard
06/11/2008 16:34:07      2145386496 byte      0 days old -- pagefile.sys
06/11/2008 16:54:38 (DIR)        0 byte      0 days old -- Program Files
06/11/2008 16:56:08 (DIR)        0 byte      0 days old -- Config.Msi
06/11/2008 17:05:02           1264 byte      0 days old -- TCleaner.txt
06/11/2008 17:07:23 (DIR)        0 byte      0 days old -- System Volume Information
06/11/2008 17:09:19 (DIR)        0 byte      0 days old -- ComboFix
06/11/2008 17:17:41           3660 byte      0 days old -- Bug.txt
06/11/2008 17:17:42 (DIR)        0 byte      0 days old -- Combo-Fix
06/11/2008 17:17:47 (DIR)        0 byte      0 days old -- WINDOWS

----- recent files in C:\WINDOWS\
04/11/2008 12:27:54 (DIR)        0 byte      2 days old -- Minidump
04/11/2008 12:47:51 (DIR)        0 byte      2 days old -- Tasks
04/11/2008 12:51:02              0 byte      2 days old -- setuperr.log
04/11/2008 12:53:08           9170 byte      2 days old -- KB943055Uninst.log
04/11/2008 18:14:42 (DIR)        0 byte      2 days old -- ERDNT
04/11/2008 20:49:01 (DIR)        0 byte      2 days old -- Debug
04/11/2008 20:49:46 (DIR)        0 byte      2 days old -- $NtUninstallKB943055$
04/11/2008 20:49:49          11413 byte      2 days old -- KB943055.log
04/11/2008 20:49:52 (DIR)        0 byte      2 days old -- $NtUninstallKB950749$
04/11/2008 20:49:56          14173 byte      2 days old -- KB950749.log
04/11/2008 20:49:58 (DIR)        0 byte      2 days old -- $NtUninstallKB945553$
04/11/2008 20:49:59          12373 byte      2 days old -- KB945553.log
04/11/2008 20:50:02 (DIR)        0 byte      2 days old -- $NtUninstallKB944338$
04/11/2008 20:50:03          13476 byte      2 days old -- KB944338.log
04/11/2008 20:50:05 (DIR)        0 byte      2 days old -- $NtUninstallKB948590$
04/11/2008 20:50:06          12774 byte      2 days old -- KB948590.log
04/11/2008 20:50:07 (DIR)        0 byte      2 days old -- $NtUninstallKB941693$
04/11/2008 20:50:09          12974 byte      2 days old -- KB941693.log
04/11/2008 20:50:13 (DIR)        0 byte      2 days old -- $NtUninstallKB947864$
04/11/2008 20:50:19          20085 byte      2 days old -- KB947864.log
04/11/2008 20:50:20 (DIR)        0 byte      2 days old -- $NtUninstallKB948881$
04/11/2008 20:50:22          11204 byte      2 days old -- KB948881.log
05/11/2008 12:58:01 (DIR)        0 byte      1 days old -- $NtUninstallKB904942$
05/11/2008 12:58:04          11030 byte      1 days old -- KB904942.log
05/11/2008 12:58:06 (DIR)        0 byte      1 days old -- $NtUninstallKB914440$
05/11/2008 12:58:07 (DIR)        0 byte      1 days old -- network diagnostic
05/11/2008 12:58:08           5198 byte      1 days old -- KB914440.log
05/11/2008 12:58:53 (DIR)        0 byte      1 days old -- $NtUninstallKB915865$
05/11/2008 12:58:57           6278 byte      1 days old -- KB915865.log
05/11/2008 12:59:06 (DIR)        0 byte      1 days old -- $NtServicePackUninstallNLSDownlevelMapping$
05/11/2008 12:59:09           7177 byte      1 days old -- NLSDownlevelMapping.log
05/11/2008 12:59:16 (DIR)        0 byte      1 days old -- $NtServicePackUninstallIDNMitigationAPIs$
05/11/2008 12:59:20           7485 byte      1 days old -- IDNMitigationAPIs.log
05/11/2008 13:00:09 (DIR)        0 byte      1 days old -- ie7
05/11/2008 13:00:17 (DIR)        0 byte      1 days old -- Media
05/11/2008 13:00:21 (DIR)        0 byte      1 days old -- WBEM
05/11/2008 13:00:27          57821 byte      1 days old -- ie7.log
05/11/2008 13:00:49 (DIR)        0 byte      1 days old -- ie7updates
05/11/2008 13:01:00          72190 byte      1 days old -- KB944533-IE7.log
05/11/2008 13:01:11          45658 byte      1 days old -- updspapi.log
05/11/2008 13:01:15          50000 byte      1 days old -- KB947864-IE7.log
05/11/2008 13:01:36          35377 byte      1 days old -- ie7_main.log
05/11/2008 13:02:42 (DIR)        0 byte      1 days old -- Help
05/11/2008 13:03:16           6286 byte      1 days old -- spupdsvc.log
05/11/2008 13:33:23             60 byte      1 days old -- setupact.log
05/11/2008 18:18:13         117714 byte      1 days old -- ntbtlog.txt
06/11/2008 09:00:51 (DIR)        0 byte      0 days old -- $hf_mig$
06/11/2008 09:17:30 (DIR)        0 byte      0 days old -- system
06/11/2008 10:18:12 (DIR)        0 byte      0 days old -- $NtUninstallKB932823-v3$
06/11/2008 10:18:18          10097 byte      0 days old -- KB932823-v3.log
06/11/2008 10:18:19           1374 byte      0 days old -- imsins.BAK
06/11/2008 10:18:25          75274 byte      0 days old -- ocgen.log
06/11/2008 10:18:25          56446 byte      0 days old -- tsoc.log
06/11/2008 10:18:25          48869 byte      0 days old -- setupapi.log
06/11/2008 10:18:25           8054 byte      0 days old -- ocmsn.log
06/11/2008 10:18:25           1374 byte      0 days old -- imsins.log
06/11/2008 10:18:25 (DIR)        0 byte      0 days old -- inf
06/11/2008 10:18:25          21821 byte      0 days old -- iis6.log
06/11/2008 10:18:25          48411 byte      0 days old -- comsetup.log
06/11/2008 10:18:25         139927 byte      0 days old -- FaxSetup.log
06/11/2008 10:18:25           7402 byte      0 days old -- msgsocm.log
06/11/2008 10:18:25          10950 byte      0 days old -- KB938127-IE7.log
06/11/2008 10:18:25          31031 byte      0 days old -- ntdtcsetup.log
06/11/2008 15:53:02 (DIR)        0 byte      0 days old -- Prefetch
06/11/2008 16:33:10          23478 byte      0 days old -- SchedLgU.Txt
06/11/2008 16:34:11           2048 byte      0 days old -- bootstat.dat
06/11/2008 16:34:12              0 byte      0 days old -- 0.log
06/11/2008 16:34:23             50 byte      0 days old -- wiaservc.log
06/11/2008 16:34:26            159 byte      0 days old -- wiadebug.log
06/11/2008 16:35:13         696959 byte      0 days old -- WindowsUpdate.log
06/11/2008 16:56:08 (DIR)        0 byte      0 days old -- WinSxS
06/11/2008 16:56:15 (DIR)        0 byte      0 days old -- Installer
06/11/2008 17:02:30 (DIR)        0 byte      0 days old -- Temp
06/11/2008 17:17:41 (DIR)        0 byte      0 days old -- system32

----- recent files in C:\WINDOWS\Downloaded Program Files\

----- recent files in C:\WINDOWS\system\

----- recent files in C:\WINDOWS\system32\
04/11/2008 12:11:54          13702 byte      2 days old -- wpa.dbl
04/11/2008 12:14:58        1070888 byte      2 days old -- PerfStringBackup.INI
04/11/2008 12:15:00          83620 byte      2 days old -- perfc00C.dat
04/11/2008 12:15:00          70106 byte      2 days old -- perfc009.dat
04/11/2008 12:15:00         485868 byte      2 days old -- perfh00C.dat
04/11/2008 12:15:00         418590 byte      2 days old -- perfh009.dat
05/11/2008 10:53:41          91888 byte      1 days old -- FNTCACHE.DAT
05/11/2008 13:00:55 (DIR)        0 byte      1 days old -- fr-fr
06/11/2008 10:18:24 (DIR)        0 byte      0 days old -- dllcache
06/11/2008 15:04:53 (DIR)        0 byte      0 days old -- CatRoot2
06/11/2008 16:20:13           3121 byte      0 days old -- CONFIG.NT
06/11/2008 16:28:07 (DIR)        0 byte      0 days old -- drivers
06/11/2008 17:07:23 (DIR)        0 byte      0 days old -- Restore

----- recent files in C:\WINDOWS\system32\drivers\

----- recent files in C:\WINDOWS	emp\
06/11/2008 16:17:38         965569 byte      0 days old -- fa56d7ec.$$$
06/11/2008 16:34:16          16384 byte      0 days old -- Perflib_Perfdata_658.dat
06/11/2008 17:03:51 (DIR)        0 byte      0 days old -- _avast4_

----- recent files in C:\Program Files\
04/11/2008 12:44:13 (DIR)        0 byte      2 days old -- ATI Technologies
04/11/2008 12:55:53 (DIR)        0 byte      2 days old -- Windows Live Toolbar
05/11/2008 16:09:17 (DIR)        0 byte      1 days old -- eMule
05/11/2008 16:17:51 (DIR)        0 byte      1 days old -- Internet Explorer
05/11/2008 20:34:33 (DIR)        0 byte      1 days old -- Messenger
05/11/2008 20:34:33 (DIR)        0 byte      1 days old -- M-Audio Firewire Audiophile
05/11/2008 20:34:33 (DIR)        0 byte      1 days old -- DivX
05/11/2008 20:36:52 (DIR)        0 byte      1 days old -- MySpace
06/11/2008 15:02:36 (DIR)        0 byte      0 days old -- PKR
06/11/2008 16:55:02 (DIR)        0 byte      0 days old -- Fichiers communs
06/11/2008 16:56:30 (DIR)        0 byte      0 days old -- SPYWAREfighter
06/11/2008 17:04:44 (DIR)        0 byte      0 days old -- Trend Micro

----- recent files in C:\Program Files\Fichiers communs\
06/11/2008 16:55:02 (DIR)        0 byte      0 days old -- Application

----- recent files in C:\Documents and Settings\Propriétaire\Application Data\
04/11/2008 13:48:47 (DIR)        0 byte      2 days old -- Malwarebytes
05/11/2008 13:09:44 (DIR)        0 byte      1 days old -- SUPERAntiSpyware.com

----- recent files in C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\
04/11/2008 18:20:11          16384 byte      2 days old -- ~DF3333.tmp
04/11/2008 18:46:09         239104 byte      2 days old -- 71exhmunmlclr14.exe
04/11/2008 18:46:09         239104 byte      2 days old -- 75exhmunmlclr14.exe
04/11/2008 18:46:09         239104 byte      2 days old -- 88exhmunmlclr14.exe
04/11/2008 18:46:09         239104 byte      2 days old -- 24exhmunmlclr14.exe
04/11/2008 19:05:45          16384 byte      2 days old -- ~DF8B63.tmp
04/11/2008 19:14:04          32768 byte      2 days old -- ~DF3D4F.tmp
04/11/2008 20:48:26          16384 byte      2 days old -- ~DF6387.tmp
05/11/2008 11:05:41          22704 byte      1 days old -- Danish.bin
05/11/2008 11:05:41          25670 byte      1 days old -- Dutch.bin
05/11/2008 11:05:41          16913 byte      1 days old -- TradChin.bin
05/11/2008 11:05:41          24256 byte      1 days old -- Japanese.bin
05/11/2008 11:05:41          20101 byte      1 days old -- Korean.bin
05/11/2008 11:05:42          27178 byte      1 days old -- French.bin
05/11/2008 11:05:43          24028 byte      1 days old -- SWEDISH.bin
05/11/2008 11:05:43          25684 byte      1 days old -- German.bin
05/11/2008 11:05:43          26062 byte      1 days old -- Russian.bin
05/11/2008 11:05:43          27689 byte      1 days old -- Spanish.bin
05/11/2008 11:05:43          27330 byte      1 days old -- Italian.bin
05/11/2008 11:05:44          26187 byte      1 days old -- Portuguese.bin
05/11/2008 11:05:44          21913 byte      1 days old -- Thai.bin
05/11/2008 11:05:44          20919 byte      1 days old -- Arabic.bin
05/11/2008 11:05:44          21857 byte      1 days old -- English.bin
05/11/2008 11:05:44          16374 byte      1 days old -- SimChin.bin
05/11/2008 11:05:45          24999 byte      1 days old -- Portuguese(Brazil).bin
05/11/2008 11:05:45          24147 byte      1 days old -- Polish.bin
05/11/2008 11:05:45          25003 byte      1 days old -- Greek.bin
05/11/2008 11:05:45          24252 byte      1 days old -- Czech.bin
05/11/2008 11:05:46          22793 byte      1 days old -- Finnish.bin
05/11/2008 11:05:47          19487 byte      1 days old -- Hebrew.bin
05/11/2008 11:05:47          26001 byte      1 days old -- Hungarian.bin
05/11/2008 11:05:48          21901 byte      1 days old -- Norwegian.bin
05/11/2008 11:05:48          22194 byte      1 days old -- Turkish.bin
05/11/2008 11:27:14          32768 byte      1 days old -- ~DF6515.tmp
05/11/2008 11:31:17          16384 byte      1 days old -- ~DF9D46.tmp
05/11/2008 11:31:34          16384 byte      1 days old -- ~DF7191.tmp
05/11/2008 11:31:58          16384 byte      1 days old -- ~DF1672.tmp
05/11/2008 11:32:48          16384 byte      1 days old -- ~DFD13B.tmp
05/11/2008 11:33:22          16384 byte      1 days old -- ~DFA2FD.tmp
05/11/2008 11:42:31          32768 byte      1 days old -- ~DF638.tmp
05/11/2008 11:44:33          32768 byte      1 days old -- ~DF34FC.tmp
05/11/2008 11:49:16          16384 byte      1 days old -- ~DF23B5.tmp
05/11/2008 11:49:16          16384 byte      1 days old -- ~DF2494.tmp
05/11/2008 11:50:14          16384 byte      1 days old -- ~DF23C4.tmp
05/11/2008 11:53:30          16384 byte      1 days old -- ~DF45C4.tmp
05/11/2008 11:54:23          32768 byte      1 days old -- ~DF7AF.tmp
05/11/2008 11:57:13          16384 byte      1 days old -- ~DF214A.tmp
05/11/2008 11:57:40          32768 byte      1 days old -- ~DFD70B.tmp
05/11/2008 12:06:58          16384 byte      1 days old -- ~DFA66A.tmp
05/11/2008 12:09:48          32768 byte      1 days old -- ~DFB01E.tmp
05/11/2008 12:20:27          16384 byte      1 days old -- ~DF1DB1.tmp
05/11/2008 12:20:50          16384 byte      1 days old -- ~DFBA1E.tmp
05/11/2008 12:22:24          32768 byte      1 days old -- ~DF3E3D.tmp
05/11/2008 12:25:54          16384 byte      1 days old -- ~DF5412.tmp
05/11/2008 12:26:21          32768 byte      1 days old -- ~DF150A.tmp
05/11/2008 12:28:38          32768 byte      1 days old -- ~DF60E8.tmp
05/11/2008 12:30:18          32768 byte      1 days old -- ~DF6AD1.tmp
05/11/2008 12:34:10          16384 byte      1 days old -- ~DFEBB.tmp
05/11/2008 12:50:14          32768 byte      1 days old -- ~DF8F7A.tmp
05/11/2008 12:51:34          16384 byte      1 days old -- ~DFFCE4.tmp
05/11/2008 13:03:17             54 byte      1 days old -- hmunmlclr14.exe.conf
05/11/2008 13:06:05          16384 byte      1 days old -- ~DF3079.tmp
05/11/2008 13:07:32          16384 byte      1 days old -- ~DF4070.tmp
05/11/2008 13:09:58          16384 byte      1 days old -- ~DF8638.tmp
05/11/2008 13:11:45          16384 byte      1 days old -- ~DF1BF6.tmp
05/11/2008 13:11:46              0 byte      1 days old -- 88313.dmp
05/11/2008 13:12:32          16384 byte      1 days old -- ~DF9948.tmp
05/11/2008 13:12:49          16384 byte      1 days old -- ~DF430A.tmp
05/11/2008 13:14:44          16384 byte      1 days old -- ~DF8882.tmp
05/11/2008 13:30:14          16316 byte      1 days old -- 6394_appcompat.txt
05/11/2008 13:30:20          75860 byte      1 days old -- 196E60.dmp
05/11/2008 13:30:50 (DIR)        0 byte      1 days old -- WERea67.dir00
05/11/2008 13:30:50 (DIR)        0 byte      1 days old -- WERe1a5.dir00
05/11/2008 13:32:24          16384 byte      1 days old -- ~DF7932.tmp
05/11/2008 13:33:08 (DIR)        0 byte      1 days old -- WERf61a.dir00
05/11/2008 13:39:59          16384 byte      1 days old -- ~DFD7EB.tmp
05/11/2008 13:40:18 (DIR)        0 byte      1 days old -- WER8f52.dir00
05/11/2008 13:40:20 (DIR)        0 byte      1 days old -- WER918b.dir00
05/11/2008 13:43:22          16384 byte      1 days old -- ~DFDB6A.tmp
05/11/2008 13:43:50          32298 byte      1 days old -- de41_appcompat.txt
05/11/2008 13:44:49 (DIR)        0 byte      1 days old -- ~nsu.tmp
05/11/2008 13:53:45          16384 byte      1 days old -- ~DFEEDF.tmp
05/11/2008 13:53:56          16384 byte      1 days old -- Perflib_Perfdata_808.dat
05/11/2008 13:54:45 (DIR)        0 byte      1 days old -- WER3a07.dir00
05/11/2008 13:56:10          16384 byte      1 days old -- ~DF5FA5.tmp
05/11/2008 13:57:24          16384 byte      1 days old -- ~DF536A.tmp
05/11/2008 13:57:59          16384 byte      1 days old -- ~DF4193.tmp
05/11/2008 13:59:31          16384 byte      1 days old -- ~DF7F9F.tmp
05/11/2008 14:01:28          16384 byte      1 days old -- ~DF89.tmp
05/11/2008 14:02:16          16384 byte      1 days old -- ~DF34F.tmp
05/11/2008 15:08:31         239104 byte      1 days old -- 60exhmunmlclr15.exe
05/11/2008 15:08:31         239104 byte      1 days old -- 46exhmunmlclr15.exe
05/11/2008 15:08:31         239104 byte      1 days old -- 79exhmunmlclr15.exe
05/11/2008 15:47:47          16384 byte      1 days old -- ~DF2136.tmp
05/11/2008 15:48:43          16316 byte      1 days old -- efda_appcompat.txt
05/11/2008 15:48:48          79711 byte      1 days old -- 2FB0F.dmp
05/11/2008 15:48:53          16384 byte      1 days old -- ~DF9F2B.tmp
05/11/2008 15:51:44          10144 byte      1 days old -- MPC5.tmp
05/11/2008 15:54:52          16384 byte      1 days old -- ~DFC6BC.tmp
05/11/2008 16:09:05             54 byte      1 days old -- hmunmlclr15.exe.conf
05/11/2008 16:13:12          16384 byte      1 days old -- ~DF6329.tmp
05/11/2008 16:18:17          16384 byte      1 days old -- ~DFBFC8.tmp
05/11/2008 16:18:33          16384 byte      1 days old -- ~DF7EC1.tmp
05/11/2008 16:19:06          16384 byte      1 days old -- ~DF16CD.tmp
05/11/2008 16:21:01          32768 byte      1 days old -- ~DF18AE.tmp
05/11/2008 16:31:24 (DIR)        0 byte      1 days old -- {E09B48B5-E141-427A-AB0C-D3605127224A}
05/11/2008 16:35:48          16384 byte      1 days old -- ~DFE243.tmp
05/11/2008 16:39:53          16384 byte      1 days old -- ~DF9898.tmp
05/11/2008 16:40:07          16384 byte      1 days old -- ~DF4EDB.tmp
05/11/2008 16:41:25          16384 byte      1 days old -- ~DF5CB1.tmp
05/11/2008 18:58:45          32768 byte      1 days old -- ~DF84C.tmp
05/11/2008 20:54:31          16384 byte      1 days old -- ~DF1F42.tmp
05/11/2008 20:54:57          16384 byte      1 days old -- ~DF7E1A.tmp
06/11/2008 09:10:34          16384 byte      0 days old -- ~DFF265.tmp
06/11/2008 09:11:12          16384 byte      0 days old -- ~DFC471.tmp
06/11/2008 09:13:00          32768 byte      0 days old -- ~DFCC98.tmp
06/11/2008 09:20:46          32768 byte      0 days old -- ~DFF5DB.tmp
06/11/2008 09:29:12          32768 byte      0 days old -- ~DF2C5F.tmp
06/11/2008 09:35:02          32768 byte      0 days old -- ~DF9840.tmp
06/11/2008 10:00:04          32768 byte      0 days old -- ~DF4304.tmp
06/11/2008 10:08:16          16384 byte      0 days old -- ~DFA144.tmp
06/11/2008 14:52:12          16384 byte      0 days old -- ~DF60BA.tmp
06/11/2008 14:54:17          32768 byte      0 days old -- ~DFACD8.tmp
06/11/2008 15:02:40          16384 byte      0 days old -- ~DF3CC3.tmp
06/11/2008 15:09:50          16384 byte      0 days old -- ~DFF540.tmp
06/11/2008 15:10:17          32768 byte      0 days old -- ~DFC9B4.tmp
06/11/2008 15:12:34          16384 byte      0 days old -- ~DF490C.tmp
06/11/2008 15:13:29          32768 byte      0 days old -- ~DFC226.tmp
06/11/2008 15:29:11           9450 byte      0 days old -- caevents.log
06/11/2008 15:35:01          16384 byte      0 days old -- ~DF41F7.tmp
06/11/2008 15:39:08          16384 byte      0 days old -- ~DFAA9.tmp
06/11/2008 15:40:37          16384 byte      0 days old -- ~DF7B1F.tmp
06/11/2008 15:41:13         311296 byte      0 days old -- ~DF1CE7.tmp
06/11/2008 15:43:01          32768 byte      0 days old -- ~DF4734.tmp
06/11/2008 15:58:44          16384 byte      0 days old -- ~DF3D3C.tmp
06/11/2008 15:59:27          16384 byte      0 days old -- ~DF98B.tmp
06/11/2008 16:00:06          32768 byte      0 days old -- ~DF172F.tmp
06/11/2008 16:10:56          16384 byte      0 days old -- ~DFD933.tmp
06/11/2008 16:11:18          16384 byte      0 days old -- ~DF9687.tmp
06/11/2008 16:12:14 (DIR)        0 byte      0 days old -- AVSETUP_4913094e
06/11/2008 16:13:05          32768 byte      0 days old -- ~DFE54A.tmp
06/11/2008 16:15:30          16384 byte      0 days old -- ~DF9A12.tmp
06/11/2008 16:15:43          32768 byte      0 days old -- ~DFEFB6.tmp
06/11/2008 16:20:14 (DIR)        0 byte      0 days old -- _avast4_
06/11/2008 16:24:21          16384 byte      0 days old -- ~DFE2D5.tmp
06/11/2008 16:25:23          16384 byte      0 days old -- ~DF5EFD.tmp
06/11/2008 16:26:07          16384 byte      0 days old -- ~DFF440.tmp
06/11/2008 16:29:07          16384 byte      0 days old -- ~DFED0F.tmp
06/11/2008 16:31:14          16384 byte      0 days old -- ~DF3471.tmp
06/11/2008 16:31:50          16384 byte      0 days old -- ~DFD017.tmp
06/11/2008 16:34:47          16384 byte      0 days old -- Perflib_Perfdata_a00.dat
06/11/2008 16:34:51          16384 byte      0 days old -- Perflib_Perfdata_dac.dat
06/11/2008 16:34:51          16384 byte      0 days old -- Perflib_Perfdata_da4.dat
06/11/2008 16:54:17              0 byte      0 days old -- is6.tmp
06/11/2008 16:54:36              0 byte      0 days old -- isA.tmp
06/11/2008 16:58:05          49152 byte      0 days old -- ~DF4FF4.tmp
06/11/2008 17:05:33          32768 byte      0 days old -- ~DF1D19.tmp
06/11/2008 17:09:48          32768 byte      0 days old -- ~DF2612.tmp
06/11/2008 17:14:09          32768 byte      0 days old -- ~DF1B2A.tmp
06/11/2008 17:24:18          32768 byte      0 days old -- ~DF3066.tmp
06/11/2008 17:26:00          32768 byte      0 days old -- ~DF659E.tmp
06/11/2008 17:27:27          32768 byte      0 days old -- ~DFCA23.tmp
06/11/2008 17:28:37          16384 byte      0 days old -- ~DFFE93.tmp
06/11/2008 17:28:37            115 byte      0 days old -- systemscan.ini
06/11/2008 17:28:37 (DIR)        0 byte      0 days old -- nsl3D.tmp

===================== REGISTRY SCAN =====================


-----HKLM\Software\Microsoft\Windows\CurrentVersion\Run-----

[Run]
  "ATICCC"="\"C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe\""
  "NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe"
  "MAFWTaskbarApp"="C:\WINDOWS\system32\MAFWTray.exe"
  "RTHDCPL"="RTHDCPL.EXE"
  "SkyTel"="SkyTel.EXE"
  "Alcmtr"="ALCMTR.EXE"
  "PKR Pal"="\"C:\Program Files\PKR\pkrpal.exe\" -osboot"
  "H2O"="C:\Program Files\SyncroSoft\Pos\H2O\cledx.exe"
  "devenv"="C:\WINDOWS\system\smvss.exe /w"
  "FLMOFFICE4DMOUSE"="C:\Program Files\Trust\DS-4500X Wireless Laser Deskset\Mouse\mouse32a.exe"
  "OFFICEKB"="C:\Program Files\Trust\DS-4500X Wireless Laser Deskset\Keyboard\kbdap32a.EXE"
  "avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe"
  "spywarefighterguard"="C:\Program Files\SPYWAREfighter\spftray.exe"
  @=""

[Run\avp6_post_uninstall]

[Run\OptionalComponents]
  @=""

[Run\OptionalComponents\IMAIL]
  "Installed"="1"
  @=""

[Run\OptionalComponents\MAPI]
  "NoChange"="1"
  "Installed"="1"
  @=""

[Run\OptionalComponents\MSFS]
  "Installed"="1"
  @=""

-----HKCU\Software\Microsoft\Windows\CurrentVersion\Run-----

[Run]
  "MsnMsgr"="\"C:\Program Files\MSN Messenger\MsnMsgr.Exe\" /background"
  "MySpaceIM"="C:\Program Files\MySpace\IM\MySpaceIM.exe"
  "SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe"
  "SUPERAntiSpyware"="C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe"
  "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe"

-----HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Run-----

[Run]
  "MySpaceIM"="C:\Program Files\MySpace\IM\MySpaceIM.exe"

-----HKLM\Software\Microsoft\Windows\CurrentVersion\policies\Explorer\Run-----

[Run]

-----HKCU\Software\Microsoft\Windows\CurrentVersion\policies\Explorer\Run-----

[Run]

-----HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows-----

[Windows]
  "AppInit_DLLs"=""

-----HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad-----

[ShellServiceObjectDelayLoad]
  "PostBootReminder"="{7849596a-48ea-486e-8937-a2a3009f31a9}"
    #### HKCR\CLSID\{7849596a-48ea-486e-8937-a2a3009f31a9}\InprocServer32 @=expand:"%SystemRoot%\system32\SHELL32.dll"
  "CDBurn"="{fbeb8a05-beee-4442-804e-409d6c4515e9}"
    #### HKCR\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InprocServer32 @=expand:"%SystemRoot%\system32\SHELL32.dll"
  "WebCheck"="{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"
    #### HKCR\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\InprocServer32 @=expand:"C:\WINDOWS\system32\webcheck.dll"
  "SysTray"="{35CEC8A3-2BE6-11D2-8773-92E220524153}"
    #### HKCR\CLSID\{35CEC8A3-2BE6-11D2-8773-92E220524153}\InprocServer32 @="C:\WINDOWS\system32\stobject.dll"

-----HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks-----

[ShellExecuteHooks]
  "{AEB6717E-7E19-11d0-97EE-00C04FD91972}"=""
    #### HKCR\CLSID\{AEB6717E-7E19-11d0-97EE-00C04FD91972}\InprocServer32 @="shell32.dll"

-----HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon-----

[Winlogon]
  "Shell"="Explorer.exe"
  "System"=""
  "Userinit"="C:\WINDOWS\system32\userinit.exe,"
  "VmApplet"="rundll32 shell32,Control_RunDLL \"sysdm.cpl\""
  "UIHost"=expand:"logonui.exe"
  "LogonType"=dword:00000001
  "WinStationsDisabled"="0"

[Winlogon\GPExtensions]

[Winlogon\GPExtensions\{3610eda5-77ef-11d2-8dc5-00c04fa31a66}]
  "@="Quota du disque Microsoft"
  "DllName"=expand:"dskquota.dll"

[Winlogon\GPExtensions\{4CFB60C1-FAA6-47f1-89AA-0B18730C9FD3}]
  "@="Internet Explorer Zonemapping"
  "DllName"=expand:"iedkcs32.dll"

[Winlogon\GPExtensions\{827D319E-6EAC-11D2-A4EA-00C04F79F83A}]
  "DllName"=expand:"scecli.dll"
  "@="Security"

[Winlogon\GPExtensions\{A2E30F80-D7DE-11d2-BBDE-00C04F86AE3B}]
  "DllName"="iedkcs32.dll"
  "@="Internet Explorer Branding"

[Winlogon\GPExtensions\{B1BE8D72-6EAC-11D2-A4EA-00C04F79F83A}]
  "DllName"=expand:"scecli.dll"
  "@="EFS recovery"

[Winlogon\GPExtensions\{C631DF4C-088F-4156-B058-4375F0853CD8}]
  "@="Microsoft Offline Files"
  "DllName"=expand:"%SystemRoot%\System32\cscui.dll"

[Winlogon\GPExtensions\{c6dc5466-785a-11d2-84d0-00c04fb169f7}]
  "@="Installation de logiciel"
  "DllName"=expand:"appmgmts.dll"

[Winlogon\Notify]

[Winlogon\Notify\!SASWinLogon]

[Winlogon\Notify\AtiExtEvent]
  "DLLName"="Ati2evxx.dll"

[Winlogon\Notify\crypt32chain]
  "DllName"=expand:"crypt32.dll"

[Winlogon\Notify\cryptnet]
  "DllName"=expand:"cryptnet.dll"

[Winlogon\Notify\cscdll]
  "DLLName"="cscdll.dll"

[Winlogon\Notify\ScCertProp]
  "DLLName"="wlnotify.dll"

[Winlogon\Notify\Schedule]
  "DllName"=expand:"wlnotify.dll"

[Winlogon\Notify\sclgntfy]
  "DllName"=expand:"sclgntfy.dll"

[Winlogon\Notify\SensLogn]
  "DLLName"="WlNotify.dll"

[Winlogon\Notify	ermsrv]
  "DllName"=expand:"wlnotify.dll"

[Winlogon\Notify\wlballoon]
  "DLLName"="wlnotify.dll"

[Winlogon\SpecialAccounts]

[Winlogon\SpecialAccounts\UserList]
  "HelpAssistant"=dword:00000000
  "TsInternetUser"=dword:00000000
  "SQLAgentCmdExec"=dword:00000000
  "NetShowServices"=dword:00000000
  "IWAM_"=dword:00010000
  "IUSR_"=dword:00010000
  "VUSR_"=dword:00010000

-----HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon-----

[Winlogon]
  "ParseAutoexec"="1"
  "ExcludeProfileDirs"="Local Settings;Temporary Internet Files;Historique;Temp"
  "BuildNumber"=dword:00000a28

-----HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options-----

[Image File Execution Options\Your Image File Name Here without a path]
  "Debugger"="ntsd -d"

-----HKLM\System\CurrentControlSet\Control\Session Manager\-----

[Session Manager]
  "BootExecute"=multi:"autocheck autochk *\00\00"

[Session Manager\SubSystems]
  "Windows"=expand:"%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,3072,512 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ProfileControl=Off MaxRequestThreads=16"

-----HKLM\SYSTEM\CurrentControlSet\Control\WOW-----

[WOW]
  "cmdline"=expand:"%SystemRoot%\system32
tvdm.exe"
  "wowcmdline"=expand:"%SystemRoot%\system32
tvdm.exe -a %SystemRoot%\system32\krnl386"

-----HKLM\Software\Microsoft\Windows NT\CurrentVersion\Run-----

[run]

-----HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce-----

[RunOnce]

-----HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx-----

[RunOnceEx]

-----HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices-----

[RunServices]

-----HKLM\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce-----

[RunServicesOnce]

-----HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce-----

[RunOnce]

-----HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnceEx-----

-----HKCU\Software\Microsoft\Windows\CurrentVersion\RunServices-----

[RunServices]

-----HKCU\Software\Microsoft\Windows NT\CurrentVersion\Run-----

-----HKCU\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce-----

[RunServicesOnce]

-----HKLM\Software\Microsoft\Command Processor\Autorun-----

-----HKCU\Software\Microsoft\Command Processor\Autorun-----

-----HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows\Load-----

-----HKLM\Software\Policies\Microsoft\Windows\System\Scripts\Startup-----

-----HKCU\Software\Policies\Microsoft\Windows\System\Scripts\Logon-----

-----HKLM\Software\Policies\Microsoft\Windows\System\Scripts\Logon-----

-----HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\TerminalServer\Install\Software\Microsoft\Windows\CurrentVersion\Runonce-----

-----HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\TerminalServer\Install\Software\Microsoft\Windows\CurrentVersion\Run-----

-----HKLM\System\CurrentControlSet\Control\Terminal Server\Wdsdpwd\StartupPrograms-----

-----HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\TerminalServer\Install\Software\Microsoft\Windows\CurrentVersion\Runonce-----

-----HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler-----

[SharedTaskScheduler]
  "{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Pré-chargeur Browseui"
    #### HKCR\CLSID\{438755C2-A8BA-11D1-B96B-00A0C90312E1}\InprocServer32 @=expand:"%SystemRoot%\system32\browseui.dll"
  "{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Démon de cache des catégories de composant"
    #### HKCR\CLSID\{8C7461EF-2B13-11d2-BE35-3078302C2030}\InprocServer32 @=expand:"%SystemRoot%\system32\browseui.dll"

-----HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects-----

[Browser Helper Objects]
  @=""

[Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
  @=""

[Browser Helper Objects\{53707962-6F74-2D53-2644-206D7942484F}]
    #### HKCR\CLSID\{53707962-6F74-2D53-2644-206D7942484F}\InprocServer32 @="C:\PROGRA~1\SPYBOT~1\SDHelper.dll"

[Browser Helper Objects\{7009fcd4-05be-44f4-9583-93fe419ab7b0}]
    #### HKCR\CLSID\{7009fcd4-05be-44f4-9583-93fe419ab7b0}\InprocServer32 @="C:\Program Files\Multi_Media_France	bMul0.dll"
  @=""

[Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
    #### HKCR\CLSID\{9030D464-4C02-4ABF-8ECC-5164760863C6}\InprocServer32 @="C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll"

-----HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks-----

[URLSearchHooks]
  "{CFBFAE00-17A6-11D0-99CB-00C04FD64497}"=""
    #### HKCR\CLSID\{CFBFAE00-17A6-11D0-99CB-00C04FD64497}\InprocServer32 @="C:\WINDOWS\system32\ieframe.dll"

-----HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig-----

-----HKCU\Control Panel\Desktop\-----

[Desktop]
  "SCRNSAVE.EXE"="C:\WINDOWS\system32\ssstars.scr"

[Desktop\WindowMetrics]

-----HKEY_CLASSES_ROOT\exefile\shell\open\command-----

[command]
  @="\"%1\" %*"

-----HKEY_CLASSES_ROOT\comfile\shell\open\command-----

[command]
  @="\"%1\" %*"

-----HKEY_CLASSES_ROOT\batfile\shell\open\command-----

[command]
  @="\"%1\" %*"

-----HKEY_CLASSES_ROOT\piffile\shell\open\command-----

[command]
  @="\"%1\" %*"

-----HKEY_CLASSES_ROOT\scrFile\shell\open\command-----

[command]
  @="\"%1\" %*"

-----HKEY_CLASSES_ROOT\htafile\shell\open\command-----

[Command]
  @="C:\WINDOWS\system32\mshta.exe \"%1\" %*"

-----HKEY_CLASSES_ROOT\logfile\shell\open\command-----

-----HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\URL-----

[URL]

[URL\DefaultPrefix]
  @="http://"

[URL\Prefixes]
  "ftp"="ftp://"
  "gopher"="gopher://"
  "home"="http://"
  "mosaic"="http://"
  "www"="http://"

-----HKLM\SYSTEM\CurrentControlSet\Control\Lsa-----

[Lsa]

[Lsa\AccessProviders]

[Lsa\AccessProviders\Windows NT Access Provider]
  "ProviderPath"=expand:"%SystemRoot%\system32
tmarta.dll"

[Lsa\Audit]

[Lsa\Audit\PerUserAuditing]

[Lsa\Audit\PerUserAuditing\System]

[Lsa\Data]

[Lsa\SSO]

[Lsa\SSO\Passport1.4]
  "SSOURL"="http://www.passport.com"

[Lsa\SspiCache]

[Lsa\SspiCache\digest.dll]
  "Name"="Digest"
  "Comment"="Digest SSPI Authentication Package"

[Lsa\SspiCache\msapsspc.dll]
  "Name"="DPA"
  "Comment"="DPA Security Package"

[Lsa\SspiCache\msnsspc.dll]
  "Name"="MSN"
  "Comment"="MSN Security Package"

-----HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess-----

[SharedAccess]
  "DependOnGroup"=multi:"\00"
  "DependOnService"=multi:"Netman\00WinMgmt\00\00"
  "Description"="Assure la traduction d'adresses de réseau, l'adressage, les services de résolution de noms et/ou les services de prévention d'intrusion pour un réseau de petite entreprise ou un réseau domestique."
  "DisplayName"="Pare-feu Windows / Partage de connexion Internet"
  "ErrorControl"=dword:00000001
  "ImagePath"=expand:"%SystemRoot%\system32\svchost.exe -k netsvcs"
  "ObjectName"="LocalSystem"
  "Start"=dword:00000002
  "Type"=dword:00000020

[SharedAccess\Epoch]
  "Epoch"=dword:00002473

[SharedAccess\Parameters]
  "ServiceDll"=expand:"%SystemRoot%\System32\ipnathlp.dll"

[SharedAccess\Parameters\FirewallPolicy]

[SharedAccess\Parameters\FirewallPolicy\DomainProfile]

[SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications]

[SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
  "%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enaxxxxx@xxxxxres.dll,-22019"
  "C:\Program Files\MSN Messenger\msnmsgr.exe"="C:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
  "C:\Program Files\MSN Messenger\livecall.exe"="C:\Program Files\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"
  "%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enaxxxxx@xxxxxres.dll,-20000"

[SharedAccess\Parameters\FirewallPolicy\StandardProfile]
  "EnableFirewall"=dword:00000001
  "DoNotAllowExceptions"=dword:00000000

[SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications]

[SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
  "%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enaxxxxx@xxxxxres.dll,-22019"
  "C:\Program Files\eMule\emule.exe"="C:\Program Files\eMule\emule.exe:*:Enabled:eMule"
  "C:\Program Files\MSN Messenger\msnmsgr.exe"="C:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
  "C:\Program Files\MSN Messenger\livecall.exe"="C:\Program Files\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"
  "C:\Program Files\Resolume 2.41esolume.exe"="C:\Program Files\Resolume 2.41esolume.exe:*:Enabled:Resolume 2.41"
  "C:\Program Files\Messenger\msmsgs.exe"="C:\Program Files\Messenger\msmsgs.exe:*:Enabled:Windows Messenger"
  "C:\Documents and Settings\Propriétaire\Local Settings\Temp\Rar$EX02.937\emule.exe"="C:\Documents and Settings\Propriétaire\Local Settings\Temp\Rar$EX02.937\emule.exe:*:Disabled:eMule"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\0exinjs.aa.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\0exinjs.aa.exe:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\22exinjs.aa.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\22exinjs.aa.exe:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\23exinjs.aa.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\23exinjs.aa.exe:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\83exinjs.aa.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\83exinjs.aa.exe:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\86exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\86exinjs.ab.exe:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\82exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\82exinjs.ab.exe:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\42exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\42exinjs.ab.exe:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\98exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\98exinjs.ab.exe:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\36exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\36exinjs.ab.exe:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\59exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\59exinjs.ab.exe:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\49exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\49exinjs.ab.exe:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\73exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\73exinjs.ab.exe:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\75exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\75exinjs.ab.exe:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\8exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\8exinjs.ab.exe:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\47exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\47exinjs.ab.exe:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\20exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\20exinjs.ab.exe:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\78exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\78exinjs.ab.exe:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\80exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\80exinjs.ab.exe:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\74exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\74exinjs.ab.exe:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\18exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\18exinjs.ab.exe:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\64exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\64exinjs.ab.exe:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\57exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\57exinjs.ab.exe:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\92exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\92exinjs.ab.exe:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\11exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\11exinjs.ab.exe:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\50exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\50exinjs.ab.exe:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\43exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\43exinjs.ab.exe:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\95exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\95exinjs.ab.exe:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\52exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\52exinjs.ab.exe:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\23exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\23exinjs.ab.exe:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\6exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\6exinjs.ab.exe:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\39exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\39exinjs.ab.exe:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\68exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\68exinjs.ab.exe:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\61exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\61exinjs.ab.exe:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\26exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\26exinjs.ab.exe:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\34exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\34exinjs.ab.exe:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\19exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\19exinjs.ab.exe:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\32exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\32exinjs.ab.exe:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\14exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\14exinjs.ab.exe:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\60exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\60exinjs.ab.exe:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\29exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\29exinjs.ab.exe:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\66exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\66exinjs.ab.exe:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\99exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\99exinjs.ab.exe:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\54exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\54exinjs.ab.exe:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\94exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\94exinjs.ab.exe:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\85exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\85exinjs.ab.exe:*:Enabled:Microsoft Update"
  "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe"="C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe:*:Disabled:Kaspersky Anti-Virus"
  "C:\Program Files\uTorrent\uTorrent.exe"="C:\Program Files\uTorrent\uTorrent.exe:*:Enabled:µTorrent"
  "C:\Program Files\BitDownload\BitDownload.exe"="C:\Program Files\BitDownload\BitDownload.exe:*:Enabled:Torrent P2P application"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\16ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\16ex:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\25ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\25ex:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\35ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\35ex:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\43ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\43ex:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\58ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\58ex:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\26ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\26ex:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\87ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\87ex:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\60ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\60ex:*:Enabled:Microsoft Update"
  "C:\Program Files\Ahead\Nero ShowTime\ShowTime.exe"="C:\Program Files\Ahead\Nero ShowTime\ShowTime.exe:*:Enabled:Nero ShowTime"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\44ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\44ex:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\50ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\50ex:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\7ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\7ex:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\42ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\42ex:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\3ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\3ex:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\21ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\21ex:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\40ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\40ex:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\2ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\2ex:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\4ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\4ex:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\65ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\65ex:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\37ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\37ex:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\31ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\31ex:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\72ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\72ex:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\92ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\92ex:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\68ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\68ex:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\45ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\45ex:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\96ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\96ex:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\33ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\33ex:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\79ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\79ex:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\10ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\10ex:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\22ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\22ex:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\55ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\55ex:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\66ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\66ex:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\94ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\94ex:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\52ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\52ex:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\0ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\0ex:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\63ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\63ex:*:Enabled:Microsoft Update"
  "C:\Documents and Settings\Propriétaire\Local Settings\Temp\10exmdnk23.exe"="C:\Documents and Settings\Propriétaire\Local Settings\Temp\10exmdnk23.exe:*:Disabled:10exmdnk23"
  "C:\Documents and Settings\Propriétaire\Local Settings\Temp\33exmdnk25.exe"="C:\Documents and Settings\Propriétaire\Local Settings\Temp\33exmdnk25.exe:*:Disabled:33exmdnk25"
  "C:\Documents and Settings\Propriétaire\Local Settings\Temp\0exmdnk26.exe"="C:\Documents and Settings\Propriétaire\Local Settings\Temp\0exmdnk26.exe:*:Disabled:0exmdnk26"
  "C:\Documents and Settings\Propriétaire\Local Settings\Temp\58exmdnk30.exe"="C:\Documents and Settings\Propriétaire\Local Settings\Temp\58exmdnk30.exe:*:Disabled:58exmdnk30"
  "C:\kav\kis7.0\french\setup.exe"="C:\kav\kis7.0\french\setup.exe:*:Enabled:Programme d'installation de Kaspersky Internet Security 7.0"
  "C:\kav\kav7.0\french\setup.exe"="C:\kav\kav7.0\french\setup.exe:*:Enabled:Programme d'installation de Kaspersky Anti-Virus 7.0"
  "%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enaxxxxx@xxxxxres.dll,-20000"

[SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts]

[SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
  "1900:UDP"="1900:UDP:LocalSubNet:Disaxxxxx@xxxxxres.dll,-22007"
  "2869:TCP"="2869:TCP:LocalSubNet:Disaxxxxx@xxxxxres.dll,-22008"
  "17053:TCP"="17053:TCP:*:Enabled:NortonAV"
  "12192:TCP"="12192:TCP:*:Enabled:NortonAV"

[SharedAccess\Setup]
  "ServiceUpgrade"=dword:00000001

[SharedAccess\Setup\InterfacesUnfirewalledAtUpdate]
  "All"=dword:00000001

-----HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Firewall\-----

-----HKEY_LOCAL_MACHINE\SOFTWARE\Winsock2-----

-----HKLM\Software\Microsoft\Ole-----

[Ole]
  "DefaultLaunchPermission"=hex:01,00,04,80,5c,00,00,00,6c,00,00,00,00,00,00,00,\
  "MachineLaunchRestriction"=hex:01,00,04,80,48,00,00,00,58,00,00,00,00,00,00,00,\
  "MachineAccessRestriction"=hex:01,00,04,80,44,00,00,00,54,00,00,00,00,00,00,00,\
  "EnableDCOM"="Y"

[Ole\AppCompat]

[Ole\AppCompat\ActivationSecurityCheckExemptionList]
  "{A50398B8-9075-4FBF-A7A1-456BF21937AD}"="1"
  "{AD65A69D-3831-40D7-9629-9B0B50A93843}"="1"
  "{0040D221-54A1-11D1-9DE0-006097042D69}"="1"
  "{2A6D72F1-6E7E-4702-B99C-E40D3DED33C3}"="1"

[Ole\NONREDIST]
  "System.EnterpriseServices.Thunk.dll"=""

-----HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WindowsUpdate\AU\-----

-----HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\-----

[Security Center]
  "FirstRunDisabled"=dword:00000001
  "AntiVirusDisableNotify"=dword:00000000
  "FirewallDisableNotify"=dword:00000000
  "UpdatesDisableNotify"=dword:00000000
  "AntiVirusOverride"=dword:00000001
  "FirewallOverride"=dword:00000000

[Security Center\Monitoring]

[Security Center\Monitoring\AhnlabAntiVirus]

[Security Center\Monitoring\ComputerAssociatesAntiVirus]

[Security Center\Monitoring\KasperskyAntiVirus]

[Security Center\Monitoring\McAfeeAntiVirus]

[Security Center\Monitoring\McAfeeFirewall]

[Security Center\Monitoring\PandaAntiVirus]

[Security Center\Monitoring\PandaFirewall]

[Security Center\Monitoring\SophosAntiVirus]

[Security Center\Monitoring\SymantecAntiVirus]

[Security Center\Monitoring\SymantecFirewall]

[Security Center\Monitoring\TinyFirewall]

[Security Center\Monitoring\TrendAntiVirus]

[Security Center\Monitoring\TrendFirewall]

[Security Center\Monitoring\ZoneLabsFirewall]

-----HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore\-----

[SystemRestore]
  "DisableSR"=dword:00000000
  "CreateFirstRunRp"=dword:00000001
  "DSMin"=dword:000000c8
  "DSMax"=dword:00000190
  "RPSessionInterval"=dword:00000000
  "RPGlobalInterval"=dword:00015180
  "RPLifeInterval"=dword:0076a700
  "CompressionBurst"=dword:0000003c
  "TimerInterval"=dword:00000078
  "DiskPercent"=dword:0000000c
  "ThawInterval"=dword:00000384
  "RestoreDiskSpaceError"=dword:00000000
  "RestoreStatus"=dword:00000000
  "RestoreSafeModeStatus"=dword:00000001

[SystemRestore\Cfg]
  "DiskPercent"=dword:0000000c
  "MachineGuid"="{D88DDE61-D342-465C-AFF5-295FBD9AB56F}"

[SystemRestore\SnapshotCallbacks]
  @=""

-----HKEY_CURRENT_USER\Software\VB and VBA Program Settings-----

[VB and VBA Program Settings]

[VB and VBA Program Settings\CCleaner]

[VB and VBA Program Settings\CCleaner\Options]

-----HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\-----

-----HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\AdvancedOptions-----

[AdvancedOptions]

-----HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\AdvancedOptions-----

-----HKLM\Software\Microsoft\Active Setup\Installed Components-----

[Installed Components]

[Installed Components\<{12d0ed0d-0ee0-4f90-8827-78cefb8f4988}]
  "@="IE7 Uninstall Stub"
  "ComponentID"="IEUDINIT"
  "StubPath"="C:\WINDOWS\system32\ieudinit.exe"

[Installed Components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}]
    #### HKCR\CLSID\{22d6f312-b0f6-11d0-94ab-0080c74c7e95}\InprocServer32 @="C:\WINDOWS\system32\wmpdxm.dll"
  "Stubpath"="C:\WINDOWS\inf\unregmp2.exe /ShowWMP"
  "@="Microsoft Windows Media Player"
  "ComponentID"="WMPACCESS"

[Installed Components\>{26923b43-4d38-484f-9b9e-de460746276c}]
  "@="Internet Explorer"
  "ComponentID"="IEACCESS"
  "StubPath"="C:\WINDOWS\system32\ie4uinit.exe -UserIconConfig"

[Installed Components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
  "@="Browser Customizations"
  "ComponentiD"="BRANDING.CAB"
  "StubPath"="RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP"

[Installed Components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS]
  "@="Personnalisation du navigateur"
  "ComponentID"="BRANDING.CAB"
  "StubPath"="RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP"

[Installed Components\>{881dd1c5-3dcf-431b-b061-f3f88e8be88a}]
  "@="Outlook Express"
  "ComponentID"="OEACCESS"
  "StubPath"=expand:"%systemroot%\system32\shmgrate.exe OCInstallUserConfigOE"

[Installed Components\{0E92DD42-76F5-4EF2-B381-F9C1D72BE23D}]
  "@="Security Update for Microsoft .NET Framework 2.0 (KB922770)"
  "ComponentID"="KB922770"

[Installed Components\{10072CEC-8CC1-11D1-986E-00A0C955B42F}]
  "@="Rendu VML (Vector Graphics Rendering)"
  "ComponentID"="MSVML"

[Installed Components\{2179C5D3-EBFF-11CF-B6FD-00AA00B4E220}]
    #### HKCR\CLSID\{2179C5D3-EBFF-11CF-B6FD-00AA00B4E220}\InprocServer32 @="C:\WINDOWS\system32\wmpdxm.dll"
  "ComponentID"="NetShow"
  "StubPath"=""

[Installed Components\{22d6f312-b0f6-11d0-94ab-0080c74c7e95}]
    #### HKCR\CLSID\{22d6f312-b0f6-11d0-94ab-0080c74c7e95}\InprocServer32 @="C:\WINDOWS\system32\wmpdxm.dll"
  "ComponentID"="Microsoft Windows Media Player"
  "StubPath"=""
  "@="Lecteur Windows Media Microsoft 6.4"

[Installed Components\{283807B5-2C60-11D0-A31D-00AA00B92C03}]
  "@="DirectAnimation"
  "ComponentID"="DirectAnimation"

[Installed Components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}]
  "@="Themes Setup"
  "ComponentID"="Theme Component"
  "StubPath"=expand:"%SystemRoot%\system32egsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32	hemeui.dll"

[Installed Components\{36f8ec70-c29a-11d1-b5c7-0000f8051515}]
  "@="Liaison de données Dynami

Sophie · Answer

SystemScan - www.suspectfile.com - ver. 3.5.5 (code: holifay & bReAkdOWn)

Running on: Windows XP HOME Edition, Service Pack 2 (2600.5.1)
System directory: C:\WINDOWS
SystemScan file: C:\Documents and Settings\Propriétaire\Local Settings\Temporary Internet Files\Content.IE5\HLWUXMAW\sys78712[1].exe
Running in: User mode
Date: 06/11/2008
Time: 17:29:43
  
Output limited to: 
 -Recent files
 -Registry Run Keys
 -Suspicious Files

===================== RECENT FILES =====================

Showing files newer than  30 days

----- recent files in C:\
04/11/2008 18:14:33 (DIR)        0 byte      2 days old -- Deckard
06/11/2008 16:34:07      2145386496 byte      0 days old -- pagefile.sys
06/11/2008 16:54:38 (DIR)        0 byte      0 days old -- Program Files
06/11/2008 16:56:08 (DIR)        0 byte      0 days old -- Config.Msi
06/11/2008 17:05:02           1264 byte      0 days old -- TCleaner.txt
06/11/2008 17:07:23 (DIR)        0 byte      0 days old -- System Volume Information
06/11/2008 17:09:19 (DIR)        0 byte      0 days old -- ComboFix
06/11/2008 17:17:41           3660 byte      0 days old -- Bug.txt
06/11/2008 17:17:42 (DIR)        0 byte      0 days old -- Combo-Fix
06/11/2008 17:17:47 (DIR)        0 byte      0 days old -- WINDOWS

----- recent files in C:\WINDOWS\
04/11/2008 12:27:54 (DIR)        0 byte      2 days old -- Minidump
04/11/2008 12:47:51 (DIR)        0 byte      2 days old -- Tasks
04/11/2008 12:51:02              0 byte      2 days old -- setuperr.log
04/11/2008 12:53:08           9170 byte      2 days old -- KB943055Uninst.log
04/11/2008 18:14:42 (DIR)        0 byte      2 days old -- ERDNT
04/11/2008 20:49:01 (DIR)        0 byte      2 days old -- Debug
04/11/2008 20:49:46 (DIR)        0 byte      2 days old -- $NtUninstallKB943055$
04/11/2008 20:49:49          11413 byte      2 days old -- KB943055.log
04/11/2008 20:49:52 (DIR)        0 byte      2 days old -- $NtUninstallKB950749$
04/11/2008 20:49:56          14173 byte      2 days old -- KB950749.log
04/11/2008 20:49:58 (DIR)        0 byte      2 days old -- $NtUninstallKB945553$
04/11/2008 20:49:59          12373 byte      2 days old -- KB945553.log
04/11/2008 20:50:02 (DIR)        0 byte      2 days old -- $NtUninstallKB944338$
04/11/2008 20:50:03          13476 byte      2 days old -- KB944338.log
04/11/2008 20:50:05 (DIR)        0 byte      2 days old -- $NtUninstallKB948590$
04/11/2008 20:50:06          12774 byte      2 days old -- KB948590.log
04/11/2008 20:50:07 (DIR)        0 byte      2 days old -- $NtUninstallKB941693$
04/11/2008 20:50:09          12974 byte      2 days old -- KB941693.log
04/11/2008 20:50:13 (DIR)        0 byte      2 days old -- $NtUninstallKB947864$
04/11/2008 20:50:19          20085 byte      2 days old -- KB947864.log
04/11/2008 20:50:20 (DIR)        0 byte      2 days old -- $NtUninstallKB948881$
04/11/2008 20:50:22          11204 byte      2 days old -- KB948881.log
05/11/2008 12:58:01 (DIR)        0 byte      1 days old -- $NtUninstallKB904942$
05/11/2008 12:58:04          11030 byte      1 days old -- KB904942.log
05/11/2008 12:58:06 (DIR)        0 byte      1 days old -- $NtUninstallKB914440$
05/11/2008 12:58:07 (DIR)        0 byte      1 days old -- network diagnostic
05/11/2008 12:58:08           5198 byte      1 days old -- KB914440.log
05/11/2008 12:58:53 (DIR)        0 byte      1 days old -- $NtUninstallKB915865$
05/11/2008 12:58:57           6278 byte      1 days old -- KB915865.log
05/11/2008 12:59:06 (DIR)        0 byte      1 days old -- $NtServicePackUninstallNLSDownlevelMapping$
05/11/2008 12:59:09           7177 byte      1 days old -- NLSDownlevelMapping.log
05/11/2008 12:59:16 (DIR)        0 byte      1 days old -- $NtServicePackUninstallIDNMitigationAPIs$
05/11/2008 12:59:20           7485 byte      1 days old -- IDNMitigationAPIs.log
05/11/2008 13:00:09 (DIR)        0 byte      1 days old -- ie7
05/11/2008 13:00:17 (DIR)        0 byte      1 days old -- Media
05/11/2008 13:00:21 (DIR)        0 byte      1 days old -- WBEM
05/11/2008 13:00:27          57821 byte      1 days old -- ie7.log
05/11/2008 13:00:49 (DIR)        0 byte      1 days old -- ie7updates
05/11/2008 13:01:00          72190 byte      1 days old -- KB944533-IE7.log
05/11/2008 13:01:11          45658 byte      1 days old -- updspapi.log
05/11/2008 13:01:15          50000 byte      1 days old -- KB947864-IE7.log
05/11/2008 13:01:36          35377 byte      1 days old -- ie7_main.log
05/11/2008 13:02:42 (DIR)        0 byte      1 days old -- Help
05/11/2008 13:03:16           6286 byte      1 days old -- spupdsvc.log
05/11/2008 13:33:23             60 byte      1 days old -- setupact.log
05/11/2008 18:18:13         117714 byte      1 days old -- ntbtlog.txt
06/11/2008 09:00:51 (DIR)        0 byte      0 days old -- $hf_mig$
06/11/2008 09:17:30 (DIR)        0 byte      0 days old -- system
06/11/2008 10:18:12 (DIR)        0 byte      0 days old -- $NtUninstallKB932823-v3$
06/11/2008 10:18:18          10097 byte      0 days old -- KB932823-v3.log
06/11/2008 10:18:19           1374 byte      0 days old -- imsins.BAK
06/11/2008 10:18:25          75274 byte      0 days old -- ocgen.log
06/11/2008 10:18:25          56446 byte      0 days old -- tsoc.log
06/11/2008 10:18:25          48869 byte      0 days old -- setupapi.log
06/11/2008 10:18:25           8054 byte      0 days old -- ocmsn.log
06/11/2008 10:18:25           1374 byte      0 days old -- imsins.log
06/11/2008 10:18:25 (DIR)        0 byte      0 days old -- inf
06/11/2008 10:18:25          21821 byte      0 days old -- iis6.log
06/11/2008 10:18:25          48411 byte      0 days old -- comsetup.log
06/11/2008 10:18:25         139927 byte      0 days old -- FaxSetup.log
06/11/2008 10:18:25           7402 byte      0 days old -- msgsocm.log
06/11/2008 10:18:25          10950 byte      0 days old -- KB938127-IE7.log
06/11/2008 10:18:25          31031 byte      0 days old -- ntdtcsetup.log
06/11/2008 15:53:02 (DIR)        0 byte      0 days old -- Prefetch
06/11/2008 16:33:10          23478 byte      0 days old -- SchedLgU.Txt
06/11/2008 16:34:11           2048 byte      0 days old -- bootstat.dat
06/11/2008 16:34:12              0 byte      0 days old -- 0.log
06/11/2008 16:34:23             50 byte      0 days old -- wiaservc.log
06/11/2008 16:34:26            159 byte      0 days old -- wiadebug.log
06/11/2008 16:35:13         696959 byte      0 days old -- WindowsUpdate.log
06/11/2008 16:56:08 (DIR)        0 byte      0 days old -- WinSxS
06/11/2008 16:56:15 (DIR)        0 byte      0 days old -- Installer
06/11/2008 17:02:30 (DIR)        0 byte      0 days old -- Temp
06/11/2008 17:17:41 (DIR)        0 byte      0 days old -- system32

----- recent files in C:\WINDOWS\Downloaded Program Files\

----- recent files in C:\WINDOWS\system\

----- recent files in C:\WINDOWS\system32\
04/11/2008 12:11:54          13702 byte      2 days old -- wpa.dbl
04/11/2008 12:14:58        1070888 byte      2 days old -- PerfStringBackup.INI
04/11/2008 12:15:00          83620 byte      2 days old -- perfc00C.dat
04/11/2008 12:15:00          70106 byte      2 days old -- perfc009.dat
04/11/2008 12:15:00         485868 byte      2 days old -- perfh00C.dat
04/11/2008 12:15:00         418590 byte      2 days old -- perfh009.dat
05/11/2008 10:53:41          91888 byte      1 days old -- FNTCACHE.DAT
05/11/2008 13:00:55 (DIR)        0 byte      1 days old -- fr-fr
06/11/2008 10:18:24 (DIR)        0 byte      0 days old -- dllcache
06/11/2008 15:04:53 (DIR)        0 byte      0 days old -- CatRoot2
06/11/2008 16:20:13           3121 byte      0 days old -- CONFIG.NT
06/11/2008 16:28:07 (DIR)        0 byte      0 days old -- drivers
06/11/2008 17:07:23 (DIR)        0 byte      0 days old -- Restore

----- recent files in C:\WINDOWS\system32\drivers\

----- recent files in C:\WINDOWS	emp\
06/11/2008 16:17:38         965569 byte      0 days old -- fa56d7ec.$$$
06/11/2008 16:34:16          16384 byte      0 days old -- Perflib_Perfdata_658.dat
06/11/2008 17:03:51 (DIR)        0 byte      0 days old -- _avast4_

----- recent files in C:\Program Files\
04/11/2008 12:44:13 (DIR)        0 byte      2 days old -- ATI Technologies
04/11/2008 12:55:53 (DIR)        0 byte      2 days old -- Windows Live Toolbar
05/11/2008 16:09:17 (DIR)        0 byte      1 days old -- eMule
05/11/2008 16:17:51 (DIR)        0 byte      1 days old -- Internet Explorer
05/11/2008 20:34:33 (DIR)        0 byte      1 days old -- Messenger
05/11/2008 20:34:33 (DIR)        0 byte      1 days old -- M-Audio Firewire Audiophile
05/11/2008 20:34:33 (DIR)        0 byte      1 days old -- DivX
05/11/2008 20:36:52 (DIR)        0 byte      1 days old -- MySpace
06/11/2008 15:02:36 (DIR)        0 byte      0 days old -- PKR
06/11/2008 16:55:02 (DIR)        0 byte      0 days old -- Fichiers communs
06/11/2008 16:56:30 (DIR)        0 byte      0 days old -- SPYWAREfighter
06/11/2008 17:04:44 (DIR)        0 byte      0 days old -- Trend Micro

----- recent files in C:\Program Files\Fichiers communs\
06/11/2008 16:55:02 (DIR)        0 byte      0 days old -- Application

----- recent files in C:\Documents and Settings\Propriétaire\Application Data\
04/11/2008 13:48:47 (DIR)        0 byte      2 days old -- Malwarebytes
05/11/2008 13:09:44 (DIR)        0 byte      1 days old -- SUPERAntiSpyware.com

----- recent files in C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\
04/11/2008 18:20:11          16384 byte      2 days old -- ~DF3333.tmp
04/11/2008 18:46:09         239104 byte      2 days old -- 71exhmunmlclr14.exe
04/11/2008 18:46:09         239104 byte      2 days old -- 75exhmunmlclr14.exe
04/11/2008 18:46:09         239104 byte      2 days old -- 88exhmunmlclr14.exe
04/11/2008 18:46:09         239104 byte      2 days old -- 24exhmunmlclr14.exe
04/11/2008 19:05:45          16384 byte      2 days old -- ~DF8B63.tmp
04/11/2008 19:14:04          32768 byte      2 days old -- ~DF3D4F.tmp
04/11/2008 20:48:26          16384 byte      2 days old -- ~DF6387.tmp
05/11/2008 11:05:41          22704 byte      1 days old -- Danish.bin
05/11/2008 11:05:41          25670 byte      1 days old -- Dutch.bin
05/11/2008 11:05:41          16913 byte      1 days old -- TradChin.bin
05/11/2008 11:05:41          24256 byte      1 days old -- Japanese.bin
05/11/2008 11:05:41          20101 byte      1 days old -- Korean.bin
05/11/2008 11:05:42          27178 byte      1 days old -- French.bin
05/11/2008 11:05:43          24028 byte      1 days old -- SWEDISH.bin
05/11/2008 11:05:43          25684 byte      1 days old -- German.bin
05/11/2008 11:05:43          26062 byte      1 days old -- Russian.bin
05/11/2008 11:05:43          27689 byte      1 days old -- Spanish.bin
05/11/2008 11:05:43          27330 byte      1 days old -- Italian.bin
05/11/2008 11:05:44          26187 byte      1 days old -- Portuguese.bin
05/11/2008 11:05:44          21913 byte      1 days old -- Thai.bin
05/11/2008 11:05:44          20919 byte      1 days old -- Arabic.bin
05/11/2008 11:05:44          21857 byte      1 days old -- English.bin
05/11/2008 11:05:44          16374 byte      1 days old -- SimChin.bin
05/11/2008 11:05:45          24999 byte      1 days old -- Portuguese(Brazil).bin
05/11/2008 11:05:45          24147 byte      1 days old -- Polish.bin
05/11/2008 11:05:45          25003 byte      1 days old -- Greek.bin
05/11/2008 11:05:45          24252 byte      1 days old -- Czech.bin
05/11/2008 11:05:46          22793 byte      1 days old -- Finnish.bin
05/11/2008 11:05:47          19487 byte      1 days old -- Hebrew.bin
05/11/2008 11:05:47          26001 byte      1 days old -- Hungarian.bin
05/11/2008 11:05:48          21901 byte      1 days old -- Norwegian.bin
05/11/2008 11:05:48          22194 byte      1 days old -- Turkish.bin
05/11/2008 11:27:14          32768 byte      1 days old -- ~DF6515.tmp
05/11/2008 11:31:17          16384 byte      1 days old -- ~DF9D46.tmp
05/11/2008 11:31:34          16384 byte      1 days old -- ~DF7191.tmp
05/11/2008 11:31:58          16384 byte      1 days old -- ~DF1672.tmp
05/11/2008 11:32:48          16384 byte      1 days old -- ~DFD13B.tmp
05/11/2008 11:33:22          16384 byte      1 days old -- ~DFA2FD.tmp
05/11/2008 11:42:31          32768 byte      1 days old -- ~DF638.tmp
05/11/2008 11:44:33          32768 byte      1 days old -- ~DF34FC.tmp
05/11/2008 11:49:16          16384 byte      1 days old -- ~DF23B5.tmp
05/11/2008 11:49:16          16384 byte      1 days old -- ~DF2494.tmp
05/11/2008 11:50:14          16384 byte      1 days old -- ~DF23C4.tmp
05/11/2008 11:53:30          16384 byte      1 days old -- ~DF45C4.tmp
05/11/2008 11:54:23          32768 byte      1 days old -- ~DF7AF.tmp
05/11/2008 11:57:13          16384 byte      1 days old -- ~DF214A.tmp
05/11/2008 11:57:40          32768 byte      1 days old -- ~DFD70B.tmp
05/11/2008 12:06:58          16384 byte      1 days old -- ~DFA66A.tmp
05/11/2008 12:09:48          32768 byte      1 days old -- ~DFB01E.tmp
05/11/2008 12:20:27          16384 byte      1 days old -- ~DF1DB1.tmp
05/11/2008 12:20:50          16384 byte      1 days old -- ~DFBA1E.tmp
05/11/2008 12:22:24          32768 byte      1 days old -- ~DF3E3D.tmp
05/11/2008 12:25:54          16384 byte      1 days old -- ~DF5412.tmp
05/11/2008 12:26:21          32768 byte      1 days old -- ~DF150A.tmp
05/11/2008 12:28:38          32768 byte      1 days old -- ~DF60E8.tmp
05/11/2008 12:30:18          32768 byte      1 days old -- ~DF6AD1.tmp
05/11/2008 12:34:10          16384 byte      1 days old -- ~DFEBB.tmp
05/11/2008 12:50:14          32768 byte      1 days old -- ~DF8F7A.tmp
05/11/2008 12:51:34          16384 byte      1 days old -- ~DFFCE4.tmp
05/11/2008 13:03:17             54 byte      1 days old -- hmunmlclr14.exe.conf
05/11/2008 13:06:05          16384 byte      1 days old -- ~DF3079.tmp
05/11/2008 13:07:32          16384 byte      1 days old -- ~DF4070.tmp
05/11/2008 13:09:58          16384 byte      1 days old -- ~DF8638.tmp
05/11/2008 13:11:45          16384 byte      1 days old -- ~DF1BF6.tmp
05/11/2008 13:11:46              0 byte      1 days old -- 88313.dmp
05/11/2008 13:12:32          16384 byte      1 days old -- ~DF9948.tmp
05/11/2008 13:12:49          16384 byte      1 days old -- ~DF430A.tmp
05/11/2008 13:14:44          16384 byte      1 days old -- ~DF8882.tmp
05/11/2008 13:30:14          16316 byte      1 days old -- 6394_appcompat.txt
05/11/2008 13:30:20          75860 byte      1 days old -- 196E60.dmp
05/11/2008 13:30:50 (DIR)        0 byte      1 days old -- WERea67.dir00
05/11/2008 13:30:50 (DIR)        0 byte      1 days old -- WERe1a5.dir00
05/11/2008 13:32:24          16384 byte      1 days old -- ~DF7932.tmp
05/11/2008 13:33:08 (DIR)        0 byte      1 days old -- WERf61a.dir00
05/11/2008 13:39:59          16384 byte      1 days old -- ~DFD7EB.tmp
05/11/2008 13:40:18 (DIR)        0 byte      1 days old -- WER8f52.dir00
05/11/2008 13:40:20 (DIR)        0 byte      1 days old -- WER918b.dir00
05/11/2008 13:43:22          16384 byte      1 days old -- ~DFDB6A.tmp
05/11/2008 13:43:50          32298 byte      1 days old -- de41_appcompat.txt
05/11/2008 13:44:49 (DIR)        0 byte      1 days old -- ~nsu.tmp
05/11/2008 13:53:45          16384 byte      1 days old -- ~DFEEDF.tmp
05/11/2008 13:53:56          16384 byte      1 days old -- Perflib_Perfdata_808.dat
05/11/2008 13:54:45 (DIR)        0 byte      1 days old -- WER3a07.dir00
05/11/2008 13:56:10          16384 byte      1 days old -- ~DF5FA5.tmp
05/11/2008 13:57:24          16384 byte      1 days old -- ~DF536A.tmp
05/11/2008 13:57:59          16384 byte      1 days old -- ~DF4193.tmp
05/11/2008 13:59:31          16384 byte      1 days old -- ~DF7F9F.tmp
05/11/2008 14:01:28          16384 byte      1 days old -- ~DF89.tmp
05/11/2008 14:02:16          16384 byte      1 days old -- ~DF34F.tmp
05/11/2008 15:08:31         239104 byte      1 days old -- 60exhmunmlclr15.exe
05/11/2008 15:08:31         239104 byte      1 days old -- 46exhmunmlclr15.exe
05/11/2008 15:08:31         239104 byte      1 days old -- 79exhmunmlclr15.exe
05/11/2008 15:47:47          16384 byte      1 days old -- ~DF2136.tmp
05/11/2008 15:48:43          16316 byte      1 days old -- efda_appcompat.txt
05/11/2008 15:48:48          79711 byte      1 days old -- 2FB0F.dmp
05/11/2008 15:48:53          16384 byte      1 days old -- ~DF9F2B.tmp
05/11/2008 15:51:44          10144 byte      1 days old -- MPC5.tmp
05/11/2008 15:54:52          16384 byte      1 days old -- ~DFC6BC.tmp
05/11/2008 16:09:05             54 byte      1 days old -- hmunmlclr15.exe.conf
05/11/2008 16:13:12          16384 byte      1 days old -- ~DF6329.tmp
05/11/2008 16:18:17          16384 byte      1 days old -- ~DFBFC8.tmp
05/11/2008 16:18:33          16384 byte      1 days old -- ~DF7EC1.tmp
05/11/2008 16:19:06          16384 byte      1 days old -- ~DF16CD.tmp
05/11/2008 16:21:01          32768 byte      1 days old -- ~DF18AE.tmp
05/11/2008 16:31:24 (DIR)        0 byte      1 days old -- {E09B48B5-E141-427A-AB0C-D3605127224A}
05/11/2008 16:35:48          16384 byte      1 days old -- ~DFE243.tmp
05/11/2008 16:39:53          16384 byte      1 days old -- ~DF9898.tmp
05/11/2008 16:40:07          16384 byte      1 days old -- ~DF4EDB.tmp
05/11/2008 16:41:25          16384 byte      1 days old -- ~DF5CB1.tmp
05/11/2008 18:58:45          32768 byte      1 days old -- ~DF84C.tmp
05/11/2008 20:54:31          16384 byte      1 days old -- ~DF1F42.tmp
05/11/2008 20:54:57          16384 byte      1 days old -- ~DF7E1A.tmp
06/11/2008 09:10:34          16384 byte      0 days old -- ~DFF265.tmp
06/11/2008 09:11:12          16384 byte      0 days old -- ~DFC471.tmp
06/11/2008 09:13:00          32768 byte      0 days old -- ~DFCC98.tmp
06/11/2008 09:20:46          32768 byte      0 days old -- ~DFF5DB.tmp
06/11/2008 09:29:12          32768 byte      0 days old -- ~DF2C5F.tmp
06/11/2008 09:35:02          32768 byte      0 days old -- ~DF9840.tmp
06/11/2008 10:00:04          32768 byte      0 days old -- ~DF4304.tmp
06/11/2008 10:08:16          16384 byte      0 days old -- ~DFA144.tmp
06/11/2008 14:52:12          16384 byte      0 days old -- ~DF60BA.tmp
06/11/2008 14:54:17          32768 byte      0 days old -- ~DFACD8.tmp
06/11/2008 15:02:40          16384 byte      0 days old -- ~DF3CC3.tmp
06/11/2008 15:09:50          16384 byte      0 days old -- ~DFF540.tmp
06/11/2008 15:10:17          32768 byte      0 days old -- ~DFC9B4.tmp
06/11/2008 15:12:34          16384 byte      0 days old -- ~DF490C.tmp
06/11/2008 15:13:29          32768 byte      0 days old -- ~DFC226.tmp
06/11/2008 15:29:11           9450 byte      0 days old -- caevents.log
06/11/2008 15:35:01          16384 byte      0 days old -- ~DF41F7.tmp
06/11/2008 15:39:08          16384 byte      0 days old -- ~DFAA9.tmp
06/11/2008 15:40:37          16384 byte      0 days old -- ~DF7B1F.tmp
06/11/2008 15:41:13         311296 byte      0 days old -- ~DF1CE7.tmp
06/11/2008 15:43:01          32768 byte      0 days old -- ~DF4734.tmp
06/11/2008 15:58:44          16384 byte      0 days old -- ~DF3D3C.tmp
06/11/2008 15:59:27          16384 byte      0 days old -- ~DF98B.tmp
06/11/2008 16:00:06          32768 byte      0 days old -- ~DF172F.tmp
06/11/2008 16:10:56          16384 byte      0 days old -- ~DFD933.tmp
06/11/2008 16:11:18          16384 byte      0 days old -- ~DF9687.tmp
06/11/2008 16:12:14 (DIR)        0 byte      0 days old -- AVSETUP_4913094e
06/11/2008 16:13:05          32768 byte      0 days old -- ~DFE54A.tmp
06/11/2008 16:15:30          16384 byte      0 days old -- ~DF9A12.tmp
06/11/2008 16:15:43          32768 byte      0 days old -- ~DFEFB6.tmp
06/11/2008 16:20:14 (DIR)        0 byte      0 days old -- _avast4_
06/11/2008 16:24:21          16384 byte      0 days old -- ~DFE2D5.tmp
06/11/2008 16:25:23          16384 byte      0 days old -- ~DF5EFD.tmp
06/11/2008 16:26:07          16384 byte      0 days old -- ~DFF440.tmp
06/11/2008 16:29:07          16384 byte      0 days old -- ~DFED0F.tmp
06/11/2008 16:31:14          16384 byte      0 days old -- ~DF3471.tmp
06/11/2008 16:31:50          16384 byte      0 days old -- ~DFD017.tmp
06/11/2008 16:34:47          16384 byte      0 days old -- Perflib_Perfdata_a00.dat
06/11/2008 16:34:51          16384 byte      0 days old -- Perflib_Perfdata_dac.dat
06/11/2008 16:34:51          16384 byte      0 days old -- Perflib_Perfdata_da4.dat
06/11/2008 16:54:17              0 byte      0 days old -- is6.tmp
06/11/2008 16:54:36              0 byte      0 days old -- isA.tmp
06/11/2008 16:58:05          49152 byte      0 days old -- ~DF4FF4.tmp
06/11/2008 17:05:33          32768 byte      0 days old -- ~DF1D19.tmp
06/11/2008 17:09:48          32768 byte      0 days old -- ~DF2612.tmp
06/11/2008 17:14:09          32768 byte      0 days old -- ~DF1B2A.tmp
06/11/2008 17:24:18          32768 byte      0 days old -- ~DF3066.tmp
06/11/2008 17:26:00          32768 byte      0 days old -- ~DF659E.tmp
06/11/2008 17:27:27          32768 byte      0 days old -- ~DFCA23.tmp
06/11/2008 17:28:37          16384 byte      0 days old -- ~DFFE93.tmp
06/11/2008 17:28:37            115 byte      0 days old -- systemscan.ini
06/11/2008 17:28:37 (DIR)        0 byte      0 days old -- nsl3D.tmp

