User Protection....et un PC sans internet

Prodan · le 23 mars 2010

Bonjour

Je demande encore une fois l'aide de cette communauté, il y a quelques jour mon pc a été un attaint par un malware "User Protection " et hasard ou non trés peu après je n'avais plus internet, même la livebox branché l'icone du reseau ne s'affiché plus

Sachant donc que c'est trés irritant et pénalisant d'avoir un Pc qui ne dispose plus d'internet je me permet de demander votre aide pour regler au plus vite cet incident et reprendre mes activités.

Je vous met ici mon rapport Hijackthis :

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 22:30:14, on 22/03/2010

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v8.00 (8.00.6001.18702)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe

C:\Program Files\Adobe\Photoshop Elements 7.0\PhotoshopElementsFileAgent.exe

C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe

C:\WINDOWS\System32\FTRTSVC.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\Program Files\Google\Update\GoogleUpdate.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\SOUNDMAN.EXE

C:\WINDOWS\system32\RUNDLL32.EXE

C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe

C:\Program Files\DNA\btdna.exe

C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Documents and Settings\Nathalie\Application Data\Microsoft\Notification de cadeaux MSN\lsnfier.exe

C:\WINDOWS\explorer.exe

C:\Documents and Settings\Nathalie\Bureau\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.fr

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens

R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\Wanadoo\SEARCH~1.DLL

R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll

O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll

O2 - BHO: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.3.7.16.dll

O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)

O2 - BHO: EoRezoBHO - {64F56FC1-1272-44CD-BA6E-39723696E350} - C:\PROGRA~1\EoRezo\EoAdv\EOREZO~1.DLL (file missing)

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll

O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll

O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.4.4525.1752\swg.dll

O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\fr\msntb.dll

O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_219B3E1547538286.dll

O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\fr\msntb.dll

O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll

O3 - Toolbar: &Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll

O3 - Toolbar: Veoh Web Player Video Finder - {0FBB9689-D3D7-4f7a-A2E2-585B10099BFC} - C:\Program Files\Veoh Networks\VeohWebPlayer\VeohIEToolbar.dll

O3 - Toolbar: Veoh Video Compass - {52836EB0-631A-47B1-94A6-61F9D9112DAE} - C:\Program Files\Veoh Networks\Veoh Video Compass\SearchRecsPlugin.dll

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [soundMan] SOUNDMAN.EXE

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min

O4 - HKCU\..\Run: [WOOKIT] C:\PROGRA~1\Wanadoo\Shell.exe appLaunchClientZone.shl|DEFAULT=cnx|PARAM=

O4 - HKCU\..\Run: [Acme.PCHButton] C:\PROGRA~1\PRESAR~1\Presario\XPHWWRP4\plugin\bin\PCHButton.exe

O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun

O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background

O4 - HKCU\..\Run: [bitTorrent DNA] "C:\Program Files\DNA\btdna.exe"

O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"

O4 - HKCU\..\Run: [ares] "C:\Program Files\Ares\Ares.exe" -h

O4 - HKCU\..\Run: [user Protection] "C:\Program Files\User Protection\usrprot.exe" -noscan

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - Startup: Notification de cadeaux MSN.lnk = C:\Documents and Settings\Nathalie\Application Data\Microsoft\Notification de cadeaux MSN\lsnfier.exe

O4 - Startup: zipdkg32.exe

O8 - Extra context menu item: Tout télécharger avec BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm

O8 - Extra context menu item: Télécharger avec BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm

O8 - Extra context menu item: Télécharger toutes les vidéos avec BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll

O9 - Extra button: Run WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - C:\Program Files\WinHTTrack\WinHTTrackIEBar.dll

O9 - Extra 'Tools' menuitem: Launch WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - C:\Program Files\WinHTTrack\WinHTTrackIEBar.dll

O9 - Extra button: PartyCasino - {B4B52284-A248-4c51-9F7C-F0A0C67FCC9D} - C:\Program Files\PartyGaming\PartyCasino\RunApp.exe

O9 - Extra 'Tools' menuitem: PartyCasino - {B4B52284-A248-4c51-9F7C-F0A0C67FCC9D} - C:\Program Files\PartyGaming\PartyCasino\RunApp.exe

O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://C:\Program Files\BitComet\tools\BitCometBHO_1.3.7.16.dll/206 (file missing)

O9 - Extra button: Messager Wanadoo - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\WANADO~1\Wanadoo Messager.exe

O9 - Extra 'Tools' menuitem: Messager Wanadoo - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\WANADO~1\Wanadoo Messager.exe

O9 - Extra button: Wanadoo - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - http://www.wanadoo.fr (file missing) (HKCU)

