fenetre regfixit

chrifleur · le 3 septembre 2008

essaie de faire ceci afin de vérifier qu'il n'y a plus d'infection

Téléchargez OTViewIt sur votre Bureau.

* Fermez toutes les fenêtres de programme, puis lancez-le

* Cliquez sur le bouton Run Scan et laissez le programme tourner sans l'interrompre

* Il va produire deux rapports (logs), l'un d'eux nommé OTViewIt.txt va s'ouvrir dans le Bloc-notes, l'autre nommé Extras sera enregistré sur le Bureau. Envoyez ces deux logs en réponse.

* Il faudra peut-être que vous utilisiez deux messages pour envoyer ces deux logs sur le forum

anelia · le 5 septembre 2008

merci,

voici le 1er rapport :

OTViewIt logfile created on: 05/09/2008 07:21:47 - Run 1

OTViewIt by OldTimer - Version 1.0.1.8 Folder = C:\Documents and Settings\Lucie Paquet\Bureau

Windows XP Home Edition Service Pack 1 (Version = 5.1.2600) - Type = NTWorkstation

Internet Explorer (Version = 6.0.2800.1106)

Locale: 0000040C | Country: France | Language: FRA | Date Format: dd/MM/yyyy

223.48 Mb Total Physical Memory | 104.21 Mb Available Physical Memory | 46.63% Memory free

547.12 Mb Paging File | 321.59 Mb Available in Paging File | 58.78% Paging File free

Paging file location(s): C:\pagefile.sys 336 672;

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files

Drive C: | 14.65 Gb Total Space | 5.09 Gb Free Space | 34.77% Space Free | Partition Type: NTFS

Drive D: | 59.90 Gb Total Space | 16.47 Gb Free Space | 27.49% Space Free | Partition Type: NTFS

E: Drive not present or media not loaded

F: Drive not present or media not loaded

G: Drive not present or media not loaded

H: Drive not present or media not loaded

I: Drive not present or media not loaded

Computer Name: LUCIE

Current User Name: Lucie Paquet

Logged in as Administrator.

Current Boot Mode: Normal

Scan Mode: Current user

Whitelist: On

===== Processes - Non-Microsoft Only =====

[12/02/2007 10:56 AM | 00,032,807 | ---- | M] (Securitoo Portal) - C:\Program Files\Securitoo\av_fw\backweb\7431218\Program\ServiceWrapper-7431218.exe

[12/02/2007 10:56 AM | 00,278,581 | ---- | M] (F-Secure Corp.) - C:\Program Files\Securitoo\av_fw\backweb\7431218\Program\fsbwsys.exe

[03/26/2008 09:32 AM | 00,290,304 | ---- | M] (F-Secure Corp.) - C:\Program Files\Securitoo\av_fw\Anti-Virus\fsgk32.exe

[12/02/2007 10:56 AM | 00,032,807 | ---- | M] (Securitoo Portal) - C:\Program Files\Securitoo\av_fw\backweb\7431218\Program\fspex.exe

[03/26/2008 09:32 AM | 00,248,320 | ---- | M] (F-Secure Corp.) - C:\Program Files\Securitoo\av_fw\Anti-Virus\fssm32.exe

[03/03/2004 08:09 AM | 05,730,304 | ---- | M] (VIA Technologies, Inc.) - C:\Program Files\VIAudioi\SBADeck\ADeck.exe

[02/08/2005 06:00 AM | 00,098,304 | ---- | M] (SEIKO EPSON CORPORATION) - C:\WINDOWS\system32\spool\drivers\w32x86\3\E_FATIACE.EXE

===== Win32 Services - Non-Microsoft Only =====

(BackWeb Plug-in - 7431218) Antivirus Firewall [Auto | Running]

[12/02/2007 10:56 AM | 00,032,807 | ---- | M] (Securitoo Portal) - C:\Program Files\Securitoo\av_fw\backweb\7431218\Program\ServiceWrapper-7431218.exe