===================== REGISTRY SCAN =====================


-----HKLM\Software\Microsoft\Windows\CurrentVersion\Run-----

[Run]
  "ATICCC"="\"C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe\""
  "NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe"
  "MAFWTaskbarApp"="C:\WINDOWS\system32\MAFWTray.exe"
  "RTHDCPL"="RTHDCPL.EXE"
  "SkyTel"="SkyTel.EXE"
  "Alcmtr"="ALCMTR.EXE"
  "PKR Pal"="\"C:\Program Files\PKR\pkrpal.exe\" -osboot"
  "H2O"="C:\Program Files\SyncroSoft\Pos\H2O\cledx.exe"
  "devenv"="C:\WINDOWS\system\smvss.exe /w"
  "FLMOFFICE4DMOUSE"="C:\Program Files\Trust\DS-4500X Wireless Laser Deskset\Mouse\mouse32a.exe"
  "OFFICEKB"="C:\Program Files\Trust\DS-4500X Wireless Laser Deskset\Keyboard\kbdap32a.EXE"
  "avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe"
  "spywarefighterguard"="C:\Program Files\SPYWAREfighter\spftray.exe"
  @=""

[Run\avp6_post_uninstall]

[Run\OptionalComponents]
  @=""

[Run\OptionalComponents\IMAIL]
  "Installed"="1"
  @=""

[Run\OptionalComponents\MAPI]
  "NoChange"="1"
  "Installed"="1"
  @=""

[Run\OptionalComponents\MSFS]
  "Installed"="1"
  @=""

-----HKCU\Software\Microsoft\Windows\CurrentVersion\Run-----

[Run]
  "MsnMsgr"="\"C:\Program Files\MSN Messenger\MsnMsgr.Exe\" /background"
  "MySpaceIM"="C:\Program Files\MySpace\IM\MySpaceIM.exe"
  "SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe"
  "SUPERAntiSpyware"="C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe"
  "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe"

-----HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Run-----

[Run]
  "MySpaceIM"="C:\Program Files\MySpace\IM\MySpaceIM.exe"

-----HKLM\Software\Microsoft\Windows\CurrentVersion\policies\Explorer\Run-----

[Run]

-----HKCU\Software\Microsoft\Windows\CurrentVersion\policies\Explorer\Run-----

[Run]

-----HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows-----

[Windows]
  "AppInit_DLLs"=""

-----HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad-----

[ShellServiceObjectDelayLoad]
  "PostBootReminder"="{7849596a-48ea-486e-8937-a2a3009f31a9}"
    #### HKCR\CLSID\{7849596a-48ea-486e-8937-a2a3009f31a9}\InprocServer32 @=expand:"%SystemRoot%\system32\SHELL32.dll"
  "CDBurn"="{fbeb8a05-beee-4442-804e-409d6c4515e9}"
    #### HKCR\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InprocServer32 @=expand:"%SystemRoot%\system32\SHELL32.dll"
  "WebCheck"="{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"
    #### HKCR\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\InprocServer32 @=expand:"C:\WINDOWS\system32\webcheck.dll"
  "SysTray"="{35CEC8A3-2BE6-11D2-8773-92E220524153}"
    #### HKCR\CLSID\{35CEC8A3-2BE6-11D2-8773-92E220524153}\InprocServer32 @="C:\WINDOWS\system32\stobject.dll"

-----HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks-----

[ShellExecuteHooks]
  "{AEB6717E-7E19-11d0-97EE-00C04FD91972}"=""
    #### HKCR\CLSID\{AEB6717E-7E19-11d0-97EE-00C04FD91972}\InprocServer32 @="shell32.dll"

-----HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon-----

[Winlogon]
  "Shell"="Explorer.exe"
  "System"=""
  "Userinit"="C:\WINDOWS\system32\userinit.exe,"
  "VmApplet"="rundll32 shell32,Control_RunDLL \"sysdm.cpl\""
  "UIHost"=expand:"logonui.exe"
  "LogonType"=dword:00000001
  "WinStationsDisabled"="0"

[Winlogon\GPExtensions]

[Winlogon\GPExtensions\{3610eda5-77ef-11d2-8dc5-00c04fa31a66}]
  "@="Quota du disque Microsoft"
  "DllName"=expand:"dskquota.dll"

[Winlogon\GPExtensions\{4CFB60C1-FAA6-47f1-89AA-0B18730C9FD3}]
  "@="Internet Explorer Zonemapping"
  "DllName"=expand:"iedkcs32.dll"

[Winlogon\GPExtensions\{827D319E-6EAC-11D2-A4EA-00C04F79F83A}]
  "DllName"=expand:"scecli.dll"
  "@="Security"

[Winlogon\GPExtensions\{A2E30F80-D7DE-11d2-BBDE-00C04F86AE3B}]
  "DllName"="iedkcs32.dll"
  "@="Internet Explorer Branding"

[Winlogon\GPExtensions\{B1BE8D72-6EAC-11D2-A4EA-00C04F79F83A}]
  "DllName"=expand:"scecli.dll"
  "@="EFS recovery"

[Winlogon\GPExtensions\{C631DF4C-088F-4156-B058-4375F0853CD8}]
  "@="Microsoft Offline Files"
  "DllName"=expand:"%SystemRoot%\System32\cscui.dll"

[Winlogon\GPExtensions\{c6dc5466-785a-11d2-84d0-00c04fb169f7}]
  "@="Installation de logiciel"
  "DllName"=expand:"appmgmts.dll"

[Winlogon\Notify]

[Winlogon\Notify\!SASWinLogon]

[Winlogon\Notify\AtiExtEvent]
  "DLLName"="Ati2evxx.dll"

[Winlogon\Notify\crypt32chain]
  "DllName"=expand:"crypt32.dll"

[Winlogon\Notify\cryptnet]
  "DllName"=expand:"cryptnet.dll"

[Winlogon\Notify\cscdll]
  "DLLName"="cscdll.dll"

[Winlogon\Notify\ScCertProp]
  "DLLName"="wlnotify.dll"

[Winlogon\Notify\Schedule]
  "DllName"=expand:"wlnotify.dll"

[Winlogon\Notify\sclgntfy]
  "DllName"=expand:"sclgntfy.dll"

[Winlogon\Notify\SensLogn]
  "DLLName"="WlNotify.dll"

[Winlogon\Notify	ermsrv]
  "DllName"=expand:"wlnotify.dll"

[Winlogon\Notify\wlballoon]
  "DLLName"="wlnotify.dll"

[Winlogon\SpecialAccounts]

[Winlogon\SpecialAccounts\UserList]
  "HelpAssistant"=dword:00000000
  "TsInternetUser"=dword:00000000
  "SQLAgentCmdExec"=dword:00000000
  "NetShowServices"=dword:00000000
  "IWAM_"=dword:00010000
  "IUSR_"=dword:00010000
  "VUSR_"=dword:00010000

-----HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon-----

[Winlogon]
  "ParseAutoexec"="1"
  "ExcludeProfileDirs"="Local Settings;Temporary Internet Files;Historique;Temp"
  "BuildNumber"=dword:00000a28

-----HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options-----

[Image File Execution Options\Your Image File Name Here without a path]
  "Debugger"="ntsd -d"

-----HKLM\System\CurrentControlSet\Control\Session Manager\-----

[Session Manager]
  "BootExecute"=multi:"autocheck autochk *\00\00"

[Session Manager\SubSystems]
  "Windows"=expand:"%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,3072,512 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ProfileControl=Off MaxRequestThreads=16"

-----HKLM\SYSTEM\CurrentControlSet\Control\WOW-----

[WOW]
  "cmdline"=expand:"%SystemRoot%\system32
tvdm.exe"
  "wowcmdline"=expand:"%SystemRoot%\system32
tvdm.exe -a %SystemRoot%\system32\krnl386"

-----HKLM\Software\Microsoft\Windows NT\CurrentVersion\Run-----

[run]

-----HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce-----

[RunOnce]

-----HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx-----

[RunOnceEx]

-----HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices-----

[RunServices]

-----HKLM\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce-----

[RunServicesOnce]

-----HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce-----

[RunOnce]

-----HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnceEx-----

-----HKCU\Software\Microsoft\Windows\CurrentVersion\RunServices-----

[RunServices]

-----HKCU\Software\Microsoft\Windows NT\CurrentVersion\Run-----

-----HKCU\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce-----

[RunServicesOnce]

-----HKLM\Software\Microsoft\Command Processor\Autorun-----

-----HKCU\Software\Microsoft\Command Processor\Autorun-----

-----HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows\Load-----

-----HKLM\Software\Policies\Microsoft\Windows\System\Scripts\Startup-----

-----HKCU\Software\Policies\Microsoft\Windows\System\Scripts\Logon-----

-----HKLM\Software\Policies\Microsoft\Windows\System\Scripts\Logon-----

-----HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\TerminalServer\Install\Software\Microsoft\Windows\CurrentVersion\Runonce-----

-----HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\TerminalServer\Install\Software\Microsoft\Windows\CurrentVersion\Run-----

-----HKLM\System\CurrentControlSet\Control\Terminal Server\Wdsdpwd\StartupPrograms-----

-----HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\TerminalServer\Install\Software\Microsoft\Windows\CurrentVersion\Runonce-----

-----HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler-----

[SharedTaskScheduler]
  "{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Pré-chargeur Browseui"
    #### HKCR\CLSID\{438755C2-A8BA-11D1-B96B-00A0C90312E1}\InprocServer32 @=expand:"%SystemRoot%\system32\browseui.dll"
  "{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Démon de cache des catégories de composant"
    #### HKCR\CLSID\{8C7461EF-2B13-11d2-BE35-3078302C2030}\InprocServer32 @=expand:"%SystemRoot%\system32\browseui.dll"

-----HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects-----

[Browser Helper Objects]
  @=""

[Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
  @=""

[Browser Helper Objects\{53707962-6F74-2D53-2644-206D7942484F}]
    #### HKCR\CLSID\{53707962-6F74-2D53-2644-206D7942484F}\InprocServer32 @="C:\PROGRA~1\SPYBOT~1\SDHelper.dll"

[Browser Helper Objects\{7009fcd4-05be-44f4-9583-93fe419ab7b0}]
    #### HKCR\CLSID\{7009fcd4-05be-44f4-9583-93fe419ab7b0}\InprocServer32 @="C:\Program Files\Multi_Media_France	bMul0.dll"
  @=""

[Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
    #### HKCR\CLSID\{9030D464-4C02-4ABF-8ECC-5164760863C6}\InprocServer32 @="C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll"

-----HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks-----

[URLSearchHooks]
  "{CFBFAE00-17A6-11D0-99CB-00C04FD64497}"=""
    #### HKCR\CLSID\{CFBFAE00-17A6-11D0-99CB-00C04FD64497}\InprocServer32 @="C:\WINDOWS\system32\ieframe.dll"

-----HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig-----

-----HKCU\Control Panel\Desktop\-----

[Desktop]
  "SCRNSAVE.EXE"="C:\WINDOWS\system32\ssstars.scr"

[Desktop\WindowMetrics]

-----HKEY_CLASSES_ROOT\exefile\shell\open\command-----

[command]
  @="\"%1\" %*"

-----HKEY_CLASSES_ROOT\comfile\shell\open\command-----

[command]
  @="\"%1\" %*"

-----HKEY_CLASSES_ROOT\batfile\shell\open\command-----

[command]
  @="\"%1\" %*"

-----HKEY_CLASSES_ROOT\piffile\shell\open\command-----

[command]
  @="\"%1\" %*"

-----HKEY_CLASSES_ROOT\scrFile\shell\open\command-----

[command]
  @="\"%1\" %*"

-----HKEY_CLASSES_ROOT\htafile\shell\open\command-----

[Command]
  @="C:\WINDOWS\system32\mshta.exe \"%1\" %*"

-----HKEY_CLASSES_ROOT\logfile\shell\open\command-----

-----HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\URL-----

[URL]

[URL\DefaultPrefix]
  @="http://"

[URL\Prefixes]
  "ftp"="ftp://"
  "gopher"="gopher://"
  "home"="http://"
  "mosaic"="http://"
  "www"="http://"

-----HKLM\SYSTEM\CurrentControlSet\Control\Lsa-----

[Lsa]

[Lsa\AccessProviders]

[Lsa\AccessProviders\Windows NT Access Provider]
  "ProviderPath"=expand:"%SystemRoot%\system32
tmarta.dll"

[Lsa\Audit]

[Lsa\Audit\PerUserAuditing]

[Lsa\Audit\PerUserAuditing\System]

[Lsa\Data]

[Lsa\SSO]

[Lsa\SSO\Passport1.4]
  "SSOURL"="http://www.passport.com"

[Lsa\SspiCache]

[Lsa\SspiCache\digest.dll]
  "Name"="Digest"
  "Comment"="Digest SSPI Authentication Package"

[Lsa\SspiCache\msapsspc.dll]
  "Name"="DPA"
  "Comment"="DPA Security Package"

[Lsa\SspiCache\msnsspc.dll]
  "Name"="MSN"
  "Comment"="MSN Security Package"

-----HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess-----

[SharedAccess]
  "DependOnGroup"=multi:"\00"
  "DependOnService"=multi:"Netman\00WinMgmt\00\00"
  "Description"="Assure la traduction d'adresses de réseau, l'adressage, les services de résolution de noms et/ou les services de prévention d'intrusion pour un réseau de petite entreprise ou un réseau domestique."
  "DisplayName"="Pare-feu Windows / Partage de connexion Internet"
  "ErrorControl"=dword:00000001
  "ImagePath"=expand:"%SystemRoot%\system32\svchost.exe -k netsvcs"
  "ObjectName"="LocalSystem"
  "Start"=dword:00000002
  "Type"=dword:00000020

[SharedAccess\Epoch]
  "Epoch"=dword:00002473

[SharedAccess\Parameters]
  "ServiceDll"=expand:"%SystemRoot%\System32\ipnathlp.dll"

[SharedAccess\Parameters\FirewallPolicy]

[SharedAccess\Parameters\FirewallPolicy\DomainProfile]

[SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications]

[SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
  "%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enaxxxxx@xxxxxres.dll,-22019"
  "C:\Program Files\MSN Messenger\msnmsgr.exe"="C:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
  "C:\Program Files\MSN Messenger\livecall.exe"="C:\Program Files\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"
  "%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enaxxxxx@xxxxxres.dll,-20000"

[SharedAccess\Parameters\FirewallPolicy\StandardProfile]
  "EnableFirewall"=dword:00000001
  "DoNotAllowExceptions"=dword:00000000

[SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications]

[SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
  "%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enaxxxxx@xxxxxres.dll,-22019"
  "C:\Program Files\eMule\emule.exe"="C:\Program Files\eMule\emule.exe:*:Enabled:eMule"
  "C:\Program Files\MSN Messenger\msnmsgr.exe"="C:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
  "C:\Program Files\MSN Messenger\livecall.exe"="C:\Program Files\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"
  "C:\Program Files\Resolume 2.41esolume.exe"="C:\Program Files\Resolume 2.41esolume.exe:*:Enabled:Resolume 2.41"
  "C:\Program Files\Messenger\msmsgs.exe"="C:\Program Files\Messenger\msmsgs.exe:*:Enabled:Windows Messenger"
  "C:\Documents and Settings\Propriétaire\Local Settings\Temp\Rar$EX02.937\emule.exe"="C:\Documents and Settings\Propriétaire\Local Settings\Temp\Rar$EX02.937\emule.exe:*:Disabled:eMule"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\0exinjs.aa.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\0exinjs.aa.exe:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\22exinjs.aa.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\22exinjs.aa.exe:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\23exinjs.aa.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\23exinjs.aa.exe:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\83exinjs.aa.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\83exinjs.aa.exe:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\86exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\86exinjs.ab.exe:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\82exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\82exinjs.ab.exe:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\42exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\42exinjs.ab.exe:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\98exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\98exinjs.ab.exe:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\36exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\36exinjs.ab.exe:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\59exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\59exinjs.ab.exe:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\49exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\49exinjs.ab.exe:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\73exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\73exinjs.ab.exe:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\75exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\75exinjs.ab.exe:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\8exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\8exinjs.ab.exe:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\47exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\47exinjs.ab.exe:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\20exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\20exinjs.ab.exe:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\78exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\78exinjs.ab.exe:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\80exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\80exinjs.ab.exe:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\74exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\74exinjs.ab.exe:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\18exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\18exinjs.ab.exe:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\64exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\64exinjs.ab.exe:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\57exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\57exinjs.ab.exe:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\92exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\92exinjs.ab.exe:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\11exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\11exinjs.ab.exe:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\50exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\50exinjs.ab.exe:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\43exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\43exinjs.ab.exe:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\95exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\95exinjs.ab.exe:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\52exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\52exinjs.ab.exe:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\23exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\23exinjs.ab.exe:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\6exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\6exinjs.ab.exe:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\39exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\39exinjs.ab.exe:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\68exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\68exinjs.ab.exe:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\61exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\61exinjs.ab.exe:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\26exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\26exinjs.ab.exe:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\34exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\34exinjs.ab.exe:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\19exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\19exinjs.ab.exe:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\32exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\32exinjs.ab.exe:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\14exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\14exinjs.ab.exe:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\60exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\60exinjs.ab.exe:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\29exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\29exinjs.ab.exe:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\66exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\66exinjs.ab.exe:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\99exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\99exinjs.ab.exe:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\54exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\54exinjs.ab.exe:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\94exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\94exinjs.ab.exe:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\85exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\85exinjs.ab.exe:*:Enabled:Microsoft Update"
  "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe"="C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe:*:Disabled:Kaspersky Anti-Virus"
  "C:\Program Files\uTorrent\uTorrent.exe"="C:\Program Files\uTorrent\uTorrent.exe:*:Enabled:µTorrent"
  "C:\Program Files\BitDownload\BitDownload.exe"="C:\Program Files\BitDownload\BitDownload.exe:*:Enabled:Torrent P2P application"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\16ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\16ex:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\25ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\25ex:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\35ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\35ex:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\43ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\43ex:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\58ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\58ex:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\26ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\26ex:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\87ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\87ex:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\60ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\60ex:*:Enabled:Microsoft Update"
  "C:\Program Files\Ahead\Nero ShowTime\ShowTime.exe"="C:\Program Files\Ahead\Nero ShowTime\ShowTime.exe:*:Enabled:Nero ShowTime"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\44ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\44ex:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\50ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\50ex:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\7ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\7ex:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\42ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\42ex:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\3ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\3ex:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\21ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\21ex:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\40ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\40ex:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\2ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\2ex:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\4ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\4ex:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\65ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\65ex:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\37ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\37ex:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\31ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\31ex:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\72ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\72ex:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\92ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\92ex:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\68ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\68ex:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\45ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\45ex:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\96ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\96ex:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\33ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\33ex:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\79ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\79ex:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\10ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\10ex:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\22ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\22ex:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\55ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\55ex:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\66ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\66ex:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\94ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\94ex:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\52ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\52ex:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\0ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\0ex:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\63ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\63ex:*:Enabled:Microsoft Update"
  "C:\Documents and Settings\Propriétaire\Local Settings\Temp\10exmdnk23.exe"="C:\Documents and Settings\Propriétaire\Local Settings\Temp\10exmdnk23.exe:*:Disabled:10exmdnk23"
  "C:\Documents and Settings\Propriétaire\Local Settings\Temp\33exmdnk25.exe"="C:\Documents and Settings\Propriétaire\Local Settings\Temp\33exmdnk25.exe:*:Disabled:33exmdnk25"
  "C:\Documents and Settings\Propriétaire\Local Settings\Temp\0exmdnk26.exe"="C:\Documents and Settings\Propriétaire\Local Settings\Temp\0exmdnk26.exe:*:Disabled:0exmdnk26"
  "C:\Documents and Settings\Propriétaire\Local Settings\Temp\58exmdnk30.exe"="C:\Documents and Settings\Propriétaire\Local Settings\Temp\58exmdnk30.exe:*:Disabled:58exmdnk30"
  "C:\kav\kis7.0\french\setup.exe"="C:\kav\kis7.0\french\setup.exe:*:Enabled:Programme d'installation de Kaspersky Internet Security 7.0"
  "C:\kav\kav7.0\french\setup.exe"="C:\kav\kav7.0\french\setup.exe:*:Enabled:Programme d'installation de Kaspersky Anti-Virus 7.0"
  "%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enaxxxxx@xxxxxres.dll,-20000"

[SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts]

[SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
  "1900:UDP"="1900:UDP:LocalSubNet:Disaxxxxx@xxxxxres.dll,-22007"
  "2869:TCP"="2869:TCP:LocalSubNet:Disaxxxxx@xxxxxres.dll,-22008"
  "17053:TCP"="17053:TCP:*:Enabled:NortonAV"
  "12192:TCP"="12192:TCP:*:Enabled:NortonAV"

[SharedAccess\Setup]
  "ServiceUpgrade"=dword:00000001

[SharedAccess\Setup\InterfacesUnfirewalledAtUpdate]
  "All"=dword:00000001

-----HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Firewall\-----

-----HKEY_LOCAL_MACHINE\SOFTWARE\Winsock2-----

-----HKLM\Software\Microsoft\Ole-----

[Ole]
  "DefaultLaunchPermission"=hex:01,00,04,80,5c,00,00,00,6c,00,00,00,00,00,00,00,\
  "MachineLaunchRestriction"=hex:01,00,04,80,48,00,00,00,58,00,00,00,00,00,00,00,\
  "MachineAccessRestriction"=hex:01,00,04,80,44,00,00,00,54,00,00,00,00,00,00,00,\
  "EnableDCOM"="Y"

[Ole\AppCompat]

[Ole\AppCompat\ActivationSecurityCheckExemptionList]
  "{A50398B8-9075-4FBF-A7A1-456BF21937AD}"="1"
  "{AD65A69D-3831-40D7-9629-9B0B50A93843}"="1"
  "{0040D221-54A1-11D1-9DE0-006097042D69}"="1"
  "{2A6D72F1-6E7E-4702-B99C-E40D3DED33C3}"="1"

[Ole\NONREDIST]
  "System.EnterpriseServices.Thunk.dll"=""

-----HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WindowsUpdate\AU\-----

-----HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\-----

[Security Center]
  "FirstRunDisabled"=dword:00000001
  "AntiVirusDisableNotify"=dword:00000000
  "FirewallDisableNotify"=dword:00000000
  "UpdatesDisableNotify"=dword:00000000
  "AntiVirusOverride"=dword:00000001
  "FirewallOverride"=dword:00000000

[Security Center\Monitoring]

[Security Center\Monitoring\AhnlabAntiVirus]

[Security Center\Monitoring\ComputerAssociatesAntiVirus]

[Security Center\Monitoring\KasperskyAntiVirus]

[Security Center\Monitoring\McAfeeAntiVirus]

[Security Center\Monitoring\McAfeeFirewall]

[Security Center\Monitoring\PandaAntiVirus]

[Security Center\Monitoring\PandaFirewall]

[Security Center\Monitoring\SophosAntiVirus]

[Security Center\Monitoring\SymantecAntiVirus]

[Security Center\Monitoring\SymantecFirewall]

[Security Center\Monitoring\TinyFirewall]

[Security Center\Monitoring\TrendAntiVirus]

[Security Center\Monitoring\TrendFirewall]

[Security Center\Monitoring\ZoneLabsFirewall]

-----HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore\-----

[SystemRestore]
  "DisableSR"=dword:00000000
  "CreateFirstRunRp"=dword:00000001
  "DSMin"=dword:000000c8
  "DSMax"=dword:00000190
  "RPSessionInterval"=dword:00000000
  "RPGlobalInterval"=dword:00015180
  "RPLifeInterval"=dword:0076a700
  "CompressionBurst"=dword:0000003c
  "TimerInterval"=dword:00000078
  "DiskPercent"=dword:0000000c
  "ThawInterval"=dword:00000384
  "RestoreDiskSpaceError"=dword:00000000
  "RestoreStatus"=dword:00000000
  "RestoreSafeModeStatus"=dword:00000001

[SystemRestore\Cfg]
  "DiskPercent"=dword:0000000c
  "MachineGuid"="{D88DDE61-D342-465C-AFF5-295FBD9AB56F}"

[SystemRestore\SnapshotCallbacks]
  @=""

-----HKEY_CURRENT_USER\Software\VB and VBA Program Settings-----

[VB and VBA Program Settings]

[VB and VBA Program Settings\CCleaner]

[VB and VBA Program Settings\CCleaner\Options]

-----HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\-----

-----HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\AdvancedOptions-----

[AdvancedOptions]

-----HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\AdvancedOptions-----

-----HKLM\Software\Microsoft\Active Setup\Installed Components-----

[Installed Components]

[Installed Components\<{12d0ed0d-0ee0-4f90-8827-78cefb8f4988}]
  "@="IE7 Uninstall Stub"
  "ComponentID"="IEUDINIT"
  "StubPath"="C:\WINDOWS\system32\ieudinit.exe"

[Installed Components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}]
    #### HKCR\CLSID\{22d6f312-b0f6-11d0-94ab-0080c74c7e95}\InprocServer32 @="C:\WINDOWS\system32\wmpdxm.dll"
  "Stubpath"="C:\WINDOWS\inf\unregmp2.exe /ShowWMP"
  "@="Microsoft Windows Media Player"
  "ComponentID"="WMPACCESS"

[Installed Components\>{26923b43-4d38-484f-9b9e-de460746276c}]
  "@="Internet Explorer"
  "ComponentID"="IEACCESS"
  "StubPath"="C:\WINDOWS\system32\ie4uinit.exe -UserIconConfig"

[Installed Components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
  "@="Browser Customizations"
  "ComponentiD"="BRANDING.CAB"
  "StubPath"="RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP"

[Installed Components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS]
  "@="Personnalisation du navigateur"
  "ComponentID"="BRANDING.CAB"
  "StubPath"="RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP"

[Installed Components\>{881dd1c5-3dcf-431b-b061-f3f88e8be88a}]
  "@="Outlook Express"
  "ComponentID"="OEACCESS"
  "StubPath"=expand:"%systemroot%\system32\shmgrate.exe OCInstallUserConfigOE"

[Installed Components\{0E92DD42-76F5-4EF2-B381-F9C1D72BE23D}]
  "@="Security Update for Microsoft .NET Framework 2.0 (KB922770)"
  "ComponentID"="KB922770"

[Installed Components\{10072CEC-8CC1-11D1-986E-00A0C955B42F}]
  "@="Rendu VML (Vector Graphics Rendering)"
  "ComponentID"="MSVML"

[Installed Components\{2179C5D3-EBFF-11CF-B6FD-00AA00B4E220}]
    #### HKCR\CLSID\{2179C5D3-EBFF-11CF-B6FD-00AA00B4E220}\InprocServer32 @="C:\WINDOWS\system32\wmpdxm.dll"
  "ComponentID"="NetShow"
  "StubPath"=""

[Installed Components\{22d6f312-b0f6-11d0-94ab-0080c74c7e95}]
    #### HKCR\CLSID\{22d6f312-b0f6-11d0-94ab-0080c74c7e95}\InprocServer32 @="C:\WINDOWS\system32\wmpdxm.dll"
  "ComponentID"="Microsoft Windows Media Player"
  "StubPath"=""
  "@="Lecteur Windows Media Microsoft 6.4"

[Installed Components\{283807B5-2C60-11D0-A31D-00AA00B92C03}]
  "@="DirectAnimation"
  "ComponentID"="DirectAnimation"

[Installed Components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}]
  "@="Themes Setup"
  "ComponentID"="Theme Component"
  "StubPath"=expand:"%SystemRoot%\system32egsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32	hemeui.dll"

[Installed Components\{36f8ec70-c29a-11d1-b5c7-0000f8051515}]
  "@="Liaison de données Dynami

Utilisateur anonyme · Answer

Re ,

/!\ Manip crée spécialement pour cet utilisateur , ne pas reproduire chez soi ... /!\

Crée un nouveau document texte : clic droit de souris sur le bureau, "Nouveau"> "Document Texte". Ouvre-le et copie-colle dedans de ce qui est en citation en gras ci-dessous, (copie tout d'un trait) : ( y compris Regedit4, et la ligne vide en dessous )

REGEDIT4

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"MySpaceIM"=-
[HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Run]
"MySpaceIM"=-
[HKLM\Software\Microsoft\Windows\CurrentVersion\Run]
"Alcmtr"=-
"devenv"=-



Puis "fichier" -> "enregistrer sous" :
dans : sur le bureau
Nom du fichier : fix.reg
Type de fichier : "tous les fichiers"
clique sur "enregistrer"

Cela doit ressembler à ça

Double clique sur fix.reg 

&#8594; tu dois OBLIGATOIREMENT* avoir un message "voulez-vous vraiment ajouter les informations contenues dans ce fichier .reg au registre ?"
Si c'est bien le cas, clique sur "oui" 

*Prevenir si le message n'apparait pas.

Reposte un Systemscan par la suite.
a+

Sophie · Answer

SystemScan - www.suspectfile.com - ver. 3.5.5 (code: holifay & bReAkdOWn)

Running on: Windows XP HOME Edition, Service Pack 2 (2600.5.1)
System directory: C:\WINDOWS
SystemScan file: C:\Documents and Settings\Propriétaire\Local Settings\Temporary Internet Files\Content.IE5\X45LC4WY\sys48504[1].exe
Running in: User mode
Date: 06/11/2008
Time: 18:32:32
  
Output limited to: 
 -Recent files
 -Registry Run Keys
 -Suspicious Files

===================== RECENT FILES =====================

Showing files newer than  30 days

----- recent files in C:\
04/11/2008 18:14:33 (DIR)        0 byte      2 days old -- Deckard
06/11/2008 16:34:07      2145386496 byte      0 days old -- pagefile.sys
06/11/2008 16:54:38 (DIR)        0 byte      0 days old -- Program Files
06/11/2008 16:56:08 (DIR)        0 byte      0 days old -- Config.Msi
06/11/2008 17:05:02           1264 byte      0 days old -- TCleaner.txt
06/11/2008 17:07:31 (DIR)        0 byte      0 days old -- System Volume Information
06/11/2008 17:09:19 (DIR)        0 byte      0 days old -- ComboFix
06/11/2008 17:17:41           3660 byte      0 days old -- Bug.txt
06/11/2008 17:17:42 (DIR)        0 byte      0 days old -- Combo-Fix
06/11/2008 17:17:47 (DIR)        0 byte      0 days old -- WINDOWS

----- recent files in C:\WINDOWS\
04/11/2008 12:27:54 (DIR)        0 byte      2 days old -- Minidump
04/11/2008 12:47:51 (DIR)        0 byte      2 days old -- Tasks
04/11/2008 12:51:02              0 byte      2 days old -- setuperr.log
04/11/2008 12:53:08           9170 byte      2 days old -- KB943055Uninst.log
04/11/2008 18:14:42 (DIR)        0 byte      2 days old -- ERDNT
04/11/2008 20:49:01 (DIR)        0 byte      2 days old -- Debug
04/11/2008 20:49:46 (DIR)        0 byte      2 days old -- $NtUninstallKB943055$
04/11/2008 20:49:49          11413 byte      2 days old -- KB943055.log
04/11/2008 20:49:52 (DIR)        0 byte      2 days old -- $NtUninstallKB950749$
04/11/2008 20:49:56          14173 byte      2 days old -- KB950749.log
04/11/2008 20:49:58 (DIR)        0 byte      2 days old -- $NtUninstallKB945553$
04/11/2008 20:49:59          12373 byte      2 days old -- KB945553.log
04/11/2008 20:50:02 (DIR)        0 byte      2 days old -- $NtUninstallKB944338$
04/11/2008 20:50:03          13476 byte      2 days old -- KB944338.log
04/11/2008 20:50:05 (DIR)        0 byte      2 days old -- $NtUninstallKB948590$
04/11/2008 20:50:06          12774 byte      2 days old -- KB948590.log
04/11/2008 20:50:07 (DIR)        0 byte      2 days old -- $NtUninstallKB941693$
04/11/2008 20:50:09          12974 byte      2 days old -- KB941693.log
04/11/2008 20:50:13 (DIR)        0 byte      2 days old -- $NtUninstallKB947864$
04/11/2008 20:50:19          20085 byte      2 days old -- KB947864.log
04/11/2008 20:50:20 (DIR)        0 byte      2 days old -- $NtUninstallKB948881$
04/11/2008 20:50:22          11204 byte      2 days old -- KB948881.log
05/11/2008 12:58:01 (DIR)        0 byte      1 days old -- $NtUninstallKB904942$
05/11/2008 12:58:04          11030 byte      1 days old -- KB904942.log
05/11/2008 12:58:06 (DIR)        0 byte      1 days old -- $NtUninstallKB914440$
05/11/2008 12:58:07 (DIR)        0 byte      1 days old -- network diagnostic
05/11/2008 12:58:08           5198 byte      1 days old -- KB914440.log
05/11/2008 12:58:53 (DIR)        0 byte      1 days old -- $NtUninstallKB915865$
05/11/2008 12:58:57           6278 byte      1 days old -- KB915865.log
05/11/2008 12:59:06 (DIR)        0 byte      1 days old -- $NtServicePackUninstallNLSDownlevelMapping$
05/11/2008 12:59:09           7177 byte      1 days old -- NLSDownlevelMapping.log
05/11/2008 12:59:16 (DIR)        0 byte      1 days old -- $NtServicePackUninstallIDNMitigationAPIs$
05/11/2008 12:59:20           7485 byte      1 days old -- IDNMitigationAPIs.log
05/11/2008 13:00:09 (DIR)        0 byte      1 days old -- ie7
05/11/2008 13:00:17 (DIR)        0 byte      1 days old -- Media
05/11/2008 13:00:21 (DIR)        0 byte      1 days old -- WBEM
05/11/2008 13:00:27          57821 byte      1 days old -- ie7.log
05/11/2008 13:00:49 (DIR)        0 byte      1 days old -- ie7updates
05/11/2008 13:01:00          72190 byte      1 days old -- KB944533-IE7.log
05/11/2008 13:01:11          45658 byte      1 days old -- updspapi.log
05/11/2008 13:01:15          50000 byte      1 days old -- KB947864-IE7.log
05/11/2008 13:01:36          35377 byte      1 days old -- ie7_main.log
05/11/2008 13:02:42 (DIR)        0 byte      1 days old -- Help
05/11/2008 13:03:16           6286 byte      1 days old -- spupdsvc.log
05/11/2008 13:33:23             60 byte      1 days old -- setupact.log
05/11/2008 18:18:13         117714 byte      1 days old -- ntbtlog.txt
06/11/2008 09:00:51 (DIR)        0 byte      0 days old -- $hf_mig$
06/11/2008 09:17:30 (DIR)        0 byte      0 days old -- system
06/11/2008 10:18:12 (DIR)        0 byte      0 days old -- $NtUninstallKB932823-v3$
06/11/2008 10:18:18          10097 byte      0 days old -- KB932823-v3.log
06/11/2008 10:18:19           1374 byte      0 days old -- imsins.BAK
06/11/2008 10:18:25          75274 byte      0 days old -- ocgen.log
06/11/2008 10:18:25          56446 byte      0 days old -- tsoc.log
06/11/2008 10:18:25          48869 byte      0 days old -- setupapi.log
06/11/2008 10:18:25           8054 byte      0 days old -- ocmsn.log
06/11/2008 10:18:25           1374 byte      0 days old -- imsins.log
06/11/2008 10:18:25 (DIR)        0 byte      0 days old -- inf
06/11/2008 10:18:25          21821 byte      0 days old -- iis6.log
06/11/2008 10:18:25          48411 byte      0 days old -- comsetup.log
06/11/2008 10:18:25         139927 byte      0 days old -- FaxSetup.log
06/11/2008 10:18:25           7402 byte      0 days old -- msgsocm.log
06/11/2008 10:18:25          31031 byte      0 days old -- ntdtcsetup.log
06/11/2008 10:18:25          10950 byte      0 days old -- KB938127-IE7.log
06/11/2008 15:53:02 (DIR)        0 byte      0 days old -- Prefetch
06/11/2008 16:33:10          23478 byte      0 days old -- SchedLgU.Txt
06/11/2008 16:34:11           2048 byte      0 days old -- bootstat.dat
06/11/2008 16:34:12              0 byte      0 days old -- 0.log
06/11/2008 16:34:23             50 byte      0 days old -- wiaservc.log
06/11/2008 16:34:26            159 byte      0 days old -- wiadebug.log
06/11/2008 16:56:08 (DIR)        0 byte      0 days old -- WinSxS
06/11/2008 16:56:15 (DIR)        0 byte      0 days old -- Installer
06/11/2008 17:17:41 (DIR)        0 byte      0 days old -- system32
06/11/2008 17:39:27         698171 byte      0 days old -- WindowsUpdate.log
06/11/2008 17:48:32 (DIR)        0 byte      0 days old -- Temp

----- recent files in C:\WINDOWS\Downloaded Program Files\

----- recent files in C:\WINDOWS\system\

----- recent files in C:\WINDOWS\system32\
04/11/2008 12:11:54          13702 byte      2 days old -- wpa.dbl
04/11/2008 12:14:58        1070888 byte      2 days old -- PerfStringBackup.INI
04/11/2008 12:15:00          83620 byte      2 days old -- perfc00C.dat
04/11/2008 12:15:00          70106 byte      2 days old -- perfc009.dat
04/11/2008 12:15:00         485868 byte      2 days old -- perfh00C.dat
04/11/2008 12:15:00         418590 byte      2 days old -- perfh009.dat
05/11/2008 10:53:41          91888 byte      1 days old -- FNTCACHE.DAT
05/11/2008 13:00:55 (DIR)        0 byte      1 days old -- fr-fr
06/11/2008 10:18:24 (DIR)        0 byte      0 days old -- dllcache
06/11/2008 15:04:53 (DIR)        0 byte      0 days old -- CatRoot2
06/11/2008 16:20:13           3121 byte      0 days old -- CONFIG.NT
06/11/2008 16:28:07 (DIR)        0 byte      0 days old -- drivers
06/11/2008 17:07:31 (DIR)        0 byte      0 days old -- Restore

----- recent files in C:\WINDOWS\system32\drivers\

----- recent files in C:\WINDOWS	emp\
06/11/2008 16:17:38         965569 byte      0 days old -- fa56d7ec.$$$
06/11/2008 16:34:16          16384 byte      0 days old -- Perflib_Perfdata_658.dat
06/11/2008 17:48:32          16384 byte      0 days old -- Perflib_Perfdata_8ec.dat
06/11/2008 18:16:31 (DIR)        0 byte      0 days old -- _avast4_

----- recent files in C:\Program Files\
04/11/2008 12:44:13 (DIR)        0 byte      2 days old -- ATI Technologies
04/11/2008 12:55:53 (DIR)        0 byte      2 days old -- Windows Live Toolbar
05/11/2008 16:09:17 (DIR)        0 byte      1 days old -- eMule
05/11/2008 16:17:51 (DIR)        0 byte      1 days old -- Internet Explorer
05/11/2008 20:34:33 (DIR)        0 byte      1 days old -- Messenger
05/11/2008 20:34:33 (DIR)        0 byte      1 days old -- M-Audio Firewire Audiophile
05/11/2008 20:34:33 (DIR)        0 byte      1 days old -- DivX
05/11/2008 20:36:52 (DIR)        0 byte      1 days old -- MySpace
06/11/2008 15:02:36 (DIR)        0 byte      0 days old -- PKR
06/11/2008 16:55:02 (DIR)        0 byte      0 days old -- Fichiers communs
06/11/2008 16:56:30 (DIR)        0 byte      0 days old -- SPYWAREfighter
06/11/2008 17:04:44 (DIR)        0 byte      0 days old -- Trend Micro

----- recent files in C:\Program Files\Fichiers communs\
06/11/2008 16:55:02 (DIR)        0 byte      0 days old -- Application

----- recent files in C:\Documents and Settings\Propriétaire\Application Data\
04/11/2008 13:48:47 (DIR)        0 byte      2 days old -- Malwarebytes
05/11/2008 13:09:44 (DIR)        0 byte      1 days old -- SUPERAntiSpyware.com

----- recent files in C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\
04/11/2008 18:20:11          16384 byte      2 days old -- ~DF3333.tmp
04/11/2008 18:46:09         239104 byte      2 days old -- 71exhmunmlclr14.exe
04/11/2008 18:46:09         239104 byte      2 days old -- 75exhmunmlclr14.exe
04/11/2008 18:46:09         239104 byte      2 days old -- 88exhmunmlclr14.exe
04/11/2008 18:46:09         239104 byte      2 days old -- 24exhmunmlclr14.exe
04/11/2008 19:05:45          16384 byte      2 days old -- ~DF8B63.tmp
04/11/2008 19:14:04          32768 byte      2 days old -- ~DF3D4F.tmp
04/11/2008 20:48:26          16384 byte      2 days old -- ~DF6387.tmp
05/11/2008 11:05:41          22704 byte      1 days old -- Danish.bin
05/11/2008 11:05:41          25670 byte      1 days old -- Dutch.bin
05/11/2008 11:05:41          16913 byte      1 days old -- TradChin.bin
05/11/2008 11:05:41          24256 byte      1 days old -- Japanese.bin
05/11/2008 11:05:41          20101 byte      1 days old -- Korean.bin
05/11/2008 11:05:42          27178 byte      1 days old -- French.bin
05/11/2008 11:05:43          24028 byte      1 days old -- SWEDISH.bin
05/11/2008 11:05:43          25684 byte      1 days old -- German.bin
05/11/2008 11:05:43          26062 byte      1 days old -- Russian.bin
05/11/2008 11:05:43          27689 byte      1 days old -- Spanish.bin
05/11/2008 11:05:43          27330 byte      1 days old -- Italian.bin
05/11/2008 11:05:44          26187 byte      1 days old -- Portuguese.bin
05/11/2008 11:05:44          21913 byte      1 days old -- Thai.bin
05/11/2008 11:05:44          20919 byte      1 days old -- Arabic.bin
05/11/2008 11:05:44          21857 byte      1 days old -- English.bin
05/11/2008 11:05:44          16374 byte      1 days old -- SimChin.bin
05/11/2008 11:05:45          24999 byte      1 days old -- Portuguese(Brazil).bin
05/11/2008 11:05:45          24147 byte      1 days old -- Polish.bin
05/11/2008 11:05:45          25003 byte      1 days old -- Greek.bin
05/11/2008 11:05:45          24252 byte      1 days old -- Czech.bin
05/11/2008 11:05:46          22793 byte      1 days old -- Finnish.bin
05/11/2008 11:05:47          19487 byte      1 days old -- Hebrew.bin
05/11/2008 11:05:47          26001 byte      1 days old -- Hungarian.bin
05/11/2008 11:05:48          21901 byte      1 days old -- Norwegian.bin
05/11/2008 11:05:48          22194 byte      1 days old -- Turkish.bin
05/11/2008 11:27:14          32768 byte      1 days old -- ~DF6515.tmp
05/11/2008 11:31:17          16384 byte      1 days old -- ~DF9D46.tmp
05/11/2008 11:31:34          16384 byte      1 days old -- ~DF7191.tmp
05/11/2008 11:31:58          16384 byte      1 days old -- ~DF1672.tmp
05/11/2008 11:32:48          16384 byte      1 days old -- ~DFD13B.tmp
05/11/2008 11:33:22          16384 byte      1 days old -- ~DFA2FD.tmp
05/11/2008 11:42:31          32768 byte      1 days old -- ~DF638.tmp
05/11/2008 11:44:33          32768 byte      1 days old -- ~DF34FC.tmp
05/11/2008 11:49:16          16384 byte      1 days old -- ~DF2494.tmp
05/11/2008 11:49:16          16384 byte      1 days old -- ~DF23B5.tmp
05/11/2008 11:50:14          16384 byte      1 days old -- ~DF23C4.tmp
05/11/2008 11:53:30          16384 byte      1 days old -- ~DF45C4.tmp
05/11/2008 11:54:23          32768 byte      1 days old -- ~DF7AF.tmp
05/11/2008 11:57:13          16384 byte      1 days old -- ~DF214A.tmp
05/11/2008 11:57:40          32768 byte      1 days old -- ~DFD70B.tmp
05/11/2008 12:06:58          16384 byte      1 days old -- ~DFA66A.tmp
05/11/2008 12:09:48          32768 byte      1 days old -- ~DFB01E.tmp
05/11/2008 12:20:27          16384 byte      1 days old -- ~DF1DB1.tmp
05/11/2008 12:20:50          16384 byte      1 days old -- ~DFBA1E.tmp
05/11/2008 12:22:24          32768 byte      1 days old -- ~DF3E3D.tmp
05/11/2008 12:25:54          16384 byte      1 days old -- ~DF5412.tmp
05/11/2008 12:26:21          32768 byte      1 days old -- ~DF150A.tmp
05/11/2008 12:28:38          32768 byte      1 days old -- ~DF60E8.tmp
05/11/2008 12:30:18          32768 byte      1 days old -- ~DF6AD1.tmp
05/11/2008 12:34:10          16384 byte      1 days old -- ~DFEBB.tmp
05/11/2008 12:50:14          32768 byte      1 days old -- ~DF8F7A.tmp
05/11/2008 12:51:34          16384 byte      1 days old -- ~DFFCE4.tmp
05/11/2008 13:03:17             54 byte      1 days old -- hmunmlclr14.exe.conf
05/11/2008 13:06:05          16384 byte      1 days old -- ~DF3079.tmp
05/11/2008 13:07:32          16384 byte      1 days old -- ~DF4070.tmp
05/11/2008 13:09:58          16384 byte      1 days old -- ~DF8638.tmp
05/11/2008 13:11:45          16384 byte      1 days old -- ~DF1BF6.tmp
05/11/2008 13:11:46              0 byte      1 days old -- 88313.dmp
05/11/2008 13:12:32          16384 byte      1 days old -- ~DF9948.tmp
05/11/2008 13:12:49          16384 byte      1 days old -- ~DF430A.tmp
05/11/2008 13:14:44          16384 byte      1 days old -- ~DF8882.tmp
05/11/2008 13:30:14          16316 byte      1 days old -- 6394_appcompat.txt
05/11/2008 13:30:20          75860 byte      1 days old -- 196E60.dmp
05/11/2008 13:30:50 (DIR)        0 byte      1 days old -- WERe1a5.dir00
05/11/2008 13:30:50 (DIR)        0 byte      1 days old -- WERea67.dir00
05/11/2008 13:32:24          16384 byte      1 days old -- ~DF7932.tmp
05/11/2008 13:33:08 (DIR)        0 byte      1 days old -- WERf61a.dir00
05/11/2008 13:39:59          16384 byte      1 days old -- ~DFD7EB.tmp
05/11/2008 13:40:18 (DIR)        0 byte      1 days old -- WER8f52.dir00
05/11/2008 13:40:20 (DIR)        0 byte      1 days old -- WER918b.dir00
05/11/2008 13:43:22          16384 byte      1 days old -- ~DFDB6A.tmp
05/11/2008 13:43:50          32298 byte      1 days old -- de41_appcompat.txt
05/11/2008 13:44:49 (DIR)        0 byte      1 days old -- ~nsu.tmp
05/11/2008 13:53:45          16384 byte      1 days old -- ~DFEEDF.tmp
05/11/2008 13:53:56          16384 byte      1 days old -- Perflib_Perfdata_808.dat
05/11/2008 13:54:45 (DIR)        0 byte      1 days old -- WER3a07.dir00
05/11/2008 13:56:10          16384 byte      1 days old -- ~DF5FA5.tmp
05/11/2008 13:57:24          16384 byte      1 days old -- ~DF536A.tmp
05/11/2008 13:57:59          16384 byte      1 days old -- ~DF4193.tmp
05/11/2008 13:59:31          16384 byte      1 days old -- ~DF7F9F.tmp
05/11/2008 14:01:28          16384 byte      1 days old -- ~DF89.tmp
05/11/2008 14:02:16          16384 byte      1 days old -- ~DF34F.tmp
05/11/2008 15:08:31         239104 byte      1 days old -- 46exhmunmlclr15.exe
05/11/2008 15:08:31         239104 byte      1 days old -- 60exhmunmlclr15.exe
05/11/2008 15:08:31         239104 byte      1 days old -- 79exhmunmlclr15.exe
05/11/2008 15:47:47          16384 byte      1 days old -- ~DF2136.tmp
05/11/2008 15:48:43          16316 byte      1 days old -- efda_appcompat.txt
05/11/2008 15:48:48          79711 byte      1 days old -- 2FB0F.dmp
05/11/2008 15:48:53          16384 byte      1 days old -- ~DF9F2B.tmp
05/11/2008 15:51:44          10144 byte      1 days old -- MPC5.tmp
05/11/2008 15:54:52          16384 byte      1 days old -- ~DFC6BC.tmp
05/11/2008 16:09:05             54 byte      1 days old -- hmunmlclr15.exe.conf
05/11/2008 16:13:12          16384 byte      1 days old -- ~DF6329.tmp
05/11/2008 16:18:17          16384 byte      1 days old -- ~DFBFC8.tmp
05/11/2008 16:18:33          16384 byte      1 days old -- ~DF7EC1.tmp
05/11/2008 16:19:06          16384 byte      1 days old -- ~DF16CD.tmp
05/11/2008 16:21:01          32768 byte      1 days old -- ~DF18AE.tmp
05/11/2008 16:31:24 (DIR)        0 byte      1 days old -- {E09B48B5-E141-427A-AB0C-D3605127224A}
05/11/2008 16:35:48          16384 byte      1 days old -- ~DFE243.tmp
05/11/2008 16:39:53          16384 byte      1 days old -- ~DF9898.tmp
05/11/2008 16:40:07          16384 byte      1 days old -- ~DF4EDB.tmp
05/11/2008 16:41:25          16384 byte      1 days old -- ~DF5CB1.tmp
05/11/2008 18:58:45          32768 byte      1 days old -- ~DF84C.tmp
05/11/2008 20:54:31          16384 byte      1 days old -- ~DF1F42.tmp
05/11/2008 20:54:57          16384 byte      1 days old -- ~DF7E1A.tmp
06/11/2008 09:10:34          16384 byte      0 days old -- ~DFF265.tmp
06/11/2008 09:11:12          16384 byte      0 days old -- ~DFC471.tmp
06/11/2008 09:13:00          32768 byte      0 days old -- ~DFCC98.tmp
06/11/2008 09:20:46          32768 byte      0 days old -- ~DFF5DB.tmp
06/11/2008 09:29:12          32768 byte      0 days old -- ~DF2C5F.tmp
06/11/2008 09:35:02          32768 byte      0 days old -- ~DF9840.tmp
06/11/2008 10:00:04          32768 byte      0 days old -- ~DF4304.tmp
06/11/2008 10:08:16          16384 byte      0 days old -- ~DFA144.tmp
06/11/2008 14:52:12          16384 byte      0 days old -- ~DF60BA.tmp
06/11/2008 14:54:17          32768 byte      0 days old -- ~DFACD8.tmp
06/11/2008 15:02:40          16384 byte      0 days old -- ~DF3CC3.tmp
06/11/2008 15:09:50          16384 byte      0 days old -- ~DFF540.tmp
06/11/2008 15:10:17          32768 byte      0 days old -- ~DFC9B4.tmp
06/11/2008 15:12:34          16384 byte      0 days old -- ~DF490C.tmp
06/11/2008 15:13:29          32768 byte      0 days old -- ~DFC226.tmp
06/11/2008 15:29:11           9450 byte      0 days old -- caevents.log
06/11/2008 15:35:01          16384 byte      0 days old -- ~DF41F7.tmp
06/11/2008 15:39:08          16384 byte      0 days old -- ~DFAA9.tmp
06/11/2008 15:40:37          16384 byte      0 days old -- ~DF7B1F.tmp
06/11/2008 15:41:13         311296 byte      0 days old -- ~DF1CE7.tmp
06/11/2008 15:43:01          32768 byte      0 days old -- ~DF4734.tmp
06/11/2008 15:58:44          16384 byte      0 days old -- ~DF3D3C.tmp
06/11/2008 15:59:27          16384 byte      0 days old -- ~DF98B.tmp
06/11/2008 16:00:06          32768 byte      0 days old -- ~DF172F.tmp
06/11/2008 16:10:56          16384 byte      0 days old -- ~DFD933.tmp
06/11/2008 16:11:18          16384 byte      0 days old -- ~DF9687.tmp
06/11/2008 16:12:14 (DIR)        0 byte      0 days old -- AVSETUP_4913094e
06/11/2008 16:13:05          32768 byte      0 days old -- ~DFE54A.tmp
06/11/2008 16:15:30          16384 byte      0 days old -- ~DF9A12.tmp
06/11/2008 16:15:43          32768 byte      0 days old -- ~DFEFB6.tmp
06/11/2008 16:20:14 (DIR)        0 byte      0 days old -- _avast4_
06/11/2008 16:24:21          16384 byte      0 days old -- ~DFE2D5.tmp
06/11/2008 16:25:23          16384 byte      0 days old -- ~DF5EFD.tmp
06/11/2008 16:26:07          16384 byte      0 days old -- ~DFF440.tmp
06/11/2008 16:29:07          16384 byte      0 days old -- ~DFED0F.tmp
06/11/2008 16:31:14          16384 byte      0 days old -- ~DF3471.tmp
06/11/2008 16:31:50          16384 byte      0 days old -- ~DFD017.tmp
06/11/2008 16:34:47          16384 byte      0 days old -- Perflib_Perfdata_a00.dat
06/11/2008 16:34:51          16384 byte      0 days old -- Perflib_Perfdata_da4.dat
06/11/2008 16:34:51          16384 byte      0 days old -- Perflib_Perfdata_dac.dat
06/11/2008 16:54:17              0 byte      0 days old -- is6.tmp
06/11/2008 16:54:36              0 byte      0 days old -- isA.tmp
06/11/2008 16:58:05          49152 byte      0 days old -- ~DF4FF4.tmp
06/11/2008 17:05:33          32768 byte      0 days old -- ~DF1D19.tmp
06/11/2008 17:09:48          32768 byte      0 days old -- ~DF2612.tmp
06/11/2008 17:14:09          32768 byte      0 days old -- ~DF1B2A.tmp
06/11/2008 17:24:18          32768 byte      0 days old -- ~DF3066.tmp
06/11/2008 17:26:00          32768 byte      0 days old -- ~DF659E.tmp
06/11/2008 17:32:19 (DIR)        0 byte      0 days old -- nsl3D.tmp
06/11/2008 17:35:01          32768 byte      0 days old -- ~DF7908.tmp
06/11/2008 18:18:49          32768 byte      0 days old -- ~DFA314.tmp
06/11/2008 18:31:43          16384 byte      0 days old -- ~DFD00C.tmp
06/11/2008 18:31:43 (DIR)        0 byte      0 days old -- nsq3F.tmp
06/11/2008 18:31:43            115 byte      0 days old -- systemscan.ini

===================== REGISTRY SCAN =====================


-----HKLM\Software\Microsoft\Windows\CurrentVersion\Run-----

[Run]
  "ATICCC"="\"C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe\""
  "NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe"
  "MAFWTaskbarApp"="C:\WINDOWS\system32\MAFWTray.exe"
  "RTHDCPL"="RTHDCPL.EXE"
  "SkyTel"="SkyTel.EXE"
  "Alcmtr"="ALCMTR.EXE"
  "PKR Pal"="\"C:\Program Files\PKR\pkrpal.exe\" -osboot"
  "H2O"="C:\Program Files\SyncroSoft\Pos\H2O\cledx.exe"
  "devenv"="C:\WINDOWS\system\smvss.exe /w"
  "FLMOFFICE4DMOUSE"="C:\Program Files\Trust\DS-4500X Wireless Laser Deskset\Mouse\mouse32a.exe"
  "OFFICEKB"="C:\Program Files\Trust\DS-4500X Wireless Laser Deskset\Keyboard\kbdap32a.EXE"
  "avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe"
  "spywarefighterguard"="C:\Program Files\SPYWAREfighter\spftray.exe"
  @=""

[Run\avp6_post_uninstall]

[Run\OptionalComponents]
  @=""

[Run\OptionalComponents\IMAIL]
  "Installed"="1"
  @=""

[Run\OptionalComponents\MAPI]
  "NoChange"="1"
  "Installed"="1"
  @=""

[Run\OptionalComponents\MSFS]
  "Installed"="1"
  @=""

-----HKCU\Software\Microsoft\Windows\CurrentVersion\Run-----

[Run]
  "MsnMsgr"="\"C:\Program Files\MSN Messenger\MsnMsgr.Exe\" /background"
  "MySpaceIM"="C:\Program Files\MySpace\IM\MySpaceIM.exe"
  "SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe"
  "SUPERAntiSpyware"="C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe"
  "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe"

-----HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Run-----

[Run]

-----HKLM\Software\Microsoft\Windows\CurrentVersion\policies\Explorer\Run-----

[Run]

-----HKCU\Software\Microsoft\Windows\CurrentVersion\policies\Explorer\Run-----

[Run]

-----HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows-----

[Windows]
  "AppInit_DLLs"=""

-----HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad-----

[ShellServiceObjectDelayLoad]
  "PostBootReminder"="{7849596a-48ea-486e-8937-a2a3009f31a9}"
    #### HKCR\CLSID\{7849596a-48ea-486e-8937-a2a3009f31a9}\InprocServer32 @=expand:"%SystemRoot%\system32\SHELL32.dll"
  "CDBurn"="{fbeb8a05-beee-4442-804e-409d6c4515e9}"
    #### HKCR\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InprocServer32 @=expand:"%SystemRoot%\system32\SHELL32.dll"
  "WebCheck"="{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"
    #### HKCR\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\InprocServer32 @=expand:"C:\WINDOWS\system32\webcheck.dll"
  "SysTray"="{35CEC8A3-2BE6-11D2-8773-92E220524153}"
    #### HKCR\CLSID\{35CEC8A3-2BE6-11D2-8773-92E220524153}\InprocServer32 @="C:\WINDOWS\system32\stobject.dll"

-----HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks-----

[ShellExecuteHooks]
  "{AEB6717E-7E19-11d0-97EE-00C04FD91972}"=""
    #### HKCR\CLSID\{AEB6717E-7E19-11d0-97EE-00C04FD91972}\InprocServer32 @="shell32.dll"

-----HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon-----

[Winlogon]
  "Shell"="Explorer.exe"
  "System"=""
  "Userinit"="C:\WINDOWS\system32\userinit.exe,"
  "VmApplet"="rundll32 shell32,Control_RunDLL \"sysdm.cpl\""
  "UIHost"=expand:"logonui.exe"
  "LogonType"=dword:00000001
  "WinStationsDisabled"="0"

[Winlogon\GPExtensions]

[Winlogon\GPExtensions\{3610eda5-77ef-11d2-8dc5-00c04fa31a66}]
  "@="Quota du disque Microsoft"
  "DllName"=expand:"dskquota.dll"

[Winlogon\GPExtensions\{4CFB60C1-FAA6-47f1-89AA-0B18730C9FD3}]
  "@="Internet Explorer Zonemapping"
  "DllName"=expand:"iedkcs32.dll"

[Winlogon\GPExtensions\{827D319E-6EAC-11D2-A4EA-00C04F79F83A}]
  "DllName"=expand:"scecli.dll"
  "@="Security"

[Winlogon\GPExtensions\{A2E30F80-D7DE-11d2-BBDE-00C04F86AE3B}]
  "DllName"="iedkcs32.dll"
  "@="Internet Explorer Branding"

[Winlogon\GPExtensions\{B1BE8D72-6EAC-11D2-A4EA-00C04F79F83A}]
  "DllName"=expand:"scecli.dll"
  "@="EFS recovery"

[Winlogon\GPExtensions\{C631DF4C-088F-4156-B058-4375F0853CD8}]
  "@="Microsoft Offline Files"
  "DllName"=expand:"%SystemRoot%\System32\cscui.dll"

[Winlogon\GPExtensions\{c6dc5466-785a-11d2-84d0-00c04fb169f7}]
  "@="Installation de logiciel"
  "DllName"=expand:"appmgmts.dll"

[Winlogon\Notify]

[Winlogon\Notify\!SASWinLogon]

[Winlogon\Notify\AtiExtEvent]
  "DLLName"="Ati2evxx.dll"

[Winlogon\Notify\crypt32chain]
  "DllName"=expand:"crypt32.dll"

[Winlogon\Notify\cryptnet]
  "DllName"=expand:"cryptnet.dll"

[Winlogon\Notify\cscdll]
  "DLLName"="cscdll.dll"

[Winlogon\Notify\ScCertProp]
  "DLLName"="wlnotify.dll"

[Winlogon\Notify\Schedule]
  "DllName"=expand:"wlnotify.dll"

[Winlogon\Notify\sclgntfy]
  "DllName"=expand:"sclgntfy.dll"

[Winlogon\Notify\SensLogn]
  "DLLName"="WlNotify.dll"

[Winlogon\Notify	ermsrv]
  "DllName"=expand:"wlnotify.dll"

[Winlogon\Notify\wlballoon]
  "DLLName"="wlnotify.dll"

[Winlogon\SpecialAccounts]

[Winlogon\SpecialAccounts\UserList]
  "HelpAssistant"=dword:00000000
  "TsInternetUser"=dword:00000000
  "SQLAgentCmdExec"=dword:00000000
  "NetShowServices"=dword:00000000
  "IWAM_"=dword:00010000
  "IUSR_"=dword:00010000
  "VUSR_"=dword:00010000

-----HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon-----

[Winlogon]
  "ParseAutoexec"="1"
  "ExcludeProfileDirs"="Local Settings;Temporary Internet Files;Historique;Temp"
  "BuildNumber"=dword:00000a28

-----HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options-----

[Image File Execution Options\Your Image File Name Here without a path]
  "Debugger"="ntsd -d"

-----HKLM\System\CurrentControlSet\Control\Session Manager\-----

[Session Manager]
  "BootExecute"=multi:"autocheck autochk *\00\00"

[Session Manager\SubSystems]
  "Windows"=expand:"%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,3072,512 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ProfileControl=Off MaxRequestThreads=16"

-----HKLM\SYSTEM\CurrentControlSet\Control\WOW-----

[WOW]
  "cmdline"=expand:"%SystemRoot%\system32
tvdm.exe"
  "wowcmdline"=expand:"%SystemRoot%\system32
tvdm.exe -a %SystemRoot%\system32\krnl386"

-----HKLM\Software\Microsoft\Windows NT\CurrentVersion\Run-----

[run]

-----HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce-----

[RunOnce]

-----HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx-----

[RunOnceEx]

-----HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices-----

[RunServices]

-----HKLM\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce-----

[RunServicesOnce]

-----HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce-----

[RunOnce]

-----HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnceEx-----

-----HKCU\Software\Microsoft\Windows\CurrentVersion\RunServices-----

[RunServices]

-----HKCU\Software\Microsoft\Windows NT\CurrentVersion\Run-----

-----HKCU\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce-----

[RunServicesOnce]

-----HKLM\Software\Microsoft\Command Processor\Autorun-----

-----HKCU\Software\Microsoft\Command Processor\Autorun-----

-----HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows\Load-----

-----HKLM\Software\Policies\Microsoft\Windows\System\Scripts\Startup-----

-----HKCU\Software\Policies\Microsoft\Windows\System\Scripts\Logon-----

-----HKLM\Software\Policies\Microsoft\Windows\System\Scripts\Logon-----

-----HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\TerminalServer\Install\Software\Microsoft\Windows\CurrentVersion\Runonce-----

-----HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\TerminalServer\Install\Software\Microsoft\Windows\CurrentVersion\Run-----

-----HKLM\System\CurrentControlSet\Control\Terminal Server\Wdsdpwd\StartupPrograms-----

-----HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\TerminalServer\Install\Software\Microsoft\Windows\CurrentVersion\Runonce-----

-----HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler-----

[SharedTaskScheduler]
  "{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Pré-chargeur Browseui"
    #### HKCR\CLSID\{438755C2-A8BA-11D1-B96B-00A0C90312E1}\InprocServer32 @=expand:"%SystemRoot%\system32\browseui.dll"
  "{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Démon de cache des catégories de composant"
    #### HKCR\CLSID\{8C7461EF-2B13-11d2-BE35-3078302C2030}\InprocServer32 @=expand:"%SystemRoot%\system32\browseui.dll"

-----HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects-----

[Browser Helper Objects]
  @=""

[Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
  @=""

[Browser Helper Objects\{53707962-6F74-2D53-2644-206D7942484F}]
    #### HKCR\CLSID\{53707962-6F74-2D53-2644-206D7942484F}\InprocServer32 @="C:\PROGRA~1\SPYBOT~1\SDHelper.dll"

[Browser Helper Objects\{7009fcd4-05be-44f4-9583-93fe419ab7b0}]
    #### HKCR\CLSID\{7009fcd4-05be-44f4-9583-93fe419ab7b0}\InprocServer32 @="C:\Program Files\Multi_Media_France	bMul0.dll"
  @=""

[Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
    #### HKCR\CLSID\{9030D464-4C02-4ABF-8ECC-5164760863C6}\InprocServer32 @="C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll"

