Analyse de log SVP
Logfile of HijackThis v1.99.1
Scan saved at 18:44:10, on 7/03/2006
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\rundll32.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe
C:\WINDOWS\win32ssr.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\MediaKey\MediaKey.EXE
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\WINDOWS\System32\rundll32.exe
C:\Adobe\Photoshop Album Edition Découverte\3.0\Apps\apdproxy.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Java\jre1.5.0\bin\jusched.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\Hewlett-Packard\Digital Imaging\bin\hpohmr08.exe
C:\WINDOWS\System32\NotifyPhoneBook.exe
C:\WINDOWS\twain_32\A4CIS\WATCH.exe
C:\NaturallySpeaking\Program\natspeak.exe
C:\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe
C:\Hewlett-Packard\Digital Imaging\Bin\hpoSTS08.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\System32\HPZipm12.exe
C:\PROGRA~1\WINZIP\wzqkpick.exe
C:\Hijackthis\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.google.be/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.be/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.be/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [MediaKey] C:\PROGRA~1\MediaKey\MediaKey.EXE
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [AME_CSA] rundll32 amecsa.cpl,RUN_DLL
O4 - HKLM\..\Run: [CloseDNF] C:\WINDOWS\System32\Utility.exe \1008
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Adobe\Photoshop Album Edition Découverte\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [system_service] drivers32.exe
O4 - HKLM\..\Run: [winsysupd] C:\\winsysupd12.exe
O4 - HKLM\..\Run: [gimmygames] C:\\gimmygames12.exe
O4 - HKLM\..\Run: [winsysban] C:\\winsysban12.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0\bin\jusched.exe
O4 - HKLM\..\RunServices: [system_service] drivers32.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [WINSOS VERIFY] "C:\Program Files\WINSOS\WINSOS.EXE" MINI
O4 - HKCU\..\RunServices: [Windows Service] windowz.exe
O4 - Startup: Watch.lnk = C:\WINDOWS\twain_32\A4CIS\WATCH.exe
O4 - Startup: Dragon NaturallySpeaking.lnk = C:\NaturallySpeaking\Program\natspeak.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: hpoddt01.exe.lnk = ?
O4 - Global Startup: hp psc 1000 series.lnk = ?
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: &Traduire à partir de l'anglais - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html
O8 - Extra context menu item: Pages liées - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Pages similaires - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Recherche &Google - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: Version de la page actuelle disponible dans le cache Google - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O16 - DPF: Dexia netbanking - http://netbanking.dexia.be/PC//Dynamic/Shared/Applet//DexiaIIA.cab
O16 - DPF: {6E5A37BF-FD42-463A-877C-4EB7002E68AE} (Housecall ActiveX 6.5) - http://us-housecall.trendmicro-europe.com/housecall/applet/html/native/x86/win32/activex/hcImpl.cab
O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} (Zylom Games Player) - http://game05.zylom.com/activex/zylomgamesplayer.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{84648578-34D6-4E17-A1CA-973F72E85B71}: NameServer = 195.238.2.21 195.238.2.22
O20 - Winlogon Notify: Controls Folder - C:\WINDOWS\system32\f40o0ed3eh0.dll
O20 - Winlogon Notify: WRNotifier - C:\WINDOWS\SYSTEM32\WRLogonNTF.dll
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: Boonty Games - BOONTY - C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe
O23 - Service: Win32Sr - Unknown owner - C:\WINDOWS\win32ssr.exe
Merci à ceux qui pourront m'aider
Scan saved at 18:44:10, on 7/03/2006
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\rundll32.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe
C:\WINDOWS\win32ssr.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\MediaKey\MediaKey.EXE
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\WINDOWS\System32\rundll32.exe
C:\Adobe\Photoshop Album Edition Découverte\3.0\Apps\apdproxy.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Java\jre1.5.0\bin\jusched.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\Hewlett-Packard\Digital Imaging\bin\hpohmr08.exe
C:\WINDOWS\System32\NotifyPhoneBook.exe
C:\WINDOWS\twain_32\A4CIS\WATCH.exe
C:\NaturallySpeaking\Program\natspeak.exe
C:\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe
C:\Hewlett-Packard\Digital Imaging\Bin\hpoSTS08.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\System32\HPZipm12.exe
C:\PROGRA~1\WINZIP\wzqkpick.exe
C:\Hijackthis\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.google.be/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.be/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.be/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [MediaKey] C:\PROGRA~1\MediaKey\MediaKey.EXE
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [AME_CSA] rundll32 amecsa.cpl,RUN_DLL
O4 - HKLM\..\Run: [CloseDNF] C:\WINDOWS\System32\Utility.exe \1008
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Adobe\Photoshop Album Edition Découverte\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [system_service] drivers32.exe
O4 - HKLM\..\Run: [winsysupd] C:\\winsysupd12.exe
O4 - HKLM\..\Run: [gimmygames] C:\\gimmygames12.exe
O4 - HKLM\..\Run: [winsysban] C:\\winsysban12.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0\bin\jusched.exe
O4 - HKLM\..\RunServices: [system_service] drivers32.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [WINSOS VERIFY] "C:\Program Files\WINSOS\WINSOS.EXE" MINI
O4 - HKCU\..\RunServices: [Windows Service] windowz.exe
O4 - Startup: Watch.lnk = C:\WINDOWS\twain_32\A4CIS\WATCH.exe
O4 - Startup: Dragon NaturallySpeaking.lnk = C:\NaturallySpeaking\Program\natspeak.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: hpoddt01.exe.lnk = ?
O4 - Global Startup: hp psc 1000 series.lnk = ?
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: &Traduire à partir de l'anglais - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html
O8 - Extra context menu item: Pages liées - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Pages similaires - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Recherche &Google - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: Version de la page actuelle disponible dans le cache Google - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O16 - DPF: Dexia netbanking - http://netbanking.dexia.be/PC//Dynamic/Shared/Applet//DexiaIIA.cab
O16 - DPF: {6E5A37BF-FD42-463A-877C-4EB7002E68AE} (Housecall ActiveX 6.5) - http://us-housecall.trendmicro-europe.com/housecall/applet/html/native/x86/win32/activex/hcImpl.cab
O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} (Zylom Games Player) - http://game05.zylom.com/activex/zylomgamesplayer.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{84648578-34D6-4E17-A1CA-973F72E85B71}: NameServer = 195.238.2.21 195.238.2.22
O20 - Winlogon Notify: Controls Folder - C:\WINDOWS\system32\f40o0ed3eh0.dll
O20 - Winlogon Notify: WRNotifier - C:\WINDOWS\SYSTEM32\WRLogonNTF.dll
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: Boonty Games - BOONTY - C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe
O23 - Service: Win32Sr - Unknown owner - C:\WINDOWS\win32ssr.exe
Merci à ceux qui pourront m'aider
8 réponses
-
ContributeurInch'Allah
-
J'ai comme l'impression que c'est la dernière fois que je te contacte. Tout semble bien se passer.
Tu m'as été d'un grand secours. Mille fois merci.
SmitFraudFix v2.23
Rapport fait à 23:38:00,84 le ven. 10/03/2006
Executé à partir de C:\attente\protection\d‚pannage\smitfraudFix\SmitfraudFix
OS: Microsoft Windows XP [version 5.1.2600]
»»»»»»»»»»»»»»»»»»»»»»»» Arret des processus
»»»»»»»»»»»»»»»»»»»»»»»» Suppression des fichiers infectés
»»»»»»»»»»»»»»»»»»»»»»»» Nettoyage Fichiers Temporaires
»»»»»»»»»»»»»»»»»»»»»»»» Nettoyage du registre
Nettoyage terminé.
»»»»»»»»»»»»»»»»»»»»»»»» Fin du rapport -
Contributeurhello
lm2fix correct - pas besoin de passer l option 2
========================
un ti nettoyage
smitfraud
http://siri.urz.free.fr/Fix/SmitfraudFix.php
----------------------------------------------------------------------------
Démarre en mode sans échec :
Pour cela, tu tapotes la touche F8 dès le début de l’allumage du PC sans t’arrêter
Une fenêtre va s’ouvrir tu te déplaces avec les flèches du clavier sur démarrer en mode sans échec puis tape entrée.
Une fois sur le bureau s’il n’y a pas toutes les couleurs et autres c’est normal !
(Si F8 ne marche pas utilise la touche F5).
----------------------------------------------------------------------------
Relance le programme Smitfraud,
Cette fois choisit l’option 2, répond oui a tous ;
Sauvegarde le rapport, redémarre en mode normal, copie-colle le rapport sauvegardé sur le forum.
=====================
ras sur ton log
=====================
as-tu tjrs des blems ? -
Salut.
Maintenant, les fenêtres intempestives ne s'ouvrent plus, mais je te soumets quand même les rapports générés.
L2mfix
L2MFIX find log 1.04a
These are the registry keys present
**********************************************************************************
Winlogon/notify:
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,33,00,32,00,2e,00,64,00,6c,00,\
6c,00,00,00
"Logoff"="ChainWlxLogoffEvent"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,6e,00,65,00,74,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Logoff"="CryptnetWlxLogoffEvent"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll]
"DLLName"="cscdll.dll"
"Logon"="WinlogonLogonEvent"
"Logoff"="WinlogonLogoffEvent"
"ScreenSaver"="WinlogonScreenSaverEvent"
"Startup"="WinlogonStartupEvent"
"Shutdown"="WinlogonShutdownEvent"
"StartShell"="WinlogonStartShellEvent"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp]
"DLLName"="wlnotify.dll"
"Logon"="SCardStartCertProp"
"Logoff"="SCardStopCertProp"
"Lock"="SCardSuspendCertProp"
"Unlock"="SCardResumeCertProp"
"Enabled"=dword:00000001
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule]
"Asynchronous"=dword:00000000
"DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Impersonate"=dword:00000000
"StartShell"="SchedStartShell"
"Logoff"="SchedEventLogOff"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy]
"Logoff"="WLEventLogoff"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001
"DllName"=hex(2):73,00,63,00,6c,00,67,00,6e,00,74,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn]
"DLLName"="WlNotify.dll"
"Lock"="SensLockEvent"
"Logon"="SensLogonEvent"
"Logoff"="SensLogoffEvent"
"Safe"=dword:00000001
"MaxWait"=dword:00000258
"StartScreenSaver"="SensStartScreenSaverEvent"
"StopScreenSaver"="SensStopScreenSaverEvent"
"Startup"="SensStartupEvent"
"Shutdown"="SensShutdownEvent"
"StartShell"="SensStartShellEvent"
"PostShell"="SensPostShellEvent"
"Disconnect"="SensDisconnectEvent"
"Reconnect"="SensReconnectEvent"
"Unlock"="SensUnlockEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv]
"Asynchronous"=dword:00000000
"DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Impersonate"=dword:00000000
"Logoff"="TSEventLogoff"
"Logon"="TSEventLogon"
"PostShell"="TSEventPostShell"
"Shutdown"="TSEventShutdown"
"StartShell"="TSEventStartShell"
"Startup"="TSEventStartup"
"MaxWait"=dword:00000258
"Reconnect"="TSEventReconnect"
"Disconnect"="TSEventDisconnect"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon]
"DLLName"="wlnotify.dll"
"Logon"="RegisterTicketExpiredNotificationEvent"
"Logoff"="UnregisterTicketExpiredNotificationEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WRNotifier]
"Asynchronous"=dword:00000000
"DllName"="WRLogonNTF.dll"
"Impersonate"=dword:00000001
"Lock"="WRLock"
"StartScreenSaver"="WRStartScreenSaver"
"StartShell"="WRStartShell"
"Startup"="WRStartup"
"StopScreenSaver"="WRStopScreenSaver"
"Unlock"="WRUnlock"
"Shutdown"="WRShutdown"
"Logoff"="WRLogoff"
"Logon"="WRLogon"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wzcnotif]
"DLLName"="wzcdlg.dll"
"Logon"="WZCEventLogon"
"Logoff"="WZCEventLogoff"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000000
RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
Copyright (c) 1999-2001 Frank Heyne Software (http://www.heysoft.de)
This program is Freeware, use it on your own risk!