O16 - DPF: {1FF43AD5-2262-4C2F-81D4-26D710C3F305} (VB2S Mannequin Virtuel Control) - http://mannequin.redoute.fr/activex/Mannequin.cab

O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll

O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w3/pr01/resources/MSNPUpld.cab

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupd...b?1214425194984

O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.nvidia.com/content/DriverDownlo.../sysreqlab2.cab

O16 - DPF: {74DBCB52-F298-4110-951D-AD2FF67BC8AB} (NVIDIA Smart Scan) - http://www.nvidia.com/content/DriverDownlo...iaSmartScan.cab

O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmesse...pdownloader.cab

O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab

O16 - DPF: {BC4B2F36-CC7E-4995-ADF6-EAB4F4C4BA14} (IaxClientOcx Control) - http://fr.smscity.com/Activex/smscity.cab

O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab56907.cab

O16 - DPF: {D8089245-3211-40F6-819B-9E5E92CD61A2} (FlashXControl Object) - https://signin2.valueactive.com/Register/Br...018/flashax.cab

O17 - HKLM\System\CCS\Services\Tcpip\..\{8AB14070-87B1-4199-96A7-65496344BAC2}: NameServer = 192.168.0.1

O23 - Service: Adobe Active File Monitor V7 (AdobeActiveFileMonitor7.0) - Adobe Systems Incorporated - C:\Program Files\Adobe\Photoshop Elements 7.0\PhotoshopElementsFileAgent.exe

O23 - Service: Planificateur Avira AntiVir Personal - Free Antivirus (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe

O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe

O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

O23 - Service: Ares Chatroom server (AresChatServer) - Ares Development Group - C:\Program Files\Ares\chatServer.exe

O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe

O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe

O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Fichiers communs\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe

O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe

O23 - Service: Google Update Service (gupdate1c8e1ca6e7dc03c) (gupdate1c8e1ca6e7dc03c) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe

O23 - Service: Google Software Updater (gusvc) - Unknown owner - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe (file missing)

O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe

O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Fichiers communs\Macromedia Shared\Service\Macromedia Licensing.exe

O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\MSCSPTISRV.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\PACSPTISVR.exe

O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe

O23 - Service: PC Tools Auxiliary Service (sdAuxService) - Unknown owner - C:\Program Files\Spyware Doctor\svcntaux.exe (file missing)

O23 - Service: PC Tools Security Service (sdCoreService) - Unknown owner - C:\Program Files\Spyware Doctor\swdsvc.exe (file missing)

O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\SPTISRV.exe

--

End of file - 11956 bytes

PS: Si jamais vous trouvez la solution mon problème pourrez m'indiquer toutes les étapes parce qu'il est vrai que j'utilise un ordinteur qui n'est pas le mien et éloigné de ma résidence

Merci beaucoup pour vos réponses

Apollo · le 23 mars 2010

Bonjour,

A) désinstaller l'arnaque Spyware Doctor:

SpyHunter et Spyware Doctor sont proposés via de faux blogs de sécurité... Ces faux blogs sont créés par des sociétés affiliées qui multiplient les sites WEB et tentent d'être dans les premiers résultats de Google concernant une des infections présentes sur ton PC.

Ces faux blogs proposent des versions payantes pour soit disant désinfecter son PC, ces sociétés affiliés touchent un % sur la ventes

Ce sont des pratiques douteuses et très limites, et non des méthodes dignes d'antispywares sérieux.

Je te conseille donc de désinstaller SpyHunter et/ou Spyware Doctor s'il est présent sur ton PC.

Pour plus d'informations, voir : http://forum.malekal.com/faux-blogs-de-sec...tor-t12847.html

************************

B) Télécharge Ad-Remover de C-XX et Enregistre-le sur le bureau.

Ou ici: http://pagesperso-orange.fr/NosTools/C_XX/AD-R.exe

Ferme toutes les applications ouvertes pour l'installer.

Sous Vista: Désactiver provisoirement l'UAC comme expliqué ICI

Double-clique (Clic droit/exécuter comme administrateur pour Vista) sur l'icône placée sur le bureau.

Si le firewall se manifeste, accorde les autorisations à l'outil pour qu'il puisse travailler.

TUTO: http://pagesperso-orange.fr/NosTools/tuto_adr_3.html

Tape S (Scanner) Valide par la touche Enter.

Appuyer sur n'importe quelle touche lorsque cela sera demandé et le rapport apparaitra.

Le rapport se trouve aussi sous C:\Ad-Report.

Copie/colle-le dans ta réponse stp.

-----------------------------------------------------------------------------------------------

2) Double-clique (Clic droit/exécuter comme administrateur pour Vista) sur l'icône placée sur le bureau.