-----HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks-----

[URLSearchHooks]
  "{CFBFAE00-17A6-11D0-99CB-00C04FD64497}"=""
    #### HKCR\CLSID\{CFBFAE00-17A6-11D0-99CB-00C04FD64497}\InprocServer32 @="C:\WINDOWS\system32\ieframe.dll"

-----HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig-----

-----HKCU\Control Panel\Desktop\-----

[Desktop]
  "SCRNSAVE.EXE"="C:\WINDOWS\system32\ssstars.scr"

[Desktop\WindowMetrics]

-----HKEY_CLASSES_ROOT\exefile\shell\open\command-----

[command]
  @="\"%1\" %*"

-----HKEY_CLASSES_ROOT\comfile\shell\open\command-----

[command]
  @="\"%1\" %*"

-----HKEY_CLASSES_ROOT\batfile\shell\open\command-----

[command]
  @="\"%1\" %*"

-----HKEY_CLASSES_ROOT\piffile\shell\open\command-----

[command]
  @="\"%1\" %*"

-----HKEY_CLASSES_ROOT\scrFile\shell\open\command-----

[command]
  @="\"%1\" %*"

-----HKEY_CLASSES_ROOT\htafile\shell\open\command-----

[Command]
  @="C:\WINDOWS\system32\mshta.exe \"%1\" %*"

-----HKEY_CLASSES_ROOT\logfile\shell\open\command-----

-----HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\URL-----

[URL]

[URL\DefaultPrefix]
  @="http://"

[URL\Prefixes]
  "ftp"="ftp://"
  "gopher"="gopher://"
  "home"="http://"
  "mosaic"="http://"
  "www"="http://"

-----HKLM\SYSTEM\CurrentControlSet\Control\Lsa-----

[Lsa]

[Lsa\AccessProviders]

[Lsa\AccessProviders\Windows NT Access Provider]
  "ProviderPath"=expand:"%SystemRoot%\system32
tmarta.dll"

[Lsa\Audit]

[Lsa\Audit\PerUserAuditing]

[Lsa\Audit\PerUserAuditing\System]

[Lsa\Data]

[Lsa\SSO]

[Lsa\SSO\Passport1.4]
  "SSOURL"="http://www.passport.com"

[Lsa\SspiCache]

[Lsa\SspiCache\digest.dll]
  "Name"="Digest"
  "Comment"="Digest SSPI Authentication Package"

[Lsa\SspiCache\msapsspc.dll]
  "Name"="DPA"
  "Comment"="DPA Security Package"

[Lsa\SspiCache\msnsspc.dll]
  "Name"="MSN"
  "Comment"="MSN Security Package"

-----HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess-----

[SharedAccess]
  "DependOnGroup"=multi:"\00"
  "DependOnService"=multi:"Netman\00WinMgmt\00\00"
  "Description"="Assure la traduction d'adresses de réseau, l'adressage, les services de résolution de noms et/ou les services de prévention d'intrusion pour un réseau de petite entreprise ou un réseau domestique."
  "DisplayName"="Pare-feu Windows / Partage de connexion Internet"
  "ErrorControl"=dword:00000001
  "ImagePath"=expand:"%SystemRoot%\system32\svchost.exe -k netsvcs"
  "ObjectName"="LocalSystem"
  "Start"=dword:00000002
  "Type"=dword:00000020

[SharedAccess\Epoch]
  "Epoch"=dword:00002473

[SharedAccess\Parameters]
  "ServiceDll"=expand:"%SystemRoot%\System32\ipnathlp.dll"

[SharedAccess\Parameters\FirewallPolicy]

[SharedAccess\Parameters\FirewallPolicy\DomainProfile]

[SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications]

[SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
  "%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enaxxxxx@xxxxxres.dll,-22019"
  "C:\Program Files\MSN Messenger\msnmsgr.exe"="C:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
  "C:\Program Files\MSN Messenger\livecall.exe"="C:\Program Files\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"
  "%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enaxxxxx@xxxxxres.dll,-20000"

[SharedAccess\Parameters\FirewallPolicy\StandardProfile]
  "EnableFirewall"=dword:00000001
  "DoNotAllowExceptions"=dword:00000000

[SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications]

[SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
  "%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enaxxxxx@xxxxxres.dll,-22019"
  "C:\Program Files\eMule\emule.exe"="C:\Program Files\eMule\emule.exe:*:Enabled:eMule"
  "C:\Program Files\MSN Messenger\msnmsgr.exe"="C:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
  "C:\Program Files\MSN Messenger\livecall.exe"="C:\Program Files\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"
  "C:\Program Files\Resolume 2.41esolume.exe"="C:\Program Files\Resolume 2.41esolume.exe:*:Enabled:Resolume 2.41"
  "C:\Program Files\Messenger\msmsgs.exe"="C:\Program Files\Messenger\msmsgs.exe:*:Enabled:Windows Messenger"
  "C:\Documents and Settings\Propriétaire\Local Settings\Temp\Rar$EX02.937\emule.exe"="C:\Documents and Settings\Propriétaire\Local Settings\Temp\Rar$EX02.937\emule.exe:*:Disabled:eMule"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\0exinjs.aa.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\0exinjs.aa.exe:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\22exinjs.aa.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\22exinjs.aa.exe:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\23exinjs.aa.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\23exinjs.aa.exe:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\83exinjs.aa.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\83exinjs.aa.exe:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\86exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\86exinjs.ab.exe:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\82exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\82exinjs.ab.exe:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\42exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\42exinjs.ab.exe:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\98exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\98exinjs.ab.exe:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\36exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\36exinjs.ab.exe:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\59exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\59exinjs.ab.exe:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\49exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\49exinjs.ab.exe:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\73exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\73exinjs.ab.exe:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\75exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\75exinjs.ab.exe:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\8exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\8exinjs.ab.exe:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\47exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\47exinjs.ab.exe:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\20exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\20exinjs.ab.exe:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\78exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\78exinjs.ab.exe:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\80exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\80exinjs.ab.exe:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\74exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\74exinjs.ab.exe:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\18exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\18exinjs.ab.exe:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\64exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\64exinjs.ab.exe:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\57exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\57exinjs.ab.exe:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\92exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\92exinjs.ab.exe:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\11exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\11exinjs.ab.exe:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\50exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\50exinjs.ab.exe:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\43exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\43exinjs.ab.exe:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\95exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\95exinjs.ab.exe:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\52exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\52exinjs.ab.exe:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\23exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\23exinjs.ab.exe:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\6exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\6exinjs.ab.exe:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\39exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\39exinjs.ab.exe:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\68exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\68exinjs.ab.exe:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\61exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\61exinjs.ab.exe:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\26exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\26exinjs.ab.exe:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\34exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\34exinjs.ab.exe:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\19exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\19exinjs.ab.exe:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\32exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\32exinjs.ab.exe:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\14exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\14exinjs.ab.exe:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\60exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\60exinjs.ab.exe:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\29exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\29exinjs.ab.exe:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\66exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\66exinjs.ab.exe:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\99exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\99exinjs.ab.exe:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\54exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\54exinjs.ab.exe:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\94exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\94exinjs.ab.exe:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\85exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\85exinjs.ab.exe:*:Enabled:Microsoft Update"
  "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe"="C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe:*:Disabled:Kaspersky Anti-Virus"
  "C:\Program Files\uTorrent\uTorrent.exe"="C:\Program Files\uTorrent\uTorrent.exe:*:Enabled:µTorrent"
  "C:\Program Files\BitDownload\BitDownload.exe"="C:\Program Files\BitDownload\BitDownload.exe:*:Enabled:Torrent P2P application"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\16ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\16ex:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\25ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\25ex:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\35ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\35ex:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\43ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\43ex:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\58ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\58ex:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\26ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\26ex:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\87ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\87ex:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\60ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\60ex:*:Enabled:Microsoft Update"
  "C:\Program Files\Ahead\Nero ShowTime\ShowTime.exe"="C:\Program Files\Ahead\Nero ShowTime\ShowTime.exe:*:Enabled:Nero ShowTime"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\44ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\44ex:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\50ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\50ex:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\7ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\7ex:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\42ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\42ex:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\3ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\3ex:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\21ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\21ex:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\40ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\40ex:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\2ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\2ex:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\4ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\4ex:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\65ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\65ex:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\37ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\37ex:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\31ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\31ex:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\72ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\72ex:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\92ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\92ex:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\68ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\68ex:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\45ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\45ex:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\96ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\96ex:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\33ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\33ex:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\79ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\79ex:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\10ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\10ex:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\22ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\22ex:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\55ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\55ex:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\66ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\66ex:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\94ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\94ex:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\52ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\52ex:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\0ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\0ex:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\63ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\63ex:*:Enabled:Microsoft Update"
  "C:\Documents and Settings\Propriétaire\Local Settings\Temp\10exmdnk23.exe"="C:\Documents and Settings\Propriétaire\Local Settings\Temp\10exmdnk23.exe:*:Disabled:10exmdnk23"
  "C:\Documents and Settings\Propriétaire\Local Settings\Temp\33exmdnk25.exe"="C:\Documents and Settings\Propriétaire\Local Settings\Temp\33exmdnk25.exe:*:Disabled:33exmdnk25"
  "C:\Documents and Settings\Propriétaire\Local Settings\Temp\0exmdnk26.exe"="C:\Documents and Settings\Propriétaire\Local Settings\Temp\0exmdnk26.exe:*:Disabled:0exmdnk26"
  "C:\Documents and Settings\Propriétaire\Local Settings\Temp\58exmdnk30.exe"="C:\Documents and Settings\Propriétaire\Local Settings\Temp\58exmdnk30.exe:*:Disabled:58exmdnk30"
  "C:\kav\kis7.0\french\setup.exe"="C:\kav\kis7.0\french\setup.exe:*:Enabled:Programme d'installation de Kaspersky Internet Security 7.0"
  "C:\kav\kav7.0\french\setup.exe"="C:\kav\kav7.0\french\setup.exe:*:Enabled:Programme d'installation de Kaspersky Anti-Virus 7.0"
  "%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enaxxxxx@xxxxxres.dll,-20000"

[SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts]

[SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
  "1900:UDP"="1900:UDP:LocalSubNet:Disaxxxxx@xxxxxres.dll,-22007"
  "2869:TCP"="2869:TCP:LocalSubNet:Disaxxxxx@xxxxxres.dll,-22008"
  "17053:TCP"="17053:TCP:*:Enabled:NortonAV"
  "12192:TCP"="12192:TCP:*:Enabled:NortonAV"

[SharedAccess\Setup]
  "ServiceUpgrade"=dword:00000001

[SharedAccess\Setup\InterfacesUnfirewalledAtUpdate]
  "All"=dword:00000001

-----HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Firewall\-----

-----HKEY_LOCAL_MACHINE\SOFTWARE\Winsock2-----

-----HKLM\Software\Microsoft\Ole-----

[Ole]
  "DefaultLaunchPermission"=hex:01,00,04,80,5c,00,00,00,6c,00,00,00,00,00,00,00,\
  "MachineLaunchRestriction"=hex:01,00,04,80,48,00,00,00,58,00,00,00,00,00,00,00,\
  "MachineAccessRestriction"=hex:01,00,04,80,44,00,00,00,54,00,00,00,00,00,00,00,\
  "EnableDCOM"="Y"

[Ole\AppCompat]

[Ole\AppCompat\ActivationSecurityCheckExemptionList]
  "{A50398B8-9075-4FBF-A7A1-456BF21937AD}"="1"
  "{AD65A69D-3831-40D7-9629-9B0B50A93843}"="1"
  "{0040D221-54A1-11D1-9DE0-006097042D69}"="1"
  "{2A6D72F1-6E7E-4702-B99C-E40D3DED33C3}"="1"

[Ole\NONREDIST]
  "System.EnterpriseServices.Thunk.dll"=""

-----HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WindowsUpdate\AU\-----

-----HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\-----

[Security Center]
  "FirstRunDisabled"=dword:00000001
  "AntiVirusDisableNotify"=dword:00000000
  "FirewallDisableNotify"=dword:00000000
  "UpdatesDisableNotify"=dword:00000000
  "AntiVirusOverride"=dword:00000001
  "FirewallOverride"=dword:00000000

[Security Center\Monitoring]

[Security Center\Monitoring\AhnlabAntiVirus]

[Security Center\Monitoring\ComputerAssociatesAntiVirus]

[Security Center\Monitoring\KasperskyAntiVirus]

[Security Center\Monitoring\McAfeeAntiVirus]

[Security Center\Monitoring\McAfeeFirewall]

[Security Center\Monitoring\PandaAntiVirus]

[Security Center\Monitoring\PandaFirewall]

[Security Center\Monitoring\SophosAntiVirus]

[Security Center\Monitoring\SymantecAntiVirus]

[Security Center\Monitoring\SymantecFirewall]

[Security Center\Monitoring\TinyFirewall]

[Security Center\Monitoring\TrendAntiVirus]

[Security Center\Monitoring\TrendFirewall]

[Security Center\Monitoring\ZoneLabsFirewall]

-----HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore\-----

[SystemRestore]
  "DisableSR"=dword:00000000
  "CreateFirstRunRp"=dword:00000001
  "DSMin"=dword:000000c8
  "DSMax"=dword:00000190
  "RPSessionInterval"=dword:00000000
  "RPGlobalInterval"=dword:00015180
  "RPLifeInterval"=dword:0076a700
  "CompressionBurst"=dword:0000003c
  "TimerInterval"=dword:00000078
  "DiskPercent"=dword:0000000c
  "ThawInterval"=dword:00000384
  "RestoreDiskSpaceError"=dword:00000000
  "RestoreStatus"=dword:00000000
  "RestoreSafeModeStatus"=dword:00000001

[SystemRestore\Cfg]
  "DiskPercent"=dword:0000000c
  "MachineGuid"="{D88DDE61-D342-465C-AFF5-295FBD9AB56F}"

[SystemRestore\SnapshotCallbacks]
  @=""

-----HKEY_CURRENT_USER\Software\VB and VBA Program Settings-----

[VB and VBA Program Settings]

[VB and VBA Program Settings\CCleaner]

[VB and VBA Program Settings\CCleaner\Options]

-----HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\-----

-----HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\AdvancedOptions-----

[AdvancedOptions]

-----HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\AdvancedOptions-----

-----HKLM\Software\Microsoft\Active Setup\Installed Components-----

[Installed Components]

[Installed Components\<{12d0ed0d-0ee0-4f90-8827-78cefb8f4988}]
  "@="IE7 Uninstall Stub"
  "ComponentID"="IEUDINIT"
  "StubPath"="C:\WINDOWS\system32\ieudinit.exe"

[Installed Components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}]
    #### HKCR\CLSID\{22d6f312-b0f6-11d0-94ab-0080c74c7e95}\InprocServer32 @="C:\WINDOWS\system32\wmpdxm.dll"
  "Stubpath"="C:\WINDOWS\inf\unregmp2.exe /ShowWMP"
  "@="Microsoft Windows Media Player"
  "ComponentID"="WMPACCESS"

[Installed Components\>{26923b43-4d38-484f-9b9e-de460746276c}]
  "@="Internet Explorer"
  "ComponentID"="IEACCESS"
  "StubPath"="C:\WINDOWS\system32\ie4uinit.exe -UserIconConfig"

[Installed Components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
  "@="Browser Customizations"
  "ComponentiD"="BRANDING.CAB"
  "StubPath"="RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP"

[Installed Components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS]
  "@="Personnalisation du navigateur"
  "ComponentID"="BRANDING.CAB"
  "StubPath"="RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP"

[Installed Components\>{881dd1c5-3dcf-431b-b061-f3f88e8be88a}]
  "@="Outlook Express"
  "ComponentID"="OEACCESS"
  "StubPath"=expand:"%systemroot%\system32\shmgrate.exe OCInstallUserConfigOE"

[Installed Components\{0E92DD42-76F5-4EF2-B381-F9C1D72BE23D}]
  "@="Security Update for Microsoft .NET Framework 2.0 (KB922770)"
  "ComponentID"="KB922770"

[Installed Components\{10072CEC-8CC1-11D1-986E-00A0C955B42F}]
  "@="Rendu VML (Vector Graphics Rendering)"
  "ComponentID"="MSVML"

[Installed Components\{2179C5D3-EBFF-11CF-B6FD-00AA00B4E220}]
    #### HKCR\CLSID\{2179C5D3-EBFF-11CF-B6FD-00AA00B4E220}\InprocServer32 @="C:\WINDOWS\system32\wmpdxm.dll"
  "ComponentID"="NetShow"
  "StubPath"=""

[Installed Components\{22d6f312-b0f6-11d0-94ab-0080c74c7e95}]
    #### HKCR\CLSID\{22d6f312-b0f6-11d0-94ab-0080c74c7e95}\InprocServer32 @="C:\WINDOWS\system32\wmpdxm.dll"
  "ComponentID"="Microsoft Windows Media Player"
  "StubPath"=""
  "@="Lecteur Windows Media Microsoft 6.4"

[Installed Components\{283807B5-2C60-11D0-A31D-00AA00B92C03}]
  "@="DirectAnimation"
  "ComponentID"="DirectAnimation"

[Installed Components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}]
  "@="Themes Setup"
  "ComponentID"="Theme Component"
  "StubPath"=expand:"%SystemRoot%\system32egsvr32.exe /s /n /i:/UserInstall %Syst

Sophie · Answer

SystemScan - www.suspectfile.com - ver. 3.5.5 (code: holifay & bReAkdOWn)

Running on: Windows XP HOME Edition, Service Pack 2 (2600.5.1)
System directory: C:\WINDOWS
SystemScan file: C:\Documents and Settings\Propriétaire\Local Settings\Temporary Internet Files\Content.IE5\X45LC4WY\sys48504[1].exe
Running in: User mode
Date: 06/11/2008
Time: 18:32:32
  
Output limited to: 
 -Recent files
 -Registry Run Keys
 -Suspicious Files

===================== RECENT FILES =====================

Showing files newer than  30 days

----- recent files in C:\
04/11/2008 18:14:33 (DIR)        0 byte      2 days old -- Deckard
06/11/2008 16:34:07      2145386496 byte      0 days old -- pagefile.sys
06/11/2008 16:54:38 (DIR)        0 byte      0 days old -- Program Files
06/11/2008 16:56:08 (DIR)        0 byte      0 days old -- Config.Msi
06/11/2008 17:05:02           1264 byte      0 days old -- TCleaner.txt
06/11/2008 17:07:31 (DIR)        0 byte      0 days old -- System Volume Information
06/11/2008 17:09:19 (DIR)        0 byte      0 days old -- ComboFix
06/11/2008 17:17:41           3660 byte      0 days old -- Bug.txt
06/11/2008 17:17:42 (DIR)        0 byte      0 days old -- Combo-Fix
06/11/2008 17:17:47 (DIR)        0 byte      0 days old -- WINDOWS

----- recent files in C:\WINDOWS\
04/11/2008 12:27:54 (DIR)        0 byte      2 days old -- Minidump
04/11/2008 12:47:51 (DIR)        0 byte      2 days old -- Tasks
04/11/2008 12:51:02              0 byte      2 days old -- setuperr.log
04/11/2008 12:53:08           9170 byte      2 days old -- KB943055Uninst.log
04/11/2008 18:14:42 (DIR)        0 byte      2 days old -- ERDNT
04/11/2008 20:49:01 (DIR)        0 byte      2 days old -- Debug
04/11/2008 20:49:46 (DIR)        0 byte      2 days old -- $NtUninstallKB943055$
04/11/2008 20:49:49          11413 byte      2 days old -- KB943055.log
04/11/2008 20:49:52 (DIR)        0 byte      2 days old -- $NtUninstallKB950749$
04/11/2008 20:49:56          14173 byte      2 days old -- KB950749.log
04/11/2008 20:49:58 (DIR)        0 byte      2 days old -- $NtUninstallKB945553$
04/11/2008 20:49:59          12373 byte      2 days old -- KB945553.log
04/11/2008 20:50:02 (DIR)        0 byte      2 days old -- $NtUninstallKB944338$
04/11/2008 20:50:03          13476 byte      2 days old -- KB944338.log
04/11/2008 20:50:05 (DIR)        0 byte      2 days old -- $NtUninstallKB948590$
04/11/2008 20:50:06          12774 byte      2 days old -- KB948590.log
04/11/2008 20:50:07 (DIR)        0 byte      2 days old -- $NtUninstallKB941693$
04/11/2008 20:50:09          12974 byte      2 days old -- KB941693.log
04/11/2008 20:50:13 (DIR)        0 byte      2 days old -- $NtUninstallKB947864$
04/11/2008 20:50:19          20085 byte      2 days old -- KB947864.log
04/11/2008 20:50:20 (DIR)        0 byte      2 days old -- $NtUninstallKB948881$
04/11/2008 20:50:22          11204 byte      2 days old -- KB948881.log
05/11/2008 12:58:01 (DIR)        0 byte      1 days old -- $NtUninstallKB904942$
05/11/2008 12:58:04          11030 byte      1 days old -- KB904942.log
05/11/2008 12:58:06 (DIR)        0 byte      1 days old -- $NtUninstallKB914440$
05/11/2008 12:58:07 (DIR)        0 byte      1 days old -- network diagnostic
05/11/2008 12:58:08           5198 byte      1 days old -- KB914440.log
05/11/2008 12:58:53 (DIR)        0 byte      1 days old -- $NtUninstallKB915865$
05/11/2008 12:58:57           6278 byte      1 days old -- KB915865.log
05/11/2008 12:59:06 (DIR)        0 byte      1 days old -- $NtServicePackUninstallNLSDownlevelMapping$
05/11/2008 12:59:09           7177 byte      1 days old -- NLSDownlevelMapping.log
05/11/2008 12:59:16 (DIR)        0 byte      1 days old -- $NtServicePackUninstallIDNMitigationAPIs$
05/11/2008 12:59:20           7485 byte      1 days old -- IDNMitigationAPIs.log
05/11/2008 13:00:09 (DIR)        0 byte      1 days old -- ie7
05/11/2008 13:00:17 (DIR)        0 byte      1 days old -- Media
05/11/2008 13:00:21 (DIR)        0 byte      1 days old -- WBEM
05/11/2008 13:00:27          57821 byte      1 days old -- ie7.log
05/11/2008 13:00:49 (DIR)        0 byte      1 days old -- ie7updates
05/11/2008 13:01:00          72190 byte      1 days old -- KB944533-IE7.log
05/11/2008 13:01:11          45658 byte      1 days old -- updspapi.log
05/11/2008 13:01:15          50000 byte      1 days old -- KB947864-IE7.log
05/11/2008 13:01:36          35377 byte      1 days old -- ie7_main.log
05/11/2008 13:02:42 (DIR)        0 byte      1 days old -- Help
05/11/2008 13:03:16           6286 byte      1 days old -- spupdsvc.log
05/11/2008 13:33:23             60 byte      1 days old -- setupact.log
05/11/2008 18:18:13         117714 byte      1 days old -- ntbtlog.txt
06/11/2008 09:00:51 (DIR)        0 byte      0 days old -- $hf_mig$
06/11/2008 09:17:30 (DIR)        0 byte      0 days old -- system
06/11/2008 10:18:12 (DIR)        0 byte      0 days old -- $NtUninstallKB932823-v3$
06/11/2008 10:18:18          10097 byte      0 days old -- KB932823-v3.log
06/11/2008 10:18:19           1374 byte      0 days old -- imsins.BAK
06/11/2008 10:18:25          75274 byte      0 days old -- ocgen.log
06/11/2008 10:18:25          56446 byte      0 days old -- tsoc.log
06/11/2008 10:18:25          48869 byte      0 days old -- setupapi.log
06/11/2008 10:18:25           8054 byte      0 days old -- ocmsn.log
06/11/2008 10:18:25           1374 byte      0 days old -- imsins.log
06/11/2008 10:18:25 (DIR)        0 byte      0 days old -- inf
06/11/2008 10:18:25          21821 byte      0 days old -- iis6.log
06/11/2008 10:18:25          48411 byte      0 days old -- comsetup.log
06/11/2008 10:18:25         139927 byte      0 days old -- FaxSetup.log
06/11/2008 10:18:25           7402 byte      0 days old -- msgsocm.log
06/11/2008 10:18:25          31031 byte      0 days old -- ntdtcsetup.log
06/11/2008 10:18:25          10950 byte      0 days old -- KB938127-IE7.log
06/11/2008 15:53:02 (DIR)        0 byte      0 days old -- Prefetch
06/11/2008 16:33:10          23478 byte      0 days old -- SchedLgU.Txt
06/11/2008 16:34:11           2048 byte      0 days old -- bootstat.dat
06/11/2008 16:34:12              0 byte      0 days old -- 0.log
06/11/2008 16:34:23             50 byte      0 days old -- wiaservc.log
06/11/2008 16:34:26            159 byte      0 days old -- wiadebug.log
06/11/2008 16:56:08 (DIR)        0 byte      0 days old -- WinSxS
06/11/2008 16:56:15 (DIR)        0 byte      0 days old -- Installer
06/11/2008 17:17:41 (DIR)        0 byte      0 days old -- system32
06/11/2008 17:39:27         698171 byte      0 days old -- WindowsUpdate.log
06/11/2008 17:48:32 (DIR)        0 byte      0 days old -- Temp

----- recent files in C:\WINDOWS\Downloaded Program Files\

----- recent files in C:\WINDOWS\system\

----- recent files in C:\WINDOWS\system32\
04/11/2008 12:11:54          13702 byte      2 days old -- wpa.dbl
04/11/2008 12:14:58        1070888 byte      2 days old -- PerfStringBackup.INI
04/11/2008 12:15:00          83620 byte      2 days old -- perfc00C.dat
04/11/2008 12:15:00          70106 byte      2 days old -- perfc009.dat
04/11/2008 12:15:00         485868 byte      2 days old -- perfh00C.dat
04/11/2008 12:15:00         418590 byte      2 days old -- perfh009.dat
05/11/2008 10:53:41          91888 byte      1 days old -- FNTCACHE.DAT
05/11/2008 13:00:55 (DIR)        0 byte      1 days old -- fr-fr
06/11/2008 10:18:24 (DIR)        0 byte      0 days old -- dllcache
06/11/2008 15:04:53 (DIR)        0 byte      0 days old -- CatRoot2
06/11/2008 16:20:13           3121 byte      0 days old -- CONFIG.NT
06/11/2008 16:28:07 (DIR)        0 byte      0 days old -- drivers
06/11/2008 17:07:31 (DIR)        0 byte      0 days old -- Restore

----- recent files in C:\WINDOWS\system32\drivers\

----- recent files in C:\WINDOWS	emp\
06/11/2008 16:17:38         965569 byte      0 days old -- fa56d7ec.$$$
06/11/2008 16:34:16          16384 byte      0 days old -- Perflib_Perfdata_658.dat
06/11/2008 17:48:32          16384 byte      0 days old -- Perflib_Perfdata_8ec.dat
06/11/2008 18:16:31 (DIR)        0 byte      0 days old -- _avast4_

----- recent files in C:\Program Files\
04/11/2008 12:44:13 (DIR)        0 byte      2 days old -- ATI Technologies
04/11/2008 12:55:53 (DIR)        0 byte      2 days old -- Windows Live Toolbar
05/11/2008 16:09:17 (DIR)        0 byte      1 days old -- eMule
05/11/2008 16:17:51 (DIR)        0 byte      1 days old -- Internet Explorer
05/11/2008 20:34:33 (DIR)        0 byte      1 days old -- Messenger
05/11/2008 20:34:33 (DIR)        0 byte      1 days old -- M-Audio Firewire Audiophile
05/11/2008 20:34:33 (DIR)        0 byte      1 days old -- DivX
05/11/2008 20:36:52 (DIR)        0 byte      1 days old -- MySpace
06/11/2008 15:02:36 (DIR)        0 byte      0 days old -- PKR
06/11/2008 16:55:02 (DIR)        0 byte      0 days old -- Fichiers communs
06/11/2008 16:56:30 (DIR)        0 byte      0 days old -- SPYWAREfighter
06/11/2008 17:04:44 (DIR)        0 byte      0 days old -- Trend Micro

----- recent files in C:\Program Files\Fichiers communs\
06/11/2008 16:55:02 (DIR)        0 byte      0 days old -- Application

----- recent files in C:\Documents and Settings\Propriétaire\Application Data\
04/11/2008 13:48:47 (DIR)        0 byte      2 days old -- Malwarebytes
05/11/2008 13:09:44 (DIR)        0 byte      1 days old -- SUPERAntiSpyware.com

----- recent files in C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\
04/11/2008 18:20:11          16384 byte      2 days old -- ~DF3333.tmp
04/11/2008 18:46:09         239104 byte      2 days old -- 71exhmunmlclr14.exe
04/11/2008 18:46:09         239104 byte      2 days old -- 75exhmunmlclr14.exe
04/11/2008 18:46:09         239104 byte      2 days old -- 88exhmunmlclr14.exe
04/11/2008 18:46:09         239104 byte      2 days old -- 24exhmunmlclr14.exe
04/11/2008 19:05:45          16384 byte      2 days old -- ~DF8B63.tmp
04/11/2008 19:14:04          32768 byte      2 days old -- ~DF3D4F.tmp
04/11/2008 20:48:26          16384 byte      2 days old -- ~DF6387.tmp
05/11/2008 11:05:41          22704 byte      1 days old -- Danish.bin
05/11/2008 11:05:41          25670 byte      1 days old -- Dutch.bin
05/11/2008 11:05:41          16913 byte      1 days old -- TradChin.bin
05/11/2008 11:05:41          24256 byte      1 days old -- Japanese.bin
05/11/2008 11:05:41          20101 byte      1 days old -- Korean.bin
05/11/2008 11:05:42          27178 byte      1 days old -- French.bin
05/11/2008 11:05:43          24028 byte      1 days old -- SWEDISH.bin
05/11/2008 11:05:43          25684 byte      1 days old -- German.bin
05/11/2008 11:05:43          26062 byte      1 days old -- Russian.bin
05/11/2008 11:05:43          27689 byte      1 days old -- Spanish.bin
05/11/2008 11:05:43          27330 byte      1 days old -- Italian.bin
05/11/2008 11:05:44          26187 byte      1 days old -- Portuguese.bin
05/11/2008 11:05:44          21913 byte      1 days old -- Thai.bin
05/11/2008 11:05:44          20919 byte      1 days old -- Arabic.bin
05/11/2008 11:05:44          21857 byte      1 days old -- English.bin
05/11/2008 11:05:44          16374 byte      1 days old -- SimChin.bin
05/11/2008 11:05:45          24999 byte      1 days old -- Portuguese(Brazil).bin
05/11/2008 11:05:45          24147 byte      1 days old -- Polish.bin
05/11/2008 11:05:45          25003 byte      1 days old -- Greek.bin
05/11/2008 11:05:45          24252 byte      1 days old -- Czech.bin
05/11/2008 11:05:46          22793 byte      1 days old -- Finnish.bin
05/11/2008 11:05:47          19487 byte      1 days old -- Hebrew.bin
05/11/2008 11:05:47          26001 byte      1 days old -- Hungarian.bin
05/11/2008 11:05:48          21901 byte      1 days old -- Norwegian.bin
05/11/2008 11:05:48          22194 byte      1 days old -- Turkish.bin
05/11/2008 11:27:14          32768 byte      1 days old -- ~DF6515.tmp
05/11/2008 11:31:17          16384 byte      1 days old -- ~DF9D46.tmp
05/11/2008 11:31:34          16384 byte      1 days old -- ~DF7191.tmp
05/11/2008 11:31:58          16384 byte      1 days old -- ~DF1672.tmp
05/11/2008 11:32:48          16384 byte      1 days old -- ~DFD13B.tmp
05/11/2008 11:33:22          16384 byte      1 days old -- ~DFA2FD.tmp
05/11/2008 11:42:31          32768 byte      1 days old -- ~DF638.tmp
05/11/2008 11:44:33          32768 byte      1 days old -- ~DF34FC.tmp
05/11/2008 11:49:16          16384 byte      1 days old -- ~DF2494.tmp
05/11/2008 11:49:16          16384 byte      1 days old -- ~DF23B5.tmp
05/11/2008 11:50:14          16384 byte      1 days old -- ~DF23C4.tmp
05/11/2008 11:53:30          16384 byte      1 days old -- ~DF45C4.tmp
05/11/2008 11:54:23          32768 byte      1 days old -- ~DF7AF.tmp
05/11/2008 11:57:13          16384 byte      1 days old -- ~DF214A.tmp
05/11/2008 11:57:40          32768 byte      1 days old -- ~DFD70B.tmp
05/11/2008 12:06:58          16384 byte      1 days old -- ~DFA66A.tmp
05/11/2008 12:09:48          32768 byte      1 days old -- ~DFB01E.tmp
05/11/2008 12:20:27          16384 byte      1 days old -- ~DF1DB1.tmp
05/11/2008 12:20:50          16384 byte      1 days old -- ~DFBA1E.tmp
05/11/2008 12:22:24          32768 byte      1 days old -- ~DF3E3D.tmp
05/11/2008 12:25:54          16384 byte      1 days old -- ~DF5412.tmp
05/11/2008 12:26:21          32768 byte      1 days old -- ~DF150A.tmp
05/11/2008 12:28:38          32768 byte      1 days old -- ~DF60E8.tmp
05/11/2008 12:30:18          32768 byte      1 days old -- ~DF6AD1.tmp
05/11/2008 12:34:10          16384 byte      1 days old -- ~DFEBB.tmp
05/11/2008 12:50:14          32768 byte      1 days old -- ~DF8F7A.tmp
05/11/2008 12:51:34          16384 byte      1 days old -- ~DFFCE4.tmp
05/11/2008 13:03:17             54 byte      1 days old -- hmunmlclr14.exe.conf
05/11/2008 13:06:05          16384 byte      1 days old -- ~DF3079.tmp
05/11/2008 13:07:32          16384 byte      1 days old -- ~DF4070.tmp
05/11/2008 13:09:58          16384 byte      1 days old -- ~DF8638.tmp
05/11/2008 13:11:45          16384 byte      1 days old -- ~DF1BF6.tmp
05/11/2008 13:11:46              0 byte      1 days old -- 88313.dmp
05/11/2008 13:12:32          16384 byte      1 days old -- ~DF9948.tmp
05/11/2008 13:12:49          16384 byte      1 days old -- ~DF430A.tmp
05/11/2008 13:14:44          16384 byte      1 days old -- ~DF8882.tmp
05/11/2008 13:30:14          16316 byte      1 days old -- 6394_appcompat.txt
05/11/2008 13:30:20          75860 byte      1 days old -- 196E60.dmp
05/11/2008 13:30:50 (DIR)        0 byte      1 days old -- WERe1a5.dir00
05/11/2008 13:30:50 (DIR)        0 byte      1 days old -- WERea67.dir00
05/11/2008 13:32:24          16384 byte      1 days old -- ~DF7932.tmp
05/11/2008 13:33:08 (DIR)        0 byte      1 days old -- WERf61a.dir00
05/11/2008 13:39:59          16384 byte      1 days old -- ~DFD7EB.tmp
05/11/2008 13:40:18 (DIR)        0 byte      1 days old -- WER8f52.dir00
05/11/2008 13:40:20 (DIR)        0 byte      1 days old -- WER918b.dir00
05/11/2008 13:43:22          16384 byte      1 days old -- ~DFDB6A.tmp
05/11/2008 13:43:50          32298 byte      1 days old -- de41_appcompat.txt
05/11/2008 13:44:49 (DIR)        0 byte      1 days old -- ~nsu.tmp
05/11/2008 13:53:45          16384 byte      1 days old -- ~DFEEDF.tmp
05/11/2008 13:53:56          16384 byte      1 days old -- Perflib_Perfdata_808.dat
05/11/2008 13:54:45 (DIR)        0 byte      1 days old -- WER3a07.dir00
05/11/2008 13:56:10          16384 byte      1 days old -- ~DF5FA5.tmp
05/11/2008 13:57:24          16384 byte      1 days old -- ~DF536A.tmp
05/11/2008 13:57:59          16384 byte      1 days old -- ~DF4193.tmp
05/11/2008 13:59:31          16384 byte      1 days old -- ~DF7F9F.tmp
05/11/2008 14:01:28          16384 byte      1 days old -- ~DF89.tmp
05/11/2008 14:02:16          16384 byte      1 days old -- ~DF34F.tmp
05/11/2008 15:08:31         239104 byte      1 days old -- 46exhmunmlclr15.exe
05/11/2008 15:08:31         239104 byte      1 days old -- 60exhmunmlclr15.exe
05/11/2008 15:08:31         239104 byte      1 days old -- 79exhmunmlclr15.exe
05/11/2008 15:47:47          16384 byte      1 days old -- ~DF2136.tmp
05/11/2008 15:48:43          16316 byte      1 days old -- efda_appcompat.txt
05/11/2008 15:48:48          79711 byte      1 days old -- 2FB0F.dmp
05/11/2008 15:48:53          16384 byte      1 days old -- ~DF9F2B.tmp
05/11/2008 15:51:44          10144 byte      1 days old -- MPC5.tmp
05/11/2008 15:54:52          16384 byte      1 days old -- ~DFC6BC.tmp
05/11/2008 16:09:05             54 byte      1 days old -- hmunmlclr15.exe.conf
05/11/2008 16:13:12          16384 byte      1 days old -- ~DF6329.tmp
05/11/2008 16:18:17          16384 byte      1 days old -- ~DFBFC8.tmp
05/11/2008 16:18:33          16384 byte      1 days old -- ~DF7EC1.tmp
05/11/2008 16:19:06          16384 byte      1 days old -- ~DF16CD.tmp
05/11/2008 16:21:01          32768 byte      1 days old -- ~DF18AE.tmp
05/11/2008 16:31:24 (DIR)        0 byte      1 days old -- {E09B48B5-E141-427A-AB0C-D3605127224A}
05/11/2008 16:35:48          16384 byte      1 days old -- ~DFE243.tmp
05/11/2008 16:39:53          16384 byte      1 days old -- ~DF9898.tmp
05/11/2008 16:40:07          16384 byte      1 days old -- ~DF4EDB.tmp
05/11/2008 16:41:25          16384 byte      1 days old -- ~DF5CB1.tmp
05/11/2008 18:58:45          32768 byte      1 days old -- ~DF84C.tmp
05/11/2008 20:54:31          16384 byte      1 days old -- ~DF1F42.tmp
05/11/2008 20:54:57          16384 byte      1 days old -- ~DF7E1A.tmp
06/11/2008 09:10:34          16384 byte      0 days old -- ~DFF265.tmp
06/11/2008 09:11:12          16384 byte      0 days old -- ~DFC471.tmp
06/11/2008 09:13:00          32768 byte      0 days old -- ~DFCC98.tmp
06/11/2008 09:20:46          32768 byte      0 days old -- ~DFF5DB.tmp
06/11/2008 09:29:12          32768 byte      0 days old -- ~DF2C5F.tmp
06/11/2008 09:35:02          32768 byte      0 days old -- ~DF9840.tmp
06/11/2008 10:00:04          32768 byte      0 days old -- ~DF4304.tmp
06/11/2008 10:08:16          16384 byte      0 days old -- ~DFA144.tmp
06/11/2008 14:52:12          16384 byte      0 days old -- ~DF60BA.tmp
06/11/2008 14:54:17          32768 byte      0 days old -- ~DFACD8.tmp
06/11/2008 15:02:40          16384 byte      0 days old -- ~DF3CC3.tmp
06/11/2008 15:09:50          16384 byte      0 days old -- ~DFF540.tmp
06/11/2008 15:10:17          32768 byte      0 days old -- ~DFC9B4.tmp
06/11/2008 15:12:34          16384 byte      0 days old -- ~DF490C.tmp
06/11/2008 15:13:29          32768 byte      0 days old -- ~DFC226.tmp
06/11/2008 15:29:11           9450 byte      0 days old -- caevents.log
06/11/2008 15:35:01          16384 byte      0 days old -- ~DF41F7.tmp
06/11/2008 15:39:08          16384 byte      0 days old -- ~DFAA9.tmp
06/11/2008 15:40:37          16384 byte      0 days old -- ~DF7B1F.tmp
06/11/2008 15:41:13         311296 byte      0 days old -- ~DF1CE7.tmp
06/11/2008 15:43:01          32768 byte      0 days old -- ~DF4734.tmp
06/11/2008 15:58:44          16384 byte      0 days old -- ~DF3D3C.tmp
06/11/2008 15:59:27          16384 byte      0 days old -- ~DF98B.tmp
06/11/2008 16:00:06          32768 byte      0 days old -- ~DF172F.tmp
06/11/2008 16:10:56          16384 byte      0 days old -- ~DFD933.tmp
06/11/2008 16:11:18          16384 byte      0 days old -- ~DF9687.tmp
06/11/2008 16:12:14 (DIR)        0 byte      0 days old -- AVSETUP_4913094e
06/11/2008 16:13:05          32768 byte      0 days old -- ~DFE54A.tmp
06/11/2008 16:15:30          16384 byte      0 days old -- ~DF9A12.tmp
06/11/2008 16:15:43          32768 byte      0 days old -- ~DFEFB6.tmp
06/11/2008 16:20:14 (DIR)        0 byte      0 days old -- _avast4_
06/11/2008 16:24:21          16384 byte      0 days old -- ~DFE2D5.tmp
06/11/2008 16:25:23          16384 byte      0 days old -- ~DF5EFD.tmp
06/11/2008 16:26:07          16384 byte      0 days old -- ~DFF440.tmp
06/11/2008 16:29:07          16384 byte      0 days old -- ~DFED0F.tmp
06/11/2008 16:31:14          16384 byte      0 days old -- ~DF3471.tmp
06/11/2008 16:31:50          16384 byte      0 days old -- ~DFD017.tmp
06/11/2008 16:34:47          16384 byte      0 days old -- Perflib_Perfdata_a00.dat
06/11/2008 16:34:51          16384 byte      0 days old -- Perflib_Perfdata_da4.dat
06/11/2008 16:34:51          16384 byte      0 days old -- Perflib_Perfdata_dac.dat
06/11/2008 16:54:17              0 byte      0 days old -- is6.tmp
06/11/2008 16:54:36              0 byte      0 days old -- isA.tmp
06/11/2008 16:58:05          49152 byte      0 days old -- ~DF4FF4.tmp
06/11/2008 17:05:33          32768 byte      0 days old -- ~DF1D19.tmp
06/11/2008 17:09:48          32768 byte      0 days old -- ~DF2612.tmp
06/11/2008 17:14:09          32768 byte      0 days old -- ~DF1B2A.tmp
06/11/2008 17:24:18          32768 byte      0 days old -- ~DF3066.tmp
06/11/2008 17:26:00          32768 byte      0 days old -- ~DF659E.tmp
06/11/2008 17:32:19 (DIR)        0 byte      0 days old -- nsl3D.tmp
06/11/2008 17:35:01          32768 byte      0 days old -- ~DF7908.tmp
06/11/2008 18:18:49          32768 byte      0 days old -- ~DFA314.tmp
06/11/2008 18:31:43          16384 byte      0 days old -- ~DFD00C.tmp
06/11/2008 18:31:43 (DIR)        0 byte      0 days old -- nsq3F.tmp
06/11/2008 18:31:43            115 byte      0 days old -- systemscan.ini

===================== REGISTRY SCAN =====================


-----HKLM\Software\Microsoft\Windows\CurrentVersion\Run-----

[Run]
  "ATICCC"="\"C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe\""
  "NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe"
  "MAFWTaskbarApp"="C:\WINDOWS\system32\MAFWTray.exe"
  "RTHDCPL"="RTHDCPL.EXE"
  "SkyTel"="SkyTel.EXE"
  "Alcmtr"="ALCMTR.EXE"
  "PKR Pal"="\"C:\Program Files\PKR\pkrpal.exe\" -osboot"
  "H2O"="C:\Program Files\SyncroSoft\Pos\H2O\cledx.exe"
  "devenv"="C:\WINDOWS\system\smvss.exe /w"
  "FLMOFFICE4DMOUSE"="C:\Program Files\Trust\DS-4500X Wireless Laser Deskset\Mouse\mouse32a.exe"
  "OFFICEKB"="C:\Program Files\Trust\DS-4500X Wireless Laser Deskset\Keyboard\kbdap32a.EXE"
  "avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe"
  "spywarefighterguard"="C:\Program Files\SPYWAREfighter\spftray.exe"
  @=""

[Run\avp6_post_uninstall]

[Run\OptionalComponents]
  @=""

[Run\OptionalComponents\IMAIL]
  "Installed"="1"
  @=""

[Run\OptionalComponents\MAPI]
  "NoChange"="1"
  "Installed"="1"
  @=""

[Run\OptionalComponents\MSFS]
  "Installed"="1"
  @=""

-----HKCU\Software\Microsoft\Windows\CurrentVersion\Run-----

[Run]
  "MsnMsgr"="\"C:\Program Files\MSN Messenger\MsnMsgr.Exe\" /background"
  "MySpaceIM"="C:\Program Files\MySpace\IM\MySpaceIM.exe"
  "SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe"
  "SUPERAntiSpyware"="C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe"
  "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe"

-----HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Run-----

[Run]

-----HKLM\Software\Microsoft\Windows\CurrentVersion\policies\Explorer\Run-----

[Run]

-----HKCU\Software\Microsoft\Windows\CurrentVersion\policies\Explorer\Run-----

[Run]

-----HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows-----

[Windows]
  "AppInit_DLLs"=""

-----HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad-----

[ShellServiceObjectDelayLoad]
  "PostBootReminder"="{7849596a-48ea-486e-8937-a2a3009f31a9}"
    #### HKCR\CLSID\{7849596a-48ea-486e-8937-a2a3009f31a9}\InprocServer32 @=expand:"%SystemRoot%\system32\SHELL32.dll"
  "CDBurn"="{fbeb8a05-beee-4442-804e-409d6c4515e9}"
    #### HKCR\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InprocServer32 @=expand:"%SystemRoot%\system32\SHELL32.dll"
  "WebCheck"="{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"
    #### HKCR\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\InprocServer32 @=expand:"C:\WINDOWS\system32\webcheck.dll"
  "SysTray"="{35CEC8A3-2BE6-11D2-8773-92E220524153}"
    #### HKCR\CLSID\{35CEC8A3-2BE6-11D2-8773-92E220524153}\InprocServer32 @="C:\WINDOWS\system32\stobject.dll"

-----HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks-----

[ShellExecuteHooks]
  "{AEB6717E-7E19-11d0-97EE-00C04FD91972}"=""
    #### HKCR\CLSID\{AEB6717E-7E19-11d0-97EE-00C04FD91972}\InprocServer32 @="shell32.dll"

-----HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon-----

[Winlogon]
  "Shell"="Explorer.exe"
  "System"=""
  "Userinit"="C:\WINDOWS\system32\userinit.exe,"
  "VmApplet"="rundll32 shell32,Control_RunDLL \"sysdm.cpl\""
  "UIHost"=expand:"logonui.exe"
  "LogonType"=dword:00000001
  "WinStationsDisabled"="0"

[Winlogon\GPExtensions]

[Winlogon\GPExtensions\{3610eda5-77ef-11d2-8dc5-00c04fa31a66}]
  "@="Quota du disque Microsoft"
  "DllName"=expand:"dskquota.dll"

[Winlogon\GPExtensions\{4CFB60C1-FAA6-47f1-89AA-0B18730C9FD3}]
  "@="Internet Explorer Zonemapping"
  "DllName"=expand:"iedkcs32.dll"

[Winlogon\GPExtensions\{827D319E-6EAC-11D2-A4EA-00C04F79F83A}]
  "DllName"=expand:"scecli.dll"
  "@="Security"

[Winlogon\GPExtensions\{A2E30F80-D7DE-11d2-BBDE-00C04F86AE3B}]
  "DllName"="iedkcs32.dll"
  "@="Internet Explorer Branding"

[Winlogon\GPExtensions\{B1BE8D72-6EAC-11D2-A4EA-00C04F79F83A}]
  "DllName"=expand:"scecli.dll"
  "@="EFS recovery"

[Winlogon\GPExtensions\{C631DF4C-088F-4156-B058-4375F0853CD8}]
  "@="Microsoft Offline Files"
  "DllName"=expand:"%SystemRoot%\System32\cscui.dll"

[Winlogon\GPExtensions\{c6dc5466-785a-11d2-84d0-00c04fb169f7}]
  "@="Installation de logiciel"
  "DllName"=expand:"appmgmts.dll"

[Winlogon\Notify]

[Winlogon\Notify\!SASWinLogon]

[Winlogon\Notify\AtiExtEvent]
  "DLLName"="Ati2evxx.dll"

[Winlogon\Notify\crypt32chain]
  "DllName"=expand:"crypt32.dll"

[Winlogon\Notify\cryptnet]
  "DllName"=expand:"cryptnet.dll"

[Winlogon\Notify\cscdll]
  "DLLName"="cscdll.dll"

[Winlogon\Notify\ScCertProp]
  "DLLName"="wlnotify.dll"

[Winlogon\Notify\Schedule]
  "DllName"=expand:"wlnotify.dll"

[Winlogon\Notify\sclgntfy]
  "DllName"=expand:"sclgntfy.dll"

[Winlogon\Notify\SensLogn]
  "DLLName"="WlNotify.dll"

[Winlogon\Notify	ermsrv]
  "DllName"=expand:"wlnotify.dll"

[Winlogon\Notify\wlballoon]
  "DLLName"="wlnotify.dll"

[Winlogon\SpecialAccounts]

[Winlogon\SpecialAccounts\UserList]
  "HelpAssistant"=dword:00000000
  "TsInternetUser"=dword:00000000
  "SQLAgentCmdExec"=dword:00000000
  "NetShowServices"=dword:00000000
  "IWAM_"=dword:00010000
  "IUSR_"=dword:00010000
  "VUSR_"=dword:00010000

-----HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon-----

[Winlogon]
  "ParseAutoexec"="1"
  "ExcludeProfileDirs"="Local Settings;Temporary Internet Files;Historique;Temp"
  "BuildNumber"=dword:00000a28

-----HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options-----

[Image File Execution Options\Your Image File Name Here without a path]
  "Debugger"="ntsd -d"

-----HKLM\System\CurrentControlSet\Control\Session Manager\-----

[Session Manager]
  "BootExecute"=multi:"autocheck autochk *\00\00"

[Session Manager\SubSystems]
  "Windows"=expand:"%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,3072,512 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ProfileControl=Off MaxRequestThreads=16"

-----HKLM\SYSTEM\CurrentControlSet\Control\WOW-----

[WOW]
  "cmdline"=expand:"%SystemRoot%\system32
tvdm.exe"
  "wowcmdline"=expand:"%SystemRoot%\system32
tvdm.exe -a %SystemRoot%\system32\krnl386"

-----HKLM\Software\Microsoft\Windows NT\CurrentVersion\Run-----

[run]

-----HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce-----

[RunOnce]

-----HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx-----

[RunOnceEx]

-----HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices-----

[RunServices]

-----HKLM\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce-----

[RunServicesOnce]

-----HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce-----

[RunOnce]

-----HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnceEx-----

-----HKCU\Software\Microsoft\Windows\CurrentVersion\RunServices-----

[RunServices]

-----HKCU\Software\Microsoft\Windows NT\CurrentVersion\Run-----

-----HKCU\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce-----

[RunServicesOnce]

-----HKLM\Software\Microsoft\Command Processor\Autorun-----

-----HKCU\Software\Microsoft\Command Processor\Autorun-----

-----HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows\Load-----

-----HKLM\Software\Policies\Microsoft\Windows\System\Scripts\Startup-----

-----HKCU\Software\Policies\Microsoft\Windows\System\Scripts\Logon-----

-----HKLM\Software\Policies\Microsoft\Windows\System\Scripts\Logon-----

-----HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\TerminalServer\Install\Software\Microsoft\Windows\CurrentVersion\Runonce-----

-----HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\TerminalServer\Install\Software\Microsoft\Windows\CurrentVersion\Run-----

-----HKLM\System\CurrentControlSet\Control\Terminal Server\Wdsdpwd\StartupPrograms-----

-----HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\TerminalServer\Install\Software\Microsoft\Windows\CurrentVersion\Runonce-----

-----HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler-----

[SharedTaskScheduler]
  "{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Pré-chargeur Browseui"
    #### HKCR\CLSID\{438755C2-A8BA-11D1-B96B-00A0C90312E1}\InprocServer32 @=expand:"%SystemRoot%\system32\browseui.dll"
  "{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Démon de cache des catégories de composant"
    #### HKCR\CLSID\{8C7461EF-2B13-11d2-BE35-3078302C2030}\InprocServer32 @=expand:"%SystemRoot%\system32\browseui.dll"

-----HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects-----

[Browser Helper Objects]
  @=""

[Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
  @=""

[Browser Helper Objects\{53707962-6F74-2D53-2644-206D7942484F}]
    #### HKCR\CLSID\{53707962-6F74-2D53-2644-206D7942484F}\InprocServer32 @="C:\PROGRA~1\SPYBOT~1\SDHelper.dll"

[Browser Helper Objects\{7009fcd4-05be-44f4-9583-93fe419ab7b0}]
    #### HKCR\CLSID\{7009fcd4-05be-44f4-9583-93fe419ab7b0}\InprocServer32 @="C:\Program Files\Multi_Media_France	bMul0.dll"
  @=""

[Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
    #### HKCR\CLSID\{9030D464-4C02-4ABF-8ECC-5164760863C6}\InprocServer32 @="C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll"

-----HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks-----

[URLSearchHooks]
  "{CFBFAE00-17A6-11D0-99CB-00C04FD64497}"=""
    #### HKCR\CLSID\{CFBFAE00-17A6-11D0-99CB-00C04FD64497}\InprocServer32 @="C:\WINDOWS\system32\ieframe.dll"

-----HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig-----

-----HKCU\Control Panel\Desktop\-----

[Desktop]
  "SCRNSAVE.EXE"="C:\WINDOWS\system32\ssstars.scr"

[Desktop\WindowMetrics]

-----HKEY_CLASSES_ROOT\exefile\shell\open\command-----

[command]
  @="\"%1\" %*"

-----HKEY_CLASSES_ROOT\comfile\shell\open\command-----

[command]
  @="\"%1\" %*"

-----HKEY_CLASSES_ROOT\batfile\shell\open\command-----

[command]
  @="\"%1\" %*"

-----HKEY_CLASSES_ROOT\piffile\shell\open\command-----

[command]
  @="\"%1\" %*"

-----HKEY_CLASSES_ROOT\scrFile\shell\open\command-----

[command]
  @="\"%1\" %*"

-----HKEY_CLASSES_ROOT\htafile\shell\open\command-----

[Command]
  @="C:\WINDOWS\system32\mshta.exe \"%1\" %*"

-----HKEY_CLASSES_ROOT\logfile\shell\open\command-----

-----HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\URL-----

[URL]

[URL\DefaultPrefix]
  @="http://"

[URL\Prefixes]
  "ftp"="ftp://"
  "gopher"="gopher://"
  "home"="http://"
  "mosaic"="http://"
  "www"="http://"

-----HKLM\SYSTEM\CurrentControlSet\Control\Lsa-----

[Lsa]

[Lsa\AccessProviders]

[Lsa\AccessProviders\Windows NT Access Provider]
  "ProviderPath"=expand:"%SystemRoot%\system32
tmarta.dll"

[Lsa\Audit]

[Lsa\Audit\PerUserAuditing]

[Lsa\Audit\PerUserAuditing\System]

[Lsa\Data]

[Lsa\SSO]

[Lsa\SSO\Passport1.4]
  "SSOURL"="http://www.passport.com"

[Lsa\SspiCache]

[Lsa\SspiCache\digest.dll]
  "Name"="Digest"
  "Comment"="Digest SSPI Authentication Package"

[Lsa\SspiCache\msapsspc.dll]
  "Name"="DPA"
  "Comment"="DPA Security Package"

[Lsa\SspiCache\msnsspc.dll]
  "Name"="MSN"
  "Comment"="MSN Security Package"

-----HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess-----

[SharedAccess]
  "DependOnGroup"=multi:"\00"
  "DependOnService"=multi:"Netman\00WinMgmt\00\00"
  "Description"="Assure la traduction d'adresses de réseau, l'adressage, les services de résolution de noms et/ou les services de prévention d'intrusion pour un réseau de petite entreprise ou un réseau domestique."
  "DisplayName"="Pare-feu Windows / Partage de connexion Internet"
  "ErrorControl"=dword:00000001
  "ImagePath"=expand:"%SystemRoot%\system32\svchost.exe -k netsvcs"
  "ObjectName"="LocalSystem"
  "Start"=dword:00000002
  "Type"=dword:00000020

[SharedAccess\Epoch]
  "Epoch"=dword:00002473

[SharedAccess\Parameters]
  "ServiceDll"=expand:"%SystemRoot%\System32\ipnathlp.dll"

[SharedAccess\Parameters\FirewallPolicy]

[SharedAccess\Parameters\FirewallPolicy\DomainProfile]

[SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications]

[SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
  "%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enaxxxxx@xxxxxres.dll,-22019"
  "C:\Program Files\MSN Messenger\msnmsgr.exe"="C:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
  "C:\Program Files\MSN Messenger\livecall.exe"="C:\Program Files\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"
  "%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enaxxxxx@xxxxxres.dll,-20000"

[SharedAccess\Parameters\FirewallPolicy\StandardProfile]
  "EnableFirewall"=dword:00000001
  "DoNotAllowExceptions"=dword:00000000

[SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications]

[SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
  "%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enaxxxxx@xxxxxres.dll,-22019"
  "C:\Program Files\eMule\emule.exe"="C:\Program Files\eMule\emule.exe:*:Enabled:eMule"
  "C:\Program Files\MSN Messenger\msnmsgr.exe"="C:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
  "C:\Program Files\MSN Messenger\livecall.exe"="C:\Program Files\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"
  "C:\Program Files\Resolume 2.41esolume.exe"="C:\Program Files\Resolume 2.41esolume.exe:*:Enabled:Resolume 2.41"
  "C:\Program Files\Messenger\msmsgs.exe"="C:\Program Files\Messenger\msmsgs.exe:*:Enabled:Windows Messenger"
  "C:\Documents and Settings\Propriétaire\Local Settings\Temp\Rar$EX02.937\emule.exe"="C:\Documents and Settings\Propriétaire\Local Settings\Temp\Rar$EX02.937\emule.exe:*:Disabled:eMule"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\0exinjs.aa.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\0exinjs.aa.exe:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\22exinjs.aa.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\22exinjs.aa.exe:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\23exinjs.aa.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\23exinjs.aa.exe:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\83exinjs.aa.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\83exinjs.aa.exe:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\86exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\86exinjs.ab.exe:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\82exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\82exinjs.ab.exe:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\42exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\42exinjs.ab.exe:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\98exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\98exinjs.ab.exe:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\36exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\36exinjs.ab.exe:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\59exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\59exinjs.ab.exe:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\49exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\49exinjs.ab.exe:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\73exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\73exinjs.ab.exe:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\75exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\75exinjs.ab.exe:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\8exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\8exinjs.ab.exe:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\47exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\47exinjs.ab.exe:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\20exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\20exinjs.ab.exe:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\78exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\78exinjs.ab.exe:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\80exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\80exinjs.ab.exe:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\74exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\74exinjs.ab.exe:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\18exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\18exinjs.ab.exe:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\64exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\64exinjs.ab.exe:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\57exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\57exinjs.ab.exe:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\92exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\92exinjs.ab.exe:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\11exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\11exinjs.ab.exe:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\50exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\50exinjs.ab.exe:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\43exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\43exinjs.ab.exe:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\95exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\95exinjs.ab.exe:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\52exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\52exinjs.ab.exe:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\23exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\23exinjs.ab.exe:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\6exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\6exinjs.ab.exe:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\39exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\39exinjs.ab.exe:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\68exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\68exinjs.ab.exe:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\61exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\61exinjs.ab.exe:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\26exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\26exinjs.ab.exe:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\34exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\34exinjs.ab.exe:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\19exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\19exinjs.ab.exe:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\32exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\32exinjs.ab.exe:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\14exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\14exinjs.ab.exe:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\60exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\60exinjs.ab.exe:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\29exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\29exinjs.ab.exe:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\66exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\66exinjs.ab.exe:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\99exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\99exinjs.ab.exe:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\54exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\54exinjs.ab.exe:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\94exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\94exinjs.ab.exe:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\85exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\85exinjs.ab.exe:*:Enabled:Microsoft Update"
  "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe"="C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe:*:Disabled:Kaspersky Anti-Virus"
  "C:\Program Files\uTorrent\uTorrent.exe"="C:\Program Files\uTorrent\uTorrent.exe:*:Enabled:µTorrent"
  "C:\Program Files\BitDownload\BitDownload.exe"="C:\Program Files\BitDownload\BitDownload.exe:*:Enabled:Torrent P2P application"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\16ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\16ex:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\25ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\25ex:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\35ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\35ex:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\43ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\43ex:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\58ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\58ex:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\26ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\26ex:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\87ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\87ex:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\60ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\60ex:*:Enabled:Microsoft Update"
  "C:\Program Files\Ahead\Nero ShowTime\ShowTime.exe"="C:\Program Files\Ahead\Nero ShowTime\ShowTime.exe:*:Enabled:Nero ShowTime"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\44ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\44ex:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\50ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\50ex:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\7ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\7ex:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\42ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\42ex:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\3ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\3ex:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\21ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\21ex:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\40ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\40ex:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\2ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\2ex:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\4ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\4ex:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\65ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\65ex:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\37ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\37ex:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\31ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\31ex:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\72ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\72ex:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\92ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\92ex:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\68ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\68ex:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\45ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\45ex:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\96ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\96ex:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\33ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\33ex:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\79ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\79ex:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\10ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\10ex:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\22ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\22ex:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\55ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\55ex:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\66ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\66ex:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\94ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\94ex:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\52ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\52ex:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\0ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\0ex:*:Enabled:Microsoft Update"
  "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\63ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\63ex:*:Enabled:Microsoft Update"
  "C:\Documents and Settings\Propriétaire\Local Settings\Temp\10exmdnk23.exe"="C:\Documents and Settings\Propriétaire\Local Settings\Temp\10exmdnk23.exe:*:Disabled:10exmdnk23"
  "C:\Documents and Settings\Propriétaire\Local Settings\Temp\33exmdnk25.exe"="C:\Documents and Settings\Propriétaire\Local Settings\Temp\33exmdnk25.exe:*:Disabled:33exmdnk25"
  "C:\Documents and Settings\Propriétaire\Local Settings\Temp\0exmdnk26.exe"="C:\Documents and Settings\Propriétaire\Local Settings\Temp\0exmdnk26.exe:*:Disabled:0exmdnk26"
  "C:\Documents and Settings\Propriétaire\Local Settings\Temp\58exmdnk30.exe"="C:\Documents and Settings\Propriétaire\Local Settings\Temp\58exmdnk30.exe:*:Disabled:58exmdnk30"
  "C:\kav\kis7.0\french\setup.exe"="C:\kav\kis7.0\french\setup.exe:*:Enabled:Programme d'installation de Kaspersky Internet Security 7.0"
  "C:\kav\kav7.0\french\setup.exe"="C:\kav\kav7.0\french\setup.exe:*:Enabled:Programme d'installation de Kaspersky Anti-Virus 7.0"
  "%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enaxxxxx@xxxxxres.dll,-20000"

[SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts]

[SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
  "1900:UDP"="1900:UDP:LocalSubNet:Disaxxxxx@xxxxxres.dll,-22007"
  "2869:TCP"="2869:TCP:LocalSubNet:Disaxxxxx@xxxxxres.dll,-22008"
  "17053:TCP"="17053:TCP:*:Enabled:NortonAV"
  "12192:TCP"="12192:TCP:*:Enabled:NortonAV"

[SharedAccess\Setup]
  "ServiceUpgrade"=dword:00000001

[SharedAccess\Setup\InterfacesUnfirewalledAtUpdate]
  "All"=dword:00000001

-----HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Firewall\-----

-----HKEY_LOCAL_MACHINE\SOFTWARE\Winsock2-----

-----HKLM\Software\Microsoft\Ole-----

[Ole]
  "DefaultLaunchPermission"=hex:01,00,04,80,5c,00,00,00,6c,00,00,00,00,00,00,00,\
  "MachineLaunchRestriction"=hex:01,00,04,80,48,00,00,00,58,00,00,00,00,00,00,00,\
  "MachineAccessRestriction"=hex:01,00,04,80,44,00,00,00,54,00,00,00,00,00,00,00,\
  "EnableDCOM"="Y"

[Ole\AppCompat]

[Ole\AppCompat\ActivationSecurityCheckExemptionList]
  "{A50398B8-9075-4FBF-A7A1-456BF21937AD}"="1"
  "{AD65A69D-3831-40D7-9629-9B0B50A93843}"="1"
  "{0040D221-54A1-11D1-9DE0-006097042D69}"="1"
  "{2A6D72F1-6E7E-4702-B99C-E40D3DED33C3}"="1"

[Ole\NONREDIST]
  "System.EnterpriseServices.Thunk.dll"=""

-----HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WindowsUpdate\AU\-----

-----HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\-----

[Security Center]
  "FirstRunDisabled"=dword:00000001
  "AntiVirusDisableNotify"=dword:00000000
  "FirewallDisableNotify"=dword:00000000
  "UpdatesDisableNotify"=dword:00000000
  "AntiVirusOverride"=dword:00000001
  "FirewallOverride"=dword:00000000

[Security Center\Monitoring]

[Security Center\Monitoring\AhnlabAntiVirus]

[Security Center\Monitoring\ComputerAssociatesAntiVirus]

[Security Center\Monitoring\KasperskyAntiVirus]

[Security Center\Monitoring\McAfeeAntiVirus]

[Security Center\Monitoring\McAfeeFirewall]

[Security Center\Monitoring\PandaAntiVirus]

[Security Center\Monitoring\PandaFirewall]

[Security Center\Monitoring\SophosAntiVirus]

[Security Center\Monitoring\SymantecAntiVirus]

[Security Center\Monitoring\SymantecFirewall]

[Security Center\Monitoring\TinyFirewall]

[Security Center\Monitoring\TrendAntiVirus]

[Security Center\Monitoring\TrendFirewall]

[Security Center\Monitoring\ZoneLabsFirewall]

-----HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore\-----

[SystemRestore]
  "DisableSR"=dword:00000000
  "CreateFirstRunRp"=dword:00000001
  "DSMin"=dword:000000c8
  "DSMax"=dword:00000190
  "RPSessionInterval"=dword:00000000
  "RPGlobalInterval"=dword:00015180
  "RPLifeInterval"=dword:0076a700
  "CompressionBurst"=dword:0000003c
  "TimerInterval"=dword:00000078
  "DiskPercent"=dword:0000000c
  "ThawInterval"=dword:00000384
  "RestoreDiskSpaceError"=dword:00000000
  "RestoreStatus"=dword:00000000
  "RestoreSafeModeStatus"=dword:00000001

[SystemRestore\Cfg]
  "DiskPercent"=dword:0000000c
  "MachineGuid"="{D88DDE61-D342-465C-AFF5-295FBD9AB56F}"

[SystemRestore\SnapshotCallbacks]
  @=""

-----HKEY_CURRENT_USER\Software\VB and VBA Program Settings-----

[VB and VBA Program Settings]

[VB and VBA Program Settings\CCleaner]

[VB and VBA Program Settings\CCleaner\Options]

-----HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\-----

-----HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\AdvancedOptions-----

[AdvancedOptions]

-----HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\AdvancedOptions-----

-----HKLM\Software\Microsoft\Active Setup\Installed Components-----

[Installed Components]

[Installed Components\<{12d0ed0d-0ee0-4f90-8827-78cefb8f4988}]
  "@="IE7 Uninstall Stub"
  "ComponentID"="IEUDINIT"
  "StubPath"="C:\WINDOWS\system32\ieudinit.exe"

[Installed Components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}]
    #### HKCR\CLSID\{22d6f312-b0f6-11d0-94ab-0080c74c7e95}\InprocServer32 @="C:\WINDOWS\system32\wmpdxm.dll"
  "Stubpath"="C:\WINDOWS\inf\unregmp2.exe /ShowWMP"
  "@="Microsoft Windows Media Player"
  "ComponentID"="WMPACCESS"

[Installed Components\>{26923b43-4d38-484f-9b9e-de460746276c}]
  "@="Internet Explorer"
  "ComponentID"="IEACCESS"
  "StubPath"="C:\WINDOWS\system32\ie4uinit.exe -UserIconConfig"

[Installed Components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
  "@="Browser Customizations"
  "ComponentiD"="BRANDING.CAB"
  "StubPath"="RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP"

[Installed Components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS]
  "@="Personnalisation du navigateur"
  "ComponentID"="BRANDING.CAB"
  "StubPath"="RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP"

[Installed Components\>{881dd1c5-3dcf-431b-b061-f3f88e8be88a}]
  "@="Outlook Express"
  "ComponentID"="OEACCESS"
  "StubPath"=expand:"%systemroot%\system32\shmgrate.exe OCInstallUserConfigOE"

[Installed Components\{0E92DD42-76F5-4EF2-B381-F9C1D72BE23D}]
  "@="Security Update for Microsoft .NET Framework 2.0 (KB922770)"
  "ComponentID"="KB922770"

[Installed Components\{10072CEC-8CC1-11D1-986E-00A0C955B42F}]
  "@="Rendu VML (Vector Graphics Rendering)"
  "ComponentID"="MSVML"

[Installed Components\{2179C5D3-EBFF-11CF-B6FD-00AA00B4E220}]
    #### HKCR\CLSID\{2179C5D3-EBFF-11CF-B6FD-00AA00B4E220}\InprocServer32 @="C:\WINDOWS\system32\wmpdxm.dll"
  "ComponentID"="NetShow"
  "StubPath"=""

[Installed Components\{22d6f312-b0f6-11d0-94ab-0080c74c7e95}]
    #### HKCR\CLSID\{22d6f312-b0f6-11d0-94ab-0080c74c7e95}\InprocServer32 @="C:\WINDOWS\system32\wmpdxm.dll"
  "ComponentID"="Microsoft Windows Media Player"
  "StubPath"=""
  "@="Lecteur Windows Media Microsoft 6.4"

[Installed Components\{283807B5-2C60-11D0-A31D-00AA00B92C03}]
  "@="DirectAnimation"
  "ComponentID"="DirectAnimation"

[Installed Components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}]
  "@="Themes Setup"
  "ComponentID"="Theme Component"
  "StubPath"=expand:"%SystemRoot%\system32egsvr32.exe /s /n /i:/UserInstall %Syst

Utilisateur anonyme · Answer

Re 
ça n'a pas fonctionné.

Tu as eu un problème ,?