Access Control List for Registry key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify:
(CI) DENY --C------- BUILTIN\Administrateurs
(NI) ALLOW Full access AUTORITE NT\SYSTEM
(IO) ALLOW Full access AUTORITE NT\SYSTEM
(NI) ALLOW Full access AUTORITE NT\SYSTEM
(IO) ALLOW Full access AUTORITE NT\SYSTEM
(ID-NI) ALLOW Read BUILTIN\Utilisateurs
(ID-IO) ALLOW Read BUILTIN\Utilisateurs
(ID-NI) ALLOW Read BUILTIN\Utilisateurs avec pouvoir
(ID-IO) ALLOW Read BUILTIN\Utilisateurs avec pouvoir
(ID-NI) ALLOW Full access BUILTIN\Administrateurs
(ID-IO) ALLOW Full access BUILTIN\Administrateurs
(ID-NI) ALLOW Full access AUTORITE NT\SYSTEM
(ID-IO) ALLOW Full access AUTORITE NT\SYSTEM
(ID-IO) ALLOW Full access CREATEUR PROPRIETAIRE
**********************************************************************************
useragent:
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
"{F58D120A-BA27-DEE7-20CC-9C58DA8F0DCF}"=""
**********************************************************************************
Shell Extension key:
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]
"{00022613-0000-0000-C000-000000000046}"="Feuille de propri‚t‚s du fichier multim‚dia"
"{176d6597-26d3-11d1-b350-080036a75b03}"="Gestion de scanneur ICM"
"{1F2E5C40-9550-11CE-99D2-00AA006E086C}"="Page de s‚curit‚ NTFS"
"{3EA48300-8CF6-101B-84FB-666CCB9BCD32}"="Page des propri‚t‚s de OLE DocFile"
"{40dd6e20-7c17-11ce-a804-00aa003ca9f6}"="Extensions de l'environnement pour le partage"
"{41E300E0-78B6-11ce-849B-444553540000}"="PlusPack CPL Extension"
"{42071712-76d4-11d1-8b24-00a0c9068ff3}"="Extension Affichage Carte du Panneau de configuration"
"{42071713-76d4-11d1-8b24-00a0c9068ff3}"="Extension Affichage cran du Panneau de configuration"
"{42071714-76d4-11d1-8b24-00a0c9068ff3}"="Extension Affichage Panorama du Panneau de configuration"
"{4E40F770-369C-11d0-8922-00A024AB2DBB}"="Page de s‚curit‚ DS"
"{513D916F-2A8E-4F51-AEAB-0CBC76FB1AF8}"="Page de compatibilit‚"
"{56117100-C0CD-101B-81E2-00AA004AE837}"="Gestionnaire de donn‚es endommag‚es de l'environnement"
"{59099400-57FF-11CE-BD94-0020AF85B590}"="Extension copie de disquette"
"{59be4990-f85c-11ce-aff7-00aa003ca9f6}"="Extensions de l'environnement pour les objets r‚seau de Microsoft Windows"
"{5DB2625A-54DF-11D0-B6C4-0800091AA605}"="Gestion d'‚cran ICM"
"{675F097E-4C4D-11D0-B6C1-0800091AA605}"="Gestion d'imprimante ICM"
"{764BF0E1-F219-11ce-972D-00AA00A14F56}"="Extensions de l'environnement de compression de fichiers"
"{77597368-7b15-11d0-a0c2-080036af3f03}"="Extension de l'environnement d'imprimante Web"
"{7988B573-EC89-11cf-9C00-00AA00A14F56}"="Disk Quota UI"
"{853FE2B1-B769-11d0-9C4E-00C04FB6C6FA}"="Menu contextuel de cryptage"
"{85BBD920-42A0-1069-A2E4-08002B30309D}"="Porte-documents"
"{88895560-9AA2-1069-930E-00AA0030EBC8}"="Extension ic“ne HyperTerminal"
"{BD84B380-8CA2-1069-AB1D-08000948F534}"="Fonts"
"{DBCE2480-C732-101B-BE72-BA78E9AD5B27}"="Profil ICC"
"{F37C5810-4D3F-11d0-B4BF-00AA00BBB723}"="Page de s‚curit‚ des imprimantes"
"{f81e9010-6ea4-11ce-a7ff-00aa003ca9f6}"="Extensions de l'environnement pour le partage"
"{f92e8c40-3d33-11d2-b1aa-080036a75b03}"="Display TroubleShoot CPL Extension"
"{7444C717-39BF-11D1-8CD9-00C04FC29D45}"="Extension de cryptographie PKO"
"{7444C719-39BF-11D1-8CD9-00C04FC29D45}"="Extension de cryptographie Sign"
"{7007ACC7-3202-11D1-AAD2-00805FC1270E}"="Connexions r‚seau"
"{992CFFA0-F557-101A-88EC-00DD010CCC48}"="Connexions r‚seau"
"{E211B736-43FD-11D1-9EFB-0000F8757FCD}"="&Scanneurs et appareils photo"
"{FB0C9C8A-6C50-11D1-9F1D-0000F8757FCD}"="&Scanneurs et appareils photo"
"{905667aa-acd6-11d2-8080-00805f6596d2}"="&Scanneurs et appareils photo"
"{3F953603-1008-4f6e-A73A-04AAC7A992F1}"="&Scanneurs et appareils photo"
"{83bbcbf3-b28a-4919-a5aa-73027445d672}"="&Scanneurs et appareils photo"
"{F0152790-D56E-4445-850E-4F3117DB740C}"="Remote Sessions CPL Extension"
"{5F327514-6C5E-4d60-8F16-D07FA08A78ED}"="Extension de la page de propri‚t‚s de mise … jour automatique"
"{60254CA5-953B-11CF-8C96-00AA00B8708C}"="Extensions de l'interpr‚teur de commandes pour l'environnement d'ex‚cution de scripts Windows"
"{2206CDB2-19C1-11D1-89E0-00C04FD7A829}"="Liaison de donn‚es Microsoft"
"{DD2110F0-9EEF-11cf-8D8E-00AA0060F5BF}"="Tasks Folder Icon Handler"
"{797F1E90-9EDD-11cf-8D8E-00AA0060F5BF}"="Tasks Folder Shell Extension"
"{D6277990-4C6A-11CF-8D87-00AA0060F5BF}"="Tƒches planifi‚es"
"{0DF44EAA-FF21-4412-828E-260A8728E7F1}"="Barre des tƒches et menu D‚marrer"
"{2559a1f0-21d7-11d4-bdaf-00c04f60b9f0}"="Rechercher"
"{2559a1f1-21d7-11d4-bdaf-00c04f60b9f0}"="Aide et support"
"{2559a1f2-21d7-11d4-bdaf-00c04f60b9f0}"="Aide et support"
"{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}"="Ex‚cuter..."
"{2559a1f4-21d7-11d4-bdaf-00c04f60b9f0}"="Internet"
"{2559a1f5-21d7-11d4-bdaf-00c04f60b9f0}"="Courrier ‚lectronique"
"{D20EA4E1-3957-11d2-A40B-0C5020524152}"="Polices"
"{D20EA4E1-3957-11d2-A40B-0C5020524153}"="Outils d'administration"
"{875CB1A1-0F29-45de-A1AE-CFB4950D0B78}"="Audio Media Properties Handler"
"{40C3D757-D6E4-4b49-BB41-0E5BBEA28817}"="Video Media Properties Handler"
"{E4B29F9D-D390-480b-92FD-7DDB47101D71}"="Wav Properties Handler"
"{87D62D94-71B3-4b9a-9489-5FE6850DC73E}"="Avi Properties Handler"
"{A6FD9E45-6E44-43f9-8644-08598F5A74D9}"="Midi Properties Handler"
"{c5a40261-cd64-4ccf-84cb-c394da41d590}"="Video Thumbnail Extractor"
"{5E6AB780-7743-11CF-A12B-00AA004AE837}"="Barre d'outils Internet Microsoft"
"{22BF0C20-6DA7-11D0-B373-00A0C9034938}"="tat du t‚l‚chargement"
"{91EA3F8B-C99B-11d0-9815-00C04FD91972}"="Dossier Bureau ‚tendu"
"{6413BA2C-B461-11d1-A18A-080036B11A03}"="Dossier du shell augment‚"
"{F61FFEC1-754F-11d0-80CA-00AA005B4383}"="BandProxy"
"{7BA4C742-9E81-11CF-99D3-00AA004AE837}"="Bande du navigateur Microsoft"
"{30D02401-6A81-11d0-8274-00C04FD5AE38}"="Bande de recherche"
"{32683183-48a0-441b-a342-7c2a440a9478}"="Media Band"
"{169A0691-8DF9-11d1-A1C4-00C04FD75D13}"="Volet int‚gr‚ de recherche"
"{07798131-AF23-11d1-9111-00A0C98BA67D}"="Recherche Web"
"{AF4F6510-F982-11d0-8595-00AA004CD6D8}"="Utilitaire des options de l'arborescence du Registre"
"{01E04581-4EEE-11d0-BFE9-00AA005B4383}"="&Adresse"
"{A08C11D2-A228-11d0-825B-00AA005B4383}"="BoŒte d'entr‚e de l'adresse"
"{00BB2763-6A77-11D0-A535-00C04FD7D062}"="Saisie semi-automatique Microsoft"
"{7376D660-C583-11d0-A3A5-00C04FD706EC}"="TridentImageExtractor"
