[surveiller] activité d'une aplication

Résolu
Utilisateur anonyme -  
Salutation,
Voilà après avoir desinstallé norton internet secuirity avec l'outil de Symantec, il etait resté dans le centre de securité de windows, et j'ai meme nettoyé le registre avec CCleaner, RegCleaner et EasyCleaner, mais ça na rien donné, j'ai supprimé toutes les clés et tous les fichiers contenant "Symantec, norton" mais rien à faire :(

Et ce que je vous demande c'est de me dire s'il y a un ligiciel pour surveiller quel fichier et quel clé sont chargé par le une aplication.

Autre chose: merci de me dire aussi où ce trouve l'.exe du centre de securité.

SVP, veuillez m'aider.

Merci d'avace.
Configuration: Windows XP SP2

21 réponses

Résumé de la discussion

La désinstallation de Norton Internet Security a laissé des traces dans le Centre de sécurité Windows, rendant difficile la suppression complète des clés et fichiers liés. Des outils de surveillance comme Filemon, Handle, Process Monitor, Process Explorer et Regmon permettent de visualiser en temps réel les activités du système de fichiers et du registre associées à une application. Certaines réponses suggèrent même d’identifier précisément les fichiers et clés chargés par le Centre de sécurité Windows lors de son exécution, afin d’isoler les éléments à supprimer ou à corriger. Certaines observations donnent aussi des exemples concrets des fichiers et clés identifiés, comme gdiplace.dll, wscui.cpl et rundll32.exe, utile pour comprendre les interactions entre le Centre et les composants système.

Bobot (l’IA à votre service)
  1. ^^Marie^^
    Salut

    Pour désinstaller Norton correctement
    http://service1.symantec.com/SUPPORT/INTER/tsgeninfointl.nsf/fr_docid/20050414110429924
    0
    1. Utilisateur anonyme
      Désolé pour le retard, il y avait un bug à CCM.

      Bon la solution que tu me propose c'est elle que j'avait fait pour desinstaller norton mais malgré ça, il était resté dans le centre de securité.

      Et ce que je vous demande c'est de me montrer un logiciel qui affiche les clés et les fichiers chargé par une application et aussi de m'indiquer où se trouve l'exe du centre de securité.

      Merci d'avance
      0
      1. ^^Marie^^
        Re,

        Fais ce qui suit
        Stp

        F - Hijackthis - Outil de diagnostic et réparation

        télécharge HijackThis ici:
        http://telechargement.zebulon.fr/138-hijackthis-1991.html

        Dézippe le dans un dossier prévu à cet effet.
        Par exemple C:\hijackthis < Enregistre le bien dans c : !
        Démo : (Merci a Balltrap34 pour cette réalisation)
        http://pageperso.aol.fr/balltrap34/Hijenr.gif

        Lance le puis:
        clique sur "do a system scan and save logfile" (cf démo)
        faire un copier coller du log entier sur le forum

        Démo : (Merci a Balltrap34 pour cette réalisation)
        http://pageperso.aol.fr/balltrap34/demohijack.htm

        Bon courage

        A+
        0
    2. Utilisateur anonyme
      Re,
      mdr ce hijackthis m'a cosé un prob dans le centre de securité de windows XP (anti-virus indetectable...), et à cause de lui j'ai du reinstaller mon XP (je sais que je pouvait cocher la case "j'ai un anti-virus que je.....", mais si l'antivirus ne serait pas lancé, je ne serait pas avertis).

      Et puis quand j'ai reinstallé mon XP, j'avait envie d'essayer Norton Internet Security, mais 5min plustard, j'etait dessu de cette poubelle qui ralentit le demarrage et qui consomme trop de ressource pour rien, alors je le désinstalle, mais c'est une colle à la peau car il ne veut pas lacher le centre de securité, alor j'essaye diverses methodes avec les nettoyeurs mais sans rien donner, je supprime toutes les clé et tous les fichiers contenant "Norton" ou "Symantec".....mais sans rien donner, et en installant Kaspersky internet security, le centre de securité ne m'avertit pas si l'antivirus est périmé ou désactivé, car il croit que norton est toujour là....: (

      Et je me demande serieusement comment ce groupe stuppide vien sortir un antivirus colle à la peau et payant en plus....

      Donc je ne voit pas un autre moyen que de surveiller quels fichiers et quelles clés sont chargé par le centre de sécurité.

      Merci d'avance
      0
      1. ^^Marie^^
        Slt

        mdr ce hijackthis m'a cosé un prob ?????

        Je ne vois pas du tout en quoi ???
        C'est un outil de diagnostic.
        Donc, aucun rapport au blocage de ton pC, à moins que tu aies touché des lignes dessus !!!

        A lire

        https://fr.wikipedia.org/wiki/HijackThis

        Par contre tu devrais le faire...

        Edit :: je t'avais donné le lien pour désinstaller Norton correctement. Lien que je fais passer à tous les internautes qui ont Norton. JAMAIS eu de soucis.....

        0
        2. Utilisateur anonyme
          Attend attend... c'est pas en l'utilisant qu'il m'a cosé le bug.....mais en le desinstallant il à touché à une clé ou à un fichier concernant le centre de securité.
          0
          1. ^^Marie^^
            mais en le desinstallant il à touché à une clé ou à un fichier concernant le centre de securité.

            IMPOSSIBLE... HT ne touche strictement à rien.

            0
            1. Utilisateur anonyme
              Bon j'ai un autre moyen, je l'installe et quand je termine je le supprime puis je nettoie le registre.. je vais envoyer le rapport ici dans quelque instants..
              0
              1. Utilisateur anonyme
                Voilà le rapport:(au fait c'est pas le meme Hijackthis ke j'ai telechargé et qui m'a cosé le prob)

                Logfile of HijackThis v1.99.1
                Scan saved maintenant, on 24/06/2007
                Platform: Windows XP SP2 (WinNT 5.01.2600)
                MSIE: Internet Explorer v7.00 (7.00.5730.0011)

                Running processes:
                C:\WINDOWS\System32\smss.exe
                C:\WINDOWS\system32\winlogon.exe
                C:\WINDOWS\system32\services.exe
                C:\WINDOWS\system32\lsass.exe
                C:\WINDOWS\system32\svchost.exe
                C:\WINDOWS\System32\svchost.exe
                C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe
                C:\WINDOWS\system32\spoolsv.exe
                C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe
                C:\WINDOWS\system32\cisvc.exe
                C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
                C:\WINDOWS\system32\nvsvc32.exe
                C:\WINDOWS\system32\oodag.exe
                C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
                C:\WINDOWS\Explorer.EXE
                C:\WINDOWS\system32\RunDll32.exe
                C:\Program Files\ANI\ANIWZCS2 Service\WZCSLDR2.exe
                C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe
                C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
                C:\WINDOWS\system32\RUNDLL32.EXE
                C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe
                C:\WINDOWS\system32\ctfmon.exe
                C:\Program Files\Internet Download Manager\IDMan.exe
                C:\Program Files\Windows Media Player\WMPNSCFG.exe
                C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
                C:\WINDOWS\System32\svchost.exe
                C:\Program Files\Internet Download Manager\IEMonitor.exe
                C:\WINDOWS\system32\cidaemon.exe
                C:\Program Files\Mozilla Thunderbird\thunderbird.exe
                C:\Program Files\Internet Explorer\IEXPLORE.EXE
                C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
                C:\Program Files\HijackThis\HijackThis.exe

                R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.01net.com/telecharger/
                R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
                R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
                R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.01net.com/telecharger/
                R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
                O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files\Internet Download Manager\IDMIECC.dll
                O2 - BHO: (no name) - {02DCA195-602B-4B1F-83FF-381B7E804BDB} - C:\WINDOWS\system32\HDBHO.dll
                O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
                O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
                O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
                O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
                O4 - HKLM\..\Run: [IMEKRMIG6.1] C:\WINDOWS\ime\imkr6_1\IMEKRMIG.EXE
                O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
                O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
                O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
                O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
                O4 - HKLM\..\Run: [ANIWZCS2Service] C:\Program Files\ANI\ANIWZCS2 Service\WZCSLDR2.exe
                O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe
                O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe
                O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
                O4 - HKLM\..\Run: [OSSelectorReinstall] C:\Program Files\Fichiers communs\Acronis\Partition Suite\oss_reinstall.exe
                O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
                O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
                O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
                O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
                O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe"
                O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
                O4 - HKCU\..\Run: [IDMan] C:\Program Files\Internet Download Manager\IDMan.exe /onboot
                O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
                O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
                O8 - Extra context menu item: Ajouter à Kaspersky Anti-Banner - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\ie_banner_deny.htm
                O8 - Extra context menu item: Download All Links with IDM - C:\Program Files\Internet Download Manager\IEGetAll.htm
                O8 - Extra context menu item: Download with IDM - C:\Program Files\Internet Download Manager\IEExt.htm
                O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
                O9 - Extra button: Statistiques d’Anti-Virus Internet - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\scieplugin.dll
                O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
                O9 - Extra button: Barre de recherche Encarta - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Fichiers communs\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
                O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                O10 - Broken Internet access because of LSP provider 'c:\program files\bonjour\mdnsnsp.dll' missing
                O11 - Options group: [INTERNATIONAL] International*
                O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
                O16 - DPF: {4CCA4E80-9259-11D9-AC6E-444553544200} - http://h30155.www3.hp.com/ediags/dd/install/HPInstallMgr_v01_5.cab
                O16 - DPF: {BE833F39-1E0C-468C-BA70-25AAEE55775E} (System Requirements Lab) - http://www.systemrequirementslab.com/sysreqlab.cab
                O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
                O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
                O17 - HKLM\System\CCS\Services\Tcpip\..\{13E5D784-1149-4E05-B2D4-041942C0AAA5}: NameServer = 192.168.0.100,61.88.88.88
                O17 - HKLM\System\CCS\Services\Tcpip\..\{B38ADCE6-F225-4F1C-9E23-89BCBEA06F67}: NameServer = 81.22.90.29 82.101.136.29
                O17 - HKLM\System\CS1\Services\Tcpip\..\{13E5D784-1149-4E05-B2D4-041942C0AAA5}: NameServer = 192.168.0.100,61.88.88.88
                O17 - HKLM\System\CS2\Services\Tcpip\..\{13E5D784-1149-4E05-B2D4-041942C0AAA5}: NameServer = 192.168.0.100,61.88.88.88
                O17 - HKLM\System\CS3\Services\Tcpip\..\{13E5D784-1149-4E05-B2D4-041942C0AAA5}: NameServer = 192.168.0.100,61.88.88.88
                O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
                O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Fichiers communs\Microsoft Shared\Help\hxds.dll
                O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
                O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\FICHIE~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
                O20 - AppInit_DLLs: C:\PROGRA~1\KASPER~1\KASPER~1.0\adialhk.dll
                O20 - Winlogon Notify: klogon - C:\WINDOWS\system32\klogon.dll
                O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
                O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
                O23 - Service: ANIWZCSd Service (ANIWZCSdService) - Alpha Networks Inc. - C:\Program Files\ANI\ANIWZCS2 Service\ANIWZCSdS.exe
                O23 - Service: Kaspersky Internet Security 6.0 (AVP) - Unknown owner - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe" -r (file missing)
                O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriverT.exe
                O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
                O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe
                O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
                O23 - Service: O&O Defrag - O&O Software GmbH - C:\WINDOWS\system32\oodag.exe
                O23 - Service: Planificateur LiveUpdate automatique - Unknown owner - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe (file missing)
                O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
                O23 - Service: StyleXPService - Unknown owner - C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe
                0
                4. Utilisateur anonyme
                  Je n'ai pas bien compris la question^^
                  0
                  1. ^^Marie^^
                    Pour faire un récapitulatif de tes soucis.

                    Dis moi comment se comporte ton PC.