A++

Sophie · Answer

SystemScan - www.suspectfile.com - ver. 3.5.5 (code: holifay & bReAkdOWn)

Running on: Windows XP HOME Edition, Service Pack 2 (2600.5.1)
System directory: C:\WINDOWS
SystemScan file: C:\Documents and Settings\Propriétaire\Local Settings\Temporary Internet Files\Content.IE5\X45LC4WY\sys48504[1].exe
Running in: User mode
Date: 06/11/2008
Time: 18:32:32
  
Output limited to: 
 -Recent files
 -Registry Run Keys
 -Suspicious Files

===================== RECENT FILES =====================

Showing files newer than  30 days

----- recent files in C:\
04/11/2008 18:14:33 (DIR)        0 byte      2 days old -- Deckard
06/11/2008 16:34:07      2145386496 byte      0 days old -- pagefile.sys
06/11/2008 16:54:38 (DIR)        0 byte      0 days old -- Program Files
06/11/2008 16:56:08 (DIR)        0 byte      0 days old -- Config.Msi
06/11/2008 17:05:02           1264 byte      0 days old -- TCleaner.txt
06/11/2008 17:07:31 (DIR)        0 byte      0 days old -- System Volume Information
06/11/2008 17:09:19 (DIR)        0 byte      0 days old -- ComboFix
06/11/2008 17:17:41           3660 byte      0 days old -- Bug.txt
06/11/2008 17:17:42 (DIR)        0 byte      0 days old -- Combo-Fix
06/11/2008 17:17:47 (DIR)        0 byte      0 days old -- WINDOWS

----- recent files in C:\WINDOWS\
04/11/2008 12:27:54 (DIR)        0 byte      2 days old -- Minidump
04/11/2008 12:47:51 (DIR)        0 byte      2 days old -- Tasks
04/11/2008 12:51:02              0 byte      2 days old -- setuperr.log
04/11/2008 12:53:08           9170 byte      2 days old -- KB943055Uninst.log
04/11/2008 18:14:42 (DIR)        0 byte      2 days old -- ERDNT
04/11/2008 20:49:01 (DIR)        0 byte      2 days old -- Debug
04/11/2008 20:49:46 (DIR)        0 byte      2 days old -- $NtUninstallKB943055$
04/11/2008 20:49:49          11413 byte      2 days old -- KB943055.log
04/11/2008 20:49:52 (DIR)        0 byte      2 days old -- $NtUninstallKB950749$
04/11/2008 20:49:56          14173 byte      2 days old -- KB950749.log
04/11/2008 20:49:58 (DIR)        0 byte      2 days old -- $NtUninstallKB945553$
04/11/2008 20:49:59          12373 byte      2 days old -- KB945553.log
04/11/2008 20:50:02 (DIR)        0 byte      2 days old -- $NtUninstallKB944338$
04/11/2008 20:50:03          13476 byte      2 days old -- KB944338.log
04/11/2008 20:50:05 (DIR)        0 byte      2 days old -- $NtUninstallKB948590$
04/11/2008 20:50:06          12774 byte      2 days old -- KB948590.log
04/11/2008 20:50:07 (DIR)        0 byte      2 days old -- $NtUninstallKB941693$
04/11/2008 20:50:09          12974 byte      2 days old -- KB941693.log
04/11/2008 20:50:13 (DIR)        0 byte      2 days old -- $NtUninstallKB947864$
04/11/2008 20:50:19          20085 byte      2 days old -- KB947864.log
04/11/2008 20:50:20 (DIR)        0 byte      2 days old -- $NtUninstallKB948881$
04/11/2008 20:50:22          11204 byte      2 days old -- KB948881.log
05/11/2008 12:58:01 (DIR)        0 byte      1 days old -- $NtUninstallKB904942$
05/11/2008 12:58:04          11030 byte      1 days old -- KB904942.log
05/11/2008 12:58:06 (DIR)        0 byte      1 days old -- $NtUninstallKB914440$
05/11/2008 12:58:07 (DIR)        0 byte      1 days old -- network diagnostic
05/11/2008 12:58:08           5198 byte      1 days old -- KB914440.log
05/11/2008 12:58:53 (DIR)        0 byte      1 days old -- $NtUninstallKB915865$
05/11/2008 12:58:57           6278 byte      1 days old -- KB915865.log
05/11/2008 12:59:06 (DIR)        0 byte      1 days old -- $NtServicePackUninstallNLSDownlevelMapping$
05/11/2008 12:59:09           7177 byte      1 days old -- NLSDownlevelMapping.log
05/11/2008 12:59:16 (DIR)        0 byte      1 days old -- $NtServicePackUninstallIDNMitigationAPIs$
05/11/2008 12:59:20           7485 byte      1 days old -- IDNMitigationAPIs.log
05/11/2008 13:00:09 (DIR)        0 byte      1 days old -- ie7
05/11/2008 13:00:17 (DIR)        0 byte      1 days old -- Media
05/11/2008 13:00:21 (DIR)        0 byte      1 days old -- WBEM
05/11/2008 13:00:27          57821 byte      1 days old -- ie7.log
05/11/2008 13:00:49 (DIR)        0 byte      1 days old -- ie7updates
05/11/2008 13:01:00          72190 byte      1 days old -- KB944533-IE7.log
05/11/2008 13:01:11          45658 byte      1 days old -- updspapi.log
05/11/2008 13:01:15          50000 byte      1 days old -- KB947864-IE7.log
05/11/2008 13:01:36          35377 byte      1 days old -- ie7_main.log
05/11/2008 13:02:42 (DIR)        0 byte      1 days old -- Help
05/11/2008 13:03:16           6286 byte      1 days old -- spupdsvc.log
05/11/2008 13:33:23             60 byte      1 days old -- setupact.log
05/11/2008 18:18:13         117714 byte      1 days old -- ntbtlog.txt
06/11/2008 09:00:51 (DIR)        0 byte      0 days old -- $hf_mig$
06/11/2008 09:17:30 (DIR)        0 byte      0 days old -- system
06/11/2008 10:18:12 (DIR)        0 byte      0 days old -- $NtUninstallKB932823-v3$
06/11/2008 10:18:18          10097 byte      0 days old -- KB932823-v3.log
06/11/2008 10:18:19           1374 byte      0 days old -- imsins.BAK
06/11/2008 10:18:25          75274 byte      0 days old -- ocgen.log
06/11/2008 10:18:25          56446 byte      0 days old -- tsoc.log
06/11/2008 10:18:25          48869 byte      0 days old -- setupapi.log
06/11/2008 10:18:25           8054 byte      0 days old -- ocmsn.log
06/11/2008 10:18:25           1374 byte      0 days old -- imsins.log
06/11/2008 10:18:25 (DIR)        0 byte      0 days old -- inf
06/11/2008 10:18:25          21821 byte      0 days old -- iis6.log
06/11/2008 10:18:25          48411 byte      0 days old -- comsetup.log
06/11/2008 10:18:25         139927 byte      0 days old -- FaxSetup.log
06/11/2008 10:18:25           7402 byte      0 days old -- msgsocm.log
06/11/2008 10:18:25          31031 byte      0 days old -- ntdtcsetup.log
06/11/2008 10:18:25          10950 byte      0 days old -- KB938127-IE7.log
06/11/2008 15:53:02 (DIR)        0 byte      0 days old -- Prefetch
06/11/2008 16:33:10          23478 byte      0 days old -- SchedLgU.Txt
06/11/2008 16:34:11           2048 byte      0 days old -- bootstat.dat
06/11/2008 16:34:12              0 byte      0 days old -- 0.log
06/11/2008 16:34:23             50 byte      0 days old -- wiaservc.log
06/11/2008 16:34:26            159 byte      0 days old -- wiadebug.log
06/11/2008 16:56:08 (DIR)        0 byte      0 days old -- WinSxS
06/11/2008 16:56:15 (DIR)        0 byte      0 days old -- Installer
06/11/2008 17:17:41 (DIR)        0 byte      0 days old -- system32
06/11/2008 17:39:27         698171 byte      0 days old -- WindowsUpdate.log
06/11/2008 17:48:32 (DIR)        0 byte      0 days old -- Temp

----- recent files in C:\WINDOWS\Downloaded Program Files\

----- recent files in C:\WINDOWS\system\

----- recent files in C:\WINDOWS\system32\
04/11/2008 12:11:54          13702 byte      2 days old -- wpa.dbl
04/11/2008 12:14:58        1070888 byte      2 days old -- PerfStringBackup.INI
04/11/2008 12:15:00          83620 byte      2 days old -- perfc00C.dat
04/11/2008 12:15:00          70106 byte      2 days old -- perfc009.dat
04/11/2008 12:15:00         485868 byte      2 days old -- perfh00C.dat
04/11/2008 12:15:00         418590 byte      2 days old -- perfh009.dat
05/11/2008 10:53:41          91888 byte      1 days old -- FNTCACHE.DAT
05/11/2008 13:00:55 (DIR)        0 byte      1 days old -- fr-fr
06/11/2008 10:18:24 (DIR)        0 byte      0 days old -- dllcache
06/11/2008 15:04:53 (DIR)        0 byte      0 days old -- CatRoot2
06/11/2008 16:20:13           3121 byte      0 days old -- CONFIG.NT
06/11/2008 16:28:07 (DIR)        0 byte      0 days old -- drivers
06/11/2008 17:07:31 (DIR)        0 byte      0 days old -- Restore

----- recent files in C:\WINDOWS\system32\drivers\

----- recent files in C:\WINDOWS	emp\
06/11/2008 16:17:38         965569 byte      0 days old -- fa56d7ec.$$$
06/11/2008 16:34:16          16384 byte      0 days old -- Perflib_Perfdata_658.dat
06/11/2008 17:48:32          16384 byte      0 days old -- Perflib_Perfdata_8ec.dat
06/11/2008 18:16:31 (DIR)        0 byte      0 days old -- _avast4_

----- recent files in C:\Program Files\
04/11/2008 12:44:13 (DIR)        0 byte      2 days old -- ATI Technologies
04/11/2008 12:55:53 (DIR)        0 byte      2 days old -- Windows Live Toolbar
05/11/2008 16:09:17 (DIR)        0 byte      1 days old -- eMule
05/11/2008 16:17:51 (DIR)        0 byte      1 days old -- Internet Explorer
05/11/2008 20:34:33 (DIR)        0 byte      1 days old -- Messenger
05/11/2008 20:34:33 (DIR)        0 byte      1 days old -- M-Audio Firewire Audiophile
05/11/2008 20:34:33 (DIR)        0 byte      1 days old -- DivX
05/11/2008 20:36:52 (DIR)        0 byte      1 days old -- MySpace
06/11/2008 15:02:36 (DIR)        0 byte      0 days old -- PKR
06/11/2008 16:55:02 (DIR)        0 byte      0 days old -- Fichiers communs
06/11/2008 16:56:30 (DIR)        0 byte      0 days old -- SPYWAREfighter
06/11/2008 17:04:44 (DIR)        0 byte      0 days old -- Trend Micro

----- recent files in C:\Program Files\Fichiers communs\
06/11/2008 16:55:02 (DIR)        0 byte      0 days old -- Application

----- recent files in C:\Documents and Settings\Propriétaire\Application Data\
04/11/2008 13:48:47 (DIR)        0 byte      2 days old -- Malwarebytes
05/11/2008 13:09:44 (DIR)        0 byte      1 days old -- SUPERAntiSpyware.com

----- recent files in C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\
04/11/2008 18:20:11          16384 byte      2 days old -- ~DF3333.tmp
04/11/2008 18:46:09         239104 byte      2 days old -- 71exhmunmlclr14.exe
04/11/2008 18:46:09         239104 byte      2 days old -- 75exhmunmlclr14.exe
04/11/2008 18:46:09         239104 byte      2 days old -- 88exhmunmlclr14.exe
04/11/2008 18:46:09         239104 byte      2 days old -- 24exhmunmlclr14.exe
04/11/2008 19:05:45          16384 byte      2 days old -- ~DF8B63.tmp
04/11/2008 19:14:04          32768 byte      2 days old -- ~DF3D4F.tmp
04/11/2008 20:48:26          16384 byte      2 days old -- ~DF6387.tmp
05/11/2008 11:05:41          22704 byte      1 days old -- Danish.bin
05/11/2008 11:05:41          25670 byte      1 days old -- Dutch.bin
05/11/2008 11:05:41          16913 byte      1 days old -- TradChin.bin
05/11/2008 11:05:41          24256 byte      1 days old -- Japanese.bin
05/11/2008 11:05:41          20101 byte      1 days old -- Korean.bin
05/11/2008 11:05:42          27178 byte      1 days old -- French.bin
05/11/2008 11:05:43          24028 byte      1 days old -- SWEDISH.bin
05/11/2008 11:05:43          25684 byte      1 days old -- German.bin
05/11/2008 11:05:43          26062 byte      1 days old -- Russian.bin
05/11/2008 11:05:43          27689 byte      1 days old -- Spanish.bin
05/11/2008 11:05:43          27330 byte      1 days old -- Italian.bin
05/11/2008 11:05:44          26187 byte      1 days old -- Portuguese.bin
05/11/2008 11:05:44          21913 byte      1 days old -- Thai.bin
05/11/2008 11:05:44          20919 byte      1 days old -- Arabic.bin
05/11/2008 11:05:44          21857 byte      1 days old -- English.bin
05/11/2008 11:05:44          16374 byte      1 days old -- SimChin.bin
05/11/2008 11:05:45          24999 byte      1 days old -- Portuguese(Brazil).bin
05/11/2008 11:05:45          24147 byte      1 days old -- Polish.bin
05/11/2008 11:05:45          25003 byte      1 days old -- Greek.bin
05/11/2008 11:05:45          24252 byte      1 days old -- Czech.bin
05/11/2008 11:05:46          22793 byte      1 days old -- Finnish.bin
05/11/2008 11:05:47          19487 byte      1 days old -- Hebrew.bin
05/11/2008 11:05:47          26001 byte      1 days old -- Hungarian.bin
05/11/2008 11:05:48          21901 byte      1 days old -- Norwegian.bin
05/11/2008 11:05:48          22194 byte      1 days old -- Turkish.bin
05/11/2008 11:27:14          32768 byte      1 days old -- ~DF6515.tmp
05/11/2008 11:31:17          16384 byte      1 days old -- ~DF9D46.tmp
05/11/2008 11:31:34          16384 byte      1 days old -- ~DF7191.tmp
05/11/2008 11:31:58          16384 byte      1 days old -- ~DF1672.tmp
05/11/2008 11:32:48          16384 byte      1 days old -- ~DFD13B.tmp
05/11/2008 11:33:22          16384 byte      1 days old -- ~DFA2FD.tmp
05/11/2008 11:42:31          32768 byte      1 days old -- ~DF638.tmp
05/11/2008 11:44:33          32768 byte      1 days old -- ~DF34FC.tmp
05/11/2008 11:49:16          16384 byte      1 days old -- ~DF2494.tmp
05/11/2008 11:49:16          16384 byte      1 days old -- ~DF23B5.tmp
05/11/2008 11:50:14          16384 byte      1 days old -- ~DF23C4.tmp
05/11/2008 11:53:30          16384 byte      1 days old -- ~DF45C4.tmp
05/11/2008 11:54:23          32768 byte      1 days old -- ~DF7AF.tmp
05/11/2008 11:57:13          16384 byte      1 days old -- ~DF214A.tmp
05/11/2008 11:57:40          32768 byte      1 days old -- ~DFD70B.tmp
05/11/2008 12:06:58          16384 byte      1 days old -- ~DFA66A.tmp
05/11/2008 12:09:48          32768 byte      1 days old -- ~DFB01E.tmp
05/11/2008 12:20:27          16384 byte      1 days old -- ~DF1DB1.tmp
05/11/2008 12:20:50          16384 byte      1 days old -- ~DFBA1E.tmp
05/11/2008 12:22:24          32768 byte      1 days old -- ~DF3E3D.tmp
05/11/2008 12:25:54          16384 byte      1 days old -- ~DF5412.tmp
05/11/2008 12:26:21          32768 byte      1 days old -- ~DF150A.tmp
05/11/2008 12:28:38          32768 byte      1 days old -- ~DF60E8.tmp
05/11/2008 12:30:18          32768 byte      1 days old -- ~DF6AD1.tmp
05/11/2008 12:34:10          16384 byte      1 days old -- ~DFEBB.tmp
05/11/2008 12:50:14          32768 byte      1 days old -- ~DF8F7A.tmp
05/11/2008 12:51:34          16384 byte      1 days old -- ~DFFCE4.tmp
05/11/2008 13:03:17             54 byte      1 days old -- hmunmlclr14.exe.conf
05/11/2008 13:06:05          16384 byte      1 days old -- ~DF3079.tmp
05/11/2008 13:07:32          16384 byte      1 days old -- ~DF4070.tmp
05/11/2008 13:09:58          16384 byte      1 days old -- ~DF8638.tmp
05/11/2008 13:11:45          16384 byte      1 days old -- ~DF1BF6.tmp
05/11/2008 13:11:46              0 byte      1 days old -- 88313.dmp
05/11/2008 13:12:32          16384 byte      1 days old -- ~DF9948.tmp
05/11/2008 13:12:49          16384 byte      1 days old -- ~DF430A.tmp
05/11/2008 13:14:44          16384 byte      1 days old -- ~DF8882.tmp
05/11/2008 13:30:14          16316 byte      1 days old -- 6394_appcompat.txt
05/11/2008 13:30:20          75860 byte      1 days old -- 196E60.dmp
05/11/2008 13:30:50 (DIR)        0 byte      1 days old -- WERe1a5.dir00
05/11/2008 13:30:50 (DIR)        0 byte      1 days old -- WERea67.dir00
05/11/2008 13:32:24          16384 byte      1 days old -- ~DF7932.tmp
05/11/2008 13:33:08 (DIR)        0 byte      1 days old -- WERf61a.dir00
05/11/2008 13:39:59          16384 byte      1 days old -- ~DFD7EB.tmp
05/11/2008 13:40:18 (DIR)        0 byte      1 days old -- WER8f52.dir00
05/11/2008 13:40:20 (DIR)        0 byte      1 days old -- WER918b.dir00
05/11/2008 13:43:22          16384 byte      1 days old -- ~DFDB6A.tmp
05/11/2008 13:43:50          32298 byte      1 days old -- de41_appcompat.txt
05/11/2008 13:44:49 (DIR)        0 byte      1 days old -- ~nsu.tmp
05/11/2008 13:53:45          16384 byte      1 days old -- ~DFEEDF.tmp
05/11/2008 13:53:56          16384 byte      1 days old -- Perflib_Perfdata_808.dat
05/11/2008 13:54:45 (DIR)        0 byte      1 days old -- WER3a07.dir00
05/11/2008 13:56:10          16384 byte      1 days old -- ~DF5FA5.tmp
05/11/2008 13:57:24          16384 byte      1 days old -- ~DF536A.tmp
05/11/2008 13:57:59          16384 byte      1 days old -- ~DF4193.tmp
05/11/2008 13:59:31          16384 byte      1 days old -- ~DF7F9F.tmp
05/11/2008 14:01:28          16384 byte      1 days old -- ~DF89.tmp
05/11/2008 14:02:16          16384 byte      1 days old -- ~DF34F.tmp
05/11/2008 15:08:31         239104 byte      1 days old -- 46exhmunmlclr15.exe
05/11/2008 15:08:31         239104 byte      1 days old -- 60exhmunmlclr15.exe
05/11/2008 15:08:31         239104 byte      1 days old -- 79exhmunmlclr15.exe
05/11/2008 15:47:47          16384 byte      1 days old -- ~DF2136.tmp
05/11/2008 15:48:43          16316 byte      1 days old -- efda_appcompat.txt
05/11/2008 15:48:48          79711 byte      1 days old -- 2FB0F.dmp
05/11/2008 15:48:53          16384 byte      1 days old -- ~DF9F2B.tmp
05/11/2008 15:51:44          10144 byte      1 days old -- MPC5.tmp
05/11/2008 15:54:52          16384 byte      1 days old -- ~DFC6BC.tmp
05/11/2008 16:09:05             54 byte      1 days old -- hmunmlclr15.exe.conf
05/11/2008 16:13:12          16384 byte      1 days old -- ~DF6329.tmp
05/11/2008 16:18:17          16384 byte      1 days old -- ~DFBFC8.tmp
05/11/2008 16:18:33          16384 byte      1 days old -- ~DF7EC1.tmp
05/11/2008 16:19:06          16384 byte      1 days old -- ~DF16CD.tmp
05/11/2008 16:21:01          32768 byte      1 days old -- ~DF18AE.tmp
05/11/2008 16:31:24 (DIR)        0 byte      1 days old -- {E09B48B5-E141-427A-AB0C-D3605127224A}
05/11/2008 16:35:48          16384 byte      1 days old -- ~DFE243.tmp
05/11/2008 16:39:53          16384 byte      1 days old -- ~DF9898.tmp
05/11/2008 16:40:07          16384 byte      1 days old -- ~DF4EDB.tmp
05/11/2008 16:41:25          16384 byte      1 days old -- ~DF5CB1.tmp
05/11/2008 18:58:45          32768 byte      1 days old -- ~DF84C.tmp
05/11/2008 20:54:31          16384 byte      1 days old -- ~DF1F42.tmp
05/11/2008 20:54:57          16384 byte      1 days old -- ~DF7E1A.tmp
06/11/2008 09:10:34          16384 byte      0 days old -- ~DFF265.tmp
06/11/2008 09:11:12          16384 byte      0 days old -- ~DFC471.tmp
06/11/2008 09:13:00          32768 byte      0 days old -- ~DFCC98.tmp
06/11/2008 09:20:46          32768 byte      0 days old -- ~DFF5DB.tmp
06/11/2008 09:29:12          32768 byte      0 days old -- ~DF2C5F.tmp
06/11/2008 09:35:02          32768 byte      0 days old -- ~DF9840.tmp
06/11/2008 10:00:04          32768 byte      0 days old -- ~DF4304.tmp
06/11/2008 10:08:16          16384 byte      0 days old -- ~DFA144.tmp
06/11/2008 14:52:12          16384 byte      0 days old -- ~DF60BA.tmp
06/11/2008 14:54:17          32768 byte      0 days old -- ~DFACD8.tmp
06/11/2008 15:02:40          16384 byte      0 days old -- ~DF3CC3.tmp
06/11/2008 15:09:50          16384 byte      0 days old -- ~DFF540.tmp
06/11/2008 15:10:17          32768 byte      0 days old -- ~DFC9B4.tmp
06/11/2008 15:12:34          16384 byte      0 days old -- ~DF490C.tmp
06/11/2008 15:13:29          32768 byte      0 days old -- ~DFC226.tmp
06/11/2008 15:29:11           9450 byte      0 days old -- caevents.log
06/11/2008 15:35:01          16384 byte      0 days old -- ~DF41F7.tmp
06/11/2008 15:39:08          16384 byte      0 days old -- ~DFAA9.tmp
06/11/2008 15:40:37          16384 byte      0 days old -- ~DF7B1F.tmp
06/11/2008 15:41:13         311296 byte      0 days old -- ~DF1CE7.tmp
06/11/2008 15:43:01          32768 byte      0 days old -- ~DF4734.tmp
06/11/2008 15:58:44          16384 byte      0 days old -- ~DF3D3C.tmp
06/11/2008 15:59:27          16384 byte      0 days old -- ~DF98B.tmp
06/11/2008 16:00:06          32768 byte      0 days old -- ~DF172F.tmp
06/11/2008 16:10:56          16384 byte      0 days old -- ~DFD933.tmp
06/11/2008 16:11:18          16384 byte      0 days old -- ~DF9687.tmp
06/11/2008 16:12:14 (DIR)        0 byte      0 days old -- AVSETUP_4913094e
06/11/2008 16:13:05          32768 byte      0 days old -- ~DFE54A.tmp
06/11/2008 16:15:30          16384 byte      0 days old -- ~DF9A12.tmp
06/11/2008 16:15:43          32768 byte      0 days old -- ~DFEFB6.tmp
06/11/2008 16:20:14 (DIR)        0 byte      0 days old -- _avast4_
06/11/2008 16:24:21          16384 byte      0 days old -- ~DFE2D5.tmp
06/11/2008 16:25:23          16384 byte      0 days old -- ~DF5EFD.tmp
06/11/2008 16:26:07          16384 byte      0 days old -- ~DFF440.tmp
06/11/2008 16:29:07          16384 byte      0 days old -- ~DFED0F.tmp
06/11/2008 16:31:14          16384 byte      0 days old -- ~DF3471.tmp
06/11/2008 16:31:50          16384 byte      0 days old -- ~DFD017.tmp
06/11/2008 16:34:47          16384 byte      0 days old -- Perflib_Perfdata_a00.dat
06/11/2008 16:34:51          16384 byte      0 days old -- Perflib_Perfdata_da4.dat
06/11/2008 16:34:51          16384 byte      0 days old -- Perflib_Perfdata_dac.dat
06/11/2008 16:54:17              0 byte      0 days old -- is6.tmp
06/11/2008 16:54:36              0 byte      0 days old -- isA.tmp
06/11/2008 16:58:05          49152 byte      0 days old -- ~DF4FF4.tmp
06/11/2008 17:05:33          32768 byte      0 days old -- ~DF1D19.tmp
06/11/2008 17:09:48          32768 byte      0 days old -- ~DF2612.tmp
06/11/2008 17:14:09          32768 byte      0 days old -- ~DF1B2A.tmp
06/11/2008 17:24:18          32768 byte      0 days old -- ~DF3066.tmp
06/11/2008 17:26:00          32768 byte      0 days old -- ~DF659E.tmp
06/11/2008 17:32:19 (DIR)        0 byte      0 days old -- nsl3D.tmp
06/11/2008 17:35:01          32768 byte      0 days old -- ~DF7908.tmp
06/11/2008 18:18:49          32768 byte      0 days old -- ~DFA314.tmp
06/11/2008 18:31:43          16384 byte      0 days old -- ~DFD00C.tmp
06/11/2008 18:31:43 (DIR)        0 byte      0 days old -- nsq3F.tmp
06/11/2008 18:31:43            115 byte      0 days old -- systemscan.ini

===================== REGISTRY SCAN =====================


-----HKLM\Software\Microsoft\Windows\CurrentVersion\Run-----

[Run]
  "ATICCC"="\"C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe\""
  "NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe"
  "MAFWTaskbarApp"="C:\WINDOWS\system32\MAFWTray.exe"
  "RTHDCPL"="RTHDCPL.EXE"
  "SkyTel"="SkyTel.EXE"
  "Alcmtr"="ALCMTR.EXE"
  "PKR Pal"="\"C:\Program Files\PKR\pkrpal.exe\" -osboot"
  "H2O"="C:\Program Files\SyncroSoft\Pos\H2O\cledx.exe"
  "devenv"="C:\WINDOWS\system\smvss.exe /w"
  "FLMOFFICE4DMOUSE"="C:\Program Files\Trust\DS-4500X Wireless Laser Deskset\Mouse\mouse32a.exe"
  "OFFICEKB"="C:\Program Files\Trust\DS-4500X Wireless Laser Deskset\Keyboard\kbdap32a.EXE"
  "avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe"
  "spywarefighterguard"="C:\Program Files\SPYWAREfighter\spftray.exe"
  @=""

[Run\avp6_post_uninstall]

[Run\OptionalComponents]
  @=""

[Run\OptionalComponents\IMAIL]
  "Installed"="1"
  @=""

[Run\OptionalComponents\MAPI]
  "NoChange"="1"
  "Installed"="1"
  @=""

[Run\OptionalComponents\MSFS]
  "Installed"="1"
  @=""

-----HKCU\Software\Microsoft\Windows\CurrentVersion\Run-----

[Run]
  "MsnMsgr"="\"C:\Program Files\MSN Messenger\MsnMsgr.Exe\" /background"
  "MySpaceIM"="C:\Program Files\MySpace\IM\MySpaceIM.exe"
  "SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe"
  "SUPERAntiSpyware"="C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe"
  "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe"

-----HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Run-----

[Run]

-----HKLM\Software\Microsoft\Windows\CurrentVersion\policies\Explorer\Run-----

[Run]

-----HKCU\Software\Microsoft\Windows\CurrentVersion\policies\Explorer\Run-----

[Run]

-----HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows-----

[Windows]
  "AppInit_DLLs"=""

-----HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad-----

[ShellServiceObjectDelayLoad]
  "PostBootReminder"="{7849596a-48ea-486e-8937-a2a3009f31a9}"
    #### HKCR\CLSID\{7849596a-48ea-486e-8937-a2a3009f31a9}\InprocServer32 @=expand:"%SystemRoot%\system32\SHELL32.dll"
  "CDBurn"="{fbeb8a05-beee-4442-804e-409d6c4515e9}"
    #### HKCR\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InprocServer32 @=expand:"%SystemRoot%\system32\SHELL32.dll"
  "WebCheck"="{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"
    #### HKCR\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\InprocServer32 @=expand:"C:\WINDOWS\system32\webcheck.dll"
  "SysTray"="{35CEC8A3-2BE6-11D2-8773-92E220524153}"
    #### HKCR\CLSID\{35CEC8A3-2BE6-11D2-8773-92E220524153}\InprocServer32 @="C:\WINDOWS\system32\stobject.dll"

-----HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks-----

[ShellExecuteHooks]
  "{AEB6717E-7E19-11d0-97EE-00C04FD91972}"=""
    #### HKCR\CLSID\{AEB6717E-7E19-11d0-97EE-00C04FD91972}\InprocServer32 @="shell32.dll"

-----HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon-----

[Winlogon]
  "Shell"="Explorer.exe"
  "System"=""
  "Userinit"="C:\WINDOWS\system32\userinit.exe,"
  "VmApplet"="rundll32 shell32,Control_RunDLL \"sysdm.cpl\""
  "UIHost"=expand:"logonui.exe"
  "LogonType"=dword:00000001
  "WinStationsDisabled"="0"

[Winlogon\GPExtensions]

[Winlogon\GPExtensions\{3610eda5-77ef-11d2-8dc5-00c04fa31a66}]
  "@="Quota du disque Microsoft"
  "DllName"=expand:"dskquota.dll"

[Winlogon\GPExtensions\{4CFB60C1-FAA6-47f1-89AA-0B18730C9FD3}]
  "@="Internet Explorer Zonemapping"
  "DllName"=expand:"iedkcs32.dll"

[Winlogon\GPExtensions\{827D319E-6EAC-11D2-A4EA-00C04F79F83A}]
  "DllName"=expand:"scecli.dll"
  "@="Security"

[Winlogon\GPExtensions\{A2E30F80-D7DE-11d2-BBDE-00C04F86AE3B}]
  "DllName"="iedkcs32.dll"
  "@="Internet Explorer Branding"

[Winlogon\GPExtensions\{B1BE8D72-6EAC-11D2-A4EA-00C04F79F83A}]
  "DllName"=expand:"scecli.dll"
  "@="EFS recovery"

[Winlogon\GPExtensions\{C631DF4C-088F-4156-B058-4375F0853CD8}]
  "@="Microsoft Offline Files"
  "DllName"=expand:"%SystemRoot%\System32\cscui.dll"

[Winlogon\GPExtensions\{c6dc5466-785a-11d2-84d0-00c04fb169f7}]
  "@="Installation de logiciel"
  "DllName"=expand:"appmgmts.dll"

[Winlogon\Notify]

[Winlogon\Notify\!SASWinLogon]

[Winlogon\Notify\AtiExtEvent]
  "DLLName"="Ati2evxx.dll"

[Winlogon\Notify\crypt32chain]
  "DllName"=expand:"crypt32.dll"

[Winlogon\Notify\cryptnet]
  "DllName"=expand:"cryptnet.dll"

[Winlogon\Notify\cscdll]
  "DLLName"="cscdll.dll"

[Winlogon\Notify\ScCertProp]
  "DLLName"="wlnotify.dll"

[Winlogon\Notify\Schedule]
  "DllName"=expand:"wlnotify.dll"

[Winlogon\Notify\sclgntfy]
  "DllName"=expand:"sclgntfy.dll"

[Winlogon\Notify\SensLogn]
  "DLLName"="WlNotify.dll"

[Winlogon\Notify	ermsrv]
  "DllName"=expand:"wlnotify.dll"

[Winlogon\Notify\wlballoon]
  "DLLName"="wlnotify.dll"

[Winlogon\SpecialAccounts]

[Winlogon\SpecialAccounts\UserList]
  "HelpAssistant"=dword:00000000
  "TsInternetUser"=dword:00000000
  "SQLAgentCmdExec"=dword:00000000
  "NetShowServices"=dword:00000000
  "IWAM_"=dword:00010000
  "IUSR_"=dword:00010000
  "VUSR_"=dword:00010000

-----HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon-----

[Winlogon]
  "ParseAutoexec"="1"
  "ExcludeProfileDirs"="Local Settings;Temporary Internet Files;Historique;Temp"
  "BuildNumber"=dword:00000a28

-----HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options-----

[Image File Execution Options\Your Image File Name Here without a path]
  "Debugger"="ntsd -d"

-----HKLM\System\CurrentControlSet\Control\Session Manager\-----

[Session Manager]
  "BootExecute"=multi:"autocheck autochk *\00\00"

[Session Manager\SubSystems]
  "Windows"=expand:"%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,3072,512 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ProfileControl=Off MaxRequestThreads=16"

-----HKLM\SYSTEM\CurrentControlSet\Control\WOW-----

[WOW]
  "cmdline"=expand:"%SystemRoot%\system32
tvdm.exe"
  "wowcmdline"=expand:"%SystemRoot%\system32
tvdm.exe -a %SystemRoot%\system32\krnl386"

-----HKLM\Software\Microsoft\Windows NT\CurrentVersion\Run-----

[run]

-----HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce-----

[RunOnce]

-----HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx-----

[RunOnceEx]

-----HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices-----

[RunServices]

-----HKLM\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce-----

[RunServicesOnce]

-----HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce-----

[RunOnce]

-----HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnceEx-----

-----HKCU\Software\Microsoft\Windows\CurrentVersion\RunServices-----

[RunServices]

-----HKCU\Software\Microsoft\Windows NT\CurrentVersion\Run-----

-----HKCU\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce-----

[RunServicesOnce]

-----HKLM\Software\Microsoft\Command Processor\Autorun-----

-----HKCU\Software\Microsoft\Command Processor\Autorun-----

-----HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows\Load-----

-----HKLM\Software\Policies\Microsoft\Windows\System\Scripts\Startup-----

-----HKCU\Software\Policies\Microsoft\Windows\System\Scripts\Logon-----

-----HKLM\Software\Policies\Microsoft\Windows\System\Scripts\Logon-----

-----HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\TerminalServer\Install\Software\Microsoft\Windows\CurrentVersion\Runonce-----

-----HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\TerminalServer\Install\Software\Microsoft\Windows\CurrentVersion\Run-----

-----HKLM\System\CurrentControlSet\Control\Terminal Server\Wdsdpwd\StartupPrograms-----

-----HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\TerminalServer\Install\Software\Microsoft\Windows\CurrentVersion\Runonce-----

-----HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler-----

[SharedTaskScheduler]
  "{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Pré-chargeur Browseui"
    #### HKCR\CLSID\{438755C2-A8BA-11D1-B96B-00A0C90312E1}\InprocServer32 @=expand:"%SystemRoot%\system32\browseui.dll"
  "{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Démon de cache des catégories de composant"
    #### HKCR\CLSID\{8C7461EF-2B13-11d2-BE35-3078302C2030}\InprocServer32 @=expand:"%SystemRoot%\system32\browseui.dll"

-----HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects-----

[Browser Helper Objects]
  @=""

[Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
  @=""

[Browser Helper Objects\{53707962-6F74-2D53-2644-206D7942484F}]
    #### HKCR\CLSID\{53707962-6F74-2D53-2644-206D7942484F}\InprocServer32 @="C:\PROGRA~1\SPYBOT~1\SDHelper.dll"

[Browser Helper Objects\{7009fcd4-05be-44f4-9583-93fe419ab7b0}]
    #### HKCR\CLSID\{7009fcd4-05be-44f4-9583-93fe419ab7b0}\InprocServer32 @="C:\Program Files\Multi_Media_France	bMul0.dll"
  @=""

[Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
    #### HKCR\CLSID\{9030D464-4C02-4ABF-8ECC-5164760863C6}\InprocServer32 @="C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll"

-----HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks-----

[URLSearchHooks]
  "{CFBFAE00-17A6-11D0-99CB-00C04FD64497}"=""
    #### HKCR\CLSID\{CFBFAE00-17A6-11D0-99CB-00C04FD64497}\InprocServer32 @="C:\WINDOWS\system32\ieframe.dll"

-----HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig-----

-----HKCU\Control Panel\Desktop\-----

[Desktop]
  "SCRNSAVE.EXE"="C:\WINDOWS\system32\ssstars.scr"

[Desktop\WindowMetrics]

-----HKEY_CLASSES_ROOT\exefile\shell\open\command-----

[command]

Sophie · Answer

SystemScan - www.suspectfile.com - ver. 3.5.5 (code: holifay & bReAkdOWn)

Running on: Windows XP HOME Edition, Service Pack 2 (2600.5.1)
System directory: C:\WINDOWS
SystemScan file: C:\Documents and Settings\Propriétaire\Local Settings\Temporary Internet Files\Content.IE5\X45LC4WY\sys48504[1].exe
Running in: User mode
Date: 06/11/2008
Time: 18:32:32
  
Output limited to: 
 -Recent files
 -Registry Run Keys
 -Suspicious Files

===================== RECENT FILES =====================

Showing files newer than  30 days

----- recent files in C:\
04/11/2008 18:14:33 (DIR)        0 byte      2 days old -- Deckard
06/11/2008 16:34:07      2145386496 byte      0 days old -- pagefile.sys
06/11/2008 16:54:38 (DIR)        0 byte      0 days old -- Program Files
06/11/2008 16:56:08 (DIR)        0 byte      0 days old -- Config.Msi
06/11/2008 17:05:02           1264 byte      0 days old -- TCleaner.txt
06/11/2008 17:07:31 (DIR)        0 byte      0 days old -- System Volume Information
06/11/2008 17:09:19 (DIR)        0 byte      0 days old -- ComboFix
06/11/2008 17:17:41           3660 byte      0 days old -- Bug.txt
06/11/2008 17:17:42 (DIR)        0 byte      0 days old -- Combo-Fix
06/11/2008 17:17:47 (DIR)        0 byte      0 days old -- WINDOWS

----- recent files in C:\WINDOWS\
04/11/2008 12:27:54 (DIR)        0 byte      2 days old -- Minidump
04/11/2008 12:47:51 (DIR)        0 byte      2 days old -- Tasks
04/11/2008 12:51:02              0 byte      2 days old -- setuperr.log
04/11/2008 12:53:08           9170 byte      2 days old -- KB943055Uninst.log
04/11/2008 18:14:42 (DIR)        0 byte      2 days old -- ERDNT
04/11/2008 20:49:01 (DIR)        0 byte      2 days old -- Debug
04/11/2008 20:49:46 (DIR)        0 byte      2 days old -- $NtUninstallKB943055$
04/11/2008 20:49:49          11413 byte      2 days old -- KB943055.log
04/11/2008 20:49:52 (DIR)        0 byte      2 days old -- $NtUninstallKB950749$
04/11/2008 20:49:56          14173 byte      2 days old -- KB950749.log
04/11/2008 20:49:58 (DIR)        0 byte      2 days old -- $NtUninstallKB945553$
04/11/2008 20:49:59          12373 byte      2 days old -- KB945553.log
04/11/2008 20:50:02 (DIR)        0 byte      2 days old -- $NtUninstallKB944338$
04/11/2008 20:50:03          13476 byte      2 days old -- KB944338.log
04/11/2008 20:50:05 (DIR)        0 byte      2 days old -- $NtUninstallKB948590$
04/11/2008 20:50:06          12774 byte      2 days old -- KB948590.log
04/11/2008 20:50:07 (DIR)        0 byte      2 days old -- $NtUninstallKB941693$
04/11/2008 20:50:09          12974 byte      2 days old -- KB941693.log
04/11/2008 20:50:13 (DIR)        0 byte      2 days old -- $NtUninstallKB947864$
04/11/2008 20:50:19          20085 byte      2 days old -- KB947864.log
04/11/2008 20:50:20 (DIR)        0 byte      2 days old -- $NtUninstallKB948881$
04/11/2008 20:50:22          11204 byte      2 days old -- KB948881.log
05/11/2008 12:58:01 (DIR)        0 byte      1 days old -- $NtUninstallKB904942$
05/11/2008 12:58:04          11030 byte      1 days old -- KB904942.log
05/11/2008 12:58:06 (DIR)        0 byte      1 days old -- $NtUninstallKB914440$
05/11/2008 12:58:07 (DIR)        0 byte      1 days old -- network diagnostic
05/11/2008 12:58:08           5198 byte      1 days old -- KB914440.log
05/11/2008 12:58:53 (DIR)        0 byte      1 days old -- $NtUninstallKB915865$
05/11/2008 12:58:57           6278 byte      1 days old -- KB915865.log
05/11/2008 12:59:06 (DIR)        0 byte      1 days old -- $NtServicePackUninstallNLSDownlevelMapping$
05/11/2008 12:59:09           7177 byte      1 days old -- NLSDownlevelMapping.log
05/11/2008 12:59:16 (DIR)        0 byte      1 days old -- $NtServicePackUninstallIDNMitigationAPIs$
05/11/2008 12:59:20           7485 byte      1 days old -- IDNMitigationAPIs.log
05/11/2008 13:00:09 (DIR)        0 byte      1 days old -- ie7
05/11/2008 13:00:17 (DIR)        0 byte      1 days old -- Media
05/11/2008 13:00:21 (DIR)        0 byte      1 days old -- WBEM
05/11/2008 13:00:27          57821 byte      1 days old -- ie7.log
05/11/2008 13:00:49 (DIR)        0 byte      1 days old -- ie7updates
05/11/2008 13:01:00          72190 byte      1 days old -- KB944533-IE7.log
05/11/2008 13:01:11          45658 byte      1 days old -- updspapi.log
05/11/2008 13:01:15          50000 byte      1 days old -- KB947864-IE7.log
05/11/2008 13:01:36          35377 byte      1 days old -- ie7_main.log
05/11/2008 13:02:42 (DIR)        0 byte      1 days old -- Help
05/11/2008 13:03:16           6286 byte      1 days old -- spupdsvc.log
05/11/2008 13:33:23             60 byte      1 days old -- setupact.log
05/11/2008 18:18:13         117714 byte      1 days old -- ntbtlog.txt
06/11/2008 09:00:51 (DIR)        0 byte      0 days old -- $hf_mig$
06/11/2008 09:17:30 (DIR)        0 byte      0 days old -- system
06/11/2008 10:18:12 (DIR)        0 byte      0 days old -- $NtUninstallKB932823-v3$
06/11/2008 10:18:18          10097 byte      0 days old -- KB932823-v3.log
06/11/2008 10:18:19           1374 byte      0 days old -- imsins.BAK
06/11/2008 10:18:25          75274 byte      0 days old -- ocgen.log
06/11/2008 10:18:25          56446 byte      0 days old -- tsoc.log
06/11/2008 10:18:25          48869 byte      0 days old -- setupapi.log
06/11/2008 10:18:25           8054 byte      0 days old -- ocmsn.log
06/11/2008 10:18:25           1374 byte      0 days old -- imsins.log
06/11/2008 10:18:25 (DIR)        0 byte      0 days old -- inf
06/11/2008 10:18:25          21821 byte      0 days old -- iis6.log
06/11/2008 10:18:25          48411 byte      0 days old -- comsetup.log
06/11/2008 10:18:25         139927 byte      0 days old -- FaxSetup.log
06/11/2008 10:18:25           7402 byte      0 days old -- msgsocm.log
06/11/2008 10:18:25          31031 byte      0 days old -- ntdtcsetup.log
06/11/2008 10:18:25          10950 byte      0 days old -- KB938127-IE7.log
06/11/2008 15:53:02 (DIR)        0 byte      0 days old -- Prefetch
06/11/2008 16:33:10          23478 byte      0 days old -- SchedLgU.Txt
06/11/2008 16:34:11           2048 byte      0 days old -- bootstat.dat
06/11/2008 16:34:12              0 byte      0 days old -- 0.log
06/11/2008 16:34:23             50 byte      0 days old -- wiaservc.log
06/11/2008 16:34:26            159 byte      0 days old -- wiadebug.log
06/11/2008 16:56:08 (DIR)        0 byte      0 days old -- WinSxS
06/11/2008 16:56:15 (DIR)        0 byte      0 days old -- Installer
06/11/2008 17:17:41 (DIR)        0 byte      0 days old -- system32
06/11/2008 17:39:27         698171 byte      0 days old -- WindowsUpdate.log
06/11/2008 17:48:32 (DIR)        0 byte      0 days old -- Temp

----- recent files in C:\WINDOWS\Downloaded Program Files\

----- recent files in C:\WINDOWS\system\

----- recent files in C:\WINDOWS\system32\
04/11/2008 12:11:54          13702 byte      2 days old -- wpa.dbl
04/11/2008 12:14:58        1070888 byte      2 days old -- PerfStringBackup.INI
04/11/2008 12:15:00          83620 byte      2 days old -- perfc00C.dat
04/11/2008 12:15:00          70106 byte      2 days old -- perfc009.dat
04/11/2008 12:15:00         485868 byte      2 days old -- perfh00C.dat
04/11/2008 12:15:00         418590 byte      2 days old -- perfh009.dat
05/11/2008 10:53:41          91888 byte      1 days old -- FNTCACHE.DAT
05/11/2008 13:00:55 (DIR)        0 byte      1 days old -- fr-fr
06/11/2008 10:18:24 (DIR)        0 byte      0 days old -- dllcache
06/11/2008 15:04:53 (DIR)        0 byte      0 days old -- CatRoot2
06/11/2008 16:20:13           3121 byte      0 days old -- CONFIG.NT
06/11/2008 16:28:07 (DIR)        0 byte      0 days old -- drivers
06/11/2008 17:07:31 (DIR)        0 byte      0 days old -- Restore

----- recent files in C:\WINDOWS\system32\drivers\

----- recent files in C:\WINDOWS	emp\
06/11/2008 16:17:38         965569 byte      0 days old -- fa56d7ec.$$$
06/11/2008 16:34:16          16384 byte      0 days old -- Perflib_Perfdata_658.dat
06/11/2008 17:48:32          16384 byte      0 days old -- Perflib_Perfdata_8ec.dat
06/11/2008 18:16:31 (DIR)        0 byte      0 days old -- _avast4_

----- recent files in C:\Program Files\
04/11/2008 12:44:13 (DIR)        0 byte      2 days old -- ATI Technologies
04/11/2008 12:55:53 (DIR)        0 byte      2 days old -- Windows Live Toolbar
05/11/2008 16:09:17 (DIR)        0 byte      1 days old -- eMule
05/11/2008 16:17:51 (DIR)        0 byte      1 days old -- Internet Explorer
05/11/2008 20:34:33 (DIR)        0 byte      1 days old -- Messenger
05/11/2008 20:34:33 (DIR)        0 byte      1 days old -- M-Audio Firewire Audiophile
05/11/2008 20:34:33 (DIR)        0 byte      1 days old -- DivX
05/11/2008 20:36:52 (DIR)        0 byte      1 days old -- MySpace
06/11/2008 15:02:36 (DIR)        0 byte      0 days old -- PKR
06/11/2008 16:55:02 (DIR)        0 byte      0 days old -- Fichiers communs
06/11/2008 16:56:30 (DIR)        0 byte      0 days old -- SPYWAREfighter
06/11/2008 17:04:44 (DIR)        0 byte      0 days old -- Trend Micro

----- recent files in C:\Program Files\Fichiers communs\
06/11/2008 16:55:02 (DIR)        0 byte      0 days old -- Application

----- recent files in C:\Documents and Settings\Propriétaire\Application Data\
04/11/2008 13:48:47 (DIR)        0 byte      2 days old -- Malwarebytes
05/11/2008 13:09:44 (DIR)        0 byte      1 days old -- SUPERAntiSpyware.com

----- recent files in C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\
04/11/2008 18:20:11          16384 byte      2 days old -- ~DF3333.tmp
04/11/2008 18:46:09         239104 byte      2 days old -- 71exhmunmlclr14.exe
04/11/2008 18:46:09         239104 byte      2 days old -- 75exhmunmlclr14.exe
04/11/2008 18:46:09         239104 byte      2 days old -- 88exhmunmlclr14.exe
04/11/2008 18:46:09         239104 byte      2 days old -- 24exhmunmlclr14.exe
04/11/2008 19:05:45          16384 byte      2 days old -- ~DF8B63.tmp
04/11/2008 19:14:04          32768 byte      2 days old -- ~DF3D4F.tmp
04/11/2008 20:48:26          16384 byte      2 days old -- ~DF6387.tmp
05/11/2008 11:05:41          22704 byte      1 days old -- Danish.bin
05/11/2008 11:05:41          25670 byte      1 days old -- Dutch.bin
05/11/2008 11:05:41          16913 byte      1 days old -- TradChin.bin
05/11/2008 11:05:41          24256 byte      1 days old -- Japanese.bin
05/11/2008 11:05:41          20101 byte      1 days old -- Korean.bin
05/11/2008 11:05:42          27178 byte      1 days old -- French.bin
05/11/2008 11:05:43          24028 byte      1 days old -- SWEDISH.bin
05/11/2008 11:05:43          25684 byte      1 days old -- German.bin
05/11/2008 11:05:43          26062 byte      1 days old -- Russian.bin
05/11/2008 11:05:43          27689 byte      1 days old -- Spanish.bin
05/11/2008 11:05:43          27330 byte      1 days old -- Italian.bin
05/11/2008 11:05:44          26187 byte      1 days old -- Portuguese.bin
05/11/2008 11:05:44          21913 byte      1 days old -- Thai.bin
05/11/2008 11:05:44          20919 byte      1 days old -- Arabic.bin
05/11/2008 11:05:44          21857 byte      1 days old -- English.bin
05/11/2008 11:05:44          16374 byte      1 days old -- SimChin.bin
05/11/2008 11:05:45          24999 byte      1 days old -- Portuguese(Brazil).bin
05/11/2008 11:05:45          24147 byte      1 days old -- Polish.bin
05/11/2008 11:05:45          25003 byte      1 days old -- Greek.bin
05/11/2008 11:05:45          24252 byte      1 days old -- Czech.bin
05/11/2008 11:05:46          22793 byte      1 days old -- Finnish.bin
05/11/2008 11:05:47          19487 byte      1 days old -- Hebrew.bin
05/11/2008 11:05:47          26001 byte      1 days old -- Hungarian.bin
05/11/2008 11:05:48          21901 byte      1 days old -- Norwegian.bin
05/11/2008 11:05:48          22194 byte      1 days old -- Turkish.bin
05/11/2008 11:27:14          32768 byte      1 days old -- ~DF6515.tmp
05/11/2008 11:31:17          16384 byte      1 days old -- ~DF9D46.tmp
05/11/2008 11:31:34          16384 byte      1 days old -- ~DF7191.tmp
05/11/2008 11:31:58          16384 byte      1 days old -- ~DF1672.tmp
05/11/2008 11:32:48          16384 byte      1 days old -- ~DFD13B.tmp
05/11/2008 11:33:22          16384 byte      1 days old -- ~DFA2FD.tmp
05/11/2008 11:42:31          32768 byte      1 days old -- ~DF638.tmp
05/11/2008 11:44:33          32768 byte      1 days old -- ~DF34FC.tmp
05/11/2008 11:49:16          16384 byte      1 days old -- ~DF2494.tmp
05/11/2008 11:49:16          16384 byte      1 days old -- ~DF23B5.tmp
05/11/2008 11:50:14          16384 byte      1 days old -- ~DF23C4.tmp
05/11/2008 11:53:30          16384 byte      1 days old -- ~DF45C4.tmp
05/11/2008 11:54:23          32768 byte      1 days old -- ~DF7AF.tmp
05/11/2008 11:57:13          16384 byte      1 days old -- ~DF214A.tmp
05/11/2008 11:57:40          32768 byte      1 days old -- ~DFD70B.tmp
05/11/2008 12:06:58          16384 byte      1 days old -- ~DFA66A.tmp
05/11/2008 12:09:48          32768 byte      1 days old -- ~DFB01E.tmp
05/11/2008 12:20:27          16384 byte      1 days old -- ~DF1DB1.tmp
05/11/2008 12:20:50          16384 byte      1 days old -- ~DFBA1E.tmp
05/11/2008 12:22:24          32768 byte      1 days old -- ~DF3E3D.tmp
05/11/2008 12:25:54          16384 byte      1 days old -- ~DF5412.tmp
05/11/2008 12:26:21          32768 byte      1 days old -- ~DF150A.tmp
05/11/2008 12:28:38          32768 byte      1 days old -- ~DF60E8.tmp
05/11/2008 12:30:18          32768 byte      1 days old -- ~DF6AD1.tmp
05/11/2008 12:34:10          16384 byte      1 days old -- ~DFEBB.tmp
05/11/2008 12:50:14          32768 byte      1 days old -- ~DF8F7A.tmp
05/11/2008 12:51:34          16384 byte      1 days old -- ~DFFCE4.tmp
05/11/2008 13:03:17             54 byte      1 days old -- hmunmlclr14.exe.conf
05/11/2008 13:06:05          16384 byte      1 days old -- ~DF3079.tmp
05/11/2008 13:07:32          16384 byte      1 days old -- ~DF4070.tmp
05/11/2008 13:09:58          16384 byte      1 days old -- ~DF8638.tmp
05/11/2008 13:11:45          16384 byte      1 days old -- ~DF1BF6.tmp
05/11/2008 13:11:46              0 byte      1 days old -- 88313.dmp
05/11/2008 13:12:32          16384 byte      1 days old -- ~DF9948.tmp
05/11/2008 13:12:49          16384 byte      1 days old -- ~DF430A.tmp
05/11/2008 13:14:44          16384 byte      1 days old -- ~DF8882.tmp
05/11/2008 13:30:14          16316 byte      1 days old -- 6394_appcompat.txt
05/11/2008 13:30:20          75860 byte      1 days old -- 196E60.dmp
05/11/2008 13:30:50 (DIR)        0 byte      1 days old -- WERe1a5.dir00
05/11/2008 13:30:50 (DIR)        0 byte      1 days old -- WERea67.dir00
05/11/2008 13:32:24          16384 byte      1 days old -- ~DF7932.tmp
05/11/2008 13:33:08 (DIR)        0 byte      1 days old -- WERf61a.dir00
05/11/2008 13:39:59          16384 byte      1 days old -- ~DFD7EB.tmp
05/11/2008 13:40:18 (DIR)        0 byte      1 days old -- WER8f52.dir00
05/11/2008 13:40:20 (DIR)        0 byte      1 days old -- WER918b.dir00
05/11/2008 13:43:22          16384 byte      1 days old -- ~DFDB6A.tmp
05/11/2008 13:43:50          32298 byte      1 days old -- de41_appcompat.txt
05/11/2008 13:44:49 (DIR)        0 byte      1 days old -- ~nsu.tmp
05/11/2008 13:53:45          16384 byte      1 days old -- ~DFEEDF.tmp
05/11/2008 13:53:56          16384 byte      1 days old -- Perflib_Perfdata_808.dat
05/11/2008 13:54:45 (DIR)        0 byte      1 days old -- WER3a07.dir00
05/11/2008 13:56:10          16384 byte      1 days old -- ~DF5FA5.tmp
05/11/2008 13:57:24          16384 byte      1 days old -- ~DF536A.tmp
05/11/2008 13:57:59          16384 byte      1 days old -- ~DF4193.tmp
05/11/2008 13:59:31          16384 byte      1 days old -- ~DF7F9F.tmp
05/11/2008 14:01:28          16384 byte      1 days old -- ~DF89.tmp
05/11/2008 14:02:16          16384 byte      1 days old -- ~DF34F.tmp
05/11/2008 15:08:31         239104 byte      1 days old -- 46exhmunmlclr15.exe
05/11/2008 15:08:31         239104 byte      1 days old -- 60exhmunmlclr15.exe
05/11/2008 15:08:31         239104 byte      1 days old -- 79exhmunmlclr15.exe
05/11/2008 15:47:47          16384 byte      1 days old -- ~DF2136.tmp
05/11/2008 15:48:43          16316 byte      1 days old -- efda_appcompat.txt
05/11/2008 15:48:48          79711 byte      1 days old -- 2FB0F.dmp
05/11/2008 15:48:53          16384 byte      1 days old -- ~DF9F2B.tmp
05/11/2008 15:51:44          10144 byte      1 days old -- MPC5.tmp
05/11/2008 15:54:52          16384 byte      1 days old -- ~DFC6BC.tmp
05/11/2008 16:09:05             54 byte      1 days old -- hmunmlclr15.exe.conf
05/11/2008 16:13:12          16384 byte      1 days old -- ~DF6329.tmp
05/11/2008 16:18:17          16384 byte      1 days old -- ~DFBFC8.tmp
05/11/2008 16:18:33          16384 byte      1 days old -- ~DF7EC1.tmp
05/11/2008 16:19:06          16384 byte      1 days old -- ~DF16CD.tmp
05/11/2008 16:21:01          32768 byte      1 days old -- ~DF18AE.tmp
05/11/2008 16:31:24 (DIR)        0 byte      1 days old -- {E09B48B5-E141-427A-AB0C-D3605127224A}
05/11/2008 16:35:48          16384 byte      1 days old -- ~DFE243.tmp
05/11/2008 16:39:53          16384 byte      1 days old -- ~DF9898.tmp
05/11/2008 16:40:07          16384 byte      1 days old -- ~DF4EDB.tmp
05/11/2008 16:41:25          16384 byte      1 days old -- ~DF5CB1.tmp
05/11/2008 18:58:45          32768 byte      1 days old -- ~DF84C.tmp
05/11/2008 20:54:31          16384 byte      1 days old -- ~DF1F42.tmp
05/11/2008 20:54:57          16384 byte      1 days old -- ~DF7E1A.tmp
06/11/2008 09:10:34          16384 byte      0 days old -- ~DFF265.tmp
06/11/2008 09:11:12          16384 byte      0 days old -- ~DFC471.tmp
06/11/2008 09:13:00          32768 byte      0 days old -- ~DFCC98.tmp
06/11/2008 09:20:46          32768 byte      0 days old -- ~DFF5DB.tmp
06/11/2008 09:29:12          32768 byte      0 days old -- ~DF2C5F.tmp
06/11/2008 09:35:02          32768 byte      0 days old -- ~DF9840.tmp
06/11/2008 10:00:04          32768 byte      0 days old -- ~DF4304.tmp
06/11/2008 10:08:16          16384 byte      0 days old -- ~DFA144.tmp
06/11/2008 14:52:12          16384 byte      0 days old -- ~DF60BA.tmp
06/11/2008 14:54:17          32768 byte      0 days old -- ~DFACD8.tmp
06/11/2008 15:02:40          16384 byte      0 days old -- ~DF3CC3.tmp
06/11/2008 15:09:50          16384 byte      0 days old -- ~DFF540.tmp
06/11/2008 15:10:17          32768 byte      0 days old -- ~DFC9B4.tmp
06/11/2008 15:12:34          16384 byte      0 days old -- ~DF490C.tmp
06/11/2008 15:13:29          32768 byte      0 days old -- ~DFC226.tmp
06/11/2008 15:29:11           9450 byte      0 days old -- caevents.log
06/11/2008 15:35:01          16384 byte      0 days old -- ~DF41F7.tmp
06/11/2008 15:39:08          16384 byte      0 days old -- ~DFAA9.tmp
06/11/2008 15:40:37          16384 byte      0 days old -- ~DF7B1F.tmp
06/11/2008 15:41:13         311296 byte      0 days old -- ~DF1CE7.tmp
06/11/2008 15:43:01          32768 byte      0 days old -- ~DF4734.tmp
06/11/2008 15:58:44          16384 byte      0 days old -- ~DF3D3C.tmp
06/11/2008 15:59:27          16384 byte      0 days old -- ~DF98B.tmp
06/11/2008 16:00:06          32768 byte      0 days old -- ~DF172F.tmp
06/11/2008 16:10:56          16384 byte      0 days old -- ~DFD933.tmp
06/11/2008 16:11:18          16384 byte      0 days old -- ~DF9687.tmp
06/11/2008 16:12:14 (DIR)        0 byte      0 days old -- AVSETUP_4913094e
06/11/2008 16:13:05          32768 byte      0 days old -- ~DFE54A.tmp
06/11/2008 16:15:30          16384 byte      0 days old -- ~DF9A12.tmp
06/11/2008 16:15:43          32768 byte      0 days old -- ~DFEFB6.tmp
06/11/2008 16:20:14 (DIR)        0 byte      0 days old -- _avast4_
06/11/2008 16:24:21          16384 byte      0 days old -- ~DFE2D5.tmp
06/11/2008 16:25:23          16384 byte      0 days old -- ~DF5EFD.tmp
06/11/2008 16:26:07          16384 byte      0 days old -- ~DFF440.tmp
06/11/2008 16:29:07          16384 byte      0 days old -- ~DFED0F.tmp
06/11/2008 16:31:14          16384 byte      0 days old -- ~DF3471.tmp
06/11/2008 16:31:50          16384 byte      0 days old -- ~DFD017.tmp
06/11/2008 16:34:47          16384 byte      0 days old -- Perflib_Perfdata_a00.dat
06/11/2008 16:34:51          16384 byte      0 days old -- Perflib_Perfdata_da4.dat
06/11/2008 16:34:51          16384 byte      0 days old -- Perflib_Perfdata_dac.dat
06/11/2008 16:54:17              0 byte      0 days old -- is6.tmp
06/11/2008 16:54:36              0 byte      0 days old -- isA.tmp
06/11/2008 16:58:05          49152 byte      0 days old -- ~DF4FF4.tmp
06/11/2008 17:05:33          32768 byte      0 days old -- ~DF1D19.tmp
06/11/2008 17:09:48          32768 byte      0 days old -- ~DF2612.tmp
06/11/2008 17:14:09          32768 byte      0 days old -- ~DF1B2A.tmp
06/11/2008 17:24:18          32768 byte      0 days old -- ~DF3066.tmp
06/11/2008 17:26:00          32768 byte      0 days old -- ~DF659E.tmp
06/11/2008 17:32:19 (DIR)        0 byte      0 days old -- nsl3D.tmp
06/11/2008 17:35:01          32768 byte      0 days old -- ~DF7908.tmp
06/11/2008 18:18:49          32768 byte      0 days old -- ~DFA314.tmp
06/11/2008 18:31:43          16384 byte      0 days old -- ~DFD00C.tmp
06/11/2008 18:31:43 (DIR)        0 byte      0 days old -- nsq3F.tmp
06/11/2008 18:31:43            115 byte      0 days old -- systemscan.ini

===================== REGISTRY SCAN =====================


-----HKLM\Software\Microsoft\Windows\CurrentVersion\Run-----

[Run]
  "ATICCC"="\"C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe\""
  "NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe"
  "MAFWTaskbarApp"="C:\WINDOWS\system32\MAFWTray.exe"
  "RTHDCPL"="RTHDCPL.EXE"
  "SkyTel"="SkyTel.EXE"
  "Alcmtr"="ALCMTR.EXE"
  "PKR Pal"="\"C:\Program Files\PKR\pkrpal.exe\" -osboot"
  "H2O"="C:\Program Files\SyncroSoft\Pos\H2O\cledx.exe"
  "devenv"="C:\WINDOWS\system\smvss.exe /w"
  "FLMOFFICE4DMOUSE"="C:\Program Files\Trust\DS-4500X Wireless Laser Deskset\Mouse\mouse32a.exe"
  "OFFICEKB"="C:\Program Files\Trust\DS-4500X Wireless Laser Deskset\Keyboard\kbdap32a.EXE"
  "avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe"
  "spywarefighterguard"="C:\Program Files\SPYWAREfighter\spftray.exe"
  @=""

[Run\avp6_post_uninstall]

[Run\OptionalComponents]
  @=""

[Run\OptionalComponents\IMAIL]
  "Installed"="1"
  @=""

[Run\OptionalComponents\MAPI]
  "NoChange"="1"
  "Installed"="1"
  @=""

[Run\OptionalComponents\MSFS]
  "Installed"="1"
  @=""

-----HKCU\Software\Microsoft\Windows\CurrentVersion\Run-----

[Run]
  "MsnMsgr"="\"C:\Program Files\MSN Messenger\MsnMsgr.Exe\" /background"
  "MySpaceIM"="C:\Program Files\MySpace\IM\MySpaceIM.exe"
  "SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe"
  "SUPERAntiSpyware"="C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe"
  "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe"

-----HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Run-----

[Run]

-----HKLM\Software\Microsoft\Windows\CurrentVersion\policies\Explorer\Run-----

[Run]

-----HKCU\Software\Microsoft\Windows\CurrentVersion\policies\Explorer\Run-----

[Run]

-----HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows-----

[Windows]
  "AppInit_DLLs"=""

-----HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad-----

[ShellServiceObjectDelayLoad]
  "PostBootReminder"="{7849596a-48ea-486e-8937-a2a3009f31a9}"
    #### HKCR\CLSID\{7849596a-48ea-486e-8937-a2a3009f31a9}\InprocServer32 @=expand:"%SystemRoot%\system32\SHELL32.dll"
  "CDBurn"="{fbeb8a05-beee-4442-804e-409d6c4515e9}"
    #### HKCR\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InprocServer32 @=expand:"%SystemRoot%\system32\SHELL32.dll"
  "WebCheck"="{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"
    #### HKCR\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\InprocServer32 @=expand:"C:\WINDOWS\system32\webcheck.dll"
  "SysTray"="{35CEC8A3-2BE6-11D2-8773-92E220524153}"
    #### HKCR\CLSID\{35CEC8A3-2BE6-11D2-8773-92E220524153}\InprocServer32 @="C:\WINDOWS\system32\stobject.dll"

-----HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks-----

[ShellExecuteHooks]
  "{AEB6717E-7E19-11d0-97EE-00C04FD91972}"=""
    #### HKCR\CLSID\{AEB6717E-7E19-11d0-97EE-00C04FD91972}\InprocServer32 @="shell32.dll"

-----HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon-----

[Winlogon]
  "Shell"="Explorer.exe"
  "System"=""
  "Userinit"="C:\WINDOWS\system32\userinit.exe,"
  "VmApplet"="rundll32 shell32,Control_RunDLL \"sysdm.cpl\""
  "UIHost"=expand:"logonui.exe"
  "LogonType"=dword:00000001
  "WinStationsDisabled"="0"

[Winlogon\GPExtensions]

[Winlogon\GPExtensions\{3610eda5-77ef-11d2-8dc5-00c04fa31a66}]
  "@="Quota du disque Microsoft"
  "DllName"=expand:"dskquota.dll"

[Winlogon\GPExtensions\{4CFB60C1-FAA6-47f1-89AA-0B18730C9FD3}]
  "@="Internet Explorer Zonemapping"
  "DllName"=expand:"iedkcs32.dll"

[Winlogon\GPExtensions\{827D319E-6EAC-11D2-A4EA-00C04F79F83A}]
  "DllName"=expand:"scecli.dll"
  "@="Security"

[Winlogon\GPExtensions\{A2E30F80-D7DE-11d2-BBDE-00C04F86AE3B}]
  "DllName"="iedkcs32.dll"
  "@="Internet Explorer Branding"

[Winlogon\GPExtensions\{B1BE8D72-6EAC-11D2-A4EA-00C04F79F83A}]
  "DllName"=expand:"scecli.dll"
  "@="EFS recovery"

[Winlogon\GPExtensions\{C631DF4C-088F-4156-B058-4375F0853CD8}]
  "@="Microsoft Offline Files"
  "DllName"=expand:"%SystemRoot%\System32\cscui.dll"

[Winlogon\GPExtensions\{c6dc5466-785a-11d2-84d0-00c04fb169f7}]
  "@="Installation de logiciel"
  "DllName"=expand:"appmgmts.dll"

[Winlogon\Notify]

[Winlogon\Notify\!SASWinLogon]

[Winlogon\Notify\AtiExtEvent]
  "DLLName"="Ati2evxx.dll"

[Winlogon\Notify\crypt32chain]
  "DllName"=expand:"crypt32.dll"

[Winlogon\Notify\cryptnet]
  "DllName"=expand:"cryptnet.dll"

[Winlogon\Notify\cscdll]
  "DLLName"="cscdll.dll"

[Winlogon\Notify\ScCertProp]
  "DLLName"="wlnotify.dll"

[Winlogon\Notify\Schedule]
  "DllName"=expand:"wlnotify.dll"

[Winlogon\Notify\sclgntfy]
  "DllName"=expand:"sclgntfy.dll"

[Winlogon\Notify\SensLogn]
  "DLLName"="WlNotify.dll"

[Winlogon\Notify	ermsrv]
  "DllName"=expand:"wlnotify.dll"

[Winlogon\Notify\wlballoon]
  "DLLName"="wlnotify.dll"

[Winlogon\SpecialAccounts]

[Winlogon\SpecialAccounts\UserList]
  "HelpAssistant"=dword:00000000
  "TsInternetUser"=dword:00000000
  "SQLAgentCmdExec"=dword:00000000
  "NetShowServices"=dword:00000000
  "IWAM_"=dword:00010000
  "IUSR_"=dword:00010000
  "VUSR_"=dword:00010000

-----HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon-----

[Winlogon]
  "ParseAutoexec"="1"
  "ExcludeProfileDirs"="Local Settings;Temporary Internet Files;Historique;Temp"
  "BuildNumber"=dword:00000a28

-----HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options-----

[Image File Execution Options\Your Image File Name Here without a path]
  "Debugger"="ntsd -d"

-----HKLM\System\CurrentControlSet\Control\Session Manager\-----

[Session Manager]
  "BootExecute"=multi:"autocheck autochk *\00\00"

[Session Manager\SubSystems]
  "Windows"=expand:"%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,3072,512 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ProfileControl=Off MaxRequestThreads=16"

-----HKLM\SYSTEM\CurrentControlSet\Control\WOW-----

[WOW]
  "cmdline"=expand:"%SystemRoot%\system32
tvdm.exe"
  "wowcmdline"=expand:"%SystemRoot%\system32
tvdm.exe -a %SystemRoot%\system32\krnl386"

-----HKLM\Software\Microsoft\Windows NT\CurrentVersion\Run-----

[run]

-----HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce-----

[RunOnce]

-----HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx-----

[RunOnceEx]

-----HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices-----

[RunServices]

-----HKLM\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce-----

[RunServicesOnce]

-----HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce-----

[RunOnce]

-----HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnceEx-----

-----HKCU\Software\Microsoft\Windows\CurrentVersion\RunServices-----

[RunServices]

-----HKCU\Software\Microsoft\Windows NT\CurrentVersion\Run-----

-----HKCU\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce-----

[RunServicesOnce]

-----HKLM\Software\Microsoft\Command Processor\Autorun-----

-----HKCU\Software\Microsoft\Command Processor\Autorun-----

-----HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows\Load-----

-----HKLM\Software\Policies\Microsoft\Windows\System\Scripts\Startup-----

-----HKCU\Software\Policies\Microsoft\Windows\System\Scripts\Logon-----

-----HKLM\Software\Policies\Microsoft\Windows\System\Scripts\Logon-----

-----HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\TerminalServer\Install\Software\Microsoft\Windows\CurrentVersion\Runonce-----

-----HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\TerminalServer\Install\Software\Microsoft\Windows\CurrentVersion\Run-----

-----HKLM\System\CurrentControlSet\Control\Terminal Server\Wdsdpwd\StartupPrograms-----

-----HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\TerminalServer\Install\Software\Microsoft\Windows\CurrentVersion\Runonce-----

-----HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler-----

[SharedTaskScheduler]
  "{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Pré-chargeur Browseui"
    #### HKCR\CLSID\{438755C2-A8BA-11D1-B96B-00A0C90312E1}\InprocServer32 @=expand:"%SystemRoot%\system32\browseui.dll"
  "{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Démon de cache des catégories de composant"
    #### HKCR\CLSID\{8C7461EF-2B13-11d2-BE35-3078302C2030}\InprocServer32 @=expand:"%SystemRoot%\system32\browseui.dll"

-----HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects-----

[Browser Helper Objects]
  @=""

[Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
  @=""

[Browser Helper Objects\{53707962-6F74-2D53-2644-206D7942484F}]
    #### HKCR\CLSID\{53707962-6F74-2D53-2644-206D7942484F}\InprocServer32 @="C:\PROGRA~1\SPYBOT~1\SDHelper.dll"