"{6756A641-DE71-11d0-831B-00AA005B4383}"="Liste de saisie semi-automatique MRU"
"{6935DB93-21E8-4ccc-BEB9-9FE3C77A297A}"="Liste de saisie semi-automatique personnalis‚e MRU"
"{7e653215-fa25-46bd-a339-34a2790f3cb7}"="Accessible"
"{acf35015-526e-4230-9596-becbe19f0ac9}"="Barre de progrŠs auto-ouvrante"
"{E0E11A09-5CB8-4B6C-8332-E00720A168F2}"="Analyseur de la barre d'adresses"
"{00BB2764-6A77-11D0-A535-00C04FD7D062}"="Liste de saisie semi-automatique de l'historique Microsoft"
"{03C036F1-A186-11D0-824A-00AA005B4383}"="Liste de saisie semi-automatique du dossier Shell Microsoft"
"{00BB2765-6A77-11D0-A535-00C04FD7D062}"="Conteneur de la liste de saisie semi-automatique multiple Microsoft"
"{ECD4FC4E-521C-11D0-B792-00A0C90312E1}"="Menu Site de bandes"
"{3CCF8A41-5C85-11d0-9796-00AA00B90ADF}"="Shell DeskBarApp"
"{ECD4FC4C-521C-11D0-B792-00A0C90312E1}"="Barre du Bureau"
"{ECD4FC4D-521C-11D0-B792-00A0C90312E1}"="Shell Rebar BandSite"
"{DD313E04-FEFF-11d1-8ECD-0000F87A470C}"="Assistance utilisateur"
"{EF8AD2D1-AE36-11D1-B2D2-006097DF8C11}"="ParamŠtres du dossier global"
"{EFA24E61-B078-11d0-89E4-00C04FC9E26E}"="Favorites Band"
"{0A89A860-D7B1-11CE-8350-444553540000}"="Shell Automation Inproc Service"
"{E7E4BC40-E76A-11CE-A9BB-00AA004AE837}"="Shell DocObject Viewer"
"{A5E46E3A-8849-11D1-9D8C-00C04FC99D61}"="Microsoft Browser Architecture"
"{FBF23B40-E3F0-101B-8488-00AA003E56F8}"="InternetShortcut"
"{3C374A40-BAE4-11CF-BF7D-00AA006946EE}"="Microsoft Url History Service"
"{FF393560-C2A7-11CF-BFF4-444553540000}"="Historique"
"{7BD29E00-76C1-11CF-9DD0-00A0C9034933}"="Temporary Internet Files"
"{7BD29E01-76C1-11CF-9DD0-00A0C9034933}"="Temporary Internet Files"
"{CFBFAE00-17A6-11D0-99CB-00C04FD64497}"="Microsoft Url Search Hook"
"{A2B0DD40-CC59-11d0-A3A5-00C04FD706EC}"="Image de d‚marrage de la Suite IE4"
"{67EA19A0-CCEF-11d0-8024-00C04FD75D13}"="CDF Extension Copy Hook"
"{131A6951-7F78-11D0-A979-00C04FD705A2}"="ISFBand OC"
"{9461b922-3c5a-11d2-bf8b-00c04fb93661}"="Search Assistant OC"
"{3DC7A020-0ACD-11CF-A9BB-00AA004AE837}"="Internet"
"{871C5380-42A0-1069-A2EA-08002B30309D}"="Internet Name Space"
"{EFA24E64-B078-11d0-89E4-00C04FC9E26E}"="Explorer Band"
"{9E56BE60-C50F-11CF-9A2C-00A0C90A90CE}"="Sendmail service"
"{9E56BE61-C50F-11CF-9A2C-00A0C90A90CE}"="Sendmail service"
"{88C6C381-2E85-11D0-94DE-444553540000}"="Dossier ActiveX Cache"
"{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"="WebCheck"
"{ABBE31D0-6DAE-11D0-BECA-00C04FD940BE}"="Subscription Mgr"
"{F5175861-2688-11d0-9C5E-00AA00A45957}"="Dossier Inscription"
"{08165EA0-E946-11CF-9C87-00AA005127ED}"="WebCheckWebCrawler"
"{E3A8BDE6-ABCE-11d0-BC4B-00C04FD929DB}"="WebCheckChannelAgent"
"{E8BB6DC0-6B4E-11d0-92DB-00A0C90C2BD7}"="TrayAgent"
"{7D559C10-9FE9-11d0-93F7-00AA0059CE02}"="Code Download Agent"
"{E6CC6978-6B6E-11D0-BECA-00C04FD940BE}"="ConnectionAgent"
"{D8BD2030-6FC9-11D0-864F-00AA006809D9}"="PostAgent"
"{7FC0B86E-5FA7-11d1-BC7C-00C04FD929DB}"="WebCheck SyncMgr Handler"
"{352EC2B7-8B9A-11D1-B8AE-006008059382}"="Gestionnaire d'applications d'environnement"
"{0B124F8F-91F0-11D1-B8B5-006008059382}"="num‚rateur d'applications install‚es"
"{CFCCC7A0-A282-11D1-9082-006008059382}"="Publication d'application Darwin"
"{e84fda7c-1d6a-45f6-b725-cb260c236066}"="Shell Image Verbs"
"{66e4e4fb-f385-4dd0-8d74-a2efd1bc6178}"="Shell Image Data Factory"
"{3F30C968-480A-4C6C-862D-EFC0897BB84B}"="Extracteur de miniatures de fichier + GDI"
"{9DBD2C50-62AD-11d0-B806-00C04FD706EC}"="Gestionnaire de miniatures - Informations de r‚sum‚ (DOCFILES)"
"{EAB841A0-9550-11cf-8C16-00805F1408F3}"="Extracteur de miniatures HTML"
"{eb9b1153-3b57-4e68-959a-a3266bc3d7fe}"="Shell Image Property Handler"
"{CC6EEFFB-43F6-46c5-9619-51D571967F7D}"="Assistant Publication de sites Web"
"{add36aa8-751a-4579-a266-d66f5202ccbb}"="Commande d'impressions via le Web"
"{6b33163c-76a5-4b6c-bf21-45de9cd503a1}"="Objet Assistant de publication Shell"
"{58f1f272-9240-4f51-b6d4-fd63d1618591}"="Assistant Obtenir une identit‚ Passport"
"{7A9D77BD-5403-11d2-8785-2E0420524153}"="Comptes d'utilisateurs"
"{BD472F60-27FA-11cf-B8B4-444553540000}"="Compressed (zipped) Folder Right Drag Handler"
"{888DCA60-FC0A-11CF-8F0F-00C04FD7D062}"="Compressed (zipped) Folder SendTo Target"
"{f39a0dc0-9cc8-11d0-a599-00c04fd64433}"="Fichier de chaŒne"
"{f3aa0dc0-9cc8-11d0-a599-00c04fd64434}"="Raccourci de chaŒne"
"{f3ba0dc0-9cc8-11d0-a599-00c04fd64435}"="Channel Handler Object"
"{f3da0dc0-9cc8-11d0-a599-00c04fd64437}"="Channel Menu"
"{f3ea0dc0-9cc8-11d0-a599-00c04fd64438}"="Channel Properties"
"{63da6ec0-2e98-11cf-8d82-444553540000}"="FTP Folders Webview"
"{883373C3-BF89-11D1-BE35-080036B11A03}"="Microsoft DocProp Shell Ext"
"{A9CF0EAE-901A-4739-A481-E35B73E47F6D}"="Microsoft DocProp Inplace Edit Box Control"
"{8EE97210-FD1F-4B19-91DA-67914005F020}"="Microsoft DocProp Inplace ML Edit Box Control"
"{0EEA25CC-4362-4A12-850B-86EE61B0D3EB}"="Microsoft DocProp Inplace Droplist Combo Control"
"{6A205B57-2567-4A2C-B881-F787FAB579A3}"="Microsoft DocProp Inplace Calendar Control"
"{28F8A4AC-BBB3-4D9B-B177-82BFC914FA33}"="Microsoft DocProp Inplace Time Control"
"{8A23E65E-31C2-11d0-891C-00A024AB2DBB}"="Directory Query UI"
"{9E51E0D0-6E0F-11d2-9601-00C04FA31A86}"="Shell properties for a DS object"
"{163FDC20-2ABC-11d0-88F0-00A024AB2DBB}"="Directory Object Find"
"{F020E586-5264-11d1-A532-0000F8757D7E}"="Directory Start/Search Find"
"{0D45D530-764B-11d0-A1CA-00AA00C16E65}"="Directory Property UI"
"{62AE1F9A-126A-11D0-A14B-0800361B1103}"="Directory Context Menu Verbs"
"{ECF03A33-103D-11d2-854D-006008059367}"="MyDocs Copy Hook"
"{ECF03A32-103D-11d2-854D-006008059367}"="MyDocs Drop Target"
"{4a7ded0a-ad25-11d0-98a8-0800361b1103}"="MyDocs Properties"
"{750fdf0e-2a26-11d1-a3ea-080036587f03}"="Offline Files Menu"
"{10CFC467-4392-11d2-8DB4-00C04FA31A66}"="Offline Files Folder Options"
"{AFDB1F70-2A4C-11d2-9039-00C04F8EEB3E}"="Dossier Fichiers hors connexion"
"{143A62C8-C33B-11D1-84FE-00C04FA34A14}"="Microsoft Agent Character Property Sheet Handler"
"{ECCDF543-45CC-11CE-B9BF-0080C87CDBA6}"="DfsShell"
"{60fd46de-f830-4894-a628-6fa81bc0190d}"="%DESC_PublishDropTarget%"
"{7A80E4A8-8005-11D2-BCF8-00C04F72C717}"="MMC Icon Handler"
"{0CD7A5C0-9F37-11CE-AE65-08002B2E1262}"=".CAB file viewer"
"{32714800-2E5F-11d0-8B85-00AA0044F941}"="Des &personnes..."