(FSBWSYS) FSBWSYS [Auto | Running]

[12/02/2007 10:56 AM | 00,278,581 | ---- | M] (F-Secure Corp.) - C:\Program Files\Securitoo\av_fw\backweb\7431218\Program\fsbwsys.exe

===== Driver Services - Non-Microsoft Only =====

(catchme) catchme [On_Demand | Stopped]

File not found - C:\DOCUME~1\LUCIEP~1\LOCALS~1\Temp\catchme.sys

(F-Secure Filter) F-Secure File System Filter [Auto | Running]

[09/10/2004 05:14 PM | 00,048,720 | ---- | M] () - C:\Program Files\Securitoo\av_fw\Anti-Virus\win2k\FSfilter.sys

(F-Secure Gatekeeper) F-Secure Gatekeeper [Auto | Running]

[03/26/2008 09:32 AM | 00,055,424 | ---- | M] () - C:\Program Files\Securitoo\av_fw\Anti-Virus\win2k\fsgk.sys

(F-Secure Recognizer) F-Secure File System Recognizer [Auto | Running]

[06/01/2004 11:03 AM | 00,016,816 | ---- | M] () - C:\Program Files\Securitoo\av_fw\Anti-Virus\win2k\FSrec.sys

(FETNDIS) Pilote NT de carte VIA PCI 10/100Mo Fast Ethernet [On_Demand | Running]

[08/17/2001 09:13 PM | 00,027,165 | ---- | M] (VIA Technologies, Inc. ) - C:\WINDOWS\system32\drivers\fetnd5.sys

(GMSIPCI) GMSIPCI [On_Demand | Stopped]

File not found - E:\INSTALL\GMSIPCI.SYS

(NTACCESS) NTACCESS [On_Demand | Stopped]

File not found - E:\NTACCESS.sys

(Secdrv) Secdrv [On_Demand | Stopped]

[04/24/2003 02:00 PM | 00,027,440 | ---- | M] () - C:\WINDOWS\system32\drivers\secdrv.sys

(SetupNTGLM7X) SetupNTGLM7X [On_Demand | Stopped]

File not found - E:\NTGLM7X.sys

(Stmatm) ATM/ADSL miniport [On_Demand | Running]

[09/19/2003 01:24 PM | 00,060,223 | R--- | M] (STMicroelectronics ) - C:\WINDOWS\system32\drivers\stmatm.sys

(TaurusUsb) ADSL Modem USB Service [On_Demand | Running]

[09/19/2003 01:24 PM | 00,539,138 | R--- | M] () - C:\WINDOWS\system32\drivers\torususb.sys

(VIAudio) Vinyl AC'97 Audio Controller (WDM) [On_Demand | Running]

[02/11/2004 07:51 AM | 00,115,840 | R--- | M] (VIA Technologies, Inc.) - C:\WINDOWS\system32\drivers\viaudios.sys

========== Run Keys ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"AdslTaskBar" = rundll32.exe stmctrl.dll,TaskBar [09/19/2003 01:24 PM | 00,151,552 | ---- | M] (BeWAN systems )

"AudioDeck" = C:\Program Files\VIAudioi\SBADeck\ADeck.exe [03/03/2004 08:09 AM | 05,730,304 | ---- | M] (VIA Technologies, Inc.)

"EPSON Stylus DX3800 Series" = C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIACE.EXE /P26 "EPSON Stylus DX3800 Series" /O6 "USB001" /M "Stylus DX3800" [02/08/2005 06:00 AM | 00,098,304 | ---- | M] (SEIKO EPSON CORPORATION)

"F-Secure Manager" = "C:\Program Files\Securitoo\av_fw\Common\FSM32.EXE" /splash [10/26/2005 03:51 AM | 00,122,929 | ---- | M] (F-Secure Corporation)