                    0
                    1. Utilisateur anonyme
                      Je n'ai rien remarqué d'anormal a par le bug du centre de securité.
                      0
                      1. ^^Marie^^
                        Tu as toujours le beug ???
                        Encore maintenant ??
                        0
                    2. Utilisateur anonyme
                      Bah wé puisque je n'ai rien fait.
                      0
                      1. ^^Marie^^
                        Re

                        C - Ccleaner :
                        (nettoyeur de registre, cookies+temps+tempos+prefetch+historique+etc.)
                        Télécharge ici :
                        https://www.ccleaner.com/ccleaner/download
                        Tutorial ici:
                        https://www.vulgarisation-informatique.com/nettoyer-windows-ccleaner.php
                        ET
                        http://perso.orange.fr/jesses/Docs/Logiciels/CCleaner.htm

                        D – Ewido – AVG
                        AVG Anti-Spyware :
                        https://www.avg.com/en-ww/free-antivirus-download
                        Tu l'installes.
                        Lance AVG Anti-Spyware et clique sur le bouton Mise à jour.
                        Patiente!
                        Lance AVG Anti-Spyware
                        Clique sur le bouton Analyse (de la barre d'outils)
                        Puis sur l'onglets Comment réagir, clique sur Actions recommandées.
                        Reviens à l'onglet Analyse. Clique sur Analyse complète du système.
                        /!\ Si un fichier est infecté en fin d'analyse /!\
                        choisis l'option " Appliquer toutes les actions " en bas.
                        Clique sur "Enregistrer le rapport" puis sur "Enregistrer le rapport sous"
                        Enregistre ce fichier texte sur ton bureau.
                        Copie/colle le rapport
                        0
                    3. Utilisateur anonyme
                      Re,
                      mdr, bon ecoute, mon regsitre je l'ai nettoyé avec CCleaner, Easy Cleaner et RagCleaner et ça n' rien donné!

                      Et en plus j'ai Kaspersky Internet Security 7.0.0.119 et il n' rien détécté!

                      Alors faut trouver autre chose.

                      Et tu connait pas un logiciel qui surveille les activités d'une application?
                      0
                      1. dubcek Contributeur
                        Quelque softs là : https://docs.microsoft.com/en-us/

                        • Filemon
                        Cet outil de surveillance vous permet de voir toutes les activités du système de fichiers en temps réel.
                        • Handle
                        Cet utilitaire pratique de ligne de commande indique quels fichiers sont ouverts par quel processus, et bien plus encore.
                        • Process Explorer
                        Indique quels fichiers ont été ouverts par les clés de registre et autres processus d'objet, quelles DLL ils ont chargées, et bien plus encore. Cet utilitaire particulièrement puissant affichera même le propriétaire de chaque processus.
                        • Process Monitor
                        Permet de surveiller l'activité du système de fichiers, du Registre, des processus, des thread et des DLL en temps réel.
                        • Regmon
                        Cet outil de surveillance vous permet de voir toutes les activités du Registre en temps réel.
                        0
                        1. Utilisateur anonyme
                          Merci!
                          Mais comment faire pour surveiller uniquement le centre de securité, car il surveille tous ce que font les processus et il m'écrit des tas ligne dont je ne sais pas où se trouve le processus du centre de securité^^...

                          Merci d'avance
                          0
                        2. ^^Marie^^
                          @Utilisateur anonyme il m'écrit des tas ligne

                          Pourrais-tu les mettre ici (copier/coller)
                          stp
                          merci
                          0
                      2. Utilisateur anonyme
                        Attendez.......

                        je ne peux pas car il y a des milliers de ligne qui ce devlopent sans cesse...

                        Par contre j'ai trouvé comment afficher ce que charge un seul programe (avec RegMan).

                        Donc dites moi où se trouve l'exe du centre de sécurité et je vous copiré le rapport.

                        Merci
                        0
                        1. Utilisateur anonyme
                          C'est bon, j'ai trouvé les fichiers du centre de sécurité ("gdiplace.dll";"wscui.cpl" ainsi que "rundll32.exe")

                          Et voilà les clé qu'ils on chargé lorsque j'ai lancé le centre de securité(je devrait bientôt lister les fichiers qu'il ont chargé):