"{8DD448E6-C188-4aed-AF92-44956194EB1F}"="Windows Media Player Play as Playlist Context Menu Handler"
"{CE3FB1D1-02AE-4a5f-A6E9-D9F1B4073E6C}"="Windows Media Player Burn Audio CD Context Menu Handler"
"{F1B9284F-E9DC-4e68-9D7E-42362A59F0FD}"="Windows Media Player Add to Playlist Context Menu Handler"
"{9F97547E-4609-42C5-AE0C-81C61FFAEBC3}"="AVG7 Shell Extension"
"{9F97547E-460A-42C5-AE0C-81C61FFAEBC3}"="AVG7 Find Extension"
"{0006F045-0000-0000-C000-000000000046}"="Microsoft Outlook Custom Icon Handler"
"{640167b4-59b0-47a6-b335-a6b3c0695aea}"="Portable Media Devices"
"{cc86590a-b60a-48e6-996b-41d25ed39a1e}"="Portable Media Devices Menu"
"{6ECA2FB0-62EF-4630-A1DD-78DAC42CF145}"=""
"{F20E5895-ACF0-4642-BE12-6ABDE4EE6D09}"=""
"{880C2C7A-1E4D-4E04-8FB3-63ACE9F90F09}"=""
"{99111813-2001-48DF-8B72-1E6431634E57}"=""
"{833E5E02-D5A3-4193-963D-9B341169FB10}"=""
"{C70701D5-9572-4E14-902F-8643620FC804}"=""
"{E0E1B0FC-9553-4FFD-8D87-ED8FE559E657}"=""
"{035C34C6-ECBC-4B14-9A99-DA2AF7B09603}"=""
"{6E908BF4-3177-455C-A578-1E65A9AD1FDD}"=""
"{E77A1E53-BE45-418F-8180-963777468497}"=""
"{C1801722-AF34-4312-BEFE-E51ADE4FAC72}"=""
"{837B32FB-537F-40B7-85C1-0599B8D92247}"=""
"{10C34609-6D99-41D4-B1EF-89D98A25FD27}"=""
"{9F17ED66-B84C-4058-9A7B-03038AF52CFF}"=""
"{B3EB4BB7-6898-4366-8527-67BB57CF5995}"=""
"{F3E9A8F8-2122-4647-8193-DFB8CB9BFD38}"=""
"{12738F5B-C926-4165-A98C-F67309EFDB8D}"=""
"{20123D40-B69A-4FC7-964E-D94DD619DA25}"=""
"{37DA1A67-5A59-415F-86D6-0695E8592CA7}"=""
"{877B5B9A-CE56-4A5B-9BAB-FE0462DF7B7C}"=""
"{0B914558-9339-43BE-9173-46D5629B38A2}"=""
"{D8E5A654-50E0-4CBC-AF15-DABA25F73F02}"=""
"{F8B1A498-076B-4E94-B625-DDBAF79B9E0A}"=""
"{83B890AC-8419-4AD8-B2DB-E7C4201E569F}"=""
"{F988377B-3034-4490-94F9-5F5E011C3CED}"=""
"{7F8F0D01-F3EC-4376-8A89-473C787C666D}"=""
"{E8502DE9-6C78-4BF2-AFF3-181763BF15A3}"=""
"{3C64B6A8-BDFE-47A8-8B14-81688BB75D53}"=""
"{3DD11F13-4F6A-4F2D-BB01-51FC8FDF658C}"=""
"{001BE213-639A-404B-8ADE-22EFC7CAB2B9}"=""
"{D87DF34C-E28F-4D4D-B81B-685C1D2D5AE2}"=""
"{96002481-697A-47D7-B549-BE61C39648B0}"=""
"{6BF4CCDA-1BD3-4F65-A974-0E734EFB6C24}"=""
"{0275A895-D7DF-446E-BBBE-4ACE60F64B82}"=""
"{826EC28E-7525-4F8C-8D5E-72E6E4EFEFE4}"=""
"{E24E67D3-0351-449C-9C6E-9BE37D9E3D91}"=""
"{747310C2-6609-4CA8-8A4C-B75C1075C97A}"=""
"{61D3B9F2-6F1B-4DE2-89E4-369B8E61DE63}"=""
"{E0D79304-84BE-11CE-9641-444553540000}"="WinZip"
"{E0D79305-84BE-11CE-9641-444553540000}"="WinZip"
"{E0D79306-84BE-11CE-9641-444553540000}"="WinZip"
"{E0D79307-84BE-11CE-9641-444553540000}"="WinZip"
"{00B39376-26B2-46C0-81A5-71171D8A299C}"=""
"{1EEF2096-A5FF-4ED4-9F46-40BADD259336}"=""
"{6426F663-3413-4657-B9AF-4D2349BBC6F3}"=""
"{AE9E9485-69EC-47D4-8C9D-80A6CF9A1A0A}"=""
"{3424E7C6-7E44-4F50-9053-4429C62F8179}"=""
"{F7D90A67-852A-4774-8DE1-D69BCA65E7CF}"=""
"{C4961849-209A-455B-8E16-D4F9CD53DB74}"=""
**********************************************************************************
HKEY ROOT CLASSIDS:
Windows Registry Editor Version 5.00
[HKEY_CLASSES_ROOT\CLSID\{6ECA2FB0-62EF-4630-A1DD-78DAC42CF145}]
@=""
"IDEx"="ADDR"
[HKEY_CLASSES_ROOT\CLSID\{6ECA2FB0-62EF-4630-A1DD-78DAC42CF145}\Implemented Categories]
@=""
[HKEY_CLASSES_ROOT\CLSID\{6ECA2FB0-62EF-4630-A1DD-78DAC42CF145}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{6ECA2FB0-62EF-4630-A1DD-78DAC42CF145}\InprocServer32]
@="C:\\WINDOWS\\system32\\iyxpromn.dll"
"ThreadingModel"="Apartment"
Windows Registry Editor Version 5.00
[HKEY_CLASSES_ROOT\CLSID\{F20E5895-ACF0-4642-BE12-6ABDE4EE6D09}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{F20E5895-ACF0-4642-BE12-6ABDE4EE6D09}\Implemented Categories]
@=""
[HKEY_CLASSES_ROOT\CLSID\{F20E5895-ACF0-4642-BE12-6ABDE4EE6D09}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{F20E5895-ACF0-4642-BE12-6ABDE4EE6D09}\InprocServer32]
@="C:\\WINDOWS\\system32\\mpsign32.dll"
"ThreadingModel"="Apartment"
Windows Registry Editor Version 5.00
[HKEY_CLASSES_ROOT\CLSID\{880C2C7A-1E4D-4E04-8FB3-63ACE9F90F09}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{880C2C7A-1E4D-4E04-8FB3-63ACE9F90F09}\Implemented Categories]
@=""
[HKEY_CLASSES_ROOT\CLSID\{880C2C7A-1E4D-4E04-8FB3-63ACE9F90F09}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{880C2C7A-1E4D-4E04-8FB3-63ACE9F90F09}\InprocServer32]
@="C:\\WINDOWS\\system32\\gntuname.dll"
"ThreadingModel"="Apartment"
Windows Registry Editor Version 5.00
[HKEY_CLASSES_ROOT\CLSID\{99111813-2001-48DF-8B72-1E6431634E57}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{99111813-2001-48DF-8B72-1E6431634E57}\Implemented Categories]
@=""
[HKEY_CLASSES_ROOT\CLSID\{99111813-2001-48DF-8B72-1E6431634E57}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{99111813-2001-48DF-8B72-1E6431634E57}\InprocServer32]
@="C:\\WINDOWS\\system32\\qx-dx331.dll"
"ThreadingModel"="Apartment"
Windows Registry Editor Version 5.00
[HKEY_CLASSES_ROOT\CLSID\{833E5E02-D5A3-4193-963D-9B341169FB10}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{833E5E02-D5A3-4193-963D-9B341169FB10}\Implemented Categories]
@=""
[HKEY_CLASSES_ROOT\CLSID\{833E5E02-D5A3-4193-963D-9B341169FB10}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{833E5E02-D5A3-4193-963D-9B341169FB10}\InprocServer32]
@="C:\\WINDOWS\\system32\\svayerxp.dll"
"ThreadingModel"="Apartment"
Windows Registry Editor Version 5.00
[HKEY_CLASSES_ROOT\CLSID\{C70701D5-9572-4E14-902F-8643620FC804}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{C70701D5-9572-4E14-902F-8643620FC804}\Implemented Categories]
@=""
[HKEY_CLASSES_ROOT\CLSID\{C70701D5-9572-4E14-902F-8643620FC804}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{C70701D5-9572-4E14-902F-8643620FC804}\InprocServer32]
@="C:\\WINDOWS\\system32\\guard.tmp"
"ThreadingModel"="Apartment"
Windows Registry Editor Version 5.00
[HKEY_CLASSES_ROOT\CLSID\{E0E1B0FC-9553-4FFD-8D87-ED8FE559E657}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{E0E1B0FC-9553-4FFD-8D87-ED8FE559E657}\Implemented Categories]
@=""
[HKEY_CLASSES_ROOT\CLSID\{E0E1B0FC-9553-4FFD-8D87-ED8FE559E657}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{E0E1B0FC-9553-4FFD-8D87-ED8FE559E657}\InprocServer32]
@="C:\\WINDOWS\\system32\\tMpiperf.dll"
"ThreadingModel"="Apartment"
Windows Registry Editor Version 5.00
[HKEY_CLASSES_ROOT\CLSID\{035C34C6-ECBC-4B14-9A99-DA2AF7B09603}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{035C34C6-ECBC-4B14-9A99-DA2AF7B09603}\Implemented Categories]
@=""
[HKEY_CLASSES_ROOT\CLSID\{035C34C6-ECBC-4B14-9A99-DA2AF7B09603}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{035C34C6-ECBC-4B14-9A99-DA2AF7B09603}\InprocServer32]
@="C:\\WINDOWS\\system32\\guard.tmp"
"ThreadingModel"="Apartment"
Windows Registry Editor Version 5.00
[HKEY_CLASSES_ROOT\CLSID\{6E908BF4-3177-455C-A578-1E65A9AD1FDD}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{6E908BF4-3177-455C-A578-1E65A9AD1FDD}\Implemented Categories]
@=""
[HKEY_CLASSES_ROOT\CLSID\{6E908BF4-3177-455C-A578-1E65A9AD1FDD}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{6E908BF4-3177-455C-A578-1E65A9AD1FDD}\InprocServer32]
@="C:\\WINDOWS\\system32\\guard.tmp"
"ThreadingModel"="Apartment"
Windows Registry Editor Version 5.00
[HKEY_CLASSES_ROOT\CLSID\{E77A1E53-BE45-418F-8180-963777468497}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{E77A1E53-BE45-418F-8180-963777468497}\Implemented Categories]
@=""
[HKEY_CLASSES_ROOT\CLSID\{E77A1E53-BE45-418F-8180-963777468497}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{E77A1E53-BE45-418F-8180-963777468497}\InprocServer32]
@="C:\\WINDOWS\\system32\\liexpand.dll"
"ThreadingModel"="Apartment"
Windows Registry Editor Version 5.00
[HKEY_CLASSES_ROOT\CLSID\{C1801722-AF34-4312-BEFE-E51ADE4FAC72}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{C1801722-AF34-4312-BEFE-E51ADE4FAC72}\Implemented Categories]
@=""
[HKEY_CLASSES_ROOT\CLSID\{C1801722-AF34-4312-BEFE-E51ADE4FAC72}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{C1801722-AF34-4312-BEFE-E51ADE4FAC72}\InprocServer32]
@="C:\\WINDOWS\\system32\\nktui2.dll"
"ThreadingModel"="Apartment"
Windows Registry Editor Version 5.00
[HKEY_CLASSES_ROOT\CLSID\{837B32FB-537F-40B7-85C1-0599B8D92247}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{837B32FB-537F-40B7-85C1-0599B8D92247}\Implemented Categories]
@=""
[HKEY_CLASSES_ROOT\CLSID\{837B32FB-537F-40B7-85C1-0599B8D92247}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{837B32FB-537F-40B7-85C1-0599B8D92247}\InprocServer32]
@="C:\\WINDOWS\\system32\\guard.tmp"
"ThreadingModel"="Apartment"
Windows Registry Editor Version 5.00
[HKEY_CLASSES_ROOT\CLSID\{10C34609-6D99-41D4-B1EF-89D98A25FD27}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{10C34609-6D99-41D4-B1EF-89D98A25FD27}\Implemented Categories]
@=""
[HKEY_CLASSES_ROOT\CLSID\{10C34609-6D99-41D4-B1EF-89D98A25FD27}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{10C34609-6D99-41D4-B1EF-89D98A25FD27}\InprocServer32]
@="C:\\WINDOWS\\system32\\guard.tmp"
"ThreadingModel"="Apartment"
Windows Registry Editor Version 5.00
[HKEY_CLASSES_ROOT\CLSID\{9F17ED66-B84C-4058-9A7B-03038AF52CFF}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{9F17ED66-B84C-4058-9A7B-03038AF52CFF}\Implemented Categories]
@=""
[HKEY_CLASSES_ROOT\CLSID\{9F17ED66-B84C-4058-9A7B-03038AF52CFF}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{9F17ED66-B84C-4058-9A7B-03038AF52CFF}\InprocServer32]
@="C:\\WINDOWS\\system32\\dbserver.dll"
"ThreadingModel"="Apartment"
Windows Registry Editor Version 5.00
[HKEY_CLASSES_ROOT\CLSID\{B3EB4BB7-6898-4366-8527-67BB57CF5995}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{B3EB4BB7-6898-4366-8527-67BB57CF5995}\Implemented Categories]
@=""
[HKEY_CLASSES_ROOT\CLSID\{B3EB4BB7-6898-4366-8527-67BB57CF5995}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{B3EB4BB7-6898-4366-8527-67BB57CF5995}\InprocServer32]