"F-Secure Startup Wizard" = "C:\Program Files\Securitoo\av_fw\FSGUI\FSSW.EXE" /reboot [10/18/2005 10:29 AM | 00,372,736 | ---- | M] (F-Secure Corporation)

"F-Secure TNB" = "C:\Program Files\Securitoo\av_fw\TNB\TNBUtil.exe" /CHECKALL /WAITFORSW [07/18/2005 04:51 PM | 00,700,416 | ---- | M] (F-Secure Corporation)

"News Service" = "C:\Program Files\Securitoo\av_fw\FSGUI\ispnews.exe" [05/31/2005 02:45 PM | 00,356,352 | ---- | M] (F-Secure Corporation)

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]

"load" = Reg Error: Value load does not exist or could not be read.

"run" = Reg Error: Value run does not exist or could not be read.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"VPbubble" = "C:\Program Files\Nosibay\VPbubble\launcher.exe" [06/03/2008 09:36 AM | 00,239,120 | ---- | M] (vente-privee.com)

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]

"load" =

"run" = Reg Error: Value run does not exist or could not be read.

========== Startup Folders ==========

[All Users.WINDOWS Startup Folder - C:\Documents and Settings\All Users.WINDOWS\Menu Démarrer\Programmes\Démarrage]

[12/02/2007 10:56 AM | 00,032,807 | ---- | M] (Securitoo Portal) - C:\Documents and Settings\All Users.WINDOWS\Menu Démarrer\Programmes\Démarrage\Antivirus Firewall.lnk = C:\Program Files\Securitoo\av_fw\backweb\7431218\Program\fspex.exe

[Lucie Paquet Startup Folder - C:\Documents and Settings\Lucie Paquet\Menu Démarrer\Programmes\Démarrage]

========== BHO's ==========

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]

HKLM CLSID: (AcroIEHlprObj Class) - [11/03/2003 02:17 PM | 00,054,248 | ---- | M] (Adobe Systems Incorporated) C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C451C08A-EC37-45DF-AAAD-18B51AB5E837}]

HKLM CLSID: (PDFCreator Toolbar Helper) - [06/15/2007 05:37 PM | 00,757,760 | ---- | M] () C:\Program Files\PDFCreator Toolbar\v3.0.0.0\PDFCreator_Toolbar.dll

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E99421FB-68DD-40F0-B4AC-B7027CAE2F1A}]

HKLM CLSID: (EpsonToolBandKicker Class) - [02/21/2005 10:50 PM | 00,368,640 | ---- | M] (SEIKO EPSON CORPORATION) C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll

========== Toolbars ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ToolBar]

"{31CF9EBE-5755-4A1D-AC25-2834D952D9B4}"

HKLM CLSID: (PDFCreator Toolbar) - [06/15/2007 05:37 PM | 00,757,760 | ---- | M] () C:\Program Files\PDFCreator Toolbar\v3.0.0.0\PDFCreator_Toolbar.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ToolBar]

"{EE5D279F-081B-4404-994D-C6B60AAEBA6D}"

HKLM CLSID: (EPSON Web-To-Page) - [02/21/2005 10:50 PM | 00,368,640 | ---- | M] (SEIKO EPSON CORPORATION) C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]

"{31CF9EBE-5755-4A1D-AC25-2834D952D9B4}"

HKLM CLSID: (PDFCreator Toolbar) - [06/15/2007 05:37 PM | 00,757,760 | ---- | M] () C:\Program Files\PDFCreator Toolbar\v3.0.0.0\PDFCreator_Toolbar.dll

"{EE5D279F-081B-4404-994D-C6B60AAEBA6D}"

HKLM CLSID: (EPSON Web-To-Page) - [02/21/2005 10:50 PM | 00,368,640 | ---- | M] (SEIKO EPSON CORPORATION) C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll

========== AppInit_Dlls ==========

========== HKLM Security Providers ==========

========== HKLM Winlogon Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell]

= Explorer.exe

>Explorer.exe - [04/24/2003 02:00 PM | 01,008,128 | ---- | M] (Microsoft Corporation) C:\WINDOWS\explorer.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\UserInit]