                          1 23:54:22 explorer.exe:856 QueryValue HKCR\cplfile\shell\cplopen\command\(Default) SUCCESS "rundll32.exe shell32.dll,Control_RunDLL "%1",%*"
                          2 23:54:22 explorer.exe:856 QueryValue HKCR\cplfile\shell\cplopen\command\(Default) SUCCESS "rundll32.exe shell32.dll,Control_RunDLL "%1",%*"
                          3 23:54:22 explorer.exe:856 QueryValue HKCR\cplfile\shell\cplopen\command\(Default) SUCCESS "rundll32.exe shell32.dll,Control_RunDLL "%1",%*"
                          4 23:54:22 explorer.exe:856 QueryValue HKCR\cplfile\shell\cplopen\command\(Default) SUCCESS "rundll32.exe shell32.dll,Control_RunDLL "%1",%*"
                          5 23:54:22 rundll32.exe:3472 QueryValue HKLM\System\CurrentControlSet\Control\Terminal Server\TSAppCompat SUCCESS 0x0
                          6 23:54:22 rundll32.exe:3472 QueryValue HKLM\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\TransparentEnabled SUCCESS 0x1
                          7 23:54:22 rundll32.exe:3472 QueryValue HKLM\SYSTEM\WPA\MediaCenter\Installed SUCCESS 0x0
                          8 23:54:22 rundll32.exe:3472 QueryValue HKLM\Software\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs SUCCESS "C:\PROGRA~1\KASPER~1\KASPER~2.0\adialhk.dll"
                          9 23:54:22 rundll32.exe:3472 QueryValue HKLM\Software\Microsoft\Windows NT\CurrentVersion\DRIVERS32\wave SUCCESS "wdmaud.drv"
                          10 23:54:22 rundll32.exe:3472 QueryValue HKLM\Software\Microsoft\Windows NT\CurrentVersion\DRIVERS32\wave SUCCESS "wdmaud.drv"
                          11 23:54:22 rundll32.exe:3472 QueryValue HKLM\Software\Microsoft\Windows NT\CurrentVersion\DRIVERS32\midi SUCCESS "wdmaud.drv"
                          12 23:54:22 rundll32.exe:3472 QueryValue HKLM\Software\Microsoft\Windows NT\CurrentVersion\DRIVERS32\midi SUCCESS "wdmaud.drv"
                          13 23:54:22 rundll32.exe:3472 QueryValue HKLM\System\CurrentControlSet\Control\MediaProperties\PrivateProperties\Joystick\Winmm\wheel SUCCESS 0x1
                          14 23:54:22 rundll32.exe:3472 QueryValue HKLM\Software\Microsoft\Windows NT\CurrentVersion\DRIVERS32\mixer SUCCESS "wdmaud.drv"
                          15 23:54:22 rundll32.exe:3472 QueryValue HKLM\Software\Microsoft\Windows NT\CurrentVersion\DRIVERS32\mixer SUCCESS "wdmaud.drv"
                          16 23:54:22 rundll32.exe:3472 QueryValue HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\CriticalSectionTimeout SUCCESS 0x278D00
                          17 23:54:22 rundll32.exe:3472 QueryValue HKCU\Software\Microsoft\Multimedia\Audio\SystemFormats SUCCESS "Qualité CD,Qualité radio,Qualité téléphonique"
                          18 23:54:22 rundll32.exe:3472 EnumerateValue HKLM\Software\Microsoft\Windows NT\CurrentVersion\Drivers32\midimapper SUCCESS Type: SZ Name: midimapper
                          19 23:54:22 rundll32.exe:3472 EnumerateValue HKLM\Software\Microsoft\Windows NT\CurrentVersion\Drivers32\msacm.imaadpcm SUCCESS Type: SZ Name: msacm.imaadpcm
                          20 23:54:22 rundll32.exe:3472 EnumerateValue HKLM\Software\Microsoft\Windows NT\CurrentVersion\Drivers32\msacm.msadpcm SUCCESS Type: SZ Name: msacm.msadpcm
                          21 23:54:22 rundll32.exe:3472 EnumerateValue HKLM\Software\Microsoft\Windows NT\CurrentVersion\Drivers32\msacm.msg711 SUCCESS Type: SZ Name: msacm.msg711
                          22 23:54:22 rundll32.exe:3472 EnumerateValue HKLM\Software\Microsoft\Windows NT\CurrentVersion\Drivers32\msacm.msgsm610 SUCCESS Type: SZ Name: msacm.msgsm610
                          23 23:54:22 rundll32.exe:3472 EnumerateValue HKLM\Software\Microsoft\Windows NT\CurrentVersion\Drivers32\msacm.trspch SUCCESS Type: SZ Name: msacm.trspch
                          24 23:54:22 rundll32.exe:3472 EnumerateValue HKLM\Software\Microsoft\Windows NT\CurrentVersion\Drivers32\vidc.cvid SUCCESS Type: SZ Name: vidc.cvid
                          25 23:54:22 rundll32.exe:3472 EnumerateValue HKLM\Software\Microsoft\Windows NT\CurrentVersion\Drivers32\vidc.I420 SUCCESS Type: SZ Name: vidc.I420
                          26 23:54:22 rundll32.exe:3472 EnumerateValue HKLM\Software\Microsoft\Windows NT\CurrentVersion\Drivers32\vidc.iv31 SUCCESS Type: SZ Name: vidc.iv31
                          27 23:54:22 rundll32.exe:3472 EnumerateValue HKLM\Software\Microsoft\Windows NT\CurrentVersion\Drivers32\vidc.iv32 SUCCESS Type: SZ Name: vidc.iv32
                          28 23:54:22 rundll32.exe:3472 EnumerateValue HKLM\Software\Microsoft\Windows NT\CurrentVersion\Drivers32\vidc.iv41 SUCCESS Type: SZ Name: vidc.iv41
                          29 23:54:22 rundll32.exe:3472 EnumerateValue HKLM\Software\Microsoft\Windows NT\CurrentVersion\Drivers32\vidc.iyuv SUCCESS Type: SZ Name: vidc.iyuv
                          30 23:54:22 rundll32.exe:3472 EnumerateValue HKLM\Software\Microsoft\Windows NT\CurrentVersion\Drivers32\vidc.mrle SUCCESS Type: SZ Name: vidc.mrle
                          31 23:54:22 rundll32.exe:3472 EnumerateValue HKLM\Software\Microsoft\Windows NT\CurrentVersion\Drivers32\vidc.msvc SUCCESS Type: SZ Name: vidc.msvc
                          32 23:54:22 rundll32.exe:3472 EnumerateValue HKLM\Software\Microsoft\Windows NT\CurrentVersion\Drivers32\vidc.uyvy SUCCESS Type: SZ Name: vidc.uyvy
                          33 23:54:22 rundll32.exe:3472 EnumerateValue HKLM\Software\Microsoft\Windows NT\CurrentVersion\Drivers32\vidc.yuy2 SUCCESS Type: SZ Name: vidc.yuy2
                          34 23:54:22 rundll32.exe:3472 EnumerateValue HKLM\Software\Microsoft\Windows NT\CurrentVersion\Drivers32\vidc.yvu9 SUCCESS Type: SZ Name: vidc.yvu9
                          35 23:54:22 rundll32.exe:3472 EnumerateValue HKLM\Software\Microsoft\Windows NT\CurrentVersion\Drivers32\vidc.yvyu SUCCESS Type: SZ Name: vidc.yvyu
                          36 23:54:22 rundll32.exe:3472 EnumerateValue HKLM\Software\Microsoft\Windows NT\CurrentVersion\Drivers32\wavemapper SUCCESS Type: SZ Name: wavemapper
                          37 23:54:22 rundll32.exe:3472 EnumerateValue HKLM\Software\Microsoft\Windows NT\CurrentVersion\Drivers32\msacm.msg723 SUCCESS Type: SZ Name: msacm.msg723
                          38 23:54:22 rundll32.exe:3472 EnumerateValue HKLM\Software\Microsoft\Windows NT\CurrentVersion\Drivers32\vidc.M263 SUCCESS Type: SZ Name: vidc.M263
                          39 23:54:22 rundll32.exe:3472 EnumerateValue HKLM\Software\Microsoft\Windows NT\CurrentVersion\Drivers32\vidc.M261 SUCCESS Type: SZ Name: vidc.M261
                          40 23:54:22 rundll32.exe:3472 EnumerateValue HKLM\Software\Microsoft\Windows NT\CurrentVersion\Drivers32\msacm.msaudio1 SUCCESS Type: SZ Name: msacm.msaudio1
                          41 23:54:22 rundll32.exe:3472 EnumerateValue HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32\midimapper SUCCESS Type: SZ Name: midimapper
                          42 23:54:22 rundll32.exe:3472 EnumerateValue HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32\msacm.imaadpcm SUCCESS Type: SZ Name: msacm.imaadpcm
                          43 23:54:22 rundll32.exe:3472 EnumerateValue HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32\msacm.msadpcm SUCCESS Type: SZ Name: msacm.msadpcm
                          44 23:54:22 rundll32.exe:3472 EnumerateValue HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32\msacm.msg711 SUCCESS Type: SZ Name: msacm.msg711
                          45 23:54:22 rundll32.exe:3472 EnumerateValue HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32\msacm.msgsm610 SUCCESS Type: SZ Name: msacm.msgsm610
                          46 23:54:22 rundll32.exe:3472 EnumerateValue HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32\msacm.trspch SUCCESS Type: SZ Name: msacm.trspch
                          47 23:54:22 rundll32.exe:3472 EnumerateValue HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32\vidc.cvid SUCCESS Type: SZ Name: vidc.cvid
                          48 23:54:22 rundll32.exe:3472 EnumerateValue HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32\vidc.I420 SUCCESS Type: SZ Name: vidc.I420
                          49 23:54:22 rundll32.exe:3472 EnumerateValue HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32\vidc.iv31 SUCCESS Type: SZ Name: vidc.iv31
                          50 23:54:22 rundll32.exe:3472 EnumerateValue HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32\vidc.iv32 SUCCESS Type: SZ Name: vidc.iv32
                          51 23:54:22 rundll32.exe:3472 EnumerateValue HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32\vidc.iv41 SUCCESS Type: SZ Name: vidc.iv41
                          52 23:54:22 rundll32.exe:3472 EnumerateValue HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32\vidc.iyuv SUCCESS Type: SZ Name: vidc.iyuv
                          53 23:54:22 rundll32.exe:3472 EnumerateValue HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32\vidc.mrle SUCCESS Type: SZ Name: vidc.mrle
                          54 23:54:22 rundll32.exe:3472 EnumerateValue HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32\vidc.msvc SUCCESS Type: SZ Name: vidc.msvc
                          55 23:54:22 rundll32.exe:3472 EnumerateValue HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32\vidc.uyvy SUCCESS Type: SZ Name: vidc.uyvy
                          56 23:54:22 rundll32.exe:3472 EnumerateValue HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32\vidc.yuy2 SUCCESS Type: SZ Name: vidc.yuy2
                          57 23:54:22 rundll32.exe:3472 EnumerateValue HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32\vidc.yvu9 SUCCESS Type: SZ Name: vidc.yvu9
                          58 23:54:22 rundll32.exe:3472 EnumerateValue HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32\vidc.yvyu SUCCESS Type: SZ Name: vidc.yvyu
                          59 23:54:22 rundll32.exe:3472 EnumerateValue HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32\wavemapper SUCCESS Type: SZ Name: wavemapper
                          60 23:54:22 rundll32.exe:3472 EnumerateValue HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32\msacm.msg723 SUCCESS Type: SZ Name: msacm.msg723
                          61 23:54:22 rundll32.exe:3472 EnumerateValue HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32\vidc.M263 SUCCESS Type: SZ Name: vidc.M263
                          62 23:54:22 rundll32.exe:3472 EnumerateValue HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32\vidc.M261 SUCCESS Type: SZ Name: vidc.M261
                          63 23:54:22 rundll32.exe:3472 EnumerateValue HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32\msacm.msaudio1 SUCCESS Type: SZ Name: msacm.msaudio1
                          64 23:54:22 rundll32.exe:3472 EnumerateValue HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32\msacm.sl_anet SUCCESS Type: SZ Name: msacm.sl_anet
                          65 23:54:22 rundll32.exe:3472 EnumerateValue HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32\msacm.iac2 SUCCESS Type: SZ Name: msacm.iac2
                          66 23:54:22 rundll32.exe:3472 EnumerateValue HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32\vidc.iv50 SUCCESS Type: SZ Name: vidc.iv50
                          67 23:54:22 rundll32.exe:3472 EnumerateValue HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32\msacm.l3acm SUCCESS Type: SZ Name: msacm.l3acm
                          68 23:54:22 rundll32.exe:3472 EnumerateValue HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32\vidc.DIVX SUCCESS Type: SZ Name: vidc.DIVX
                          69 23:54:22 rundll32.exe:3472 EnumerateValue HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32\vidc.yv12 SUCCESS Type: SZ Name: vidc.yv12
                          70 23:54:22 rundll32.exe:3472 EnumerateValue HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32\msacm.siren SUCCESS Type: SZ Name: msacm.siren
                          71 23:54:22 rundll32.exe:3472 EnumerateValue HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32\wave SUCCESS Type: SZ Name: wave
                          72 23:54:22 rundll32.exe:3472 EnumerateValue HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32\midi SUCCESS Type: SZ Name: midi