@="C:\\WINDOWS\\system32\\ibv6mon.dll"
"ThreadingModel"="Apartment"
Windows Registry Editor Version 5.00
[HKEY_CLASSES_ROOT\CLSID\{F3E9A8F8-2122-4647-8193-DFB8CB9BFD38}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{F3E9A8F8-2122-4647-8193-DFB8CB9BFD38}\Implemented Categories]
@=""
[HKEY_CLASSES_ROOT\CLSID\{F3E9A8F8-2122-4647-8193-DFB8CB9BFD38}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{F3E9A8F8-2122-4647-8193-DFB8CB9BFD38}\InprocServer32]
@="C:\\WINDOWS\\system32\\dxmsrpcn.dll"
"ThreadingModel"="Apartment"
Windows Registry Editor Version 5.00
[HKEY_CLASSES_ROOT\CLSID\{12738F5B-C926-4165-A98C-F67309EFDB8D}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{12738F5B-C926-4165-A98C-F67309EFDB8D}\Implemented Categories]
@=""
[HKEY_CLASSES_ROOT\CLSID\{12738F5B-C926-4165-A98C-F67309EFDB8D}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{12738F5B-C926-4165-A98C-F67309EFDB8D}\InprocServer32]
@="C:\\WINDOWS\\system32\\mdaatext.dll"
"ThreadingModel"="Apartment"
Windows Registry Editor Version 5.00
[HKEY_CLASSES_ROOT\CLSID\{20123D40-B69A-4FC7-964E-D94DD619DA25}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{20123D40-B69A-4FC7-964E-D94DD619DA25}\Implemented Categories]
@=""
[HKEY_CLASSES_ROOT\CLSID\{20123D40-B69A-4FC7-964E-D94DD619DA25}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{20123D40-B69A-4FC7-964E-D94DD619DA25}\InprocServer32]
@="C:\\WINDOWS\\system32\\guard.tmp"
"ThreadingModel"="Apartment"
Windows Registry Editor Version 5.00
[HKEY_CLASSES_ROOT\CLSID\{37DA1A67-5A59-415F-86D6-0695E8592CA7}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{37DA1A67-5A59-415F-86D6-0695E8592CA7}\Implemented Categories]
@=""
[HKEY_CLASSES_ROOT\CLSID\{37DA1A67-5A59-415F-86D6-0695E8592CA7}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{37DA1A67-5A59-415F-86D6-0695E8592CA7}\InprocServer32]
@="C:\\WINDOWS\\system32\\cgmpobj.dll"
"ThreadingModel"="Apartment"
Windows Registry Editor Version 5.00
[HKEY_CLASSES_ROOT\CLSID\{877B5B9A-CE56-4A5B-9BAB-FE0462DF7B7C}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{877B5B9A-CE56-4A5B-9BAB-FE0462DF7B7C}\Implemented Categories]
@=""
[HKEY_CLASSES_ROOT\CLSID\{877B5B9A-CE56-4A5B-9BAB-FE0462DF7B7C}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{877B5B9A-CE56-4A5B-9BAB-FE0462DF7B7C}\InprocServer32]
@="C:\\WINDOWS\\system32\\srcurity.dll"
"ThreadingModel"="Apartment"
Windows Registry Editor Version 5.00
[HKEY_CLASSES_ROOT\CLSID\{0B914558-9339-43BE-9173-46D5629B38A2}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{0B914558-9339-43BE-9173-46D5629B38A2}\Implemented Categories]
@=""
[HKEY_CLASSES_ROOT\CLSID\{0B914558-9339-43BE-9173-46D5629B38A2}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{0B914558-9339-43BE-9173-46D5629B38A2}\InprocServer32]
@="C:\\WINDOWS\\system32\\mmisip.dll"
"ThreadingModel"="Apartment"
Windows Registry Editor Version 5.00
[HKEY_CLASSES_ROOT\CLSID\{D8E5A654-50E0-4CBC-AF15-DABA25F73F02}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{D8E5A654-50E0-4CBC-AF15-DABA25F73F02}\Implemented Categories]
@=""
[HKEY_CLASSES_ROOT\CLSID\{D8E5A654-50E0-4CBC-AF15-DABA25F73F02}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{D8E5A654-50E0-4CBC-AF15-DABA25F73F02}\InprocServer32]
@="C:\\WINDOWS\\system32\\nzprint.dll"
"ThreadingModel"="Apartment"
Windows Registry Editor Version 5.00
[HKEY_CLASSES_ROOT\CLSID\{F8B1A498-076B-4E94-B625-DDBAF79B9E0A}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{F8B1A498-076B-4E94-B625-DDBAF79B9E0A}\Implemented Categories]
@=""
[HKEY_CLASSES_ROOT\CLSID\{F8B1A498-076B-4E94-B625-DDBAF79B9E0A}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{F8B1A498-076B-4E94-B625-DDBAF79B9E0A}\InprocServer32]
@="C:\\WINDOWS\\system32\\oiecli.dll"
"ThreadingModel"="Apartment"
Windows Registry Editor Version 5.00
[HKEY_CLASSES_ROOT\CLSID\{83B890AC-8419-4AD8-B2DB-E7C4201E569F}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{83B890AC-8419-4AD8-B2DB-E7C4201E569F}\Implemented Categories]
@=""
[HKEY_CLASSES_ROOT\CLSID\{83B890AC-8419-4AD8-B2DB-E7C4201E569F}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{83B890AC-8419-4AD8-B2DB-E7C4201E569F}\InprocServer32]
@="C:\\WINDOWS\\system32\\dpactfrm.dll"
"ThreadingModel"="Apartment"
Windows Registry Editor Version 5.00
[HKEY_CLASSES_ROOT\CLSID\{F988377B-3034-4490-94F9-5F5E011C3CED}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{F988377B-3034-4490-94F9-5F5E011C3CED}\Implemented Categories]
@=""
[HKEY_CLASSES_ROOT\CLSID\{F988377B-3034-4490-94F9-5F5E011C3CED}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{F988377B-3034-4490-94F9-5F5E011C3CED}\InprocServer32]
@="C:\\WINDOWS\\system32\\ozbc16gt.dll"
"ThreadingModel"="Apartment"
Windows Registry Editor Version 5.00
[HKEY_CLASSES_ROOT\CLSID\{7F8F0D01-F3EC-4376-8A89-473C787C666D}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{7F8F0D01-F3EC-4376-8A89-473C787C666D}\Implemented Categories]
@=""
[HKEY_CLASSES_ROOT\CLSID\{7F8F0D01-F3EC-4376-8A89-473C787C666D}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{7F8F0D01-F3EC-4376-8A89-473C787C666D}\InprocServer32]
@="C:\\WINDOWS\\system32\\sqdoclc.dll"
"ThreadingModel"="Apartment"
Windows Registry Editor Version 5.00
[HKEY_CLASSES_ROOT\CLSID\{E8502DE9-6C78-4BF2-AFF3-181763BF15A3}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{E8502DE9-6C78-4BF2-AFF3-181763BF15A3}\Implemented Categories]
@=""
[HKEY_CLASSES_ROOT\CLSID\{E8502DE9-6C78-4BF2-AFF3-181763BF15A3}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{E8502DE9-6C78-4BF2-AFF3-181763BF15A3}\InprocServer32]
@="C:\\WINDOWS\\system32\\mqrecr40.dll"
"ThreadingModel"="Apartment"
Windows Registry Editor Version 5.00
[HKEY_CLASSES_ROOT\CLSID\{3C64B6A8-BDFE-47A8-8B14-81688BB75D53}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{3C64B6A8-BDFE-47A8-8B14-81688BB75D53}\Implemented Categories]
@=""
[HKEY_CLASSES_ROOT\CLSID\{3C64B6A8-BDFE-47A8-8B14-81688BB75D53}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{3C64B6A8-BDFE-47A8-8B14-81688BB75D53}\InprocServer32]
@="C:\\WINDOWS\\system32\\lvghours.dll"
"ThreadingModel"="Apartment"
Windows Registry Editor Version 5.00
[HKEY_CLASSES_ROOT\CLSID\{3DD11F13-4F6A-4F2D-BB01-51FC8FDF658C}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{3DD11F13-4F6A-4F2D-BB01-51FC8FDF658C}\Implemented Categories]
@=""
[HKEY_CLASSES_ROOT\CLSID\{3DD11F13-4F6A-4F2D-BB01-51FC8FDF658C}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{3DD11F13-4F6A-4F2D-BB01-51FC8FDF658C}\InprocServer32]
@="C:\\WINDOWS\\system32\\mfwdat10.dll"
"ThreadingModel"="Apartment"
Windows Registry Editor Version 5.00
[HKEY_CLASSES_ROOT\CLSID\{001BE213-639A-404B-8ADE-22EFC7CAB2B9}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{001BE213-639A-404B-8ADE-22EFC7CAB2B9}\Implemented Categories]
@=""
[HKEY_CLASSES_ROOT\CLSID\{001BE213-639A-404B-8ADE-22EFC7CAB2B9}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{001BE213-639A-404B-8ADE-22EFC7CAB2B9}\InprocServer32]
@="C:\\WINDOWS\\system32\\chmpobj.dll"
"ThreadingModel"="Apartment"
Windows Registry Editor Version 5.00
[HKEY_CLASSES_ROOT\CLSID\{D87DF34C-E28F-4D4D-B81B-685C1D2D5AE2}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{D87DF34C-E28F-4D4D-B81B-685C1D2D5AE2}\Implemented Categories]
@=""
[HKEY_CLASSES_ROOT\CLSID\{D87DF34C-E28F-4D4D-B81B-685C1D2D5AE2}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{D87DF34C-E28F-4D4D-B81B-685C1D2D5AE2}\InprocServer32]
@="C:\\WINDOWS\\system32\\silwoa.dll"
"ThreadingModel"="Apartment"
Windows Registry Editor Version 5.00
[HKEY_CLASSES_ROOT\CLSID\{96002481-697A-47D7-B549-BE61C39648B0}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{96002481-697A-47D7-B549-BE61C39648B0}\Implemented Categories]
@=""
[HKEY_CLASSES_ROOT\CLSID\{96002481-697A-47D7-B549-BE61C39648B0}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{96002481-697A-47D7-B549-BE61C39648B0}\InprocServer32]
@="C:\\WINDOWS\\system32\\kddhept.dll"
"ThreadingModel"="Apartment"
Windows Registry Editor Version 5.00
[HKEY_CLASSES_ROOT\CLSID\{6BF4CCDA-1BD3-4F65-A974-0E734EFB6C24}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{6BF4CCDA-1BD3-4F65-A974-0E734EFB6C24}\Implemented Categories]
@=""
[HKEY_CLASSES_ROOT\CLSID\{6BF4CCDA-1BD3-4F65-A974-0E734EFB6C24}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{6BF4CCDA-1BD3-4F65-A974-0E734EFB6C24}\InprocServer32]
@="C:\\WINDOWS\\system32\\dzcpcsvc.dll"
"ThreadingModel"="Apartment"
Windows Registry Editor Version 5.00
[HKEY_CLASSES_ROOT\CLSID\{0275A895-D7DF-446E-BBBE-4ACE60F64B82}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{0275A895-D7DF-446E-BBBE-4ACE60F64B82}\Implemented Categories]
@=""
[HKEY_CLASSES_ROOT\CLSID\{0275A895-D7DF-446E-BBBE-4ACE60F64B82}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{0275A895-D7DF-446E-BBBE-4ACE60F64B82}\InprocServer32]
@="C:\\WINDOWS\\system32\\guard.tmp"
"ThreadingModel"="Apartment"
Windows Registry Editor Version 5.00
[HKEY_CLASSES_ROOT\CLSID\{826EC28E-7525-4F8C-8D5E-72E6E4EFEFE4}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{826EC28E-7525-4F8C-8D5E-72E6E4EFEFE4}\Implemented Categories]
@=""
[HKEY_CLASSES_ROOT\CLSID\{826EC28E-7525-4F8C-8D5E-72E6E4EFEFE4}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{826EC28E-7525-4F8C-8D5E-72E6E4EFEFE4}\InprocServer32]
@="C:\\WINDOWS\\system32\\kpdmon.dll"
"ThreadingModel"="Apartment"
Windows Registry Editor Version 5.00
[HKEY_CLASSES_ROOT\CLSID\{E24E67D3-0351-449C-9C6E-9BE37D9E3D91}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{E24E67D3-0351-449C-9C6E-9BE37D9E3D91}\Implemented Categories]
@=""
[HKEY_CLASSES_ROOT\CLSID\{E24E67D3-0351-449C-9C6E-9BE37D9E3D91}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{E24E67D3-0351-449C-9C6E-9BE37D9E3D91}\InprocServer32]