= C:\WINDOWS\system32\userinit.exe,

>C:\WINDOWS\system32\userinit.exe - [04/24/2003 02:00 PM | 00,022,528 | ---- | M] (Microsoft Corporation) C:\WINDOWS\system32\userinit.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\UIHost]

= logonui.exe

>logonui.exe - [04/24/2003 02:00 PM | 00,505,344 | ---- | M] (Microsoft Corporation) C:\WINDOWS\system32\logonui.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\VMApplet]

= rundll32 shell32,Control_RunDLL "sysdm.cpl"

>rundll32 shell32 - [04/24/2003 02:00 PM | 08,393,216 | ---- | M] (Microsoft Corporation) C:\WINDOWS\system32\shell32.dll

>Control_RunDLL "sysdm.cpl" - [04/24/2003 02:00 PM | 00,274,944 | ---- | M] (Microsoft Corporation) C:\WINDOWS\system32\sysdm.cpl

========== User's Winlogon Settings ==========

========== Winlogon Notify Settings ==========

========== Policies ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer]

Unable to open key or key not present!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System]

"dontdisplaylastusername" = 0

"legalnoticecaption" =

"legalnoticetext" =

"shutdownwithoutlogon" = 1

"undockwithoutlogon" = 1

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer]

"NoDriveTypeAutoRun" = 145

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System]

Unable to open key or key not present!

========== Lsa Authentication Packages ==========

========== Lsa Security Packages ==========

========== Desktop Components ==========

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]

"FriendlyName" = "Ma page d'accueil"

"Source" = "About:Home"

"SubscribedURL" = "About:Home"

========== Safeboot Options ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot]

"AlternateShell" = cmd.exe

========== Disabled MsConfig Items ==========

Unable to open key or key not present!

========== CDRom AutoRun Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom]

"AutoRun" = 1

========== Autorun Files on Drives ==========

AUTOEXEC.BAT []

[01/26/2006 08:55 PM | 00,000,000 | ---- | M] () C:\AUTOEXEC.BAT [ NTFS ]

========== MountPoints2 ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{11b24cce-1b3d-11dc-8eae-00110904a9f3}\Shell]

"" = None

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{505c2e56-5f84-11dc-8ec6-00110904a9f3}\Shell]

"" = None

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{80d6584c-c36c-11dc-bffd-00110904a9f3}\Shell]

"" = None

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{886536b2-799a-11dc-8ed9-00110904a9f3}\Shell]

"" = None

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{91a698f6-b22f-11dc-bfc2-00110904a9f3}\Shell]

"" = None

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{aca88434-442a-11dc-8ebd-00110904a9f3}\Shell]

"" = None

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c5d68a6c-a034-11dc-bf83-00110904a9f3}\Shell]

"" = None

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{cc507bd4-d354-11dc-8028-00110904a9f3}\Shell]

"" = None

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{ed6813dc-c53e-11dc-8000-00110904a9f3}\Shell]

"" = None

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{ed6813dd-c53e-11dc-8000-00110904a9f3}\Shell]

"" = None

========== DNS Name Servers ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Adapters\{94F4736B-6214-4B4C-A2D0-A22A64223B6F}]

Servers: | Description: Carte Fast Ethernet compatible VIA

========== Hosts File ==========

HOSTS File = (790 bytes) - C:\WINDOWS\System32\drivers\etc\Hosts

First 25 entries...

