1246 utilisateurs connectés
j'ai un problème de spyware Newdonet
icibonheur
le 20 décembre 2005 à 12h28
je suis plus qu'un débutant en informatique 
pouvez vous m'aider
a me sortir de ce problème.
pouvez vous m'aider a me sortir de ce problème.
répondre
Anges
le 20 décembre 2005 à 12h34
gchris
le 20 décembre 2005 à 19h46
-Télécharge HijackThis: 
(lien sur l'image).
-Crée un dossier nommé HijackThis et place le dedans.
-Exécute le et clique sur Do a scan and save log file.
-Copie et colle ici ton rapport ouvert avec le bloc note. Sans rien faire d'autre.
(lien sur l'image). -Crée un dossier nommé HijackThis et place le dedans.
-Exécute le et clique sur Do a scan and save log file.
-Copie et colle ici ton rapport ouvert avec le bloc note. Sans rien faire d'autre.
icibonheur
le 20 décembre 2005 à 23h46
voici le rapport de hijacktis comme demandéLogfile of HijackThis v1.99.1
Scan saved at 23:43:42, on 12/20/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\Explorer.EXE
C:\WINNT\system32\LEXBCES.EXE
C:\WINNT\system32\LEXPPS.EXE
C:\WINNT\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\WINNT\system32\drivers\CDAC11BA.EXE
C:\Program Files\ewido anti-malware\ewidoctrl.exe
C:\Program Files\ewido anti-malware\ewidoguard.exe
c:\program files\mcafee.com\agent\mcdetect.exe
c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
C:\Program Files\VeriSign\NAVI\naviagent.exe
C:\Program Files\Photodex\ProShow\ScsiAccess.exe
c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe
C:\WINNT\System32\svchost.exe
c:\progra~1\mcafee.com\vso\mcvsescn.exe
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe
C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe
C:\Program Files\QuickTime\qttask.exe
C:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\Program Files\Lexmark X1100 Series\lxbkbmon.exe
C:\PROGRA~1\GOTOSO~1\VADERE~1\Vaderetro_oe.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\WINNT\system32\RunDll32.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\WINNT\system32\DrvMon.exe
C:\Program Files\Shareaza\Shareaza.exe
C:\Program Files\Skype\Phone\Skype.exe
c:\progra~1\mcafee.com\vso\mcvsftsn.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Administrateur\Bureau\anti tout\HijackThis.exe
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: i-Nav IDN SearchHook - {CE000994-A58C-4441-8938-744CD72AB27F} - C:\Program Files\VeriSign\i-Nav\i-nav_4_2_1.dll
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_5_7_0.dll (file missing)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: i-Nav IDN Resolver - {CE000992-A58C-4441-8938-744CD72AB27F} - C:\Program Files\VeriSign\i-Nav\i-nav_4_2_1.dll
O3 - Toolbar: Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_5_7_0.dll (file missing)
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [Lexmark X1100 Series] "C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [VSOCheckTask] "c:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe" /checktask
O4 - HKLM\..\Run: [VirusScan Online] "c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe"
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [MCUpdateExe] c:\PROGRA~1\mcafee.com\agent\mcupdate.exe
O4 - HKLM\..\Run: [Vade Retro Outlook Express] "C:\PROGRA~1\GOTOSO~1\VADERE~1\Vaderetro_oe.exe"
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [Sin Espias] C:\Program Files\SinEspias\No-Spy.exe /autorun
O4 - HKLM\..\Run: [stnospy] C:\Program Files\SinEspias\no-spy.exe /autorun
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [DrvMon.exe] C:\WINNT\system32\DrvMon.exe
O4 - HKCU\..\Run: [Shareaza] "C:\Program Files\Shareaza\Shareaza.exe" -tray
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINNT\system32\Shdocvw.dll
O9 - Extra button: Aide i-Nav - {CE000992-A58C-4441-8938-744CD72AB27F} - http://idn.verisign-grs.com/plug-in/support/index.jsp (file missing)
O9 - Extra 'Tools' menuitem: Aide i-Nav - {CE000992-A58C-4441-8938-744CD72AB27F} - http://idn.verisign-grs.com/plug-in/support/index.jsp (file missing)
O9 - Extra button: (no name) - {CE000996-A58C-4441-8938-744CD72AB27F} - C:\Program Files\VeriSign\i-Nav\i-nav_4_2_1.dll
O9 - Extra 'Tools' menuitem: Options i-Nav - {CE000996-A58C-4441-8938-744CD72AB27F} - C:\Program Files\VeriSign\i-Nav\i-nav_4_2_1.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: ppctlcab - http://ppupdates.ca.com/downloads/scanner/ppctlcab.cab
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by17fd.bay17.hotmail.msn.com/resources/MsnPUpld.cab
O16 - DPF: {80DD2229-B8E4-4C77-B72F-F22972D723EA} (AvxScanOnline Control) - http://www.coupdepoucepc.com/scan/Msie/bitdefender.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {BD393C14-72AD-4790-A095-76522973D6B8} (CBreakshotControl Class) - http://messenger.zone.msn.com/binary/Bankshot.cab31267.cab
O16 - DPF: {CB50428B-657F-47DF-9B32-671F82AA73F7} (Photodex Presenter AX control) - http://www.photodex.com/pxplay.cab
O16 - DPF: {EF0DBA6F-43CE-4B26-9808-2AB38FA0DB29} (MSN Money Ticker) - http://fdl.msn.com/public/investor/v13/ticker.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab31267.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: WRNotifier - WRLogonNTF.dll (file missing)
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINNT\system32\drivers\CDAC11BA.EXE
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido anti-malware\ewidoguard.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINNT\system32\LEXBCES.EXE
O23 - Service: McAfee WSC Integration (McDetect.exe) - McAfee, Inc - c:\program files\mcafee.com\agent\mcdetect.exe
O23 - Service: McAfee.com McShield (McShield) - Unknown owner - c:\PROGRA~1\mcafee.com\vso\mcshield.exe
O23 - Service: McAfee Task Scheduler (McTskshd.exe) - McAfee, Inc - c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: McAfee.com VirusScan Online Realtime Engine (MCVSRte) - McAfee, Inc - c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
O23 - Service: VeriSign Updater (navi) - VeriSign, Inc. - C:\Program Files\VeriSign\NAVI\naviagent.exe
O23 - Service: ScsiAccess - Unknown owner - C:\Program Files\Photodex\ProShow\ScsiAccess.exe
Scan saved at 23:43:42, on 12/20/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\Explorer.EXE
C:\WINNT\system32\LEXBCES.EXE
C:\WINNT\system32\LEXPPS.EXE
C:\WINNT\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\WINNT\system32\drivers\CDAC11BA.EXE
C:\Program Files\ewido anti-malware\ewidoctrl.exe
C:\Program Files\ewido anti-malware\ewidoguard.exe
c:\program files\mcafee.com\agent\mcdetect.exe
c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
C:\Program Files\VeriSign\NAVI\naviagent.exe
C:\Program Files\Photodex\ProShow\ScsiAccess.exe
c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe
C:\WINNT\System32\svchost.exe
c:\progra~1\mcafee.com\vso\mcvsescn.exe
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe
C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe
C:\Program Files\QuickTime\qttask.exe
C:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\Program Files\Lexmark X1100 Series\lxbkbmon.exe
C:\PROGRA~1\GOTOSO~1\VADERE~1\Vaderetro_oe.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\WINNT\system32\RunDll32.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\WINNT\system32\DrvMon.exe
C:\Program Files\Shareaza\Shareaza.exe
C:\Program Files\Skype\Phone\Skype.exe
c:\progra~1\mcafee.com\vso\mcvsftsn.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Administrateur\Bureau\anti tout\HijackThis.exe
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: i-Nav IDN SearchHook - {CE000994-A58C-4441-8938-744CD72AB27F} - C:\Program Files\VeriSign\i-Nav\i-nav_4_2_1.dll
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_5_7_0.dll (file missing)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: i-Nav IDN Resolver - {CE000992-A58C-4441-8938-744CD72AB27F} - C:\Program Files\VeriSign\i-Nav\i-nav_4_2_1.dll
O3 - Toolbar: Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_5_7_0.dll (file missing)
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [Lexmark X1100 Series] "C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [VSOCheckTask] "c:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe" /checktask
O4 - HKLM\..\Run: [VirusScan Online] "c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe"
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [MCUpdateExe] c:\PROGRA~1\mcafee.com\agent\mcupdate.exe
O4 - HKLM\..\Run: [Vade Retro Outlook Express] "C:\PROGRA~1\GOTOSO~1\VADERE~1\Vaderetro_oe.exe"
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [Sin Espias] C:\Program Files\SinEspias\No-Spy.exe /autorun
O4 - HKLM\..\Run: [stnospy] C:\Program Files\SinEspias\no-spy.exe /autorun
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [DrvMon.exe] C:\WINNT\system32\DrvMon.exe
O4 - HKCU\..\Run: [Shareaza] "C:\Program Files\Shareaza\Shareaza.exe" -tray
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINNT\system32\Shdocvw.dll
O9 - Extra button: Aide i-Nav - {CE000992-A58C-4441-8938-744CD72AB27F} - http://idn.verisign-grs.com/plug-in/support/index.jsp (file missing)
O9 - Extra 'Tools' menuitem: Aide i-Nav - {CE000992-A58C-4441-8938-744CD72AB27F} - http://idn.verisign-grs.com/plug-in/support/index.jsp (file missing)
O9 - Extra button: (no name) - {CE000996-A58C-4441-8938-744CD72AB27F} - C:\Program Files\VeriSign\i-Nav\i-nav_4_2_1.dll
O9 - Extra 'Tools' menuitem: Options i-Nav - {CE000996-A58C-4441-8938-744CD72AB27F} - C:\Program Files\VeriSign\i-Nav\i-nav_4_2_1.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: ppctlcab - http://ppupdates.ca.com/downloads/scanner/ppctlcab.cab
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by17fd.bay17.hotmail.msn.com/resources/MsnPUpld.cab
O16 - DPF: {80DD2229-B8E4-4C77-B72F-F22972D723EA} (AvxScanOnline Control) - http://www.coupdepoucepc.com/scan/Msie/bitdefender.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {BD393C14-72AD-4790-A095-76522973D6B8} (CBreakshotControl Class) - http://messenger.zone.msn.com/binary/Bankshot.cab31267.cab
O16 - DPF: {CB50428B-657F-47DF-9B32-671F82AA73F7} (Photodex Presenter AX control) - http://www.photodex.com/pxplay.cab
O16 - DPF: {EF0DBA6F-43CE-4B26-9808-2AB38FA0DB29} (MSN Money Ticker) - http://fdl.msn.com/public/investor/v13/ticker.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab31267.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: WRNotifier - WRLogonNTF.dll (file missing)
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINNT\system32\drivers\CDAC11BA.EXE
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido anti-malware\ewidoguard.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINNT\system32\LEXBCES.EXE
O23 - Service: McAfee WSC Integration (McDetect.exe) - McAfee, Inc - c:\program files\mcafee.com\agent\mcdetect.exe
O23 - Service: McAfee.com McShield (McShield) - Unknown owner - c:\PROGRA~1\mcafee.com\vso\mcshield.exe
O23 - Service: McAfee Task Scheduler (McTskshd.exe) - McAfee, Inc - c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: McAfee.com VirusScan Online Realtime Engine (MCVSRte) - McAfee, Inc - c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
O23 - Service: VeriSign Updater (navi) - VeriSign, Inc. - C:\Program Files\VeriSign\NAVI\naviagent.exe
O23 - Service: ScsiAccess - Unknown owner - C:\Program Files\Photodex\ProShow\ScsiAccess.exe
icibonheur
le 20 décembre 2005 à 23h48
je ne sais t'envoyer que le bloc note, pas possible de copier coller le rapport
gchris
le 21 décembre 2005 à 19h28
qu'est-ce qui te détecte NewDotNet ? -> colle le rapport.