@="C:\\WINDOWS\\system32\\npobjapi.dll"
"ThreadingModel"="Apartment"
Windows Registry Editor Version 5.00
[HKEY_CLASSES_ROOT\CLSID\{747310C2-6609-4CA8-8A4C-B75C1075C97A}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{747310C2-6609-4CA8-8A4C-B75C1075C97A}\Implemented Categories]
@=""
[HKEY_CLASSES_ROOT\CLSID\{747310C2-6609-4CA8-8A4C-B75C1075C97A}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{747310C2-6609-4CA8-8A4C-B75C1075C97A}\InprocServer32]
@="C:\\WINDOWS\\system32\\nrapi16.dll"
"ThreadingModel"="Apartment"
Windows Registry Editor Version 5.00
[HKEY_CLASSES_ROOT\CLSID\{61D3B9F2-6F1B-4DE2-89E4-369B8E61DE63}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{61D3B9F2-6F1B-4DE2-89E4-369B8E61DE63}\Implemented Categories]
@=""
[HKEY_CLASSES_ROOT\CLSID\{61D3B9F2-6F1B-4DE2-89E4-369B8E61DE63}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{61D3B9F2-6F1B-4DE2-89E4-369B8E61DE63}\InprocServer32]
@="C:\\WINDOWS\\system32\\swftpub.dll"
"ThreadingModel"="Apartment"
Windows Registry Editor Version 5.00
[HKEY_CLASSES_ROOT\CLSID\{00B39376-26B2-46C0-81A5-71171D8A299C}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{00B39376-26B2-46C0-81A5-71171D8A299C}\Implemented Categories]
@=""
[HKEY_CLASSES_ROOT\CLSID\{00B39376-26B2-46C0-81A5-71171D8A299C}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{00B39376-26B2-46C0-81A5-71171D8A299C}\InprocServer32]
@="C:\\WINDOWS\\system32\\fTultrep.dll"
"ThreadingModel"="Apartment"
Windows Registry Editor Version 5.00
[HKEY_CLASSES_ROOT\CLSID\{1EEF2096-A5FF-4ED4-9F46-40BADD259336}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{1EEF2096-A5FF-4ED4-9F46-40BADD259336}\Implemented Categories]
@=""
[HKEY_CLASSES_ROOT\CLSID\{1EEF2096-A5FF-4ED4-9F46-40BADD259336}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{1EEF2096-A5FF-4ED4-9F46-40BADD259336}\InprocServer32]
@="C:\\WINDOWS\\system32\\desapi.dll"
"ThreadingModel"="Apartment"
Windows Registry Editor Version 5.00
[HKEY_CLASSES_ROOT\CLSID\{6426F663-3413-4657-B9AF-4D2349BBC6F3}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{6426F663-3413-4657-B9AF-4D2349BBC6F3}\Implemented Categories]
@=""
[HKEY_CLASSES_ROOT\CLSID\{6426F663-3413-4657-B9AF-4D2349BBC6F3}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{6426F663-3413-4657-B9AF-4D2349BBC6F3}\InprocServer32]
@="C:\\WINDOWS\\system32\\miiqtz32.dll"
"ThreadingModel"="Apartment"
Windows Registry Editor Version 5.00
[HKEY_CLASSES_ROOT\CLSID\{AE9E9485-69EC-47D4-8C9D-80A6CF9A1A0A}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{AE9E9485-69EC-47D4-8C9D-80A6CF9A1A0A}\Implemented Categories]
@=""
[HKEY_CLASSES_ROOT\CLSID\{AE9E9485-69EC-47D4-8C9D-80A6CF9A1A0A}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{AE9E9485-69EC-47D4-8C9D-80A6CF9A1A0A}\InprocServer32]
@="C:\\WINDOWS\\system32\\snayerxp.dll"
"ThreadingModel"="Apartment"
Windows Registry Editor Version 5.00
[HKEY_CLASSES_ROOT\CLSID\{3424E7C6-7E44-4F50-9053-4429C62F8179}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{3424E7C6-7E44-4F50-9053-4429C62F8179}\Implemented Categories]
@=""
[HKEY_CLASSES_ROOT\CLSID\{3424E7C6-7E44-4F50-9053-4429C62F8179}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{3424E7C6-7E44-4F50-9053-4429C62F8179}\InprocServer32]
@="C:\\WINDOWS\\system32\\shbcsp.dll"
"ThreadingModel"="Apartment"
Windows Registry Editor Version 5.00
[HKEY_CLASSES_ROOT\CLSID\{F7D90A67-852A-4774-8DE1-D69BCA65E7CF}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{F7D90A67-852A-4774-8DE1-D69BCA65E7CF}\Implemented Categories]
@=""
[HKEY_CLASSES_ROOT\CLSID\{F7D90A67-852A-4774-8DE1-D69BCA65E7CF}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{F7D90A67-852A-4774-8DE1-D69BCA65E7CF}\InprocServer32]
@="C:\\WINDOWS\\system32\\IiagXpr6.dll"
"ThreadingModel"="Apartment"
Windows Registry Editor Version 5.00
[HKEY_CLASSES_ROOT\CLSID\{C4961849-209A-455B-8E16-D4F9CD53DB74}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{C4961849-209A-455B-8E16-D4F9CD53DB74}\Implemented Categories]
@=""
[HKEY_CLASSES_ROOT\CLSID\{C4961849-209A-455B-8E16-D4F9CD53DB74}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{C4961849-209A-455B-8E16-D4F9CD53DB74}\InprocServer32]
@="C:\\WINDOWS\\system32\\cKpesnpn.dll"
"ThreadingModel"="Apartment"
**********************************************************************************
Files Found are not all bad files:
C:\WINDOWS\SYSTEM32\
wrlogo~1.dll Wed 14 Dec 2005 19:25:10 A.... 492.544 481,00 K
1 item found: 1 file, 0 directories.
Total of file sizes: 492.544 bytes 481,00 K
Locate .tmp files:
No matches found.
**********************************************************************************
Directory Listing of system files:
Le volume dans le lecteur C n'a pas de nom.
Le num‚ro de s‚rie du volume est 0B20-14FA
R‚pertoire de C:\WINDOWS\System32
13/10/2005 17:05 <REP> Microsoft
10/10/2005 13:41 <REP> dllcache
0 fichier(s) 0 octets
2 R‚p(s) 33.703.264.256 octets libres
HijackThis
Logfile of HijackThis v1.99.1
Scan saved at 12:09:05, on 10/03/2006
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\ewido anti-malware\ewidoctrl.exe
C:\ewido anti-malware\ewidoguard.exe
C:\Sunbelt Software\Personal Firewall 4\kpf4ss.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe
C:\Sunbelt Software\Personal Firewall 4\kpf4gui.exe
C:\WINDOWS\Explorer.EXE
C:\Sunbelt Software\Personal Firewall 4\kpf4gui.exe
C:\PROGRA~1\MediaKey\MediaKey.EXE
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\WINDOWS\System32\rundll32.exe
C:\WINDOWS\System32\NotifyPhoneBook.exe
C:\Adobe\Photoshop Album Edition Découverte\3.0\Apps\apdproxy.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Java\jre1.5.0\bin\jusched.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\WINDOWS\twain_32\A4CIS\WATCH.exe
C:\NaturallySpeaking\Program\natspeak.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Hijackthis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.be/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [MediaKey] C:\PROGRA~1\MediaKey\MediaKey.EXE
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [AME_CSA] rundll32 amecsa.cpl,RUN_DLL
O4 - HKLM\..\Run: [CloseDNF] C:\WINDOWS\System32\Utility.exe \1008
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Adobe\Photoshop Album Edition Découverte\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [system_service] drivers32.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0\bin\jusched.exe
O4 - HKLM\..\RunServices: [system_service] drivers32.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [WINSOS VERIFY] "C:\Program Files\WINSOS\WINSOS.EXE" MINI
O4 - HKCU\..\RunServices: [Windows Service] windowz.exe
O4 - Startup: Watch.lnk = C:\WINDOWS\twain_32\A4CIS\WATCH.exe
O4 - Startup: Dragon NaturallySpeaking.lnk = C:\NaturallySpeaking\Program\natspeak.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: &Traduire à partir de l'anglais - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html
O8 - Extra context menu item: Pages liées - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Pages similaires - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Recherche &Google - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: Version de la page actuelle disponible dans le cache Google - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan8/oscan8.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{84648578-34D6-4E17-A1CA-973F72E85B71}: NameServer = 195.238.2.21 195.238.2.22
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: Boonty Games - BOONTY - C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe
O23 - Service: ewido security suite control - ewido networks - C:\ewido anti-malware\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\ewido anti-malware\ewidoguard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Sunbelt Kerio Personal Firewall 4 (KPF4) - Sunbelt Software - C:\Sunbelt Software\Personal Firewall 4\kpf4ss.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe
O23 - Service: Win32Sr - Unknown owner - C:\WINDOWS\win32ssr.exe (file missing)
SmitFraudFix
SmitFraudFix v2.23
Rapport fait à 12:12:06,60 le ven. 10/03/2006
Executé à partir de C:\attente\protection\d‚pannage\smitfraudFix\SmitfraudFix
OS: Microsoft Windows XP [version 5.1.2600]
»»»»»»»»»»»»»»»»»»»»»»»» Recherche C:\
»»»»»»»»»»»»»»»»»»»»»»»» Recherche C:\WINDOWS
»»»»»»»»»»»»»»»»»»»»»»»» Recherche C:\WINDOWS\system
»»»»»»»»»»»»»»»»»»»»»»»» Recherche C:\WINDOWS\Web
»»»»»»»»»»»»»»»»»»»»»»»» Recherche C:\WINDOWS\system32
»»»»»»»»»»»»»»»»»»»»»»»» Recherche ...\Application Data
»»»»»»»»»»»»»»»»»»»»»»»» Recherche Menu Démarrer
»»»»»»»»»»»»»»»»»»»»»»»» Recherche Bureau
»»»»»»»»»»»»»»»»»»»»»»»» Recherche C:\Program Files
»»»»»»»»»»»»»»»»»»»»»»»» Recherche présence de clés corrompues
»»»»»»»»»»»»»»»»»»»»»»»» Recherche éléments du bureau
»»»»»»»»»»»»»»»»»»»»»»»» Recherche Sharedtaskscheduler
SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Pré-chargeur Browseui"
[HKEY_CLASSES_ROOT\CLSID\{438755C2-A8BA-11D1-B96B-00A0C90312E1}\InProcServer32]
@="%SystemRoot%\System32\browseui.dll"
[HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{438755C2-A8BA-11D1-B96B-00A0C90312E1}\InProcServer32]
@="%SystemRoot%\System32\browseui.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Démon de cache des catégories de composant"
[HKEY_CLASSES_ROOT\CLSID\{8C7461EF-2B13-11d2-BE35-3078302C2030}\InProcServer32]
@="%SystemRoot%\System32\browseui.dll"
[HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{8C7461EF-2B13-11d2-BE35-3078302C2030}\InProcServer32]
@="%SystemRoot%\System32\browseui.dll"
»»»»»»»»»»»»»»»»»»»»»»»» Recherche infection wininet.dll
»»»»»»»»»»»»»»»»»»»»»»»» Fin du rapport
J'espère qu'après ceci, il n'y a plus rien.