Si le firewall se manifeste, accorde les autorisations à l'outil pour qu'il puisse travailler.

TUTO: http://pagesperso-orange.fr/NosTools/tuto_adr_3.html

Tape L (Nettoyer) Valide par la touche Enter.

Le bureau va disparaitre, c'est normal!

Appuyer sur n'importe quelle touche lorsque cela sera demandé et le rapport apparaitra.

Le rapport se trouve aussi sous C:\Ad-Report Clean.

Copie/colle-le dans ta réponse stp.

Réactiver l'UAC de Vista. (Si Vista bien sûr!).

La page d'accueil sera peut-être changée; il suffit de remettre sa page habituelle via les options internet.

*************************

Poste les rapports stp puis:

C) Télécharger ATF Cleaner par Atribune.

Installe-le sur le bureau. (A conserver car très utile après chaque séance de surf)

Double-clique ATF-Cleaner.exe afin de lancer le programme.
--> Sous Vista/Seven: Clic droit/exécuter en temps qu'administrateur.

Sous l'onglet Main, choisis : Select All
Cliquer sur le bouton Empty Selected

Si tu utilises le navigateur Firefox :

Clique Firefox au haut et choisis : Select All
Cliquer le bouton Empty Selected
NOTE : Si tu veux conserver tes mots de passe sauvegardés, clique No à l'invite.

Si tu utilises le navigateur Opera :

Clique Opera au haut et choisis : Select All
Cliquer le bouton Empty Selected
NOTE : Si tu veux conserver tes mots de passe sauvegardés, cliquer No à l'invite.

Clique Exit, du menu principal, afin de fermer le programme.

Pour obtenir du Support technique, double-clique l'adresse électronique située au bas de chacun des menus.

**************************

D) Télécharge Malwarebytes' Anti-Malware (MBAM)

Ce logiciel est à garder.

Uniquement en cas de problème de mise à jour:

Télécharger mises à jour MBAM

Exécute le fichier après l'installation de MBAM

Connecter les supports amovibles (clés usb etc.) avant de lancer l'analyse.

Double clique sur le fichier téléchargé pour lancer le processus d'installation.
Dans l'onglet "Mise à jour", clique sur le bouton "Recherche de mise à jour": si le pare-feu demande l'autorisation à MBAM de se connecter, accepte.
Une fois la mise à jour terminée, rends-toi dans l'onglet "Recherche".
Sélectionne "Exécuter un examen complet"
Clique sur "Rechercher"
L'analyse démarre, le scan est relativement long, c'est normal.
A la fin de l'analyse, un message s'affiche :
L'examen s'est terminé normalement. Clique sur 'Afficher les résultats' pour afficher tous les objets trouvés.
Clique sur "Ok" pour poursuivre. Si MBAM n'a rien trouvé, il te le dira aussi.
Ferme tes navigateurs.
Si des malwares ont été détectés, clique sur Afficher les résultats.
Sélectionne tout (ou laisse coché) et clique sur Supprimer la sélection, MBAM va détruire les fichiers et clés de registre et en mettre une copie dans la quarantaine.
MBAM va ouvrir le Bloc-notes et y copier le rapport d'analyse. Copie-colle ce rapport et poste-le dans ta prochaine réponse.

Si MBAM demande à redémarrer le pc, fais-le.

!!! Ne pas vider la quarantaine de MBAM sans avis !!! (en cas de faux-positifs toujours possibles.)

**************************

E) Télécharge random's system information tool (RSIT) par random/random et sauvegarde-le sur le Bureau.

Double-clique sur RSIT.exe afin de lancer RSIT.

Sous VISTA: clic droit/exécuter en temps qu'administrateur.
Clique Continue à l'écran Disclaimer.
Si l'outil HIjackThis (version à jour) n'est pas présent ou non détecté sur l'ordinateur, RSIT le téléchargera et tu devras accepter la licence.
Lorsque l'analyse sera terminée, deux fichiers texte s'ouvriront. Poste le contenu de log.txt (<<qui sera affiché)
ainsi que de info.txt (<<qui sera réduit dans la Barre des Tâches).

@++

Prodan · le 25 mars 2010

Voila les scans dans l'ordre et pas d'amélioration ....

Site web: http://pagesperso-orange.fr/NosTools/ad_remover.html

.

Lancé à: 00:32:16 le 25/03/2010 | Mode normal | Option: SCAN

Exécuté de: C:\Ad-Remover\ADR.exe

SE: Microsoft® Windows XP™ Service Pack 2 - X86

Nom du PC: LOTUS | Utilisateur actuel: Nathalie (Administrateur)

.

============== ÉLÉMENT(S) TROUVÉ(S) ==============

.