icibonheur
le 21 décembre 2005 à 21h11
c'est spybot qui détecte Newdonet
icibonheur
icibonheur
gchris
le 21 décembre 2005 à 21h15
colle le rapport.
icibonheur
le 21 décembre 2005 à 21h15
voila le rapport ca fait beaucoup
--- Search result list ---
NewDotNet: Réglages utilisateur (Clé du registre, nothing done)
HKEY_USERS\.DEFAULT\Software\new.net
NewDotNet: Réglages utilisateur (Clé du registre, nothing done)
HKEY_USERS\S-1-5-18\Software\new.net
DoubleClick: Cookie traceur (Firefox: Utilisateur par défaut) (Cookie, nothing done)
--- Spybot - Search & Destroy version: 1.3 .1TX (build: 20040801) ---
2004-05-12 blindman.exe (1.0.0.0)
2004-08-30 SpybotSD.exe (1.3.0.12)
2004-05-12 TeaTimer.exe (1.3.0.12)
2004-06-15 unins000.exe (51.15.0.0)
2004-05-12 Update.exe (1.3.0.0)
2004-10-04 advcheck.dll (1.0.1.0)
2004-05-12 borlndmm.dll (7.0.4.453)
2004-05-12 delphimm.dll (7.0.4.453)
2004-05-12 SDHelper.dll (1.3.0.12)
2004-05-12 Tools.dll (2.0.0.0)
2004-05-12 UnzDll.dll (1.73.1.1)
2004-05-12 ZipDll.dll (1.73.2.0)
2005-12-02 Includes\Cookies.sbi
2005-12-02 Includes\Dialer.sbi
2005-12-02 Includes\Hijackers.sbi
2005-12-02 Includes\Keyloggers.sbi
2004-11-29 Includes\LSP.sbi
2005-12-02 Includes\Malware.sbi
2005-12-02 Includes\PUPS.sbi
2005-12-02 Includes\Revision.sbi
2005-12-02 Includes\Security.sbi
2005-12-02 Includes\Spybots.sbi
2005-02-17 Includes\Tracks.uti
2005-12-02 Includes\Trojans.sbi
--- System information ---
Windows XP (Build: 2600) Service Pack 2
/ DataAccess: Microsoft Data Access Components KB870669
/ DataAccess: Security Update for Microsoft Data Access Components
/ Internet Explorer 6 / SP0: Correctif Windows XP - Article Base de Connaissances 834707
/ Internet Explorer 6 / SP1: Correctif Windows 2000 - Article Base de Connaissances 834707
/ Windows Media Player: Correctif pour le Lecteur Windows Media [Voir Q828026 pour plus d'informations]
/ Windows Media Player / SP0: Correctif pour le Lecteur Windows Media [Voir Q828026 pour plus d'informations]
/ Windows XP / SP2: Windows XP Service Pack 2
/ Windows XP / SP2: Correctif Windows XP - KB824151
/ Windows XP / SP2: Correctif Windows XP - KB840987
/ Windows XP / SP2: Correctif Windows XP - KB841356
/ Windows XP / SP2: Correctif Windows XP - KB842773
/ Windows XP / SP3: Correctif Windows XP - KB834707
/ Windows XP / SP3: Correctif Windows XP - KB867282
/ Windows XP / SP3: Correctif Windows XP - KB873333
/ Windows XP / SP3: Correctif Windows XP - KB873339
/ Windows XP / SP3: Mise à jour de sécurité pour Windows XP (KB883939)
/ Windows XP / SP3: Correctif Windows XP - KB885250
/ Windows XP / SP3: Correctif Windows XP - KB885835
/ Windows XP / SP3: Correctif Windows XP - KB885836
/ Windows XP / SP3: Correctif Windows XP - KB886185
/ Windows XP / SP3: Correctif Windows XP - KB887472
/ Windows XP / SP3: Correctif Windows XP - KB887742
/ Windows XP / SP3: Correctif Windows XP - KB888113
/ Windows XP / SP3: Correctif Windows XP - KB888302
/ Windows XP / SP3: Mise à jour de sécurité pour Windows XP (KB890046)
/ Windows XP / SP3: Correctif Windows XP - KB890047
/ Windows XP / SP3: Correctif Windows XP - KB890175
/ Windows XP / SP3: Correctif Windows XP - KB890859
/ Windows XP / SP3: Correctif Windows XP - KB890923
/ Windows XP / SP3: Correctif Windows XP - KB891781
/ Windows XP / SP3: Mise à jour de sécurité pour Windows XP (KB893066)
/ Windows XP / SP3: Correctif Windows XP - KB893086
/ Windows XP / SP3: Mise à jour de sécurité pour Windows XP (KB893756)
/ Windows XP / SP3: Windows Installer 3.1 (KB893803)
/ Windows XP / SP3: Windows Installer 3.1 (KB893803)
/ Windows XP / SP3: Mise à jour pour Windows XP (KB894391)
/ Windows XP / SP3: Mise à jour de sécurité pour Windows XP (KB896358)
/ Windows XP / SP3: Mise à jour de sécurité pour Windows XP (KB896422)
/ Windows XP / SP3: Mise à jour de sécurité pour Windows XP (KB896423)
/ Windows XP / SP3: Mise à jour de sécurité pour Windows XP (KB896424)
/ Windows XP / SP3: Mise à jour de sécurité pour Windows XP (KB896428)
/ Windows XP / SP3: Mise à jour de sécurité pour Windows XP (KB896688)
/ Windows XP / SP3: Mise à jour pour Windows XP (KB896727)
/ Windows XP / SP3: Mise à jour pour Windows XP (KB898461)
/ Windows XP / SP3: Mise à jour de sécurité pour Windows XP (KB899587)
/ Windows XP / SP3: Mise à jour de sécurité pour Windows XP (KB899588)
/ Windows XP / SP3: Mise à jour de sécurité pour Windows XP (KB899589)
/ Windows XP / SP3: Mise à jour de sécurité pour Windows XP (KB899591)
/ Windows XP / SP3: Mise à jour de sécurité pour Windows XP (KB900725)
/ Windows XP / SP3: Mise à jour de sécurité pour Windows XP (KB901017)
/ Windows XP / SP3: Mise à jour de sécurité pour Windows XP (KB901214)
/ Windows XP / SP3: Mise à jour de sécurité pour Windows XP (KB902400)
/ Windows XP / SP3: Mise à jour de sécurité pour Windows XP (KB903235)
/ Windows XP / SP3: Mise à jour de sécurité pour Windows XP (KB904706)
/ Windows XP / SP3: Mise à jour de sécurité pour Windows XP (KB905414)
/ Windows XP / SP3: Mise à jour de sécurité pour Windows XP (KB905749)
/ Windows XP / SP3: Mise à jour de sécurité pour Windows XP (KB905915)
/ Windows XP / SP3: Mise à jour pour Windows XP (KB910437)
--- Startup entries list ---
Located: HK_LM:Run, Cmaudio
command: RunDll32 cmicnfg.cpl,CMICtrlWnd
file: C:\WINNT\system32\RunDll32.exe
size: 33792
MD5: cdd7140c0eaa754c527b983ccc9993cd
Located: HK_LM:Run, iTunesHelper
command: C:\Program Files\iTunes\iTunesHelper.exe
file: C:\Program Files\iTunes\iTunesHelper.exe
size: 278528
MD5: 2e0e2be7bd6614ea4c86b9ece793e31e
Located: HK_LM:Run, Lexmark X1100 Series
command: "C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe"
file: C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe
size: 57344
MD5: 622ed3a888a7c1fcade04f4d095fca76
Located: HK_LM:Run, MCAgentExe
command: c:\PROGRA~1\mcafee.com\agent\mcagent.exe
file: c:\PROGRA~1\mcafee.com\agent\mcagent.exe
size: 303104
MD5: e8d2dcece015f4558aa3853514664f15
Located: HK_LM:Run, MCUpdateExe
command: c:\PROGRA~1\mcafee.com\agent\mcupdate.exe
file: c:\PROGRA~1\mcafee.com\agent\mcupdate.exe
size: 212992
MD5: 612ecc8413abf6c2f8d57b8485535025
Located: HK_LM:Run, QuickTime Task
command: "C:\Program Files\QuickTime\qttask.exe" -atboottime
file: C:\Program Files\QuickTime\qttask.exe
size: 98304
MD5: 76a3a30b58405c2c6d833895253a51a9
Located: HK_LM:Run, RealTray
command: C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
Located: HK_LM:Run, Sin Espias
command: C:\Program Files\SinEspias\No-Spy.exe /autorun
Located: HK_LM:Run, SpeedTouch USB Diagnostics
command: "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon
file: C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe
size: 877568
MD5: 671169202bcbd231a0d24e0d0dd29156
Located: HK_LM:Run, stnospy
command: C:\Program Files\SinEspias\no-spy.exe /autorun
Located: HK_LM:Run, Vade Retro Outlook Express
command: "C:\PROGRA~1\GOTOSO~1\VADERE~1\Vaderetro_oe.exe"
file: C:\PROGRA~1\GOTOSO~1\VADERE~1\Vaderetro_oe.exe
size: 310272
MD5: 7c4ccfc4e05ce507b7b50d1750c726ba
Located: HK_LM:Run, VirusScan Online
command: "c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe"
file: c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe
size: 196608
MD5: 944982c9b57c8bcc58f4001a62cd503f
Located: HK_LM:Run, VSOCheckTask
command: "c:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe" /checktask
file: c:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe
size: 143360
MD5: d527afe3bed159802f84fee4118b995a
Located: HK_LM:Run, WinampAgent
command: C:\Program Files\Winamp\winampa.exe
file: C:\Program Files\Winamp\winampa.exe
size: 33792
MD5: 6ba852b42abb9a7c221513fb7b63ab11
Located: HK_CU:Run, DrvMon.exe
command: C:\WINNT\system32\DrvMon.exe
file: C:\WINNT\system32\DrvMon.exe
size: 53248
MD5: 42692f2fe399c4cde8c3020013edabe0
Located: HK_CU:Run, msnmsgr
command: "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
file: C:\Program Files\MSN Messenger\msnmsgr.exe
size: 7094272
MD5: bcd239cb30b5356a019fd81e45d6636b
Located: HK_CU:Run, Shareaza
command: "C:\Program Files\Shareaza\Shareaza.exe" -tray
file: C:\Program Files\Shareaza\Shareaza.exe
size: 3887104
MD5: 4e9fdb788d7f948a9f3744fdea7ea0d7
Located: HK_CU:Run, Skype
command: "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
file: C:\Program Files\Skype\Phone\Skype.exe
size: 14892072
MD5: dda9e7a1b3ddf8714a971243c8643594
Located: System.ini, crypt32chain
command: crypt32.dll
Located: System.ini, cryptnet
command: cryptnet.dll
Located: System.ini, cscdll
command: cscdll.dll
Located: System.ini, ScCertProp
command: wlnotify.dll
Located: System.ini, Schedule
command: wlnotify.dll
Located: System.ini, sclgntfy
command: sclgntfy.dll
Located: System.ini, SensLogn
command: WlNotify.dll
Located: System.ini, termsrv
command: wlnotify.dll
Located: System.ini, wlballoon
command: wlnotify.dll
Located: System.ini, WRNotifier
command: WRLogonNTF.dll
Located: System.ini, wzcnotif
command: wzcdlg.dll
--- Browser helper object list ---
{02478D38-C3F9-4efb-9B51-7695ECA05670} (Yahoo! Companion BHO)