Un grand merci et encore toutes mes excuses pour mon entrée en matière quelque peu cavalière. -
Contributeur'soir
ahah c est à toi qu il va falloir de la patience
tu as des infections de ttes sortes
certaines sont parties, mais les plus méchantes sont tjrs bien accrochées
c est le résultat d un ordi insuffisament protégé et surtout de ta façon de surfer - tu as de mauvaises fréquentations
rires, c est de ta faute !
========================
Installer L2mfix là (nettoie ligne O20 de Hijackthis)
http://www.atribune.org/downloads/l2mfix.exe
http://www.downloads.subratam.org/l2mfix.exe
http://users.skynet.be/BernieClub/tools.html
1. extraire le fichier sur le bureau
2. désactiver l'antivirus (car process est détecté faussement comme virus malware par certains antivirus)
3. lancer l2mfix.bat et sélectionner l'option #1 et faire Enter pour faire apparaître le log (cela prend qqs minutes)
4. Copie le log et colle
attendre mon feu vert pour la suite
5. Fermes toutes tes fenêtres windows
6. Relances l2mfix.bat et sélectionne l'option #2
7. l'ordi va redémarrer automatiquement sinon le faire manuellement
8. Recopie le log et colle-le à nouveau sur un FORUM approprié pour une aide
9. Lances un Hijackthis http://www.merijn.org/files/hijackthis.zip ou là http://users.skynet.be/BernieClub/tools.html
tu le lances " Do a system scan and save log " et tu copie/colle le rapport sur un FORUM approprié pour une aide (avec cliq droit de la souris).
==============================
un contrôle
Télécharger ceci (merci a S!RI pour ce petit programme) :
http://siri.urz.free.fr/Fix/SmitfraudFix.zip
L'exécuter, puis double-cliquer sur Smitfraudfix.cmd
Choisir l’option 1, il va générer un rapport
Copier-coller ce dernier dans un message sur le forum.
En image :
http://siri.urz.free.fr/Fix/SmitfraudFix.php
applique-toi dans tes devoirs , dd
-
Contributeurhello
ouvre hijack
fixe ceci de cette manière
(http://pageperso.aol.fr/balltrap34/demohijack.htm)
O16 - DPF: Dexia netbanking - http://netbanking.dexia.be/PC//Dynamic/Shared/Applet//DexiaIIA.cab
O16 - DPF: {6E5A37BF-FD42-463A-877C-4EB7002E68AE} (Housecall ActiveX 6.5) - http://us-housecall.trendmicro-europe.com/housecall/applet/html/native/x86/win32/activex/hcImpl.cab
O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} (Zylom Games Player) - http://game05.zylom.com/activex/zylomgamesplayer.cab
+
O4 - Global Startup: hpoddt01.exe.lnk = ?
O4 - Global Startup: hp psc 1000 series.lnk = ?
O4 - HKLM\..\Run: [winsysupd] C:\\winsysupd12.exe
O4 - HKLM\..\Run: [gimmygames] C:\\gimmygames12.exe
O4 - HKLM\..\Run: [winsysban] C:\\winsysban12.exe
===============
version de IE périmée
=======
pas de pare- feu actif ???
en voilà un gratuit et de bonne qualité
http://www.clubic.com/telecharger-fiche11071-kerio-personal-firewall.html
son tuto
http://www.pcentraide.com/index.php?showtopic=110
========
j attends rapports ddés au post 3-
Bonjour.
Je n'ai pas oublié, mais depuis hier, des fenêtres intempestives continuent à apparaître quel que soit le programme où je me trouve.
Comme tu l'as demandé, je colle les deux rapports que tu as demandé.
Bitdefender
Statistiques
Temps
01:16:28
Fichiers
356520
Directoires
3894
Secteurs de boot
3
Archives
3481
Paquets programmes
41177
Résultats
Virus identifiés
7
Fichiers infectés
14
Fichiers suspects
2
Avertissements
0
Désinfectés
0
Fichiers effacés
16
Info sur les moteurs
Définition virus
300777
Version des moteurs
AVCORE v1.0 (build 2292) (i386) (Mar 3 2005 11:57:29)
Analyse des plugins
13
Archive des plugins
39
Unpack des plugins
4
E-mail plugins
6
Système plugins
1
Paramètres d'analyse
Première action
Désinfecté
Seconde Action
Supprimé
Heuristique
Oui
Acceptez les avertissements
Oui
Extensions analysées
*;
Excludez les extensions
Analyse d'emails
Oui
Analyse des Archives
Oui
Analyser paquets programmes
Oui
Analyse des fichiers
Oui
Analyse de boot
Oui
Fichier analysé
Statut
C:\WINDOWS\system32\guard.tmp
Détecté avec: Adware.Dinky.A.Trojan
C:\WINDOWS\system32\guard.tmp
Supprimé
C:\WINDOWS\system32\__delete_on_reboot__desapi.dll
Détecté avec: Adware.Dinky.A.Trojan
C:\WINDOWS\system32\__delete_on_reboot__desapi.dll
Echec de la désinfection
C:\WINDOWS\system32\__delete_on_reboot__desapi.dll
Echec de la suppression
C:\Documents and Settings\a\.housecall\Quarantine\A0020450.exe.bac_a01904=>(Quarantine-4)
Infecté par: Backdoor.SDBot.ANS
C:\Documents and Settings\a\.housecall\Quarantine\A0020450.exe.bac_a01904=>(Quarantine-4)
Echec de la désinfection
C:\Documents and Settings\a\.housecall\Quarantine\A0020450.exe.bac_a01904=>(Quarantine-4)
Supprimé
C:\System Volume Information\_restore{90B0E1B4-2DB5-41F8-8C23-57CD0153BCB7}\RP67\A0021649.exe
Suspecté de: Generic.Malware.Ssp.426B0BAA
C:\System Volume Information\_restore{90B0E1B4-2DB5-41F8-8C23-57CD0153BCB7}\RP67\A0021649.exe
Echec de la désinfection
C:\System Volume Information\_restore{90B0E1B4-2DB5-41F8-8C23-57CD0153BCB7}\RP67\A0021649.exe
Supprimé
C:\System Volume Information\_restore{90B0E1B4-2DB5-41F8-8C23-57CD0153BCB7}\RP67\A0021668.dll
Détecté avec: Adware.Dinky.A.Trojan
C:\System Volume Information\_restore{90B0E1B4-2DB5-41F8-8C23-57CD0153BCB7}\RP67\A0021668.dll
Supprimé
C:\System Volume Information\_restore{90B0E1B4-2DB5-41F8-8C23-57CD0153BCB7}\RP67\A0021669.dll
Détecté avec: Adware.Dinky.A.Trojan
C:\System Volume Information\_restore{90B0E1B4-2DB5-41F8-8C23-57CD0153BCB7}\RP67\A0021669.dll
Supprimé
C:\attente\ripper\setupcdripper.exe=>wise0017
Infecté par: Trojan.Downloader.Adload.A
C:\attente\ripper\setupcdripper.exe=>wise0017
Echec de la désinfection
C:\attente\ripper\setupcdripper.exe=>wise0017
Supprimé
C:\attente\ripper\setupcdripper.exe
Echec de la mise à jour
C:\attente\ripper\setupcdripper.exe=>wise0019=>(ZIP Sfx o)=>v2.0.4a.cab=>NHelper.dll
Détecté avec: Adware.Navexcel.A
C:\attente\ripper\setupcdripper.exe=>wise0019=>(ZIP Sfx o)=>v2.0.4a.cab=>NHelper.dll
Echec de la désinfection
C:\attente\ripper\setupcdripper.exe=>wise0019=>(ZIP Sfx o)=>v2.0.4a.cab=>NHelper.dll
Supprimé
C:\attente\ripper\setupcdripper.exe=>wise0019=>(ZIP Sfx o)=>v2.0.4a.cab
Echec de la mise à jour
C:\attente\ripper\setupcdripper.exe=>wise0019=>(ZIP Sfx o)=>v2.0.4a.cab=>NHUninstaller.exe
Détecté avec: Adware.Navexcel.A
C:\attente\ripper\setupcdripper.exe=>wise0019=>(ZIP Sfx o)=>v2.0.4a.cab=>NHUninstaller.exe
Echec de la désinfection
C:\attente\ripper\setupcdripper.exe=>wise0019=>(ZIP Sfx o)=>v2.0.4a.cab=>NHUninstaller.exe
Supprimé
C:\attente\ripper\setupcdripper.exe=>wise0019=>(ZIP Sfx o)=>v2.0.4a.cab
Echec de la mise à jour
C:\attente\ripper\setupcdripper.exe=>wise0019=>(ZIP Sfx o)=>v2.0.4a.cab=>NHUpdater.exe
Détecté avec: Adware.Navexcel.A
C:\attente\ripper\setupcdripper.exe=>wise0019=>(ZIP Sfx o)=>v2.0.4a.cab=>NHUpdater.exe
Echec de la désinfection
C:\attente\ripper\setupcdripper.exe=>wise0019=>(ZIP Sfx o)=>v2.0.4a.cab=>NHUpdater.exe
Supprimé
C:\attente\ripper\setupcdripper.exe=>wise0019=>(ZIP Sfx o)=>v2.0.4a.cab
Echec de la mise à jour
C:\sonia\chargementnet\netpumper-1.23-setup.exe=>(Instyler o)=>(Instyler Module 78)
Infecté par: Trojan.Downloader.Swizzor.DO
C:\sonia\chargementnet\netpumper-1.23-setup.exe=>(Instyler o)=>(Instyler Module 78)
Supprimé
C:\sonia\chargementnet\netpumper-1.23-setup.exe=>(Instyler o)
Echec de la mise à jour
D:\System Volume Information\_restore{90B0E1B4-2DB5-41F8-8C23-57CD0153BCB7}\RP67\A0021650.exe
Suspecté de: Generic.Malware.Ssp.426B0BAA
D:\System Volume Information\_restore{90B0E1B4-2DB5-41F8-8C23-57CD0153BCB7}\RP67\A0021650.exe
Echec de la désinfection
D:\System Volume Information\_restore{90B0E1B4-2DB5-41F8-8C23-57CD0153BCB7}\RP67\A0021650.exe
Supprimé
D:\attente\ripper\setupcdripper.exe=>wise0017
Infecté par: Trojan.Downloader.Adload.A
D:\attente\ripper\setupcdripper.exe=>wise0017
Echec de la désinfection
D:\attente\ripper\setupcdripper.exe=>wise0017
Supprimé
D:\attente\ripper\setupcdripper.exe
Echec de la mise à jour