                          73 23:54:22 rundll32.exe:3472 EnumerateValue HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32\mixer SUCCESS Type: SZ Name: mixer
                          74 23:54:22 rundll32.exe:3472 QueryValue HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32\msacm.imaadpcm SUCCESS "imaadp32.acm"
                          75 23:54:22 rundll32.exe:3472 QueryValue HKLM\Software\Microsoft\AudioCompressionManager\DriverCache\msacm.imaadpcm\fdwSupport SUCCESS 0x1
                          76 23:54:22 rundll32.exe:3472 QueryValue HKLM\Software\Microsoft\AudioCompressionManager\DriverCache\msacm.imaadpcm\cFormatTags SUCCESS 0x2
                          77 23:54:22 rundll32.exe:3472 QueryValue HKLM\Software\Microsoft\AudioCompressionManager\DriverCache\msacm.imaadpcm\aFormatTagCache SUCCESS 01 00 00 00 10 00 00 00 ...
                          78 23:54:22 rundll32.exe:3472 QueryValue HKLM\Software\Microsoft\AudioCompressionManager\DriverCache\msacm.imaadpcm\cFilterTags SUCCESS 0x0
                          79 23:54:22 rundll32.exe:3472 QueryValue HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32\msacm.msadpcm SUCCESS "msadp32.acm"
                          80 23:54:22 rundll32.exe:3472 QueryValue HKLM\Software\Microsoft\AudioCompressionManager\DriverCache\msacm.msadpcm\fdwSupport SUCCESS 0x1
                          81 23:54:22 rundll32.exe:3472 QueryValue HKLM\Software\Microsoft\AudioCompressionManager\DriverCache\msacm.msadpcm\cFormatTags SUCCESS 0x2
                          82 23:54:22 rundll32.exe:3472 QueryValue HKLM\Software\Microsoft\AudioCompressionManager\DriverCache\msacm.msadpcm\aFormatTagCache SUCCESS 01 00 00 00 10 00 00 00 ...
                          83 23:54:22 rundll32.exe:3472 QueryValue HKLM\Software\Microsoft\AudioCompressionManager\DriverCache\msacm.msadpcm\cFilterTags SUCCESS 0x0
                          84 23:54:22 rundll32.exe:3472 QueryValue HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32\msacm.msg711 SUCCESS "msg711.acm"
                          85 23:54:22 rundll32.exe:3472 QueryValue HKLM\Software\Microsoft\AudioCompressionManager\DriverCache\msacm.msg711\fdwSupport SUCCESS 0x1
                          86 23:54:22 rundll32.exe:3472 QueryValue HKLM\Software\Microsoft\AudioCompressionManager\DriverCache\msacm.msg711\cFormatTags SUCCESS 0x3
                          87 23:54:22 rundll32.exe:3472 QueryValue HKLM\Software\Microsoft\AudioCompressionManager\DriverCache\msacm.msg711\aFormatTagCache SUCCESS 01 00 00 00 10 00 00 00 ...
                          88 23:54:22 rundll32.exe:3472 QueryValue HKLM\Software\Microsoft\AudioCompressionManager\DriverCache\msacm.msg711\cFilterTags SUCCESS 0x0
                          89 23:54:22 rundll32.exe:3472 QueryValue HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32\msacm.msgsm610 SUCCESS "msgsm32.acm"
                          90 23:54:22 rundll32.exe:3472 QueryValue HKLM\Software\Microsoft\AudioCompressionManager\DriverCache\msacm.msgsm610\fdwSupport SUCCESS 0x1
                          91 23:54:22 rundll32.exe:3472 QueryValue HKLM\Software\Microsoft\AudioCompressionManager\DriverCache\msacm.msgsm610\cFormatTags SUCCESS 0x2
                          92 23:54:22 rundll32.exe:3472 QueryValue HKLM\Software\Microsoft\AudioCompressionManager\DriverCache\msacm.msgsm610\aFormatTagCache SUCCESS 01 00 00 00 10 00 00 00 ...
                          93 23:54:22 rundll32.exe:3472 QueryValue HKLM\Software\Microsoft\AudioCompressionManager\DriverCache\msacm.msgsm610\cFilterTags SUCCESS 0x0
                          94 23:54:22 rundll32.exe:3472 QueryValue HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32\msacm.trspch SUCCESS "tssoft32.acm"
                          95 23:54:22 rundll32.exe:3472 QueryValue HKLM\Software\Microsoft\AudioCompressionManager\DriverCache\msacm.trspch\fdwSupport SUCCESS 0x1
                          96 23:54:22 rundll32.exe:3472 QueryValue HKLM\Software\Microsoft\AudioCompressionManager\DriverCache\msacm.trspch\cFormatTags SUCCESS 0x2
                          97 23:54:22 rundll32.exe:3472 QueryValue HKLM\Software\Microsoft\AudioCompressionManager\DriverCache\msacm.trspch\aFormatTagCache SUCCESS 01 00 00 00 10 00 00 00 ...
                          98 23:54:22 rundll32.exe:3472 QueryValue HKLM\Software\Microsoft\AudioCompressionManager\DriverCache\msacm.trspch\cFilterTags SUCCESS 0x0
                          99 23:54:22 rundll32.exe:3472 QueryValue HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32\msacm.msg723 SUCCESS "msg723.acm"
                          100 23:54:22 rundll32.exe:3472 QueryValue HKLM\Software\Microsoft\AudioCompressionManager\DriverCache\msacm.msg723\fdwSupport SUCCESS 0x1
                          101 23:54:22 rundll32.exe:3472 QueryValue HKLM\Software\Microsoft\AudioCompressionManager\DriverCache\msacm.msg723\cFormatTags SUCCESS 0x2
                          102 23:54:22 rundll32.exe:3472 QueryValue HKLM\Software\Microsoft\AudioCompressionManager\DriverCache\msacm.msg723\aFormatTagCache SUCCESS 01 00 00 00 10 00 00 00 ...
                          103 23:54:22 rundll32.exe:3472 QueryValue HKLM\Software\Microsoft\AudioCompressionManager\DriverCache\msacm.msg723\cFilterTags SUCCESS 0x0
                          104 23:54:22 rundll32.exe:3472 QueryValue HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32\msacm.msaudio1 SUCCESS "msaud32.acm"
                          105 23:54:22 rundll32.exe:3472 QueryValue HKLM\Software\Microsoft\AudioCompressionManager\DriverCache\msacm.msaudio1\fdwSupport SUCCESS 0x1
                          106 23:54:22 rundll32.exe:3472 QueryValue HKLM\Software\Microsoft\AudioCompressionManager\DriverCache\msacm.msaudio1\cFormatTags SUCCESS 0x3
                          107 23:54:22 rundll32.exe:3472 QueryValue HKLM\Software\Microsoft\AudioCompressionManager\DriverCache\msacm.msaudio1\aFormatTagCache SUCCESS 01 00 00 00 12 00 00 00 ...
                          108 23:54:22 rundll32.exe:3472 QueryValue HKLM\Software\Microsoft\AudioCompressionManager\DriverCache\msacm.msaudio1\cFilterTags SUCCESS 0x0
                          109 23:54:22 rundll32.exe:3472 QueryValue HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32\msacm.sl_anet SUCCESS "sl_anet.acm"
                          110 23:54:22 rundll32.exe:3472 QueryValue HKLM\Software\Microsoft\AudioCompressionManager\DriverCache\msacm.sl_anet\fdwSupport SUCCESS 0x1
                          111 23:54:22 rundll32.exe:3472 QueryValue HKLM\Software\Microsoft\AudioCompressionManager\DriverCache\msacm.sl_anet\cFormatTags SUCCESS 0x2
                          112 23:54:22 rundll32.exe:3472 QueryValue HKLM\Software\Microsoft\AudioCompressionManager\DriverCache\msacm.sl_anet\aFormatTagCache SUCCESS 01 00 00 00 10 00 00 00 ...
                          113 23:54:22 rundll32.exe:3472 QueryValue HKLM\Software\Microsoft\AudioCompressionManager\DriverCache\msacm.sl_anet\cFilterTags SUCCESS 0x0
                          114 23:54:22 rundll32.exe:3472 QueryValue HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32\msacm.iac2 SUCCESS "C:\WINDOWS\system32\iac25_32.ax"
                          115 23:54:22 rundll32.exe:3472 QueryValue HKLM\Software\Microsoft\AudioCompressionManager\DriverCache\msacm.iac2\fdwSupport SUCCESS 0x1
                          116 23:54:22 rundll32.exe:3472 QueryValue HKLM\Software\Microsoft\AudioCompressionManager\DriverCache\msacm.iac2\cFormatTags SUCCESS 0x2
                          117 23:54:22 rundll32.exe:3472 QueryValue HKLM\Software\Microsoft\AudioCompressionManager\DriverCache\msacm.iac2\aFormatTagCache SUCCESS 01 00 00 00 10 00 00 00 ...
                          118 23:54:22 rundll32.exe:3472 QueryValue HKLM\Software\Microsoft\AudioCompressionManager\DriverCache\msacm.iac2\cFilterTags SUCCESS 0x0
                          119 23:54:22 rundll32.exe:3472 QueryValue HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32\msacm.l3acm SUCCESS "C:\WINDOWS\system32\l3codeca.acm"
                          120 23:54:22 rundll32.exe:3472 QueryValue HKLM\Software\Microsoft\AudioCompressionManager\DriverCache\msacm.l3acm\fdwSupport SUCCESS 0x1
                          121 23:54:22 rundll32.exe:3472 QueryValue HKLM\Software\Microsoft\AudioCompressionManager\DriverCache\msacm.l3acm\cFormatTags SUCCESS 0x2
                          122 23:54:22 rundll32.exe:3472 QueryValue HKLM\Software\Microsoft\AudioCompressionManager\DriverCache\msacm.l3acm\aFormatTagCache SUCCESS 01 00 00 00 10 00 00 00 ...
                          123 23:54:22 rundll32.exe:3472 QueryValue HKLM\Software\Microsoft\AudioCompressionManager\DriverCache\msacm.l3acm\cFilterTags SUCCESS 0x0
                          124 23:54:22 rundll32.exe:3472 QueryValue HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32\msacm.siren SUCCESS "sirenacm.dll"
                          125 23:54:22 rundll32.exe:3472 QueryValue HKLM\Software\Microsoft\AudioCompressionManager\DriverCache\msacm.siren\fdwSupport SUCCESS 0x1
                          126 23:54:22 rundll32.exe:3472 QueryValue HKLM\Software\Microsoft\AudioCompressionManager\DriverCache\msacm.siren\cFormatTags SUCCESS 0x2
                          127 23:54:22 rundll32.exe:3472 QueryValue HKLM\Software\Microsoft\AudioCompressionManager\DriverCache\msacm.siren\aFormatTagCache SUCCESS 01 00 00 00 10 00 00 00 ...
                          128 23:54:22 rundll32.exe:3472 QueryValue HKLM\Software\Microsoft\AudioCompressionManager\DriverCache\msacm.siren\cFilterTags SUCCESS 0x0
                          129 23:54:22 rundll32.exe:3472 QueryValue HKLM\SYSTEM\Setup\SystemSetupInProgress SUCCESS 0x0
                          130 23:54:22 rundll32.exe:3472 QueryValue HKCU\Control Panel\Desktop\SmoothScroll SUCCESS 0x1
                          131 23:54:22 rundll32.exe:3472 EnumerateValue HKLM\Software\Microsoft\Windows NT\CurrentVersion\LanguagePack\THAI SUCCESS 0x1
                          132 23:54:22 rundll32.exe:3472 EnumerateValue HKLM\Software\Microsoft\Windows NT\CurrentVersion\LanguagePack\HEBREW SUCCESS 0x0
                          133 23:54:22 rundll32.exe:3472 EnumerateValue HKLM\Software\Microsoft\Windows NT\CurrentVersion\LanguagePack\ARABIC SUCCESS 0x0
                          134 23:54:22 rundll32.exe:3472 EnumerateValue HKLM\Software\Microsoft\Windows NT\CurrentVersion\LanguagePack\VIETNAMESE SUCCESS 0x3
                          135 23:54:22 rundll32.exe:3472 EnumerateValue HKLM\Software\Microsoft\Windows NT\CurrentVersion\LanguagePack\INDIAN SUCCESS 0x4
                          136 23:54:22 rundll32.exe:3472 EnumerateValue HKLM\Software\Microsoft\Windows NT\CurrentVersion\LanguagePack\SURROGATE SUCCESS 0x2
                          137 23:54:22 rundll32.exe:3472 QueryValue HKCU\Control Panel\Desktop\SmoothScroll SUCCESS 0x1
                          138 23:54:22 rundll32.exe:3472 QueryValue HKLM\System\CurrentControlSet\Control\ProductOptions\ProductType SUCCESS "WinNT"
                          139 23:54:22 rundll32.exe:3472 QueryValue HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Personal SUCCESS "%USERPROFILE%\Mes documents"
                          140 23:54:22 rundll32.exe:3472 QueryValue HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Local Settings SUCCESS "%USERPROFILE%\Local Settings"
                          141 23:54:22 rundll32.exe:3472 QueryValue HKLM\System\CurrentControlSet\Control\ComputerName\ActiveComputerName\ComputerName SUCCESS "GANIBARD-A3F22B"
                          142 23:54:23 rundll32.exe:3472 QueryValue HKLM\System\CurrentControlSet\Services\LDAP\LdapClientIntegrity SUCCESS 0x1
                          143 23:54:23 rundll32.exe:3472 QueryValue HKLM\SOFTWARE\Microsoft\CTF\SystemShared\CUAS SUCCESS 0x0
                          144 23:54:23 rundll32.exe:3472 QueryValue HKCU\Keyboard Layout\Toggle\Language Hotkey SUCCESS "1"
                          145 23:54:23 rundll32.exe:3472 QueryValue HKCU\Keyboard Layout\Toggle\Language Hotkey SUCCESS "1"
                          146 23:54:23 rundll32.exe:3472 QueryValue HKCU\Keyboard Layout\Toggle\Layout Hotkey SUCCESS "2"
                          147 23:54:23 rundll32.exe:3472 QueryValue HKCU\Keyboard Layout\Toggle\Layout Hotkey SUCCESS "2"
                          148 23:54:23 rundll32.exe:3472 QueryValue HKLM\Software\Microsoft\Windows NT\CurrentVersion\IMM\Ime File SUCCESS "msctfime.ime"