C:\Documents and Settings\Nathalie\Application Data\EoRezo

C:\Documents and Settings\Nathalie\Application Data\ItsLabel

C:\Documents and Settings\Propriétaire\Application Data\EoRezo

C:\Documents and Settings\Propriétaire\Application Data\ItsLabel

C:\Documents and Settings\Propriétaire\Menu Démarrer\Programmes\Roxy Palace Online Casino

C:\MicroGaming\Casino\Roxypalace

C:\Program Files\Crawler

C:\Program Files\PartyGaming

.

HKCU\Software\EoRezo

HKCU\Software\ItsLabel

HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{1CB20BF0-BBAE-40A7-93F4-6435FF3D0411}

HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{64F56FC1-1272-44CD-BA6E-39723696E350}

HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{64F56FC1-1272-44CD-BA6E-39723696E350}

HKLM\Software\Classes\CLSID\{64F56FC1-1272-44CD-BA6E-39723696E350}

HKLM\Software\Classes\EoRezoBHO.EoBho

HKLM\Software\Classes\EoRezoBHO.EoBho.1

HKLM\Software\Classes\Interface\{B0D071A1-36B3-4757-A126-14C89C56013A}

HKLM\Software\Classes\TR.TRFactory

HKLM\Software\Classes\TR.TRFactory.1

HKLM\Software\Classes\TypeLib\{B4C656C9-F2E9-4E77-B3F4-443DF2BD778F}

HKLM\Software\ItsLabel

HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{64F56FC1-1272-44CD-BA6E-39723696E350}

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\eoEngine_is1

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\RoxyPalace

HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser|{4B3803EA-5230-4DC3-A7FC-33638F3D3542}

HKCU\Software\Mozilla\Firefox\Extensions|{A89AED22-9133-424c-88E7-C8235C5FF302}

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\ARA.ini

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\DID.dll

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\DM.dll

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\images\habeas_webseal.gif

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|c:\program files\partygaming\language\en_US\lang_pack_en_US.txt

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\language\fr_FR\lang_pack_fr_FR.txt

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\libeay32.dll

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\llh.dll

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\MFC42LU.DLL

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\MSLUP60.dll

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\MSLURT.dll

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\GRA.ini

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\en_US\lang_pack_en_US.txt

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\account_but_newacocunt.jpg

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\allversion.txt

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\bonus-icon.gif

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\but.bmp

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\but_account.bmp

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\but_skin.gif

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\but_skin_account.gif

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\client_bottom.jpg

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\client_bottom_right.jpg

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\client_gradient.jpg

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\client_top.jpg

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\connect_screen_bg.jpg

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\down_arrow.gif

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\down_arrow_o.gif

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\games\addplaymoney_button.jpg

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\games\aud.png

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\games\autospincancel_button.jpg

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\games\autospinoptions_background.jpg

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\games\autospinstart_button.jpg

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\games\balance_strip.jpg

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\games\bottombar_logo_net.jpg

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\games\bottombar_net.jpg

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\games\bottombar_net_big.jpg

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\games\bottombar_net_medium.jpg

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\games\buyin_botbg.jpg

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\games\buyin_cancelbutton.jpg

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\games\buyin_cashierbutton.jpg

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\games\buyin_midbg.jpg

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\games\buyin_okbutton.jpg

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\games\buyin_topbg.jpg

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\games\BuyInConfig.ini

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\games\cad.png

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\games\cardgames\6_bigcardback.bmp

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\games\cardgames\blackjack\bj_check.jpg

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\games\cardgames\blackjack\bjbar_americanroulette_icon.jpg

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\games\cardgames\blackjack\bjbar_baccarat_icon.jpg

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\games\cardgames\blackjack\bjbar_bjbonuspairs_icon.jpg

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\games\cardgames\blackjack\bjbar_bjhighlimit_icon.jpg

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\games\cardgames\blackjack\bjbar_bjsingledeck_icon.jpg

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\games\cardgames\blackjack\bjbar_boardbabe_icon.jpg

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\games\cardgames\blackjack\bjbar_cashcruise_icon.jpg

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\games\cardgames\blackjack\bjbar_casinowar_icon.jpg

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\games\cardgames\blackjack\bjbar_coolbanana_icon.jpg

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\games\cardgames\blackjack\bjbar_deuceswild_icon.jpg

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\games\cardgames\blackjack\bjbar_europeanroulette_icon.jpg

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\games\cardgames\blackjack\bjbar_firedrake_icon.jpg

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\games\cardgames\blackjack\bjbar_flamingo_icon.jpg

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\games\cardgames\blackjack\bjbar_fruitparty_icon.jpg

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\games\cardgames\blackjack\bjbar_goannagold_icon.jpg