BHO name:
CLSID name: Yahoo! Companion BHO
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} (AcroIEHlprObj Class)
BHO name:
CLSID name: AcroIEHlprObj Class
description: Adobe Acrobat reader
classification: Legitimate
known filename: AcroIEhelper.ocx<br>AcroIEhelper.dll
info link: http://www.adobe.com/products/acrobat/readstep2.html
info source: TonyKlein
Path: C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\
Long name: AcroIEHelper.ocx
Short name: ACROIE~1.OCX
Date (created): 06/09/2005 14:57:58
Date (last access): 12/21/2005 20:58:24
Date (last write): 04/16/2001 14:39:02
Filesize: 37808
Attributes:
MD5: 8394ABFC1BE196A62C9F532511936DF7
CRC32: 71D6E350
Version: 0.1.0.0
{CE000992-A58C-4441-8938-744CD72AB27F} (i-Nav IDN Resolver)
BHO name: i-Nav IDN Resolver
CLSID name: i-Nav IDN Resolver
description: Verisign i-Nav,
classification: Legitimate
known filename: i-nav_4_0_0.dll
info link: http://www.idnnow.com/index.jsp?lang=en
info source: TonyKlein
Path: C:\Program Files\VeriSign\i-Nav\
Long name: i-nav_4_2_1.dll
Short name: I-NAV_~2.DLL
Date (created): 05/11/2005 17:22:04
Date (last access): 12/21/2005 20:58:24
Date (last write): 05/02/2005 14:39:10
Filesize: 446464
Attributes: archive
MD5: B4AB85CB4C705522C6040AF8D045A710
CRC32: 15D0F93B
Version: 0.4.0.2
--- ActiveX list ---
DirectAnimation Java Classes (DirectAnimation Java Classes)
DPF name: DirectAnimation Java Classes
CLSID name:
description:
classification: Legitimate
known filename: %WINDIR%\Java\classes\dajava.cab
info link:
info source: Patrick M. Kolla
Microsoft XML Parser for Java (Microsoft XML Parser for Java)
DPF name: Microsoft XML Parser for Java
CLSID name:
description:
classification: Legitimate
known filename: %WINDIR%\Java\classes\xmldso.cab
info link:
info source: Patrick M. Kolla
ppctlcab (ppctlcab)
DPF name: ppctlcab
CLSID name:
{00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class)
DPF name:
CLSID name: Checkers Class
Path: C:\WINNT\Downloaded Program Files\
Long name: msgrchkr.dll
Short name:
Date (created): 05/29/2003 15:00:18
Date (last access): 12/21/2005 20:51:44
Date (last write): 05/29/2003 15:00:18
Filesize: 77408
Attributes: archive
MD5: 42D567DF86B9B7AC4A89664C9651B68B
CRC32: 47FF3D19
Version: 0.7.0.1
{14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class)
DPF name:
CLSID name: MessengerStatsClient Class
Path: C:\WINNT\Downloaded Program Files\
Long name: MessengerStatsPAClient.dll
Short name: MESSEN~2.DLL
Date (created): 04/06/2004 19:03:54
Date (last access): 12/21/2005 20:51:44
Date (last write): 04/06/2004 19:03:54
Filesize: 172072
Attributes: archive
MD5: 94D1773AEAA2197AFEE3A6F8404FE4E9
CRC32: 76C3823D
Version: 0.9.0.2
{166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control)
DPF name:
CLSID name: Shockwave ActiveX Control
description: Macromedia ShockWave Flash Player 7
classification: Unknown
known filename: SWDIR.DLL
info link:
info source: Patrick M. Kolla
Path: C:\WINNT\system32\macromed\Shockwave 10\
Long name: Download.dll
Short name:
Date (created): 07/19/2005 14:39:20
Date (last access): 12/21/2005 10:45:04
Date (last write): 07/19/2005 14:39:20
Filesize: 79552
Attributes: archive
MD5: 6092AEDB6921703A78FBD4E01C126439
CRC32: 978BDE38
Version: 0.10.0.1
{2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class)
DPF name:
CLSID name: Minesweeper Flags Class
Path: C:\WINNT\Downloaded Program Files\
Long name: minesweeper.dll
Short name: MINESW~1.DLL
Date (created): 05/29/2003 15:00:22
Date (last access): 12/21/2005 20:51:44
Date (last write): 05/29/2003 15:00:22
Filesize: 84064
Attributes: archive
MD5: F951FD0EA383DF2D49CA0359E4A86968
CRC32: 50A69718
Version: 0.7.0.1
{33564D57-0000-0010-8000-00AA00389B71} ()
DPF name:
CLSID name:
{33564D57-9980-0010-8000-00AA00389B71} ()
DPF name:
CLSID name:
description: Microsoft WMV Video Codec
classification: Legitimate
known filename: WMV9DMO.CAB
info link:
info source: Patrick M. Kolla
{4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool)
DPF name:
CLSID name: MSN Photo Upload Tool
Path: C:\WINNT\Downloaded Program Files\
Long name: MsnPUpld.dll
Short name:
Date (created): 10/08/2004 16:01:22
Date (last access): 12/21/2005 20:51:44
Date (last write): 10/08/2004 16:01:22
Filesize: 372736
Attributes: archive
MD5: D2ED523BB0FE94F8F492BEFE1C336040
CRC32: C4677625
Version: 0.10.0.0
{80DD2229-B8E4-4C77-B72F-F22972D723EA} (AvxScanOnline Control)
DPF name:
CLSID name: AvxScanOnline Control
description: BitDefender online virus scanner
classification: Legitimate
known filename: bitdefender.ocx
info link:
info source: Patrick M. Kolla
{8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.5.0)
DPF name: Java Runtime Environment 1.5.0
CLSID name: Java Plug-in 1.5.0_02
description: Sun Java
classification: Legitimate
known filename: %PROGRAM FILES%\JabaSoft\JRE\*\Bin\npjava131.dll
info link:
info source: Patrick M. Kolla
Path: C:\Program Files\Java\jre1.5.0_02\bin\
Long name: NPJPI150_02.dll
Short name: NPJPI1~1.DLL
Date (created): 03/04/2005 02:36:50
Date (last access): 12/14/2005 16:32:14
Date (last write): 03/04/2005 02:54:18
Filesize: 69746
Attributes: archive
MD5: 6C9A4C573C0C771D99D902EE06DA3CBB
CRC32: 55F989EE
Version: 0.5.0.0
{8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class)
DPF name:
CLSID name: MessengerStatsClient Class
Path: C:\WINNT\Downloaded Program Files\
Long name: messengerstatsclient.dll
Short name: MESSEN~1.DLL
Date (created): 05/29/2003 15:00:20
Date (last access): 12/21/2005 20:51:44
Date (last write): 05/29/2003 15:00:20
Filesize: 160864
Attributes: archive
MD5: B069B555A00AA026F657AA4FD13AE154
CRC32: 89BB01E1
Version: 0.7.0.1
{9F1C11AA-197B-4942-BA54-47A8489BB47F} ()
DPF name:
CLSID name:
description: Windows Update
classification: Legitimate
known filename: %WINDIR%\System32\iuctl.dll,iuengine.dll
info link:
info source: Patrick M. Kolla
{BD393C14-72AD-4790-A095-76522973D6B8} (CBreakshotControl Class)
DPF name:
CLSID name: CBreakshotControl Class
Path: C:\WINNT\Downloaded Program Files\
Long name: Banksht2.dll
Short name:
Date (created): 05/11/2004 11:55:38
Date (last access): 12/21/2005 20:51:44
Date (last write): 05/11/2004 11:55:38
Filesize: 1277992
Attributes: archive
MD5: 5409FBE248ACC1E2A8FE5C03442BEF74
CRC32: FC1429F1
Version: 0.1.0.0
{CAFEEFAC-0015-0000-0002-ABCDEFFEDCBA} (Java Runtime Environment 1.5.0)
DPF name: Java Runtime Environment 1.5.0
CLSID name: Java Plug-in 1.5.0_02
Path: C:\Program Files\Java\jre1.5.0_02\bin\
Long name: NPJPI150_02.dll
Short name: NPJPI1~1.DLL
Date (created): 03/04/2005 02:36:50
Date (last access): 12/21/2005 21:12:48
Date (last write): 03/04/2005 02:54:18
Filesize: 69746
Attributes: archive
MD5: 6C9A4C573C0C771D99D902EE06DA3CBB
CRC32: 55F989EE
Version: 0.5.0.0
{CB50428B-657F-47DF-9B32-671F82AA73F7} (Photodex Presenter AX control)
DPF name:
CLSID name: Photodex Presenter AX control
Path: C:\PROGRA~1\PHOTOD~1\
Long name: pxplay.ocx
Short name:
Date (created): 09/05/2005 15:06:16
Date (last access): 12/14/2005 16:32:14
Date (last write): 09/05/2005 15:06:02
Filesize: 291920
Attributes: archive
MD5: CD74955A5B800ACC3BEE32607F679841
CRC32: 10771AC8
Version: 0.2.0.50
{D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object)
DPF name:
CLSID name: Shockwave Flash Object
description: Macromedia Shockwave Flash Player
classification: Legitimate
known filename:
info link:
info source: Patrick M. Kolla
Path: C:\WINNT\system32\Macromed\Flash\
Long name: Flash8.ocx
Short name:
Date (created): 08/27/2005 12:38:56
Date (last access): 12/21/2005 18:19:10
Date (last write): 08/27/2005 12:38:56
Filesize: 1435272
Attributes: archive
MD5: 900373C059C2B51CA91BF110DBDECB33
CRC32: F19599BC
Version: 0.8.0.0
{EF0DBA6F-43CE-4B26-9808-2AB38FA0DB29} (MSN Money Ticker)
DPF name:
CLSID name: MSN Money Ticker
Path: C:\WINNT\Downloaded Program Files\
Long name: ticker13.ocx
Short name:
Date (created): 06/11/2003 08:27:56
Date (last access): 12/21/2005 19:47:20
Date (last write): 06/11/2003 08:27:56
Filesize: 430080
Attributes: archive
MD5: 3D9371E944259D20E828A08ACBE9EF62
CRC32: 669A676E
Version: 0.13.7.211
{F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class)
DPF name:
CLSID name: Solitaire Showdown Class
Path: C:\WINNT\Downloaded Program Files\
Long name: solitaireshowdown.dll
Short name: SOLITA~1.DLL
Date (created): 05/29/2003 15:00:20
Date (last access): 12/21/2005 20:51:44
Date (last write): 05/29/2003 15:00:20
Filesize: 86112
Attributes: archive
MD5: 6E0E81210B17C225AD8DBB86F0C41E32
CRC32: 1C944476
Version: 0.7.0.1
--- Process list ---
PID: 0 ( 0) [System]
PID: 4 ( 0) System
PID: 152 ( 512) C:\Program Files\ewido anti-malware\ewidoctrl.exe
PID: 184 ( 512) C:\Program Files\ewido anti-malware\ewidoguard.exe
PID: 328 ( 512) c:\program files\mcafee.com\agent\mcdetect.exe
PID: 340 ( 4) \SystemRoot\System32\smss.exe
PID: 356 ( 668) c:\progra~1\mcafee.com\vso\mcvsftsn.exe
PID: 380 ( 512) c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