[Browser Helper Objects\{7009fcd4-05be-44f4-9583-93fe419ab7b0}]
    #### HKCR\CLSID\{7009fcd4-05be-44f4-9583-93fe419ab7b0}\InprocServer32 @="C:\Program Files\Multi_Media_France	bMul0.dll"
  @=""

[Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
    #### HKCR\CLSID\{9030D464-4C02-4ABF-8ECC-5164760863C6}\InprocServer32 @="C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll"

-----HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks-----

[URLSearchHooks]
  "{CFBFAE00-17A6-11D0-99CB-00C04FD64497}"=""
    #### HKCR\CLSID\{CFBFAE00-17A6-11D0-99CB-00C04FD64497}\InprocServer32 @="C:\WINDOWS\system32\ieframe.dll"

-----HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig-----

-----HKCU\Control Panel\Desktop\-----

[Desktop]
  "SCRNSAVE.EXE"="C:\WINDOWS\system32\ssstars.scr"

[Desktop\WindowMetrics]

-----HKEY_CLASSES_ROOT\exefile\shell\open\command-----

[command]

Sophie · Answer

@="\"%1\" %*" -----HKEY_CLASSES_ROOT\comfile\shell\open\command----- [command] @="\"%1\" %*" -----HKEY_CLASSES_ROOT\batfile\shell\open\command----- [command] @="\"%1\" %*" -----HKEY_CLASSES_ROOT\piffile\shell\open\command----- [command] @="\"%1\" %*" -----HKEY_CLASSES_ROOT\scrFile\shell\open\command----- [command] @="\"%1\" %*" -----HKEY_CLASSES_ROOT\htafile\shell\open\command----- [Command] @="C:\WINDOWS\system32\mshta.exe \"%1\" %*" -----HKEY_CLASSES_ROOT\logfile\shell\open\command----- -----HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\URL----- [URL] [URL\DefaultPrefix] @="http://" [URL\Prefixes] "ftp"="ftp://" "gopher"="gopher://" "home"="http://" "mosaic"="http://" "www"="http://" -----HKLM\SYSTEM\CurrentControlSet\Control\Lsa----- [Lsa] [Lsa\AccessProviders] [Lsa\AccessProviders\Windows NT Access Provider] "ProviderPath"=expand:"%SystemRoot%\system32 tmarta.dll" [Lsa\Audit] [Lsa\Audit\PerUserAuditing] [Lsa\Audit\PerUserAuditing\System] [Lsa\Data] [Lsa\SSO] [Lsa\SSO\Passport1.4] "SSOURL"="http://www.passport.com" [Lsa\SspiCache] [Lsa\SspiCache\digest.dll] "Name"="Digest" "Comment"="Digest SSPI Authentication Package" [Lsa\SspiCache\msapsspc.dll] "Name"="DPA" "Comment"="DPA Security Package" [Lsa\SspiCache\msnsspc.dll] "Name"="MSN" "Comment"="MSN Security Package" -----HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess----- [SharedAccess] "DependOnGroup"=multi:"\00" "DependOnService"=multi:"Netman\00WinMgmt\00\00" "Description"="Assure la traduction d'adresses de réseau, l'adressage, les services de résolution de noms et/ou les services de prévention d'intrusion pour un réseau de petite entreprise ou un réseau domestique." "DisplayName"="Pare-feu Windows / Partage de connexion Internet" "ErrorControl"=dword:00000001 "ImagePath"=expand:"%SystemRoot%\system32\svchost.exe -k netsvcs" "ObjectName"="LocalSystem" "Start"=dword:00000002 "Type"=dword:00000020 [SharedAccess\Epoch] "Epoch"=dword:00002473 [SharedAccess\Parameters] "ServiceDll"=expand:"%SystemRoot%\System32\ipnathlp.dll" [SharedAccess\Parameters\FirewallPolicy] [SharedAccess\Parameters\FirewallPolicy\DomainProfile] [SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications] [SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List] "%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enaxxxxx@xxxxxres.dll,-22019" "C:\Program Files\MSN Messenger\msnmsgr.exe"="C:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1" "C:\Program Files\MSN Messenger\livecall.exe"="C:\Program Files\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)" "%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enaxxxxx@xxxxxres.dll,-20000" [SharedAccess\Parameters\FirewallPolicy\StandardProfile] "EnableFirewall"=dword:00000001 "DoNotAllowExceptions"=dword:00000000 [SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications] [SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] "%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enaxxxxx@xxxxxres.dll,-22019" "C:\Program Files\eMule\emule.exe"="C:\Program Files\eMule\emule.exe:*:Enabled:eMule" "C:\Program Files\MSN Messenger\msnmsgr.exe"="C:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1" "C:\Program Files\MSN Messenger\livecall.exe"="C:\Program Files\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)" "C:\Program Files\Resolume 2.41 esolume.exe"="C:\Program Files\Resolume 2.41 esolume.exe:*:Enabled:Resolume 2.41" "C:\Program Files\Messenger\msmsgs.exe"="C:\Program Files\Messenger\msmsgs.exe:*:Enabled:Windows Messenger" "C:\Documents and Settings\Propriétaire\Local Settings\Temp\Rar$EX02.937\emule.exe"="C:\Documents and Settings\Propriétaire\Local Settings\Temp\Rar$EX02.937\emule.exe:*:Disabled:eMule" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\0exinjs.aa.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\0exinjs.aa.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\22exinjs.aa.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\22exinjs.aa.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\23exinjs.aa.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\23exinjs.aa.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\83exinjs.aa.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\83exinjs.aa.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\86exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\86exinjs.ab.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\82exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\82exinjs.ab.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\42exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\42exinjs.ab.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\98exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\98exinjs.ab.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\36exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\36exinjs.ab.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\59exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\59exinjs.ab.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\49exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\49exinjs.ab.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\73exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\73exinjs.ab.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\75exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\75exinjs.ab.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\8exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\8exinjs.ab.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\47exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\47exinjs.ab.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\20exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\20exinjs.ab.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\78exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\78exinjs.ab.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\80exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\80exinjs.ab.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\74exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\74exinjs.ab.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\18exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\18exinjs.ab.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\64exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\64exinjs.ab.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\57exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\57exinjs.ab.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\92exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\92exinjs.ab.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\11exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\11exinjs.ab.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\50exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\50exinjs.ab.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\43exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\43exinjs.ab.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\95exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\95exinjs.ab.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\52exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\52exinjs.ab.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\23exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\23exinjs.ab.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\6exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\6exinjs.ab.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\39exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\39exinjs.ab.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\68exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\68exinjs.ab.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\61exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\61exinjs.ab.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\26exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\26exinjs.ab.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\34exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\34exinjs.ab.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\19exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\19exinjs.ab.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\32exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\32exinjs.ab.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\14exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\14exinjs.ab.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\60exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\60exinjs.ab.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\29exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\29exinjs.ab.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\66exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\66exinjs.ab.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\99exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\99exinjs.ab.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\54exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\54exinjs.ab.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\94exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\94exinjs.ab.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\85exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\85exinjs.ab.exe:*:Enabled:Microsoft Update" "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe"="C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe:*:Disabled:Kaspersky Anti-Virus" "C:\Program Files\uTorrent\uTorrent.exe"="C:\Program Files\uTorrent\uTorrent.exe:*:Enabled:µTorrent" "C:\Program Files\BitDownload\BitDownload.exe"="C:\Program Files\BitDownload\BitDownload.exe:*:Enabled:Torrent P2P application" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\16ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\16ex:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\25ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\25ex:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\35ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\35ex:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\43ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\43ex:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\58ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\58ex:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\26ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\26ex:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\87ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\87ex:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\60ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\60ex:*:Enabled:Microsoft Update" "C:\Program Files\Ahead\Nero ShowTime\ShowTime.exe"="C:\Program Files\Ahead\Nero ShowTime\ShowTime.exe:*:Enabled:Nero ShowTime" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\44ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\44ex:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\50ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\50ex:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\7ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\7ex:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\42ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\42ex:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\3ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\3ex:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\21ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\21ex:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\40ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\40ex:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\2ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\2ex:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\4ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\4ex:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\65ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\65ex:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\37ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\37ex:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\31ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\31ex:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\72ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\72ex:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\92ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\92ex:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\68ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\68ex:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\45ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\45ex:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\96ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\96ex:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\33ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\33ex:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\79ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\79ex:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\10ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\10ex:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\22ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\22ex:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\55ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\55ex:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\66ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\66ex:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\94ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\94ex:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\52ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\52ex:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\0ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\0ex:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\63ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\63ex:*:Enabled:Microsoft Update" "C:\Documents and Settings\Propriétaire\Local Settings\Temp\10exmdnk23.exe"="C:\Documents and Settings\Propriétaire\Local Settings\Temp\10exmdnk23.exe:*:Disabled:10exmdnk23" "C:\Documents and Settings\Propriétaire\Local Settings\Temp\33exmdnk25.exe"="C:\Documents and Settings\Propriétaire\Local Settings\Temp\33exmdnk25.exe:*:Disabled:33exmdnk25" "C:\Documents and Settings\Propriétaire\Local Settings\Temp\0exmdnk26.exe"="C:\Documents and Settings\Propriétaire\Local Settings\Temp\0exmdnk26.exe:*:Disabled:0exmdnk26" "C:\Documents and Settings\Propriétaire\Local Settings\Temp\58exmdnk30.exe"="C:\Documents and Settings\Propriétaire\Local Settings\Temp\58exmdnk30.exe:*:Disabled:58exmdnk30" "C:\kav\kis7.0\french\setup.exe"="C:\kav\kis7.0\french\setup.exe:*:Enabled:Programme d'installation de Kaspersky Internet Security 7.0" "C:\kav\kav7.0\french\setup.exe"="C:\kav\kav7.0\french\setup.exe:*:Enabled:Programme d'installation de Kaspersky Anti-Virus 7.0" "%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enaxxxxx@xxxxxres.dll,-20000" [SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts] [SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List] "1900:UDP"="1900:UDP:LocalSubNet:Disaxxxxx@xxxxxres.dll,-22007" "2869:TCP"="2869:TCP:LocalSubNet:Disaxxxxx@xxxxxres.dll,-22008" "17053:TCP"="17053:TCP:*:Enabled:NortonAV" "12192:TCP"="12192:TCP:*:Enabled:NortonAV" [SharedAccess\Setup] "ServiceUpgrade"=dword:00000001 [SharedAccess\Setup\InterfacesUnfirewalledAtUpdate] "All"=dword:00000001 -----HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Firewall\----- -----HKEY_LOCAL_MACHINE\SOFTWARE\Winsock2----- -----HKLM\Software\Microsoft\Ole----- [Ole] "DefaultLaunchPermission"=hex:01,00,04,80,5c,00,00,00,6c,00,00,00,00,00,00,00,\ "MachineLaunchRestriction"=hex:01,00,04,80,48,00,00,00,58,00,00,00,00,00,00,00,\ "MachineAccessRestriction"=hex:01,00,04,80,44,00,00,00,54,00,00,00,00,00,00,00,\ "EnableDCOM"="Y" [Ole\AppCompat] [Ole\AppCompat\ActivationSecurityCheckExemptionList] "{A50398B8-9075-4FBF-A7A1-456BF21937AD}"="1" "{AD65A69D-3831-40D7-9629-9B0B50A93843}"="1" "{0040D221-54A1-11D1-9DE0-006097042D69}"="1" "{2A6D72F1-6E7E-4702-B99C-E40D3DED33C3}"="1" [Ole\NONREDIST] "System.EnterpriseServices.Thunk.dll"="" -----HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WindowsUpdate\AU\----- -----HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\----- [Security Center] "FirstRunDisabled"=dword:00000001 "AntiVirusDisableNotify"=dword:00000000 "FirewallDisableNotify"=dword:00000000 "UpdatesDisableNotify"=dword:00000000 "AntiVirusOverride"=dword:00000001 "FirewallOverride"=dword:00000000 [Security Center\Monitoring] [Security Center\Monitoring\AhnlabAntiVirus] [Security Center\Monitoring\ComputerAssociatesAntiVirus] [Security Center\Monitoring\KasperskyAntiVirus] [Security Center\Monitoring\McAfeeAntiVirus] [Security Center\Monitoring\McAfeeFirewall] [Security Center\Monitoring\PandaAntiVirus] [Security Center\Monitoring\PandaFirewall] [Security Center\Monitoring\SophosAntiVirus] [Security Center\Monitoring\SymantecAntiVirus] [Security Center\Monitoring\SymantecFirewall] [Security Center\Monitoring\TinyFirewall] [Security Center\Monitoring\TrendAntiVirus] [Security Center\Monitoring\TrendFirewall] [Security Center\Monitoring\ZoneLabsFirewall] -----HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore\----- [SystemRestore] "DisableSR"=dword:00000000 "CreateFirstRunRp"=dword:00000001 "DSMin"=dword:000000c8 "DSMax"=dword:00000190 "RPSessionInterval"=dword:00000000 "RPGlobalInterval"=dword:00015180 "RPLifeInterval"=dword:0076a700 "CompressionBurst"=dword:0000003c "TimerInterval"=dword:00000078 "DiskPercent"=dword:0000000c "ThawInterval"=dword:00000384 "RestoreDiskSpaceError"=dword:00000000 "RestoreStatus"=dword:00000000 "RestoreSafeModeStatus"=dword:00000001 [SystemRestore\Cfg] "DiskPercent"=dword:0000000c "MachineGuid"="{D88DDE61-D342-465C-AFF5-295FBD9AB56F}" [SystemRestore\SnapshotCallbacks] @="" -----HKEY_CURRENT_USER\Software\VB and VBA Program Settings----- [VB and VBA Program Settings] [VB and VBA Program Settings\CCleaner] [VB and VBA Program Settings\CCleaner\Options] -----HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\----- -----HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\AdvancedOptions----- [AdvancedOptions] -----HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\AdvancedOptions----- -----HKLM\Software\Microsoft\Active Setup\Installed Components----- [Installed Components] [Installed Components\<{12d0ed0d-0ee0-4f90-8827-78cefb8f4988}] "@="IE7 Uninstall Stub" "ComponentID"="IEUDINIT" "StubPath"="C:\WINDOWS\system32\ieudinit.exe" [Installed Components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}] #### HKCR\CLSID\{22d6f312-b0f6-11d0-94ab-0080c74c7e95}\InprocServer32 @="C:\WINDOWS\system32\wmpdxm.dll" "Stubpath"="C:\WINDOWS\inf\unregmp2.exe /ShowWMP" "@="Microsoft Windows Media Player" "ComponentID"="WMPACCESS" [Installed Components\>{26923b43-4d38-484f-9b9e-de460746276c}] "@="Internet Explorer" "ComponentID"="IEACCESS" "StubPath"="C:\WINDOWS\system32\ie4uinit.exe -UserIconConfig" [Installed Components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}] "@="Browser Customizations" "ComponentiD"="BRANDING.CAB" "StubPath"="RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP" [Installed Components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS] "@="Personnalisation du navigateur" "ComponentID"="BRANDING.CAB" "StubPath"="RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP" [Installed Components\>{881dd1c5-3dcf-431b-b061-f3f88e8be88a}] "@="Outlook Express" "ComponentID"="OEACCESS" "StubPath"=expand:"%systemroot%\system32\shmgrate.exe OCInstallUserConfigOE" [Installed Components\{0E92DD42-76F5-4EF2-B381-F9C1D72BE23D}] "@="Security Update for Microsoft .NET Framework 2.0 (KB922770)" "ComponentID"="KB922770" [Installed Components\{10072CEC-8CC1-11D1-986E-00A0C955B42F}] "@="Rendu VML (Vector Graphics Rendering)" "ComponentID"="MSVML" [Installed Components\{2179C5D3-EBFF-11CF-B6FD-00AA00B4E220}] #### HKCR\CLSID\{2179C5D3-EBFF-11CF-B6FD-00AA00B4E220}\InprocServer32 @="C:\WINDOWS\system32\wmpdxm.dll" "ComponentID"="NetShow" "StubPath"="" [Installed Components\{22d6f312-b0f6-11d0-94ab-0080c74c7e95}] #### HKCR\CLSID\{22d6f312-b0f6-11d0-94ab-0080c74c7e95}\InprocServer32 @="C:\WINDOWS\system32\wmpdxm.dll" "ComponentID"="Microsoft Windows Media Player" "StubPath"="" "@="Lecteur Windows Media Microsoft 6.4" [Installed Components\{283807B5-2C60-11D0-A31D-00AA00B92C03}] "@="DirectAnimation" "ComponentID"="DirectAnimation" [Installed Components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}] "@="Themes Setup" "ComponentID"="Theme Component" "StubPath"=expand:"%SystemRoot%\system32 egsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32 hemeui.dll" [Installed Components\{36f8ec70-c29a-11d1-b5c7-0000f8051515}] "@="Liaison de données Dynamic HTML pour Java" "ComponentID"="TridataJava" [Installed Components\{3919E8B8-A291-74E5-5DBF-8FB615E8FCED}] "@="Themes Setup" "ComponentID"="Theme Component" [Installed Components\{3af36230-a269-11d1-b5bf-0000f8051515}] "@="Offline Browsing Pack" "ComponentID"="MobilePk" [Installed Components\{3bf42070-b3b1-11d1-b5c5-0000f8051515}] "@="Uniscribe" "ComponentID"="USP10" [Installed Components\{411EDCF7-755D-414E-A74B-3DCD6583F589}] "ComponentID"="S867460" "@="Microsoft .NET Framework 1.1 Service Pack 1 (KB867460)" [Installed Components\{4278c270-a269-11d1-b5bf-0000f8051515}] "@="Création avancée" "ComponentID"="AdvAuth" [Installed Components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}] "@="Microsoft Outlook Express 6" "ComponentID"="MailNews" "StubPath"=expand:"\"%ProgramFiles%\Outlook Express\setup50.exe\" /APP:OE /CALLER:WINNT /user /install" [Installed Components\{44BBA842-CC51-11CF-AAFA-00AA00B6015B}] "@="NetMeeting 3.01" "ComponentID"="NetMeeting" "StubPath"="rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT" [Installed Components\{44BBA848-CC51-11CF-AAFA-00AA00B6015C}] "@="DirectShow" "ComponentID"="activemovie" [Installed Components\{44BBA855-CC51-11CF-AAFA-00AA00B6015F}] "@="DirectDrawEx" "ComponentID"="DirectDrawEx" [Installed Components\{45ea75a0-a269-11d1-b5bf-0000f8051515}] "@="Internet Explorer Help" "ComponentID"="HelpCont" [Installed Components\{4f216970-c90c-11d1-b5c7-0000f8051515}] "@="Classes Java DirectAnimation" "ComponentID"="DAJava" [Installed Components\{4f645220-306d-11d2-995d-00c04f98bbc9}] "@="Microsoft Windows Script 5.6" "ComponentID"="MSVBScript" [Installed Components\{5945c046-1e7d-11d1-bc44-00c04fd912be}] "KeyFileName"="C:\Program Files\Messenger\msmsgs.exe" "@="Windows Messenger 4.7" "ComponentID"="Messenger" "StubPath"="rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser" [Installed Components\{5A8D6EE0-3E18-11D0-821E-444553540000}] "(Default)"="Internet Connection Wizard" "ComponentID"="ICW" [Installed Components\{5fd399c0-a70a-11d1-9948-00c04f98bbc9}] "@="Internet Explorer Setup Tools" "ComponentID"="GenSetup" [Installed Components\{630b1da0-b465-11d1-9948-00c04f98bbc9}] "@="Browsing Enhancements" "ComponentID"="ExtraPack" "KeyFileName"="C:\WINDOWS\system32\msieftp.dll" [Installed Components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}] #### HKCR\CLSID\{6BF52A52-394A-11d3-B153-00C04F79FAA6}\InprocServer32 @="C:\WINDOWS\system32\wmp.dll" "@="Microsoft Windows Media Player" "ComponentID"="Microsoft Windows Media Player" "StubPath"="rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\wmp.inf,PerUserStub" [Installed Components\{6fab99d0-bab8-11d1-994a-00c04f98bbc9}] "@="MSN Site Access" "ComponentID"="MSN_Auth" [Installed Components\{7131646D-CD3C-40F4-97B9-CD9E4E6262EF}] "ComponentID"=".NETFramework" "@=".NET Framework" [Installed Components\{7790769C-0471-11d2-AF11-00C04FA35D02}] "@="Carnet d'adresses 6" "ComponentID"="WAB" "StubPath"=expand:"\"%ProgramFiles%\Outlook Express\setup50.exe\" /APP:WAB /CALLER:WINNT /user /install" [Installed Components\{8056AC9E-49C5-4375-9ADE-B2F862C9DF51}] "ComponentID"="KB928365" "@="Security Update for Microsoft .NET Framework 2.0 (KB928365)" [Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4340}] "@="Mise à jour du Bureau Windows" "ComponentID"="IE4Shell_NT" "StubPath"=expand:"regsvr32.exe /s /n /i:U shell32.dll" [Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4383}] "@="Internet Explorer" "ComponentID"="BASEIE40_W2K" "StubPath"="C:\WINDOWS\system32\ie4uinit.exe -BaseSettings" [Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4383}\AuthorizedCDFPrefix] [Installed Components\{89B4C1CD-B018-4511-B0A1-5476DBF70820}] "StubPath"="C:\WINDOWS\system32\Rundll32.exe C:\WINDOWS\system32\mscories.dll,Install" "ComponentID"="DOTNETFRAMEWORKS" [Installed Components\{8D1D0E9A-C799-4D28-9E29-0061D1E66E43}] "ComponentID"="M928366" "@="Microsoft .NET Framework 1.1 Hotfix (KB928366)" [Installed Components\{9381D8F2-0288-11D0-9501-00AA00B911A5}] "@="Dynamic HTML Data Binding" "ComponentID"="Tridata" [Installed Components\{967B098A-042D-4367-BAC9-8BC11684174F}] "@="Security Update for Microsoft .NET Framework 2.0 (KB917283)" "ComponentID"="KB917283" [Installed Components\{ACC563BC-4266-43f0-B6ED-9D38C4202C7E}] [Installed Components\{C9E9A340-D1F1-11D0-821E-444553540600}] "@="Internet Explorer Core Fonts" "ComponentID"="Fontcore" [Installed Components\{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}] "ComponentID"=".NETFramework" "@=".NET Framework" [Installed Components\{CC2A9BA0-3BDD-11D0-821E-444553540000}] "@="Planificateur de tâches" "ComponentID"="MSTASK" [Installed Components\{CDD7975E-60F8-41d5-8149-19E51D6F71D0}] "ComponentID"="Windows Movie Maker v2.1" [Installed Components\{D27CDB6E-AE6D-11cf-96B8-444553540000}] "@="Adobe Flash Player" "ComponentID"="Flash" [Installed Components\{de5aed00-a4bf-11d1-9948-00c04f98bbc9}] "@="HTML Help" "ComponentID"="HTMLHelp" [Installed Components\{E92B03AB-B707-11d2-9CBD-0000F87A369E}] "@="Active Directory Service Interface" "ComponentID"="ADSI" -----Comparing registry keys CCS1 vs CCS2 ----- < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\aawservice > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\aswTdi DisplayName REG_SZ avast! Network Shield Support > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\aswTdi ErrorControl REG_DWORD 1 (0x1) > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\aswTdi Type REG_DWORD 1 (0x1) > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\aswTdi Group REG_SZ PNP_TDI > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\aswTdi Start REG_DWORD 1 (0x1) > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\aswTdi DependOnService REG_MULTI_SZ tcpip\0\0 > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\aswTdi Tag REG_DWORD 9 (0x9) < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\aswTdi\Parameters ProviderStart REG_DWORD 3 (0x3) > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\aswTdi\Parameters ProviderStart REG_DWORD 1 (0x1) < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\AVG Anti-Spyware Driver < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\AVG Anti-Spyware Guard < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\AvgAsCln < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\AVP < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\BITS Start REG_DWORD 3 (0x3) > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\BITS Start REG_DWORD 2 (0x2) < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\Dhcp\Parameters {6317C625-DA29-42BA-9ADD-C0C897993031} REG_BINARY 1A0000000000000002000000000000002EAECB4705D40000060000000000000008000000000000002EAECB473E0410463E041145030000000000000004000000000000002EAECB47C0A801010F0000000000000005000000000000002EAECB476C6F63616C000000330000000000000004000000000000002EAECB4700015180010000000000000004000000000000002EAECB47FFFFFF00360000000000000004000000000000002EAECB47C0A80101350000000000000001000000000000002EAECB4705000000 > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\Dhcp\Parameters {6317C625-DA29-42BA-9ADD-C0C897993031} REG_BINARY FC000000000000000000000000000000BF1D13491A0000000000000002000000000000003969144905D400000600000000000000080000000000000039691449D043DEDED043DCDC0300000000000000040000000000000039691449C0A801010F000000000000000500000000000000396914496C6F63616C0000003300000000000000040000000000000039691449000151800100000000000000040000000000000039691449FFFFFF003600000000000000040000000000000039691449C0A80101350000000000000001000000000000003969144905000000 < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\Eventlog\Application\ESENT EventMessageFile REG_EXPAND_SZ c:\windows\system32\ESENT.dll > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\Eventlog\Application\ESENT EventMessageFile REG_EXPAND_SZ C:\WINDOWS\system32\ESENT.dll < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\Eventlog\Application\ESENT CategoryMessageFile REG_EXPAND_SZ c:\windows\system32\ESENT.dll > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\Eventlog\Application\ESENT CategoryMessageFile REG_EXPAND_SZ C:\WINDOWS\system32\ESENT.dll > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\Eventlog\Security\DS > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\Eventlog\Security\LSA > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\Eventlog\Security\NetDDE Object > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\Eventlog\Security\SC Manager > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\Eventlog\Security\Security > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\Eventlog\Security\Security Account Manager > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\Eventlog\Security\Spooler < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\Eventlog\System Sources REG_MULTI_SZ WZCSVC\0Workstation\0WindowsMedia\0Windows Update Agent\0Windows Script Host\0Windows Installer 3.1\0Windows File Protection\0Win32k\0W32Time\0VolSnap\0viaide\0VgaSave\0USER32\0UPS\0ultra\0udfs\0toside\0TermServSessDir\0TermService\0TermServDevices\0TermDD\0tdi\0TCPMon\0Tcpip\0System Error\0sym_u3\0sym_hi\0symc8xx\0symc810\0StillImage\0SSDPSRV\0Srv\0srservice\0sr\0sparrow\0sndblst\0Simbad\0SideBySide\0sfloppy\0Setup\0Service de stockage amovible\0Service Control Manager\0Server\0serial\0scsiport\0Schedule\0Schannel\0SCardSvr\0Save Dump\0SAM\0RTL8023xp\0RSVP\0RemoteAccess\0redbook\0Rdbss\0RasMan\0RasAuto\0ql1280\0ql1240\0ql12160\0ql10wnt\0ql1080\0PSched\0Print\0PptpMiniport\0PolicyAgent\0PlugPlayManager\0perc2\0pcmcia\0pciide\0pci\0parvdm\0partmgr\0parport\0OSPFMib\0OSPF\0null\0NtServicePack\0ntfs\0npfs\0Nla\0NIC1394\0Netlogon\0NetDDE\0NetBT\0NetBIOS\0NdisWan\0NdisIP\0ndis\0Mup\0msfs\0msadlib\0MrxSmb\0MRxDAV\0mraid35x\0mouhid\0mouclass\0Modem\0LsaSrv\0LmHosts\0LDMS\0LDM\0lbrtfdc\0Kerberos\0kbdhid\0kbdclass\0isapnp\0irsir\0IPXSAP\0IPXRouterManager\0IPXRIP\0IPXCP\0IPSec\0IPRouterManager\0IPRIP2\0IPNATHLP\0IPMGM\0IPBOOTP\0intelppm\0intelide\0ini910u\0IGMPv2\0i8042prt\0i2omp\0i2omgmt\0Http\0hpn\0ftdisk\0fs_rec\0flpydisk\0Fips\0fdc\0fastfat\0eventlog\0efs\0dpti2o\0Dnscache\0Dnsapi\0dmio\0dmboot\0Distributed Link Tracking Client\0disk\0Dhcp\0DfsSvc\0DfsDriver\0DCOM\0dac960nt\0dac2w2k\0cpqarray\0cmdide\0changer\0cdrom\0Cdm\0cdfs\0cdaudio\0cd20xrnt\0cbidf2k\0Browser\0BITS\0beep\0Atmarpc\0ati2mtag\0Ati HotKey Poller\0atdisk\0atapi\0AsyncMac\0asc3550\0asc3350p\0asc\0Arp1394\0Application Popup\0apphelp\0amsint\0ami0nt\0aliide\0Alerter\0aic78xx\0aic78u2\0aha154x\0adpu160m\0acpiec\0acpi\0abp480n5\0abiosdsk\0System\0\0 > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\Eventlog\System Sources REG_MULTI_SZ WZCSVC\0Workstation\0WindowsMedia\0Windows Update Agent\0Windows Script Host\0Windows Installer 3.1\0Windows File Protection\0Win32k\0W32Time\0VolSnap\0viaide\0VgaSave\0USER32\0UPS\0ultra\0udfs\0toside\0TermServSessDir\0TermService\0TermServDevices\0TermDD\0tdi\0TCPMon\0Tcpip\0System Error\0sym_u3\0sym_hi\0symc8xx\0symc810\0StillImage\0SSDPSRV\0Srv\0srservice\0sr\0sparrow\0sndblst\0Simbad\0SideBySide\0sfloppy\0Setup\0Service de stockage amovible\0Service Control Manager\0Server\0serial\0scsiport\0Schedule\0Schannel\0SCardSvr\0Save Dump\0SAM\0RTL8023xp\0RSVP\0RemoteAccess\0redbook\0Rdbss\0RasMan\0RasAuto\0ql1280\0ql1240\0ql12160\0ql10wnt\0ql1080\0PSched\0Print\0PptpMiniport\0PolicyAgent\0PlugPlayManager\0perc2\0pcmcia\0pciide\0pci\0parvdm\0partmgr\0parport\0OSPFMib\0OSPF\0null\0NtServicePack\0ntfs\0npfs\0Nla\0NIC1394\0Netlogon\0NetDDE\0NetBT\0NetBIOS\0NdisWan\0NdisIP\0ndis\0Mup\0msfs\0msadlib\0MrxSmb\0MRxDAV\0mraid35x\0mouhid\0mouclass\0Modem\0LsaSrv\0LmHosts\0LDMS\0LDM\0lbrtfdc\0Kerberos\0kbdhid\0kbdclass\0isapnp\0irsir\0IPXSAP\0IPXRouterManager\0IPXRIP\0IPXCP\0IPSec\0IPRouterManager\0IPRIP2\0IPNATHLP\0IPMGM\0IPBOOTP\0Internet Explorer 7 Disk\0intelppm\0intelide\0ini910u\0IGMPv2\0i8042prt\0i2omp\0i2omgmt\0Http\0hpn\0ftdisk\0fs_rec\0flpydisk\0Fips\0fdc\0fastfat\0eventlog\0efs\0dpti2o\0Dnscache\0Dnsapi\0dmio\0dmboot\0Distributed Link Tracking Client\0disk\0Dhcp\0DfsSvc\0DfsDriver\0DCOM\0dac960nt\0dac2w2k\0cpqarray\0cmdide\0changer\0cdrom\0Cdm\0cdfs\0cdaudio\0cd20xrnt\0cbidf2k\0Browser\0BITS\0beep\0Atmarpc\0ati2mtag\0Ati HotKey Poller\0atdisk\0atapi\0AsyncMac\0asc3550\0asc3350p\0asc\0Arp1394\0Application Popup\0apphelp\0amsint\0ami0nt\0aliide\0Alerter\0aic78xx\0aic78u2\0aha154x\0adpu160m\0acpiec\0acpi\0abp480n5\0abiosdsk\0System\0\0 < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\kl1 < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\klif < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\lanmanserver\parameters Guid REG_BINARY 5004971301681449958DAA43046B5866 > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\lanmanserver\parameters Guid REG_BINARY 0C479EC6F0F996478B4B2AB36A79A4DE > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\MRxDAV\EncryptedDirectories < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\PerfDisk\Performance WbemAdapFileSignature REG_BINARY 97F41DFEE99BC2AE60BAD78679FB40A1 < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\PerfDisk\Performance WbemAdapFileTime REG_BINARY 0020E7D4F03DC601 < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\PerfDisk\Performance WbemAdapFileSize REG_DWORD 27136 (0x6A00) < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\PerfDisk\Performance WbemAdapStatus REG_DWORD 0 (0x0) < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\PerfNet\Performance WbemAdapFileSignature REG_BINARY 7FD03F93453FAFBABB6E29B11E9E731C < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\PerfNet\Performance WbemAdapFileTime REG_BINARY 0020E7D4F03DC601 < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\PerfNet\Performance WbemAdapFileSize REG_DWORD 17408 (0x4400) < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\PerfNet\Performance WbemAdapStatus REG_DWORD 0 (0x0) < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\SharedAccess\Epoch Epoch REG_DWORD 8851 (0x2293) > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\SharedAccess\Epoch Epoch REG_DWORD 9331 (0x2473) > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List %windir%\Network Diagnostic\xpnetdiag.exe REG_SZ %windir%\Network Diagnostic\xpnetdiag.exe:*:Enaxxxxx@xxxxxres.dll,-20000 > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\kav\kis7.0\french\setup.exe REG_SZ C:\kav\kis7.0\french\setup.exe:*:Enabled:Programme d'installation de Kaspersky Internet Security 7.0 > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\kav\kav7.0\french\setup.exe REG_SZ C:\kav\kav7.0\french\setup.exe:*:Enabled:Programme d'installation de Kaspersky Anti-Virus 7.0 > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List %windir%\Network Diagnostic\xpnetdiag.exe REG_SZ %windir%\Network Diagnostic\xpnetdiag.exe:*:Enaxxxxx@xxxxxres.dll,-20000 < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\Spooler\Performance WbemAdapFileSignature REG_BINARY E415A3D071D315CD84F6F593A3A060B3 < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\Spooler\Performance WbemAdapFileTime REG_BINARY 0020E7D4F03DC601 < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\Spooler\Performance WbemAdapFileSize REG_DWORD 146944 (0x23E00) < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\Spooler\Performance WbemAdapStatus REG_DWORD 0 (0x0) < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\sr Start REG_DWORD 0 (0x0) > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\sr Start REG_DWORD 4 (0x4) < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\sr ImagePath REG_EXPAND_SZ system32\DRIVERS\sr.sys > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\sr ImagePath REG_EXPAND_SZ \SystemRoot\system32\DRIVERS\sr.sys < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\sr\Parameters FirstRun REG_DWORD 0 (0x0) > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\sr\Parameters FirstRun REG_DWORD 1 (0x1) < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\TapiSrv\Performance WbemAdapFileSignature REG_BINARY 0483F001E58AF7EA90B23BA9ACB367D3 < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\TapiSrv\Performance WbemAdapFileTime REG_BINARY 0020E7D4F03DC601 < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\TapiSrv\Performance WbemAdapFileSize REG_DWORD 5632 (0x1600) < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\TapiSrv\Performance WbemAdapStatus REG_DWORD 0 (0x0) < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\Tcpip\Parameters DhcpNameServer REG_SZ 62.4.16.70 62.4.17.69 > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\Tcpip\Parameters DhcpNameServer REG_SZ 208.67.222.222 208.67.220.220 < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\Tcpip\Parameters\Interfaces\{6317C625-DA29-42BA-9ADD-C0C897993031} LeaseObtainedTime REG_DWORD 1204444334 (0x47CA5CAE) > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\Tcpip\Parameters\Interfaces\{6317C625-DA29-42BA-9ADD-C0C897993031} LeaseObtainedTime REG_DWORD 1225988025 (0x491317B9) < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\Tcpip\Parameters\Interfaces\{6317C625-DA29-42BA-9ADD-C0C897993031} T1 REG_DWORD 1204487534 (0x47CB056E) > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\Tcpip\Parameters\Interfaces\{6317C625-DA29-42BA-9ADD-C0C897993031} T1 REG_DWORD 1226031225 (0x4913C079) < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\Tcpip\Parameters\Interfaces\{6317C625-DA29-42BA-9ADD-C0C897993031} T2 REG_DWORD 1204519934 (0x47CB83FE) > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\Tcpip\Parameters\Interfaces\{6317C625-DA29-42BA-9ADD-C0C897993031} T2 REG_DWORD 1226063625 (0x49143F09) < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\Tcpip\Parameters\Interfaces\{6317C625-DA29-42BA-9ADD-C0C897993031} LeaseTerminatesTime REG_DWORD 1204530734 (0x47CBAE2E) > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\Tcpip\Parameters\Interfaces\{6317C625-DA29-42BA-9ADD-C0C897993031} LeaseTerminatesTime REG_DWORD 1226074425 (0x49146939) < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\Tcpip\Parameters\Interfaces\{6317C625-DA29-42BA-9ADD-C0C897993031} DhcpIPAddress REG_SZ 192.168.1.101 > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\Tcpip\Parameters\Interfaces\{6317C625-DA29-42BA-9ADD-C0C897993031} DhcpIPAddress REG_SZ 192.168.1.100 < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\Tcpip\Parameters\Interfaces\{6317C625-DA29-42BA-9ADD-C0C897993031} DhcpNameServer REG_SZ 62.4.16.70 62.4.17.69 > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\Tcpip\Parameters\Interfaces\{6317C625-DA29-42BA-9ADD-C0C897993031} DhcpNameServer REG_SZ 208.67.222.222 208.67.220.220 < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\WmiApRpl\Performance Last Counter REG_DWORD 4848 (0x12F0) > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\WmiApRpl\Performance Last Counter REG_DWORD 4856 (0x12F8) < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\WmiApRpl\Performance Last Help REG_DWORD 4849 (0x12F1) > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\WmiApRpl\Performance Last Help REG_DWORD 4857 (0x12F9) < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\WmiApRpl\Performance Object List REG_SZ 4844 4844 > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\WmiApRpl\Performance Object List REG_SZ 4844 4844 4850 4850 < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\wuauserv Start REG_DWORD 4 (0x4) > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\wuauserv Start REG_DWORD 2 (0x2) < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\{6317C625-DA29-42BA-9ADD-C0C897993031}\Parameters\Tcpip DhcpIPAddress REG_SZ 192.168.1.101 > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\{6317C625-DA29-42BA-9ADD-C0C897993031}\Parameters\Tcpip DhcpIPAddress REG_SZ 192.168.1.100 < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\{6317C625-DA29-42BA-9ADD-C0C897993031}\Parameters\Tcpip LeaseObtainedTime REG_DWORD 1204444334 (0x47CA5CAE) > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\{6317C625-DA29-42BA-9ADD-C0C897993031}\Parameters\Tcpip LeaseObtainedTime REG_DWORD 1225988025 (0x491317B9) < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\{6317C625-DA29-42BA-9ADD-C0C897993031}\Parameters\Tcpip T1 REG_DWORD 1204487534 (0x47CB056E) > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\{6317C625-DA29-42BA-9ADD-C0C897993031}\Parameters\Tcpip T1 REG_DWORD 1226031225 (0x4913C079) < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\{6317C625-DA29-42BA-9ADD-C0C897993031}\Parameters\Tcpip T2 REG_DWORD 1204519934 (0x47CB83FE) > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\{6317C625-DA29-42BA-9ADD-C0C897993031}\Parameters\Tcpip T2 REG_DWORD 1226063625 (0x49143F09) < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\{6317C625-DA29-42BA-9ADD-C0C897993031}\Parameters\Tcpip LeaseTerminatesTime REG_DWORD 1204530734 (0x47CBAE2E) > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\{6317C625-DA29-42BA-9ADD-C0C897993031}\Parameters\Tcpip LeaseTerminatesTime REG_DWORD 1226074425 (0x49146939) Result compared: Different -----Comparing registry keys CCS1 vs CCS3 ----- < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\aawservice > Value: HKEY_LOCAL_MACHINE\system\controlset003\services\aswTdi DisplayName REG_SZ avast! Network Shield Support > Value: HKEY_LOCAL_MACHINE\system\controlset003\services\aswTdi ErrorControl REG_DWORD 1 (0x1) > Value: HKEY_LOCAL_MACHINE\system\controlset003\services\aswTdi Type REG_DWORD 1 (0x1) > Value: HKEY_LOCAL_MACHINE\system\controlset003\services\aswTdi Group REG_SZ PNP_TDI > Value: HKEY_LOCAL_MACHINE\system\controlset003\services\aswTdi Start REG_DWORD 1 (0x1) > Value: HKEY_LOCAL_MACHINE\system\controlset003\services\aswTdi DependOnService REG_MULTI_SZ tcpip\0\0 > Value: HKEY_LOCAL_MACHINE\system\controlset003\services\aswTdi Tag REG_DWORD 9 (0x9) < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\aswTdi\Parameters ProviderStart REG_DWORD 3 (0x3) > Value: HKEY_LOCAL_MACHINE\system\controlset003\services\aswTdi\Parameters ProviderStart REG_DWORD 1 (0x1) < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\AVG Anti-Spyware Driver < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\AVG Anti-Spyware Guard < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\AvgAsCln < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\AVP < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\BITS Start REG_DWORD 3 (0x3) > Value: HKEY_LOCAL_MACHINE\system\controlset003\services\BITS Start REG_DWORD 2 (0x2) < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\Dhcp\Parameters {6317C625-DA29-42BA-9ADD-C0C897993031} REG_BINARY 1A0000000000000002000000000000002EAECB4705D40000060000000000000008000000000000002EAECB473E0410463E041145030000000000000004000000000000002EAECB47C0A801010F0000000000000005000000000000002EAECB476C6F63616C000000330000000000000004000000000000002EAECB4700015180010000000000000004000000000000002EAECB47FFFFFF00360000000000000004000000000000002EAECB47C0A80101350000000000000001000000000000002EAECB4705000000 > Value: HKEY_LOCAL_MACHINE\system\controlset003\services\Dhcp\Parameters {6317C625-DA29-42BA-9ADD-C0C897993031} REG_BINARY 1A000000000000000200000000000000F45F144905D4000006000000000000000800000000000000F45F1449D043DEDED043DCDC03000000000000000400000000000000F45F1449C0A801010F000000000000000500000000000000F45F14496C6F63616C00000033000000000000000400000000000000F45F14490001518001000000000000000400000000000000F45F1449FFFFFF0036000000000000000400000000000000F45F1449C0A8010135000000000000000100000000000000F45F144905000000 > Value: HKEY_LOCAL_MACHINE\system\controlset003\services\Eventlog\Security\DS > Value: HKEY_LOCAL_MACHINE\system\controlset003\services\Eventlog\Security\LSA > Value: HKEY_LOCAL_MACHINE\system\controlset003\services\Eventlog\Security\NetDDE Object > Value: HKEY_LOCAL_MACHINE\system\controlset003\services\Eventlog\Security\SC Manager > Value: HKEY_LOCAL_MACHINE\system\controlset003\services\Eventlog\Security\Security > Value: HKEY_LOCAL_MACHINE\system\controlset003\services\Eventlog\Security\Security Account Manager > Value: HKEY_LOCAL_MACHINE\system\controlset003\services\Eventlog\Security\Spooler < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\Eventlog\System Sources REG_MULTI_SZ WZCSVC\0Workstation\0WindowsMedia\0Windows Update Agent\0Windows Script Host\0Windows Installer 3.1\0Windows File Protection\0Win32k\0W32Time\0VolSnap\0viaide\0VgaSave\0USER32\0UPS\0ultra\0udfs\0toside\0TermServSessDir\0TermService\0TermServDevices\0TermDD\0tdi\0TCPMon\0Tcpip\0System Error\0sym_u3\0sym_hi\0symc8xx\0symc810\0StillImage\0SSDPSRV\0Srv\0srservice\0sr\0sparrow\0sndblst\0Simbad\0SideBySide\0sfloppy\0Setup\0Service de stockage amovible\0Service Control Manager\0Server\0serial\0scsiport\0Schedule\0Schannel\0SCardSvr\0Save Dump\0SAM\0RTL8023xp\0RSVP\0RemoteAccess\0redbook\0Rdbss\0RasMan\0RasAuto\0ql1280\0ql1240\0ql12160\0ql10wnt\0ql1080\0PSched\0Print\0PptpMiniport\0PolicyAgent\0PlugPlayManager\0perc2\0pcmcia\0pciide\0pci\0parvdm\0partmgr\0parport\0OSPFMib\0OSPF\0null\0NtServicePack\0ntfs\0npfs\0Nla\0NIC1394\0Netlogon\0NetDDE\0NetBT\0NetBIOS\0NdisWan\0NdisIP\0ndis\0Mup\0msfs\0msadlib\0MrxSmb\0MRxDAV\0mraid35x\0mouhid\0mouclass\0Modem\0LsaSrv\0LmHosts\0LDMS\0LDM\0lbrtfdc\0Kerberos\0kbdhid\0kbdclass\0isapnp\0irsir\0IPXSAP\0IPXRouterManager\0IPXRIP\0IPXCP\0IPSec\0IPRouterManager\0IPRIP2\0IPNATHLP\0IPMGM\0IPBOOTP\0intelppm\0intelide\0ini910u\0IGMPv2\0i8042prt\0i2omp\0i2omgmt\0Http\0hpn\0ftdisk\0fs_rec\0flpydisk\0Fips\0fdc\0fastfat\0eventlog\0efs\0dpti2o\0Dnscache\0Dnsapi\0dmio\0dmboot\0Distributed Link Tracking Client\0disk\0Dhcp\0DfsSvc\0DfsDriver\0DCOM\0dac960nt\0dac2w2k\0cpqarray\0cmdide\0changer\0cdrom\0Cdm\0cdfs\0cdaudio\0cd20xrnt\0cbidf2k\0Browser\0BITS\0beep\0Atmarpc\0ati2mtag\0Ati HotKey Poller\0atdisk\0atapi\0AsyncMac\0asc3550\0asc3350p\0asc\0Arp1394\0Application Popup\0apphelp\0amsint\0ami0nt\0aliide\0Alerter\0aic78xx\0aic78u2\0aha154x\0adpu160m\0acpiec\0acpi\0abp480n5\0abiosdsk\0System\0\0 > Value: HKEY_LOCAL_MACHINE\system\controlset003\services\Eventlog\System Sources REG_MULTI_SZ WZCSVC\0Workstation\0WindowsMedia\0Windows Update Agent\0Windows Script Host\0Windows Installer 3.1\0Windows File Protection\0Win32k\0W32Time\0VolSnap\0viaide\0VgaSave\0USER32\0UPS\0ultra\0udfs\0toside\0TermServSessDir\0TermService\0TermServDevices\0TermDD\0tdi\0TCPMon\0Tcpip\0System Error\0sym_u3\0sym_hi\0symc8xx\0symc810\0StillImage\0SSDPSRV\0Srv\0srservice\0sr\0sparrow\0sndblst\0Simbad\0SideBySide\0sfloppy\0Setup\0Service de stockage amovible\0Service Control Manager\0Server\0serial\0scsiport\0Schedule\0Schannel\0SCardSvr\0Save Dump\0SAM\0RTL8023xp\0RSVP\0RemoteAccess\0redbook\0Rdbss\0RasMan\0RasAuto\0ql1280\0ql1240\0ql12160\0ql10wnt\0ql1080\0PSched\0Print\0PptpMiniport\0PolicyAgent\0PlugPlayManager\0perc2\0pcmcia\0pciide\0pci\0parvdm\0partmgr\0parport\0OSPFMib\0OSPF\0null\0NtServicePack\0ntfs\0npfs\0Nla\0NIC1394\0Netlogon\0NetDDE\0NetBT\0NetBIOS\0NdisWan\0NdisIP\0ndis\0Mup\0msfs\0msadlib\0MrxSmb\0MRxDAV\0mraid35x\0mouhid\0mouclass\0Modem\0LsaSrv\0LmHosts\0LDMS\0LDM\0lbrtfdc\0Kerberos\0kbdhid\0kbdclass\0isapnp\0irsir\0IPXSAP\0IPXRouterManager\0IPXRIP\0IPXCP\0IPSec\0IPRouterManager\0IPRIP2\0IPNATHLP\0IPMGM\0IPBOOTP\0Internet Explorer 7 Disk\0intelppm\0intelide\0ini910u\0IGMPv2\0i8042prt\0i2omp\0i2omgmt\0Http\0hpn\0ftdisk\0fs_rec\0flpydisk\0Fips\0fdc\0fastfat\0eventlog\0efs\0dpti2o\0Dnscache\0Dnsapi\0dmio\0dmboot\0Distributed Link Tracking Client\0disk\0Dhcp\0DfsSvc\0DfsDriver\0DCOM\0dac960nt\0dac2w2k\0cpqarray\0cmdide\0changer\0cdrom\0Cdm\0cdfs\0cdaudio\0cd20xrnt\0cbidf2k\0Browser\0BITS\0beep\0Atmarpc\0ati2mtag\0Ati HotKey Poller\0atdisk\0atapi\0AsyncMac\0asc3550\0asc3350p\0asc\0Arp1394\0Application Popup\0apphelp\0amsint\0ami0nt\0aliide\0Alerter\0aic78xx\0aic78u2\0aha154x\0adpu160m\0acpiec\0acpi\0abp480n5\0abiosdsk\0System\0\0 < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\kl1 < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\klif < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\lanmanserver\parameters Guid REG_BINARY 5004971301681449958DAA43046B5866 > Value: HKEY_LOCAL_MACHINE\system\controlset003\services\lanmanserver\parameters Guid REG_BINARY 0C479EC6F0F996478B4B2AB36A79A4DE > Value: HKEY_LOCAL_MACHINE\system\controlset003\services\MRxDAV\EncryptedDirectories < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\PerfDisk\Performance WbemAdapFileSignature REG_BINARY 97F41DFEE99BC2AE60BAD78679FB40A1 < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\PerfDisk\Performance WbemAdapFileTime REG_BINARY 0020E7D4F03DC601 < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\PerfDisk\Performance WbemAdapFileSize REG_DWORD 27136 (0x6A00) < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\PerfDisk\Performance WbemAdapStatus REG_DWORD 0 (0x0) < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\PerfNet\Performance WbemAdapFileSignature REG_BINARY 7FD03F93453FAFBABB6E29B11E9E731C < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\PerfNet\Performance WbemAdapFileTime REG_BINARY 0020E7D4F03DC601 < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\PerfNet\Performance WbemAdapFileSize REG_DWORD 17408 (0x4400) < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\PerfNet\Performance WbemAdapStatus REG_DWORD 0 (0x0) < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\SharedAccess\Epoch Epoch REG_DWORD 8851 (0x2293) > Value: HKEY_LOCAL_MACHINE\system\controlset003\services\SharedAccess\Epoch Epoch REG_DWORD 9316 (0x2464) > Value: HKEY_LOCAL_MACHINE\system\controlset003\services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List %windir%\Network Diagnostic\xpnetdiag.exe REG_SZ %windir%\Network Diagnostic\xpnetdiag.exe:*:Enaxxxxx@xxxxxres.dll,-20000 > Value: HKEY_LOCAL_MACHINE\system\controlset003\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\kav\kis7.0\french\setup.exe REG_SZ C:\kav\kis7.0\french\setup.exe:*:Enabled:Programme d'installation de Kaspersky Internet Security 7.0 > Value: HKEY_LOCAL_MACHINE\system\controlset003\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\kav\kav7.0\french\setup.exe REG_SZ C:\kav\kav7.0\french\setup.exe:*:Enabled:Programme d'installation de Kaspersky Anti-Virus 7.0 > Value: HKEY_LOCAL_MACHINE\system\controlset003\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List %windir%\Network Diagnostic\xpnetdiag.exe REG_SZ %windir%\Network Diagnostic\xpnetdiag.exe:*:Enaxxxxx@xxxxxres.dll,-20000 < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\Spooler\Performance WbemAdapFileSignature REG_BINARY E415A3D071D315CD84F6F593A3A060B3 < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\Spooler\Performance WbemAdapFileTime REG_BINARY 0020E7D4F03DC601 < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\Spooler\Performance WbemAdapFileSize REG_DWORD 146944 (0x23E00) < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\Spooler\Performance WbemAdapStatus REG_DWORD 0 (0x0) < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\sr Start REG_DWORD 0 (0x0) > Value: HKEY_LOCAL_MACHINE\system\controlset003\services\sr Start REG_DWORD 4 (0x4) < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\sr ImagePath REG_EXPAND_SZ system32\DRIVERS\sr.sys > Value: HKEY_LOCAL_MACHINE\system\controlset003\services\sr ImagePath REG_EXPAND_SZ \SystemRoot\system32\DRIVERS\sr.sys < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\sr\Parameters FirstRun REG_DWORD 0 (0x0) > Value: HKEY_LOCAL_MACHINE\system\controlset003\services\sr\Parameters FirstRun REG_DWORD 1 (0x1) < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\TapiSrv\Performance WbemAdapFileSignature REG_BINARY 0483F001E58AF7EA90B23BA9ACB367D3 < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\TapiSrv\Performance WbemAdapFileTime REG_BINARY 0020E7D4F03DC601 < Value: HKEY_LOCAL_MACHINE\system\controlset001\se