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\games\cardgames\blackjack\bjbar_goldenoasis_icon.jpg

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\games\cardgames\blackjack\bjbar_graveyardbash_icon.jpg

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\games\cardgames\blackjack\bjbar_hotjokerpoker_icon.jpg

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\games\cardgames\blackjack\bjbar_hotroller_icon.jpg

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\games\cardgames\blackjack\bjbar_job_icon.jpg

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\games\cardgames\blackjack\bjbar_junglerumble_icon.jpg

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\games\cardgames\blackjack\bjbar_kangacash_icon.jpg

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\games\cardgames\blackjack\bjbar_kookakeno_icon.jpg

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\games\cardgames\blackjack\bjbar_lir_icon.jpg

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\games\cardgames\blackjack\bjbar_logo_cover.jpg

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\games\cardgames\blackjack\bjbar_magicman_icon.jpg

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\games\cardgames\blackjack\bjbar_mhvp_icon.jpg

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\games\cardgames\blackjack\bjbar_paigow_icon.jpg

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\games\cardgames\blackjack\bjbar_pc_icon.jpg

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\games\cardgames\blackjack\bjbar_pcp_icon.jpg

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\games\cardgames\blackjack\bjbar_piggypayback_icon.jpg

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\games\cardgames\blackjack\bjbar_predator_icon.jpg

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\games\cardgames\blackjack\bjbar_reddog_icon.jpg

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\games\cardgames\blackjack\bjbar_safecrackerkeno_icon.jpg

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\games\cardgames\blackjack\bjbar_sfw_icon.jpg

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\games\cardgames\blackjack\bjbar_silvercity_icon.jpg

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\games\cardgames\blackjack\bjbar_superjoker_icon.jpg

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\games\cardgames\blackjack\bjbar_supermystic_icon.jpg

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\games\cardgames\blackjack\bjbar_superstar_icon.jpg

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\games\cardgames\blackjack\bjbar_sweethawaii_icon.jpg

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\games\cardgames\blackjack\bjbar_tcp_icon.jpg

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\games\cardgames\blackjack\bjbar_tod_icon.jpg

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\games\cardgames\blackjack\bjbar_vegasclub_icon.jpg

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\games\cardgames\blackjack\BlackJack.dll

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\games\cardgames\blackjack\blackjack.wav

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\games\cardgames\blackjack\blackjack\bj_table.jpg

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\games\cardgames\blackjack\blackjack\Config.ini

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\games\cardgames\blackjack\blackjack\version.txt

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\games\cardgames\blackjack\chip_pointer_R.gif

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\games\cardgames\blackjack\clear_button.jpg

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\games\cardgames\blackjack\deal_button.jpg

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\games\cardgames\blackjack\double_button.jpg

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\games\cardgames\blackjack\hit_button.jpg

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\games\cardgames\blackjack\insurance.wav

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\games\cardgames\blackjack\insure_button.jpg

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\games\cardgames\blackjack\number_circle.gif

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\games\cardgames\blackjack\pointer_R.gif

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\games\cardgames\blackjack\push.wav

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\games\cardgames\blackjack\repeatbet_button.jpg

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\games\cardgames\blackjack\result_bj.jpg

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\games\cardgames\blackjack\result_bust.jpg

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\games\cardgames\blackjack\result_insure.jpg

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\games\cardgames\blackjack\result_lost.jpg

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\games\cardgames\blackjack\result_push.jpg

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\games\cardgames\blackjack\result_won.jpg

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\games\cardgames\blackjack\split.wav

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\games\cardgames\blackjack\split_button.png

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\games\cardgames\blackjack\stand_button.jpg

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\games\cardgames\blackjack\surrender_button.jpg

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\games\cardgames\blackjack\version.txt

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\games\cardgames\c0_5.png

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\games\cardgames\c1.png

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\games\cardgames\c10.png

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\games\cardgames\c100.png

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\games\cardgames\c100k.png

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\games\cardgames\c10k.png

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\games\cardgames\c1k.png

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\games\cardgames\c2_5k.png

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\games\cardgames\c25.png

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\games\cardgames\c250.png

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\games\cardgames\c25k.png

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\games\cardgames\c5.png

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\games\cardgames\c50.png

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\games\cardgames\c500.png

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\games\cardgames\c500k.png

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\games\cardgames\c50k.png

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\games\cardgames\c5k.png

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\games\cardgames\Card.wav

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\games\cardgames\card_deck.bmp

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\games\cardgames\CardFlip.wav

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\games\cardgames\FRU_6_bigcardback.bmp

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\games\cardgames\number_circle.gif

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\games\cardgames\pointer_R.gif

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\games\cardgames\qd_cashier_button.jpg

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\games\cardgames\qd_exit_button.jpg