                          149 23:54:23 rundll32.exe:3472 QueryValue HKLM\Software\Microsoft\CTF\SystemShared\CUAS SUCCESS 0x0
                          150 23:54:23 rundll32.exe:3472 QueryValue HKLM\SYSTEM\WPA\MediaCenter\Installed SUCCESS 0x0
                          151 23:54:23 rundll32.exe:3472 QueryValue HKLM\Hardware\DeviceMap\VIDEO\MaxObjectNumber SUCCESS 0x3
                          152 23:54:23 rundll32.exe:3472 QueryValue HKLM\SYSTEM\CURRENTCONTROLSET\ENUM\PCI\VEN_10DE&DEV_0185&SUBSYS_20181682&REV_C1\4&1affaa3d&0&0008\HardwareID SUCCESS "PCI\VEN_10DE&DEV_0185&SUBSYS_20181682&REV_C1"
                          153 23:54:23 rundll32.exe:3472 QueryValue HKLM\SYSTEM\CURRENTCONTROLSET\ENUM\PCI\VEN_10DE&DEV_0185&SUBSYS_20181682&REV_C1\4&1affaa3d&0&0008\HardwareID SUCCESS "PCI\VEN_10DE&DEV_0185&SUBSYS_20181682&REV_C1"
                          154 23:54:23 rundll32.exe:3472 QueryValue HKLM\Hardware\DeviceMap\Video\\Device\Video0 SUCCESS "\Registry\Machine\System\CurrentControlSet\Control\Video\{CDC5B952-8FD8-4BBA-9A32-444F483AE1D8}\0000"
                          155 23:54:23 rundll32.exe:2748 QueryKey HKCU\Software\Classes SUCCESS Name: \REGISTRY\USER\S-1-5-21-1757981266-1390067357-725345543-1003_CLASSES
                          156 23:54:23 rundll32.exe:2748 QueryKey HKCR\CLSID\{1CDB2949-8F65-4355-8456-263E7C208A5D} SUCCESS Name: \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CDB2949-8F65-4355-8456-263E7C208A5D}
                          157 23:54:23 rundll32.exe:3472 QueryValue HKLM\Software\Microsoft\CTF\SystemShared\CUAS SUCCESS 0x0
                          158 23:54:23 rundll32.exe:3472 QueryKey HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Fonts SUCCESS Subkeys = 0
                          159 23:54:23 rundll32.exe:3472 QueryValue HKCU\Software\Microsoft\GDIPlus\FontCachePath SUCCESS "C:\Documents and Settings\GANIBARDI\Local Settings\Application Data"
                          160 23:54:23 rundll32.exe:2748 QueryKey HKCU\Software\Classes SUCCESS Name: \REGISTRY\USER\S-1-5-21-1757981266-1390067357-725345543-1003_CLASSES
                          161 23:54:23 rundll32.exe:2748 QueryKey HKCR\CLSID\{1CDB2949-8F65-4355-8456-263E7C208A5D} SUCCESS Name: \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CDB2949-8F65-4355-8456-263E7C208A5D}
                          162 23:54:23 rundll32.exe:2748 QueryKey HKCU\Software\Classes SUCCESS Name: \REGISTRY\USER\S-1-5-21-1757981266-1390067357-725345543-1003_CLASSES
                          163 23:54:23 rundll32.exe:2748 QueryKey HKCR\CLSID\{1CDB2949-8F65-4355-8456-263E7C208A5D}\InProcServer32 SUCCESS Name: \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CDB2949-8F65-4355-8456-263E7C208A5D}\InprocServer32
                          164 23:54:23 rundll32.exe:2748 QueryValue HKCR\CLSID\{1CDB2949-8F65-4355-8456-263E7C208A5D}\InProcServer32\(Default) SUCCESS "C:\WINDOWS\system32\nvshell.dll"
                          165 23:54:23 rundll32.exe:2748 QueryKey HKCR\CLSID\{1CDB2949-8F65-4355-8456-263E7C208A5D}\InProcServer32 SUCCESS Name: \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CDB2949-8F65-4355-8456-263E7C208A5D}\InprocServer32
                          166 23:54:23 rundll32.exe:2748 QueryValue HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1CDB2949-8F65-4355-8456-263E7C208A5D} {000214E6-0000-0000-C000-000000000046} 0x401 SUCCESS 0x1
                          167 23:54:23 rundll32.exe:2748 QueryValue HKCR\CLSID\{1cdb2949-8f65-4355-8456-263e7c208a5d}\InProcServer32\(Default) SUCCESS "C:\WINDOWS\system32\nvshell.dll"
                          168 23:54:23 rundll32.exe:2748 QueryValue HKLM\Software\Microsoft\COM3\REGDBVersion SUCCESS 1C 00 00 00 00 00 00 00
                          169 23:54:23 rundll32.exe:2748 QueryValue HKLM\Software\Microsoft\COM3\REGDBVersion SUCCESS 1C 00 00 00 00 00 00 00
                          170 23:54:23 rundll32.exe:2748 QueryKey HKCU\Software\Classes SUCCESS Name: \REGISTRY\USER\S-1-5-21-1757981266-1390067357-725345543-1003_CLASSES
                          171 23:54:23 rundll32.exe:2748 QueryKey HKCR\CLSID\{1CDB2949-8F65-4355-8456-263E7C208A5D} SUCCESS Name: \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CDB2949-8F65-4355-8456-263E7C208A5D}
                          172 23:54:23 rundll32.exe:2748 QueryKey HKCU\Software\Classes SUCCESS Name: \REGISTRY\USER\S-1-5-21-1757981266-1390067357-725345543-1003_CLASSES
                          173 23:54:23 rundll32.exe:2748 QueryKey HKCU\Software\Classes SUCCESS Name: \REGISTRY\USER\S-1-5-21-1757981266-1390067357-725345543-1003_CLASSES
                          174 23:54:23 rundll32.exe:2748 QueryKey HKCR\CLSID\{1CDB2949-8F65-4355-8456-263E7C208A5D} SUCCESS Name: \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CDB2949-8F65-4355-8456-263E7C208A5D}
                          175 23:54:23 rundll32.exe:2748 QueryKey HKCR\CLSID\{1CDB2949-8F65-4355-8456-263E7C208A5D}\InprocServer32 SUCCESS Name: \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CDB2949-8F65-4355-8456-263E7C208A5D}\InprocServer32
                          176 23:54:23 rundll32.exe:2748 QueryKey HKCR\CLSID\{1CDB2949-8F65-4355-8456-263E7C208A5D} SUCCESS Name: \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CDB2949-8F65-4355-8456-263E7C208A5D}
                          177 23:54:23 rundll32.exe:2748 QueryKey HKCR\CLSID\{1CDB2949-8F65-4355-8456-263E7C208A5D} SUCCESS Name: \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CDB2949-8F65-4355-8456-263E7C208A5D}
                          178 23:54:23 rundll32.exe:2748 QueryKey HKCR\CLSID\{1CDB2949-8F65-4355-8456-263E7C208A5D} SUCCESS Name: \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CDB2949-8F65-4355-8456-263E7C208A5D}
                          179 23:54:23 rundll32.exe:2748 QueryKey HKCR\CLSID\{1CDB2949-8F65-4355-8456-263E7C208A5D}\InprocServer32 SUCCESS Name: \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CDB2949-8F65-4355-8456-263E7C208A5D}\InprocServer32
                          180 23:54:23 rundll32.exe:2748 QueryValue HKCR\CLSID\{1CDB2949-8F65-4355-8456-263E7C208A5D}\InprocServer32\(Default) SUCCESS "C:\WINDOWS\system32\nvshell.dll"
                          181 23:54:23 rundll32.exe:2748 QueryKey HKCR\CLSID\{1CDB2949-8F65-4355-8456-263E7C208A5D} SUCCESS Name: \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CDB2949-8F65-4355-8456-263E7C208A5D}
                          182 23:54:23 rundll32.exe:2748 QueryKey HKCR\CLSID\{1CDB2949-8F65-4355-8456-263E7C208A5D} SUCCESS Name: \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CDB2949-8F65-4355-8456-263E7C208A5D}
                          183 23:54:23 rundll32.exe:2748 QueryKey HKCR\CLSID\{1CDB2949-8F65-4355-8456-263E7C208A5D} SUCCESS Name: \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CDB2949-8F65-4355-8456-263E7C208A5D}
                          184 23:54:23 rundll32.exe:2748 QueryKey HKCR\CLSID\{1CDB2949-8F65-4355-8456-263E7C208A5D} SUCCESS Name: \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CDB2949-8F65-4355-8456-263E7C208A5D}
                          185 23:54:23 rundll32.exe:2748 QueryKey HKCU\Software\Classes SUCCESS Name: \REGISTRY\USER\S-1-5-21-1757981266-1390067357-725345543-1003_CLASSES
                          186 23:54:23 rundll32.exe:2748 QueryKey HKCR\CLSID\{1CDB2949-8F65-4355-8456-263E7C208A5D} SUCCESS Name: \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CDB2949-8F65-4355-8456-263E7C208A5D}
                          187 23:54:23 rundll32.exe:2748 QueryValue HKCU\Software\NVIDIA Corporation\Global\nView\nViewLoaded SUCCESS 0x1
                          188 23:54:23 rundll32.exe:3472 QueryValue HKLM\System\CurrentControlSet\Control\Nls\Locale\0000040C SUCCESS "1"
                          189 23:54:23 rundll32.exe:3472 QueryValue HKLM\System\CurrentControlSet\Control\Nls\Language Groups\1 SUCCESS "1"
                          190 23:54:23 rundll32.exe:2748 QueryValue HKCU\Software\NVIDIA Corporation\Global\nView\Shell SUCCESS 0x0
                          191 23:54:23 rundll32.exe:3472 QueryKey HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink SUCCESS Subkeys = 0
                          192 23:54:23 rundll32.exe:3472 EnumerateValue HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink\Lucida Sans Unicode SUCCESS "MSGOTHIC.TTC,MS UI Gothic"
                          193 23:54:23 rundll32.exe:3472 EnumerateValue HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink\Tahoma SUCCESS "MSGOTHIC.TTC,MS UI Gothic"
                          194 23:54:23 rundll32.exe:3472 EnumerateValue HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink\Microsoft Sans Serif SUCCESS "MSGOTHIC.TTC,MS UI Gothic"
                          195 23:54:23 rundll32.exe:3472 QueryKey HKCU\Software\Classes SUCCESS Name: \REGISTRY\USER\S-1-5-21-1757981266-1390067357-725345543-1003_CLASSES
                          196 23:54:23 rundll32.exe:3472 QueryKey HKCR\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32 SUCCESS Name: \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32
                          197 23:54:23 rundll32.exe:3472 QueryValue HKCR\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32\(Default) SUCCESS "%SystemRoot%\system32\SHELL32.dll"
                          198 23:54:23 rundll32.exe:3472 QueryValue HKCU\Control Panel\don't load\ncpa.cpl SUCCESS "No"
                          199 23:54:23 rundll32.exe:3472 QueryValue HKCU\Control Panel\don't load\odbccp32.cpl SUCCESS "No"
                          200 23:54:23 rundll32.exe:3472 EnumerateValue HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Control Panel\CPLs\Internet Connection Firewall SUCCESS "Firewall.cpl"
                          201 23:54:23 rundll32.exe:3472 EnumerateValue HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Control Panel\CPLs\NetSetupWizard SUCCESS "NetSetup.cpl"
                          202 23:54:23 rundll32.exe:3472 EnumerateValue HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Control Panel\CPLs\Speech SUCCESS "C:\Program Files\Fichiers communs\Microsoft Shared\Speech\sapi.cpl"
                          203 23:54:23 rundll32.exe:3472 EnumerateValue HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Control Panel\CPLs\Cmcpls SUCCESS "C:\WINDOWS\System\cmicnfg.cpl"
                          204 23:54:23 rundll32.exe:3472 EnumerateValue HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Control Panel\CPLs\ SUCCESS ""
                          205 23:54:23 rundll32.exe:3472 EnumerateValue HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Control Panel\CPLs\Nero BurnRights SUCCESS "C:\Program Files\Nero\Nero 7\Nero Toolkit\NeroBurnRights.cpl"
                          206 23:54:23 rundll32.exe:3472 EnumerateValue HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Control Panel\CPLs\mlcfg32.cpl SUCCESS "C:\PROGRA~1\MICROS~2\Office12\MLCFG32.CPL"
                          207 23:54:23 rundll32.exe:3472 QueryValue HKCU\Software\Microsoft\Windows\CurrentVersion\Controls Folder\Presentation LCID SUCCESS 0x40C
                          208 23:54:23 rundll32.exe:3472 QueryValue HKCU\Software\Microsoft\Windows\CurrentVersion\Controls Folder\Presentation Cache SUCCESS 48 01 00 00 03 00 00 00 ...
                          209 23:54:23 rundll32.exe:3472 EnumerateKey HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ControlPanel\NameSpace SUCCESS Name: Accessibility_Options
                          210 23:54:23 rundll32.exe:3472 EnumerateKey HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ControlPanel\NameSpace SUCCESS Name: Add-Remove_Programs
                          211 23:54:23 rundll32.exe:3472 EnumerateKey HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ControlPanel\NameSpace SUCCESS Name: Date-Time
                          212 23:54:23 rundll32.exe:3472 EnumerateKey HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ControlPanel\NameSpace SUCCESS Name: Dialing_Options
                          213 23:54:23 rundll32.exe:3472 EnumerateKey HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ControlPanel\NameSpace SUCCESS Name: Display_Properties
                          214 23:54:23 rundll32.exe:3472 EnumerateKey HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ControlPanel\NameSpace SUCCESS Name: Internet_Options