PID: 444 ( 340) csrss.exe
PID: 468 ( 340) \??\C:\WINNT\system32\winlogon.exe
PID: 512 ( 468) C:\WINNT\system32\services.exe
PID: 524 ( 468) C:\WINNT\system32\lsass.exe
PID: 668 ( 512) C:\WINNT\system32\svchost.exe
PID: 720 ( 668) C:\Program Files\Messenger\msmsgs.exe
PID: 736 ( 512) svchost.exe
PID: 812 ( 512) c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
PID: 824 ( 512) C:\WINNT\System32\svchost.exe
PID: 856 ( 512) C:\Program Files\VeriSign\NAVI\naviagent.exe
PID: 872 ( 512) svchost.exe
PID: 900 ( 512) svchost.exe
PID: 960 ( 512) C:\Program Files\Photodex\ProShow\ScsiAccess.exe
PID: 1216 ( 512) C:\WINNT\system32\LEXBCES.EXE
PID: 1312 ( 512) C:\WINNT\system32\spoolsv.exe
PID: 1316 (1216) C:\WINNT\system32\LEXPPS.EXE
PID: 1332 (1284) C:\WINNT\Explorer.EXE
PID: 1360 ( 512) C:\WINNT\System32\svchost.exe
PID: 1560 (1332) C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe
PID: 1568 (1332) C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe
PID: 1576 (1332) C:\Program Files\QuickTime\qttask.exe
PID: 1592 (1332) C:\PROGRA~1\mcafee.com\vso\mcvsshld.exe
PID: 1612 (1568) C:\Program Files\Lexmark X1100 Series\lxbkbmon.exe
PID: 1616 (1332) C:\PROGRA~1\mcafee.com\agent\mcagent.exe
PID: 1640 (1332) C:\PROGRA~1\GOTOSO~1\VADERE~1\Vaderetro_oe.exe
PID: 1652 (1332) C:\Program Files\iTunes\iTunesHelper.exe
PID: 1660 (1592) c:\progra~1\mcafee.com\vso\mcvsescn.exe
PID: 1668 (1332) C:\Program Files\Real\RealPlayer\RealPlay.exe
PID: 1676 (1332) C:\WINNT\system32\RunDll32.exe
PID: 1684 (1332) C:\Program Files\Winamp\winampa.exe
PID: 1712 (1332) C:\Program Files\MSN Messenger\msnmsgr.exe
PID: 1720 (1332) C:\WINNT\system32\DrvMon.exe
PID: 1796 (1332) C:\Program Files\Shareaza\Shareaza.exe
PID: 1840 (1332) C:\Program Files\Skype\Phone\Skype.exe
PID: 1896 ( 512) C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
PID: 1936 ( 668) NAVICL~1.EXE
PID: 1980 ( 512) C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
PID: 2024 ( 512) C:\WINNT\system32\drivers\CDAC11BA.EXE
PID: 2784 ( 512) C:\Program Files\iPod\bin\iPodService.exe
PID: 2876 ( 512) c:\PROGRA~1\mcafee.com\vso\mcshield.exe
PID: 3332 ( 512) alg.exe
PID: 4000 (1332) C:\Program Files\Mozilla Firefox\firefox.exe
PID: 4036 (1332) C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe
Spybot - Search && Destroy process list report, 12/21/2005 21:12:48
--- Browser start & search pages list ---
Spybot - Search && Destroy browser pages report, 12/21/2005 21:12:48
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Search Page
http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Search Bar
http://home.microsoft.com/search/lobby/search.asp
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Start Page
http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Search\SearchAssistant
http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Search\CustomizeSearch
http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchUrl\@
http://home.microsoft.com/access/autosearch.asp?p=%s
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Search Page
http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Search Bar
http://home.microsoft.com/search/lobby/search.asp
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Start Page
http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Default_Page_URL
http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Default_Search_URL
http://home.microsoft.com/search/search.asp
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Search\SearchAssistant
http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Search\CustomizeSearch
http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchUrl\@
http://home.microsoft.com/access/autosearch.asp?p=%s
--- Winsock Layered Service Provider list ---
Protocol 0: MSAFD Irda [IrDA]
GUID: {3972523D-2AF1-11D1-B655-00805F3642CC}
Filename: %SystemRoot%\system32\mswsock.dll
Description: Infrared protocol
DB filename: %SystemRoot%\system32\mswsock.dll
DB protocol: MSAFD Irda [IrDA]
Protocol 1: MSAFD Tcpip [TCP/IP]
GUID: {E70F1AA0-AB8B-11CF-8CA3-00805F48A192}
Filename: %SystemRoot%\system32\mswsock.dll
Description: Microsoft Windows NT/2k/XP IP protocol
DB filename: %SystemRoot%\system32\mswsock.dll
DB protocol: MSAFD Tcpip
Protocol 2: MSAFD Tcpip [UDP/IP]
GUID: {E70F1AA0-AB8B-11CF-8CA3-00805F48A192}
Filename: %SystemRoot%\system32\mswsock.dll
Description: Microsoft Windows NT/2k/XP IP protocol
DB filename: %SystemRoot%\system32\mswsock.dll
DB protocol: MSAFD Tcpip
Protocol 3: MSAFD Tcpip [RAW/IP]
GUID: {E70F1AA0-AB8B-11CF-8CA3-00805F48A192}
Filename: %SystemRoot%\system32\mswsock.dll
Description: Microsoft Windows NT/2k/XP IP protocol
DB filename: %SystemRoot%\system32\mswsock.dll
DB protocol: MSAFD Tcpip
Protocol 4: RSVP UDP Service Provider
GUID: {9D60A9E0-337A-11D0-BD88-0000C082E69A}
Filename: %SystemRoot%\system32\rsvpsp.dll
Description: Microsoft Windows NT/2k/XP RVSP
DB filename: %SystemRoot%\system32\rsvpsp.dll
DB protocol: RSVP * Service Provider
Protocol 5: RSVP TCP Service Provider
GUID: {9D60A9E0-337A-11D0-BD88-0000C082E69A}
Filename: %SystemRoot%\system32\rsvpsp.dll
Description: Microsoft Windows NT/2k/XP RVSP
DB filename: %SystemRoot%\system32\rsvpsp.dll
DB protocol: RSVP * Service Provider
Protocol 6: MSAFD Irda [IrDA]
GUID: {3972523D-2AF1-11D1-B655-00805F3642CC}
Filename: %SystemRoot%\system32\mswsock.dll
Description: Infrared protocol
DB filename: %SystemRoot%\system32\mswsock.dll
DB protocol: MSAFD Irda [IrDA]
Protocol 7: MSAFD Tcpip [TCP/IP]
GUID: {E70F1AA0-AB8B-11CF-8CA3-00805F48A192}
Filename: %SystemRoot%\system32\mswsock.dll
Description: Microsoft Windows NT/2k/XP IP protocol
DB filename: %SystemRoot%\system32\mswsock.dll
DB protocol: MSAFD Tcpip
Protocol 8: MSAFD Tcpip [UDP/IP]
GUID: {E70F1AA0-AB8B-11CF-8CA3-00805F48A192}
Filename: %SystemRoot%\system32\mswsock.dll
Description: Microsoft Windows NT/2k/XP IP protocol
DB filename: %SystemRoot%\system32\mswsock.dll
DB protocol: MSAFD Tcpip
Protocol 9: MSAFD Tcpip [RAW/IP]
GUID: {E70F1AA0-AB8B-11CF-8CA3-00805F48A192}
Filename: %SystemRoot%\system32\mswsock.dll
Description: Microsoft Windows NT/2k/XP IP protocol
DB filename: %SystemRoot%\system32\mswsock.dll
DB protocol: MSAFD Tcpip
Protocol 10: RSVP UDP Service Provider
GUID: {9D60A9E0-337A-11D0-BD88-0000C082E69A}
Filename: %SystemRoot%\system32\rsvpsp.dll
Description: Microsoft Windows NT/2k/XP RVSP
DB filename: %SystemRoot%\system32\rsvpsp.dll
DB protocol: RSVP * Service Provider
Protocol 11: RSVP TCP Service Provider
GUID: {9D60A9E0-337A-11D0-BD88-0000C082E69A}
Filename: %SystemRoot%\system32\rsvpsp.dll
Description: Microsoft Windows NT/2k/XP RVSP
DB filename: %SystemRoot%\system32\rsvpsp.dll
DB protocol: RSVP * Service Provider
Protocol 12: MSAFD NetBIOS [\Device\NetBT_Tcpip_{CF05C84C-23D4-4734-9EEF-5D13BFE38DBF}] SEQPACKET 0
GUID: {8D5F1830-C273-11CF-95C8-00805F48A192}
Filename: %SystemRoot%\system32\mswsock.dll
Description: Microsoft Windows NT/2k/XP NetBios protocol
DB filename: %SystemRoot%\system32\mswsock.dll
DB protocol: MSAFD NetBIOS *
Protocol 13: MSAFD NetBIOS [\Device\NetBT_Tcpip_{CF05C84C-23D4-4734-9EEF-5D13BFE38DBF}] DATAGRAM 0
GUID: {8D5F1830-C273-11CF-95C8-00805F48A192}
Filename: %SystemRoot%\system32\mswsock.dll
Description: Microsoft Windows NT/2k/XP NetBios protocol
DB filename: %SystemRoot%\system32\mswsock.dll
DB protocol: MSAFD NetBIOS *
Protocol 14: MSAFD NetBIOS [\Device\NetBT_Tcpip_{BA8C3F65-97E3-47AF-8FA0-82F45D0AEB60}] SEQPACKET 3
GUID: {8D5F1830-C273-11CF-95C8-00805F48A192}
Filename: %SystemRoot%\system32\mswsock.dll
Description: Microsoft Windows NT/2k/XP NetBios protocol
DB filename: %SystemRoot%\system32\mswsock.dll
DB protocol: MSAFD NetBIOS *
Protocol 15: MSAFD NetBIOS [\Device\NetBT_Tcpip_{BA8C3F65-97E3-47AF-8FA0-82F45D0AEB60}] DATAGRAM 3
GUID: {8D5F1830-C273-11CF-95C8-00805F48A192}
Filename: %SystemRoot%\system32\mswsock.dll
Description: Microsoft Windows NT/2k/XP NetBios protocol
DB filename: %SystemRoot%\system32\mswsock.dll
DB protocol: MSAFD NetBIOS *
Protocol 16: MSAFD NetBIOS [\Device\NetBT_Tcpip_{9EAB3BB6-7B9E-404A-9250-9CA7EFE0138F}] SEQPACKET 1
GUID: {8D5F1830-C273-11CF-95C8-00805F48A192}
Filename: %SystemRoot%\system32\mswsock.dll
Description: Microsoft Windows NT/2k/XP NetBios protocol
DB filename: %SystemRoot%\system32\mswsock.dll
DB protocol: MSAFD NetBIOS *
Protocol 17: MSAFD NetBIOS [\Device\NetBT_Tcpip_{9EAB3BB6-7B9E-404A-9250-9CA7EFE0138F}] DATAGRAM 1
GUID: {8D5F1830-C273-11CF-95C8-00805F48A192}
Filename: %SystemRoot%\system32\mswsock.dll
Description: Microsoft Windows NT/2k/XP NetBios protocol
DB filename: %SystemRoot%\system32\mswsock.dll
DB protocol: MSAFD NetBIOS *
Protocol 18: MSAFD NetBIOS [\Device\NetBT_Tcpip_{07172EAA-FF95-400A-BDF1-ADA8BF82074E}] SEQPACKET 2
GUID: {8D5F1830-C273-11CF-95C8-00805F48A192}
Filename: %SystemRoot%\system32\mswsock.dll
Description: Microsoft Windows NT/2k/XP NetBios protocol
DB filename: %SystemRoot%\system32\mswsock.dll
DB protocol: MSAFD NetBIOS *