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\games\cardgames\qd_gamelogs_button.jpg

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\games\cardgames\qd_version_button.jpg

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\games\cardgames\rc0_5.png

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\games\cardgames\rc1.png

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\games\cardgames\rc10.png

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\games\cardgames\rc100.png

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\games\cardgames\rc100k.png

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\games\cardgames\rc10k.png

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\games\cardgames\rc1k.png

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\games\cardgames\rc2_5k.png

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\games\cardgames\rc25.png

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\games\cardgames\rc250.png

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\games\cardgames\rc25k.png

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\games\cardgames\rc5.png

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\games\cardgames\rc50.png

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\games\cardgames\rc500.png

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\games\cardgames\rc500k.png

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\games\cardgames\rc50k.png

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\games\cardgames\rc5k.png

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\games\cardgames\Rr.bmp

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\games\cardgames\rules_button.jpg

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\games\cardgames\version.txt

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\games\cashier_button.jpg

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\games\cashout_midbg.jpg

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\games\cent_strip.jpg

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\games\chf.png

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\games\chips.wav

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\games\czk.png

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\games\dkk.png

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\games\eur.png

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\games\exit_button.jpg

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\games\format.ini

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\games\game_topbar_pff.jpg

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\games\gamelogs_button.jpg

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\games\gbp.png

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\games\hkd.png

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\games\huf.png

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\games\ils.png

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\games\inr.png

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\games\jpy.png

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\games\krw.png

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\games\myr.png

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\games\nok.png

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\games\nzd.png

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\games\php.png

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\games\pln.png

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\games\popup_but_cancel.gif

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\games\popup_but_cashier.gif

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\games\popup_but_ok.gif

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\games\popup_buyin_but_all.jpg

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\games\popup_buyin_tab.jpg

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\games\PushBut.wav

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\games\quickdeposit_button.jpg

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\games\ron.png

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\games\rur.png

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\games\sek.png

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\games\sgd.png

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\games\skk.png

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\games\status_dlg.jpg

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\games\sys_icons.jpg

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\games\system_but_close.jpg

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\games\system_but_inactive_close.jpg

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\games\system_but_inactive_minimise.jpg

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\games\system_but_minimise.jpg

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\games\table_logo_com.png

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\games\table_logo_net.png

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\games\thb.png

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\games\trny_buyin_botbg.jpg

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\games\try.png

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\games\twd.png

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\games\usd.png

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\games\version.txt

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\games\version_button.jpg

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\games\win.wav

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\games\zar.png

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\icon_three.gif

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\icon_ticked.gif

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\lhn_account_background.jpg

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\lhn_account_divider.jpg

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\lhn_ani_refresh.gif

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\lhn_bar_jackpot.jpg

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\lhn_bar_jackpot_numbers.gif

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\lhn_bar_jackpot_numbers.jpg

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\lhn_bar_jackpot_numbers_small.gif

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\lhn_bar_news.jpg

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\lhn_but_cashout.jpg

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\lhn_but_deposit.jpg

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\lhn_but_deposit_large.jpg

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\lhn_but_options.jpg

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\lhn_but_redeem.jpg

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\lhn_but_refresh.jpg

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\lhn_but_reload_play.jpg

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\lhn_but_status.jpg

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\lhn_details_open.jpg

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\lhn_link_arrow.gif

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\lhn_tab_background.jpg

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\loading.gif

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\menu_01_myaccount.jpg

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\menu_02_cashier.jpg

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\menu_03_news.jpg

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\menu_04_rules.jpg

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\menu_05_tellfriend.jpg

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\menu_06_about.jpg

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\menu_07_help.jpg

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\new-mail-icon.gif

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\no-mail-icon.gif

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\PartyCasino.ico

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\popup_login_bottom.jpg

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\popup_login_top.jpg

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\popup_register_bottomleft.jpg

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\popup_register_top.jpg

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\skin.bmp

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\skin_account.bmp

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\spacer.gif

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\system_but_bets.jpg

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\system_but_bingo.jpg

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\system_but_cashier.jpg

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\system_but_connected.jpg

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\system_but_gammon.jpg

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\system_but_poker.jpg

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\system_but_security.jpg

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\ticker_bg.jpg

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\up_arrow.gif

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\up_arrow_o.gif

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\images\version.txt

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\Language\fr_FR\lang_pack_fr_FR.txt

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\lobbyconfig.txt

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\PartyCasino.dll

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\pc_uninstall.bat

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\ProductVersion.txt

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyCasino\sys.ini

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\PartyGaming.exe

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\ssleay32.dll

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\UNICOWS.DLL

HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDLLs|C:\Program Files\PartyGaming\zlib1.dll

.

============== SCAN ADDITIONNEL ==============

.