127.0.0.1 localhost

========== Files/Folders - Created Within 30 days ==========

[09/01/2008 06:14 PM | -HSD | C] - C:\Config.Msi

[09/02/2008 09:47 AM | ---D | C] - C:\tmp

[09/02/2008 03:26 PM | ---D | C] - C:\Documents and Settings\All Users.WINDOWS\Application Data\Malwarebytes

[09/02/2008 03:26 PM | ---D | C] - C:\Documents and Settings\Lucie Paquet\Application Data\Malwarebytes

[08/07/2008 04:42 PM | R--D | C] - C:\Documents and Settings\Lucie Paquet\Mes documents\Mes vidéos

[09/02/2008 03:26 PM | 00,000,696 | ---- | C] () - C:\Documents and Settings\All Users.WINDOWS\Bureau\Malwarebytes' Anti-Malware.lnk

[08/08/2008 10:06 AM | 03,723,454 | ---- | C] (IZSoftware ) - C:\Documents and Settings\Lucie Paquet\Bureau\IZArc_Setup.exe

[08/09/2008 11:35 AM | 00,020,480 | ---- | C] () - C:\Documents and Settings\Lucie Paquet\Bureau\licenciement Nounou.doc

[08/11/2008 10:30 AM | 00,273,913 | ---- | C] () - C:\Documents and Settings\Lucie Paquet\Bureau\club haribo.pdf

[09/04/2008 08:23 PM | ---D | C] - C:\Documents and Settings\Lucie Paquet\Bureau\Raccourcis Bureau non utilisés

[09/05/2008 06:56 AM | 00,001,008 | ---- | C] () - C:\Documents and Settings\All Users.WINDOWS\Menu Démarrer\Programmes\Démarrage\Antivirus Firewall.lnk

[09/02/2008 02:32 PM | ---D | C] - C:\Program Files\Navilog1

[09/02/2008 03:26 PM | ---D | C] - C:\Program Files\Malwarebytes' Anti-Malware

[09/02/2008 05:18 PM | ---D | C] - C:\Program Files\Trend Micro

========== Files - Modified Within 30 days ==========

[1 C:\WINDOWS\System32\*.tmp files]

[09/02/2008 09:46 AM | 00,229,592 | ---- | M] () - C:\WINDOWS\System32\FNTCACHE.DAT

[09/04/2008 08:18 PM | 00,002,422 | ---- | M] () - C:\WINDOWS\System32\wpa.dbl

[7 C:\WINDOWS\*.tmp files]

[09/05/2008 06:56 AM | 00,002,048 | --S- | M] () - C:\WINDOWS\bootstat.dat

[09/05/2008 06:56 AM | 00,000,006 | -H-- | M] () - C:\WINDOWS\tasks\SA.DAT

[09/05/2008 06:57 AM | 00,000,588 | ---- | M] () - C:\WINDOWS\tasks\Scheduled scanning task.job

[09/02/2008 05:17 PM | 00,001,285 | ---- | M] () - C:\Documents and Settings\Lucie Paquet\Application Data\QuickZip45.ini

[09/01/2008 06:16 PM | 00,107,520 | ---- | M] () - C:\Documents and Settings\Lucie Paquet\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

[09/02/2008 03:26 PM | 00,000,696 | ---- | M] () - C:\Documents and Settings\All Users.WINDOWS\Bureau\Malwarebytes' Anti-Malware.lnk

[08/08/2008 10:06 AM | 03,723,454 | ---- | M] (IZSoftware ) - C:\Documents and Settings\Lucie Paquet\Bureau\IZArc_Setup.exe

[08/09/2008 11:35 AM | 00,020,480 | ---- | M] () - C:\Documents and Settings\Lucie Paquet\Bureau\licenciement Nounou.doc

[08/11/2008 10:30 AM | 00,273,913 | ---- | M] () - C:\Documents and Settings\Lucie Paquet\Bureau\club haribo.pdf

[09/05/2008 06:56 AM | 00,001,008 | ---- | M] () - C:\Documents and Settings\All Users.WINDOWS\Menu Démarrer\Programmes\Démarrage\Antivirus Firewall.lnk

< End of report >

et le 2e

OTViewIt Extras logfile created on: 05/09/2008 07:21:48 - Run 1

OTViewIt by OldTimer - Version 1.0.1.8 Folder = C:\Documents and Settings\Lucie Paquet\Bureau