Protocol 19: MSAFD NetBIOS [\Device\NetBT_Tcpip_{07172EAA-FF95-400A-BDF1-ADA8BF82074E}] DATAGRAM 2
GUID: {8D5F1830-C273-11CF-95C8-00805F48A192}
Filename: %SystemRoot%\system32\mswsock.dll
Description: Microsoft Windows NT/2k/XP NetBios protocol
DB filename: %SystemRoot%\system32\mswsock.dll
DB protocol: MSAFD NetBIOS *
Namespace Provider 0: TCP/IP
GUID: {22059D40-7E9E-11CF-AE5A-00AA00A7112B}
Filename: %SystemRoot%\System32\mswsock.dll
Description: Microsoft Windows NT/2k/XP TCP/IP name space provider
DB filename: %SystemRoot%\system32\mswsock.dll
DB protocol: TCP/IP
Namespace Provider 1: NTDS
GUID: {3B2637EE-E580-11CF-A555-00C04FD8D4AC}
Filename: %SystemRoot%\System32\winrnr.dll
Description: Microsoft Windows NT/2k/XP name space provider
DB filename: %SystemRoot%\system32\winrnr.dll
DB protocol: NTDS
Namespace Provider 2: Espace de noms NLA (Network Location Awareness)
GUID: {6642243A-3BA8-4AA6-BAA5-2E0BD71FDD83}
Filename: %SystemRoot%\System32\mswsock.dll
Description: Microsoft Windows NT/2k/XP name space provider
DB filename: %SystemRoot%\system32\mswsock.dll
DB protocol: NLA-Namespace
--- Search result list ---
NewDotNet: Réglages utilisateur (Clé du registre, nothing done)
HKEY_USERS\.DEFAULT\Software\new.net
NewDotNet: Réglages utilisateur (Clé du registre, nothing done)
HKEY_USERS\S-1-5-18\Software\new.net
DoubleClick: Cookie traceur (Firefox: Utilisateur par défaut) (Cookie, nothing done)
--- Spybot - Search & Destroy version: 1.3 .1TX (build: 20040801) ---
2004-05-12 blindman.exe (1.0.0.0)
2004-08-30 SpybotSD.exe (1.3.0.12)
2004-05-12 TeaTimer.exe (1.3.0.12)
2004-06-15 unins000.exe (51.15.0.0)
2004-05-12 Update.exe (1.3.0.0)
2004-10-04 advcheck.dll (1.0.1.0)
2004-05-12 borlndmm.dll (7.0.4.453)
2004-05-12 delphimm.dll (7.0.4.453)
2004-05-12 SDHelper.dll (1.3.0.12)
2004-05-12 Tools.dll (2.0.0.0)
2004-05-12 UnzDll.dll (1.73.1.1)
2004-05-12 ZipDll.dll (1.73.2.0)
2005-12-02 Includes\Cookies.sbi
2005-12-02 Includes\Dialer.sbi
2005-12-02 Includes\Hijackers.sbi
2005-12-02 Includes\Keyloggers.sbi
2004-11-29 Includes\LSP.sbi
2005-12-02 Includes\Malware.sbi
2005-12-02 Includes\PUPS.sbi
2005-12-02 Includes\Revision.sbi
2005-12-02 Includes\Security.sbi
2005-12-02 Includes\Spybots.sbi
2005-02-17 Includes\Tracks.uti
2005-12-02 Includes\Trojans.sbi
--- System information ---
Windows XP (Build: 2600) Service Pack 2
/ DataAccess: Microsoft Data Access Components KB870669
/ DataAccess: Security Update for Microsoft Data Access Components
/ Internet Explorer 6 / SP0: Correctif Windows XP - Article Base de Connaissances 834707
/ Internet Explorer 6 / SP1: Correctif Windows 2000 - Article Base de Connaissances 834707
/ Windows Media Player: Correctif pour le Lecteur Windows Media [Voir Q828026 pour plus d'informations]
/ Windows Media Player / SP0: Correctif pour le Lecteur Windows Media [Voir Q828026 pour plus d'informations]
/ Windows XP / SP2: Windows XP Service Pack 2
/ Windows XP / SP2: Correctif Windows XP - KB824151
/ Windows XP / SP2: Correctif Windows XP - KB840987
/ Windows XP / SP2: Correctif Windows XP - KB841356
/ Windows XP / SP2: Correctif Windows XP - KB842773
/ Windows XP / SP3: Correctif Windows XP - KB834707
/ Windows XP / SP3: Correctif Windows XP - KB867282
/ Windows XP / SP3: Correctif Windows XP - KB873333
/ Windows XP / SP3: Correctif Windows XP - KB873339
/ Windows XP / SP3: Mise à jour de sécurité pour Windows XP (KB883939)
/ Windows XP / SP3: Correctif Windows XP - KB885250
/ Windows XP / SP3: Correctif Windows XP - KB885835
/ Windows XP / SP3: Correctif Windows XP - KB885836
/ Windows XP / SP3: Correctif Windows XP - KB886185
/ Windows XP / SP3: Correctif Windows XP - KB887472
/ Windows XP / SP3: Correctif Windows XP - KB887742
/ Windows XP / SP3: Correctif Windows XP - KB888113
/ Windows XP / SP3: Correctif Windows XP - KB888302
/ Windows XP / SP3: Mise à jour de sécurité pour Windows XP (KB890046)
/ Windows XP / SP3: Correctif Windows XP - KB890047
/ Windows XP / SP3: Correctif Windows XP - KB890175
/ Windows XP / SP3: Correctif Windows XP - KB890859
/ Windows XP / SP3: Correctif Windows XP - KB890923
/ Windows XP / SP3: Correctif Windows XP - KB891781
/ Windows XP / SP3: Mise à jour de sécurité pour Windows XP (KB893066)
/ Windows XP / SP3: Correctif Windows XP - KB893086
/ Windows XP / SP3: Mise à jour de sécurité pour Windows XP (KB893756)
/ Windows XP / SP3: Windows Installer 3.1 (KB893803)
/ Windows XP / SP3: Windows Installer 3.1 (KB893803)
/ Windows XP / SP3: Mise à jour pour Windows XP (KB894391)
/ Windows XP / SP3: Mise à jour de sécurité pour Windows XP (KB896358)
/ Windows XP / SP3: Mise à jour de sécurité pour Windows XP (KB896422)
/ Windows XP / SP3: Mise à jour de sécurité pour Windows XP (KB896423)
/ Windows XP / SP3: Mise à jour de sécurité pour Windows XP (KB896424)
/ Windows XP / SP3: Mise à jour de sécurité pour Windows XP (KB896428)
/ Windows XP / SP3: Mise à jour de sécurité pour Windows XP (KB896688)
/ Windows XP / SP3: Mise à jour pour Windows XP (KB896727)
/ Windows XP / SP3: Mise à jour pour Windows XP (KB898461)
/ Windows XP / SP3: Mise à jour de sécurité pour Windows XP (KB899587)
/ Windows XP / SP3: Mise à jour de sécurité pour Windows XP (KB899588)
/ Windows XP / SP3: Mise à jour de sécurité pour Windows XP (KB899589)
/ Windows XP / SP3: Mise à jour de sécurité pour Windows XP (KB899591)
/ Windows XP / SP3: Mise à jour de sécurité pour Windows XP (KB900725)
/ Windows XP / SP3: Mise à jour de sécurité pour Windows XP (KB901017)
/ Windows XP / SP3: Mise à jour de sécurité pour Windows XP (KB901214)
/ Windows XP / SP3: Mise à jour de sécurité pour Windows XP (KB902400)
/ Windows XP / SP3: Mise à jour de sécurité pour Windows XP (KB903235)
/ Windows XP / SP3: Mise à jour de sécurité pour Windows XP (KB904706)
/ Windows XP / SP3: Mise à jour de sécurité pour Windows XP (KB905414)
/ Windows XP / SP3: Mise à jour de sécurité pour Windows XP (KB905749)
/ Windows XP / SP3: Mise à jour de sécurité pour Windows XP (KB905915)
/ Windows XP / SP3: Mise à jour pour Windows XP (KB910437)
--- Startup entries list ---
Located: HK_LM:Run, Cmaudio
command: RunDll32 cmicnfg.cpl,CMICtrlWnd
file: C:\WINNT\system32\RunDll32.exe
size: 33792
MD5: cdd7140c0eaa754c527b983ccc9993cd
Located: HK_LM:Run, iTunesHelper
command: C:\Program Files\iTunes\iTunesHelper.exe
file: C:\Program Files\iTunes\iTunesHelper.exe
size: 278528
MD5: 2e0e2be7bd6614ea4c86b9ece793e31e
Located: HK_LM:Run, Lexmark X1100 Series
command: "C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe"
file: C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe
size: 57344
MD5: 622ed3a888a7c1fcade04f4d095fca76
Located: HK_LM:Run, MCAgentExe
command: c:\PROGRA~1\mcafee.com\agent\mcagent.exe
file: c:\PROGRA~1\mcafee.com\agent\mcagent.exe
size: 303104
MD5: e8d2dcece015f4558aa3853514664f15
Located: HK_LM:Run, MCUpdateExe
command: c:\PROGRA~1\mcafee.com\agent\mcupdate.exe
file: c:\PROGRA~1\mcafee.com\agent\mcupdate.exe
size: 212992
MD5: 612ecc8413abf6c2f8d57b8485535025
Located: HK_LM:Run, QuickTime Task
command: "C:\Program Files\QuickTime\qttask.exe" -atboottime
file: C:\Program Files\QuickTime\qttask.exe
size: 98304
MD5: 76a3a30b58405c2c6d833895253a51a9
Located: HK_LM:Run, RealTray
command: C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
Located: HK_LM:Run, Sin Espias
command: C:\Program Files\SinEspias\No-Spy.exe /autorun
Located: HK_LM:Run, SpeedTouch USB Diagnostics
command: "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon
file: C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe
size: 877568
MD5: 671169202bcbd231a0d24e0d0dd29156
Located: HK_LM:Run, stnospy
command: C:\Program Files\SinEspias\no-spy.exe /autorun
Located: HK_LM:Run, Vade Retro Outlook Express
command: "C:\PROGRA~1\GOTOSO~1\VADERE~1\Vaderetro_oe.exe"
file: C:\PROGRA~1\GOTOSO~1\VADERE~1\Vaderetro_oe.exe
size: 310272
MD5: 7c4ccfc4e05ce507b7b50d1750c726ba
Located: HK_LM:Run, VirusScan Online
command: "c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe"
file: c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe
size: 196608
MD5: 944982c9b57c8bcc58f4001a62cd503f
Located: HK_LM:Run, VSOCheckTask
command: "c:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe" /checktask
file: c:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe
size: 143360
MD5: d527afe3bed159802f84fee4118b995a
Located: HK_LM:Run, WinampAgent
command: C:\Program Files\Winamp\winampa.exe
file: C:\Program Files\Winamp\winampa.exe
size: 33792
MD5: 6ba852b42abb9a7c221513fb7b63ab11
Located: HK_CU:Run, DrvMon.exe
command: C:\WINNT\system32\DrvMon.exe
file: C:\WINNT\system32\DrvMon.exe
size: 53248
MD5: 42692f2fe399c4cde8c3020013edabe0
Located: HK_CU:Run, msnmsgr
command: "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
file: C:\Program Files\MSN Messenger\msnmsgr.exe
size: 7094272
MD5: bcd239cb30b5356a019fd81e45d6636b
Located: HK_CU:Run, Shareaza
command: "C:\Program Files\Shareaza\Shareaza.exe" -tray
file: C:\Program Files\Shareaza\Shareaza.exe
size: 3887104
MD5: 4e9fdb788d7f948a9f3744fdea7ea0d7