* Mozilla FireFox Version 3.5.7 (fr) *

.

C:\Documents and Settings\Nathalie\..\42orv7l5.default\prefs.js - browser.download.lastDir: C:\\Documents and Settings\\Nathalie\\Bureau

C:\Documents and Settings\Nathalie\..\42orv7l5.default\prefs.js - browser.startup.homepage: hxxp://fr.msn.com/

C:\Documents and Settings\Nathalie\..\42orv7l5.default\prefs.js - browser.startup.homepage_override.mstone: rv:1.9.1.7

C:\Documents and Settings\Nathalie\..\42orv7l5.default\prefs.js - keyword.URL: hxxp://www.bing.com/search?mkt=fr-FR&form=MIAWB1&q=

C:\Documents and Settings\Propriétaire\..\ypvbalxb.default\Invalidprefs.js - browser.download.lastDir: C:\\Documents and Settings\\PropriÃ©taire\\Mes documents\\dossier adeuh RA

C:\Documents and Settings\Propriétaire\..\ypvbalxb.default\Invalidprefs.js - browser.startup.homepage: hxxp://www.lo.st

C:\Documents and Settings\Propriétaire\..\ypvbalxb.default\Invalidprefs.js - browser.startup.homepage_override.mstone: rv:1.9.0.3

C:\Documents and Settings\Propriétaire\..\ypvbalxb.default\prefs.js - browser.download.lastDir: C:\\Documents and Settings\\PropriÃ©taire\\Mes documents\\dossier adeuh RA

C:\Documents and Settings\Propriétaire\..\ypvbalxb.default\prefs.js - browser.startup.homepage: hxxp://www.lo.st

C:\Documents and Settings\Propriétaire\..\ypvbalxb.default\prefs.js - browser.startup.homepage_override.mstone: rv:1.9.0.3

.

* Internet Explorer Version 8.0.6001.18702 *

.

[HKCU\Software\Microsoft\Internet Explorer\Main]

.

Do404Search: 0x01000000

Enable Browser Extensions: yes

Local Page: C:\WINDOWS\system32\blank.htm

Search Page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

Show_ToolBar: yes

Start Page: hxxp://www.wanadoo.fr

Use Custom Search URL: 1

Use Search Asst: no

.

[HKLM\Software\Microsoft\Internet Explorer\Main]

.

Default_Page_URL: hxxp://go.microsoft.com/fwlink/?LinkId=69157

Default_Search_URL: hxxp://go.microsoft.com/fwlink/?LinkId=54896

Delete_Temp_Files_On_Exit: yes

Local Page: C:\WINDOWS\system32\blank.htm

SearchAssistant: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

Search bar: hxxp://www.google.com/ie

Search Page: hxxp://go.microsoft.com/fwlink/?LinkId=54896

Start Page: hxxp://go.microsoft.com/fwlink/?LinkId=69157

Use Search Asst: no

.

[HKLM\Software\Microsoft\Internet Explorer\ABOUTURLS]

.

Tabs: res://ieframe.dll/tabswelcome.htm

Blank: res://mshtml.dll/blank.htm

.

============== SUSPECT(S) ==============

.

C:\Documents and Settings\Nathalie\Application Data\BitTorrent\Warcraft III Reign of Chaos, The Frozen Throne + Update Patch War3TFT_122a_English +CD Key.torrent

C:\Documents and Settings\Nathalie\Bureau\LauncherQuickPatcher.exe

C:\Documents and Settings\Nathalie\Bureau\Rayman_3_-_Hoodlum_havoc___CRACK_100__WORKING___ENGLISH__saliko.4563499.TPB.torrent

C:\Documents and Settings\Nathalie\Mes documents\Downloads\Compressed\!Crack.nfo

C:\Documents and Settings\Nathalie\Mes documents\Downloads\Compressed\CrackNocd4flt.exe

C:\Documents and Settings\Nathalie\Mes documents\DungeonParty\UpdaterDownloads\patch-dungeonparty-0.7.0.1-0.7.0.2.exe

C:\Documents and Settings\Nathalie\Mes documents\DungeonParty\UpdaterDownloads\patch-dungeonparty-0.7.0.2-0.7.0.3.exe

C:\Documents and Settings\Nathalie\Mes documents\DungeonParty\UpdaterDownloads\patch-dungeonparty-0.7.0.3-0.7.0.4.exe

C:\Documents and Settings\Nathalie\Mes documents\DungeonParty\UpdaterDownloads\patch-dungeonparty-0.7.0.4-0.7.0.5.exe

C:\Documents and Settings\Nathalie\Mes documents\DungeonParty\UpdaterDownloads\patch-dungeonparty-0.7.0.5-0.7.0.6.exe