Sophie · Answer

@="\"%1\" %*" -----HKEY_CLASSES_ROOT\comfile\shell\open\command----- [command] @="\"%1\" %*" -----HKEY_CLASSES_ROOT\batfile\shell\open\command----- [command] @="\"%1\" %*" -----HKEY_CLASSES_ROOT\piffile\shell\open\command----- [command] @="\"%1\" %*" -----HKEY_CLASSES_ROOT\scrFile\shell\open\command----- [command] @="\"%1\" %*" -----HKEY_CLASSES_ROOT\htafile\shell\open\command----- [Command] @="C:\WINDOWS\system32\mshta.exe \"%1\" %*" -----HKEY_CLASSES_ROOT\logfile\shell\open\command----- -----HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\URL----- [URL] [URL\DefaultPrefix] @="http://" [URL\Prefixes] "ftp"="ftp://" "gopher"="gopher://" "home"="http://" "mosaic"="http://" "www"="http://" -----HKLM\SYSTEM\CurrentControlSet\Control\Lsa----- [Lsa] [Lsa\AccessProviders] [Lsa\AccessProviders\Windows NT Access Provider] "ProviderPath"=expand:"%SystemRoot%\system32 tmarta.dll" [Lsa\Audit] [Lsa\Audit\PerUserAuditing] [Lsa\Audit\PerUserAuditing\System] [Lsa\Data] [Lsa\SSO] [Lsa\SSO\Passport1.4] "SSOURL"="http://www.passport.com" [Lsa\SspiCache] [Lsa\SspiCache\digest.dll] "Name"="Digest" "Comment"="Digest SSPI Authentication Package" [Lsa\SspiCache\msapsspc.dll] "Name"="DPA" "Comment"="DPA Security Package" [Lsa\SspiCache\msnsspc.dll] "Name"="MSN" "Comment"="MSN Security Package" -----HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess----- [SharedAccess] "DependOnGroup"=multi:"\00" "DependOnService"=multi:"Netman\00WinMgmt\00\00" "Description"="Assure la traduction d'adresses de réseau, l'adressage, les services de résolution de noms et/ou les services de prévention d'intrusion pour un réseau de petite entreprise ou un réseau domestique." "DisplayName"="Pare-feu Windows / Partage de connexion Internet" "ErrorControl"=dword:00000001 "ImagePath"=expand:"%SystemRoot%\system32\svchost.exe -k netsvcs" "ObjectName"="LocalSystem" "Start"=dword:00000002 "Type"=dword:00000020 [SharedAccess\Epoch] "Epoch"=dword:00002473 [SharedAccess\Parameters] "ServiceDll"=expand:"%SystemRoot%\System32\ipnathlp.dll" [SharedAccess\Parameters\FirewallPolicy] [SharedAccess\Parameters\FirewallPolicy\DomainProfile] [SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications] [SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List] "%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enaxxxxx@xxxxxres.dll,-22019" "C:\Program Files\MSN Messenger\msnmsgr.exe"="C:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1" "C:\Program Files\MSN Messenger\livecall.exe"="C:\Program Files\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)" "%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enaxxxxx@xxxxxres.dll,-20000" [SharedAccess\Parameters\FirewallPolicy\StandardProfile] "EnableFirewall"=dword:00000001 "DoNotAllowExceptions"=dword:00000000 [SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications] [SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] "%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enaxxxxx@xxxxxres.dll,-22019" "C:\Program Files\eMule\emule.exe"="C:\Program Files\eMule\emule.exe:*:Enabled:eMule" "C:\Program Files\MSN Messenger\msnmsgr.exe"="C:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1" "C:\Program Files\MSN Messenger\livecall.exe"="C:\Program Files\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)" "C:\Program Files\Resolume 2.41 esolume.exe"="C:\Program Files\Resolume 2.41 esolume.exe:*:Enabled:Resolume 2.41" "C:\Program Files\Messenger\msmsgs.exe"="C:\Program Files\Messenger\msmsgs.exe:*:Enabled:Windows Messenger" "C:\Documents and Settings\Propriétaire\Local Settings\Temp\Rar$EX02.937\emule.exe"="C:\Documents and Settings\Propriétaire\Local Settings\Temp\Rar$EX02.937\emule.exe:*:Disabled:eMule" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\0exinjs.aa.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\0exinjs.aa.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\22exinjs.aa.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\22exinjs.aa.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\23exinjs.aa.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\23exinjs.aa.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\83exinjs.aa.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\83exinjs.aa.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\86exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\86exinjs.ab.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\82exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\82exinjs.ab.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\42exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\42exinjs.ab.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\98exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\98exinjs.ab.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\36exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\36exinjs.ab.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\59exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\59exinjs.ab.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\49exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\49exinjs.ab.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\73exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\73exinjs.ab.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\75exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\75exinjs.ab.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\8exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\8exinjs.ab.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\47exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\47exinjs.ab.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\20exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\20exinjs.ab.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\78exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\78exinjs.ab.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\80exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\80exinjs.ab.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\74exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\74exinjs.ab.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\18exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\18exinjs.ab.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\64exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\64exinjs.ab.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\57exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\57exinjs.ab.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\92exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\92exinjs.ab.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\11exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\11exinjs.ab.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\50exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\50exinjs.ab.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\43exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\43exinjs.ab.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\95exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\95exinjs.ab.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\52exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\52exinjs.ab.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\23exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\23exinjs.ab.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\6exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\6exinjs.ab.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\39exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\39exinjs.ab.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\68exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\68exinjs.ab.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\61exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\61exinjs.ab.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\26exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\26exinjs.ab.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\34exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\34exinjs.ab.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\19exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\19exinjs.ab.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\32exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\32exinjs.ab.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\14exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\14exinjs.ab.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\60exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\60exinjs.ab.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\29exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\29exinjs.ab.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\66exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\66exinjs.ab.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\99exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\99exinjs.ab.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\54exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\54exinjs.ab.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\94exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\94exinjs.ab.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\85exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\85exinjs.ab.exe:*:Enabled:Microsoft Update" "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe"="C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe:*:Disabled:Kaspersky Anti-Virus" "C:\Program Files\uTorrent\uTorrent.exe"="C:\Program Files\uTorrent\uTorrent.exe:*:Enabled:µTorrent" "C:\Program Files\BitDownload\BitDownload.exe"="C:\Program Files\BitDownload\BitDownload.exe:*:Enabled:Torrent P2P application" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\16ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\16ex:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\25ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\25ex:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\35ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\35ex:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\43ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\43ex:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\58ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\58ex:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\26ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\26ex:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\87ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\87ex:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\60ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\60ex:*:Enabled:Microsoft Update" "C:\Program Files\Ahead\Nero ShowTime\ShowTime.exe"="C:\Program Files\Ahead\Nero ShowTime\ShowTime.exe:*:Enabled:Nero ShowTime" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\44ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\44ex:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\50ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\50ex:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\7ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\7ex:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\42ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\42ex:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\3ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\3ex:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\21ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\21ex:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\40ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\40ex:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\2ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\2ex:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\4ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\4ex:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\65ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\65ex:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\37ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\37ex:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\31ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\31ex:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\72ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\72ex:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\92ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\92ex:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\68ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\68ex:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\45ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\45ex:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\96ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\96ex:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\33ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\33ex:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\79ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\79ex:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\10ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\10ex:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\22ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\22ex:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\55ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\55ex:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\66ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\66ex:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\94ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\94ex:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\52ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\52ex:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\0ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\0ex:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\63ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\63ex:*:Enabled:Microsoft Update" "C:\Documents and Settings\Propriétaire\Local Settings\Temp\10exmdnk23.exe"="C:\Documents and Settings\Propriétaire\Local Settings\Temp\10exmdnk23.exe:*:Disabled:10exmdnk23" "C:\Documents and Settings\Propriétaire\Local Settings\Temp\33exmdnk25.exe"="C:\Documents and Settings\Propriétaire\Local Settings\Temp\33exmdnk25.exe:*:Disabled:33exmdnk25" "C:\Documents and Settings\Propriétaire\Local Settings\Temp\0exmdnk26.exe"="C:\Documents and Settings\Propriétaire\Local Settings\Temp\0exmdnk26.exe:*:Disabled:0exmdnk26" "C:\Documents and Settings\Propriétaire\Local Settings\Temp\58exmdnk30.exe"="C:\Documents and Settings\Propriétaire\Local Settings\Temp\58exmdnk30.exe:*:Disabled:58exmdnk30" "C:\kav\kis7.0\french\setup.exe"="C:\kav\kis7.0\french\setup.exe:*:Enabled:Programme d'installation de Kaspersky Internet Security 7.0" "C:\kav\kav7.0\french\setup.exe"="C:\kav\kav7.0\french\setup.exe:*:Enabled:Programme d'installation de Kaspersky Anti-Virus 7.0" "%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enaxxxxx@xxxxxres.dll,-20000" [SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts] [SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List] "1900:UDP"="1900:UDP:LocalSubNet:Disaxxxxx@xxxxxres.dll,-22007" "2869:TCP"="2869:TCP:LocalSubNet:Disaxxxxx@xxxxxres.dll,-22008" "17053:TCP"="17053:TCP:*:Enabled:NortonAV" "12192:TCP"="12192:TCP:*:Enabled:NortonAV" [SharedAccess\Setup] "ServiceUpgrade"=dword:00000001 [SharedAccess\Setup\InterfacesUnfirewalledAtUpdate] "All"=dword:00000001 -----HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Firewall\----- -----HKEY_LOCAL_MACHINE\SOFTWARE\Winsock2----- -----HKLM\Software\Microsoft\Ole----- [Ole] "DefaultLaunchPermission"=hex:01,00,04,80,5c,00,00,00,6c,00,00,00,00,00,00,00,\ "MachineLaunchRestriction"=hex:01,00,04,80,48,00,00,00,58,00,00,00,00,00,00,00,\ "MachineAccessRestriction"=hex:01,00,04,80,44,00,00,00,54,00,00,00,00,00,00,00,\ "EnableDCOM"="Y" [Ole\AppCompat] [Ole\AppCompat\ActivationSecurityCheckExemptionList] "{A50398B8-9075-4FBF-A7A1-456BF21937AD}"="1" "{AD65A69D-3831-40D7-9629-9B0B50A93843}"="1" "{0040D221-54A1-11D1-9DE0-006097042D69}"="1" "{2A6D72F1-6E7E-4702-B99C-E40D3DED33C3}"="1" [Ole\NONREDIST] "System.EnterpriseServices.Thunk.dll"="" -----HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WindowsUpdate\AU\----- -----HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\----- [Security Center] "FirstRunDisabled"=dword:00000001 "AntiVirusDisableNotify"=dword:00000000 "FirewallDisableNotify"=dword:00000000 "UpdatesDisableNotify"=dword:00000000 "AntiVirusOverride"=dword:00000001 "FirewallOverride"=dword:00000000 [Security Center\Monitoring] [Security Center\Monitoring\AhnlabAntiVirus] [Security Center\Monitoring\ComputerAssociatesAntiVirus] [Security Center\Monitoring\KasperskyAntiVirus] [Security Center\Monitoring\McAfeeAntiVirus] [Security Center\Monitoring\McAfeeFirewall] [Security Center\Monitoring\PandaAntiVirus] [Security Center\Monitoring\PandaFirewall] [Security Center\Monitoring\SophosAntiVirus] [Security Center\Monitoring\SymantecAntiVirus] [Security Center\Monitoring\SymantecFirewall] [Security Center\Monitoring\TinyFirewall] [Security Center\Monitoring\TrendAntiVirus] [Security Center\Monitoring\TrendFirewall] [Security Center\Monitoring\ZoneLabsFirewall] -----HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore\----- [SystemRestore] "DisableSR"=dword:00000000 "CreateFirstRunRp"=dword:00000001 "DSMin"=dword:000000c8 "DSMax"=dword:00000190 "RPSessionInterval"=dword:00000000 "RPGlobalInterval"=dword:00015180 "RPLifeInterval"=dword:0076a700 "CompressionBurst"=dword:0000003c "TimerInterval"=dword:00000078 "DiskPercent"=dword:0000000c "ThawInterval"=dword:00000384 "RestoreDiskSpaceError"=dword:00000000 "RestoreStatus"=dword:00000000 "RestoreSafeModeStatus"=dword:00000001 [SystemRestore\Cfg] "DiskPercent"=dword:0000000c "MachineGuid"="{D88DDE61-D342-465C-AFF5-295FBD9AB56F}" [SystemRestore\SnapshotCallbacks] @="" -----HKEY_CURRENT_USER\Software\VB and VBA Program Settings----- [VB and VBA Program Settings] [VB and VBA Program Settings\CCleaner] [VB and VBA Program Settings\CCleaner\Options] -----HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\----- -----HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\AdvancedOptions----- [AdvancedOptions] -----HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\AdvancedOptions----- -----HKLM\Software\Microsoft\Active Setup\Installed Components----- [Installed Components] [Installed Components\<{12d0ed0d-0ee0-4f90-8827-78cefb8f4988}] "@="IE7 Uninstall Stub" "ComponentID"="IEUDINIT" "StubPath"="C:\WINDOWS\system32\ieudinit.exe" [Installed Components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}] #### HKCR\CLSID\{22d6f312-b0f6-11d0-94ab-0080c74c7e95}\InprocServer32 @="C:\WINDOWS\system32\wmpdxm.dll" "Stubpath"="C:\WINDOWS\inf\unregmp2.exe /ShowWMP" "@="Microsoft Windows Media Player" "ComponentID"="WMPACCESS" [Installed Components\>{26923b43-4d38-484f-9b9e-de460746276c}] "@="Internet Explorer" "ComponentID"="IEACCESS" "StubPath"="C:\WINDOWS\system32\ie4uinit.exe -UserIconConfig" [Installed Components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}] "@="Browser Customizations" "ComponentiD"="BRANDING.CAB" "StubPath"="RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP" [Installed Components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS] "@="Personnalisation du navigateur" "ComponentID"="BRANDING.CAB" "StubPath"="RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP" [Installed Components\>{881dd1c5-3dcf-431b-b061-f3f88e8be88a}] "@="Outlook Express" "ComponentID"="OEACCESS" "StubPath"=expand:"%systemroot%\system32\shmgrate.exe OCInstallUserConfigOE" [Installed Components\{0E92DD42-76F5-4EF2-B381-F9C1D72BE23D}] "@="Security Update for Microsoft .NET Framework 2.0 (KB922770)" "ComponentID"="KB922770" [Installed Components\{10072CEC-8CC1-11D1-986E-00A0C955B42F}] "@="Rendu VML (Vector Graphics Rendering)" "ComponentID"="MSVML" [Installed Components\{2179C5D3-EBFF-11CF-B6FD-00AA00B4E220}] #### HKCR\CLSID\{2179C5D3-EBFF-11CF-B6FD-00AA00B4E220}\InprocServer32 @="C:\WINDOWS\system32\wmpdxm.dll" "ComponentID"="NetShow" "StubPath"="" [Installed Components\{22d6f312-b0f6-11d0-94ab-0080c74c7e95}] #### HKCR\CLSID\{22d6f312-b0f6-11d0-94ab-0080c74c7e95}\InprocServer32 @="C:\WINDOWS\system32\wmpdxm.dll" "ComponentID"="Microsoft Windows Media Player" "StubPath"="" "@="Lecteur Windows Media Microsoft 6.4" [Installed Components\{283807B5-2C60-11D0-A31D-00AA00B92C03}] "@="DirectAnimation" "ComponentID"="DirectAnimation" [Installed Components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}] "@="Themes Setup" "ComponentID"="Theme Component" "StubPath"=expand:"%SystemRoot%\system32 egsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32 hemeui.dll" [Installed Components\{36f8ec70-c29a-11d1-b5c7-0000f8051515}] "@="Liaison de données Dynamic HTML pour Java" "ComponentID"="TridataJava" [Installed Components\{3919E8B8-A291-74E5-5DBF-8FB615E8FCED}] "@="Themes Setup" "ComponentID"="Theme Component" [Installed Components\{3af36230-a269-11d1-b5bf-0000f8051515}] "@="Offline Browsing Pack" "ComponentID"="MobilePk" [Installed Components\{3bf42070-b3b1-11d1-b5c5-0000f8051515}] "@="Uniscribe" "ComponentID"="USP10" [Installed Components\{411EDCF7-755D-414E-A74B-3DCD6583F589}] "ComponentID"="S867460" "@="Microsoft .NET Framework 1.1 Service Pack 1 (KB867460)" [Installed Components\{4278c270-a269-11d1-b5bf-0000f8051515}] "@="Création avancée" "ComponentID"="AdvAuth" [Installed Components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}] "@="Microsoft Outlook Express 6" "ComponentID"="MailNews" "StubPath"=expand:"\"%ProgramFiles%\Outlook Express\setup50.exe\" /APP:OE /CALLER:WINNT /user /install" [Installed Components\{44BBA842-CC51-11CF-AAFA-00AA00B6015B}] "@="NetMeeting 3.01" "ComponentID"="NetMeeting" "StubPath"="rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT" [Installed Components\{44BBA848-CC51-11CF-AAFA-00AA00B6015C}] "@="DirectShow" "ComponentID"="activemovie" [Installed Components\{44BBA855-CC51-11CF-AAFA-00AA00B6015F}] "@="DirectDrawEx" "ComponentID"="DirectDrawEx" [Installed Components\{45ea75a0-a269-11d1-b5bf-0000f8051515}] "@="Internet Explorer Help" "ComponentID"="HelpCont" [Installed Components\{4f216970-c90c-11d1-b5c7-0000f8051515}] "@="Classes Java DirectAnimation" "ComponentID"="DAJava" [Installed Components\{4f645220-306d-11d2-995d-00c04f98bbc9}] "@="Microsoft Windows Script 5.6" "ComponentID"="MSVBScript" [Installed Components\{5945c046-1e7d-11d1-bc44-00c04fd912be}] "KeyFileName"="C:\Program Files\Messenger\msmsgs.exe" "@="Windows Messenger 4.7" "ComponentID"="Messenger" "StubPath"="rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser" [Installed Components\{5A8D6EE0-3E18-11D0-821E-444553540000}] "(Default)"="Internet Connection Wizard" "ComponentID"="ICW" [Installed Components\{5fd399c0-a70a-11d1-9948-00c04f98bbc9}] "@="Internet Explorer Setup Tools" "ComponentID"="GenSetup" [Installed Components\{630b1da0-b465-11d1-9948-00c04f98bbc9}] "@="Browsing Enhancements" "ComponentID"="ExtraPack" "KeyFileName"="C:\WINDOWS\system32\msieftp.dll" [Installed Components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}] #### HKCR\CLSID\{6BF52A52-394A-11d3-B153-00C04F79FAA6}\InprocServer32 @="C:\WINDOWS\system32\wmp.dll" "@="Microsoft Windows Media Player" "ComponentID"="Microsoft Windows Media Player" "StubPath"="rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\wmp.inf,PerUserStub" [Installed Components\{6fab99d0-bab8-11d1-994a-00c04f98bbc9}] "@="MSN Site Access" "ComponentID"="MSN_Auth" [Installed Components\{7131646D-CD3C-40F4-97B9-CD9E4E6262EF}] "ComponentID"=".NETFramework" "@=".NET Framework" [Installed Components\{7790769C-0471-11d2-AF11-00C04FA35D02}] "@="Carnet d'adresses 6" "ComponentID"="WAB" "StubPath"=expand:"\"%ProgramFiles%\Outlook Express\setup50.exe\" /APP:WAB /CALLER:WINNT /user /install" [Installed Components\{8056AC9E-49C5-4375-9ADE-B2F862C9DF51}] "ComponentID"="KB928365" "@="Security Update for Microsoft .NET Framework 2.0 (KB928365)" [Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4340}] "@="Mise à jour du Bureau Windows" "ComponentID"="IE4Shell_NT" "StubPath"=expand:"regsvr32.exe /s /n /i:U shell32.dll" [Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4383}] "@="Internet Explorer" "ComponentID"="BASEIE40_W2K" "StubPath"="C:\WINDOWS\system32\ie4uinit.exe -BaseSettings" [Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4383}\AuthorizedCDFPrefix] [Installed Components\{89B4C1CD-B018-4511-B0A1-5476DBF70820}] "StubPath"="C:\WINDOWS\system32\Rundll32.exe C:\WINDOWS\system32\mscories.dll,Install" "ComponentID"="DOTNETFRAMEWORKS" [Installed Components\{8D1D0E9A-C799-4D28-9E29-0061D1E66E43}] "ComponentID"="M928366" "@="Microsoft .NET Framework 1.1 Hotfix (KB928366)" [Installed Components\{9381D8F2-0288-11D0-9501-00AA00B911A5}] "@="Dynamic HTML Data Binding" "ComponentID"="Tridata" [Installed Components\{967B098A-042D-4367-BAC9-8BC11684174F}] "@="Security Update for Microsoft .NET Framework 2.0 (KB917283)" "ComponentID"="KB917283" [Installed Components\{ACC563BC-4266-43f0-B6ED-9D38C4202C7E}] [Installed Components\{C9E9A340-D1F1-11D0-821E-444553540600}] "@="Internet Explorer Core Fonts" "ComponentID"="Fontcore" [Installed Components\{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}] "ComponentID"=".NETFramework" "@=".NET Framework" [Installed Components\{CC2A9BA0-3BDD-11D0-821E-444553540000}] "@="Planificateur de tâches" "ComponentID"="MSTASK" [Installed Components\{CDD7975E-60F8-41d5-8149-19E51D6F71D0}] "ComponentID"="Windows Movie Maker v2.1" [Installed Components\{D27CDB6E-AE6D-11cf-96B8-444553540000}] "@="Adobe Flash Player" "ComponentID"="Flash" [Installed Components\{de5aed00-a4bf-11d1-9948-00c04f98bbc9}] "@="HTML Help" "ComponentID"="HTMLHelp" [Installed Components\{E92B03AB-B707-11d2-9CBD-0000F87A369E}] "@="Active Directory Service Interface" "ComponentID"="ADSI" -----Comparing registry keys CCS1 vs CCS2 ----- < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\aawservice > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\aswTdi DisplayName REG_SZ avast! Network Shield Support > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\aswTdi ErrorControl REG_DWORD 1 (0x1) > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\aswTdi Type REG_DWORD 1 (0x1) > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\aswTdi Group REG_SZ PNP_TDI > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\aswTdi Start REG_DWORD 1 (0x1) > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\aswTdi DependOnService REG_MULTI_SZ tcpip\0\0 > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\aswTdi Tag REG_DWORD 9 (0x9) < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\aswTdi\Parameters ProviderStart REG_DWORD 3 (0x3) > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\aswTdi\Parameters ProviderStart REG_DWORD 1 (0x1) < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\AVG Anti-Spyware Driver < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\AVG Anti-Spyware Guard < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\AvgAsCln < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\AVP < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\BITS Start REG_DWORD 3 (0x3) > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\BITS Start REG_DWORD 2 (0x2) < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\Dhcp\Parameters {6317C625-DA29-42BA-9ADD-C0C897993031} REG_BINARY 1A0000000000000002000000000000002EAECB4705D40000060000000000000008000000000000002EAECB473E0410463E041145030000000000000004000000000000002EAECB47C0A801010F0000000000000005000000000000002EAECB476C6F63616C000000330000000000000004000000000000002EAECB4700015180010000000000000004000000000000002EAECB47FFFFFF00360000000000000004000000000000002EAECB47C0A80101350000000000000001000000000000002EAECB4705000000 > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\Dhcp\Parameters {6317C625-DA29-42BA-9ADD-C0C897993031} REG_BINARY FC000000000000000000000000000000BF1D13491A0000000000000002000000000000003969144905D400000600000000000000080000000000000039691449D043DEDED043DCDC0300000000000000040000000000000039691449C0A801010F000000000000000500000000000000396914496C6F63616C0000003300000000000000040000000000000039691449000151800100000000000000040000000000000039691449FFFFFF003600000000000000040000000000000039691449C0A80101350000000000000001000000000000003969144905000000 < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\Eventlog\Application\ESENT EventMessageFile REG_EXPAND_SZ c:\windows\system32\ESENT.dll > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\Eventlog\Application\ESENT EventMessageFile REG_EXPAND_SZ C:\WINDOWS\system32\ESENT.dll < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\Eventlog\Application\ESENT CategoryMessageFile REG_EXPAND_SZ c:\windows\system32\ESENT.dll > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\Eventlog\Application\ESENT CategoryMessageFile REG_EXPAND_SZ C:\WINDOWS\system32\ESENT.dll > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\Eventlog\Security\DS > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\Eventlog\Security\LSA > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\Eventlog\Security\NetDDE Object > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\Eventlog\Security\SC Manager > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\Eventlog\Security\Security > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\Eventlog\Security\Security Account Manager > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\Eventlog\Security\Spooler < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\Eventlog\System Sources REG_MULTI_SZ WZCSVC\0Workstation\0WindowsMedia\0Windows Update Agent\0Windows Script Host\0Windows Installer 3.1\0Windows File Protection\0Win32k\0W32Time\0VolSnap\0viaide\0VgaSave\0USER32\0UPS\0ultra\0udfs\0toside\0TermServSessDir\0TermService\0TermServDevices\0TermDD\0tdi\0TCPMon\0Tcpip\0System Error\0sym_u3\0sym_hi\0symc8xx\0symc810\0StillImage\0SSDPSRV\0Srv\0srservice\0sr\0sparrow\0sndblst\0Simbad\0SideBySide\0sfloppy\0Setup\0Service de stockage amovible\0Service Control Manager\0Server\0serial\0scsiport\0Schedule\0Schannel\0SCardSvr\0Save Dump\0SAM\0RTL8023xp\0RSVP\0RemoteAccess\0redbook\0Rdbss\0RasMan\0RasAuto\0ql1280\0ql1240\0ql12160\0ql10wnt\0ql1080\0PSched\0Print\0PptpMiniport\0PolicyAgent\0PlugPlayManager\0perc2\0pcmcia\0pciide\0pci\0parvdm\0partmgr\0parport\0OSPFMib\0OSPF\0null\0NtServicePack\0ntfs\0npfs\0Nla\0NIC1394\0Netlogon\0NetDDE\0NetBT\0NetBIOS\0NdisWan\0NdisIP\0ndis\0Mup\0msfs\0msadlib\0MrxSmb\0MRxDAV\0mraid35x\0mouhid\0mouclass\0Modem\0LsaSrv\0LmHosts\0LDMS\0LDM\0lbrtfdc\0Kerberos\0kbdhid\0kbdclass\0isapnp\0irsir\0IPXSAP\0IPXRouterManager\0IPXRIP\0IPXCP\0IPSec\0IPRouterManager\0IPRIP2\0IPNATHLP\0IPMGM\0IPBOOTP\0intelppm\0intelide\0ini910u\0IGMPv2\0i8042prt\0i2omp\0i2omgmt\0Http\0hpn\0ftdisk\0fs_rec\0flpydisk\0Fips\0fdc\0fastfat\0eventlog\0efs\0dpti2o\0Dnscache\0Dnsapi\0dmio\0dmboot\0Distributed Link Tracking Client\0disk\0Dhcp\0DfsSvc\0DfsDriver\0DCOM\0dac960nt\0dac2w2k\0cpqarray\0cmdide\0changer\0cdrom\0Cdm\0cdfs\0cdaudio\0cd20xrnt\0cbidf2k\0Browser\0BITS\0beep\0Atmarpc\0ati2mtag\0Ati HotKey Poller\0atdisk\0atapi\0AsyncMac\0asc3550\0asc3350p\0asc\0Arp1394\0Application Popup\0apphelp\0amsint\0ami0nt\0aliide\0Alerter\0aic78xx\0aic78u2\0aha154x\0adpu160m\0acpiec\0acpi\0abp480n5\0abiosdsk\0System\0\0 > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\Eventlog\System Sources REG_MULTI_SZ WZCSVC\0Workstation\0WindowsMedia\0Windows Update Agent\0Windows Script Host\0Windows Installer 3.1\0Windows File Protection\0Win32k\0W32Time\0VolSnap\0viaide\0VgaSave\0USER32\0UPS\0ultra\0udfs\0toside\0TermServSessDir\0TermService\0TermServDevices\0TermDD\0tdi\0TCPMon\0Tcpip\0System Error\0sym_u3\0sym_hi\0symc8xx\0symc810\0StillImage\0SSDPSRV\0Srv\0srservice\0sr\0sparrow\0sndblst\0Simbad\0SideBySide\0sfloppy\0Setup\0Service de stockage amovible\0Service Control Manager\0Server\0serial\0scsiport\0Schedule\0Schannel\0SCardSvr\0Save Dump\0SAM\0RTL8023xp\0RSVP\0RemoteAccess\0redbook\0Rdbss\0RasMan\0RasAuto\0ql1280\0ql1240\0ql12160\0ql10wnt\0ql1080\0PSched\0Print\0PptpMiniport\0PolicyAgent\0PlugPlayManager\0perc2\0pcmcia\0pciide\0pci\0parvdm\0partmgr\0parport\0OSPFMib\0OSPF\0null\0NtServicePack\0ntfs\0npfs\0Nla\0NIC1394\0Netlogon\0NetDDE\0NetBT\0NetBIOS\0NdisWan\0NdisIP\0ndis\0Mup\0msfs\0msadlib\0MrxSmb\0MRxDAV\0mraid35x\0mouhid\0mouclass\0Modem\0LsaSrv\0LmHosts\0LDMS\0LDM\0lbrtfdc\0Kerberos\0kbdhid\0kbdclass\0isapnp\0irsir\0IPXSAP\0IPXRouterManager\0IPXRIP\0IPXCP\0IPSec\0IPRouterManager\0IPRIP2\0IPNATHLP\0IPMGM\0IPBOOTP\0Internet Explorer 7 Disk\0intelppm\0intelide\0ini910u\0IGMPv2\0i8042prt\0i2omp\0i2omgmt\0Http\0hpn\0ftdisk\0fs_rec\0flpydisk\0Fips\0fdc\0fastfat\0eventlog\0efs\0dpti2o\0Dnscache\0Dnsapi\0dmio\0dmboot\0Distributed Link Tracking Client\0disk\0Dhcp\0DfsSvc\0DfsDriver\0DCOM\0dac960nt\0dac2w2k\0cpqarray\0cmdide\0changer\0cdrom\0Cdm\0cdfs\0cdaudio\0cd20xrnt\0cbidf2k\0Browser\0BITS\0beep\0Atmarpc\0ati2mtag\0Ati HotKey Poller\0atdisk\0atapi\0AsyncMac\0asc3550\0asc3350p\0asc\0Arp1394\0Application Popup\0apphelp\0amsint\0ami0nt\0aliide\0Alerter\0aic78xx\0aic78u2\0aha154x\0adpu160m\0acpiec\0acpi\0abp480n5\0abiosdsk\0System\0\0 < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\kl1 < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\klif < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\lanmanserver\parameters Guid REG_BINARY 5004971301681449958DAA43046B5866 > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\lanmanserver\parameters Guid REG_BINARY 0C479EC6F0F996478B4B2AB36A79A4DE > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\MRxDAV\EncryptedDirectories < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\PerfDisk\Performance WbemAdapFileSignature REG_BINARY 97F41DFEE99BC2AE60BAD78679FB40A1 < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\PerfDisk\Performance WbemAdapFileTime REG_BINARY 0020E7D4F03DC601 < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\PerfDisk\Performance WbemAdapFileSize REG_DWORD 27136 (0x6A00) < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\PerfDisk\Performance WbemAdapStatus REG_DWORD 0 (0x0) < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\PerfNet\Performance WbemAdapFileSignature REG_BINARY 7FD03F93453FAFBABB6E29B11E9E731C < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\PerfNet\Performance WbemAdapFileTime REG_BINARY 0020E7D4F03DC601 < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\PerfNet\Performance WbemAdapFileSize REG_DWORD 17408 (0x4400) < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\PerfNet\Performance WbemAdapStatus REG_DWORD 0 (0x0) < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\SharedAccess\Epoch Epoch REG_DWORD 8851 (0x2293) > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\SharedAccess\Epoch Epoch REG_DWORD 9331 (0x2473) > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List %windir%\Network Diagnostic\xpnetdiag.exe REG_SZ %windir%\Network Diagnostic\xpnetdiag.exe:*:Enaxxxxx@xxxxxres.dll,-20000 > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\kav\kis7.0\french\setup.exe REG_SZ C:\kav\kis7.0\french\setup.exe:*:Enabled:Programme d'installation de Kaspersky Internet Security 7.0 > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\kav\kav7.0\french\setup.exe REG_SZ C:\kav\kav7.0\french\setup.exe:*:Enabled:Programme d'installation de Kaspersky Anti-Virus 7.0 > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List %windir%\Network Diagnostic\xpnetdiag.exe REG_SZ %windir%\Network Diagnostic\xpnetdiag.exe:*:Enaxxxxx@xxxxxres.dll,-20000 < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\Spooler\Performance WbemAdapFileSignature REG_BINARY E415A3D071D315CD84F6F593A3A060B3 < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\Spooler\Performance WbemAdapFileTime REG_BINARY 0020E7D4F03DC601 < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\Spooler\Performance WbemAdapFileSize REG_DWORD 146944 (0x23E00) < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\Spooler\Performance WbemAdapStatus REG_DWORD 0 (0x0) < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\sr Start REG_DWORD 0 (0x0) > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\sr Start REG_DWORD 4 (0x4) < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\sr ImagePath REG_EXPAND_SZ system32\DRIVERS\sr.sys > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\sr ImagePath REG_EXPAND_SZ \SystemRoot\system32\DRIVERS\sr.sys < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\sr\Parameters FirstRun REG_DWORD 0 (0x0) > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\sr\Parameters FirstRun REG_DWORD 1 (0x1) < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\TapiSrv\Performance WbemAdapFileSignature REG_BINARY 0483F001E58AF7EA90B23BA9ACB367D3 < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\TapiSrv\Performance WbemAdapFileTime REG_BINARY 0020E7D4F03DC601 < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\TapiSrv\Performance WbemAdapFileSize REG_DWORD 5632 (0x1600) < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\TapiSrv\Performance WbemAdapStatus REG_DWORD 0 (0x0) < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\Tcpip\Parameters DhcpNameServer REG_SZ 62.4.16.70 62.4.17.69 > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\Tcpip\Parameters DhcpNameServer REG_SZ 208.67.222.222 208.67.220.220 < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\Tcpip\Parameters\Interfaces\{6317C625-DA29-42BA-9ADD-C0C897993031} LeaseObtainedTime REG_DWORD 1204444334 (0x47CA5CAE) > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\Tcpip\Parameters\Interfaces\{6317C625-DA29-42BA-9ADD-C0C897993031} LeaseObtainedTime REG_DWORD 1225988025 (0x491317B9) < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\Tcpip\Parameters\Interfaces\{6317C625-DA29-42BA-9ADD-C0C897993031} T1 REG_DWORD 1204487534 (0x47CB056E) > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\Tcpip\Parameters\Interfaces\{6317C625-DA29-42BA-9ADD-C0C897993031} T1 REG_DWORD 1226031225 (0x4913C079) < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\Tcpip\Parameters\Interfaces\{6317C625-DA29-42BA-9ADD-C0C897993031} T2 REG_DWORD 1204519934 (0x47CB83FE) > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\Tcpip\Parameters\Interfaces\{6317C625-DA29-42BA-9ADD-C0C897993031} T2 REG_DWORD 1226063625 (0x49143F09) < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\Tcpip\Parameters\Interfaces\{6317C625-DA29-42BA-9ADD-C0C897993031} LeaseTerminatesTime REG_DWORD 1204530734 (0x47CBAE2E) > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\Tcpip\Parameters\Interfaces\{6317C625-DA29-42BA-9ADD-C0C897993031} LeaseTerminatesTime REG_DWORD 1226074425 (0x49146939) < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\Tcpip\Parameters\Interfaces\{6317C625-DA29-42BA-9ADD-C0C897993031} DhcpIPAddress REG_SZ 192.168.1.101 > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\Tcpip\Parameters\Interfaces\{6317C625-DA29-42BA-9ADD-C0C897993031} DhcpIPAddress REG_SZ 192.168.1.100 < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\Tcpip\Parameters\Interfaces\{6317C625-DA29-42BA-9ADD-C0C897993031} DhcpNameServer REG_SZ 62.4.16.70 62.4.17.69 > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\Tcpip\Parameters\Interfaces\{6317C625-DA29-42BA-9ADD-C0C897993031} DhcpNameServer REG_SZ 208.67.222.222 208.67.220.220 < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\WmiApRpl\Performance Last Counter REG_DWORD 4848 (0x12F0) > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\WmiApRpl\Performance Last Counter REG_DWORD 4856 (0x12F8) < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\WmiApRpl\Performance Last Help REG_DWORD 4849 (0x12F1) > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\WmiApRpl\Performance Last Help REG_DWORD 4857 (0x12F9) < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\WmiApRpl\Performance Object List REG_SZ 4844 4844 > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\WmiApRpl\Performance Object List REG_SZ 4844 4844 4850 4850 < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\wuauserv Start REG_DWORD 4 (0x4) > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\wuauserv Start REG_DWORD 2 (0x2) < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\{6317C625-DA29-42BA-9ADD-C0C897993031}\Parameters\Tcpip DhcpIPAddress REG_SZ 192.168.1.101 > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\{6317C625-DA29-42BA-9ADD-C0C897993031}\Parameters\Tcpip DhcpIPAddress REG_SZ 192.168.1.100 < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\{6317C625-DA29-42BA-9ADD-C0C897993031}\Parameters\Tcpip LeaseObtainedTime REG_DWORD 1204444334 (0x47CA5CAE) > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\{6317C625-DA29-42BA-9ADD-C0C897993031}\Parameters\Tcpip LeaseObtainedTime REG_DWORD 1225988025 (0x491317B9) < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\{6317C625-DA29-42BA-9ADD-C0C897993031}\Parameters\Tcpip T1 REG_DWORD 1204487534 (0x47CB056E) > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\{6317C625-DA29-42BA-9ADD-C0C897993031}\Parameters\Tcpip T1 REG_DWORD 1226031225 (0x4913C079) < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\{6317C625-DA29-42BA-9ADD-C0C897993031}\Parameters\Tcpip T2 REG_DWORD 1204519934 (0x47CB83FE) > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\{6317C625-DA29-42BA-9ADD-C0C897993031}\Parameters\Tcpip T2 REG_DWORD 1226063625 (0x49143F09) < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\{6317C625-DA29-42BA-9ADD-C0C897993031}\Parameters\Tcpip LeaseTerminatesTime REG_DWORD 1204530734 (0x47CBAE2E) > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\{6317C625-DA29-42BA-9ADD-C0C897993031}\Parameters\Tcpip LeaseTerminatesTime REG_DWORD 1226074425 (0x49146939) Result compared: Different -----Comparing registry keys CCS1 vs CCS3 ----- < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\aawservice > Value: HKEY_LOCAL_MACHINE\system\controlset003\services\aswTdi DisplayName REG_SZ avast! Network Shield Support > Value: HKEY_LOCAL_MACHINE\system\controlset003\services\aswTdi ErrorControl REG_DWORD 1 (0x1) > Value: HKEY_LOCAL_MACHINE\system\controlset003\services\aswTdi Type REG_DWORD 1 (0x1) > Value: HKEY_LOCAL_MACHINE\system\controlset003\services\aswTdi Group REG_SZ PNP_TDI > Value: HKEY_LOCAL_MACHINE\system\controlset003\services\aswTdi Start REG_DWORD 1 (0x1) > Value: HKEY_LOCAL_MACHINE\system\controlset003\services\aswTdi DependOnService REG_MULTI_SZ tcpip\0\0 > Value: HKEY_LOCAL_MACHINE\system\controlset003\services\aswTdi Tag REG_DWORD 9 (0x9) < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\aswTdi\Parameters ProviderStart REG_DWORD 3 (0x3) > Value: HKEY_LOCAL_MACHINE\system\controlset003\services\aswTdi\Parameters ProviderStart REG_DWORD 1 (0x1) < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\AVG Anti-Spyware Driver < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\AVG Anti-Spyware Guard < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\AvgAsCln < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\AVP < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\BITS Start REG_DWORD 3 (0x3) > Value: HKEY_LOCAL_MACHINE\system\controlset003\services\BITS Start REG_DWORD 2 (0x2) < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\Dhcp\Parameters {6317C625-DA29-42BA-9ADD-C0C897993031} REG_BINARY 1A0000000000000002000000000000002EAECB4705D40000060000000000000008000000000000002EAECB473E0410463E041145030000000000000004000000000000002EAECB47C0A801010F0000000000000005000000000000002EAECB476C6F63616C000000330000000000000004000000000000002EAECB4700015180010000000000000004000000000000002EAECB47FFFFFF00360000000000000004000000000000002EAECB47C0A80101350000000000000001000000000000002EAECB4705000000 > Value: HKEY_LOCAL_MACHINE\system\controlset003\services\Dhcp\Parameters {6317C625-DA29-42BA-9ADD-C0C897993031} REG_BINARY 1A000000000000000200000000000000F45F144905D4000006000000000000000800000000000000F45F1449D043DEDED043DCDC03000000000000000400000000000000F45F1449C0A801010F000000000000000500000000000000F45F14496C6F63616C00000033000000000000000400000000000000F45F14490001518001000000000000000400000000000000F45F1449FFFFFF0036000000000000000400000000000000F45F1449C0A8010135000000000000000100000000000000F45F144905000000 > Value: HKEY_LOCAL_MACHINE\system\controlset003\services\Eventlog\Security\DS > Value: HKEY_LOCAL_MACHINE\system\controlset003\services\Eventlog\Security\LSA > Value: HKEY_LOCAL_MACHINE\system\controlset003\services\Eventlog\Security\NetDDE Object > Value: HKEY_LOCAL_MACHINE\system\controlset003\services\Eventlog\Security\SC Manager > Value: HKEY_LOCAL_MACHINE\system\controlset003\services\Eventlog\Security\Security > Value: HKEY_LOCAL_MACHINE\system\controlset003\services\Eventlog\Security\Security Account Manager > Value: HKEY_LOCAL_MACHINE\system\controlset003\services\Eventlog\Security\Spooler < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\Eventlog\System Sources REG_MULTI_SZ WZCSVC\0Workstation\0WindowsMedia\0Windows Update Agent\0Windows Script Host\0Windows Installer 3.1\0Windows File Protection\0Win32k\0W32Time\0VolSnap\0viaide\0VgaSave\0USER32\0UPS\0ultra\0udfs\0toside\0TermServSessDir\0TermService\0TermServDevices\0TermDD\0tdi\0TCPMon\0Tcpip\0System Error\0sym_u3\0sym_hi\0symc8xx\0symc810\0StillImage\0SSDPSRV\0Srv\0srservice\0sr\0sparrow\0sndblst\0Simbad\0SideBySide\0sfloppy\0Setup\0Service de stockage amovible\0Service Control Manager\0Server\0serial\0scsiport\0Schedule\0Schannel\0SCardSvr\0Save Dump\0SAM\0RTL8023xp\0RSVP\0RemoteAccess\0redbook\0Rdbss\0RasMan\0RasAuto\0ql1280\0ql1240\0ql12160\0ql10wnt\0ql1080\0PSched\0Print\0PptpMiniport\0PolicyAgent\0PlugPlayManager\0perc2\0pcmcia\0pciide\0pci\0parvdm\0partmgr\0parport\0OSPFMib\0OSPF\0null\0NtServicePack\0ntfs\0npfs\0Nla\0NIC1394\0Netlogon\0NetDDE\0NetBT\0NetBIOS\0NdisWan\0NdisIP\0ndis\0Mup\0msfs\0msadlib\0MrxSmb\0MRxDAV\0mraid35x\0mouhid\0mouclass\0Modem\0LsaSrv\0LmHosts\0LDMS\0LDM\0lbrtfdc\0Kerberos\0kbdhid\0kbdclass\0isapnp\0irsir\0IPXSAP\0IPXRouterManager\0IPXRIP\0IPXCP\0IPSec\0IPRouterManager\0IPRIP2\0IPNATHLP\0IPMGM\0IPBOOTP\0intelppm\0intelide\0ini910u\0IGMPv2\0i8042prt\0i2omp\0i2omgmt\0Http\0hpn\0ftdisk\0fs_rec\0flpydisk\0Fips\0fdc\0fastfat\0eventlog\0efs\0dpti2o\0Dnscache\0Dnsapi\0dmio\0dmboot\0Distributed Link Tracking Client\0disk\0Dhcp\0DfsSvc\0DfsDriver\0DCOM\0dac960nt\0dac2w2k\0cpqarray\0cmdide\0changer\0cdrom\0Cdm\0cdfs\0cdaudio\0cd20xrnt\0cbidf2k\0Browser\0BITS\0beep\0Atmarpc\0ati2mtag\0Ati HotKey Poller\0atdisk\0atapi\0AsyncMac\0asc3550\0asc3350p\0asc\0Arp1394\0Application Popup\0apphelp\0amsint\0ami0nt\0aliide\0Alerter\0aic78xx\0aic78u2\0aha154x\0adpu160m\0acpiec\0acpi\0abp480n5\0abiosdsk\0System\0\0 > Value: HKEY_LOCAL_MACHINE\system\controlset003\services\Eventlog\System Sources REG_MULTI_SZ WZCSVC\0Workstation\0WindowsMedia\0Windows Update Agent\0Windows Script Host\0Windows Installer 3.1\0Windows File Protection\0Win32k\0W32Time\0VolSnap\0viaide\0VgaSave\0USER32\0UPS\0ultra\0udfs\0toside\0TermServSessDir\0TermService\0TermServDevices\0TermDD\0tdi\0TCPMon\0Tcpip\0System Error\0sym_u3\0sym_hi\0symc8xx\0symc810\0StillImage\0SSDPSRV\0Srv\0srservice\0sr\0sparrow\0sndblst\0Simbad\0SideBySide\0sfloppy\0Setup\0Service de stockage amovible\0Service Control Manager\0Server\0serial\0scsiport\0Schedule\0Schannel\0SCardSvr\0Save Dump\0SAM\0RTL8023xp\0RSVP\0RemoteAccess\0redbook\0Rdbss\0RasMan\0RasAuto\0ql1280\0ql1240\0ql12160\0ql10wnt\0ql1080\0PSched\0Print\0PptpMiniport\0PolicyAgent\0PlugPlayManager\0perc2\0pcmcia\0pciide\0pci\0parvdm\0partmgr\0parport\0OSPFMib\0OSPF\0null\0NtServicePack\0ntfs\0npfs\0Nla\0NIC1394\0Netlogon\0NetDDE\0NetBT\0NetBIOS\0NdisWan\0NdisIP\0ndis\0Mup\0msfs\0msadlib\0MrxSmb\0MRxDAV\0mraid35x\0mouhid\0mouclass\0Modem\0LsaSrv\0LmHosts\0LDMS\0LDM\0lbrtfdc\0Kerberos\0kbdhid\0kbdclass\0isapnp\0irsir\0IPXSAP\0IPXRouterManager\0IPXRIP\0IPXCP\0IPSec\0IPRouterManager\0IPRIP2\0IPNATHLP\0IPMGM\0IPBOOTP\0Internet Explorer 7 Disk\0intelppm\0intelide\0ini910u\0IGMPv2\0i8042prt\0i2omp\0i2omgmt\0Http\0hpn\0ftdisk\0fs_rec\0flpydisk\0Fips\0fdc\0fastfat\0eventlog\0efs\0dpti2o\0Dnscache\0Dnsapi\0dmio\0dmboot\0Distributed Link Tracking Client\0disk\0Dhcp\0DfsSvc\0DfsDriver\0DCOM\0dac960nt\0dac2w2k\0cpqarray\0cmdide\0changer\0cdrom\0Cdm\0cdfs\0cdaudio\0cd20xrnt\0cbidf2k\0Browser\0BITS\0beep\0Atmarpc\0ati2mtag\0Ati HotKey Poller\0atdisk\0atapi\0AsyncMac\0asc3550\0asc3350p\0asc\0Arp1394\0Application Popup\0apphelp\0amsint\0ami0nt\0aliide\0Alerter\0aic78xx\0aic78u2\0aha154x\0adpu160m\0acpiec\0acpi\0abp480n5\0abiosdsk\0System\0\0 < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\kl1 < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\klif < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\lanmanserver\parameters Guid REG_BINARY 5004971301681449958DAA43046B5866 > Value: HKEY_LOCAL_MACHINE\system\controlset003\services\lanmanserver\parameters Guid REG_BINARY 0C479EC6F0F996478B4B2AB36A79A4DE > Value: HKEY_LOCAL_MACHINE\system\controlset003\services\MRxDAV\EncryptedDirectories < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\PerfDisk\Performance WbemAdapFileSignature REG_BINARY 97F41DFEE99BC2AE60BAD78679FB40A1 < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\PerfDisk\Performance WbemAdapFileTime REG_BINARY 0020E7D4F03DC601 < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\PerfDisk\Performance WbemAdapFileSize REG_DWORD 27136 (0x6A00) < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\PerfDisk\Performance WbemAdapStatus REG_DWORD 0 (0x0) < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\PerfNet\Performance WbemAdapFileSignature REG_BINARY 7FD03F93453FAFBABB6E29B11E9E731C < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\PerfNet\Performance WbemAdapFileTime REG_BINARY 0020E7D4F03DC601 < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\PerfNet\Performance WbemAdapFileSize REG_DWORD 17408 (0x4400) < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\PerfNet\Performance WbemAdapStatus REG_DWORD 0 (0x0) < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\SharedAccess\Epoch Epoch REG_DWORD 8851 (0x2293) > Value: HKEY_LOCAL_MACHINE\system\controlset003\services\SharedAccess\Epoch Epoch REG_DWORD 9316 (0x2464) > Value: HKEY_LOCAL_MACHINE\system\controlset003\services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List %windir%\Network Diagnostic\xpnetdiag.exe REG_SZ %windir%\Network Diagnostic\xpnetdiag.exe:*:Enaxxxxx@xxxxxres.dll,-20000 > Value: HKEY_LOCAL_MACHINE\system\controlset003\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\kav\kis7.0\french\setup.exe REG_SZ C:\kav\kis7.0\french\setup.exe:*:Enabled:Programme d'installation de Kaspersky Internet Security 7.0 > Value: HKEY_LOCAL_MACHINE\system\controlset003\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\kav\kav7.0\french\setup.exe REG_SZ C:\kav\kav7.0\french\setup.exe:*:Enabled:Programme d'installation de Kaspersky Anti-Virus 7.0 > Value: HKEY_LOCAL_MACHINE\system\controlset003\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List %windir%\Network Diagnostic\xpnetdiag.exe REG_SZ %windir%\Network Diagnostic\xpnetdiag.exe:*:Enaxxxxx@xxxxxres.dll,-20000 < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\Spooler\Performance WbemAdapFileSignature REG_BINARY E415A3D071D315CD84F6F593A3A060B3 < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\Spooler\Performance WbemAdapFileTime REG_BINARY 0020E7D4F03DC601 < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\Spooler\Performance WbemAdapFileSize REG_DWORD 146944 (0x23E00) < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\Spooler\Performance WbemAdapStatus REG_DWORD 0 (0x0) < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\sr Start REG_DWORD 0 (0x0) > Value: HKEY_LOCAL_MACHINE\system\controlset003\services\sr Start REG_DWORD 4 (0x4) < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\sr ImagePath REG_EXPAND_SZ system32\DRIVERS\sr.sys > Value: HKEY_LOCAL_MACHINE\system\controlset003\services\sr ImagePath REG_EXPAND_SZ \SystemRoot\system32\DRIVERS\sr.sys < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\sr\Parameters FirstRun REG_DWORD 0 (0x0) > Value: HKEY_LOCAL_MACHINE\system\controlset003\services\sr\Parameters FirstRun REG_DWORD 1 (0x1) < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\TapiSrv\Performance WbemAdapFileSignature REG_BINARY 0483F001E58AF7EA90B23BA9ACB367D3 < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\TapiSrv\Performance WbemAdapFileTime REG_BINARY 0020E7D4F03DC601 < Value: HKEY_LOCAL_MACHINE\system\controlset001\se

Sophie · Answer

@="\"%1\" %*" -----HKEY_CLASSES_ROOT\comfile\shell\open\command----- [command] @="\"%1\" %*" -----HKEY_CLASSES_ROOT\batfile\shell\open\command----- [command] @="\"%1\" %*" -----HKEY_CLASSES_ROOT\piffile\shell\open\command----- [command] @="\"%1\" %*" -----HKEY_CLASSES_ROOT\scrFile\shell\open\command----- [command] @="\"%1\" %*" -----HKEY_CLASSES_ROOT\htafile\shell\open\command----- [Command] @="C:\WINDOWS\system32\mshta.exe \"%1\" %*" -----HKEY_CLASSES_ROOT\logfile\shell\open\command----- -----HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\URL----- [URL] [URL\DefaultPrefix] @="http://" [URL\Prefixes] "ftp"="ftp://" "gopher"="gopher://" "home"="http://" "mosaic"="http://" "www"="http://" -----HKLM\SYSTEM\CurrentControlSet\Control\Lsa----- [Lsa] [Lsa\AccessProviders] [Lsa\AccessProviders\Windows NT Access Provider] "ProviderPath"=expand:"%SystemRoot%\system32 tmarta.dll" [Lsa\Audit] [Lsa\Audit\PerUserAuditing] [Lsa\Audit\PerUserAuditing\System] [Lsa\Data] [Lsa\SSO] [Lsa\SSO\Passport1.4] "SSOURL"="http://www.passport.com" [Lsa\SspiCache] [Lsa\SspiCache\digest.dll] "Name"="Digest" "Comment"="Digest SSPI Authentication Package" [Lsa\SspiCache\msapsspc.dll] "Name"="DPA" "Comment"="DPA Security Package" [Lsa\SspiCache\msnsspc.dll] "Name"="MSN" "Comment"="MSN Security Package" -----HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess----- [SharedAccess] "DependOnGroup"=multi:"\00" "DependOnService"=multi:"Netman\00WinMgmt\00\00" "Description"="Assure la traduction d'adresses de réseau, l'adressage, les services de résolution de noms et/ou les services de prévention d'intrusion pour un réseau de petite entreprise ou un réseau domestique." "DisplayName"="Pare-feu Windows / Partage de connexion Internet" "ErrorControl"=dword:00000001 "ImagePath"=expand:"%SystemRoot%\system32\svchost.exe -k netsvcs" "ObjectName"="LocalSystem" "Start"=dword:00000002 "Type"=dword:00000020 [SharedAccess\Epoch] "Epoch"=dword:00002473 [SharedAccess\Parameters] "ServiceDll"=expand:"%SystemRoot%\System32\ipnathlp.dll" [SharedAccess\Parameters\FirewallPolicy] [SharedAccess\Parameters\FirewallPolicy\DomainProfile] [SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications] [SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List] "%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enaxxxxx@xxxxxres.dll,-22019" "C:\Program Files\MSN Messenger\msnmsgr.exe"="C:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1" "C:\Program Files\MSN Messenger\livecall.exe"="C:\Program Files\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)" "%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enaxxxxx@xxxxxres.dll,-20000" [SharedAccess\Parameters\FirewallPolicy\StandardProfile] "EnableFirewall"=dword:00000001 "DoNotAllowExceptions"=dword:00000000 [SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications] [SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] "%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enaxxxxx@xxxxxres.dll,-22019" "C:\Program Files\eMule\emule.exe"="C:\Program Files\eMule\emule.exe:*:Enabled:eMule" "C:\Program Files\MSN Messenger\msnmsgr.exe"="C:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1" "C:\Program Files\MSN Messenger\livecall.exe"="C:\Program Files\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)" "C:\Program Files\Resolume 2.41 esolume.exe"="C:\Program Files\Resolume 2.41 esolume.exe:*:Enabled:Resolume 2.41" "C:\Program Files\Messenger\msmsgs.exe"="C:\Program Files\Messenger\msmsgs.exe:*:Enabled:Windows Messenger" "C:\Documents and Settings\Propriétaire\Local Settings\Temp\Rar$EX02.937\emule.exe"="C:\Documents and Settings\Propriétaire\Local Settings\Temp\Rar$EX02.937\emule.exe:*:Disabled:eMule" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\0exinjs.aa.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\0exinjs.aa.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\22exinjs.aa.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\22exinjs.aa.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\23exinjs.aa.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\23exinjs.aa.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\83exinjs.aa.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\83exinjs.aa.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\86exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\86exinjs.ab.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\82exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\82exinjs.ab.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\42exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\42exinjs.ab.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\98exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\98exinjs.ab.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\36exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\36exinjs.ab.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\59exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\59exinjs.ab.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\49exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\49exinjs.ab.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\73exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\73exinjs.ab.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\75exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\75exinjs.ab.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\8exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\8exinjs.ab.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\47exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\47exinjs.ab.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\20exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\20exinjs.ab.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\78exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\78exinjs.ab.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\80exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\80exinjs.ab.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\74exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\74exinjs.ab.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\18exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\18exinjs.ab.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\64exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\64exinjs.ab.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\57exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\57exinjs.ab.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\92exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\92exinjs.ab.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\11exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\11exinjs.ab.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\50exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\50exinjs.ab.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\43exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\43exinjs.ab.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\95exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\95exinjs.ab.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\52exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\52exinjs.ab.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\23exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\23exinjs.ab.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\6exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\6exinjs.ab.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\39exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\39exinjs.ab.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\68exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\68exinjs.ab.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\61exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\61exinjs.ab.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\26exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\26exinjs.ab.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\34exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\34exinjs.ab.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\19exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\19exinjs.ab.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\32exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\32exinjs.ab.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\14exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\14exinjs.ab.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\60exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\60exinjs.ab.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\29exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\29exinjs.ab.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\66exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\66exinjs.ab.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\99exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\99exinjs.ab.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\54exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\54exinjs.ab.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\94exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\94exinjs.ab.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\85exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\85exinjs.ab.exe:*:Enabled:Microsoft Update" "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe"="C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe:*:Disabled:Kaspersky Anti-Virus" "C:\Program Files\uTorrent\uTorrent.exe"="C:\Program Files\uTorrent\uTorrent.exe:*:Enabled:µTorrent" "C:\Program Files\BitDownload\BitDownload.exe"="C:\Program Files\BitDownload\BitDownload.exe:*:Enabled:Torrent P2P application" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\16ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\16ex:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\25ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\25ex:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\35ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\35ex:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\43ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\43ex:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\58ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\58ex:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\26ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\26ex:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\87ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\87ex:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\60ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\60ex:*:Enabled:Microsoft Update" "C:\Program Files\Ahead\Nero ShowTime\ShowTime.exe"="C:\Program Files\Ahead\Nero ShowTime\ShowTime.exe:*:Enabled:Nero ShowTime" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\44ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\44ex:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\50ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\50ex:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\7ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\7ex:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\42ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\42ex:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\3ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\3ex:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\21ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\21ex:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\40ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\40ex:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\2ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\2ex:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\4ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\4ex:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\65ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\65ex:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\37ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\37ex:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\31ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\31ex:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\72ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\72ex:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\92ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\92ex:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\68ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\68ex:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\45ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\45ex:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\96ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\96ex:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\33ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\33ex:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\79ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\79ex:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\10ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\10ex:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\22ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\22ex:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\55ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\55ex:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\66ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\66ex:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\94ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\94ex:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\52ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\52ex:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\0ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\0ex:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\63ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\63ex:*:Enabled:Microsoft Update" "C:\Documents and Settings\Propriétaire\Local Settings\Temp\10exmdnk23.exe"="C:\Documents and Settings\Propriétaire\Local Settings\Temp\10exmdnk23.exe:*:Disabled:10exmdnk23" "C:\Documents and Settings\Propriétaire\Local Settings\Temp\33exmdnk25.exe"="C:\Documents and Settings\Propriétaire\Local Settings\Temp\33exmdnk25.exe:*:Disabled:33exmdnk25" "C:\Documents and Settings\Propriétaire\Local Settings\Temp\0exmdnk26.exe"="C:\Documents and Settings\Propriétaire\Local Settings\Temp\0exmdnk26.exe:*:Disabled:0exmdnk26" "C:\Documents and Settings\Propriétaire\Local Settings\Temp\58exmdnk30.exe"="C:\Documents and Settings\Propriétaire\Local Settings\Temp\58exmdnk30.exe:*:Disabled:58exmdnk30" "C:\kav\kis7.0\french\setup.exe"="C:\kav\kis7.0\french\setup.exe:*:Enabled:Programme d'installation de Kaspersky Internet Security 7.0" "C:\kav\kav7.0\french\setup.exe"="C:\kav\kav7.0\french\setup.exe:*:Enabled:Programme d'installation de Kaspersky Anti-Virus 7.0" "%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enaxxxxx@xxxxxres.dll,-20000" [SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts] [SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List] "1900:UDP"="1900:UDP:LocalSubNet:Disaxxxxx@xxxxxres.dll,-22007" "2869:TCP"="2869:TCP:LocalSubNet:Disaxxxxx@xxxxxres.dll,-22008" "17053:TCP"="17053:TCP:*:Enabled:NortonAV" "12192:TCP"="12192:TCP:*:Enabled:NortonAV" [SharedAccess\Setup] "ServiceUpgrade"=dword:00000001 [SharedAccess\Setup\InterfacesUnfirewalledAtUpdate] "All"=dword:00000001 -----HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Firewall\----- -----HKEY_LOCAL_MACHINE\SOFTWARE\Winsock2----- -----HKLM\Software\Microsoft\Ole----- [Ole] "DefaultLaunchPermission"=hex:01,00,04,80,5c,00,00,00,6c,00,00,00,00,00,00,00,\ "MachineLaunchRestriction"=hex:01,00,04,80,48,00,00,00,58,00,00,00,00,00,00,00,\ "MachineAccessRestriction"=hex:01,00,04,80,44,00,00,00,54,00,00,00,00,00,00,00,\ "EnableDCOM"="Y" [Ole\AppCompat] [Ole\AppCompat\ActivationSecurityCheckExemptionList] "{A50398B8-9075-4FBF-A7A1-456BF21937AD}"="1" "{AD65A69D-3831-40D7-9629-9B0B50A93843}"="1" "{0040D221-54A1-11D1-9DE0-006097042D69}"="1" "{2A6D72F1-6E7E-4702-B99C-E40D3DED33C3}"="1" [Ole\NONREDIST] "System.EnterpriseServices.Thunk.dll"="" -----HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WindowsUpdate\AU\----- -----HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\----- [Security Center] "FirstRunDisabled"=dword:00000001 "AntiVirusDisableNotify"=dword:00000000 "FirewallDisableNotify"=dword:00000000 "UpdatesDisableNotify"=dword:00000000 "AntiVirusOverride"=dword:00000001 "FirewallOverride"=dword:00000000 [Security Center\Monitoring] [Security Center\Monitoring\AhnlabAntiVirus] [Security Center\Monitoring\ComputerAssociatesAntiVirus] [Security Center\Monitoring\KasperskyAntiVirus] [Security Center\Monitoring\McAfeeAntiVirus] [Security Center\Monitoring\McAfeeFirewall] [Security Center\Monitoring\PandaAntiVirus] [Security Center\Monitoring\PandaFirewall] [Security Center\Monitoring\SophosAntiVirus] [Security Center\Monitoring\SymantecAntiVirus] [Security Center\Monitoring\SymantecFirewall] [Security Center\Monitoring\TinyFirewall] [Security Center\Monitoring\TrendAntiVirus] [Security Center\Monitoring\TrendFirewall] [Security Center\Monitoring\ZoneLabsFirewall] -----HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore\----- [SystemRestore] "DisableSR"=dword:00000000 "CreateFirstRunRp"=dword:00000001 "DSMin"=dword:000000c8 "DSMax"=dword:00000190 "RPSessionInterval"=dword:00000000 "RPGlobalInterval"=dword:00015180 "RPLifeInterval"=dword:0076a700 "CompressionBurst"=dword:0000003c "TimerInterval"=dword:00000078 "DiskPercent"=dword:0000000c "ThawInterval"=dword:00000384 "RestoreDiskSpaceError"=dword:00000000 "RestoreStatus"=dword:00000000 "RestoreSafeModeStatus"=dword:00000001 [SystemRestore\Cfg] "DiskPercent"=dword:0000000c "MachineGuid"="{D88DDE61-D342-465C-AFF5-295FBD9AB56F}" [SystemRestore\SnapshotCallbacks] @="" -----HKEY_CURRENT_USER\Software\VB and VBA Program Settings----- [VB and VBA Program Settings] [VB and VBA Program Settings\CCleaner] [VB and VBA Program Settings\CCleaner\Options] -----HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\----- -----HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\AdvancedOptions----- [AdvancedOptions] -----HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\AdvancedOptions----- -----HKLM\Software\Microsoft\Active Setup\Installed Components----- [Installed Components] [Installed Components\<{12d0ed0d-0ee0-4f90-8827-78cefb8f4988}] "@="IE7 Uninstall Stub" "ComponentID"="IEUDINIT" "StubPath"="C:\WINDOWS\system32\ieudinit.exe" [Installed Components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}] #### HKCR\CLSID\{22d6f312-b0f6-11d0-94ab-0080c74c7e95}\InprocServer32 @="C:\WINDOWS\system32\wmpdxm.dll" "Stubpath"="C:\WINDOWS\inf\unregmp2.exe /ShowWMP" "@="Microsoft Windows Media Player" "ComponentID"="WMPACCESS" [Installed Components\>{26923b43-4d38-484f-9b9e-de460746276c}] "@="Internet Explorer" "ComponentID"="IEACCESS" "StubPath"="C:\WINDOWS\system32\ie4uinit.exe -UserIconConfig" [Installed Components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}] "@="Browser Customizations" "ComponentiD"="BRANDING.CAB" "StubPath"="RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP" [Installed Components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS] "@="Personnalisation du navigateur" "ComponentID"="BRANDING.CAB" "StubPath"="RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP" [Installed Components\>{881dd1c5-3dcf-431b-b061-f3f88e8be88a}] "@="Outlook Express" "ComponentID"="OEACCESS" "StubPath"=expand:"%systemroot%\system32\shmgrate.exe OCInstallUserConfigOE" [Installed Components\{0E92DD42-76F5-4EF2-B381-F9C1D72BE23D}] "@="Security Update for Microsoft .NET Framework 2.0 (KB922770)" "ComponentID"="KB922770" [Installed Components\{10072CEC-8CC1-11D1-986E-00A0C955B42F}] "@="Rendu VML (Vector Graphics Rendering)" "ComponentID"="MSVML" [Installed Components\{2179C5D3-EBFF-11CF-B6FD-00AA00B4E220}] #### HKCR\CLSID\{2179C5D3-EBFF-11CF-B6FD-00AA00B4E220}\InprocServer32 @="C:\WINDOWS\system32\wmpdxm.dll" "ComponentID"="NetShow" "StubPath"="" [Installed Components\{22d6f312-b0f6-11d0-94ab-0080c74c7e95}] #### HKCR\CLSID\{22d6f312-b0f6-11d0-94ab-0080c74c7e95}\InprocServer32 @="C:\WINDOWS\system32\wmpdxm.dll" "ComponentID"="Microsoft Windows Media Player" "StubPath"="" "@="Lecteur Windows Media Microsoft 6.4" [Installed Components\{283807B5-2C60-11D0-A31D-00AA00B92C03}] "@="DirectAnimation" "ComponentID"="DirectAnimation" [Installed Components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}] "@="Themes Setup" "ComponentID"="Theme Component" "StubPath"=expand:"%SystemRoot%\system32 egsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32 hemeui.dll" [Installed Components\{36f8ec70-c29a-11d1-b5c7-0000f8051515}] "@="Liaison de données Dynamic HTML pour Java" "ComponentID"="TridataJava" [Installed Components\{3919E8B8-A291-74E5-5DBF-8FB615E8FCED}] "@="Themes Setup" "ComponentID"="Theme Component" [Installed Components\{3af36230-a269-11d1-b5bf-0000f8051515}] "@="Offline Browsing Pack" "ComponentID"="MobilePk" [Installed Components\{3bf42070-b3b1-11d1-b5c5-0000f8051515}] "@="Uniscribe" "ComponentID"="USP10" [Installed Components\{411EDCF7-755D-414E-A74B-3DCD6583F589}] "ComponentID"="S867460" "@="Microsoft .NET Framework 1.1 Service Pack 1 (KB867460)" [Installed Components\{4278c270-a269-11d1-b5bf-0000f8051515}] "@="Création avancée" "ComponentID"="AdvAuth" [Installed Components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}] "@="Microsoft Outlook Express 6" "ComponentID"="MailNews" "StubPath"=expand:"\"%ProgramFiles%\Outlook Express\setup50.exe\" /APP:OE /CALLER:WINNT /user /install" [Installed Components\{44BBA842-CC51-11CF-AAFA-00AA00B6015B}] "@="NetMeeting 3.01" "ComponentID"="NetMeeting" "StubPath"="rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT" [Installed Components\{44BBA848-CC51-11CF-AAFA-00AA00B6015C}] "@="DirectShow" "ComponentID"="activemovie" [Installed Components\{44BBA855-CC51-11CF-AAFA-00AA00B6015F}] "@="DirectDrawEx" "ComponentID"="DirectDrawEx" [Installed Components\{45ea75a0-a269-11d1-b5bf-0000f8051515}] "@="Internet Explorer Help" "ComponentID"="HelpCont" [Installed Components\{4f216970-c90c-11d1-b5c7-0000f8051515}] "@="Classes Java DirectAnimation" "ComponentID"="DAJava" [Installed Components\{4f645220-306d-11d2-995d-00c04f98bbc9}] "@="Microsoft Windows Script 5.6" "ComponentID"="MSVBScript" [Installed Components\{5945c046-1e7d-11d1-bc44-00c04fd912be}] "KeyFileName"="C:\Program Files\Messenger\msmsgs.exe" "@="Windows Messenger 4.7" "ComponentID"="Messenger" "StubPath"="rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser" [Installed Components\{5A8D6EE0-3E18-11D0-821E-444553540000}] "(Default)"="Internet Connection Wizard" "ComponentID"="ICW" [Installed Components\{5fd399c0-a70a-11d1-9948-00c04f98bbc9}] "@="Internet Explorer Setup Tools" "ComponentID"="GenSetup" [Installed Components\{630b1da0-b465-11d1-9948-00c04f98bbc9}] "@="Browsing Enhancements" "ComponentID"="ExtraPack" "KeyFileName"="C:\WINDOWS\system32\msieftp.dll" [Installed Components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}] #### HKCR\CLSID\{6BF52A52-394A-11d3-B153-00C04F79FAA6}\InprocServer32 @="C:\WINDOWS\system32\wmp.dll" "@="Microsoft Windows Media Player" "ComponentID"="Microsoft Windows Media Player" "StubPath"="rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\wmp.inf,PerUserStub" [Installed Components\{6fab99d0-bab8-11d1-994a-00c04f98bbc9}] "@="MSN Site Access" "ComponentID"="MSN_Auth" [Installed Components\{7131646D-CD3C-40F4-97B9-CD9E4E6262EF}] "ComponentID"=".NETFramework" "@=".NET Framework" [Installed Components\{7790769C-0471-11d2-AF11-00C04FA35D02}] "@="Carnet d'adresses 6" "ComponentID"="WAB" "StubPath"=expand:"\"%ProgramFiles%\Outlook Express\setup50.exe\" /APP:WAB /CALLER:WINNT /user /install" [Installed Components\{8056AC9E-49C5-4375-9ADE-B2F862C9DF51}] "ComponentID"="KB928365" "@="Security Update for Microsoft .NET Framework 2.0 (KB928365)" [Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4340}] "@="Mise à jour du Bureau Windows" "ComponentID"="IE4Shell_NT" "StubPath"=expand:"regsvr32.exe /s /n /i:U shell32.dll" [Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4383}] "@="Internet Explorer" "ComponentID"="BASEIE40_W2K" "StubPath"="C:\WINDOWS\system32\ie4uinit.exe -BaseSettings" [Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4383}\AuthorizedCDFPrefix] [Installed Components\{89B4C1CD-B018-4511-B0A1-5476DBF70820}] "StubPath"="C:\WINDOWS\system32\Rundll32.exe C:\WINDOWS\system32\mscories.dll,Install" "ComponentID"="DOTNETFRAMEWORKS" [Installed Components\{8D1D0E9A-C799-4D28-9E29-0061D1E66E43}] "ComponentID"="M928366" "@="Microsoft .NET Framework 1.1 Hotfix (KB928366)" [Installed Components\{9381D8F2-0288-11D0-9501-00AA00B911A5}] "@="Dynamic HTML Data Binding" "ComponentID"="Tridata" [Installed Components\{967B098A-042D-4367-BAC9-8BC11684174F}] "@="Security Update for Microsoft .NET Framework 2.0 (KB917283)" "ComponentID"="KB917283" [Installed Components\{ACC563BC-4266-43f0-B6ED-9D38C4202C7E}] [Installed Components\{C9E9A340-D1F1-11D0-821E-444553540600}] "@="Internet Explorer Core Fonts" "ComponentID"="Fontcore" [Installed Components\{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}] "ComponentID"=".NETFramework" "@=".NET Framework" [Installed Components\{CC2A9BA0-3BDD-11D0-821E-444553540000}] "@="Planificateur de tâches" "ComponentID"="MSTASK" [Installed Components\{CDD7975E-60F8-41d5-8149-19E51D6F71D0}] "ComponentID"="Windows Movie Maker v2.1" [Installed Components\{D27CDB6E-AE6D-11cf-96B8-444553540000}] "@="Adobe Flash Player" "ComponentID"="Flash" [Installed Components\{de5aed00-a4bf-11d1-9948-00c04f98bbc9}] "@="HTML Help" "ComponentID"="HTMLHelp" [Installed Components\{E92B03AB-B707-11d2-9CBD-0000F87A369E}] "@="Active Directory Service Interface" "ComponentID"="ADSI" -----Comparing registry keys CCS1 vs CCS2 ----- < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\aawservice > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\aswTdi DisplayName REG_SZ avast! Network Shield Support > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\aswTdi ErrorControl REG_DWORD 1 (0x1) > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\aswTdi Type REG_DWORD 1 (0x1) > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\aswTdi Group REG_SZ PNP_TDI > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\aswTdi Start REG_DWORD 1 (0x1) > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\aswTdi DependOnService REG_MULTI_SZ tcpip\0\0 > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\aswTdi Tag REG_DWORD 9 (0x9) < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\aswTdi\Parameters ProviderStart REG_DWORD 3 (0x3) > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\aswTdi\Parameters ProviderStart REG_DWORD 1 (0x1) < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\AVG Anti-Spyware Driver < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\AVG Anti-Spyware Guard < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\AvgAsCln < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\AVP < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\BITS Start REG_DWORD 3 (0x3) > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\BITS Start REG_DWORD 2 (0x2) < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\Dhcp\Parameters {6317C625-DA29-42BA-9ADD-C0C897993031} REG_BINARY 1A0000000000000002000000000000002EAECB4705D40000060000000000000008000000000000002EAECB473E0410463E041145030000000000000004000000000000002EAECB47C0A801010F0000000000000005000000000000002EAECB476C6F63616C000000330000000000000004000000000000002EAECB4700015180010000000000000004000000000000002EAECB47FFFFFF00360000000000000004000000000000002EAECB47C0A80101350000000000000001000000000000002EAECB4705000000 > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\Dhcp\Parameters {6317C625-DA29-42BA-9ADD-C0C897993031} REG_BINARY FC000000000000000000000000000000BF1D13491A0000000000000002000000000000003969144905D400000600000000000000080000000000000039691449D043DEDED043DCDC0300000000000000040000000000000039691449C0A801010F000000000000000500000000000000396914496C6F63616C0000003300000000000000040000000000000039691449000151800100000000000000040000000000000039691449FFFFFF003600000000000000040000000000000039691449C0A80101350000000000000001000000000000003969144905000000 < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\Eventlog\Application\ESENT EventMessageFile REG_EXPAND_SZ c:\windows\system32\ESENT.dll > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\Eventlog\Application\ESENT EventMessageFile REG_EXPAND_SZ C:\WINDOWS\system32\ESENT.dll < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\Eventlog\Application\ESENT CategoryMessageFile REG_EXPAND_SZ c:\windows\system32\ESENT.dll > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\Eventlog\Application\ESENT CategoryMessageFile REG_EXPAND_SZ C:\WINDOWS\system32\ESENT.dll > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\Eventlog\Security\DS > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\Eventlog\Security\LSA > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\Eventlog\Security\NetDDE Object > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\Eventlog\Security\SC Manager > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\Eventlog\Security\Security > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\Eventlog\Security\Security Account Manager > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\Eventlog\Security\Spooler < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\Eventlog\System Sources REG_MULTI_SZ WZCSVC\0Workstation\0WindowsMedia\0Windows Update Agent\0Windows Script Host\0Windows Installer 3.1\0Windows File Protection\0Win32k\0W32Time\0VolSnap\0viaide\0VgaSave\0USER32\0UPS\0ultra\0udfs\0toside\0TermServSessDir\0TermService\0TermServDevices\0TermDD\0tdi\0TCPMon\0Tcpip\0System Error\0sym_u3\0sym_hi\0symc8xx\0symc810\0StillImage\0SSDPSRV\0Srv\0srservice\0sr\0sparrow\0sndblst\0Simbad\0SideBySide\0sfloppy\0Setup\0Service de stockage amovible\0Service Control Manager\0Server\0serial\0scsiport\0Schedule\0Schannel\0SCardSvr\0Save Dump\0SAM\0RTL8023xp\0RSVP\0RemoteAccess\0redbook\0Rdbss\0RasMan\0RasAuto\0ql1280\0ql1240\0ql12160\0ql10wnt\0ql1080\0PSched\0Print\0PptpMiniport\0PolicyAgent\0PlugPlayManager\0perc2\0pcmcia\0pciide\0pci\0parvdm\0partmgr\0parport\0OSPFMib\0OSPF\0null\0NtServicePack\0ntfs\0npfs\0Nla\0NIC1394\0Netlogon\0NetDDE\0NetBT\0NetBIOS\0NdisWan\0NdisIP\0ndis\0Mup\0msfs\0msadlib\0MrxSmb\0MRxDAV\0mraid35x\0mouhid\0mouclass\0Modem\0LsaSrv\0LmHosts\0LDMS\0LDM\0lbrtfdc\0Kerberos\0kbdhid\0kbdclass\0isapnp\0irsir\0IPXSAP\0IPXRouterManager\0IPXRIP\0IPXCP\0IPSec\0IPRouterManager\0IPRIP2\0IPNATHLP\0IPMGM\0IPBOOTP\0intelppm\0intelide\0ini910u\0IGMPv2\0i8042prt\0i2omp\0i2omgmt\0Http\0hpn\0ftdisk\0fs_rec\0flpydisk\0Fips\0fdc\0fastfat\0eventlog\0efs\0dpti2o\0Dnscache\0Dnsapi\0dmio\0dmboot\0Distributed Link Tracking Client\0disk\0Dhcp\0DfsSvc\0DfsDriver\0DCOM\0dac960nt\0dac2w2k\0cpqarray\0cmdide\0changer\0cdrom\0Cdm\0cdfs\0cdaudio\0cd20xrnt\0cbidf2k\0Browser\0BITS\0beep\0Atmarpc\0ati2mtag\0Ati HotKey Poller\0atdisk\0atapi\0AsyncMac\0asc3550\0asc3350p\0asc\0Arp1394\0Application Popup\0apphelp\0amsint\0ami0nt\0aliide\0Alerter\0aic78xx\0aic78u2\0aha154x\0adpu160m\0acpiec\0acpi\0abp480n5\0abiosdsk\0System\0\0 > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\Eventlog\System Sources REG_MULTI_SZ WZCSVC\0Workstation\0WindowsMedia\0Windows Update Agent\0Windows Script Host\0Windows Installer 3.1\0Windows File Protection\0Win32k\0W32Time\0VolSnap\0viaide\0VgaSave\0USER32\0UPS\0ultra\0udfs\0toside\0TermServSessDir\0TermService\0TermServDevices\0TermDD\0tdi\0TCPMon\0Tcpip\0System Error\0sym_u3\0sym_hi\0symc8xx\0symc810\0StillImage\0SSDPSRV\0Srv\0srservice\0sr\0sparrow\0sndblst\0Simbad\0SideBySide\0sfloppy\0Setup\0Service de stockage amovible\0Service Control Manager\0Server\0serial\0scsiport\0Schedule\0Schannel\0SCardSvr\0Save Dump\0SAM\0RTL8023xp\0RSVP\0RemoteAccess\0redbook\0Rdbss\0RasMan\0RasAuto\0ql1280\0ql1240\0ql12160\0ql10wnt\0ql1080\0PSched\0Print\0PptpMiniport\0PolicyAgent\0PlugPlayManager\0perc2\0pcmcia\0pciide\0pci\0parvdm\0partmgr\0parport\0OSPFMib\0OSPF\0null\0NtServicePack\0ntfs\0npfs\0Nla\0NIC1394\0Netlogon\0NetDDE\0NetBT\0NetBIOS\0NdisWan\0NdisIP\0ndis\0Mup\0msfs\0msadlib\0MrxSmb\0MRxDAV\0mraid35x\0mouhid\0mouclass\0Modem\0LsaSrv\0LmHosts\0LDMS\0LDM\0lbrtfdc\0Kerberos\0kbdhid\0kbdclass\0isapnp\0irsir\0IPXSAP\0IPXRouterManager\0IPXRIP\0IPXCP\0IPSec\0IPRouterManager\0IPRIP2\0IPNATHLP\0IPMGM\0IPBOOTP\0Internet Explorer 7 Disk\0intelppm\0intelide\0ini910u\0IGMPv2\0i8042prt\0i2omp\0i2omgmt\0Http\0hpn\0ftdisk\0fs_rec\0flpydisk\0Fips\0fdc\0fastfat\0eventlog\0efs\0dpti2o\0Dnscache\0Dnsapi\0dmio\0dmboot\0Distributed Link Tracking Client\0disk\0Dhcp\0DfsSvc\0DfsDriver\0DCOM\0dac960nt\0dac2w2k\0cpqarray\0cmdide\0changer\0cdrom\0Cdm\0cdfs\0cdaudio\0cd20xrnt\0cbidf2k\0Browser\0BITS\0beep\0Atmarpc\0ati2mtag\0Ati HotKey Poller\0atdisk\0atapi\0AsyncMac\0asc3550\0asc3350p\0asc\0Arp1394\0Application Popup\0apphelp\0amsint\0ami0nt\0aliide\0Alerter\0aic78xx\0aic78u2\0aha154x\0adpu160m\0acpiec\0acpi\0abp480n5\0abiosdsk\0System\0\0 < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\kl1 < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\klif < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\lanmanserver\parameters Guid REG_BINARY 5004971301681449958DAA43046B5866 > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\lanmanserver\parameters Guid REG_BINARY 0C479EC6F0F996478B4B2AB36A79A4DE > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\MRxDAV\EncryptedDirectories < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\PerfDisk\Performance WbemAdapFileSignature REG_BINARY 97F41DFEE99BC2AE60BAD78679FB40A1 < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\PerfDisk\Performance WbemAdapFileTime REG_BINARY 0020E7D4F03DC601 < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\PerfDisk\Performance WbemAdapFileSize REG_DWORD 27136 (0x6A00) < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\PerfDisk\Performance WbemAdapStatus REG_DWORD 0 (0x0) < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\PerfNet\Performance WbemAdapFileSignature REG_BINARY 7FD03F93453FAFBABB6E29B11E9E731C < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\PerfNet\Performance WbemAdapFileTime REG_BINARY 0020E7D4F03DC601 < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\PerfNet\Performance WbemAdapFileSize REG_DWORD 17408 (0x4400) < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\PerfNet\Performance WbemAdapStatus REG_DWORD 0 (0x0) < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\SharedAccess\Epoch Epoch REG_DWORD 8851 (0x2293) > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\SharedAccess\Epoch Epoch REG_DWORD 9331 (0x2473) > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List %windir%\Network Diagnostic\xpnetdiag.exe REG_SZ %windir%\Network Diagnostic\xpnetdiag.exe:*:Enaxxxxx@xxxxxres.dll,-20000 > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\kav\kis7.0\french\setup.exe REG_SZ C:\kav\kis7.0\french\setup.exe:*:Enabled:Programme d'installation de Kaspersky Internet Security 7.0 > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\kav\kav7.0\french\setup.exe REG_SZ C:\kav\kav7.0\french\setup.exe:*:Enabled:Programme d'installation de Kaspersky Anti-Virus 7.0 > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List %windir%\Network Diagnostic\xpnetdiag.exe REG_SZ %windir%\Network Diagnostic\xpnetdiag.exe:*:Enaxxxxx@xxxxxres.dll,-20000 < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\Spooler\Performance WbemAdapFileSignature REG_BINARY E415A3D071D315CD84F6F593A3A060B3 < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\Spooler\Performance WbemAdapFileTime REG_BINARY 0020E7D4F03DC601 < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\Spooler\Performance WbemAdapFileSize REG_DWORD 146944 (0x23E00) < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\Spooler\Performance WbemAdapStatus REG_DWORD 0 (0x0) < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\sr Start REG_DWORD 0 (0x0) > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\sr Start REG_DWORD 4 (0x4) < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\sr ImagePath REG_EXPAND_SZ system32\DRIVERS\sr.sys > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\sr ImagePath REG_EXPAND_SZ \SystemRoot\system32\DRIVERS\sr.sys < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\sr\Parameters FirstRun REG_DWORD 0 (0x0) > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\sr\Parameters FirstRun REG_DWORD 1 (0x1) < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\TapiSrv\Performance WbemAdapFileSignature REG_BINARY 0483F001E58AF7EA90B23BA9ACB367D3 < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\TapiSrv\Performance WbemAdapFileTime REG_BINARY 0020E7D4F03DC601 < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\TapiSrv\Performance WbemAdapFileSize REG_DWORD 5632 (0x1600) < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\TapiSrv\Performance WbemAdapStatus REG_DWORD 0 (0x0) < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\Tcpip\Parameters DhcpNameServer REG_SZ 62.4.16.70 62.4.17.69 > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\Tcpip\Parameters DhcpNameServer REG_SZ 208.67.222.222 208.67.220.220 < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\Tcpip\Parameters\Interfaces\{6317C625-DA29-42BA-9ADD-C0C897993031} LeaseObtainedTime REG_DWORD 1204444334 (0x47CA5CAE) > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\Tcpip\Parameters\Interfaces\{6317C625-DA29-42BA-9ADD-C0C897993031} LeaseObtainedTime REG_DWORD 1225988025 (0x491317B9) < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\Tcpip\Parameters\Interfaces\{6317C625-DA29-42BA-9ADD-C0C897993031} T1 REG_DWORD 1204487534 (0x47CB056E) > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\Tcpip\Parameters\Interfaces\{6317C625-DA29-42BA-9ADD-C0C897993031} T1 REG_DWORD 1226031225 (0x4913C079) < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\Tcpip\Parameters\Interfaces\{6317C625-DA29-42BA-9ADD-C0C897993031} T2 REG_DWORD 1204519934 (0x47CB83FE) > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\Tcpip\Parameters\Interfaces\{6317C625-DA29-42BA-9ADD-C0C897993031} T2 REG_DWORD 1226063625 (0x49143F09) < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\Tcpip\Parameters\Interfaces\{6317C625-DA29-42BA-9ADD-C0C897993031} LeaseTerminatesTime REG_DWORD 1204530734 (0x47CBAE2E) > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\Tcpip\Parameters\Interfaces\{6317C625-DA29-42BA-9ADD-C0C897993031} LeaseTerminatesTime REG_DWORD 1226074425 (0x49146939) < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\Tcpip\Parameters\Interfaces\{6317C625-DA29-42BA-9ADD-C0C897993031} DhcpIPAddress REG_SZ 192.168.1.101 > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\Tcpip\Parameters\Interfaces\{6317C625-DA29-42BA-9ADD-C0C897993031} DhcpIPAddress REG_SZ 192.168.1.100 < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\Tcpip\Parameters\Interfaces\{6317C625-DA29-42BA-9ADD-C0C897993031} DhcpNameServer REG_SZ 62.4.16.70 62.4.17.69 > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\Tcpip\Parameters\Interfaces\{6317C625-DA29-42BA-9ADD-C0C897993031} DhcpNameServer REG_SZ 208.67.222.222 208.67.220.220 < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\WmiApRpl\Performance Last Counter REG_DWORD 4848 (0x12F0) > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\WmiApRpl\Performance Last Counter REG_DWORD 4856 (0x12F8) < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\WmiApRpl\Performance Last Help REG_DWORD 4849 (0x12F1) > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\WmiApRpl\Performance Last Help REG_DWORD 4857 (0x12F9) < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\WmiApRpl\Performance Object List REG_SZ 4844 4844 > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\WmiApRpl\Performance Object List REG_SZ 4844 4844 4850 4850 < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\wuauserv Start REG_DWORD 4 (0x4) > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\wuauserv Start REG_DWORD 2 (0x2) < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\{6317C625-DA29-42BA-9ADD-C0C897993031}\Parameters\Tcpip DhcpIPAddress REG_SZ 192.168.1.101 > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\{6317C625-DA29-42BA-9ADD-C0C897993031}\Parameters\Tcpip DhcpIPAddress REG_SZ 192.168.1.100 < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\{6317C625-DA29-42BA-9ADD-C0C897993031}\Parameters\Tcpip LeaseObtainedTime REG_DWORD 1204444334 (0x47CA5CAE) > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\{6317C625-DA29-42BA-9ADD-C0C897993031}\Parameters\Tcpip LeaseObtainedTime REG_DWORD 1225988025 (0x491317B9) < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\{6317C625-DA29-42BA-9ADD-C0C897993031}\Parameters\Tcpip T1 REG_DWORD 1204487534 (0x47CB056E) > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\{6317C625-DA29-42BA-9ADD-C0C897993031}\Parameters\Tcpip T1 REG_DWORD 1226031225 (0x4913C079) < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\{6317C625-DA29-42BA-9ADD-C0C897993031}\Parameters\Tcpip T2 REG_DWORD 1204519934 (0x47CB83FE) > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\{6317C625-DA29-42BA-9ADD-C0C897993031}\Parameters\Tcpip T2 REG_DWORD 1226063625 (0x49143F09) < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\{6317C625-DA29-42BA-9ADD-C0C897993031}\Parameters\Tcpip LeaseTerminatesTime REG_DWORD 1204530734 (0x47CBAE2E) > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\{6317C625-DA29-42BA-9ADD-C0C897993031}\Parameters\Tcpip LeaseTerminatesTime REG_DWORD 1226074425 (0x49146939) Result compared: Different -----Comparing registry keys CCS1 vs CCS3 ----- < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\aawservice > Value: HKEY_LOCAL_MACHINE\system\controlset003\services\aswTdi DisplayName REG_SZ avast! Network Shield Support > Value: HKEY_LOCAL_MACHINE\system\controlset003\services\aswTdi ErrorControl REG_DWORD 1 (0x1) > Value: HKEY_LOCAL_MACHINE\system\controlset003\services\aswTdi Type REG_DWORD 1 (0x1) > Value: HKEY_LOCAL_MACHINE\system\controlset003\services\aswTdi Group REG_SZ PNP_TDI > Value: HKEY_LOCAL_MACHINE\system\controlset003\services\aswTdi Start REG_DWORD 1 (0x1) > Value: HKEY_LOCAL_MACHINE\system\controlset003\services\aswTdi DependOnService REG_MULTI_SZ tcpip\0\0 > Value: HKEY_LOCAL_MACHINE\system\controlset003\services\aswTdi Tag REG_DWORD 9 (0x9) < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\aswTdi\Parameters ProviderStart REG_DWORD 3 (0x3) > Value: HKEY_LOCAL_MACHINE\system\controlset003\services\aswTdi\Parameters ProviderStart REG_DWORD 1 (0x1) < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\AVG Anti-Spyware Driver < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\AVG Anti-Spyware Guard < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\AvgAsCln < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\AVP < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\BITS Start REG_DWORD 3 (0x3) > Value: HKEY_LOCAL_MACHINE\system\controlset003\services\BITS Start REG_DWORD 2 (0x2) < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\Dhcp\Parameters {6317C625-DA29-42BA-9ADD-C0C897993031} REG_BINARY 1A0000000000000002000000000000002EAECB4705D40000060000000000000008000000000000002EAECB473E0410463E041145030000000000000004000000000000002EAECB47C0A801010F0000000000000005000000000000002EAECB476C6F63616C000000330000000000000004000000000000002EAECB4700015180010000000000000004000000000000002EAECB47FFFFFF00360000000000000004000000000000002EAECB47C0A80101350000000000000001000000000000002EAECB4705000000 > Value: HKEY_LOCAL_MACHINE\system\controlset003\services\Dhcp\Parameters {6317C625-DA29-42BA-9ADD-C0C897993031} REG_BINARY 1A000000000000000200000000000000F45F144905D4000006000000000000000800000000000000F45F1449D043DEDED043DCDC03000000000000000400000000000000F45F1449C0A801010F000000000000000500000000000000F45F14496C6F63616C00000033000000000000000400000000000000F45F14490001518001000000000000000400000000000000F45F1449FFFFFF0036000000000000000400000000000000F45F1449C0A8010135000000000000000100000000000000F45F144905000000 > Value: HKEY_LOCAL_MACHINE\system\controlset003\services\Eventlog\Security\DS > Value: HKEY_LOCAL_MACHINE\system\controlset003\services\Eventlog\Security\LSA > Value: HKEY_LOCAL_MACHINE\system\controlset003\services\Eventlog\Security\NetDDE Object > Value: HKEY_LOCAL_MACHINE\system\controlset003\services\Eventlog\Security\SC Manager > Value: HKEY_LOCAL_MACHINE\system\controlset003\services\Eventlog\Security\Security > Value: HKEY_LOCAL_MACHINE\system\controlset003\services\Eventlog\Security\Security Account Manager > Value: HKEY_LOCAL_MACHINE\system\controlset003\services\Eventlog\Security\Spooler < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\Eventlog\System Sources REG_MULTI_SZ WZCSVC\0Workstation\0WindowsMedia\0Windows Update Agent\0Windows Script Host\0Windows Installer 3.1\0Windows File Protection\0Win32k\0W32Time\0VolSnap\0viaide\0VgaSave\0USER32\0UPS\0ultra\0udfs\0toside\0TermServSessDir\0TermService\0TermServDevices\0TermDD\0tdi\0TCPMon\0Tcpip\0System Error\0sym_u3\0sym_hi\0symc8xx\0symc810\0StillImage\0SSDPSRV\0Srv\0srservice\0sr\0sparrow\0sndblst\0Simbad\0SideBySide\0sfloppy\0Setup\0Service de stockage amovible\0Service Control Manager\0Server\0serial\0scsiport\0Schedule\0Schannel\0SCardSvr\0Save Dump\0SAM\0RTL8023xp\0RSVP\0RemoteAccess\0redbook\0Rdbss\0RasMan\0RasAuto\0ql1280\0ql1240\0ql12160\0ql10wnt\0ql1080\0PSched\0Print\0PptpMiniport\0PolicyAgent\0PlugPlayManager\0perc2\0pcmcia\0pciide\0pci\0parvdm\0partmgr\0parport\0OSPFMib\0OSPF\0null\0NtServicePack\0ntfs\0npfs\0Nla\0NIC1394\0Netlogon\0NetDDE\0NetBT\0NetBIOS\0NdisWan\0NdisIP\0ndis\0Mup\0msfs\0msadlib\0MrxSmb\0MRxDAV\0mraid35x\0mouhid\0mouclass\0Modem\0LsaSrv\0LmHosts\0LDMS\0LDM\0lbrtfdc\0Kerberos\0kbdhid\0kbdclass\0isapnp\0irsir\0IPXSAP\0IPXRouterManager\0IPXRIP\0IPXCP\0IPSec\0IPRouterManager\0IPRIP2\0IPNATHLP\0IPMGM\0IPBOOTP\0intelppm\0intelide\0ini910u\0IGMPv2\0i8042prt\0i2omp\0i2omgmt\0Http\0hpn\0ftdisk\0fs_rec\0flpydisk\0Fips\0fdc\0fastfat\0eventlog\0efs\0dpti2o\0Dnscache\0Dnsapi\0dmio\0dmboot\0Distributed Link Tracking Client\0disk\0Dhcp\0DfsSvc\0DfsDriver\0DCOM\0dac960nt\0dac2w2k\0cpqarray\0cmdide\0changer\0cdrom\0Cdm\0cdfs\0cdaudio\0cd20xrnt\0cbidf2k\0Browser\0BITS\0beep\0Atmarpc\0ati2mtag\0Ati HotKey Poller\0atdisk\0atapi\0AsyncMac\0asc3550\0asc3350p\0asc\0Arp1394\0Application Popup\0apphelp\0amsint\0ami0nt\0aliide\0Alerter\0aic78xx\0aic78u2\0aha154x\0adpu160m\0acpiec\0acpi\0abp480n5\0abiosdsk\0System\0\0 > Value: HKEY_LOCAL_MACHINE\system\controlset003\services\Eventlog\System Sources REG_MULTI_SZ WZCSVC\0Workstation\0WindowsMedia\0Windows Update Agent\0Windows Script Host\0Windows Installer 3.1\0Windows File Protection\0Win32k\0W32Time\0VolSnap\0viaide\0VgaSave\0USER32\0UPS\0ultra\0udfs\0toside\0TermServSessDir\0TermService\0TermServDevices\0TermDD\0tdi\0TCPMon\0Tcpip\0System Error\0sym_u3\0sym_hi\0symc8xx\0symc810\0StillImage\0SSDPSRV\0Srv\0srservice\0sr\0sparrow\0sndblst\0Simbad\0SideBySide\0sfloppy\0Setup\0Service de stockage amovible\0Service Control Manager\0Server\0serial\0scsiport\0Schedule\0Schannel\0SCardSvr\0Save Dump\0SAM\0RTL8023xp\0RSVP\0RemoteAccess\0redbook\0Rdbss\0RasMan\0RasAuto\0ql1280\0ql1240\0ql12160\0ql10wnt\0ql1080\0PSched\0Print\0PptpMiniport\0PolicyAgent\0PlugPlayManager\0perc2\0pcmcia\0pciide\0pci\0parvdm\0partmgr\0parport\0OSPFMib\0OSPF\0null\0NtServicePack\0ntfs\0npfs\0Nla\0NIC1394\0Netlogon\0NetDDE\0NetBT\0NetBIOS\0NdisWan\0NdisIP\0ndis\0Mup\0msfs\0msadlib\0MrxSmb\0MRxDAV\0mraid35x\0mouhid\0mouclass\0Modem\0LsaSrv\0LmHosts\0LDMS\0LDM\0lbrtfdc\0Kerberos\0kbdhid\0kbdclass\0isapnp\0irsir\0IPXSAP\0IPXRouterManager\0IPXRIP\0IPXCP\0IPSec\0IPRouterManager\0IPRIP2\0IPNATHLP\0IPMGM\0IPBOOTP\0Internet Explorer 7 Disk\0intelppm\0intelide\0ini910u\0IGMPv2\0i8042prt\0i2omp\0i2omgmt\0Http\0hpn\0ftdisk\0fs_rec\0flpydisk\0Fips\0fdc\0fastfat\0eventlog\0efs\0dpti2o\0Dnscache\0Dnsapi\0dmio\0dmboot\0Distributed Link Tracking Client\0disk\0Dhcp\0DfsSvc\0DfsDriver\0DCOM\0dac960nt\0dac2w2k\0cpqarray\0cmdide\0changer\0cdrom\0Cdm\0cdfs\0cdaudio\0cd20xrnt\0cbidf2k\0Browser\0BITS\0beep\0Atmarpc\0ati2mtag\0Ati HotKey Poller\0atdisk\0atapi\0AsyncMac\0asc3550\0asc3350p\0asc\0Arp1394\0Application Popup\0apphelp\0amsint\0ami0nt\0aliide\0Alerter\0aic78xx\0aic78u2\0aha154x\0adpu160m\0acpiec\0acpi\0abp480n5\0abiosdsk\0System\0\0 < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\kl1 < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\klif < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\lanmanserver\parameters Guid REG_BINARY 5004971301681449958DAA43046B5866 > Value: HKEY_LOCAL_MACHINE\system\controlset003\services\lanmanserver\parameters Guid REG_BINARY 0C479EC6F0F996478B4B2AB36A79A4DE > Value: HKEY_LOCAL_MACHINE\system\controlset003\services\MRxDAV\EncryptedDirectories < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\PerfDisk\Performance WbemAdapFileSignature REG_BINARY 97F41DFEE99BC2AE60BAD78679FB40A1 < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\PerfDisk\Performance WbemAdapFileTime REG_BINARY 0020E7D4F03DC601 < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\PerfDisk\Performance WbemAdapFileSize REG_DWORD 27136 (0x6A00) < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\PerfDisk\Performance WbemAdapStatus REG_DWORD 0 (0x0) < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\PerfNet\Performance WbemAdapFileSignature REG_BINARY 7FD03F93453FAFBABB6E29B11E9E731C < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\PerfNet\Performance WbemAdapFileTime REG_BINARY 0020E7D4F03DC601 < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\PerfNet\Performance WbemAdapFileSize REG_DWORD 17408 (0x4400) < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\PerfNet\Performance WbemAdapStatus REG_DWORD 0 (0x0) < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\SharedAccess\Epoch Epoch REG_DWORD 8851 (0x2293) > Value: HKEY_LOCAL_MACHINE\system\controlset003\services\SharedAccess\Epoch Epoch REG_DWORD 9316 (0x2464) > Value: HKEY_LOCAL_MACHINE\system\controlset003\services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List %windir%\Network Diagnostic\xpnetdiag.exe REG_SZ %windir%\Network Diagnostic\xpnetdiag.exe:*:Enaxxxxx@xxxxxres.dll,-20000 > Value: HKEY_LOCAL_MACHINE\system\controlset003\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\kav\kis7.0\french\setup.exe REG_SZ C:\kav\kis7.0\french\setup.exe:*:Enabled:Programme d'installation de Kaspersky Internet Security 7.0 > Value: HKEY_LOCAL_MACHINE\system\controlset003\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\kav\kav7.0\french\setup.exe REG_SZ C:\kav\kav7.0\french\setup.exe:*:Enabled:Programme d'installation de Kaspersky Anti-Virus 7.0 > Value: HKEY_LOCAL_MACHINE\system\controlset003\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List %windir%\Network Diagnostic\xpnetdiag.exe REG_SZ %windir%\Network Diagnostic\xpnetdiag.exe:*:Enaxxxxx@xxxxxres.dll,-20000 < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\Spooler\Performance WbemAdapFileSignature REG_BINARY E415A3D071D315CD84F6F593A3A060B3 < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\Spooler\Performance WbemAdapFileTime REG_BINARY 0020E7D4F03DC601 < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\Spooler\Performance WbemAdapFileSize REG_DWORD 146944 (0x23E00) < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\Spooler\Performance WbemAdapStatus REG_DWORD 0 (0x0) < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\sr Start REG_DWORD 0 (0x0) > Value: HKEY_LOCAL_MACHINE\system\controlset003\services\sr Start REG_DWORD 4 (0x4) < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\sr ImagePath REG_EXPAND_SZ system32\DRIVERS\sr.sys > Value: HKEY_LOCAL_MACHINE\system\controlset003\services\sr ImagePath REG_EXPAND_SZ \SystemRoot\system32\DRIVERS\sr.sys < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\sr\Parameters FirstRun REG_DWORD 0 (0x0) > Value: HKEY_LOCAL_MACHINE\system\controlset003\services\sr\Parameters FirstRun REG_DWORD 1 (0x1) < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\TapiSrv\Performance WbemAdapFileSignature REG_BINARY 0483F001E58AF7EA90B23BA9ACB367D3 < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\TapiSrv\Performance WbemAdapFileTime REG_BINARY 0020E7D4F03DC601 < Value: HKEY_LOCAL_MACHINE\system\controlset001\se