                          215 23:54:23 rundll32.exe:3472 EnumerateKey HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ControlPanel\NameSpace SUCCESS Name: Printers
                          216 23:54:23 rundll32.exe:3472 QueryValue HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ControlPanel\NameSpace\Printers\(Default) SUCCESS "{2227A280-3AEA-1069-A2DE-08002B30309D}"
                          217 23:54:23 rundll32.exe:3472 EnumerateKey HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ControlPanel\NameSpace SUCCESS Name: {0DF44EAA-FF21-4412-828E-260A8728E7F1}
                          218 23:54:23 rundll32.exe:3472 EnumerateKey HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ControlPanel\NameSpace SUCCESS Name: {6DFD7C5C-2451-11d3-A299-00C04F8EF6AF}
                          219 23:54:23 rundll32.exe:3472 EnumerateKey HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ControlPanel\NameSpace SUCCESS Name: {7007ACC7-3202-11D1-AAD2-00805FC1270E}
                          220 23:54:23 rundll32.exe:3472 EnumerateKey HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ControlPanel\NameSpace SUCCESS Name: {D20EA4E1-3957-11d2-A40B-0C5020524152}
                          221 23:54:23 rundll32.exe:3472 EnumerateKey HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ControlPanel\NameSpace SUCCESS Name: {D20EA4E1-3957-11d2-A40B-0C5020524153}
                          222 23:54:23 rundll32.exe:3472 EnumerateKey HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ControlPanel\NameSpace SUCCESS Name: {D6277990-4C6A-11CF-8D87-00AA0060F5BF}
                          223 23:54:23 rundll32.exe:3472 EnumerateKey HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ControlPanel\NameSpace SUCCESS Name: {E211B736-43FD-11D1-9EFB-0000F8757FCD}
                          224 23:54:23 rundll32.exe:3472 QueryKey HKCU\Software\Classes SUCCESS Name: \REGISTRY\USER\S-1-5-21-1757981266-1390067357-725345543-1003_CLASSES
                          225 23:54:23 rundll32.exe:3472 QueryKey HKCU\Software\Classes\CLSID SUCCESS Name: \REGISTRY\USER\S-1-5-21-1757981266-1390067357-725345543-1003_CLASSES\CLSID
                          226 23:54:23 rundll32.exe:3472 QueryKey HKCU\Software\Classes\CLSID\{2227A280-3AEA-1069-A2DE-08002B30309D} SUCCESS Name: \REGISTRY\USER\S-1-5-21-1757981266-1390067357-725345543-1003_CLASSES\CLSID\{2227A280-3AEA-1069-A2DE-08002B30309D}
                          227 23:54:23 rundll32.exe:3472 QueryValue HKCR\CLSID\{2227A280-3AEA-1069-A2DE-08002B30309D}\LocalizedString SUCCESS "@%SystemRoot%\system32\SHELL32.dll,-9319"
                          228 23:54:23 rundll32.exe:3472 QueryValue HKLM\Software\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-1757981266-1390067357-725345543-1003\Flags SUCCESS 0x0
                          229 23:54:23 rundll32.exe:3472 QueryValue HKLM\Software\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-1757981266-1390067357-725345543-1003\State SUCCESS 0x100
                          230 23:54:23 rundll32.exe:3472 QueryValue HKLM\Software\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-1757981266-1390067357-725345543-1003\CentralProfile SUCCESS ""
                          231 23:54:23 rundll32.exe:3472 QueryValue HKLM\Software\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-1757981266-1390067357-725345543-1003\ProfileImagePath SUCCESS "%SystemDrive%\Documents and Settings\GANIBARDI"
                          232 23:54:23 rundll32.exe:3472 QueryValue HKLM\Software\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-1757981266-1390067357-725345543-1003\ProfileLoadTimeLow SUCCESS 0x245C9702
                          233 23:54:23 rundll32.exe:3472 QueryValue HKLM\Software\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-1757981266-1390067357-725345543-1003\ProfileLoadTimeHigh SUCCESS 0x1C7B841
                          234 23:54:23 rundll32.exe:3472 QueryValue HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\LangID SUCCESS 0C 04
                          235 23:54:23 rundll32.exe:3472 QueryValue HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\@C:\WINDOWS\system32\SHELL32.dll,-9319 SUCCESS "Imprimantes et télécopieurs"
                          236 23:54:23 rundll32.exe:3472 QueryKey HKCU\Software\Classes SUCCESS Name: \REGISTRY\USER\S-1-5-21-1757981266-1390067357-725345543-1003_CLASSES
                          237 23:54:23 rundll32.exe:3472 QueryKey HKCR\CLSID\{2227A280-3AEA-1069-A2DE-08002B30309D}\ShellFolder SUCCESS Name: \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2227A280-3AEA-1069-A2DE-08002B30309D}\ShellFolder
                          238 23:54:23 rundll32.exe:3472 QueryValue HKCR\CLSID\{2227A280-3AEA-1069-A2DE-08002B30309D}\ShellFolder\Attributes SUCCESS 0x20000004
                          239 23:54:23 rundll32.exe:3472 QueryKey HKCR\CLSID\{2227A280-3AEA-1069-A2DE-08002B30309D}\ShellFolder SUCCESS Name: \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2227A280-3AEA-1069-A2DE-08002B30309D}\ShellFolder
                          240 23:54:23 rundll32.exe:3472 QueryKey HKCU\Software\Classes SUCCESS Name: \REGISTRY\USER\S-1-5-21-1757981266-1390067357-725345543-1003_CLASSES
                          241 23:54:23 rundll32.exe:3472 QueryKey HKCU\Software\Classes\CLSID SUCCESS Name: \REGISTRY\USER\S-1-5-21-1757981266-1390067357-725345543-1003_CLASSES\CLSID
                          242 23:54:23 rundll32.exe:3472 QueryKey HKCU\Software\Classes\CLSID\{0DF44EAA-FF21-4412-828E-260A8728E7F1} SUCCESS Name: \REGISTRY\USER\S-1-5-21-1757981266-1390067357-725345543-1003_CLASSES\CLSID\{0DF44EAA-FF21-4412-828E-260A8728E7F1}
                          243 23:54:23 rundll32.exe:3472 QueryValue HKCR\CLSID\{0DF44EAA-FF21-4412-828E-260A8728E7F1}\LocalizedString SUCCESS "@%SystemRoot%\system32\SHELL32.dll,-32517"
                          244 23:54:23 rundll32.exe:3472 QueryValue HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\@C:\WINDOWS\system32\SHELL32.dll,-32517 SUCCESS "Barre des tâches et menu Démarrer"
                          245 23:54:23 rundll32.exe:3472 QueryKey HKCU\Software\Classes SUCCESS Name: \REGISTRY\USER\S-1-5-21-1757981266-1390067357-725345543-1003_CLASSES
                          246 23:54:23 rundll32.exe:3472 QueryKey HKCU\Software\Classes\CLSID\{0DF44EAA-FF21-4412-828E-260A8728E7F1} SUCCESS Name: \REGISTRY\USER\S-1-5-21-1757981266-1390067357-725345543-1003_CLASSES\CLSID\{0DF44EAA-FF21-4412-828E-260A8728E7F1}
                          247 23:54:23 rundll32.exe:3472 QueryKey HKCU\Software\Classes SUCCESS Name: \REGISTRY\USER\S-1-5-21-1757981266-1390067357-725345543-1003_CLASSES
                          248 23:54:23 rundll32.exe:3472 QueryKey HKCR\CLSID\{0DF44EAA-FF21-4412-828E-260A8728E7F1}\ShellFolder SUCCESS Name: \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0DF44EAA-FF21-4412-828E-260A8728E7F1}\ShellFolder
                          249 23:54:23 rundll32.exe:3472 QueryValue HKCR\CLSID\{0DF44EAA-FF21-4412-828E-260A8728E7F1}\ShellFolder\Attributes SUCCESS 0x0
                          250 23:54:23 rundll32.exe:3472 QueryKey HKCR\CLSID\{0DF44EAA-FF21-4412-828E-260A8728E7F1}\ShellFolder SUCCESS Name: \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0DF44EAA-FF21-4412-828E-260A8728E7F1}\ShellFolder
                          251 23:54:23 rundll32.exe:3472 QueryValue HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\NonEnum\{0DF44EAA-FF21-4412-828E-260A8728E7F1} SUCCESS 0x20
                          252 23:54:23 rundll32.exe:3472 QueryKey HKCU\Software\Classes SUCCESS Name: \REGISTRY\USER\S-1-5-21-1757981266-1390067357-725345543-1003_CLASSES
                          253 23:54:23 rundll32.exe:3472 QueryKey HKCU\Software\Classes\CLSID\{0DF44EAA-FF21-4412-828E-260A8728E7F1} SUCCESS Name: \REGISTRY\USER\S-1-5-21-1757981266-1390067357-725345543-1003_CLASSES\CLSID\{0DF44EAA-FF21-4412-828E-260A8728E7F1}
                          254 23:54:23 rundll32.exe:3472 QueryKey HKCU\Software\Classes\CLSID\{0DF44EAA-FF21-4412-828E-260A8728E7F1} SUCCESS Name: \REGISTRY\USER\S-1-5-21-1757981266-1390067357-725345543-1003_CLASSES\CLSID\{0DF44EAA-FF21-4412-828E-260A8728E7F1}
                          255 23:54:23 rundll32.exe:3472 QueryValue HKCR\CLSID\{0DF44EAA-FF21-4412-828E-260A8728E7F1}\{305CA226-D286-468E-B848-2B2E8E697B74} 2 SUCCESS 0x1
                          256 23:54:23 rundll32.exe:3472 QueryKey HKCU\Software\Classes SUCCESS Name: \REGISTRY\USER\S-1-5-21-1757981266-1390067357-725345543-1003_CLASSES
                          257 23:54:23 rundll32.exe:3472 QueryKey HKCU\Software\Classes\CLSID SUCCESS Name: \REGISTRY\USER\S-1-5-21-1757981266-1390067357-725345543-1003_CLASSES\CLSID
                          258 23:54:23 rundll32.exe:3472 QueryKey HKCU\Software\Classes\CLSID\{6DFD7C5C-2451-11D3-A299-00C04F8EF6AF} SUCCESS Name: \REGISTRY\USER\S-1-5-21-1757981266-1390067357-725345543-1003_CLASSES\CLSID\{6DFD7C5C-2451-11d3-A299-00C04F8EF6AF}
                          259 23:54:23 rundll32.exe:3472 QueryValue HKCR\CLSID\{6DFD7C5C-2451-11d3-A299-00C04F8EF6AF}\LocalizedString SUCCESS "@%SystemRoot%\system32\SHELL32.dll,-22985"
                          260 23:54:23 rundll32.exe:3472 QueryValue HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\@C:\WINDOWS\system32\SHELL32.dll,-22985 SUCCESS "Options des dossiers"
                          261 23:54:23 rundll32.exe:3472 QueryKey HKCU\Software\Classes SUCCESS Name: \REGISTRY\USER\S-1-5-21-1757981266-1390067357-725345543-1003_CLASSES
                          262 23:54:23 rundll32.exe:3472 QueryKey HKCU\Software\Classes\CLSID\{6DFD7C5C-2451-11D3-A299-00C04F8EF6AF} SUCCESS Name: \REGISTRY\USER\S-1-5-21-1757981266-1390067357-725345543-1003_CLASSES\CLSID\{6DFD7C5C-2451-11d3-A299-00C04F8EF6AF}
                          263 23:54:23 rundll32.exe:3472 QueryKey HKCU\Software\Classes SUCCESS Name: \REGISTRY\USER\S-1-5-21-1757981266-1390067357-725345543-1003_CLASSES
                          264 23:54:23 rundll32.exe:3472 QueryKey HKCR\CLSID\{6DFD7C5C-2451-11D3-A299-00C04F8EF6AF}\ShellFolder SUCCESS Name: \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6DFD7C5C-2451-11d3-A299-00C04F8EF6AF}\ShellFolder
                          265 23:54:23 rundll32.exe:3472 QueryValue HKCR\CLSID\{6DFD7C5C-2451-11D3-A299-00C04F8EF6AF}\ShellFolder\Attributes SUCCESS 0x0
                          266 23:54:23 rundll32.exe:3472 QueryKey HKCR\CLSID\{6DFD7C5C-2451-11D3-A299-00C04F8EF6AF}\ShellFolder SUCCESS Name: \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6DFD7C5C-2451-11d3-A299-00C04F8EF6AF}\ShellFolder
                          267 23:54:23 rundll32.exe:3472 QueryValue HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\NonEnum\{6DFD7C5C-2451-11D3-A299-00C04F8EF6AF} SUCCESS 0x40000021
                          268 23:54:23 rundll32.exe:3472 QueryKey HKCU\Software\Classes SUCCESS Name: \REGISTRY\USER\S-1-5-21-1757981266-1390067357-725345543-1003_CLASSES
                          269 23:54:23 rundll32.exe:3472 QueryKey HKCU\Software\Classes\CLSID\{6DFD7C5C-2451-11D3-A299-00C04F8EF6AF} SUCCESS Name: \REGISTRY\USER\S-1-5-21-1757981266-1390067357-725345543-1003_CLASSES\CLSID\{6DFD7C5C-2451-11d3-A299-00C04F8EF6AF}
                          270 23:54:23 rundll32.exe:3472 QueryKey HKCU\Software\Classes\CLSID\{6DFD7C5C-2451-11D3-A299-00C04F8EF6AF} SUCCESS Name: \REGISTRY\USER\S-1-5-21-1757981266-1390067357-725345543-1003_CLASSES\CLSID\{6DFD7C5C-2451-11d3-A299-00C04F8EF6AF}
                          271 23:54:23 rundll32.exe:3472 QueryValue HKCR\CLSID\{6DFD7C5C-2451-11d3-A299-00C04F8EF6AF}\{305CA226-D286-468E-B848-2B2E8E697B74} 2 SUCCESS 0x1
                          272 23:54:23 rundll32.exe:3472 QueryKey HKCU\Software\Classes SUCCESS Name: \REGISTRY\USER\S-1-5-21-1757981266-1390067357-725345543-1003_CLASSES
                          273 23:54:23 rundll32.exe:3472 QueryKey HKCU\Software\Classes\CLSID SUCCESS Name: \REGISTRY\USER\S-1-5-21-1757981266-1390067357-725345543-1003_CLASSES\CLSID
                          274 23:54:23 rundll32.exe:3472 QueryKey HKCU\Software\Classes\CLSID\{7007ACC7-3202-11D1-AAD2-00805FC1270E} SUCCESS Name: \REGISTRY\USER\S-1-5-21-1757981266-1390067357-725345543-1003_CLASSES\CLSID\{7007ACC7-3202-11D1-AAD2-00805FC1270E}