Located: HK_CU:Run, Skype
command: "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
file: C:\Program Files\Skype\Phone\Skype.exe
size: 14892072
MD5: dda9e7a1b3ddf8714a971243c8643594
Located: System.ini, crypt32chain
command: crypt32.dll
Located: System.ini, cryptnet
command: cryptnet.dll
Located: System.ini, cscdll
command: cscdll.dll
Located: System.ini, ScCertProp
command: wlnotify.dll
Located: System.ini, Schedule
command: wlnotify.dll
Located: System.ini, sclgntfy
command: sclgntfy.dll
Located: System.ini, SensLogn
command: WlNotify.dll
Located: System.ini, termsrv
command: wlnotify.dll
Located: System.ini, wlballoon
command: wlnotify.dll
Located: System.ini, WRNotifier
command: WRLogonNTF.dll
Located: System.ini, wzcnotif
command: wzcdlg.dll
--- Browser helper object list ---
{02478D38-C3F9-4efb-9B51-7695ECA05670} (Yahoo! Companion BHO)
BHO name:
CLSID name: Yahoo! Companion BHO
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} (AcroIEHlprObj Class)
BHO name:
CLSID name: AcroIEHlprObj Class
description: Adobe Acrobat reader
classification: Legitimate
known filename: AcroIEhelper.ocx<br>AcroIEhelper.dll
info link: http://www.adobe.com/products/acrobat/readstep2.html
info source: TonyKlein
Path: C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\
Long name: AcroIEHelper.ocx
Short name: ACROIE~1.OCX
Date (created): 06/09/2005 14:57:58
Date (last access): 12/21/2005 20:58:24
Date (last write): 04/16/2001 14:39:02
Filesize: 37808
Attributes:
MD5: 8394ABFC1BE196A62C9F532511936DF7
CRC32: 71D6E350
Version: 0.1.0.0
{CE000992-A58C-4441-8938-744CD72AB27F} (i-Nav IDN Resolver)
BHO name: i-Nav IDN Resolver
CLSID name: i-Nav IDN Resolver
description: Verisign i-Nav,
classification: Legitimate
known filename: i-nav_4_0_0.dll
info link: http://www.idnnow.com/index.jsp?lang=en
info source: TonyKlein
Path: C:\Program Files\VeriSign\i-Nav\
Long name: i-nav_4_2_1.dll
Short name: I-NAV_~2.DLL
Date (created): 05/11/2005 17:22:04
Date (last access): 12/21/2005 20:58:24
Date (last write): 05/02/2005 14:39:10
Filesize: 446464
Attributes: archive
MD5: B4AB85CB4C705522C6040AF8D045A710
CRC32: 15D0F93B
Version: 0.4.0.2
--- ActiveX list ---
DirectAnimation Java Classes (DirectAnimation Java Classes)
DPF name: DirectAnimation Java Classes
CLSID name:
description:
classification: Legitimate
known filename: %WINDIR%\Java\classes\dajava.cab
info link:
info source: Patrick M. Kolla
Microsoft XML Parser for Java (Microsoft XML Parser for Java)
DPF name: Microsoft XML Parser for Java
CLSID name:
description:
classification: Legitimate
known filename: %WINDIR%\Java\classes\xmldso.cab
info link:
info source: Patrick M. Kolla
ppctlcab (ppctlcab)
DPF name: ppctlcab
CLSID name:
{00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class)
DPF name:
CLSID name: Checkers Class
Path: C:\WINNT\Downloaded Program Files\
Long name: msgrchkr.dll
Short name:
Date (created): 05/29/2003 15:00:18
Date (last access): 12/21/2005 20:51:44
Date (last write): 05/29/2003 15:00:18
Filesize: 77408
Attributes: archive
MD5: 42D567DF86B9B7AC4A89664C9651B68B
CRC32: 47FF3D19
Version: 0.7.0.1
{14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class)
DPF name:
CLSID name: MessengerStatsClient Class
Path: C:\WINNT\Downloaded Program Files\
Long name: MessengerStatsPAClient.dll
Short name: MESSEN~2.DLL
Date (created): 04/06/2004 19:03:54
Date (last access): 12/21/2005 20:51:44
Date (last write): 04/06/2004 19:03:54
Filesize: 172072
Attributes: archive
MD5: 94D1773AEAA2197AFEE3A6F8404FE4E9
CRC32: 76C3823D
Version: 0.9.0.2
{166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control)
DPF name:
CLSID name: Shockwave ActiveX Control
description: Macromedia ShockWave Flash Player 7
classification: Unknown
known filename: SWDIR.DLL
info link:
info source: Patrick M. Kolla
Path: C:\WINNT\system32\macromed\Shockwave 10\
Long name: Download.dll
Short name:
Date (created): 07/19/2005 14:39:20
Date (last access): 12/21/2005 10:45:04
Date (last write): 07/19/2005 14:39:20
Filesize: 79552
Attributes: archive
MD5: 6092AEDB6921703A78FBD4E01C126439
CRC32: 978BDE38
Version: 0.10.0.1
{2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class)
DPF name:
CLSID name: Minesweeper Flags Class
Path: C:\WINNT\Downloaded Program Files\
Long name: minesweeper.dll
Short name: MINESW~1.DLL
Date (created): 05/29/2003 15:00:22
Date (last access): 12/21/2005 20:51:44
Date (last write): 05/29/2003 15:00:22
Filesize: 84064
Attributes: archive
MD5: F951FD0EA383DF2D49CA0359E4A86968
CRC32: 50A69718
Version: 0.7.0.1
{33564D57-0000-0010-8000-00AA00389B71} ()
DPF name:
CLSID name:
{33564D57-9980-0010-8000-00AA00389B71} ()
DPF name:
CLSID name:
description: Microsoft WMV Video Codec
classification: Legitimate
known filename: WMV9DMO.CAB
info link:
info source: Patrick M. Kolla
{4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool)
DPF name:
CLSID name: MSN Photo Upload Tool
Path: C:\WINNT\Downloaded Program Files\
Long name: MsnPUpld.dll
Short name:
Date (created): 10/08/2004 16:01:22
Date (last access): 12/21/2005 20:51:44
Date (last write): 10/08/2004 16:01:22
Filesize: 372736
Attributes: archive
MD5: D2ED523BB0FE94F8F492BEFE1C336040
CRC32: C4677625
Version: 0.10.0.0
{80DD2229-B8E4-4C77-B72F-F22972D723EA} (AvxScanOnline Control)
DPF name:
CLSID name: AvxScanOnline Control
description: BitDefender online virus scanner
classification: Legitimate
known filename: bitdefender.ocx
info link:
info source: Patrick M. Kolla
{8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.5.0)
DPF name: Java Runtime Environment 1.5.0
CLSID name: Java Plug-in 1.5.0_02
description: Sun Java
classification: Legitimate
known filename: %PROGRAM FILES%\JabaSoft\JRE\*\Bin\npjava131.dll
info link:
info source: Patrick M. Kolla
Path: C:\Program Files\Java\jre1.5.0_02\bin\
Long name: NPJPI150_02.dll
Short name: NPJPI1~1.DLL
Date (created): 03/04/2005 02:36:50
Date (last access): 12/14/2005 16:32:14
Date (last write): 03/04/2005 02:54:18
Filesize: 69746
Attributes: archive
MD5: 6C9A4C573C0C771D99D902EE06DA3CBB
CRC32: 55F989EE
Version: 0.5.0.0
{8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class)
DPF name:
CLSID name: MessengerStatsClient Class
Path: C:\WINNT\Downloaded Program Files\
Long name: messengerstatsclient.dll
Short name: MESSEN~1.DLL
Date (created): 05/29/2003 15:00:20
Date (last access): 12/21/2005 20:51:44
Date (last write): 05/29/2003 15:00:20
Filesize: 160864
Attributes: archive
MD5: B069B555A00AA026F657AA4FD13AE154
CRC32: 89BB01E1
Version: 0.7.0.1
{9F1C11AA-197B-4942-BA54-47A8489BB47F} ()
DPF name:
CLSID name:
description: Windows Update
classification: Legitimate
known filename: %WINDIR%\System32\iuctl.dll,iuengine.dll
info link:
info source: Patrick M. Kolla
{BD393C14-72AD-4790-A095-76522973D6B8} (CBreakshotControl Class)
DPF name:
CLSID name: CBreakshotControl Class
Path: C:\WINNT\Downloaded Program Files\
Long name: Banksht2.dll
Short name:
Date (created): 05/11/2004 11:55:38
Date (last access): 12/21/2005 20:51:44
Date (last write): 05/11/2004 11:55:38
Filesize: 1277992
Attributes: archive
MD5: 5409FBE248ACC1E2A8FE5C03442BEF74
CRC32: FC1429F1
Version: 0.1.0.0
{CAFEEFAC-0015-0000-0002-ABCDEFFEDCBA} (Java Runtime Environment 1.5.0)
DPF name: Java Runtime Environment 1.5.0
CLSID name: Java Plug-in 1.5.0_02
Path: C:\Program Files\Java\jre1.5.0_02\bin\
Long name: NPJPI150_02.dll
Short name: NPJPI1~1.DLL
Date (created): 03/04/2005 02:36:50
Date (last access): 12/21/2005 21:12:48
Date (last write): 03/04/2005 02:54:18
Filesize: 69746
Attributes: archive
MD5: 6C9A4C573C0C771D99D902EE06DA3CBB
CRC32: 55F989EE
Version: 0.5.0.0
{CB50428B-657F-47DF-9B32-671F82AA73F7} (Photodex Presenter AX control)
DPF name:
CLSID name: Photodex Presenter AX control
Path: C:\PROGRA~1\PHOTOD~1\
Long name: pxplay.ocx
Short name:
Date (created): 09/05/2005 15:06:16
Date (last access): 12/14/2005 16:32:14
Date (last write): 09/05/2005 15:06:02
Filesize: 291920
Attributes: archive
MD5: CD74955A5B800ACC3BEE32607F679841
CRC32: 10771AC8
Version: 0.2.0.50
{D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object)
DPF name:
CLSID name: Shockwave Flash Object
description: Macromedia Shockwave Flash Player
classification: Legitimate
known filename:
info link:
info source: Patrick M. Kolla
Path: C:\WINNT\system32\Macromed\Flash\
Long name: Flash8.ocx
Short name:
Date (created): 08/27/2005 12:38:56
Date (last access): 12/21/2005 18:19:10
Date (last write): 08/27/2005 12:38:56
Filesize: 1435272
Attributes: archive
MD5: 900373C059C2B51CA91BF110DBDECB33
CRC32: F19599BC
Version: 0.8.0.0
{EF0DBA6F-43CE-4B26-9808-2AB38FA0DB29} (MSN Money Ticker)
DPF name:
CLSID name: MSN Money Ticker
Path: C:\WINNT\Downloaded Program Files\
Long name: ticker13.ocx
Short name:
Date (created): 06/11/2003 08:27:56
Date (last access): 12/21/2005 19:47:20
Date (last write): 06/11/2003 08:27:56
Filesize: 430080
Attributes: archive
MD5: 3D9371E944259D20E828A08ACBE9EF62
CRC32: 669A676E
Version: 0.13.7.211