Windows XP Home Edition Service Pack 1 (Version = 5.1.2600) - Type = NTWorkstation

Internet Explorer (Version = 6.0.2800.1106)

Locale: 0000040C | Country: France | Language: FRA | Date Format: dd/MM/yyyy

223.48 Mb Total Physical Memory | 104.21 Mb Available Physical Memory | 46.63% Memory free

547.12 Mb Paging File | 321.59 Mb Available in Paging File | 58.78% Paging File free

Paging file location(s): C:\pagefile.sys 336 672;

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files

Drive C: | 14.65 Gb Total Space | 5.09 Gb Free Space | 34.77% Space Free | Partition Type: NTFS

Drive D: | 59.90 Gb Total Space | 16.47 Gb Free Space | 27.49% Space Free | Partition Type: NTFS

E: Drive not present or media not loaded

F: Drive not present or media not loaded

G: Drive not present or media not loaded

H: Drive not present or media not loaded

I: Drive not present or media not loaded

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

Unable to open key or key not present!

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

"C:\Program Files\Securitoo\av_fw\backweb\7431218\Program\fspex.exe" = C:\Program Files\Securitoo\av_fw\backweb\7431218\program\fspex.exe:*:enabled:Antivirus Firewall

[12/02/2007 10:56 AM | 00,032,807 | ---- | M] (Securitoo Portal)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]

"C:\Program Files\Securitoo\av_fw\backweb\7431218\Program\fspex.exe" = C:\Program Files\Securitoo\av_fw\backweb\7431218\program\fspex.exe:*:enabled:Antivirus Firewall

[12/02/2007 10:56 AM | 00,032,807 | ---- | M] (Securitoo Portal)

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]

.bat [@ = batfile] - "%1" %*

.cmd [@ = cmdfile] - "%1" %*

.com [@ = comfile] - "%1" %*

.exe [@ = exefile] - "%1" %*

.pif [@ = piffile] - "%1" %*

.scr [@ = scrfile] - "%1" %*

========== Winsock2 Catalogs ==========

========== HKEY_LOCAL_MACHINE Protocol Defaults ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProtocolDefaults] - Default Protocols

shell - shell protocol not assigned

========== HKEY_CURRENT_USER Protocol Defaults ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProtocolDefaults] - Default Protocols

shell - shell protocol not assigned

========== Protocol Handlers ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\]

ipp: [HKLM - No CLSID value]

msdaipp: [HKLM - No CLSID value]

========== Protocol Filters ==========

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

"{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}" = PDFCreator

"{0003040C-78E1-11D2-B60F-006097C998E7}" = Microsoft Office 2000 SR-1 Small Business

"{0004040C-78E1-11D2-B60F-006097C998E7}" = Microsoft Office 2000 SR-1 Disque 2

"{20C45B32-5AB6-46A4-94EF-58950CAF05E5}" = EPSON Attach To Email

"{2A88F1BF-7041-4E42-84B1-6B4ACB83AC64}" = EPSON Scan Assistant

"{314F6D08-A8B7-11D8-8446-0050BA1D384D}" = EPSON Image Clip Palette

"{350C940c-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP

"{5DA7BC15-18D3-41A0-9F59-838DA3EAEF17}" = EPSON Easy Photo Print

"{67EDD823-135A-4D59-87BD-950616D6E857}" = EPSON Copy Utility 3

"{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}" = PowerDVD

"{7131646D-CD3C-40F4-97B9-CD9E4E6262EF}" = Microsoft .NET Framework 2.0

"{7F14F68C-17FA-4F88-B3FD-7F449C1EBF32}" = EPSON Web-To-Page

"{90AF040C-6000-11D3-8CFE-0150048383C9}" = Microsoft Office PowerPoint Viewer 2003