Utilisateur anonyme · Answer

T'a fini de freeposter ??

Sophie · Answer

@="\"%1\" %*" -----HKEY_CLASSES_ROOT\comfile\shell\open\command----- [command] @="\"%1\" %*" -----HKEY_CLASSES_ROOT\batfile\shell\open\command----- [command] @="\"%1\" %*" -----HKEY_CLASSES_ROOT\piffile\shell\open\command----- [command] @="\"%1\" %*" -----HKEY_CLASSES_ROOT\scrFile\shell\open\command----- [command] @="\"%1\" %*" -----HKEY_CLASSES_ROOT\htafile\shell\open\command----- [Command] @="C:\WINDOWS\system32\mshta.exe \"%1\" %*" -----HKEY_CLASSES_ROOT\logfile\shell\open\command----- -----HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\URL----- [URL] [URL\DefaultPrefix] @="http://" [URL\Prefixes] "ftp"="ftp://" "gopher"="gopher://" "home"="http://" "mosaic"="http://" "www"="http://" -----HKLM\SYSTEM\CurrentControlSet\Control\Lsa----- [Lsa] [Lsa\AccessProviders] [Lsa\AccessProviders\Windows NT Access Provider] "ProviderPath"=expand:"%SystemRoot%\system32 tmarta.dll" [Lsa\Audit] [Lsa\Audit\PerUserAuditing] [Lsa\Audit\PerUserAuditing\System] [Lsa\Data] [Lsa\SSO] [Lsa\SSO\Passport1.4] "SSOURL"="http://www.passport.com" [Lsa\SspiCache] [Lsa\SspiCache\digest.dll] "Name"="Digest" "Comment"="Digest SSPI Authentication Package" [Lsa\SspiCache\msapsspc.dll] "Name"="DPA" "Comment"="DPA Security Package" [Lsa\SspiCache\msnsspc.dll] "Name"="MSN" "Comment"="MSN Security Package" -----HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess----- [SharedAccess] "DependOnGroup"=multi:"\00" "DependOnService"=multi:"Netman\00WinMgmt\00\00" "Description"="Assure la traduction d'adresses de réseau, l'adressage, les services de résolution de noms et/ou les services de prévention d'intrusion pour un réseau de petite entreprise ou un réseau domestique." "DisplayName"="Pare-feu Windows / Partage de connexion Internet" "ErrorControl"=dword:00000001 "ImagePath"=expand:"%SystemRoot%\system32\svchost.exe -k netsvcs" "ObjectName"="LocalSystem" "Start"=dword:00000002 "Type"=dword:00000020 [SharedAccess\Epoch] "Epoch"=dword:00002473 [SharedAccess\Parameters] "ServiceDll"=expand:"%SystemRoot%\System32\ipnathlp.dll" [SharedAccess\Parameters\FirewallPolicy] [SharedAccess\Parameters\FirewallPolicy\DomainProfile] [SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications] [SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List] "%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enaxxxxx@xxxxxres.dll,-22019" "C:\Program Files\MSN Messenger\msnmsgr.exe"="C:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1" "C:\Program Files\MSN Messenger\livecall.exe"="C:\Program Files\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)" "%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enaxxxxx@xxxxxres.dll,-20000" [SharedAccess\Parameters\FirewallPolicy\StandardProfile] "EnableFirewall"=dword:00000001 "DoNotAllowExceptions"=dword:00000000 [SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications] [SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] "%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enaxxxxx@xxxxxres.dll,-22019" "C:\Program Files\eMule\emule.exe"="C:\Program Files\eMule\emule.exe:*:Enabled:eMule" "C:\Program Files\MSN Messenger\msnmsgr.exe"="C:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1" "C:\Program Files\MSN Messenger\livecall.exe"="C:\Program Files\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)" "C:\Program Files\Resolume 2.41 esolume.exe"="C:\Program Files\Resolume 2.41 esolume.exe:*:Enabled:Resolume 2.41" "C:\Program Files\Messenger\msmsgs.exe"="C:\Program Files\Messenger\msmsgs.exe:*:Enabled:Windows Messenger" "C:\Documents and Settings\Propriétaire\Local Settings\Temp\Rar$EX02.937\emule.exe"="C:\Documents and Settings\Propriétaire\Local Settings\Temp\Rar$EX02.937\emule.exe:*:Disabled:eMule" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\0exinjs.aa.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\0exinjs.aa.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\22exinjs.aa.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\22exinjs.aa.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\23exinjs.aa.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\23exinjs.aa.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\83exinjs.aa.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\83exinjs.aa.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\86exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\86exinjs.ab.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\82exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\82exinjs.ab.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\42exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\42exinjs.ab.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\98exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\98exinjs.ab.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\36exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\36exinjs.ab.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\59exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\59exinjs.ab.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\49exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\49exinjs.ab.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\73exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\73exinjs.ab.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\75exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\75exinjs.ab.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\8exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\8exinjs.ab.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\47exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\47exinjs.ab.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\20exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\20exinjs.ab.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\78exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\78exinjs.ab.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\80exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\80exinjs.ab.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\74exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\74exinjs.ab.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\18exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\18exinjs.ab.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\64exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\64exinjs.ab.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\57exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\57exinjs.ab.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\92exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\92exinjs.ab.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\11exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\11exinjs.ab.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\50exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\50exinjs.ab.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\43exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\43exinjs.ab.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\95exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\95exinjs.ab.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\52exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\52exinjs.ab.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\23exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\23exinjs.ab.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\6exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\6exinjs.ab.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\39exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\39exinjs.ab.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\68exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\68exinjs.ab.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\61exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\61exinjs.ab.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\26exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\26exinjs.ab.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\34exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\34exinjs.ab.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\19exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\19exinjs.ab.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\32exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\32exinjs.ab.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\14exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\14exinjs.ab.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\60exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\60exinjs.ab.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\29exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\29exinjs.ab.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\66exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\66exinjs.ab.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\99exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\99exinjs.ab.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\54exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\54exinjs.ab.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\94exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\94exinjs.ab.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\85exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\85exinjs.ab.exe:*:Enabled:Microsoft Update" "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe"="C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe:*:Disabled:Kaspersky Anti-Virus" "C:\Program Files\uTorrent\uTorrent.exe"="C:\Program Files\uTorrent\uTorrent.exe:*:Enabled:µTorrent" "C:\Program Files\BitDownload\BitDownload.exe"="C:\Program Files\BitDownload\BitDownload.exe:*:Enabled:Torrent P2P application" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\16ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\16ex:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\25ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\25ex:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\35ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\35ex:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\43ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\43ex:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\58ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\58ex:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\26ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\26ex:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\87ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\87ex:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\60ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\60ex:*:Enabled:Microsoft Update" "C:\Program Files\Ahead\Nero ShowTime\ShowTime.exe"="C:\Program Files\Ahead\Nero ShowTime\ShowTime.exe:*:Enabled:Nero ShowTime" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\44ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\44ex:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\50ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\50ex:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\7ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\7ex:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\42ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\42ex:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\3ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\3ex:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\21ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\21ex:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\40ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\40ex:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\2ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\2ex:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\4ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\4ex:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\65ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\65ex:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\37ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\37ex:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\31ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\31ex:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\72ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\72ex:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\92ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\92ex:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\68ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\68ex:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\45ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\45ex:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\96ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\96ex:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\33ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\33ex:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\79ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\79ex:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\10ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\10ex:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\22ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\22ex:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\55ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\55ex:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\66ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\66ex:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\94ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\94ex:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\52ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\52ex:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\0ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\0ex:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\63ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\63ex:*:Enabled:Microsoft Update" "C:\Documents and Settings\Propriétaire\Local Settings\Temp\10exmdnk23.exe"="C:\Documents and Settings\Propriétaire\Local Settings\Temp\10exmdnk23.exe:*:Disabled:10exmdnk23" "C:\Documents and Settings\Propriétaire\Local Settings\Temp\33exmdnk25.exe"="C:\Documents and Settings\Propriétaire\Local Settings\Temp\33exmdnk25.exe:*:Disabled:33exmdnk25" "C:\Documents and Settings\Propriétaire\Local Settings\Temp\0exmdnk26.exe"="C:\Documents and Settings\Propriétaire\Local Settings\Temp\0exmdnk26.exe:*:Disabled:0exmdnk26" "C:\Documents and Settings\Propriétaire\Local Settings\Temp\58exmdnk30.exe"="C:\Documents and Settings\Propriétaire\Local Settings\Temp\58exmdnk30.exe:*:Disabled:58exmdnk30" "C:\kav\kis7.0\french\setup.exe"="C:\kav\kis7.0\french\setup.exe:*:Enabled:Programme d'installation de Kaspersky Internet Security 7.0" "C:\kav\kav7.0\french\setup.exe"="C:\kav\kav7.0\french\setup.exe:*:Enabled:Programme d'installation de Kaspersky Anti-Virus 7.0" "%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enaxxxxx@xxxxxres.dll,-20000" [SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts] [SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List] "1900:UDP"="1900:UDP:LocalSubNet:Disaxxxxx@xxxxxres.dll,-22007" "2869:TCP"="2869:TCP:LocalSubNet:Disaxxxxx@xxxxxres.dll,-22008" "17053:TCP"="17053:TCP:*:Enabled:NortonAV" "12192:TCP"="12192:TCP:*:Enabled:NortonAV" [SharedAccess\Setup] "ServiceUpgrade"=dword:00000001 [SharedAccess\Setup\InterfacesUnfirewalledAtUpdate] "All"=dword:00000001 -----HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Firewall\----- -----HKEY_LOCAL_MACHINE\SOFTWARE\Winsock2----- -----HKLM\Software\Microsoft\Ole----- [Ole] "DefaultLaunchPermission"=hex:01,00,04,80,5c,00,00,00,6c,00,00,00,00,00,00,00,\ "MachineLaunchRestriction"=hex:01,00,04,80,48,00,00,00,58,00,00,00,00,00,00,00,\ "MachineAccessRestriction"=hex:01,00,04,80,44,00,00,00,54,00,00,00,00,00,00,00,\ "EnableDCOM"="Y" [Ole\AppCompat] [Ole\AppCompat\ActivationSecurityCheckExemptionList] "{A50398B8-9075-4FBF-A7A1-456BF21937AD}"="1" "{AD65A69D-3831-40D7-9629-9B0B50A93843}"="1" "{0040D221-54A1-11D1-9DE0-006097042D69}"="1" "{2A6D72F1-6E7E-4702-B99C-E40D3DED33C3}"="1" [Ole\NONREDIST] "System.EnterpriseServices.Thunk.dll"="" -----HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WindowsUpdate\AU\----- -----HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\----- [Security Center] "FirstRunDisabled"=dword:00000001 "AntiVirusDisableNotify"=dword:00000000 "FirewallDisableNotify"=dword:00000000 "UpdatesDisableNotify"=dword:00000000 "AntiVirusOverride"=dword:00000001 "FirewallOverride"=dword:00000000 [Security Center\Monitoring] [Security Center\Monitoring\AhnlabAntiVirus] [Security Center\Monitoring\ComputerAssociatesAntiVirus] [Security Center\Monitoring\KasperskyAntiVirus] [Security Center\Monitoring\McAfeeAntiVirus] [Security Center\Monitoring\McAfeeFirewall] [Security Center\Monitoring\PandaAntiVirus] [Security Center\Monitoring\PandaFirewall] [Security Center\Monitoring\SophosAntiVirus] [Security Center\Monitoring\SymantecAntiVirus] [Security Center\Monitoring\SymantecFirewall] [Security Center\Monitoring\TinyFirewall] [Security Center\Monitoring\TrendAntiVirus] [Security Center\Monitoring\TrendFirewall] [Security Center\Monitoring\ZoneLabsFirewall] -----HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore\----- [SystemRestore] "DisableSR"=dword:00000000 "CreateFirstRunRp"=dword:00000001 "DSMin"=dword:000000c8 "DSMax"=dword:00000190 "RPSessionInterval"=dword:00000000 "RPGlobalInterval"=dword:00015180 "RPLifeInterval"=dword:0076a700 "CompressionBurst"=dword:0000003c "TimerInterval"=dword:00000078 "DiskPercent"=dword:0000000c "ThawInterval"=dword:00000384 "RestoreDiskSpaceError"=dword:00000000 "RestoreStatus"=dword:00000000 "RestoreSafeModeStatus"=dword:00000001 [SystemRestore\Cfg] "DiskPercent"=dword:0000000c "MachineGuid"="{D88DDE61-D342-465C-AFF5-295FBD9AB56F}" [SystemRestore\SnapshotCallbacks] @="" -----HKEY_CURRENT_USER\Software\VB and VBA Program Settings----- [VB and VBA Program Settings] [VB and VBA Program Settings\CCleaner] [VB and VBA Program Settings\CCleaner\Options] -----HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\----- -----HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\AdvancedOptions----- [AdvancedOptions] -----HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\AdvancedOptions----- -----HKLM\Software\Microsoft\Active Setup\Installed Components----- [Installed Components] [Installed Components\<{12d0ed0d-0ee0-4f90-8827-78cefb8f4988}] "@="IE7 Uninstall Stub" "ComponentID"="IEUDINIT" "StubPath"="C:\WINDOWS\system32\ieudinit.exe" [Installed Components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}] #### HKCR\CLSID\{22d6f312-b0f6-11d0-94ab-0080c74c7e95}\InprocServer32 @="C:\WINDOWS\system32\wmpdxm.dll" "Stubpath"="C:\WINDOWS\inf\unregmp2.exe /ShowWMP" "@="Microsoft Windows Media Player" "ComponentID"="WMPACCESS" [Installed Components\>{26923b43-4d38-484f-9b9e-de460746276c}] "@="Internet Explorer" "ComponentID"="IEACCESS" "StubPath"="C:\WINDOWS\system32\ie4uinit.exe -UserIconConfig" [Installed Components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}] "@="Browser Customizations" "ComponentiD"="BRANDING.CAB" "StubPath"="RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP" [Installed Components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS] "@="Personnalisation du navigateur" "ComponentID"="BRANDING.CAB" "StubPath"="RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP" [Installed Components\>{881dd1c5-3dcf-431b-b061-f3f88e8be88a}] "@="Outlook Express" "ComponentID"="OEACCESS" "StubPath"=expand:"%systemroot%\system32\shmgrate.exe OCInstallUserConfigOE" [Installed Components\{0E92DD42-76F5-4EF2-B381-F9C1D72BE23D}] "@="Security Update for Microsoft .NET Framework 2.0 (KB922770)" "ComponentID"="KB922770" [Installed Components\{10072CEC-8CC1-11D1-986E-00A0C955B42F}] "@="Rendu VML (Vector Graphics Rendering)" "ComponentID"="MSVML" [Installed Components\{2179C5D3-EBFF-11CF-B6FD-00AA00B4E220}] #### HKCR\CLSID\{2179C5D3-EBFF-11CF-B6FD-00AA00B4E220}\InprocServer32 @="C:\WINDOWS\system32\wmpdxm.dll" "ComponentID"="NetShow" "StubPath"="" [Installed Components\{22d6f312-b0f6-11d0-94ab-0080c74c7e95}] #### HKCR\CLSID\{22d6f312-b0f6-11d0-94ab-0080c74c7e95}\InprocServer32 @="C:\WINDOWS\system32\wmpdxm.dll" "ComponentID"="Microsoft Windows Media Player" "StubPath"="" "@="Lecteur Windows Media Microsoft 6.4" [Installed Components\{283807B5-2C60-11D0-A31D-00AA00B92C03}] "@="DirectAnimation" "ComponentID"="DirectAnimation" [Installed Components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}] "@="Themes Setup" "ComponentID"="Theme Component" "StubPath"=expand:"%SystemRoot%\system32 egsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32 hemeui.dll" [Installed Components\{36f8ec70-c29a-11d1-b5c7-0000f8051515}] "@="Liaison de données Dynamic HTML pour Java" "ComponentID"="TridataJava" [Installed Components\{3919E8B8-A291-74E5-5DBF-8FB615E8FCED}] "@="Themes Setup" "ComponentID"="Theme Component" [Installed Components\{3af36230-a269-11d1-b5bf-0000f8051515}] "@="Offline Browsing Pack" "ComponentID"="MobilePk" [Installed Components\{3bf42070-b3b1-11d1-b5c5-0000f8051515}] "@="Uniscribe" "ComponentID"="USP10" [Installed Components\{411EDCF7-755D-414E-A74B-3DCD6583F589}] "ComponentID"="S867460" "@="Microsoft .NET Framework 1.1 Service Pack 1 (KB867460)" [Installed Components\{4278c270-a269-11d1-b5bf-0000f8051515}] "@="Création avancée" "ComponentID"="AdvAuth" [Installed Components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}] "@="Microsoft Outlook Express 6" "ComponentID"="MailNews" "StubPath"=expand:"\"%ProgramFiles%\Outlook Express\setup50.exe\" /APP:OE /CALLER:WINNT /user /install" [Installed Components\{44BBA842-CC51-11CF-AAFA-00AA00B6015B}] "@="NetMeeting 3.01" "ComponentID"="NetMeeting" "StubPath"="rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT" [Installed Components\{44BBA848-CC51-11CF-AAFA-00AA00B6015C}] "@="DirectShow" "ComponentID"="activemovie" [Installed Components\{44BBA855-CC51-11CF-AAFA-00AA00B6015F}] "@="DirectDrawEx" "ComponentID"="DirectDrawEx" [Installed Components\{45ea75a0-a269-11d1-b5bf-0000f8051515}] "@="Internet Explorer Help" "ComponentID"="HelpCont" [Installed Components\{4f216970-c90c-11d1-b5c7-0000f8051515}] "@="Classes Java DirectAnimation" "ComponentID"="DAJava" [Installed Components\{4f645220-306d-11d2-995d-00c04f98bbc9}] "@="Microsoft Windows Script 5.6" "ComponentID"="MSVBScript" [Installed Components\{5945c046-1e7d-11d1-bc44-00c04fd912be}] "KeyFileName"="C:\Program Files\Messenger\msmsgs.exe" "@="Windows Messenger 4.7" "ComponentID"="Messenger" "StubPath"="rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser" [Installed Components\{5A8D6EE0-3E18-11D0-821E-444553540000}] "(Default)"="Internet Connection Wizard" "ComponentID"="ICW" [Installed Components\{5fd399c0-a70a-11d1-9948-00c04f98bbc9}] "@="Internet Explorer Setup Tools" "ComponentID"="GenSetup" [Installed Components\{630b1da0-b465-11d1-9948-00c04f98bbc9}] "@="Browsing Enhancements" "ComponentID"="ExtraPack" "KeyFileName"="C:\WINDOWS\system32\msieftp.dll" [Installed Components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}] #### HKCR\CLSID\{6BF52A52-394A-11d3-B153-00C04F79FAA6}\InprocServer32 @="C:\WINDOWS\system32\wmp.dll" "@="Microsoft Windows Media Player" "ComponentID"="Microsoft Windows Media Player" "StubPath"="rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\wmp.inf,PerUserStub" [Installed Components\{6fab99d0-bab8-11d1-994a-00c04f98bbc9}] "@="MSN Site Access" "ComponentID"="MSN_Auth" [Installed Components\{7131646D-CD3C-40F4-97B9-CD9E4E6262EF}] "ComponentID"=".NETFramework" "@=".NET Framework" [Installed Components\{7790769C-0471-11d2-AF11-00C04FA35D02}] "@="Carnet d'adresses 6" "ComponentID"="WAB" "StubPath"=expand:"\"%ProgramFiles%\Outlook Express\setup50.exe\" /APP:WAB /CALLER:WINNT /user /install" [Installed Components\{8056AC9E-49C5-4375-9ADE-B2F862C9DF51}] "ComponentID"="KB928365" "@="Security Update for Microsoft .NET Framework 2.0 (KB928365)" [Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4340}] "@="Mise à jour du Bureau Windows" "ComponentID"="IE4Shell_NT" "StubPath"=expand:"regsvr32.exe /s /n /i:U shell32.dll" [Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4383}] "@="Internet Explorer" "ComponentID"="BASEIE40_W2K" "StubPath"="C:\WINDOWS\system32\ie4uinit.exe -BaseSettings" [Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4383}\AuthorizedCDFPrefix] [Installed Components\{89B4C1CD-B018-4511-B0A1-5476DBF70820}] "StubPath"="C:\WINDOWS\system32\Rundll32.exe C:\WINDOWS\system32\mscories.dll,Install" "ComponentID"="DOTNETFRAMEWORKS" [Installed Components\{8D1D0E9A-C799-4D28-9E29-0061D1E66E43}] "ComponentID"="M928366" "@="Microsoft .NET Framework 1.1 Hotfix (KB928366)" [Installed Components\{9381D8F2-0288-11D0-9501-00AA00B911A5}] "@="Dynamic HTML Data Binding" "ComponentID"="Tridata" [Installed Components\{967B098A-042D-4367-BAC9-8BC11684174F}] "@="Security Update for Microsoft .NET Framework 2.0 (KB917283)" "ComponentID"="KB917283" [Installed Components\{ACC563BC-4266-43f0-B6ED-9D38C4202C7E}] [Installed Components\{C9E9A340-D1F1-11D0-821E-444553540600}] "@="Internet Explorer Core Fonts" "ComponentID"="Fontcore" [Installed Components\{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}] "ComponentID"=".NETFramework" "@=".NET Framework" [Installed Components\{CC2A9BA0-3BDD-11D0-821E-444553540000}] "@="Planificateur de tâches" "ComponentID"="MSTASK" [Installed Components\{CDD7975E-60F8-41d5-8149-19E51D6F71D0}] "ComponentID"="Windows Movie Maker v2.1" [Installed Components\{D27CDB6E-AE6D-11cf-96B8-444553540000}] "@="Adobe Flash Player" "ComponentID"="Flash" [Installed Components\{de5aed00-a4bf-11d1-9948-00c04f98bbc9}] "@="HTML Help" "ComponentID"="HTMLHelp" [Installed Components\{E92B03AB-B707-11d2-9CBD-0000F87A369E}] "@="Active Directory Service Interface" "ComponentID"="ADSI" -----Comparing registry keys CCS1 vs CCS2 ----- < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\aawservice > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\aswTdi DisplayName REG_SZ avast! Network Shield Support > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\aswTdi ErrorControl REG_DWORD 1 (0x1) > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\aswTdi Type REG_DWORD 1 (0x1) > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\aswTdi Group REG_SZ PNP_TDI > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\aswTdi Start REG_DWORD 1 (0x1) > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\aswTdi DependOnService REG_MULTI_SZ tcpip\0\0 > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\aswTdi Tag REG_DWORD 9 (0x9) < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\aswTdi\Parameters ProviderStart REG_DWORD 3 (0x3) > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\aswTdi\Parameters ProviderStart REG_DWORD 1 (0x1) < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\AVG Anti-Spyware Driver < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\AVG Anti-Spyware Guard < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\AvgAsCln < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\AVP < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\BITS Start REG_DWORD 3 (0x3) > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\BITS Start REG_DWORD 2 (0x2) < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\Dhcp\Parameters {6317C625-DA29-42BA-9ADD-C0C897993031} REG_BINARY 1A0000000000000002000000000000002EAECB4705D40000060000000000000008000000000000002EAECB473E0410463E041145030000000000000004000000000000002EAECB47C0A801010F0000000000000005000000000000002EAECB476C6F63616C000000330000000000000004000000000000002EAECB4700015180010000000000000004000000000000002EAECB47FFFFFF00360000000000000004000000000000002EAECB47C0A80101350000000000000001000000000000002EAECB4705000000 > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\Dhcp\Parameters {6317C625-DA29-42BA-9ADD-C0C897993031} REG_BINARY FC000000000000000000000000000000BF1D13491A0000000000000002000000000000003969144905D400000600000000000000080000000000000039691449D043DEDED043DCDC0300000000000000040000000000000039691449C0A801010F000000000000000500000000000000396914496C6F63616C0000003300000000000000040000000000000039691449000151800100000000000000040000000000000039691449FFFFFF003600000000000000040000000000000039691449C0A80101350000000000000001000000000000003969144905000000 < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\Eventlog\Application\ESENT EventMessageFile REG_EXPAND_SZ c:\windows\system32\ESENT.dll > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\Eventlog\Application\ESENT EventMessageFile REG_EXPAND_SZ C:\WINDOWS\system32\ESENT.dll < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\Eventlog\Application\ESENT CategoryMessageFile REG_EXPAND_SZ c:\windows\system32\ESENT.dll > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\Eventlog\Application\ESENT CategoryMessageFile REG_EXPAND_SZ C:\WINDOWS\system32\ESENT.dll > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\Eventlog\Security\DS > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\Eventlog\Security\LSA > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\Eventlog\Security\NetDDE Object > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\Eventlog\Security\SC Manager > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\Eventlog\Security\Security > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\Eventlog\Security\Security Account Manager > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\Eventlog\Security\Spooler < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\Eventlog\System Sources REG_MULTI_SZ WZCSVC\0Workstation\0WindowsMedia\0Windows Update Agent\0Windows Script Host\0Windows Installer 3.1\0Windows File Protection\0Win32k\0W32Time\0VolSnap\0viaide\0VgaSave\0USER32\0UPS\0ultra\0udfs\0toside\0TermServSessDir\0TermService\0TermServDevices\0TermDD\0tdi\0TCPMon\0Tcpip\0System Error\0sym_u3\0sym_hi\0symc8xx\0symc810\0StillImage\0SSDPSRV\0Srv\0srservice\0sr\0sparrow\0sndblst\0Simbad\0SideBySide\0sfloppy\0Setup\0Service de stockage amovible\0Service Control Manager\0Server\0serial\0scsiport\0Schedule\0Schannel\0SCardSvr\0Save Dump\0SAM\0RTL8023xp\0RSVP\0RemoteAccess\0redbook\0Rdbss\0RasMan\0RasAuto\0ql1280\0ql1240\0ql12160\0ql10wnt\0ql1080\0PSched\0Print\0PptpMiniport\0PolicyAgent\0PlugPlayManager\0perc2\0pcmcia\0pciide\0pci\0parvdm\0partmgr\0parport\0OSPFMib\0OSPF\0null\0NtServicePack\0ntfs\0npfs\0Nla\0NIC1394\0Netlogon\0NetDDE\0NetBT\0NetBIOS\0NdisWan\0NdisIP\0ndis\0Mup\0msfs\0msadlib\0MrxSmb\0MRxDAV\0mraid35x\0mouhid\0mouclass\0Modem\0LsaSrv\0LmHosts\0LDMS\0LDM\0lbrtfdc\0Kerberos\0kbdhid\0kbdclass\0isapnp\0irsir\0IPXSAP\0IPXRouterManager\0IPXRIP\0IPXCP\0IPSec\0IPRouterManager\0IPRIP2\0IPNATHLP\0IPMGM\0IPBOOTP\0intelppm\0intelide\0ini910u\0IGMPv2\0i8042prt\0i2omp\0i2omgmt\0Http\0hpn\0ftdisk\0fs_rec\0flpydisk\0Fips\0fdc\0fastfat\0eventlog\0efs\0dpti2o\0Dnscache\0Dnsapi\0dmio\0dmboot\0Distributed Link Tracking Client\0disk\0Dhcp\0DfsSvc\0DfsDriver\0DCOM\0dac960nt\0dac2w2k\0cpqarray\0cmdide\0changer\0cdrom\0Cdm\0cdfs\0cdaudio\0cd20xrnt\0cbidf2k\0Browser\0BITS\0beep\0Atmarpc\0ati2mtag\0Ati HotKey Poller\0atdisk\0atapi\0AsyncMac\0asc3550\0asc3350p\0asc\0Arp1394\0Application Popup\0apphelp\0amsint\0ami0nt\0aliide\0Alerter\0aic78xx\0aic78u2\0aha154x\0adpu160m\0acpiec\0acpi\0abp480n5\0abiosdsk\0System\0\0 > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\Eventlog\System Sources REG_MULTI_SZ WZCSVC\0Workstation\0WindowsMedia\0Windows Update Agent\0Windows Script Host\0Windows Installer 3.1\0Windows File Protection\0Win32k\0W32Time\0VolSnap\0viaide\0VgaSave\0USER32\0UPS\0ultra\0udfs\0toside\0TermServSessDir\0TermService\0TermServDevices\0TermDD\0tdi\0TCPMon\0Tcpip\0System Error\0sym_u3\0sym_hi\0symc8xx\0symc810\0StillImage\0SSDPSRV\0Srv\0srservice\0sr\0sparrow\0sndblst\0Simbad\0SideBySide\0sfloppy\0Setup\0Service de stockage amovible\0Service Control Manager\0Server\0serial\0scsiport\0Schedule\0Schannel\0SCardSvr\0Save Dump\0SAM\0RTL8023xp\0RSVP\0RemoteAccess\0redbook\0Rdbss\0RasMan\0RasAuto\0ql1280\0ql1240\0ql12160\0ql10wnt\0ql1080\0PSched\0Print\0PptpMiniport\0PolicyAgent\0PlugPlayManager\0perc2\0pcmcia\0pciide\0pci\0parvdm\0partmgr\0parport\0OSPFMib\0OSPF\0null\0NtServicePack\0ntfs\0npfs\0Nla\0NIC1394\0Netlogon\0NetDDE\0NetBT\0NetBIOS\0NdisWan\0NdisIP\0ndis\0Mup\0msfs\0msadlib\0MrxSmb\0MRxDAV\0mraid35x\0mouhid\0mouclass\0Modem\0LsaSrv\0LmHosts\0LDMS\0LDM\0lbrtfdc\0Kerberos\0kbdhid\0kbdclass\0isapnp\0irsir\0IPXSAP\0IPXRouterManager\0IPXRIP\0IPXCP\0IPSec\0IPRouterManager\0IPRIP2\0IPNATHLP\0IPMGM\0IPBOOTP\0Internet Explorer 7 Disk\0intelppm\0intelide\0ini910u\0IGMPv2\0i8042prt\0i2omp\0i2omgmt\0Http\0hpn\0ftdisk\0fs_rec\0flpydisk\0Fips\0fdc\0fastfat\0eventlog\0efs\0dpti2o\0Dnscache\0Dnsapi\0dmio\0dmboot\0Distributed Link Tracking Client\0disk\0Dhcp\0DfsSvc\0DfsDriver\0DCOM\0dac960nt\0dac2w2k\0cpqarray\0cmdide\0changer\0cdrom\0Cdm\0cdfs\0cdaudio\0cd20xrnt\0cbidf2k\0Browser\0BITS\0beep\0Atmarpc\0ati2mtag\0Ati HotKey Poller\0atdisk\0atapi\0AsyncMac\0asc3550\0asc3350p\0asc\0Arp1394\0Application Popup\0apphelp\0amsint\0ami0nt\0aliide\0Alerter\0aic78xx\0aic78u2\0aha154x\0adpu160m\0acpiec\0acpi\0abp480n5\0abiosdsk\0System\0\0 < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\kl1 < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\klif < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\lanmanserver\parameters Guid REG_BINARY 5004971301681449958DAA43046B5866 > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\lanmanserver\parameters Guid REG_BINARY 0C479EC6F0F996478B4B2AB36A79A4DE > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\MRxDAV\EncryptedDirectories < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\PerfDisk\Performance WbemAdapFileSignature REG_BINARY 97F41DFEE99BC2AE60BAD78679FB40A1 < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\PerfDisk\Performance WbemAdapFileTime REG_BINARY 0020E7D4F03DC601 < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\PerfDisk\Performance WbemAdapFileSize REG_DWORD 27136 (0x6A00) < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\PerfDisk\Performance WbemAdapStatus REG_DWORD 0 (0x0) < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\PerfNet\Performance WbemAdapFileSignature REG_BINARY 7FD03F93453FAFBABB6E29B11E9E731C < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\PerfNet\Performance WbemAdapFileTime REG_BINARY 0020E7D4F03DC601 < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\PerfNet\Performance WbemAdapFileSize REG_DWORD 17408 (0x4400) < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\PerfNet\Performance WbemAdapStatus REG_DWORD 0 (0x0) < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\SharedAccess\Epoch Epoch REG_DWORD 8851 (0x2293) > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\SharedAccess\Epoch Epoch REG_DWORD 9331 (0x2473) > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List %windir%\Network Diagnostic\xpnetdiag.exe REG_SZ %windir%\Network Diagnostic\xpnetdiag.exe:*:Enaxxxxx@xxxxxres.dll,-20000 > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\kav\kis7.0\french\setup.exe REG_SZ C:\kav\kis7.0\french\setup.exe:*:Enabled:Programme d'installation de Kaspersky Internet Security 7.0 > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\kav\kav7.0\french\setup.exe REG_SZ C:\kav\kav7.0\french\setup.exe:*:Enabled:Programme d'installation de Kaspersky Anti-Virus 7.0 > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List %windir%\Network Diagnostic\xpnetdiag.exe REG_SZ %windir%\Network Diagnostic\xpnetdiag.exe:*:Enaxxxxx@xxxxxres.dll,-20000 < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\Spooler\Performance WbemAdapFileSignature REG_BINARY E415A3D071D315CD84F6F593A3A060B3 < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\Spooler\Performance WbemAdapFileTime REG_BINARY 0020E7D4F03DC601 < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\Spooler\Performance WbemAdapFileSize REG_DWORD 146944 (0x23E00) < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\Spooler\Performance WbemAdapStatus REG_DWORD 0 (0x0) < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\sr Start REG_DWORD 0 (0x0) > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\sr Start REG_DWORD 4 (0x4) < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\sr ImagePath REG_EXPAND_SZ system32\DRIVERS\sr.sys > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\sr ImagePath REG_EXPAND_SZ \SystemRoot\system32\DRIVERS\sr.sys < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\sr\Parameters FirstRun REG_DWORD 0 (0x0) > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\sr\Parameters FirstRun REG_DWORD 1 (0x1) < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\TapiSrv\Performance WbemAdapFileSignature REG_BINARY 0483F001E58AF7EA90B23BA9ACB367D3 < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\TapiSrv\Performance WbemAdapFileTime REG_BINARY 0020E7D4F03DC601 < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\TapiSrv\Performance WbemAdapFileSize REG_DWORD 5632 (0x1600) < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\TapiSrv\Performance WbemAdapStatus REG_DWORD 0 (0x0) < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\Tcpip\Parameters DhcpNameServer REG_SZ 62.4.16.70 62.4.17.69 > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\Tcpip\Parameters DhcpNameServer REG_SZ 208.67.222.222 208.67.220.220 < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\Tcpip\Parameters\Interfaces\{6317C625-DA29-42BA-9ADD-C0C897993031} LeaseObtainedTime REG_DWORD 1204444334 (0x47CA5CAE) > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\Tcpip\Parameters\Interfaces\{6317C625-DA29-42BA-9ADD-C0C897993031} LeaseObtainedTime REG_DWORD 1225988025 (0x491317B9) < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\Tcpip\Parameters\Interfaces\{6317C625-DA29-42BA-9ADD-C0C897993031} T1 REG_DWORD 1204487534 (0x47CB056E) > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\Tcpip\Parameters\Interfaces\{6317C625-DA29-42BA-9ADD-C0C897993031} T1 REG_DWORD 1226031225 (0x4913C079) < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\Tcpip\Parameters\Interfaces\{6317C625-DA29-42BA-9ADD-C0C897993031} T2 REG_DWORD 1204519934 (0x47CB83FE) > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\Tcpip\Parameters\Interfaces\{6317C625-DA29-42BA-9ADD-C0C897993031} T2 REG_DWORD 1226063625 (0x49143F09) < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\Tcpip\Parameters\Interfaces\{6317C625-DA29-42BA-9ADD-C0C897993031} LeaseTerminatesTime REG_DWORD 1204530734 (0x47CBAE2E) > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\Tcpip\Parameters\Interfaces\{6317C625-DA29-42BA-9ADD-C0C897993031} LeaseTerminatesTime REG_DWORD 1226074425 (0x49146939) < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\Tcpip\Parameters\Interfaces\{6317C625-DA29-42BA-9ADD-C0C897993031} DhcpIPAddress REG_SZ 192.168.1.101 > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\Tcpip\Parameters\Interfaces\{6317C625-DA29-42BA-9ADD-C0C897993031} DhcpIPAddress REG_SZ 192.168.1.100 < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\Tcpip\Parameters\Interfaces\{6317C625-DA29-42BA-9ADD-C0C897993031} DhcpNameServer REG_SZ 62.4.16.70 62.4.17.69 > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\Tcpip\Parameters\Interfaces\{6317C625-DA29-42BA-9ADD-C0C897993031} DhcpNameServer REG_SZ 208.67.222.222 208.67.220.220 < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\WmiApRpl\Performance Last Counter REG_DWORD 4848 (0x12F0) > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\WmiApRpl\Performance Last Counter REG_DWORD 4856 (0x12F8) < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\WmiApRpl\Performance Last Help REG_DWORD 4849 (0x12F1) > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\WmiApRpl\Performance Last Help REG_DWORD 4857 (0x12F9) < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\WmiApRpl\Performance Object List REG_SZ 4844 4844 > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\WmiApRpl\Performance Object List REG_SZ 4844 4844 4850 4850 < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\wuauserv Start REG_DWORD 4 (0x4) > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\wuauserv Start REG_DWORD 2 (0x2) < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\{6317C625-DA29-42BA-9ADD-C0C897993031}\Parameters\Tcpip DhcpIPAddress REG_SZ 192.168.1.101 > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\{6317C625-DA29-42BA-9ADD-C0C897993031}\Parameters\Tcpip DhcpIPAddress REG_SZ 192.168.1.100 < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\{6317C625-DA29-42BA-9ADD-C0C897993031}\Parameters\Tcpip LeaseObtainedTime REG_DWORD 1204444334 (0x47CA5CAE) > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\{6317C625-DA29-42BA-9ADD-C0C897993031}\Parameters\Tcpip LeaseObtainedTime REG_DWORD 1225988025 (0x491317B9) < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\{6317C625-DA29-42BA-9ADD-C0C897993031}\Parameters\Tcpip T1 REG_DWORD 1204487534 (0x47CB056E) > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\{6317C625-DA29-42BA-9ADD-C0C897993031}\Parameters\Tcpip T1 REG_DWORD 1226031225 (0x4913C079) < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\{6317C625-DA29-42BA-9ADD-C0C897993031}\Parameters\Tcpip T2 REG_DWORD 1204519934 (0x47CB83FE) > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\{6317C625-DA29-42BA-9ADD-C0C897993031}\Parameters\Tcpip T2 REG_DWORD 1226063625 (0x49143F09) < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\{6317C625-DA29-42BA-9ADD-C0C897993031}\Parameters\Tcpip LeaseTerminatesTime REG_DWORD 1204530734 (0x47CBAE2E) > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\{6317C625-DA29-42BA-9ADD-C0C897993031}\Parameters\Tcpip LeaseTerminatesTime REG_DWORD 1226074425 (0x49146939) Result compared: Different -----Comparing registry keys CCS1 vs CCS3 ----- < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\aawservice > Value: HKEY_LOCAL_MACHINE\system\controlset003\services\aswTdi DisplayName REG_SZ avast! Network Shield Support > Value: HKEY_LOCAL_MACHINE\system\controlset003\services\aswTdi ErrorControl REG_DWORD 1 (0x1) > Value: HKEY_LOCAL_MACHINE\system\controlset003\services\aswTdi Type REG_DWORD 1 (0x1) > Value: HKEY_LOCAL_MACHINE\system\controlset003\services\aswTdi Group REG_SZ PNP_TDI > Value: HKEY_LOCAL_MACHINE\system\controlset003\services\aswTdi Start REG_DWORD 1 (0x1) > Value: HKEY_LOCAL_MACHINE\system\controlset003\services\aswTdi DependOnService REG_MULTI_SZ tcpip\0\0 > Value: HKEY_LOCAL_MACHINE\system\controlset003\services\aswTdi Tag REG_DWORD 9 (0x9) < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\aswTdi\Parameters ProviderStart REG_DWORD 3 (0x3) > Value: HKEY_LOCAL_MACHINE\system\controlset003\services\aswTdi\Parameters ProviderStart REG_DWORD 1 (0x1) < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\AVG Anti-Spyware Driver < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\AVG Anti-Spyware Guard < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\AvgAsCln < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\AVP < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\BITS Start REG_DWORD 3 (0x3) > Value: HKEY_LOCAL_MACHINE\system\controlset003\services\BITS Start REG_DWORD 2 (0x2) < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\Dhcp\Parameters {6317C625-DA29-42BA-9ADD-C0C897993031} REG_BINARY 1A0000000000000002000000000000002EAECB4705D40000060000000000000008000000000000002EAECB473E0410463E041145030000000000000004000000000000002EAECB47C0A801010F0000000000000005000000000000002EAECB476C6F63616C000000330000000000000004000000000000002EAECB4700015180010000000000000004000000000000002EAECB47FFFFFF00360000000000000004000000000000002EAECB47C0A80101350000000000000001000000000000002EAECB4705000000 > Value: HKEY_LOCAL_MACHINE\system\controlset003\services\Dhcp\Parameters {6317C625-DA29-42BA-9ADD-C0C897993031} REG_BINARY 1A000000000000000200000000000000F45F144905D4000006000000000000000800000000000000F45F1449D043DEDED043DCDC03000000000000000400000000000000F45F1449C0A801010F000000000000000500000000000000F45F14496C6F63616C00000033000000000000000400000000000000F45F14490001518001000000000000000400000000000000F45F1449FFFFFF0036000000000000000400000000000000F45F1449C0A8010135000000000000000100000000000000F45F144905000000 > Value: HKEY_LOCAL_MACHINE\system\controlset003\services\Eventlog\Security\DS > Value: HKEY_LOCAL_MACHINE\system\controlset003\services\Eventlog\Security\LSA > Value: HKEY_LOCAL_MACHINE\system\controlset003\services\Eventlog\Security\NetDDE Object > Value: HKEY_LOCAL_MACHINE\system\controlset003\services\Eventlog\Security\SC Manager > Value: HKEY_LOCAL_MACHINE\system\controlset003\services\Eventlog\Security\Security > Value: HKEY_LOCAL_MACHINE\system\controlset003\services\Eventlog\Security\Security Account Manager > Value: HKEY_LOCAL_MACHINE\system\controlset003\services\Eventlog\Security\Spooler < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\Eventlog\System Sources REG_MULTI_SZ WZCSVC\0Workstation\0WindowsMedia\0Windows Update Agent\0Windows Script Host\0Windows Installer 3.1\0Windows File Protection\0Win32k\0W32Time\0VolSnap\0viaide\0VgaSave\0USER32\0UPS\0ultra\0udfs\0toside\0TermServSessDir\0TermService\0TermServDevices\0TermDD\0tdi\0TCPMon\0Tcpip\0System Error\0sym_u3\0sym_hi\0symc8xx\0symc810\0StillImage\0SSDPSRV\0Srv\0srservice\0sr\0sparrow\0sndblst\0Simbad\0SideBySide\0sfloppy\0Setup\0Service de stockage amovible\0Service Control Manager\0Server\0serial\0scsiport\0Schedule\0Schannel\0SCardSvr\0Save Dump\0SAM\0RTL8023xp\0RSVP\0RemoteAccess\0redbook\0Rdbss\0RasMan\0RasAuto\0ql1280\0ql1240\0ql12160\0ql10wnt\0ql1080\0PSched\0Print\0PptpMiniport\0PolicyAgent\0PlugPlayManager\0perc2\0pcmcia\0pciide\0pci\0parvdm\0partmgr\0parport\0OSPFMib\0OSPF\0null\0NtServicePack\0ntfs\0npfs\0Nla\0NIC1394\0Netlogon\0NetDDE\0NetBT\0NetBIOS\0NdisWan\0NdisIP\0ndis\0Mup\0msfs\0msadlib\0MrxSmb\0MRxDAV\0mraid35x\0mouhid\0mouclass\0Modem\0LsaSrv\0LmHosts\0LDMS\0LDM\0lbrtfdc\0Kerberos\0kbdhid\0kbdclass\0isapnp\0irsir\0IPXSAP\0IPXRouterManager\0IPXRIP\0IPXCP\0IPSec\0IPRouterManager\0IPRIP2\0IPNATHLP\0IPMGM\0IPBOOTP\0intelppm\0intelide\0ini910u\0IGMPv2\0i8042prt\0i2omp\0i2omgmt\0Http\0hpn\0ftdisk\0fs_rec\0flpydisk\0Fips\0fdc\0fastfat\0eventlog\0efs\0dpti2o\0Dnscache\0Dnsapi\0dmio\0dmboot\0Distributed Link Tracking Client\0disk\0Dhcp\0DfsSvc\0DfsDriver\0DCOM\0dac960nt\0dac2w2k\0cpqarray\0cmdide\0changer\0cdrom\0Cdm\0cdfs\0cdaudio\0cd20xrnt\0cbidf2k\0Browser\0BITS\0beep\0Atmarpc\0ati2mtag\0Ati HotKey Poller\0atdisk\0atapi\0AsyncMac\0asc3550\0asc3350p\0asc\0Arp1394\0Application Popup\0apphelp\0amsint\0ami0nt\0aliide\0Alerter\0aic78xx\0aic78u2\0aha154x\0adpu160m\0acpiec\0acpi\0abp480n5\0abiosdsk\0System\0\0 > Value: HKEY_LOCAL_MACHINE\system\controlset003\services\Eventlog\System Sources REG_MULTI_SZ WZCSVC\0Workstation\0WindowsMedia\0Windows Update Agent\0Windows Script Host\0Windows Installer 3.1\0Windows File Protection\0Win32k\0W32Time\0VolSnap\0viaide\0VgaSave\0USER32\0UPS\0ultra\0udfs\0toside\0TermServSessDir\0TermService\0TermServDevices\0TermDD\0tdi\0TCPMon\0Tcpip\0System Error\0sym_u3\0sym_hi\0symc8xx\0symc810\0StillImage\0SSDPSRV\0Srv\0srservice\0sr\0sparrow\0sndblst\0Simbad\0SideBySide\0sfloppy\0Setup\0Service de stockage amovible\0Service Control Manager\0Server\0serial\0scsiport\0Schedule\0Schannel\0SCardSvr\0Save Dump\0SAM\0RTL8023xp\0RSVP\0RemoteAccess\0redbook\0Rdbss\0RasMan\0RasAuto\0ql1280\0ql1240\0ql12160\0ql10wnt\0ql1080\0PSched\0Print\0PptpMiniport\0PolicyAgent\0PlugPlayManager\0perc2\0pcmcia\0pciide\0pci\0parvdm\0partmgr\0parport\0OSPFMib\0OSPF\0null\0NtServicePack\0ntfs\0npfs\0Nla\0NIC1394\0Netlogon\0NetDDE\0NetBT\0NetBIOS\0NdisWan\0NdisIP\0ndis\0Mup\0msfs\0msadlib\0MrxSmb\0MRxDAV\0mraid35x\0mouhid\0mouclass\0Modem\0LsaSrv\0LmHosts\0LDMS\0LDM\0lbrtfdc\0Kerberos\0kbdhid\0kbdclass\0isapnp\0irsir\0IPXSAP\0IPXRouterManager\0IPXRIP\0IPXCP\0IPSec\0IPRouterManager\0IPRIP2\0IPNATHLP\0IPMGM\0IPBOOTP\0Internet Explorer 7 Disk\0intelppm\0intelide\0ini910u\0IGMPv2\0i8042prt\0i2omp\0i2omgmt\0Http\0hpn\0ftdisk\0fs_rec\0flpydisk\0Fips\0fdc\0fastfat\0eventlog\0efs\0dpti2o\0Dnscache\0Dnsapi\0dmio\0dmboot\0Distributed Link Tracking Client\0disk\0Dhcp\0DfsSvc\0DfsDriver\0DCOM\0dac960nt\0dac2w2k\0cpqarray\0cmdide\0changer\0cdrom\0Cdm\0cdfs\0cdaudio\0cd20xrnt\0cbidf2k\0Browser\0BITS\0beep\0Atmarpc\0ati2mtag\0Ati HotKey Poller\0atdisk\0atapi\0AsyncMac\0asc3550\0asc3350p\0asc\0Arp1394\0Application Popup\0apphelp\0amsint\0ami0nt\0aliide\0Alerter\0aic78xx\0aic78u2\0aha154x\0adpu160m\0acpiec\0acpi\0abp480n5\0abiosdsk\0System\0\0 < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\kl1 < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\klif < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\lanmanserver\parameters Guid REG_BINARY 5004971301681449958DAA43046B5866 > Value: HKEY_LOCAL_MACHINE\system\controlset003\services\lanmanserver\parameters Guid REG_BINARY 0C479EC6F0F996478B4B2AB36A79A4DE > Value: HKEY_LOCAL_MACHINE\system\controlset003\services\MRxDAV\EncryptedDirectories < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\PerfDisk\Performance WbemAdapFileSignature REG_BINARY 97F41DFEE99BC2AE60BAD78679FB40A1 < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\PerfDisk\Performance WbemAdapFileTime REG_BINARY 0020E7D4F03DC601 < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\PerfDisk\Performance WbemAdapFileSize REG_DWORD 27136 (0x6A00) < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\PerfDisk\Performance WbemAdapStatus REG_DWORD 0 (0x0) < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\PerfNet\Performance WbemAdapFileSignature REG_BINARY 7FD03F93453FAFBABB6E29B11E9E731C < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\PerfNet\Performance WbemAdapFileTime REG_BINARY 0020E7D4F03DC601 < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\PerfNet\Performance WbemAdapFileSize REG_DWORD 17408 (0x4400) < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\PerfNet\Performance WbemAdapStatus REG_DWORD 0 (0x0) < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\SharedAccess\Epoch Epoch REG_DWORD 8851 (0x2293) > Value: HKEY_LOCAL_MACHINE\system\controlset003\services\SharedAccess\Epoch Epoch REG_DWORD 9316 (0x2464) > Value: HKEY_LOCAL_MACHINE\system\controlset003\services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List %windir%\Network Diagnostic\xpnetdiag.exe REG_SZ %windir%\Network Diagnostic\xpnetdiag.exe:*:Enaxxxxx@xxxxxres.dll,-20000 > Value: HKEY_LOCAL_MACHINE\system\controlset003\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\kav\kis7.0\french\setup.exe REG_SZ C:\kav\kis7.0\french\setup.exe:*:Enabled:Programme d'installation de Kaspersky Internet Security 7.0 > Value: HKEY_LOCAL_MACHINE\system\controlset003\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\kav\kav7.0\french\setup.exe REG_SZ C:\kav\kav7.0\french\setup.exe:*:Enabled:Programme d'installation de Kaspersky Anti-Virus 7.0 > Value: HKEY_LOCAL_MACHINE\system\controlset003\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List %windir%\Network Diagnostic\xpnetdiag.exe REG_SZ %windir%\Network Diagnostic\xpnetdiag.exe:*:Enaxxxxx@xxxxxres.dll,-20000 < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\Spooler\Performance WbemAdapFileSignature REG_BINARY E415A3D071D315CD84F6F593A3A060B3 < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\Spooler\Performance WbemAdapFileTime REG_BINARY 0020E7D4F03DC601 < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\Spooler\Performance WbemAdapFileSize REG_DWORD 146944 (0x23E00) < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\Spooler\Performance WbemAdapStatus REG_DWORD 0 (0x0) < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\sr Start REG_DWORD 0 (0x0) > Value: HKEY_LOCAL_MACHINE\system\controlset003\services\sr Start REG_DWORD 4 (0x4) < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\sr ImagePath REG_EXPAND_SZ system32\DRIVERS\sr.sys > Value: HKEY_LOCAL_MACHINE\system\controlset003\services\sr ImagePath REG_EXPAND_SZ \SystemRoot\system32\DRIVERS\sr.sys < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\sr\Parameters FirstRun REG_DWORD 0 (0x0) > Value: HKEY_LOCAL_MACHINE\system\controlset003\services\sr\Parameters FirstRun REG_DWORD 1 (0x1) < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\TapiSrv\Performance WbemAdapFileSignature REG_BINARY 0483F001E58AF7EA90B23BA9ACB367D3 < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\TapiSrv\Performance WbemAdapFileTime REG_BINARY 0020E7D4F03DC601 < Value: HKEY_LOCAL_MACHINE\system\controlset001\se

Sophie · Answer

Jte l'ai envoyer en 2 partie j'ai eu du mal a poster le message :)

Utilisateur anonyme · Answer

Re , oui mais la , tu m'en a envoyé en 10 exemplaires ...

donc je disais ...

a++

Sophie · Answer

desoler de te l'avoir envoyer en plusieur fois mais mon ordi plante est jpenser ke sa te lenvoyer po :)

Sa a pas marcher??? peut tu me redonner les instruction jsuis un peu perdu du coup lol...

Mici d'avance de ta patience :)

Utilisateur anonyme · Answer

Re , 
ceci :



/!\ Manip crée spécialement pour cet utilisateur , ne pas reproduire chez soi ... /!\

Crée un nouveau document texte : clic droit de souris sur le bureau, "Nouveau"> "Document Texte". Ouvre-le et copie-colle dedans de ce qui est en citation en gras ci-dessous, (copie tout d'un trait) : ( y compris Regedit4, et la ligne vide en dessous )

REGEDIT4

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"MySpaceIM"=-
[HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Run]
"MySpaceIM"=-
[HKLM\Software\Microsoft\Windows\CurrentVersion\Run]
"Alcmtr"=-
"devenv"=-




Puis "fichier" -> "enregistrer sous" :
dans : sur le bureau
Nom du fichier : fix.reg
Type de fichier : "tous les fichiers"
clique sur "enregistrer"

Cela doit ressembler à ça

Double clique sur fix.reg 

&#8594; tu dois OBLIGATOIREMENT* avoir un message "voulez-vous vraiment ajouter les informations contenues dans ce fichier .reg au registre ?"
Si c'est bien le cas, clique sur "oui" 

*Prevenir si le message n'apparait pas.

Sophie · Answer

Re,

mais je l'ai fais ca et j'ai bien sur mon bureau licone fix.reg

J(ai eu le message aussi :)

Utilisateur anonyme · Answer

Re ,

Clique droit sur fix.reg > modifier > copie/colle le contenu ici.

a++

Sophie · Answer

REGEDIT4 

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 
"MySpaceIM"=- 
[HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Run] 
"MySpaceIM"=- 
[HKLM\Software\Microsoft\Windows\CurrentVersion\Run] 
"Alcmtr"=- 
"devenv"=-

Utilisateur anonyme · Answer

Re ,

au temps pour moi ..
supprime le fix.reg.