{F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class)
DPF name:
CLSID name: Solitaire Showdown Class
Path: C:\WINNT\Downloaded Program Files\
Long name: solitaireshowdown.dll
Short name: SOLITA~1.DLL
Date (created): 05/29/2003 15:00:20
Date (last access): 12/21/2005 20:51:44
Date (last write): 05/29/2003 15:00:20
Filesize: 86112
Attributes: archive
MD5: 6E0E81210B17C225AD8DBB86F0C41E32
CRC32: 1C944476
Version: 0.7.0.1
--- Process list ---
PID: 0 ( 0) [System]
PID: 4 ( 0) System
PID: 152 ( 512) C:\Program Files\ewido anti-malware\ewidoctrl.exe
PID: 184 ( 512) C:\Program Files\ewido anti-malware\ewidoguard.exe
PID: 328 ( 512) c:\program files\mcafee.com\agent\mcdetect.exe
PID: 340 ( 4) \SystemRoot\System32\smss.exe
PID: 356 ( 668) c:\progra~1\mcafee.com\vso\mcvsftsn.exe
PID: 380 ( 512) c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
PID: 444 ( 340) csrss.exe
PID: 468 ( 340) \??\C:\WINNT\system32\winlogon.exe
PID: 512 ( 468) C:\WINNT\system32\services.exe
PID: 524 ( 468) C:\WINNT\system32\lsass.exe
PID: 668 ( 512) C:\WINNT\system32\svchost.exe
PID: 720 ( 668) C:\Program Files\Messenger\msmsgs.exe
PID: 736 ( 512) svchost.exe
PID: 812 ( 512) c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
PID: 824 ( 512) C:\WINNT\System32\svchost.exe
PID: 856 ( 512) C:\Program Files\VeriSign\NAVI\naviagent.exe
PID: 872 ( 512) svchost.exe
PID: 900 ( 512) svchost.exe
PID: 960 ( 512) C:\Program Files\Photodex\ProShow\ScsiAccess.exe
PID: 1216 ( 512) C:\WINNT\system32\LEXBCES.EXE
PID: 1312 ( 512) C:\WINNT\system32\spoolsv.exe
PID: 1316 (1216) C:\WINNT\system32\LEXPPS.EXE
PID: 1332 (1284) C:\WINNT\Explorer.EXE
PID: 1360 ( 512) C:\WINNT\System32\svchost.exe
PID: 1560 (1332) C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe
PID: 1568 (1332) C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe
PID: 1576 (1332) C:\Program Files\QuickTime\qttask.exe
PID: 1592 (1332) C:\PROGRA~1\mcafee.com\vso\mcvsshld.exe
PID: 1612 (1568) C:\Program Files\Lexmark X1100 Series\lxbkbmon.exe
PID: 1616 (1332) C:\PROGRA~1\mcafee.com\agent\mcagent.exe
PID: 1640 (1332) C:\PROGRA~1\GOTOSO~1\VADERE~1\Vaderetro_oe.exe
PID: 1652 (1332) C:\Program Files\iTunes\iTunesHelper.exe
PID: 1660 (1592) c:\progra~1\mcafee.com\vso\mcvsescn.exe
PID: 1668 (1332) C:\Program Files\Real\RealPlayer\RealPlay.exe
PID: 1676 (1332) C:\WINNT\system32\RunDll32.exe
PID: 1684 (1332) C:\Program Files\Winamp\winampa.exe
PID: 1712 (1332) C:\Program Files\MSN Messenger\msnmsgr.exe
PID: 1720 (1332) C:\WINNT\system32\DrvMon.exe
PID: 1796 (1332) C:\Program Files\Shareaza\Shareaza.exe
PID: 1840 (1332) C:\Program Files\Skype\Phone\Skype.exe
PID: 1896 ( 512) C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
PID: 1936 ( 668) NAVICL~1.EXE
PID: 1980 ( 512) C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
PID: 2024 ( 512) C:\WINNT\system32\drivers\CDAC11BA.EXE
PID: 2784 ( 512) C:\Program Files\iPod\bin\iPodService.exe
PID: 2876 ( 512) c:\PROGRA~1\mcafee.com\vso\mcshield.exe
PID: 3332 ( 512) alg.exe
PID: 4000 (1332) C:\Program Files\Mozilla Firefox\firefox.exe
PID: 4036 (1332) C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe
Spybot - Search && Destroy process list report, 12/21/2005 21:12:48
--- Browser start & search pages list ---
Spybot - Search && Destroy browser pages report, 12/21/2005 21:12:48
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Search Page
http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Search Bar
http://home.microsoft.com/search/lobby/search.asp
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Start Page
http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Search\SearchAssistant
http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Search\CustomizeSearch
http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchUrl\@
http://home.microsoft.com/access/autosearch.asp?p=%s
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Search Page
http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Search Bar
http://home.microsoft.com/search/lobby/search.asp
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Start Page
http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Default_Page_URL
http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Default_Search_URL
http://home.microsoft.com/search/search.asp
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Search\SearchAssistant
http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Search\CustomizeSearch
http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchUrl\@
http://home.microsoft.com/access/autosearch.asp?p=%s
--- Winsock Layered Service Provider list ---
Protocol 0: MSAFD Irda [IrDA]
GUID: {3972523D-2AF1-11D1-B655-00805F3642CC}
Filename: %SystemRoot%\system32\mswsock.dll
Description: Infrared protocol
DB filename: %SystemRoot%\system32\mswsock.dll
DB protocol: MSAFD Irda [IrDA]
Protocol 1: MSAFD Tcpip [TCP/IP]
GUID: {E70F1AA0-AB8B-11CF-8CA3-00805F48A192}
Filename: %SystemRoot%\system32\mswsock.dll
Description: Microsoft Windows NT/2k/XP IP protocol
DB filename: %SystemRoot%\system32\mswsock.dll
DB protocol: MSAFD Tcpip
Protocol 2: MSAFD Tcpip [UDP/IP]
GUID: {E70F1AA0-AB8B-11CF-8CA3-00805F48A192}
Filename: %SystemRoot%\system32\mswsock.dll
Description: Microsoft Windows NT/2k/XP IP protocol
DB filename: %SystemRoot%\system32\mswsock.dll
DB protocol: MSAFD Tcpip
Protocol 3: MSAFD Tcpip [RAW/IP]
GUID: {E70F1AA0-AB8B-11CF-8CA3-00805F48A192}
Filename: %SystemRoot%\system32\mswsock.dll
Description: Microsoft Windows NT/2k/XP IP protocol
DB filename: %SystemRoot%\system32\mswsock.dll
DB protocol: MSAFD Tcpip
Protocol 4: RSVP UDP Service Provider
GUID: {9D60A9E0-337A-11D0-BD88-0000C082E69A}
Filename: %SystemRoot%\system32\rsvpsp.dll
Description: Microsoft Windows NT/2k/XP RVSP
DB filename: %SystemRoot%\system32\rsvpsp.dll
DB protocol: RSVP * Service Provider
Protocol 5: RSVP TCP Service Provider
GUID: {9D60A9E0-337A-11D0-BD88-0000C082E69A}
Filename: %SystemRoot%\system32\rsvpsp.dll
Description: Microsoft Windows NT/2k/XP RVSP
DB filename: %SystemRoot%\system32\rsvpsp.dll
DB protocol: RSVP * Service Provider
Protocol 6: MSAFD Irda [IrDA]
GUID: {3972523D-2AF1-11D1-B655-00805F3642CC}
Filename: %SystemRoot%\system32\mswsock.dll
Description: Infrared protocol
DB filename: %SystemRoot%\system32\mswsock.dll
DB protocol: MSAFD Irda [IrDA]
Protocol 7: MSAFD Tcpip [TCP/IP]
GUID: {E70F1AA0-AB8B-11CF-8CA3-00805F48A192}
Filename: %SystemRoot%\system32\mswsock.dll
Description: Microsoft Windows NT/2k/XP IP protocol
DB filename: %SystemRoot%\system32\mswsock.dll
DB protocol: MSAFD Tcpip
Protocol 8: MSAFD Tcpip [UDP/IP]
GUID: {E70F1AA0-AB8B-11CF-8CA3-00805F48A192}
Filename: %SystemRoot%\system32\mswsock.dll
Description: Microsoft Windows NT/2k/XP IP protocol
DB filename: %SystemRoot%\system32\mswsock.dll
DB protocol: MSAFD Tcpip
Protocol 9: MSAFD Tcpip [RAW/IP]
GUID: {E70F1AA0-AB8B-11CF-8CA3-00805F48A192}
Filename: %SystemRoot%\system32\mswsock.dll
Description: Microsoft Windows NT/2k/XP IP protocol
DB filename: %SystemRoot%\system32\mswsock.dll
DB protocol: MSAFD Tcpip
Protocol 10: RSVP UDP Service Provider
GUID: {9D60A9E0-337A-11D0-BD88-0000C082E69A}
Filename: %SystemRoot%\system32\rsvpsp.dll
Description: Microsoft Windows NT/2k/XP RVSP
DB filename: %SystemRoot%\system32\rsvpsp.dll
DB protocol: RSVP * Service Provider
Protocol 11: RSVP TCP Service Provider
GUID: {9D60A9E0-337A-11D0-BD88-0000C082E69A}
Filename: %SystemRoot%\system32\rsvpsp.dll
Description: Microsoft Windows NT/2k/XP RVSP
DB filename: %SystemRoot%\system32\rsvpsp.dll
DB protocol: RSVP * Service Provider
Protocol 12: MSAFD NetBIOS [\Device\NetBT_Tcpip_{CF05C84C-23D4-4734-9EEF-5D13BFE38DBF}] SEQPACKET 0
GUID: {8D5F1830-C273-11CF-95C8-00805F48A192}
Filename: %SystemRoot%\system32\mswsock.dll
Description: Microsoft Windows NT/2k/XP NetBios protocol
DB filename: %SystemRoot%\system32\mswsock.dll
DB protocol: MSAFD NetBIOS *
Protocol 13: MSAFD NetBIOS [\Device\NetBT_Tcpip_{CF05C84C-23D4-4734-9EEF-5D13BFE38DBF}] DATAGRAM 0
GUID: {8D5F1830-C273-11CF-95C8-00805F48A192}
Filename: %SystemRoot%\system32\mswsock.dll
Description: Microsoft Windows NT/2k/XP NetBios protocol
DB filename: %SystemRoot%\system32\mswsock.dll
DB protocol: MSAFD NetBIOS *
Protocol 14: MSAFD NetBIOS [\Device\NetBT_Tcpip_{BA8C3F65-97E3-47AF-8FA0-82F45D0AEB60}] SEQPACKET 3
GUID: {8D5F1830-C273-11CF-95C8-00805F48A192}
Filename: %SystemRoot%\system32\mswsock.dll
Description: Microsoft Windows NT/2k/XP NetBios protocol
DB filename: %SystemRoot%\system32\mswsock.dll
DB protocol: MSAFD NetBIOS *
Protocol 15: MSAFD NetBIOS [\Device\NetBT_Tcpip_{BA8C3F65-97E3-47AF-8FA0-82F45D0AEB60}] DATAGRAM 3
GUID: {8D5F1830-C273-11CF-95C8-00805F48A192}
Filename: %SystemRoot%\system32\mswsock.dll
Description: Microsoft Windows NT/2k/XP NetBios protocol
DB filename: %SystemRoot%\system32\mswsock.dll
DB protocol: MSAFD NetBIOS *
Protocol 16: MSAFD NetBIOS [\Device\NetBT_Tcpip_{9EAB3BB6-7B9E-404A-9250-9CA7EFE0138F}] SEQPACKET 1
GUID: {8D5F1830-C273-11CF-95C8-00805F48A192}