"{97C82B44-D408-4F14-9252-47FC1636D23E}_is1" = IZArc 3.81

"{AC76BA86-7AD7-1033-7B44-A00000000001}" = Adobe Reader 6.0.1

"{AEC0CEBC-0FC7-4716-8222-1C4A742719B1}" = Digimax Master

"{B90450DF-E781-46FD-B1F1-0C86DA40E443}" = PIF DESIGNER

"{E86BC406-944E-41F6-ADE6-2C136734C96B}" = EPSON File Manager

"{F196AC50-7C95-42E1-9947-BDAB18BF3C8C}" = Microsoft .NET Framework 2.0 Language Pack - FRA

"BackWeb-7431218 Uninstaller" = Securitoo AntiVirus Firewall

"eMule" = eMule

"EPSON Printer and Utilities" = EPSON Logiciel imprimante

"EPSON Scanner" = EPSON Scan

"ESDX3800 Guide d'utilisation" = ESDX3800 Guide d'utilisation

"HijackThis" = HijackThis 2.0.2

"InstallShield_{20C45B32-5AB6-46A4-94EF-58950CAF05E5}" = EPSON Attach To Email

"KB893803v2" = Windows Installer 3.1 (KB893803)

"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware

"Microsoft .NET Framework 2.0" = Microsoft .NET Framework 2.0

"Microsoft .NET Framework 2.0 Language Pack - FRA" = Module de prise en charge linguistique de Microsoft .NET Framework 2.0 - FRA

"Navilog1_is1" = Navilog1 3.6.5

"PDFCreator Toolbar" = PDFCreator Toolbar

"Quick Zip_is1" = Quick Zip 4.60.019

"QuickTime" = QuickTime

"ShockwaveFlash" = Macromedia Flash Player 8

"StmAdsl" = BeWAN ADSL modem

"VIA Audio Driver Setup Program" = VIA Audio Driver Setup Program

"VPbubble" = VPbubble (remove only)

"WinRAR archiver" = Archiveur WinRAR

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

"uTorrent" = µTorrent

========== Last 10 Event Log Errors ==========

[ Application Events ]

Error - 03/09/2008 07:33:50 - Computer Name = LUCIE - User Name = User SID not found - Source = Securitoo AntiVirus

Description = 3 2008-09-03 09:33:49+02:00 lucie LUCIE\Lucie Paquet Securitoo

AntiVirus Scanning of C:\DOCUMENTS AND SETTINGS\LUCIE PAQUET\LOCAL SETTINGS\TEMPORARY

INTERNET FILES\CONTENT.IE5\STK9IZSL\594FFB8EF5B9AA11E4FB35D6EB15D8A3[1].JPG was

aborted due to exceeded scanning time limit. The file may be in use or reading

it was too slow (e.g. network connection was under stress).

Error - 03/09/2008 07:36:08 - Computer Name = LUCIE - User Name = User SID not found - Source = Securitoo AntiVirus

Description = 4 2008-09-03 09:36:06+02:00 lucie LUCIE\Lucie Paquet Securitoo

AntiVirus Scanning of C:\DOCUMENTS AND SETTINGS\LUCIE PAQUET\LOCAL SETTINGS\TEMPORARY

INTERNET FILES\CONTENT.IE5\WLMZG5Y3\OPEL_728X90[1].SWF was aborted due to exceeded

scanning time limit. The file may be in use or reading it was too slow (e.g. network

connection was under stress).

Error - 03/09/2008 07:38:28 - Computer Name = LUCIE - User Name = User SID not found - Source = Securitoo AntiVirus

Description = 5 2008-09-03 09:38:26+02:00 lucie LUCIE\Lucie Paquet Securitoo

AntiVirus Scanning of C:\DOCUMENTS AND SETTINGS\LUCIE PAQUET\LOCAL SETTINGS\TEMPORARY

INTERNET FILES\CONTENT.IE5\WLMZG5Y3\33919.18[1].JPG was aborted due to exceeded

scanning time limit. The file may be in use or reading it was too slow (e.g. network

connection was under stress).