D:\attente\ripper\setupcdripper.exe=>wise0019=>(ZIP Sfx o)=>v2.0.4a.cab=>NHelper.dll
Détecté avec: Adware.Navexcel.A
D:\attente\ripper\setupcdripper.exe=>wise0019=>(ZIP Sfx o)=>v2.0.4a.cab=>NHelper.dll
Echec de la désinfection
D:\attente\ripper\setupcdripper.exe=>wise0019=>(ZIP Sfx o)=>v2.0.4a.cab=>NHelper.dll
Supprimé
D:\attente\ripper\setupcdripper.exe=>wise0019=>(ZIP Sfx o)=>v2.0.4a.cab
Echec de la mise à jour
D:\attente\ripper\setupcdripper.exe=>wise0019=>(ZIP Sfx o)=>v2.0.4a.cab=>NHUninstaller.exe
Détecté avec: Adware.Navexcel.A
D:\attente\ripper\setupcdripper.exe=>wise0019=>(ZIP Sfx o)=>v2.0.4a.cab=>NHUninstaller.exe
Echec de la désinfection
D:\attente\ripper\setupcdripper.exe=>wise0019=>(ZIP Sfx o)=>v2.0.4a.cab=>NHUninstaller.exe
Supprimé
D:\attente\ripper\setupcdripper.exe=>wise0019=>(ZIP Sfx o)=>v2.0.4a.cab
Echec de la mise à jour
D:\attente\ripper\setupcdripper.exe=>wise0019=>(ZIP Sfx o)=>v2.0.4a.cab=>NHUpdater.exe
Détecté avec: Adware.Navexcel.A
D:\attente\ripper\setupcdripper.exe=>wise0019=>(ZIP Sfx o)=>v2.0.4a.cab=>NHUpdater.exe
Echec de la désinfection
D:\attente\ripper\setupcdripper.exe=>wise0019=>(ZIP Sfx o)=>v2.0.4a.cab=>NHUpdater.exe
Supprimé
D:\attente\ripper\setupcdripper.exe=>wise0019=>(ZIP Sfx o)=>v2.0.4a.cab
ewido
+ Résultats du scan:
[1088] C:\WINDOWS\system32\swftpub.dll -> Adware.Look2Me : Erreur durant le nettoyage
[1564] C:\WINDOWS\system32\swftpub.dll -> Adware.Look2Me : Erreur durant le nettoyage
C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\G445SXJA\rp5[1].exe -> Backdoor.SdBot.aad : Nettoyer et sauvegarder
C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\G445SXJA\rp5[2].exe -> Backdoor.SdBot.aad : Nettoyer et sauvegarder
C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\ILST83YZ\rp5[1].exe -> Backdoor.SdBot.aad : Nettoyer et sauvegarder
C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\VOKI1NTR\rp5[1].exe -> Backdoor.SdBot.aad : Nettoyer et sauvegarder
C:\WINDOWS\system32\__delete_on_reboot__swftpub.dll -> Adware.Look2Me : Nettoyer et sauvegarder
C:\WINDOWS\system32\a.exe -> Backdoor.SdBot.aad : Nettoyer et sauvegarder
C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\0AK34WFG\ErrorSafeScannerInstallFR[1].cab/UERSV_0001_N68M0602NetInstaller.exe -> Not-A-Virus.Downloader.Win32.WinFixer.d : Nettoyer et sauvegarder
C:\WINDOWS\Temp\Cookies\a@ad.yieldmanager[2].txt -> TrackingCookie.Yieldmanager : Nettoyer et sauvegarder
C:\WINDOWS\Temp\Cookies\a@cpvfeed[2].txt -> TrackingCookie.Cpvfeed : Nettoyer et sauvegarder
C:\WINDOWS\Temp\Cookies\a@stats1.reliablestats[1].txt -> TrackingCookie.Reliablestats : Nettoyer et sauvegarder
C:\WINDOWS\__delete_on_reboot__win32ssr.exe -> Backdoor.SdBot.aad : Nettoyer et sauvegarder
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\C4Q9S2OM\rp5[1].exe -> Backdoor.SdBot.aad : Nettoyer et sauvegarder
C:\Documents and Settings\a\Local Settings\Temp\Cookies\a@weborama[2].txt -> TrackingCookie.Weborama : Nettoyer et sauvegarder
C:\Documents and Settings\a\Local Settings\Temp\Cookies\a@com[2].txt -> TrackingCookie.Com : Nettoyer et sauvegarder
C:\Documents and Settings\a\Local Settings\Temp\Cookies\a@h.starware[1].txt -> TrackingCookie.Starware : Nettoyer et sauvegarder
C:\Documents and Settings\a\Local Settings\Temp\Cookies\a@tacoda[1].txt -> TrackingCookie.Tacoda : Nettoyer et sauvegarder
C:\Documents and Settings\a\Local Settings\Temp\Cookies\a@burstnet[2].txt -> TrackingCookie.Burstnet : Nettoyer et sauvegarder
C:\Documents and Settings\a\Local Settings\Temp\Cookies\a@ivwbox[2].txt -> TrackingCookie.Ivwbox : Nettoyer et sauvegarder
C:\Documents and Settings\a\Local Settings\Temp\Cookies\a@adopt.euroclick[2].txt -> TrackingCookie.Euroclick : Nettoyer et sauvegarder
C:\Documents and Settings\a\Local Settings\Temp\Cookies\a@cpvfeed[2].txt -> TrackingCookie.Cpvfeed : Nettoyer et sauvegarder
C:\Documents and Settings\a\Local Settings\Temp\Cookies\a@ad.yieldmanager[1].txt -> TrackingCookie.Yieldmanager : Nettoyer et sauvegarder
C:\Documents and Settings\a\Local Settings\Temp\Cookies\a@stats1.reliablestats[1].txt -> TrackingCookie.Reliablestats : Nettoyer et sauvegarder
C:\Documents and Settings\a\Local Settings\Temp\Cookies\a@promo.casinotropez[2].txt -> TrackingCookie.Casinotropez : Nettoyer et sauvegarder
C:\Documents and Settings\a\Cookies\a@cpvfeed[1].txt -> TrackingCookie.Cpvfeed : Nettoyer et sauvegarder
C:\Documents and Settings\a\Cookies\a@stats1.reliablestats[1].txt -> TrackingCookie.Reliablestats : Nettoyer et sauvegarder
C:\Documents and Settings\a\Cookies\a@ad.yieldmanager[2].txt -> TrackingCookie.Yieldmanager : Nettoyer et sauvegarder
:mozilla.7:C:\Documents and Settings\a\Application Data\Mozilla\Firefox\Profiles\rymhwl1s.default\cookies.txt -> TrackingCookie.Yieldmanager : Nettoyer et sauvegarder
:mozilla.8:C:\Documents and Settings\a\Application Data\Mozilla\Firefox\Profiles\rymhwl1s.default\cookies.txt -> TrackingCookie.Yieldmanager : Nettoyer et sauvegarder
:mozilla.14:C:\Documents and Settings\a\Application Data\Mozilla\Firefox\Profiles\rymhwl1s.default\cookies.txt -> TrackingCookie.Com : Nettoyer et sauvegarder
:mozilla.15:C:\Documents and Settings\a\Application Data\Mozilla\Firefox\Profiles\rymhwl1s.default\cookies.txt -> TrackingCookie.Com : Nettoyer et sauvegarder
C:\System Volume Information\_restore{90B0E1B4-2DB5-41F8-8C23-57CD0153BCB7}\RP49\A0014389.exe -> Adware.NewDotNet : Nettoyer et sauvegarder
C:\System Volume Information\_restore{90B0E1B4-2DB5-41F8-8C23-57CD0153BCB7}\RP63\A0017755.exe -> Not-A-Virus.Downloader.Win32.WinFixer.d : Nettoyer et sauvegarder
C:\System Volume Information\_restore{90B0E1B4-2DB5-41F8-8C23-57CD0153BCB7}\RP66\A0020497.exe -> Backdoor.SdBot.aad : Nettoyer et sauvegarder
C:\System Volume Information\_restore{90B0E1B4-2DB5-41F8-8C23-57CD0153BCB7}\RP66\A0020508.exe -> Backdoor.SdBot.aad : Nettoyer et sauvegarder
C:\System Volume Information\_restore{90B0E1B4-2DB5-41F8-8C23-57CD0153BCB7}\RP66\A0021528.exe -> Backdoor.SdBot.aad : Nettoyer et sauvegarder
C:\System Volume Information\_restore{90B0E1B4-2DB5-41F8-8C23-57CD0153BCB7}\RP66\A0021550.exe -> Backdoor.SdBot.aad : Nettoyer et sauvegarder
C:\System Volume Information\_restore{90B0E1B4-2DB5-41F8-8C23-57CD0153BCB7}\RP66\A0021559.exe -> Backdoor.SdBot.aad : Nettoyer et sauvegarder
C:\System Volume Information\_restore{90B0E1B4-2DB5-41F8-8C23-57CD0153BCB7}\RP66\A0021568.exe -> Backdoor.SdBot.aad : Nettoyer et sauvegarder
C:\System Volume Information\_restore{90B0E1B4-2DB5-41F8-8C23-57CD0153BCB7}\RP66\A0021589.exe -> Backdoor.SdBot.aad : Nettoyer et sauvegarder
C:\System Volume Information\_restore{90B0E1B4-2DB5-41F8-8C23-57CD0153BCB7}\RP66\A0021603.exe -> Backdoor.SdBot.aad : Nettoyer et sauvegarder
C:\attente\protection\WinAntiSpyware2006FreeInstall.exe -> Not-A-Virus.Downloader.Win32.WinFixer.d : Nettoyer et sauvegarder
C:\sonia\chargementnet\jeux\HongKong_Mahjong1024-dm.exe -> Adware.Trymedia : Nettoyer et sauvegarder
Merci pour l'aide et la patience
-
-
Contributeurhello
pas grave
pré-nettoyage ds l ordre , cela simplifie le boulot du helper pour la suite
1/ - telech
ewido (dowload)
http://www.ewido.net/fr/download/
copie/COLLE rapport entier
2/ - scan online sous IE
http://www.bitdefender.fr/bd/site/search.php#
copie/COLLE rapport entier
c est l heure de l apéro
tu auras ttes les instructions au courant de la nuit -
Contributeurhello
un bonjour te serait salutaire pour que je prenne ta dde en compte
merci
http://www.technicland.com/malpolitus.swf-
BONJOUR
Tu as parfaitement raison et ça ne m'arrive pratiquement jamais d'être malpoli à ce point.
Voilà une semaine que je suis embêté et très énervé par mon problème de fenêtres qui s'ouvrent continuellement sur ma machine. Je me suis laissé emporter par l'espoir d'avoir enfin une solution.
Merci de ne pas avoir coupé court : je l'aurais bien mérité. Allez, un bon mouvement.
Mille excuses.
-