Filename: %SystemRoot%\system32\mswsock.dll
Description: Microsoft Windows NT/2k/XP NetBios protocol
DB filename: %SystemRoot%\system32\mswsock.dll
DB protocol: MSAFD NetBIOS *
Protocol 17: MSAFD NetBIOS [\Device\NetBT_Tcpip_{9EAB3BB6-7B9E-404A-9250-9CA7EFE0138F}] DATAGRAM 1
GUID: {8D5F1830-C273-11CF-95C8-00805F48A192}
Filename: %SystemRoot%\system32\mswsock.dll
Description: Microsoft Windows NT/2k/XP NetBios protocol
DB filename: %SystemRoot%\system32\mswsock.dll
DB protocol: MSAFD NetBIOS *
Protocol 18: MSAFD NetBIOS [\Device\NetBT_Tcpip_{07172EAA-FF95-400A-BDF1-ADA8BF82074E}] SEQPACKET 2
GUID: {8D5F1830-C273-11CF-95C8-00805F48A192}
Filename: %SystemRoot%\system32\mswsock.dll
Description: Microsoft Windows NT/2k/XP NetBios protocol
DB filename: %SystemRoot%\system32\mswsock.dll
DB protocol: MSAFD NetBIOS *
Protocol 19: MSAFD NetBIOS [\Device\NetBT_Tcpip_{07172EAA-FF95-400A-BDF1-ADA8BF82074E}] DATAGRAM 2
GUID: {8D5F1830-C273-11CF-95C8-00805F48A192}
Filename: %SystemRoot%\system32\mswsock.dll
Description: Microsoft Windows NT/2k/XP NetBios protocol
DB filename: %SystemRoot%\system32\mswsock.dll
DB protocol: MSAFD NetBIOS *
Namespace Provider 0: TCP/IP
GUID: {22059D40-7E9E-11CF-AE5A-00AA00A7112B}
Filename: %SystemRoot%\System32\mswsock.dll
Description: Microsoft Windows NT/2k/XP TCP/IP name space provider
DB filename: %SystemRoot%\system32\mswsock.dll
DB protocol: TCP/IP
Namespace Provider 1: NTDS
GUID: {3B2637EE-E580-11CF-A555-00C04FD8D4AC}
Filename: %SystemRoot%\System32\winrnr.dll
Description: Microsoft Windows NT/2k/XP name space provider
DB filename: %SystemRoot%\system32\winrnr.dll
DB protocol: NTDS
Namespace Provider 2: Espace de noms NLA (Network Location Awareness)
GUID: {6642243A-3BA8-4AA6-BAA5-2E0BD71FDD83}
Filename: %SystemRoot%\System32\mswsock.dll
Description: Microsoft Windows NT/2k/XP name space provider
DB filename: %SystemRoot%\system32\mswsock.dll
DB protocol: NLA-Namespace
gchris
le 21 décembre 2005 à 21h22
Crée un fichier texte avec le bloc-note
copie/colle ceci dans le fichier :
Enregistre le fichier sur ton bureau en prenant soins de mettre "tous fichiers" dans "Type" et nomme-le remove.reg
Double-clic sur remove.reg et accepte la fusion à ton registre.
---
copie/colle ceci dans le fichier :
Enregistre le fichier sur ton bureau en prenant soins de mettre "tous fichiers" dans "Type" et nomme-le remove.reg
Double-clic sur remove.reg et accepte la fusion à ton registre.
---
icibonheur
le 22 décembre 2005 à 00h29
étant débutant en informatique peux tu m'expliquer plus en détails ce que je dois faire exactement ( Crée un fichier texte avec le bloc-note)lequel bloc note de spybot??? et je crée ca comment (moi pas doué tu sais ) Si tu pouvais détailler ca serait sympa merci d'avance Gchris. icibonheur
gchris
le 22 décembre 2005 à 20h15
Télécharge ce >>fichier<<
Dézippe-le sur ton bureau (extraire)
Double-clic sur le fichier remove_1.reg et accepte la fusion à ton registre
redémarre ton pc.
Dézippe-le sur ton bureau (extraire)
Double-clic sur le fichier remove_1.reg et accepte la fusion à ton registre
redémarre ton pc.
icibonheur
le 23 décembre 2005 à 00h19
gchris tu es génial, j'ai suivi t'es conseils, et la miracle 
spybot a terminé son analyse sans trouver "Newdonet" et le plus merveilleux c'est que j'ai refait une analyse avec Ad Aware SE qu'enfin il a su terminer son analyse sans rester bloqué ce qu'il faisait depuis deux semaines.Pourrais tu me donner un dernier conseil, qu'est ce que je dois installer ou faire pour éviter a l'avenir d'avoir le même problème.
Mon Antivirus c'est Mcafee mais uniquement l'antivirus j'ai recu le logiciel a un ami mais pour qu'il face un travail complet faudrait que j'achète le complément comme demandé sur le disque. j'ai spybot et Adware( Si possible des versions francaise). Merci encore a toi bravo t'es un champion
PS:j'oubliais je dois garder le fichier "remove_1.reg" sur mon bureau au cas où???
gchris
le 23 décembre 2005 à 18h55
- Télécharge fichier hosts
- Dézippe-le sur ton bureau
- Récupère le fichier HOSTS (dans le dossier décompressé) via un clic droit -> copier ou couper
- Rends-toi à C:\windows\system32\drivers\etc
- Clic droit -> coller.
- Windows te demande si tu veux remplacer le fichier existant -> Répond oui.
---
http://home.tele2.fr/gchrispage/index/download/fichiers_&_scripts/blockli(...)
dézippe ce fichier, et double-clic sur blocklist.reg, accepte la fusion à ton registre.
---
Télécharger Spyware Blaster:
il ne supprime rien, il protège pour empécher les installations de malwares (vaccination). Met à jour et met toutes les protections sur enable.
- Dézippe-le sur ton bureau
- Récupère le fichier HOSTS (dans le dossier décompressé) via un clic droit -> copier ou couper
- Rends-toi à C:\windows\system32\drivers\etc
- Clic droit -> coller.
- Windows te demande si tu veux remplacer le fichier existant -> Répond oui.
---
http://home.tele2.fr/gchrispage/index/download/fichiers_&_scripts/blockli(...)
dézippe ce fichier, et double-clic sur blocklist.reg, accepte la fusion à ton registre.
---
Télécharger Spyware Blaster:
il ne supprime rien, il protège pour empécher les installations de malwares (vaccination). Met à jour et met toutes les protections sur enable.
icibonheur
le 27 décembre 2005 à 19h22
Salut gchris, j'ai fais exactement ce que tu m'as conseillé, mais avec l'aide de mon fils (heureusement qu'il était là ) je te remercie encore pour le temps que tu m'as consacré pour régler mon problème, ma réponse est un peu tardive mais désolé je n'étais pas chez moi ces derniers jours.
Encore merci et bonnes fêtes de fin d'année a toi et t'es proches.
Icibonheur
gchris
le 27 décembre 2005 à 19h30
Merci, bonnes fètes également.
@+
@+
procyon16
le 04 février 2006 à 14h50
Salut !
J'ai le même problème qu'avait Icibonheur sauf que les manipulations que Gchris à décris n'ont pas résolu le problème.
Ad-aware reste bloqué ici :
C:\DOCUME~1\HP_PRO~1\LOCALS~1\Temp\AAWTMP
Je vous remercie pour votre aide.
J'ai le même problème qu'avait Icibonheur sauf que les manipulations que Gchris à décris n'ont pas résolu le problème.
Ad-aware reste bloqué ici :
C:\DOCUME~1\HP_PRO~1\LOCALS~1\Temp\AAWTMP
Je vous remercie pour votre aide.
gchris
le 04 février 2006 à 14h52
Crées-toi un sujet.
-->Message édité par gchris le 04/02/2006 14:53:00<--
procyon16
le 04 février 2006 à 18h47
Hey !!!!!!!! J'ai crée un nouveau sujet comme tu m'a dit alors pourquoi tu l'a supprimé ? 
Je crois que je vais peter un cable. Mon problème est trés serieux et je n'ai pas de temps à perdre ! Je crois avoir donné suffisemment de détails et respecté les regles du forum non ?
Je crois que je vais peter un cable. Mon problème est trés serieux et je n'ai pas de temps à perdre ! Je crois avoir donné suffisemment de détails et respecté les regles du forum non ?
Roach System
le 04 février 2006 à 18h51
1 - rester Zen et courtois(e)
2 - Crée toi un sujet (tres clair)
3 - Decrit ton probleme tres clairement avec une petite config de ton ordi
SANS RAPPORT HIJACKTHIS
4 - A toute suite
-->Message édité par Roach System le 04/02/2006 18:52:20<--
PRODUITS
- Portables |
- PC |
- Moniteurs |
- Photo / Vidéo |
- T.V. |
- Audio |
- GPS |
- Stockage |
- Téléphonie |
- autres catégories
TÉLÉCHARGER - LOGICIELS
- Windows & logiciels |
- Bureautique |
- Développement |
- Internet |
- Jeux |
- Loisirs |
- Multimédia |
- Personnaliser son pc |
- Sécurité |
- Utilitaires |
- Logiciels Linux |
- logiciels Mac
JEUX VIDÉOS
- jeux PC |
- Xbox |
- Playstation |
- Wii |
- PSP |
- DS |
- Action |
- Aventure |
- MMORPG |
- Sports |
- Simulation |
- Enfant |
- Soluces et astuces
LOISIRS
01NET PRO
- Réseaux et Internet |
- Programmation et développement |
- Logiciels d'entreprise |
- Systèmes d'exploitation en entreprise |
- Sécurité en entreprise |
- Entreprenariat |
- Emploi |
- Services PRO |
- Matériel PRO
AVIS ET COMMENTAIRES
- Les actualités de 01net. |
- Avis sur les jeux vidéos |
- Avis sur les produits |
- Avis sur les logiciels |
A PROPOS DE 01NET
publicité
Messages des modérateurs
Discussions les plus actives
- mon pc rame a mort j ai des pic de uc a 70 a 100 %
- virus ou anti-virus 360? comment s'en débarrasser, je galère
- PC extremement lent et msg d'erreur
- disque dur,amovible,interne ne s'ouvre plus en 2 clic(virus)
- Connection internet impossible causée par virus
- comment nettoyer mon ordinateur?
- [RESOLU] Avast, pare feu ... tous bloqués !!
- infecté par spyware-secure ? (résolu)
- macrovirus : W97/Thus.AD (résolu)
- virus et disfonctionnement
 |
 |
Packaging
La vogue des produits collectors.
|
 |
||
L'ORDINATEUR INDIVIDUEL
Le mensuel informatique qui vous informe et vous conseille.
Nous contacter
|
Charte de confiance
|
Voir notice légale
01net. - 01men - RMC - BFM Radio - BFM TV - TousLesPodcasts - 01informatique.fr - Association RMC-BFM
01net. - 01men - RMC - BFM Radio - BFM TV - TousLesPodcasts - 01informatique.fr - Association RMC-BFM
Tous droits réservés © 1999 - 2009 Internext - 01net.