C:\Documents and Settings\Nathalie\Mes documents\DungeonParty\UpdaterDownloads\patch-dungeonparty-0.7.0.6-0.7.0.7.exe

C:\Documents and Settings\Nathalie\Mes documents\DungeonParty\UpdaterDownloads\patch-dungeonparty-0.7.0.7-0.7.0.8.exe

C:\Documents and Settings\Nathalie\Mes documents\DungeonParty\UpdaterDownloads\patch-dungeonparty-0.7.0.8-0.7.0.9.exe

C:\Documents and Settings\Nathalie\Mes documents\DungeonParty\UpdaterDownloads\patch-dungeonparty-0.7.0.9-0.7.1.0.exe

.

========================================

.

C:\DOCUME~1\Nathalie\LOCALS~1\Temp: 15 Fichier(s), 4 Dossier(s)

Temporary Internet Files: 26 Fichier(s), 11 Dossier(s)

.

C:\Ad-Remover\Quarantine: 0 Fichier(s)

C:\Ad-Remover\Backup: 13 Fichier(s)

.

C:\Ad-Report-CLEAN[1].txt - 503 Octet(s)

C:\Ad-Report-SCAN[1].txt - 47430 Octet(s)

.

Fin à: 00:55:06, 25/03/2010

.

============== E.O.F - SCAN[1] ==============

.

======= RAPPORT D'AD-REMOVER 2.0.0.0,B | UNIQUEMENT XP/VISTA/7 =======

.

Mis à jour par C_XX le 23/03/10 à 14:00

Contact: AdRemover.contact@gmail.com

Site web: http://pagesperso-orange.fr/NosTools/ad_remover.html

.

Lancé à: 22:06:28 le 24/03/2010 | Mode normal | Option: CLEAN

Exécuté de: C:\Ad-Remover\ADR.exe

SE: Microsoft® Windows XP™ Service Pack 2 - X86

Nom du PC: LOTUS | Utilisateur actuel: Nathalie (Administrateur)

.

============== ÉLÉMENT(S) NEUTRALISÉ(S) ==============

.

Malwarebytes' Anti-Malware 1.44

Version de la base de données: 3861

Windows 5.1.2600 Service Pack 2

Internet Explorer 8.0.6001.18702

25/03/2010 00:08:09

mbam-log-2010-03-25 (00-08-09).txt

Type de recherche: Examen complet (A:\|C:\|D:\|E:\|F:\|G:\|)

Eléments examinés: 410943

Temps écoulé: 1 hour(s), 25 minute(s), 26 second(s)

Processus mémoire infecté(s): 0

Module(s) mémoire infecté(s): 0

Clé(s) du Registre infectée(s): 1

Valeur(s) du Registre infectée(s): 0

Elément(s) de données du Registre infecté(s): 0

Dossier(s) infecté(s): 1

Fichier(s) infecté(s): 0

Processus mémoire infecté(s):

(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):

(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):

HKEY_CURRENT_USER\Software\Malware Defense (Rogue.MalwareDefense) -> Quarantined and deleted successfully.

Valeur(s) du Registre infectée(s):

(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):

(Aucun élément nuisible détecté)

Dossier(s) infecté(s):

C:\WINDOWS\_VOIDnylnoismbu (Rootkit.TDSS) -> Quarantined and deleted successfully.

Fichier(s) infecté(s):

(Aucun élément nuisible détecté)

Logfile of random's system information tool 1.06 (written by random/random)

Run by Nathalie at 2010-03-25 00:16:44

Microsoft Windows XP Édition familiale Service Pack 2

System drive C: has 25 GB (17%) free of 149 GB

Total RAM: 1023 MB (55% free)

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 00:16:59, on 25/03/2010

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v8.00 (8.00.6001.18702)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe

C:\Program Files\Adobe\Photoshop Elements 7.0\PhotoshopElementsFileAgent.exe

C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe

C:\WINDOWS\System32\FTRTSVC.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\Program Files\Google\Update\GoogleUpdate.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\SOUNDMAN.EXE

C:\WINDOWS\system32\RUNDLL32.EXE

C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe

C:\Program Files\DNA\btdna.exe

C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

C:\PROGRA~1\Wanadoo\TaskBarIcon.exe

C:\Program Files\Ares\Ares.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Documents and Settings\Nathalie\Application Data\Microsoft\Notification de cadeaux MSN\lsnfier.exe

C:\Program Files\Internet Explorer\IEXPLORE.EXE

C:\WINDOWS\explorer.exe

C:\Documents and Settings\Nathalie\Bureau\RSIT.exe

C:\Documents and Settings\Nathalie\Bureau\Nathalie.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.wanadoo.fr

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Wanadoo