Recommence le  avec :

REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"MySpaceIM"=-
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"Alcmtr"=-
"devenv"=-

Reposte un system scan en ne cochant QUE Registry run keys

A++

Sophie · Answer

SystemScan - www.suspectfile.com - ver. 3.5.5 (code: holifay & bReAkdOWn) Running on: Windows XP HOME Edition, Service Pack 2 (2600.5.1) System directory: C:\WINDOWS SystemScan file: C:\Documents and Settings\Propriétaire\Local Settings\Temporary Internet Files\Content.IE5\CD9FG9R0\sys11839[1].exe Running in: User mode Date: 07/11/2008 Time: 10:50:48 Output limited to: -Registry Run Keys ===================== REGISTRY SCAN ===================== -----HKLM\Software\Microsoft\Windows\CurrentVersion\Run----- [Run] "ATICCC"="\"C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe\"" "NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" "MAFWTaskbarApp"="C:\WINDOWS\system32\MAFWTray.exe" "RTHDCPL"="RTHDCPL.EXE" "SkyTel"="SkyTel.EXE" "PKR Pal"="\"C:\Program Files\PKR\pkrpal.exe\" -osboot" "H2O"="C:\Program Files\SyncroSoft\Pos\H2O\cledx.exe" "FLMOFFICE4DMOUSE"="C:\Program Files\Trust\DS-4500X Wireless Laser Deskset\Mouse\mouse32a.exe" "OFFICEKB"="C:\Program Files\Trust\DS-4500X Wireless Laser Deskset\Keyboard\kbdap32a.EXE" "avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [Run\avp6_post_uninstall] [Run\OptionalComponents] @="" [Run\OptionalComponents\IMAIL] "Installed"="1" @="" [Run\OptionalComponents\MAPI] "NoChange"="1" "Installed"="1" @="" [Run\OptionalComponents\MSFS] "Installed"="1" @="" -----HKCU\Software\Microsoft\Windows\CurrentVersion\Run----- [Run] "MsnMsgr"="\"C:\Program Files\MSN Messenger\MsnMsgr.Exe\" /background" "SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" "SUPERAntiSpyware"="C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe" "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" -----HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Run----- [Run] -----HKLM\Software\Microsoft\Windows\CurrentVersion\policies\Explorer\Run----- [Run] -----HKCU\Software\Microsoft\Windows\CurrentVersion\policies\Explorer\Run----- [Run] -----HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows----- [Windows] "AppInit_DLLs"="" -----HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad----- [ShellServiceObjectDelayLoad] "PostBootReminder"="{7849596a-48ea-486e-8937-a2a3009f31a9}" #### HKCR\CLSID\{7849596a-48ea-486e-8937-a2a3009f31a9}\InprocServer32 @=expand:"%SystemRoot%\system32\SHELL32.dll" "CDBurn"="{fbeb8a05-beee-4442-804e-409d6c4515e9}" #### HKCR\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InprocServer32 @=expand:"%SystemRoot%\system32\SHELL32.dll" "WebCheck"="{E6FB5E20-DE35-11CF-9C87-00AA005127ED}" #### HKCR\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\InprocServer32 @=expand:"C:\WINDOWS\system32\webcheck.dll" "SysTray"="{35CEC8A3-2BE6-11D2-8773-92E220524153}" #### HKCR\CLSID\{35CEC8A3-2BE6-11D2-8773-92E220524153}\InprocServer32 @="C:\WINDOWS\system32\stobject.dll" -----HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks----- [ShellExecuteHooks] "{AEB6717E-7E19-11d0-97EE-00C04FD91972}"="" #### HKCR\CLSID\{AEB6717E-7E19-11d0-97EE-00C04FD91972}\InprocServer32 @="shell32.dll" -----HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon----- [Winlogon] "Shell"="Explorer.exe" "System"="" "Userinit"="C:\WINDOWS\system32\userinit.exe," "VmApplet"="rundll32 shell32,Control_RunDLL \"sysdm.cpl\"" "UIHost"=expand:"logonui.exe" "LogonType"=dword:00000001 "WinStationsDisabled"="0" [Winlogon\GPExtensions] [Winlogon\GPExtensions\{3610eda5-77ef-11d2-8dc5-00c04fa31a66}] "@="Quota du disque Microsoft" "DllName"=expand:"dskquota.dll" [Winlogon\GPExtensions\{4CFB60C1-FAA6-47f1-89AA-0B18730C9FD3}] "@="Internet Explorer Zonemapping" "DllName"=expand:"iedkcs32.dll" [Winlogon\GPExtensions\{827D319E-6EAC-11D2-A4EA-00C04F79F83A}] "DllName"=expand:"scecli.dll" "@="Security" [Winlogon\GPExtensions\{A2E30F80-D7DE-11d2-BBDE-00C04F86AE3B}] "DllName"="iedkcs32.dll" "@="Internet Explorer Branding" [Winlogon\GPExtensions\{B1BE8D72-6EAC-11D2-A4EA-00C04F79F83A}] "DllName"=expand:"scecli.dll" "@="EFS recovery" [Winlogon\GPExtensions\{C631DF4C-088F-4156-B058-4375F0853CD8}] "@="Microsoft Offline Files" "DllName"=expand:"%SystemRoot%\System32\cscui.dll" [Winlogon\GPExtensions\{c6dc5466-785a-11d2-84d0-00c04fb169f7}] "@="Installation de logiciel" "DllName"=expand:"appmgmts.dll" [Winlogon\Notify] [Winlogon\Notify\!SASWinLogon] [Winlogon\Notify\AtiExtEvent] "DLLName"="Ati2evxx.dll" [Winlogon\Notify\crypt32chain] "DllName"=expand:"crypt32.dll" [Winlogon\Notify\cryptnet] "DllName"=expand:"cryptnet.dll" [Winlogon\Notify\cscdll] "DLLName"="cscdll.dll" [Winlogon\Notify\ScCertProp] "DLLName"="wlnotify.dll" [Winlogon\Notify\Schedule] "DllName"=expand:"wlnotify.dll" [Winlogon\Notify\sclgntfy] "DllName"=expand:"sclgntfy.dll" [Winlogon\Notify\SensLogn] "DLLName"="WlNotify.dll" [Winlogon\Notify ermsrv] "DllName"=expand:"wlnotify.dll" [Winlogon\Notify\wlballoon] "DLLName"="wlnotify.dll" [Winlogon\SpecialAccounts] [Winlogon\SpecialAccounts\UserList] "HelpAssistant"=dword:00000000 "TsInternetUser"=dword:00000000 "SQLAgentCmdExec"=dword:00000000 "NetShowServices"=dword:00000000 "IWAM_"=dword:00010000 "IUSR_"=dword:00010000 "VUSR_"=dword:00010000 -----HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon----- [Winlogon] "ParseAutoexec"="1" "ExcludeProfileDirs"="Local Settings;Temporary Internet Files;Historique;Temp" "BuildNumber"=dword:00000a28 -----HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options----- [Image File Execution Options\Your Image File Name Here without a path] "Debugger"="ntsd -d" -----HKLM\System\CurrentControlSet\Control\Session Manager\----- [Session Manager] "BootExecute"=multi:"autocheck autochk *\00\00" [Session Manager\SubSystems] "Windows"=expand:"%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,3072,512 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ProfileControl=Off MaxRequestThreads=16" -----HKLM\SYSTEM\CurrentControlSet\Control\WOW----- [WOW] "cmdline"=expand:"%SystemRoot%\system32 tvdm.exe" "wowcmdline"=expand:"%SystemRoot%\system32 tvdm.exe -a %SystemRoot%\system32\krnl386" -----HKLM\Software\Microsoft\Windows NT\CurrentVersion\Run----- [run] -----HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce----- [RunOnce] -----HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx----- [RunOnceEx] -----HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices----- [RunServices] -----HKLM\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce----- [RunServicesOnce] -----HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce----- [RunOnce] -----HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnceEx----- -----HKCU\Software\Microsoft\Windows\CurrentVersion\RunServices----- [RunServices] -----HKCU\Software\Microsoft\Windows NT\CurrentVersion\Run----- -----HKCU\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce----- [RunServicesOnce] -----HKLM\Software\Microsoft\Command Processor\Autorun----- -----HKCU\Software\Microsoft\Command Processor\Autorun----- -----HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows\Load----- -----HKLM\Software\Policies\Microsoft\Windows\System\Scripts\Startup----- -----HKCU\Software\Policies\Microsoft\Windows\System\Scripts\Logon----- -----HKLM\Software\Policies\Microsoft\Windows\System\Scripts\Logon----- -----HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\TerminalServer\Install\Software\Microsoft\Windows\CurrentVersion\Runonce----- -----HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\TerminalServer\Install\Software\Microsoft\Windows\CurrentVersion\Run----- -----HKLM\System\CurrentControlSet\Control\Terminal Server\Wds dpwd\StartupPrograms----- -----HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\TerminalServer\Install\Software\Microsoft\Windows\CurrentVersion\Runonce----- -----HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler----- [SharedTaskScheduler] "{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Pré-chargeur Browseui" #### HKCR\CLSID\{438755C2-A8BA-11D1-B96B-00A0C90312E1}\InprocServer32 @=expand:"%SystemRoot%\system32\browseui.dll" "{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Démon de cache des catégories de composant" #### HKCR\CLSID\{8C7461EF-2B13-11d2-BE35-3078302C2030}\InprocServer32 @=expand:"%SystemRoot%\system32\browseui.dll" -----HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects----- [Browser Helper Objects] @="" [Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}] @="" [Browser Helper Objects\{53707962-6F74-2D53-2644-206D7942484F}] #### HKCR\CLSID\{53707962-6F74-2D53-2644-206D7942484F}\InprocServer32 @="C:\PROGRA~1\SPYBOT~1\SDHelper.dll" [Browser Helper Objects\{7009fcd4-05be-44f4-9583-93fe419ab7b0}] #### HKCR\CLSID\{7009fcd4-05be-44f4-9583-93fe419ab7b0}\InprocServer32 @="C:\Program Files\Multi_Media_France bMul0.dll" @="" [Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}] #### HKCR\CLSID\{9030D464-4C02-4ABF-8ECC-5164760863C6}\InprocServer32 @="C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll" -----HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks----- [URLSearchHooks] "{CFBFAE00-17A6-11D0-99CB-00C04FD64497}"="" #### HKCR\CLSID\{CFBFAE00-17A6-11D0-99CB-00C04FD64497}\InprocServer32 @="C:\WINDOWS\system32\ieframe.dll" -----HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig----- -----HKCU\Control Panel\Desktop\----- [Desktop] "SCRNSAVE.EXE"="C:\WINDOWS\system32\ssstars.scr" [Desktop\WindowMetrics] -----HKEY_CLASSES_ROOT\exefile\shell\open\command----- [command] @="\"%1\" %*" -----HKEY_CLASSES_ROOT\comfile\shell\open\command----- [command] @="\"%1\" %*" -----HKEY_CLASSES_ROOT\batfile\shell\open\command----- [command] @="\"%1\" %*" -----HKEY_CLASSES_ROOT\piffile\shell\open\command----- [command] @="\"%1\" %*" -----HKEY_CLASSES_ROOT\scrFile\shell\open\command----- [command] @="\"%1\" %*" -----HKEY_CLASSES_ROOT\htafile\shell\open\command----- [Command] @="C:\WINDOWS\system32\mshta.exe \"%1\" %*" -----HKEY_CLASSES_ROOT\logfile\shell\open\command----- -----HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\URL----- [URL] [URL\DefaultPrefix] @="http://" [URL\Prefixes] "ftp"="ftp://" "gopher"="gopher://" "home"="http://" "mosaic"="http://" "www"="http://" -----HKLM\SYSTEM\CurrentControlSet\Control\Lsa----- [Lsa] [Lsa\AccessProviders] [Lsa\AccessProviders\Windows NT Access Provider] "ProviderPath"=expand:"%SystemRoot%\system32 tmarta.dll" [Lsa\Audit] [Lsa\Audit\PerUserAuditing] [Lsa\Audit\PerUserAuditing\System] [Lsa\Data] [Lsa\SSO] [Lsa\SSO\Passport1.4] "SSOURL"="http://www.passport.com" [Lsa\SspiCache] [Lsa\SspiCache\digest.dll] "Name"="Digest" "Comment"="Digest SSPI Authentication Package" [Lsa\SspiCache\msapsspc.dll] "Name"="DPA" "Comment"="DPA Security Package" [Lsa\SspiCache\msnsspc.dll] "Name"="MSN" "Comment"="MSN Security Package" -----HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess----- [SharedAccess] "DependOnGroup"=multi:"\00" "DependOnService"=multi:"Netman\00WinMgmt\00\00" "Description"="Assure la traduction d'adresses de réseau, l'adressage, les services de résolution de noms et/ou les services de prévention d'intrusion pour un réseau de petite entreprise ou un réseau domestique." "DisplayName"="Pare-feu Windows / Partage de connexion Internet" "ErrorControl"=dword:00000001 "ImagePath"=expand:"%SystemRoot%\system32\svchost.exe -k netsvcs" "ObjectName"="LocalSystem" "Start"=dword:00000002 "Type"=dword:00000020 [SharedAccess\Epoch] "Epoch"=dword:0000249e [SharedAccess\Parameters] "ServiceDll"=expand:"%SystemRoot%\System32\ipnathlp.dll" [SharedAccess\Parameters\FirewallPolicy] [SharedAccess\Parameters\FirewallPolicy\DomainProfile] [SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications] [SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List] "%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enaxxxxx@xxxxxres.dll,-22019" "C:\Program Files\MSN Messenger\msnmsgr.exe"="C:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1" "C:\Program Files\MSN Messenger\livecall.exe"="C:\Program Files\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)" "%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enaxxxxx@xxxxxres.dll,-20000" [SharedAccess\Parameters\FirewallPolicy\StandardProfile] "EnableFirewall"=dword:00000001 "DoNotAllowExceptions"=dword:00000000 [SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications] [SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] "%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enaxxxxx@xxxxxres.dll,-22019" "C:\Program Files\eMule\emule.exe"="C:\Program Files\eMule\emule.exe:*:Enabled:eMule" "C:\Program Files\MSN Messenger\msnmsgr.exe"="C:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1" "C:\Program Files\MSN Messenger\livecall.exe"="C:\Program Files\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)" "C:\Program Files\Resolume 2.41 esolume.exe"="C:\Program Files\Resolume 2.41 esolume.exe:*:Enabled:Resolume 2.41" "C:\Program Files\Messenger\msmsgs.exe"="C:\Program Files\Messenger\msmsgs.exe:*:Enabled:Windows Messenger" "C:\Documents and Settings\Propriétaire\Local Settings\Temp\Rar$EX02.937\emule.exe"="C:\Documents and Settings\Propriétaire\Local Settings\Temp\Rar$EX02.937\emule.exe:*:Disabled:eMule" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\0exinjs.aa.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\0exinjs.aa.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\22exinjs.aa.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\22exinjs.aa.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\23exinjs.aa.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\23exinjs.aa.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\83exinjs.aa.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\83exinjs.aa.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\86exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\86exinjs.ab.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\82exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\82exinjs.ab.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\42exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\42exinjs.ab.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\98exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\98exinjs.ab.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\36exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\36exinjs.ab.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\59exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\59exinjs.ab.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\49exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\49exinjs.ab.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\73exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\73exinjs.ab.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\75exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\75exinjs.ab.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\8exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\8exinjs.ab.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\47exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\47exinjs.ab.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\20exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\20exinjs.ab.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\78exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\78exinjs.ab.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\80exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\80exinjs.ab.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\74exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\74exinjs.ab.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\18exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\18exinjs.ab.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\64exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\64exinjs.ab.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\57exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\57exinjs.ab.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\92exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\92exinjs.ab.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\11exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\11exinjs.ab.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\50exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\50exinjs.ab.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\43exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\43exinjs.ab.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\95exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\95exinjs.ab.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\52exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\52exinjs.ab.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\23exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\23exinjs.ab.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\6exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\6exinjs.ab.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\39exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\39exinjs.ab.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\68exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\68exinjs.ab.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\61exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\61exinjs.ab.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\26exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\26exinjs.ab.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\34exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\34exinjs.ab.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\19exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\19exinjs.ab.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\32exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\32exinjs.ab.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\14exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\14exinjs.ab.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\60exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\60exinjs.ab.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\29exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\29exinjs.ab.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\66exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\66exinjs.ab.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\99exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\99exinjs.ab.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\54exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\54exinjs.ab.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\94exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\94exinjs.ab.exe:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\85exinjs.ab.exe"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\85exinjs.ab.exe:*:Enabled:Microsoft Update" "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe"="C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe:*:Disabled:Kaspersky Anti-Virus" "C:\Program Files\uTorrent\uTorrent.exe"="C:\Program Files\uTorrent\uTorrent.exe:*:Enabled:µTorrent" "C:\Program Files\BitDownload\BitDownload.exe"="C:\Program Files\BitDownload\BitDownload.exe:*:Enabled:Torrent P2P application" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\16ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\16ex:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\25ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\25ex:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\35ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\35ex:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\43ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\43ex:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\58ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\58ex:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\26ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\26ex:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\87ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\87ex:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\60ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\60ex:*:Enabled:Microsoft Update" "C:\Program Files\Ahead\Nero ShowTime\ShowTime.exe"="C:\Program Files\Ahead\Nero ShowTime\ShowTime.exe:*:Enabled:Nero ShowTime" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\44ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\44ex:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\50ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\50ex:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\7ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\7ex:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\42ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\42ex:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\3ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\3ex:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\21ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\21ex:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\40ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\40ex:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\2ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\2ex:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\4ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\4ex:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\65ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\65ex:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\37ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\37ex:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\31ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\31ex:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\72ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\72ex:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\92ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\92ex:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\68ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\68ex:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\45ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\45ex:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\96ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\96ex:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\33ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\33ex:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\79ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\79ex:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\10ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\10ex:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\22ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\22ex:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\55ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\55ex:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\66ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\66ex:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\94ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\94ex:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\52ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\52ex:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\0ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\0ex:*:Enabled:Microsoft Update" "C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\63ex"="C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp\63ex:*:Enabled:Microsoft Update" "C:\Documents and Settings\Propriétaire\Local Settings\Temp\10exmdnk23.exe"="C:\Documents and Settings\Propriétaire\Local Settings\Temp\10exmdnk23.exe:*:Disabled:10exmdnk23" "C:\Documents and Settings\Propriétaire\Local Settings\Temp\33exmdnk25.exe"="C:\Documents and Settings\Propriétaire\Local Settings\Temp\33exmdnk25.exe:*:Disabled:33exmdnk25" "C:\Documents and Settings\Propriétaire\Local Settings\Temp\0exmdnk26.exe"="C:\Documents and Settings\Propriétaire\Local Settings\Temp\0exmdnk26.exe:*:Disabled:0exmdnk26" "C:\Documents and Settings\Propriétaire\Local Settings\Temp\58exmdnk30.exe"="C:\Documents and Settings\Propriétaire\Local Settings\Temp\58exmdnk30.exe:*:Disabled:58exmdnk30" "C:\kav\kis7.0\french\setup.exe"="C:\kav\kis7.0\french\setup.exe:*:Enabled:Programme d'installation de Kaspersky Internet Security 7.0" "C:\kav\kav7.0\french\setup.exe"="C:\kav\kav7.0\french\setup.exe:*:Enabled:Programme d'installation de Kaspersky Anti-Virus 7.0" "%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enaxxxxx@xxxxxres.dll,-20000" [SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts] [SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List] "1900:UDP"="1900:UDP:LocalSubNet:Disaxxxxx@xxxxxres.dll,-22007" "2869:TCP"="2869:TCP:LocalSubNet:Disaxxxxx@xxxxxres.dll,-22008" "17053:TCP"="17053:TCP:*:Enabled:NortonAV" "12192:TCP"="12192:TCP:*:Enabled:NortonAV" [SharedAccess\Setup] "ServiceUpgrade"=dword:00000001 [SharedAccess\Setup\InterfacesUnfirewalledAtUpdate] "All"=dword:00000001 -----HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Firewall\----- -----HKEY_LOCAL_MACHINE\SOFTWARE\Winsock2----- -----HKLM\Software\Microsoft\Ole----- [Ole] "DefaultLaunchPermission"=hex:01,00,04,80,5c,00,00,00,6c,00,00,00,00,00,00,00,\ "MachineLaunchRestriction"=hex:01,00,04,80,48,00,00,00,58,00,00,00,00,00,00,00,\ "MachineAccessRestriction"=hex:01,00,04,80,44,00,00,00,54,00,00,00,00,00,00,00,\ "EnableDCOM"="Y" [Ole\AppCompat] [Ole\AppCompat\ActivationSecurityCheckExemptionList] "{A50398B8-9075-4FBF-A7A1-456BF21937AD}"="1" "{AD65A69D-3831-40D7-9629-9B0B50A93843}"="1" "{0040D221-54A1-11D1-9DE0-006097042D69}"="1" "{2A6D72F1-6E7E-4702-B99C-E40D3DED33C3}"="1" [Ole\NONREDIST] "System.EnterpriseServices.Thunk.dll"="" -----HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WindowsUpdate\AU\----- -----HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\----- [Security Center] "FirstRunDisabled"=dword:00000001 "AntiVirusDisableNotify"=dword:00000000 "FirewallDisableNotify"=dword:00000000 "UpdatesDisableNotify"=dword:00000000 "AntiVirusOverride"=dword:00000001 "FirewallOverride"=dword:00000000 [Security Center\Monitoring] [Security Center\Monitoring\AhnlabAntiVirus] [Security Center\Monitoring\ComputerAssociatesAntiVirus] [Security Center\Monitoring\KasperskyAntiVirus] [Security Center\Monitoring\McAfeeAntiVirus] [Security Center\Monitoring\McAfeeFirewall] [Security Center\Monitoring\PandaAntiVirus] [Security Center\Monitoring\PandaFirewall] [Security Center\Monitoring\SophosAntiVirus] [Security Center\Monitoring\SymantecAntiVirus] [Security Center\Monitoring\SymantecFirewall] [Security Center\Monitoring\TinyFirewall] [Security Center\Monitoring\TrendAntiVirus] [Security Center\Monitoring\TrendFirewall] [Security Center\Monitoring\ZoneLabsFirewall] -----HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore\----- [SystemRestore] "DisableSR"=dword:00000000 "CreateFirstRunRp"=dword:00000001 "DSMin"=dword:000000c8 "DSMax"=dword:00000190 "RPSessionInterval"=dword:00000000 "RPGlobalInterval"=dword:00015180 "RPLifeInterval"=dword:0076a700 "CompressionBurst"=dword:0000003c "TimerInterval"=dword:00000078 "DiskPercent"=dword:0000000c "ThawInterval"=dword:00000384 "RestoreDiskSpaceError"=dword:00000000 "RestoreStatus"=dword:00000000 "RestoreSafeModeStatus"=dword:00000001 [SystemRestore\Cfg] "DiskPercent"=dword:0000000c "MachineGuid"="{D88DDE61-D342-465C-AFF5-295FBD9AB56F}" [SystemRestore\SnapshotCallbacks] @="" -----HKEY_CURRENT_USER\Software\VB and VBA Program Settings----- [VB and VBA Program Settings] [VB and VBA Program Settings\CCleaner] [VB and VBA Program Settings\CCleaner\Options] -----HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\----- -----HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\AdvancedOptions----- [AdvancedOptions] -----HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\AdvancedOptions----- -----HKLM\Software\Microsoft\Active Setup\Installed Components----- [Installed Components] [Installed Components\<{12d0ed0d-0ee0-4f90-8827-78cefb8f4988}] "@="IE7 Uninstall Stub" "ComponentID"="IEUDINIT" "StubPath"="C:\WINDOWS\system32\ieudinit.exe" [Installed Components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}] #### HKCR\CLSID\{22d6f312-b0f6-11d0-94ab-0080c74c7e95}\InprocServer32 @="C:\WINDOWS\system32\wmpdxm.dll" "Stubpath"="C:\WINDOWS\inf\unregmp2.exe /ShowWMP" "@="Microsoft Windows Media Player" "ComponentID"="WMPACCESS" [Installed Components\>{26923b43-4d38-484f-9b9e-de460746276c}] "@="Internet Explorer" "ComponentID"="IEACCESS" "StubPath"="C:\WINDOWS\system32\ie4uinit.exe -UserIconConfig" [Installed Components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}] "@="Browser Customizations" "ComponentiD"="BRANDING.CAB" "StubPath"="RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP" [Installed Components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS] "@="Personnalisation du navigateur" "ComponentID"="BRANDING.CAB" "StubPath"="RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP" [Installed Components\>{881dd1c5-3dcf-431b-b061-f3f88e8be88a}] "@="Outlook Express" "ComponentID"="OEACCESS" "StubPath"=expand:"%systemroot%\system32\shmgrate.exe OCInstallUserConfigOE" [Installed Components\{0E92DD42-76F5-4EF2-B381-F9C1D72BE23D}] "@="Security Update for Microsoft .NET Framework 2.0 (KB922770)" "ComponentID"="KB922770" [Installed Components\{10072CEC-8CC1-11D1-986E-00A0C955B42F}] "@="Rendu VML (Vector Graphics Rendering)" "ComponentID"="MSVML" [Installed Components\{2179C5D3-EBFF-11CF-B6FD-00AA00B4E220}] #### HKCR\CLSID\{2179C5D3-EBFF-11CF-B6FD-00AA00B4E220}\InprocServer32 @="C:\WINDOWS\system32\wmpdxm.dll" "ComponentID"="NetShow" "StubPath"="" [Installed Components\{22d6f312-b0f6-11d0-94ab-0080c74c7e95}] #### HKCR\CLSID\{22d6f312-b0f6-11d0-94ab-0080c74c7e95}\InprocServer32 @="C:\WINDOWS\system32\wmpdxm.dll" "ComponentID"="Microsoft Windows Media Player" "StubPath"="" "@="Lecteur Windows Media Microsoft 6.4" [Installed Components\{283807B5-2C60-11D0-A31D-00AA00B92C03}] "@="DirectAnimation" "ComponentID"="DirectAnimation" [Installed Components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}] "@="Themes Setup" "ComponentID"="Theme Component" "StubPath"=expand:"%SystemRoot%\system32 egsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32 hemeui.dll" [Installed Components\{36f8ec70-c29a-11d1-b5c7-0000f8051515}] "@="Liaison de données Dynamic HTML pour Java" "ComponentID"="TridataJava" [Installed Components\{3919E8B8-A291-74E5-5DBF-8FB615E8FCED}] "@="Themes Setup" "ComponentID"="Theme Component" [Installed Components\{3af36230-a269-11d1-b5bf-0000f8051515}] "@="Offline Browsing Pack" "ComponentID"="MobilePk" [Installed Components\{3bf42070-b3b1-11d1-b5c5-0000f8051515}] "@="Uniscribe" "ComponentID"="USP10" [Installed Components\{411EDCF7-755D-414E-A74B-3DCD6583F589}] "ComponentID"="S867460" "@="Microsoft .NET Framework 1.1 Service Pack 1 (KB867460)" [Installed Components\{4278c270-a269-11d1-b5bf-0000f8051515}] "@="Création avancée" "ComponentID"="AdvAuth" [Installed Components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}] "@="Microsoft Outlook Express 6" "ComponentID"="MailNews" "StubPath"=expand:"\"%ProgramFiles%\Outlook Express\setup50.exe\" /APP:OE /CALLER:WINNT /user /install" [Installed Components\{44BBA842-CC51-11CF-AAFA-00AA00B6015B}] "@="NetMeeting 3.01" "ComponentID"="NetMeeting" "StubPath"="rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT" [Installed Components\{44BBA848-CC51-11CF-AAFA-00AA00B6015C}] "@="DirectShow" "ComponentID"="activemovie" [Installed Components\{44BBA855-CC51-11CF-AAFA-00AA00B6015F}] "@="DirectDrawEx" "ComponentID"="DirectDrawEx" [Installed Components\{45ea75a0-a269-11d1-b5bf-0000f8051515}] "@="Internet Explorer Help" "ComponentID"="HelpCont" [Installed Components\{4f216970-c90c-11d1-b5c7-0000f8051515}] "@="Classes Java DirectAnimation" "ComponentID"="DAJava" [Installed Components\{4f645220-306d-11d2-995d-00c04f98bbc9}] "@="Microsoft Windows Script 5.6" "ComponentID"="MSVBScript" [Installed Components\{5945c046-1e7d-11d1-bc44-00c04fd912be}] "KeyFileName"="C:\Program Files\Messenger\msmsgs.exe" "@="Windows Messenger 4.7" "ComponentID"="Messenger" "StubPath"="rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser" [Installed Components\{5A8D6EE0-3E18-11D0-821E-444553540000}] "(Default)"="Internet Connection Wizard" "ComponentID"="ICW" [Installed Components\{5fd399c0-a70a-11d1-9948-00c04f98bbc9}] "@="Internet Explorer Setup Tools" "ComponentID"="GenSetup" [Installed Components\{630b1da0-b465-11d1-9948-00c04f98bbc9}] "@="Browsing Enhancements" "ComponentID"="ExtraPack" "KeyFileName"="C:\WINDOWS\system32\msieftp.dll" [Installed Components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}] #### HKCR\CLSID\{6BF52A52-394A-11d3-B153-00C04F79FAA6}\InprocServer32 @="C:\WINDOWS\system32\wmp.dll" "@="Microsoft Windows Media Player" "ComponentID"="Microsoft Windows Media Player" "StubPath"="rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\wmp.inf,PerUserStub" [Installed Components\{6fab99d0-bab8-11d1-994a-00c04f98bbc9}] "@="MSN Site Access" "ComponentID"="MSN_Auth" [Installed Components\{7131646D-CD3C-40F4-97B9-CD9E4E6262EF}] "ComponentID"=".NETFramework" "@=".NET Framework" [Installed Components\{7790769C-0471-11d2-AF11-00C04FA35D02}] "@="Carnet d'adresses 6" "ComponentID"="WAB" "StubPath"=expand:"\"%ProgramFiles%\Outlook Express\setup50.exe\" /APP:WAB /CALLER:WINNT /user /install" [Installed Components\{8056AC9E-49C5-4375-9ADE-B2F862C9DF51}] "ComponentID"="KB928365" "@="Security Update for Microsoft .NET Framework 2.0 (KB928365)" [Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4340}] "@="Mise à jour du Bureau Windows" "ComponentID"="IE4Shell_NT" "StubPath"=expand:"regsvr32.exe /s /n /i:U shell32.dll" [Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4383}] "@="Internet Explorer" "ComponentID"="BASEIE40_W2K" "StubPath"="C:\WINDOWS\system32\ie4uinit.exe -BaseSettings" [Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4383}\AuthorizedCDFPrefix] [Installed Components\{89B4C1CD-B018-4511-B0A1-5476DBF70820}] "StubPath"="C:\WINDOWS\system32\Rundll32.exe C:\WINDOWS\system32\mscories.dll,Install" "ComponentID"="DOTNETFRAMEWORKS" [Installed Components\{8D1D0E9A-C799-4D28-9E29-0061D1E66E43}] "ComponentID"="M928366" "@="Microsoft .NET Framework 1.1 Hotfix (KB928366)" [Installed Components\{9381D8F2-0288-11D0-9501-00AA00B911A5}] "@="Dynamic HTML Data Binding" "ComponentID"="Tridata" [Installed Components\{967B098A-042D-4367-BAC9-8BC11684174F}] "@="Security Update for Microsoft .NET Framework 2.0 (KB917283)" "ComponentID"="KB917283" [Installed Components\{ACC563BC-4266-43f0-B6ED-9D38C4202C7E}] [Installed Components\{C9E9A340-D1F1-11D0-821E-444553540600}] "@="Internet Explorer Core Fonts" "ComponentID"="Fontcore" [Installed Components\{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}] "ComponentID"=".NETFramework" "@=".NET Framework" [Installed Components\{CC2A9BA0-3BDD-11D0-821E-444553540000}] "@="Planificateur de tâches" "ComponentID"="MSTASK" [Installed Components\{CDD7975E-60F8-41d5-8149-19E51D6F71D0}] "ComponentID"="Windows Movie Maker v2.1" [Installed Components\{D27CDB6E-AE6D-11cf-96B8-444553540000}] "@="Adobe Flash Player" "ComponentID"="Flash" [Installed Components\{de5aed00-a4bf-11d1-9948-00c04f98bbc9}] "@="HTML Help" "ComponentID"="HTMLHelp" [Installed Components\{E92B03AB-B707-11d2-9CBD-0000F87A369E}] "@="Active Directory Service Interface" "ComponentID"="ADSI" -----Comparing registry keys CCS1 vs CCS2 ----- < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\aawservice > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\aswTdi DisplayName REG_SZ avast! Network Shield Support > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\aswTdi ErrorControl REG_DWORD 1 (0x1) > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\aswTdi Type REG_DWORD 1 (0x1) > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\aswTdi Group REG_SZ PNP_TDI > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\aswTdi Start REG_DWORD 1 (0x1) > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\aswTdi DependOnService REG_MULTI_SZ tcpip\0\0 > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\aswTdi Tag REG_DWORD 9 (0x9) < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\aswTdi\Parameters ProviderStart REG_DWORD 3 (0x3) > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\aswTdi\Parameters ProviderStart REG_DWORD 1 (0x1) < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\AVG Anti-Spyware Driver < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\AVG Anti-Spyware Guard < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\AvgAsCln < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\AVP < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\BITS Start REG_DWORD 3 (0x3) > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\BITS Start REG_DWORD 2 (0x2) < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\Dhcp\Parameters {6317C625-DA29-42BA-9ADD-C0C897993031} REG_BINARY 1A0000000000000002000000000000002EAECB4705D40000060000000000000008000000000000002EAECB473E0410463E041145030000000000000004000000000000002EAECB47C0A801010F0000000000000005000000000000002EAECB476C6F63616C000000330000000000000004000000000000002EAECB4700015180010000000000000004000000000000002EAECB47FFFFFF00360000000000000004000000000000002EAECB47C0A80101350000000000000001000000000000002EAECB4705000000 > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\Dhcp\Parameters {6317C625-DA29-42BA-9ADD-C0C897993031} REG_BINARY FC000000000000000000000000000000D9F313491A0000000000000002000000000000000F34154905D40000060000000000000008000000000000000F341549D043DEDED043DCDC030000000000000004000000000000000F341549C0A801010F0000000000000005000000000000000F3415496C6F63616C000000330000000000000004000000000000000F34154900015180010000000000000004000000000000000F341549FFFFFF00360000000000000004000000000000000F341549C0A80101350000000000000001000000000000000F34154905000000 < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\Eventlog\Application\ESENT EventMessageFile REG_EXPAND_SZ c:\windows\system32\ESENT.dll > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\Eventlog\Application\ESENT EventMessageFile REG_EXPAND_SZ C:\WINDOWS\system32\ESENT.dll < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\Eventlog\Application\ESENT CategoryMessageFile REG_EXPAND_SZ c:\windows\system32\ESENT.dll > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\Eventlog\Application\ESENT CategoryMessageFile REG_EXPAND_SZ C:\WINDOWS\system32\ESENT.dll > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\Eventlog\Security\DS > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\Eventlog\Security\LSA > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\Eventlog\Security\NetDDE Object > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\Eventlog\Security\SC Manager > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\Eventlog\Security\Security > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\Eventlog\Security\Security Account Manager > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\Eventlog\Security\Spooler < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\Eventlog\System Sources REG_MULTI_SZ WZCSVC\0Workstation\0WindowsMedia\0Windows Update Agent\0Windows Script Host\0Windows Installer 3.1\0Windows File Protection\0Win32k\0W32Time\0VolSnap\0viaide\0VgaSave\0USER32\0UPS\0ultra\0udfs\0toside\0TermServSessDir\0TermService\0TermServDevices\0TermDD\0tdi\0TCPMon\0Tcpip\0System Error\0sym_u3\0sym_hi\0symc8xx\0symc810\0StillImage\0SSDPSRV\0Srv\0srservice\0sr\0sparrow\0sndblst\0Simbad\0SideBySide\0sfloppy\0Setup\0Service de stockage amovible\0Service Control Manager\0Server\0serial\0scsiport\0Schedule\0Schannel\0SCardSvr\0Save Dump\0SAM\0RTL8023xp\0RSVP\0RemoteAccess\0redbook\0Rdbss\0RasMan\0RasAuto\0ql1280\0ql1240\0ql12160\0ql10wnt\0ql1080\0PSched\0Print\0PptpMiniport\0PolicyAgent\0PlugPlayManager\0perc2\0pcmcia\0pciide\0pci\0parvdm\0partmgr\0parport\0OSPFMib\0OSPF\0null\0NtServicePack\0ntfs\0npfs\0Nla\0NIC1394\0Netlogon\0NetDDE\0NetBT\0NetBIOS\0NdisWan\0NdisIP\0ndis\0Mup\0msfs\0msadlib\0MrxSmb\0MRxDAV\0mraid35x\0mouhid\0mouclass\0Modem\0LsaSrv\0LmHosts\0LDMS\0LDM\0lbrtfdc\0Kerberos\0kbdhid\0kbdclass\0isapnp\0irsir\0IPXSAP\0IPXRouterManager\0IPXRIP\0IPXCP\0IPSec\0IPRouterManager\0IPRIP2\0IPNATHLP\0IPMGM\0IPBOOTP\0intelppm\0intelide\0ini910u\0IGMPv2\0i8042prt\0i2omp\0i2omgmt\0Http\0hpn\0ftdisk\0fs_rec\0flpydisk\0Fips\0fdc\0fastfat\0eventlog\0efs\0dpti2o\0Dnscache\0Dnsapi\0dmio\0dmboot\0Distributed Link Tracking Client\0disk\0Dhcp\0DfsSvc\0DfsDriver\0DCOM\0dac960nt\0dac2w2k\0cpqarray\0cmdide\0changer\0cdrom\0Cdm\0cdfs\0cdaudio\0cd20xrnt\0cbidf2k\0Browser\0BITS\0beep\0Atmarpc\0ati2mtag\0Ati HotKey Poller\0atdisk\0atapi\0AsyncMac\0asc3550\0asc3350p\0asc\0Arp1394\0Application Popup\0apphelp\0amsint\0ami0nt\0aliide\0Alerter\0aic78xx\0aic78u2\0aha154x\0adpu160m\0acpiec\0acpi\0abp480n5\0abiosdsk\0System\0\0 > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\Eventlog\System Sources REG_MULTI_SZ WZCSVC\0Workstation\0WindowsMedia\0Windows Update Agent\0Windows Script Host\0Windows Installer 3.1\0Windows File Protection\0Win32k\0W32Time\0VolSnap\0viaide\0VgaSave\0USER32\0UPS\0ultra\0udfs\0toside\0TermServSessDir\0TermService\0TermServDevices\0TermDD\0tdi\0TCPMon\0Tcpip\0System Error\0sym_u3\0sym_hi\0symc8xx\0symc810\0StillImage\0SSDPSRV\0Srv\0srservice\0sr\0sparrow\0sndblst\0Simbad\0SideBySide\0sfloppy\0Setup\0Service de stockage amovible\0Service Control Manager\0Server\0serial\0scsiport\0Schedule\0Schannel\0SCardSvr\0Save Dump\0SAM\0RTL8023xp\0RSVP\0RemoteAccess\0redbook\0Rdbss\0RasMan\0RasAuto\0ql1280\0ql1240\0ql12160\0ql10wnt\0ql1080\0PSched\0Print\0PptpMiniport\0PolicyAgent\0PlugPlayManager\0perc2\0pcmcia\0pciide\0pci\0parvdm\0partmgr\0parport\0OSPFMib\0OSPF\0null\0NtServicePack\0ntfs\0npfs\0Nla\0NIC1394\0Netlogon\0NetDDE\0NetBT\0NetBIOS\0NdisWan\0NdisIP\0ndis\0Mup\0msfs\0msadlib\0MrxSmb\0MRxDAV\0mraid35x\0mouhid\0mouclass\0Modem\0LsaSrv\0LmHosts\0LDMS\0LDM\0lbrtfdc\0Kerberos\0kbdhid\0kbdclass\0isapnp\0irsir\0IPXSAP\0IPXRouterManager\0IPXRIP\0IPXCP\0IPSec\0IPRouterManager\0IPRIP2\0IPNATHLP\0IPMGM\0IPBOOTP\0Internet Explorer 7 Disk\0intelppm\0intelide\0ini910u\0IGMPv2\0i8042prt\0i2omp\0i2omgmt\0Http\0hpn\0ftdisk\0fs_rec\0flpydisk\0Fips\0fdc\0fastfat\0eventlog\0efs\0dpti2o\0Dnscache\0Dnsapi\0dmio\0dmboot\0Distributed Link Tracking Client\0disk\0Dhcp\0DfsSvc\0DfsDriver\0DCOM\0dac960nt\0dac2w2k\0cpqarray\0cmdide\0changer\0cdrom\0Cdm\0cdfs\0cdaudio\0cd20xrnt\0cbidf2k\0Browser\0BITS\0beep\0Atmarpc\0ati2mtag\0Ati HotKey Poller\0atdisk\0atapi\0AsyncMac\0asc3550\0asc3350p\0asc\0Arp1394\0Application Popup\0apphelp\0amsint\0ami0nt\0aliide\0Alerter\0aic78xx\0aic78u2\0aha154x\0adpu160m\0acpiec\0acpi\0abp480n5\0abiosdsk\0System\0\0 < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\kl1 < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\klif < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\lanmanserver\parameters Guid REG_BINARY 5004971301681449958DAA43046B5866 > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\lanmanserver\parameters Guid REG_BINARY A4F927298FE44C46AC7FCF14FB095E78 > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\MRxDAV\EncryptedDirectories < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\PerfDisk\Performance WbemAdapFileSignature REG_BINARY 97F41DFEE99BC2AE60BAD78679FB40A1 < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\PerfDisk\Performance WbemAdapFileTime REG_BINARY 0020E7D4F03DC601 < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\PerfDisk\Performance WbemAdapFileSize REG_DWORD 27136 (0x6A00) < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\PerfDisk\Performance WbemAdapStatus REG_DWORD 0 (0x0) < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\PerfNet\Performance WbemAdapFileSignature REG_BINARY 7FD03F93453FAFBABB6E29B11E9E731C < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\PerfNet\Performance WbemAdapFileTime REG_BINARY 0020E7D4F03DC601 < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\PerfNet\Performance WbemAdapFileSize REG_DWORD 17408 (0x4400) < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\PerfNet\Performance WbemAdapStatus REG_DWORD 0 (0x0) < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\SharedAccess\Epoch Epoch REG_DWORD 8851 (0x2293) > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\SharedAccess\Epoch Epoch REG_DWORD 9374 (0x249E) > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List %windir%\Network Diagnostic\xpnetdiag.exe REG_SZ %windir%\Network Diagnostic\xpnetdiag.exe:*:Enaxxxxx@xxxxxres.dll,-20000 > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\kav\kis7.0\french\setup.exe REG_SZ C:\kav\kis7.0\french\setup.exe:*:Enabled:Programme d'installation de Kaspersky Internet Security 7.0 > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\kav\kav7.0\french\setup.exe REG_SZ C:\kav\kav7.0\french\setup.exe:*:Enabled:Programme d'installation de Kaspersky Anti-Virus 7.0 > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List %windir%\Network Diagnostic\xpnetdiag.exe REG_SZ %windir%\Network Diagnostic\xpnetdiag.exe:*:Enaxxxxx@xxxxxres.dll,-20000 < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\Spooler\Performance WbemAdapFileSignature REG_BINARY E415A3D071D315CD84F6F593A3A060B3 < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\Spooler\Performance WbemAdapFileTime REG_BINARY 0020E7D4F03DC601 < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\Spooler\Performance WbemAdapFileSize REG_DWORD 146944 (0x23E00) < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\Spooler\Performance WbemAdapStatus REG_DWORD 0 (0x0) < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\TapiSrv\Performance WbemAdapFileSignature REG_BINARY 0483F001E58AF7EA90B23BA9ACB367D3 < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\TapiSrv\Performance WbemAdapFileTime REG_BINARY 0020E7D4F03DC601 < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\TapiSrv\Performance WbemAdapFileSize REG_DWORD 5632 (0x1600) < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\TapiSrv\Performance WbemAdapStatus REG_DWORD 0 (0x0) < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\Tcpip\Parameters DhcpNameServer REG_SZ 62.4.16.70 62.4.17.69 > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\Tcpip\Parameters DhcpNameServer REG_SZ 208.67.222.222 208.67.220.220 < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\Tcpip\Parameters\Interfaces\{6317C625-DA29-42BA-9ADD-C0C897993031} LeaseObtainedTime REG_DWORD 1204444334 (0x47CA5CAE) > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\Tcpip\Parameters\Interfaces\{6317C625-DA29-42BA-9ADD-C0C897993031} LeaseObtainedTime REG_DWORD 1226039951 (0x4913E28F) < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\Tcpip\Parameters\Interfaces\{6317C625-DA29-42BA-9ADD-C0C897993031} T1 REG_DWORD 1204487534 (0x47CB056E) > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\Tcpip\Parameters\Interfaces\{6317C625-DA29-42BA-9ADD-C0C897993031} T1 REG_DWORD 1226083151 (0x49148B4F) < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\Tcpip\Parameters\Interfaces\{6317C625-DA29-42BA-9ADD-C0C897993031} T2 REG_DWORD 1204519934 (0x47CB83FE) > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\Tcpip\Parameters\Interfaces\{6317C625-DA29-42BA-9ADD-C0C897993031} T2 REG_DWORD 1226115551 (0x491509DF) < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\Tcpip\Parameters\Interfaces\{6317C625-DA29-42BA-9ADD-C0C897993031} LeaseTerminatesTime REG_DWORD 1204530734 (0x47CBAE2E) > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\Tcpip\Parameters\Interfaces\{6317C625-DA29-42BA-9ADD-C0C897993031} LeaseTerminatesTime REG_DWORD 1226126351 (0x4915340F) < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\Tcpip\Parameters\Interfaces\{6317C625-DA29-42BA-9ADD-C0C897993031} DhcpIPAddress REG_SZ 192.168.1.101 > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\Tcpip\Parameters\Interfaces\{6317C625-DA29-42BA-9ADD-C0C897993031} DhcpIPAddress REG_SZ 192.168.1.100 < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\Tcpip\Parameters\Interfaces\{6317C625-DA29-42BA-9ADD-C0C897993031} DhcpRetryTime REG_DWORD 43198 (0xA8BE) > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\Tcpip\Parameters\Interfaces\{6317C625-DA29-42BA-9ADD-C0C897993031} DhcpRetryTime REG_DWORD 43197 (0xA8BD) < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\Tcpip\Parameters\Interfaces\{6317C625-DA29-42BA-9ADD-C0C897993031} DhcpNameServer REG_SZ 62.4.16.70 62.4.17.69 > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\Tcpip\Parameters\Interfaces\{6317C625-DA29-42BA-9ADD-C0C897993031} DhcpNameServer REG_SZ 208.67.222.222 208.67.220.220 < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\WmiApRpl\Performance Last Counter REG_DWORD 4848 (0x12F0) > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\WmiApRpl\Performance Last Counter REG_DWORD 4856 (0x12F8) < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\WmiApRpl\Performance Last Help REG_DWORD 4849 (0x12F1) > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\WmiApRpl\Performance Last Help REG_DWORD 4857 (0x12F9) < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\WmiApRpl\Performance Object List REG_SZ 4844 4844 > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\WmiApRpl\Performance Object List REG_SZ 4844 4844 4850 4850 < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\wuauserv Start REG_DWORD 4 (0x4) > Value: HKEY_LOCAL_MACHINE\system\controlset002\services\wuauserv Start REG_DWORD 2 (0x2) < Value: HKEY_LOCAL_MACHINE\system\controlset001\services\{6317C625-DA29-42BA-9ADD-C0C897993031}\Paramet

Sophie · Answer

J'ai fais tt ce ke tu ma dit j'espere que c bon :)

Utilisateur anonyme · Answer

Re ,

alors ,

Reposte moi un rapport DSS ( juste le fichier main.txt )

Et dit moi ou en sont tes soucis.
a
+

Sophie · Answer

Tu peu me reposter le dds stp jlai envoyer a la corbeille desoler :)

Sophie · Answer

C bon je l'ai retrouvé voila le rapport 


Deckard's System Scanner v20071014.68
Run by Propriétaire on 2008-11-07 11:12:59
Computer is in Normal Mode.
--------------------------------------------------------------------------------



-- HijackThis (run as Propriétaire.exe) ----------------------------------------

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:13:16, on 07/11/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\PSIService.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\MAFWTray.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\ATI Technologies\ATI.ACE\CLI.EXE
C:\Program Files\SyncroSoft\Pos\H2O\cledx.exe
C:\Program Files\Trust\DS-4500X Wireless Laser Deskset\Mouse\mouse32a.exe
C:\Program Files\Trust\DS-4500X Wireless Laser Deskset\Keyboard\kbdap32a.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Documents and Settings\Propriétaire\Local Settings\Temporary Internet Files\Content.IE5\HLWUXMAW\dss[1].exe
C:\PROGRA~1\TRENDM~1\HIJACK~1\Propriétaire.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = https://www.bing.com/?FORM=TOOLBR&cc=fr&toHttps=1&redig=4527FFF1C12746FC9EDB535C75E80ECC
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Multi Media France Toolbar - {7009fcd4-05be-44f4-9583-93fe419ab7b0} - C:\Program Files\Multi_Media_France	bMul0.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O3 - Toolbar: Multi Media France Toolbar - {7009fcd4-05be-44f4-9583-93fe419ab7b0} - C:\Program Files\Multi_Media_France	bMul0.dll
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [MAFWTaskbarApp] C:\WINDOWS\system32\MAFWTray.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [PKR Pal] "C:\Program Files\PKR\pkrpal.exe" -osboot
O4 - HKLM\..\Run: [H2O] C:\Program Files\SyncroSoft\Pos\H2O\cledx.exe
O4 - HKLM\..\Run: [FLMOFFICE4DMOUSE] C:\Program Files\Trust\DS-4500X Wireless Laser Deskset\Mouse\mouse32a.exe
O4 - HKLM\..\Run: [OFFICEKB] C:\Program Files\Trust\DS-4500X Wireless Laser Deskset\Keyboard\kbdap32a.EXE
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O20 - Winlogon Notify: !SASWinLogon - C:\WINDOWS\
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: MSSQL$SONY_MEDIAMGR - Unknown owner - C:\Program Files\Sony\Shared Plug-Ins\Media Manager\MSSQL$SONY_MEDIAMGR\Binn\sqlservr.exe (file missing)
O23 - Service: ProtexisLicensing - Unknown owner - C:\WINDOWS\system32\PSIService.exe
O23 - Service: SQLAgent$SONY_MEDIAMGR - Unknown owner - C:\Program Files\Sony\Shared Plug-Ins\Media Manager\MSSQL$SONY_MEDIAMGR\Binn\sqlagent.EXE (file missing)

Sophie · Answer

Jcrois po qu'il y ai encore des probleme je peu rentrer dans mon poste de travaille normalement et sur mes icone de bureau idem.

Internet marche impecable ne rame plus.


Par contre j'ai enlever kapersky et j'ai telecharger avast j'espere que c bon comme antivirus???

J'ai aussi spy bot si tu a autre chose a me conseiller de mieux????

Par contre maintenant j'ai un soucis avec msn je n'arrive plus a me connecter c les fichier host qui bloque mais quand je fais reparer ca marche pas non plus a tu une solution???


Merci pour ton aide :) :)

Utilisateur anonyme · Answer

Re ,
Tu l'avais payé Kaspersky ?

Il reste encore une merde.

Désactive la restauration système.
Clic droit sur poste de travail > propriétés > onglet restauration système
Coche "désactiver la restauration système sur tous les lecteurs".
clic sur ok pour valider.

 Télécharge l'outil Flash_Disinfector de sUBs:
http://www.techsupportforum.com/sectools/sUBs/Flash_Disinfector.exe

Enregistre Flash_Disinfector.exe sur ton bureau.
Double clique sur Flash_Disinfector.exe pour l'exécuter.
Quand le message : "Plug in yours flash drive & clic Ok to begin disinfection" apparaitra :
Connecte au pc, clé USB, DD externes, susceptibles d'avoir été infectés.
Puis clic sur Ok
Les icônes sur le bureau vont disparaitre jusqu'à l'apparition du message: [Done!!]
Appuies ensuite sur OK, pour faire réapparaitre le bureau.

Ensuite réactive ta restauration système
Clic droit sur « Poste de travail », puis sur « Propriétés »,
Vas sur l’onglet « Restauration système »
Tu décoches la case « Désactiver la restauration »
Termine par [Appliquer] [OK]  

*******************************************************
 Télécharger OAD (Outil d'Aide au Diagnostic) < http://sosvirus.changelog.fr/OAD.exe >
&#8594; Enregistre-le sur ton bureau
&#8594; Lancer 'OAD.exe' en faisant un double clique sur le fichier
&#8594; Saisir la valeur recherchée -> '  AdobeR.exe ' ( fait un copier/coller )
&#8594; Type de recherche : sélectionner l'option 6 puis valide [entrée] 
&#8594; OAD va maintenant rechercher le fichier.
&#8594; Laisse-le travailler jusqu'à ce qu'il en ait terminé.
&#8594; Suivant la taille des disques durs, cette recherche peut prendre plusieurs minutes.

------------- Patienter. --------------

&#8594;  Le rapport de recherche s'affichera automatiquement dès qu'il en aura terminé.
&#8594; Faire un copier/coller de ce rapport dans ton prochain post.


(CTRL+A Pour tout selectionner  , CTRL+C pour copier et CTRL+V pour coller )
 
Note: Certains Antivirus peuvent émettre une alerte lors du téléchargement / utilisation  > ignore


A+

Sophie · Answer

07/11/2008 ---- 11:37:00,04  

----------------------------------
§§§§§§ [AdobeR.exe ] §§§§§§
----------------------------------
[X] Registre
 
-------------- [  ] rapide
-- Fichier --- [  ] disque systeme
 ------------- [X] complete


********************
     [Registre] 
********************


[HKEY_USERS\S-1-5-21-1060284298-57989841-725345543-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{0df70462-5273-11dc-baa9-0019660ffbb4}\Shell\Auto\command]
@="AdobeR.exe e"

[HKEY_USERS\S-1-5-21-1060284298-57989841-725345543-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{0df70463-5273-11dc-baa9-0019660ffbb4}\Shell\Auto\command]
@="AdobeR.exe e"

[HKEY_USERS\S-1-5-21-1060284298-57989841-725345543-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{0df70463-5273-11dc-baa9-0019660ffbb4}\Shell\AutoRun\command]
@="C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL AdobeR.exe e"

[HKEY_USERS\S-1-5-21-1060284298-57989841-725345543-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{ae157c5c-abdb-11dd-8e8b-0019660ffbb4}\Shell\Auto\command]
@="AdobeR.exe e"

[HKEY_USERS\S-1-5-21-1060284298-57989841-725345543-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{ae157c5c-abdb-11dd-8e8b-0019660ffbb4}\Shell\AutoRun\command]
@="C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL AdobeR.exe e"

[HKEY_USERS\S-1-5-21-1060284298-57989841-725345543-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{e217225b-d6fd-11dc-ba16-0019660ffbb4}\Shell\Auto\command]
@="AdobeR.exe e"

[HKEY_USERS\S-1-5-21-1060284298-57989841-725345543-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{e217225b-d6fd-11dc-ba16-0019660ffbb4}\Shell\AutoRun\command]
@="C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL AdobeR.exe e"

*******************
     [Fichier] 
*******************



*********************
     [Même date] 
*********************

Aucun fichier créé à la même date détecté


Outil Aide Diagnostic By !aur3n7 Version 1.1
----------------------------------
§§§§§ Fin Rapport §§§§§ 
----------------------------------


Voila le rapport :)


Et non j'ai pas acheter kapersky :)

Utilisateur anonyme · Answer

Re ,
OK.

Recommence le fix.reg avec :

REGEDIT 4

[HKEY_USERS\S-1-5-21-1060284298-57989841-725345543-1003\Software\Microsoft\Windows\Current­Version\Explorer\MountPoints2\{0df70462-5273-11dc-baa9-0019660ffbb4}\Shell\Auto\command]
@=""
[HKEY_USERS\S-1-5-21-1060284298-57989841-725345543-1003\Software\Microsoft\Windows\Current­Version\Explorer\MountPoints2\{0df70463-5273-11dc-baa9-0019660ffbb4}\Shell\AutoRun\command­]
@=""
[HKEY_USERS\S-1-5-21-1060284298-57989841-725345543-1003\Software\Microsoft\Windows\Current­Version\Explorer\MountPoints2\{e217225b-d6fd-11dc-ba16-0019660ffbb4}\Shell\Auto\command]
@=""
[HKEY_USERS\S-1-5-21-1060284298-57989841-725345543-1003\Software\Microsoft\Windows\Current­Version\Explorer\MountPoints2\{e217225b-d6fd-11dc-ba16-0019660ffbb4}\Shell\AutoRun\command­]
@="" 
[HKEY_USERS\S-1-5-21-1060284298-57989841-725345543-1003\Software\Microsoft\Windows\Current­Version\Explorer\MountPoints2\{ae157c5c-abdb-11dd-8e8b-0019660ffbb4}\Shell\Auto\command]
@=""
[HKEY_USERS\S-1-5-21-1060284298-57989841-725345543-1003\Software\Microsoft\Windows\Current­Version\Explorer\MountPoints2\{ae157c5c-abdb-11dd-8e8b-0019660ffbb4}\Shell\AutoRun\command­]
@="" 





****************************************************

&#8594; Télécharge clean : http://www.malekal.com/download/clean.zip

&#8594; Dézippe-le ( clique droit , extraire tout) 

&#8594; Lance clean.cmd ( ou clean ), Choisi l'option 1 et poste moi le rapport.

(- Où est le rapport clean ? : « Poste de travail » / double clic sur disque « C / » double-clic sur « rapport_clean.txt » et « copier/coller le contenu » sur le forum. )

Note : Tu auras peut-être un message qui t'invitera a uploader un fichier , fait-le dès que tu pourras. 


Tutorial : http://bibou0007.com/outils-specifiques-f78/tuto-clean-t1007.htm

****************************************************

A++

Sophie · Answer

-->- Recherche: 

C:\Combofix: trouvé !
C:\_OtMoveIt: trouvé !
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\HJT.exe\HijackThis.lnk: trouvé !
C:\Documents and Settings\Propriétaire\Bureau\Dss.exe: trouvé !
C:\Documents and Settings\Propriétaire\Bureau\HijackThis.lnk: trouvé !
C:\Documents and Settings\Propriétaire\Bureau\reason4\Msnfix.zip: trouvé !
C:\Documents and Settings\Propriétaire\Bureau\reason4\MsnFix: trouvé !
C:\Documents and Settings\Propriétaire\Bureau\reason4\MSNFix\MsnFix: trouvé !
C:\Program Files\Trend Micro\HijackThis: trouvé !
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe: trouvé !

---------------------------------
-->- Suppression: 

C:\Documents and Settings\All Users\Menu Démarrer\Programmes\HJT.exe\HijackThis.lnk: supprimé !
C:\Documents and Settings\Propriétaire\Bureau\Dss.exe: supprimé !
C:\Documents and Settings\Propriétaire\Bureau\HijackThis.lnk: supprimé !
C:\Documents and Settings\Propriétaire\Bureau\reason4\Msnfix.zip: supprimé !
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe: supprimé !
C:\Combofix: supprimé !
C:\_OtMoveIt: supprimé !
C:\Documents and Settings\Propriétaire\Bureau\reason4\MsnFix: supprimé !
C:\Program Files\Trend Micro\HijackThis: supprimé !

Utilisateur anonyme · Answer

????

Sophie · Answer

Desoler celui d'avant sa doit pas etre le bon 


voila le bon :)

 07/11/2008 a 12:01:43,46 
 
*** Recherche des fichiers dans C: 
C:\autorun.inf FOUND 
 
*** Recherche des fichiers dans C:\WINDOWS\ 
 
*** Recherche des fichiers dans C:\WINDOWS\system32 
 
*** Recherche des fichiers dans C:\Program Files 
"C:\Program Files\DivX\Google\Firefox\ffinstaller.exe" FOUND 
"C:\Program Files\Multi_Media_France\" FOUND 
"C:\Program Files\Multi_Media\" FOUND

Utilisateur anonyme · Answer

Re , c'est mieux là ;))

&#8594; Redémarre en MSE

Autre tutorials pour MSE:

https://www.micro-astuce.com/depannage/demarrer-mode-sans-echec.php
http://www.coupdepoucepc.com/modules/news/article.php?storyid=253

&#8594; Re-lance clean  -> Choisis l'option 2

---Clean va travailler.---

&#8594; Un rapport Va etre généré , poste le moi ;)

( Le rapport est aussi sauvegardé dans C:\Rapport_clean.txt )

********************************************

Ultime vérification :

Va sur ce site , /!\ Internet Explorer obligatoire /!\ , Clique sur ' J'accepte '  , Installe les ActiveX si necessaire ,et vérifie si ils sont bien configurés Clique sur ' installer ' puis ' click here to scan '( ou : cliquez ici pour scanner ).
Et poste moi le rapport. ( qui se trouve ici -> C:\windows\bdoscan8\scanres.txt )

(CTRL+A Pour tout selectionner  , CTRL+C pour copier et CTRL+V pour coller )

Tutorial :  http://pageperso.aol.fr/loraline60/bitdefender_scan.htm


a+

Sophie · Answer

Re, voila le rapport


Script execute en mode sans echec 
Rapport clean par Malekal_morte - http://www.malekal.com 
Script execute en mode sans echec 07/11/2008 a 12:14:26,06 

Microsoft Windows XP [version 5.1.2600]
 
*** Suppression des fichiers dans C: 
tentative de suppression de C:\autorun.inf 
Impossible de supprimer C:\autorun.inf  
 
*** Suppression des fichiers dans C:\WINDOWS\ 
 
*** Suppression des fichiers dans C:\WINDOWS\system32 
 
*** Suppression des fichiers dans C:\Program Files 
tentative de suppression de "C:\Program Files\DivX\Google\Firefox\ffinstaller.exe" 
tentative de suppression de "C:\Program Files\Multi_Media_France\" 
tentative de suppression de "C:\Program Files\Multi_Media\" 
 
*** Suppression des clefs du registre effectuee.. 
*** Fin du rapport !

Utilisateur anonyme · Answer

Re ,
avant ou après le scan Bitdefender ,

Supprime ce fichier :

C:\autorun.inf 

(en MSE

Autre tutorials :

https://www.micro-astuce.com/depannage/demarrer-mode-sans-echec.php
http://www.coupdepoucepc.com/modules/news/article.php?storyid=253

)


si tu n'y arrive pas.

je reviens ce soir
A++

Sophie · Answer

Avant le scan 

le scan j'arrive pas a le faire 

jvais redemarer pour supprimé lez fichier ke tu ma demander :) je re

Sophie · Answer

J'ai supprimé le fichier en mode sans echec que tu ma demander... 

je n'arrive tjrs pas a faire le scan ke tu me demande est a installer activex..


Ok a ce soir bye :)

Sophie · Answer

[General]
App	= "BitDefender Online Scanner v8"
Date	= 07:11:2008
Time	= 12:54:21
Scan Path	= C:\;D:\;

[Engines Info]
Virus Definitions	= 1256618
Engine build	= "AVCORE v1.0 (build 2422) (i386) (Sep 25 2007 08:26:36)"
Scan plugins	= 16
Archive plugins	= 42
Unpack plugins	= 7
E-mail plugins	= 6
System plugins	= 5

[Scan Statistics]
Folders	= 5910
Files	= 115838
Archives	= 486
Packed files	= 7484
Identified viruses	= 2
Infected files	= 16
Warnings	= 0
Suspect files	= 0
Disinfected files	= 0
Deleted files	= 16
Copied files	= 0
Moved files	= 0
Renamed files	= 0
I/O Errors	= 10

[Scan Settings]
SecondAction	= Delete
FirstAction	= Disinfect
Heuristics	= 1
Enable Warnings	= 1
Exclude Ext	= 
Extensions	= exe;com;dll;ocx;scr;bin;dat;386;vxd;sys;wdm;cla;class;ovl;ole;hlp;doc;dot;xls;ppt;wbk;wiz;pot;ppa;xla;xlt;vbs;vbe;mdb;rtf;htm;hta;html;xml;xtp;php;asp;js;shs;chm;lnk;pif;prc;url;smm;pfd;msi;ini;csc;cmd;bas;
Scan Emails	= 1
Scan Archives	= 1
Scan Packed	= 1
Scan Files	= 1
Scan Boot	= 1
Verify Memory	= 0

[Scan Results]
Line00000031	= "C:\Deckard\System Scanner\20081104181830\backup\DOCUME~1\PROPRI~1\LOCALS~1\Temp\30exhmunmlclr14.exe Infecté par: Trojan.Agent.AITJ"
Line00000030	= "C:\Deckard\System Scanner\20081104181830\backup\DOCUME~1\PROPRI~1\LOCALS~1\Temp\30exhmunmlclr14.exe Supprimé"
Line00000029	= "C:\Deckard\System Scanner\20081104181830\backup\DOCUME~1\PROPRI~1\LOCALS~1\Temp\49exhmunmlclr14.exe Infecté par: Trojan.Agent.AITJ"
Line00000028	= "C:\Deckard\System Scanner\20081104181830\backup\DOCUME~1\PROPRI~1\LOCALS~1\Temp\49exhmunmlclr14.exe Supprimé"
Line00000027	= "C:\Deckard\System Scanner\20081104181830\backup\DOCUME~1\PROPRI~1\LOCALS~1\Temp\55exhmunmlclr14.exe Infecté par: Trojan.Agent.AITJ"
Line00000026	= "C:\Deckard\System Scanner\20081104181830\backup\DOCUME~1\PROPRI~1\LOCALS~1\Temp\55exhmunmlclr14.exe Supprimé"
Line00000025	= "C:\Deckard\System Scanner\20081104181830\backup\DOCUME~1\PROPRI~1\LOCALS~1\Temp\59exhmunmlclr14.exe Infecté par: Trojan.Agent.AITJ"
Line00000024	= "C:\Deckard\System Scanner\20081104181830\backup\DOCUME~1\PROPRI~1\LOCALS~1\Temp\59exhmunmlclr14.exe Supprimé"
Line00000023	= "C:\Deckard\System Scanner\20081104181830\backup\DOCUME~1\PROPRI~1\LOCALS~1\Temp\66exmdnk56.exe Infecté par: Backdoor.Agent.ZMY"
Line00000022	= "C:\Deckard\System Scanner\20081104181830\backup\DOCUME~1\PROPRI~1\LOCALS~1\Temp\66exmdnk56.exe Supprimé"
Line00000021	= "C:\Deckard\System Scanner\20081104181830\backup\DOCUME~1\PROPRI~1\LOCALS~1\Temp\82exhmunmlclr14.exe Infecté par: Trojan.Agent.AITJ"
Line00000020	= "C:\Deckard\System Scanner\20081104181830\backup\DOCUME~1\PROPRI~1\LOCALS~1\Temp\82exhmunmlclr14.exe Supprimé"
Line00000019	= "C:\Documents and Settings\Propriétaire\Local Settings\Temp\24exhmunmlclr14.exe Infecté par: Trojan.Agent.AITJ"
Line00000018	= "C:\Documents and Settings\Propriétaire\Local Settings\Temp\24exhmunmlclr14.exe Supprimé"
Line00000017	= "C:\Documents and Settings\Propriétaire\Local Settings\Temp\71exhmunmlclr14.exe Infecté par: Trojan.Agent.AITJ"
Line00000016	= "C:\Documents and Settings\Propriétaire\Local Settings\Temp\71exhmunmlclr14.exe Supprimé"
Line00000015	= "C:\Documents and Settings\Propriétaire\Local Settings\Temp\75exhmunmlclr14.exe Infecté par: Trojan.Agent.AITJ"
Line00000014	= "C:\Documents and Settings\Propriétaire\Local Settings\Temp\75exhmunmlclr14.exe Supprimé"
Line00000013	= "C:\Documents and Settings\Propriétaire\Local Settings\Temp\88exhmunmlclr14.exe Infecté par: Trojan.Agent.AITJ"
Line00000012	= "C:\Documents and Settings\Propriétaire\Local Settings\Temp\88exhmunmlclr14.exe Supprimé"
Line00000011	= "C:\System Volume Information\_restore{D88DDE61-D342-465C-AFF5-295FBD9AB56F}\RP3\A0000121.exe Infecté par: Trojan.Agent.AITJ"
Line00000010	= "C:\System Volume Information\_restore{D88DDE61-D342-465C-AFF5-295FBD9AB56F}\RP3\A0000121.exe Supprimé"
Line00000009	= "C:\System Volume Information\_restore{D88DDE61-D342-465C-AFF5-295FBD9AB56F}\RP3\A0000122.exe Infecté par: Trojan.Agent.AITJ"
Line00000008	= "C:\System Volume Information\_restore{D88DDE61-D342-465C-AFF5-295FBD9AB56F}\RP3\A0000122.exe Supprimé"
Line00000007	= "C:\System Volume Information\_restore{D88DDE61-D342-465C-AFF5-295FBD9AB56F}\RP3\A0000123.exe Infecté par: Trojan.Agent.AITJ"
Line00000006	= "C:\System Volume Information\_restore{D88DDE61-D342-465C-AFF5-295FBD9AB56F}\RP3\A0000123.exe Supprimé"
Line00000005	= "C:\System Volume Information\_restore{D88DDE61-D342-465C-AFF5-295FBD9AB56F}\RP3\A0000124.exe Infecté par: Trojan.Agent.AITJ"
Line00000004	= "C:\System Volume Information\_restore{D88DDE61-D342-465C-AFF5-295FBD9AB56F}\RP3\A0000124.exe Supprimé"
Line00000003	= "C:\System Volume Information\_restore{D88DDE61-D342-465C-AFF5-295FBD9AB56F}\RP3\A0000125.exe Infecté par: Backdoor.Agent.ZMY"
Line00000002	= "C:\System Volume Information\_restore{D88DDE61-D342-465C-AFF5-295FBD9AB56F}\RP3\A0000125.exe Supprimé"
Line00000001	= "C:\System Volume Information\_restore{D88DDE61-D342-465C-AFF5-295FBD9AB56F}\RP3\A0000126.exe Infecté par: Trojan.Agent.AITJ"
Line00000000	= "C:\System Volume Information\_restore{D88DDE61-D342-465C-AFF5-295FBD9AB56F}\RP3\A0000126.exe Supprimé"


je crois pas que sa soit ces resultat la ke tu me demande mais je trouve pas autre chose

Sophie · Answer

J'ai bien fais le scan avec bideffender mais quand je suis tes instructions je ne trouve pas le rapport :) a tt

Utilisateur anonyme · Answer

Re ,
C'est le bon.


_ Supprime SystemScan.
_ Supprime les fix.reg

Refais tourner Toolscleaner stp.
> poste le rapport.



A++

Sophie · Answer

-->- Recherche: 

C:\Combofix: trouvé !
C:\_OtMoveIt: trouvé !
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\HJT.exe\HijackThis.lnk: trouvé !
C:\Documents and Settings\Propriétaire\Bureau\Dss.exe: trouvé !
C:\Documents and Settings\Propriétaire\Bureau\HijackThis.lnk: trouvé !
C:\Documents and Settings\Propriétaire\Bureau\reason4\Msnfix.zip: trouvé !
C:\Documents and Settings\Propriétaire\Bureau\reason4\MsnFix: trouvé !
C:\Documents and Settings\Propriétaire\Bureau\reason4\MSNFix\MsnFix: trouvé !
C:\Program Files\Trend Micro\HijackThis: trouvé !
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe: trouvé !

---------------------------------
-->- Suppression: 

C:\Documents and Settings\All Users\Menu Démarrer\Programmes\HJT.exe\HijackThis.lnk: supprimé !
C:\Documents and Settings\Propriétaire\Bureau\Dss.exe: supprimé !
C:\Documents and Settings\Propriétaire\Bureau\HijackThis.lnk: supprimé !
C:\Documents and Settings\Propriétaire\Bureau\reason4\Msnfix.zip: supprimé !
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe: supprimé !
C:\Combofix: supprimé !
C:\_OtMoveIt: supprimé !
C:\Documents and Settings\Propriétaire\Bureau\reason4\MsnFix: supprimé !
C:\Program Files\Trend Micro\HijackThis: supprimé !

Voila le rapport:)

Sophie · Answer

J'arrive tjrs pa a me connectrer sur msn...

Fichier host est quand je fais reparer sa donne rien :)

Utilisateur anonyme · Answer

Re ,

Télécharge RHosts

-> Lance-le et choisi ' restaurer ' .


Re-tente la connexion sur msn.
A++

Sophie · Answer

re,

nan sa marche tjrs pas  fichier host et aussi le port principaux ya un souci :) quand je fais restaurer rien ne ce passe

Utilisateur anonyme · Answer

Re ,
Tu as quelle version de MSN ?

Sophie · Answer

Re,
Je c pas j'ai du telecharger la dernière :)

Utilisateur anonyme · Answer

Re ,
Réinstalle ta version d'MSN et dit moi où en est.

( si tu as peur , sauvegarde tes contacts avant : ' contacts > enregistrer mes contact messenger ' )

A++

Sophie · Answer

Re,

Ta pas le lien pour le telecharger please???

Utilisateur anonyme · Answer

Re ,
Pas dur à trouver sur Google ...

https://www.skype.com/fr/

Si tu as déjà désinstallé ta version choisi ' mettre à jour ' , sinon ' télécharger messenger '

A++

Sophie · Answer

J'ai d'abord essaye de faire la mise a jour et sa na pas foncionner 


je l'ai donc desinstaller et je l'ai re telacharger sa marche pas non plus....

Y' a tjrs comme probleme les fichier host et le pot principaux ...

:) :)


a plus

Utilisateur anonyme · Answer

Re ,
A court d'idées ...

Faut attendre je pense , c'est peut-être un problème de réseaux . 

( supprime Rhost )

( supprime Toolscleaner )

( supprime Tcleaner.txt )

a++

Sophie · Answer

Re,
C bon j'ai supprimé tt ca :)

Sophie · Answer

Clean aussi je peu le supprimé ???

Utilisateur anonyme · Answer

Re ,
Oui  :)

Sophie · Answer

Re, 

Est ce que je suis libéré de tt ces virus???

En tout cas jte remercie mon ordi marche super bien :)

Utilisateur anonyme · Answer

Re ,
Selon moi , tu n'as plus d'infection.

Donc mon aide s'arrête ici.

Pose moi toutes les questions que tu veux ;))

a++

Sophie · Answer

J'ai pas d'autre kestions jte remercie de ton aide ...


Bonne continuation a toi :)

SVP virus, pc ki rame je veu faire le menage

123 réponses

Newsletters