Error - 03/09/2008 11:11:26 - Computer Name = LUCIE - User Name = User SID not found - Source = Securitoo AntiVirus

Description = 6 2008-09-03 13:11:25+02:00 lucie LUCIE\Lucie Paquet Securitoo

AntiVirus Scanning of C:\DOCUMENTS AND SETTINGS\LUCIE PAQUET\LOCAL SETTINGS\TEMPORARY

INTERNET FILES\CONTENT.IE5\P32J5PIJ\CSSCRIPTLIB[1].JS was aborted due to exceeded

scanning time limit. The file may be in use or reading it was too slow (e.g. network

connection was under stress).

Error - 03/09/2008 11:24:55 - Computer Name = LUCIE - User Name = User SID not found - Source = Securitoo AntiVirus

Description = 7 2008-09-03 13:24:54+02:00 lucie LUCIE\Lucie Paquet Securitoo

AntiVirus Scanning of C:\DOCUMENTS AND SETTINGS\LUCIE PAQUET\COOKIES\LUCIE [email protected][2].TXT

was aborted due to exceeded scanning time limit. The file may be in use or reading

it was too slow (e.g. network connection was under stress).

Error - 03/09/2008 14:26:31 - Computer Name = LUCIE - User Name = User SID not found - Source = Securitoo AntiVirus

Description = 8 2008-09-03 16:26:31+02:00 lucie LUCIE\Lucie Paquet Securitoo

AntiVirus Scanning of C:\DOCUMENTS AND SETTINGS\LUCIE PAQUET\COOKIES\LUCIE [email protected][2].TXT

was aborted due to exceeded scanning time limit. The file may be in use or reading

it was too slow (e.g. network connection was under stress).

Error - 04/09/2008 18:21:30 - Computer Name = LUCIE - User Name = User SID not found - Source = Securitoo AntiVirus

Description = 1 2008-09-04 20:21:29+02:00 lucie LUCIE\Lucie Paquet Securitoo

AntiVirus Scanning of C:\WINDOWS\SYSTEM32\SHLWAPI.DLL was aborted due to exceeded

scanning time limit. The file may be in use or reading it was too slow (e.g. network

connection was under stress).

Error - 04/09/2008 18:25:05 - Computer Name = LUCIE - User Name = User SID not found - Source = Securitoo AntiVirus

Description = 2 2008-09-04 20:25:04+02:00 lucie LUCIE\Lucie Paquet Securitoo

AntiVirus Scanning of C:\DOCUMENTS AND SETTINGS\LUCIE PAQUET\COOKIES\LUCIE [email protected][1].TXT

was aborted due to exceeded scanning time limit. The file may be in use or reading

it was too slow (e.g. network connection was under stress).

Error - 04/09/2008 18:32:13 - Computer Name = LUCIE - User Name = User SID not found - Source = Securitoo AntiVirus

Description = 3 2008-09-04 20:32:12+02:00 lucie LUCIE\Lucie Paquet Securitoo

AntiVirus Scanning of C:\DOCUMENTS AND SETTINGS\LUCIE PAQUET\LOCAL SETTINGS\TEMPORARY

INTERNET FILES\CONTENT.IE5\KVSZUFSF\PA_MODULE[1].PHP was aborted due to exceeded

scanning time limit. The file may be in use or reading it was too slow (e.g. network

connection was under stress).

Error - 05/09/2008 04:58:34 - Computer Name = LUCIE - User Name = User SID not found - Source = Securitoo AntiVirus

Description = 1 2008-09-05 06:58:31+02:00 lucie LUCIE\Lucie Paquet Securitoo

AntiVirus Scanning of C:\WINDOWS\SYSTEM32\RICHED32.DLL was aborted due to exceeded

scanning time limit. The file may be in use or reading it was too slow (e.g. network

connection was under stress).

[ Security Events ]

[ System Events ]

Error - 01/09/2008 16:18:14 - Computer Name = LUCIE - User Name = User SID not found - Source = Service Control Manager