                          275 23:54:23 rundll32.exe:3472 QueryValue HKCR\CLSID\{7007ACC7-3202-11D1-AAD2-00805FC1270E}\LocalizedString SUCCESS "@C:\WINDOWS\system32\netshell.dll,-1200"
                          276 23:54:23 rundll32.exe:3472 QueryValue HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\@C:\WINDOWS\system32\netshell.dll,-1200 SUCCESS "Connexions réseau"
                          277 23:54:23 rundll32.exe:3472 QueryKey HKCU\Software\Classes SUCCESS Name: \REGISTRY\USER\S-1-5-21-1757981266-1390067357-725345543-1003_CLASSES
                          278 23:54:23 rundll32.exe:3472 QueryKey HKCU\Software\Classes\CLSID\{7007ACC7-3202-11D1-AAD2-00805FC1270E} SUCCESS Name: \REGISTRY\USER\S-1-5-21-1757981266-1390067357-725345543-1003_CLASSES\CLSID\{7007ACC7-3202-11D1-AAD2-00805FC1270E}
                          279 23:54:23 rundll32.exe:3472 QueryKey HKCU\Software\Classes SUCCESS Name: \REGISTRY\USER\S-1-5-21-1757981266-1390067357-725345543-1003_CLASSES
                          280 23:54:23 rundll32.exe:3472 QueryKey HKCR\CLSID\{7007ACC7-3202-11D1-AAD2-00805FC1270E}\ShellFolder SUCCESS Name: \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7007ACC7-3202-11D1-AAD2-00805FC1270E}\ShellFolder
                          281 23:54:23 rundll32.exe:3472 QueryValue HKCR\CLSID\{7007ACC7-3202-11D1-AAD2-00805FC1270E}\ShellFolder\Attributes SUCCESS 00 00 00 20
                          282 23:54:23 rundll32.exe:3472 QueryKey HKCR\CLSID\{7007ACC7-3202-11D1-AAD2-00805FC1270E}\ShellFolder SUCCESS Name: \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7007ACC7-3202-11D1-AAD2-00805FC1270E}\ShellFolder
                          283 23:54:23 rundll32.exe:3472 QueryKey HKCU\Software\Classes SUCCESS Name: \REGISTRY\USER\S-1-5-21-1757981266-1390067357-725345543-1003_CLASSES
                          284 23:54:23 rundll32.exe:3472 QueryKey HKCU\Software\Classes\CLSID SUCCESS Name: \REGISTRY\USER\S-1-5-21-1757981266-1390067357-725345543-1003_CLASSES\CLSID
                          285 23:54:23 rundll32.exe:3472 QueryKey HKCU\Software\Classes\CLSID\{D20EA4E1-3957-11D2-A40B-0C5020524152} SUCCESS Name: \REGISTRY\USER\S-1-5-21-1757981266-1390067357-725345543-1003_CLASSES\CLSID\{D20EA4E1-3957-11d2-A40B-0C5020524152}
                          286 23:54:23 rundll32.exe:3472 QueryValue HKCR\CLSID\{D20EA4E1-3957-11d2-A40B-0C5020524152}\LocalizedString SUCCESS "@%SystemRoot%\system32\SHELL32.dll,-22981"
                          287 23:54:23 rundll32.exe:3472 QueryValue HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\@C:\WINDOWS\system32\SHELL32.dll,-22981 SUCCESS "Polices"
                          288 23:54:23 rundll32.exe:3472 QueryKey HKCU\Software\Classes SUCCESS Name: \REGISTRY\USER\S-1-5-21-1757981266-1390067357-725345543-1003_CLASSES
                          289 23:54:23 rundll32.exe:3472 QueryKey HKCU\Software\Classes\CLSID\{D20EA4E1-3957-11D2-A40B-0C5020524152} SUCCESS Name: \REGISTRY\USER\S-1-5-21-1757981266-1390067357-725345543-1003_CLASSES\CLSID\{D20EA4E1-3957-11d2-A40B-0C5020524152}
                          290 23:54:23 rundll32.exe:3472 QueryKey HKCU\Software\Classes SUCCESS Name: \REGISTRY\USER\S-1-5-21-1757981266-1390067357-725345543-1003_CLASSES
                          291 23:54:23 rundll32.exe:3472 QueryKey HKCR\CLSID\{D20EA4E1-3957-11D2-A40B-0C5020524152}\ShellFolder SUCCESS Name: \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D20EA4E1-3957-11d2-A40B-0C5020524152}\ShellFolder
                          292 23:54:23 rundll32.exe:3472 QueryValue HKCR\CLSID\{D20EA4E1-3957-11D2-A40B-0C5020524152}\ShellFolder\Attributes SUCCESS 0x60000000
                          293 23:54:23 rundll32.exe:3472 QueryKey HKCR\CLSID\{D20EA4E1-3957-11D2-A40B-0C5020524152}\ShellFolder SUCCESS Name: \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D20EA4E1-3957-11d2-A40B-0C5020524152}\ShellFolder
                          294 23:54:23 rundll32.exe:3472 QueryKey HKCU\Software\Classes SUCCESS Name: \REGISTRY\USER\S-1-5-21-1757981266-1390067357-725345543-1003_CLASSES
                          295 23:54:23 rundll32.exe:3472 QueryKey HKCU\Software\Classes\CLSID SUCCESS Name: \REGISTRY\USER\S-1-5-21-1757981266-1390067357-725345543-1003_CLASSES\CLSID
                          296 23:54:23 rundll32.exe:3472 QueryKey HKCU\Software\Classes\CLSID\{D20EA4E1-3957-11D2-A40B-0C5020524153} SUCCESS Name: \REGISTRY\USER\S-1-5-21-1757981266-1390067357-725345543-1003_CLASSES\CLSID\{D20EA4E1-3957-11d2-A40B-0C5020524153}
                          297 23:54:23 rundll32.exe:3472 QueryValue HKCR\CLSID\{D20EA4E1-3957-11d2-A40B-0C5020524153}\LocalizedString SUCCESS "@%SystemRoot%\system32\SHELL32.dll,-22982"
                          298 23:54:23 rundll32.exe:3472 QueryValue HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\@C:\WINDOWS\system32\SHELL32.dll,-22982 SUCCESS "Outils d'administration"
                          299 23:54:23 rundll32.exe:3472 QueryKey HKCU\Software\Classes SUCCESS Name: \REGISTRY\USER\S-1-5-21-1757981266-1390067357-725345543-1003_CLASSES
                          300 23:54:23 rundll32.exe:3472 QueryKey HKCU\Software\Classes\CLSID\{D20EA4E1-3957-11D2-A40B-0C5020524153} SUCCESS Name: \REGISTRY\USER\S-1-5-21-1757981266-1390067357-725345543-1003_CLASSES\CLSID\{D20EA4E1-3957-11d2-A40B-0C5020524153}
                          301 23:54:23 rundll32.exe:3472 QueryKey HKCU\Software\Classes SUCCESS Name: \REGISTRY\USER\S-1-5-21-1757981266-1390067357-725345543-1003_CLASSES
                          302 23:54:23 rundll32.exe:3472 QueryKey HKCR\CLSID\{D20EA4E1-3957-11D2-A40B-0C5020524153}\ShellFolder SUCCESS Name: \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D20EA4E1-3957-11d2-A40B-0C5020524153}\ShellFolder
                          303 23:54:23 rundll32.exe:3472 QueryValue HKCR\CLSID\{D20EA4E1-3957-11D2-A40B-0C5020524153}\ShellFolder\Attributes SUCCESS 0x60000100
                          304 23:54:23 rundll32.exe:3472 QueryKey HKCR\CLSID\{D20EA4E1-3957-11D2-A40B-0C5020524153}\ShellFolder SUCCESS Name: \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D20EA4E1-3957-11d2-A40B-0C5020524153}\ShellFolder
                          305 23:54:23 rundll32.exe:3472 QueryKey HKCU\Software\Classes SUCCESS Name: \REGISTRY\USER\S-1-5-21-1757981266-1390067357-725345543-1003_CLASSES
                          306 23:54:23 rundll32.exe:3472 QueryKey HKCU\Software\Classes\CLSID SUCCESS Name: \REGISTRY\USER\S-1-5-21-1757981266-1390067357-725345543-1003_CLASSES\CLSID
                          307 23:54:23 rundll32.exe:3472 QueryKey HKCU\Software\Classes\CLSID\{D6277990-4C6A-11CF-8D87-00AA0060F5BF} SUCCESS Name: \REGISTRY\USER\S-1-5-21-1757981266-1390067357-725345543-1003_CLASSES\CLSID\{D6277990-4C6A-11CF-8D87-00AA0060F5BF}
                          308 23:54:23 rundll32.exe:3472 QueryValue HKCR\CLSID\{D6277990-4C6A-11CF-8D87-00AA0060F5BF}\LocalizedString SUCCESS "@C:\WINDOWS\system32\mstask.dll,-3408"
                          309 23:54:23 rundll32.exe:3472 QueryValue HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\@C:\WINDOWS\system32\mstask.dll,-3408 SUCCESS "Tâches planifiées"
                          310 23:54:23 rundll32.exe:3472 QueryKey HKCU\Software\Classes SUCCESS Name: \REGISTRY\USER\S-1-5-21-1757981266-1390067357-725345543-1003_CLASSES
                          311 23:54:23 rundll32.exe:3472 QueryKey HKCU\Software\Classes\CLSID\{D6277990-4C6A-11CF-8D87-00AA0060F5BF} SUCCESS Name: \REGISTRY\USER\S-1-5-21-1757981266-1390067357-725345543-1003_CLASSES\CLSID\{D6277990-4C6A-11CF-8D87-00AA0060F5BF}
                          312 23:54:23 rundll32.exe:3472 QueryKey HKCU\Software\Classes SUCCESS Name: \REGISTRY\USER\S-1-5-21-1757981266-1390067357-725345543-1003_CLASSES
                          313 23:54:23 rundll32.exe:3472 QueryKey HKCR\CLSID\{D6277990-4C6A-11CF-8D87-00AA0060F5BF}\ShellFolder SUCCESS Name: \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D6277990-4C6A-11CF-8D87-00AA0060F5BF}\ShellFolder
                          314 23:54:23 rundll32.exe:3472 QueryValue HKCR\CLSID\{D6277990-4C6A-11CF-8D87-00AA0060F5BF}\ShellFolder\Attributes SUCCESS 00 00 00 21
                          315 23:54:23 rundll32.exe:3472 QueryKey HKCR\CLSID\{D6277990-4C6A-11CF-8D87-00AA0060F5BF}\ShellFolder SUCCESS Name: \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D6277990-4C6A-11CF-8D87-00AA0060F5BF}\ShellFolder
                          316 23:54:23 rundll32.exe:3472 QueryKey HKCU\Software\Classes SUCCESS Name: \REGISTRY\USER\S-1-5-21-1757981266-1390067357-725345543-1003_CLASSES
                          317 23:54:23 rundll32.exe:3472 QueryKey HKCU\Software\Classes\CLSID SUCCESS Name: \REGISTRY\USER\S-1-5-21-1757981266-1390067357-725345543-1003_CLASSES\CLSID
                          318 23:54:23 rundll32.exe:3472 QueryKey HKCU\Software\Classes\CLSID\{E211B736-43FD-11D1-9EFB-0000F8757FCD} SUCCESS Name: \REGISTRY\USER\S-1-5-21-1757981266-1390067357-725345543-1003_CLASSES\CLSID\{E211B736-43FD-11D1-9EFB-0000F8757FCD}
                          319 23:54:23 rundll32.exe:3472 QueryValue HKCR\CLSID\{E211B736-43FD-11D1-9EFB-0000F8757FCD}\LocalizedString SUCCESS "@%SystemRoot%\system32\wiashext.dll,-331"
                          320 23:54:23 rundll32.exe:3472 QueryValue HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\@C:\WINDOWS\system32\wiashext.dll,-331 SUCCESS "Scanneurs et appareils photo"
                          321 23:54:23 rundll32.exe:3472 QueryKey HKCU\Software\Classes SUCCESS Name: \REGISTRY\USER\S-1-5-21-1757981266-1390067357-725345543-1003_CLASSES
                          322 23:54:23 rundll32.exe:3472 QueryKey HKCU\Software\Classes\CLSID\{E211B736-43FD-11D1-9EFB-0000F8757FCD} SUCCESS Name: \REGISTRY\USER\S-1-5-21-1757981266-1390067357-725345543-1003_CLASSES\CLSID\{E211B736-43FD-11D1-9EFB-0000F8757FCD}
                          323 23:54:23 rundll32.exe:3472 QueryKey HKCU\Software\Classes SUCCESS Name: \REGISTRY\USER\S-1-5-21-1757981266-1390067357-725345543-1003_CLASSES
                          324 23:54:23 rundll32.exe:3472 QueryKey HKCR\CLSID\{E211B736-43FD-11D1-9EFB-0000F8757FCD}\ShellFolder SUCCESS Name: \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E211B736-43FD-11D1-9EFB-0000F8757FCD}\ShellFolder
                          325 23:54:23 rundll32.exe:3472 QueryValue HKCR\CLSID\{E211B736-43FD-11D1-9EFB-0000F8757FCD}\ShellFolder\Attributes SUCCESS 0x20400004
                          326 23:54:23 rundll32.exe:3472 QueryKey HKCR\CLSID\{E211B736-43FD-11D1-9EFB-0000F8757FCD}\ShellFolder SUCCESS Name: \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E211B736-43FD-11D1-9EFB-0000F8757FCD}\ShellFolder
                          327 23:54:23 rundll32.exe:3472 QueryValue HKCR\CLSID\{E211B736-43FD-11D1-9EFB-0000F8757FCD}\ShellFolder\CallForAttributes SUCCESS 0x0
                          328 23:54:23 rundll32.exe:3472 EnumerateValue HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Control Panel\Extended Properties\{305CA226-D286-468E-B848-2B2E8E697B74} 2\%SystemRoot%\system32\Firewall.cpl SUCCESS "3,10"
                          329 23:54:23 rundll32.exe:3472 EnumerateValue HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Control Panel\Extended Properties\{305CA226-D286-468E-B848-2B2E8E697B74} 2\%SystemRoot%\system32\wscui.cpl SUCCESS 0xFFFFFFFF
                          330 23:54:23 rundll32.exe:3472 EnumerateValue HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Control Panel\Extended Properties\{305CA226-D286-468E-B848-2B2E8E697B74} 2\%SystemRoot%\system32\NetSetup.cpl SUCCESS 0x3
                          331 23:54:23 rundll32.exe:3472 EnumerateValue HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Control Panel\Extended Properties\{305CA226-D286-468E-B848-2B2E8E697B74} 2\C:\Program Files\Fichiers communs\Microsoft Shared\Speech\sapi.cpl SUCCESS 0x4
                          332 23:54:23 rundll32.exe:3472 EnumerateValue HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Control Panel\Extended Properties\{305CA226-D286-468E-B848-2B2E8E697B74} 2\%SystemRoot%\System32\wuaucpl.cpl SUCCESS 0xA
                          333 23:54:23 rundll32.exe:3472 EnumerateValue HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Control Panel\Extended Properties\{305CA226-D286-468E-B848-2B2E8E697B74} 2\%SystemRoot%\system32\appwiz.cpl SUCCESS 0x8
                          334 23:54:23 rundll32.exe:3472 EnumerateValue HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Control Panel\Extended Properties\{305CA226-D286-468E-B848-2B2E8E697B74} 2\%SystemRoot%\system32\access.cpl SUCCESS 0x7
                          335 23:54:23 rundll32.exe:3472 EnumerateValue HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Control Panel\Extended Properties\{305CA226-D286-468E-B848-2B2E8E697B74} 2\%SystemRoot%\system32\bthprops.cpl SUCCESS "2,3"
                          336 23:54:23 rundll32.exe:3472 EnumerateValue HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Control Panel\Extended Properties\{305CA226-D286-468E-B848-2B2E8E697B74} 2\%SystemRoot%\system32\desk.cpl SUCCESS 0x1
                          337 23:54:23 rundll32.exe:3472 EnumerateValue HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Control Panel\Extended Properties\{305CA226-D286-468E-B848-2B2E8E697B74} 2\%SystemRoot%\system32\hdwwiz.cpl SUCCESS 0xFFFFFFFF
                          338 23:54:23 rundll32.exe:3472 EnumerateValue HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Control Panel\Extended Properties\{305CA226-D286-468E-B848-2B2E8E697B74} 2\%SystemRoot%\system32\inetcpl.cpl SUCCESS "3,10"
                          339 23:54:23 rundll32.exe:3472 EnumerateValue HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Control Panel\Extended Properties\{305CA226-D286-468E-B848-2B2E8E697B74} 2\%SystemRoot%\system32\intl.cpl SUCCESS 0x6
                          340 23:54:23 rundll32.exe:3472 EnumerateValue HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Control Panel\Extended Properties\{305CA226-D286-468E-B848-2B2E8E697B74} 2\%SystemRoot%\system32\irprops.cpl SUCCESS 0x2
                          341 23:54:23 rundll32.exe:3472 EnumerateValue HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Control Panel\Extended Properties\{305CA226-D286-468E-B848-2B2E8E697B74} 2\%SystemRoot%\system32\joy.cpl SUCCESS 0x2
                          342 23:54:23 rundll32.exe:3472 EnumerateValue HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Control Panel\Extended Properties\{305CA226-D286-468E-B848-2B2E8E697B74} 2\%SystemRoot%\system32\main.cpl SUCCESS 0x2
                          343 23:54:23 rundll32.exe:3472 EnumerateValue HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Control Panel\Extended Properties\{305CA226-D286-468E-B848-2B2E8E697B74} 2\%SystemRoot%\system32\mmsys.cpl SUCCESS 0x4
                          344 23:54:23 rundll32.exe:3472 EnumerateValue HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Control Panel\Extended Properties\{305CA226-D286-468E-B848-2B2E8E697B74} 2\%SystemRoot%\system32\ncpa.cpl SUCCESS 0x3
                          345 23:54:23 rundll32.exe:3472 EnumerateValue HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Control Panel\Extended Properties\{305CA226-D286-468E-B848-2B2E8E697B74} 2\%SystemRoot%\system32\nwc.cpl SUCCESS 0x0
                          346 23:54:23 rundll32.exe:3472 EnumerateValue HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Control Panel\Extended Properties\{305CA226-D286-468E-B848-2B2E8E697B74} 2\%SystemRoot%\system32\nusrmgr.cpl SUCCESS 0x9
                          347 23:54:23 rundll32.exe:3472 EnumerateValue HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Control Panel\Extended Properties\{305CA226-D286-468E-B848-2B2E8E697B74} 2\%SystemRoot%\system32\odbccp32.cpl SUCCESS 0x0
                          348 23:54:23 rundll32.exe:3472 EnumerateValue HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Control Panel\Extended Properties\{305CA226-D286-468E-B848-2B2E8E697B74} 2\%SystemRoot%\system32\powercfg.cpl SUCCESS 0x5
                          349 23:54:23 rundll32.exe:3472 EnumerateValue HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Control Panel\Extended Properties\{305CA226-D286-468E-B848-2B2E8E697B74} 2\%SystemRoot%\system32\sticpl.cpl SUCCESS 0x2
                          350 23:54:23 rundll32.exe:3472 EnumerateValue HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Control Panel\Extended Properties\{305CA226-D286-468E-B848-2B2E8E697B74} 2\%SystemRoot%\system32\sysdm.cpl SUCCESS "5"
                          351 23:54:23 rundll32.exe:3472 EnumerateValue HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Control Panel\Extended Properties\{305CA226-D286-468E-B848-2B2E8E697B74} 2\%SystemRoot%\system32\telephon.cpl SUCCESS 0x2
                          352 23:54:23 rundll32.exe:3472 EnumerateValue HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Control Panel\Extended Properties\{305CA226-D286-468E-B848-2B2E8E697B74} 2\%SystemRoot%\system32\timedate.cpl SUCCESS 0x6
                          353 23:54:23 rundll32.exe:3472 EnumerateValue HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Control Panel\Extended Properties\{305CA226-D286-468E-B848-2B2E8E697B74} 2\C:\Program Files\Sony Ericsson\Mobile\Mobile Phone Monitor\ecsepm.cpl SUCCESS 0x2
                          354 23:54:23 rundll32.exe:3472 EnumerateValue HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Control Panel\Extended Properties\{305CA226-D286-468E-B848-2B2E8E697B74} 2\ SUCCESS ""
                          355 23:54:23 rundll32.exe:3472 EnumerateValue HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Control Panel\Extended Properties\{305CA226-D286-468E-B848-2B2E8E697B74} 2\C:\Program Files\Microsoft Office\Office12\MLCFG32.CPL SUCCESS 0x9
                          356 23:54:23 rundll32.exe:3472 QueryValue HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Control Panel\Extended Properties\{305CA226-D286-468E-B848-2B2E8E697B74} 2\%SystemRoot%\system32\access.cpl SUCCESS 0x7
                          357 23:54:23 rundll32.exe:3472 QueryValue HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Control Panel\Extended Properties\{305CA226-D286-468E-B848-2B2E8E697B74} 2\C:\Program Files\Fichiers communs\Microsoft Shared\Speech\sapi.cpl SUCCESS 0x4
                          358 23:54:23 rundll32.exe:3472 QueryValue HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Control Panel\Extended Properties\{305CA226-D286-468E-B848-2B2E8E697B74} 2\(Default) SUCCESS ""
                          359 23:54:23 rundll32.exe:3472 QueryValue HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Control Panel\Extended Properties\{305CA226-D286-468E-B848-2B2E8E697B74} 2\%SystemRoot%\system32\appwiz.cpl SUCCESS 0x8
                          360 23:54:23 rundll32.exe:3472 QueryValue HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Control Panel\Extended Properties\{305CA226-D286-468E-B848-2B2E8E697B74} 2\%SystemRoot%\system32\desk.cpl SUCCESS 0x1
                          361 23:54:23 rundll32.exe:3472 QueryValue HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Control Panel\Extended Properties\{305CA226-D286-468E-B848-2B2E8E697B74} 2\%SystemRoot%\system32\hdwwiz.cpl SUCCESS 0xFFFFFFFF
                          362 23:54:23 rundll32.exe:3472 QueryValue HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Control Panel\Extended Properties\{305CA226-D286-468E-B848-2B2E8E697B74} 2\%SystemRoot%\system32\intl.cpl SUCCESS 0x6
                          363 23:54:23 rundll32.exe:3472 QueryValue HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Control Panel\Extended Properties\{305CA226-D286-468E-B848-2B2E8E697B74} 2\%SystemRoot%\system32\joy.cpl SUCCESS 0x2
                          364 23:54:23 rundll32.exe:3472 QueryValue HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Control Panel\Extended Properties\{305CA226-D286-468E-B848-2B2E8E697B74} 2\%SystemRoot%\system32\main.cpl SUCCESS 0x2
                          365 23:54:23 rundll32.exe:3472 QueryValue HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Control Panel\Extended Properties\{305CA226-D286-468E-B848-2B2E8E697B74} 2\%SystemRoot%\system32\main.cpl SUCCESS 0x2
                          366 23:54:23 rundll32.exe:3472 QueryValue HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Control Panel\Extended Properties\{305CA226-D286-468E-B848-2B2E8E697B74} 2\%SystemRoot%\system32\mmsys.cpl SUCCESS 0x4
                          367 23:54:23 rundll32.exe:3472 QueryValue HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Control Panel\Extended Properties\{305CA226-D286-468E-B848-2B2E8E697B74} 2\%SystemRoot%\system32\nusrmgr.cpl SUCCESS 0x9
                          368 23:54:23 rundll32.exe:3472 QueryValue HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Control Panel\Extended Properties\{305CA226-D286-468E-B848-2B2E8E697B74} 2\%SystemRoot%\system32\powercfg.cpl SUCCESS 0x5
                          369 23:54:23 rundll32.exe:3472 QueryValue HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Control Panel\Extended Properties\{305CA226-D286-468E-B848-2B2E8E697B74} 2\%SystemRoot%\system32\sysdm.cpl SUCCESS "5"
                          370 23:54:23 rundll32.exe:3472 QueryValue HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Control Panel\Extended Properties\{305CA226-D286-468E-B848-2B2E8E697B74} 2\%SystemRoot%\system32\telephon.cpl SUCCESS 0x2
                          371 23:54:23 rundll32.exe:3472 QueryValue HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Control Panel\Extended Properties\{305CA226-D286-468E-B848-2B2E8E697B74} 2\%SystemRoot%\system32\timedate.cpl SUCCESS 0x6
                          372 23:54:23 rundll32.exe:3472 QueryValue HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Control Panel\Extended Properties\{305CA226-D286-468E-B848-2B2E8E697B74} 2\%SystemRoot%\system32\wscui.cpl SUCCESS 0xFFFFFFFF
                          373 23:54:23 rundll32.exe:3472 QueryValue HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Control Panel\Extended Properties\{305CA226-D286-468E-B848-2B2E8E697B74} 2\(Default) SUCCESS ""
                          374 23:54:23 rundll32.exe:3472 QueryValue HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Control Panel\Extended Properties\{305CA226-D286-468E-B848-2B2E8E697B74} 2\C:\Program Files\Microsoft Office\Office12\MLCFG32.CPL SUCCESS 0x9
                          375 23:54:23 rundll32.exe:3472 QueryValue HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Control Panel\Extended Properties\{305CA226-D286-468E-B848-2B2E8E697B74} 2\%SystemRoot%\system32\inetcpl.cpl SUCCESS "3,10"
                          376 23:54:23 rundll32.exe:3472 QueryValue HKLM\SYSTEM\WPA\MediaCenter\Installed SUCCESS 0x0
                          377 23:54:23 rundll32.exe:3472 QueryValue HKLM\System\Setup\SystemSetupInProgress SUCCESS 0x0
                          378 23:54:23 rundll32.exe:3472 QueryValue HKLM\System\WPA\PnP\seed SUCCESS 0xD7CA2224
                          379 23:54:23 rundll32.exe:3472 QueryValue HKLM\SYSTEM\Setup\OsLoaderPath SUCCESS "\"
                          380 23:54:23 rundll32.exe:3472 QueryValue HKLM\SYSTEM\Setup\OsLoaderPath SUCCESS "\"
                          381 23:54
                          0
                          1. Utilisateur anonyme
                            Salut!

                            Bon je vois que ces centaines de clés n'ont pas pu résoudre le problème :(

                            Alors, la seule solution c'est forcément contacter Microsoft et normalement, ils me regleront ce bug génant....

                            Mais voilà je sais pas comment faire pour les contacter, quelqu'un pourait il me dire comment les contacter SVP (si j'arrive à résoudre ce bug, j'écrirai la réponse)?

                            Merci d'avance.
                            0
                            • 1
                            • 2

                            Discussions similaires

                            Compte Amazon bloqué pour activité inhabituelle
                            Pierre_Ubk

                            8 réponses
                            Compte Amazon "temporairement verrouillé"
                            Eolia49

                            1 réponse
                            Compte Amazon verrouillé suite à une activité suspecte
                            Aurax10

                            35 réponses
                            Compte Orange bloqué
                            Arthur-92

                            4 réponses
                            Transfert de fichier d’applicatIon via xender
                            Oussout

                            1 réponse