020 - AppInit_DLLs: Sockspy.dll

Bonjour *Fabrice* :

Bonjour !

Dans mon rapport Hijack This, je vois cette ligne :

020 - AppInit_DLLs: Sockspy.dll Sockspy.dll Sockspy.dll Sockspy.dll
Sockspy.dll Sockspy.dll Sockspy.dll Sockspy.dll

Savez-vous ce que c'est ...? Merci !

( j'ai posté aussi dans Sécurité ...mais y a pas grand-monde là-bas ...! )

Relatif à BitDefender... d'après quelques indice "gougueuliens".

Désactive (en décochant) la ligne corespondante avec Autoruns:
http://cjoint.com/?mioaJPlw7o

Redémarrer et si BitDefender se plaint recoche l'option et redémare
... sinon envoie le log d'HJT ici.

Autoruns de Mark Russinovich:
http://www.sysinternals.com/utilities/autoruns.html

Tiens-nous au courant.
:)
--
Claude LaFrenière [MVP] :-{)
courriel: http://viadresse.com?39135017
http://climenole.serendipia.net/

«My Principal Design Was To Inform, Not To Amuse Thee.»
Lemuel Gulliver, The Travels (IV:12)

Bonjour *Claude LaFrenière* :

Relatif à BitDefender... d'après quelques indice "gougueuliens".
<--------------------------------------------------------------- indiceS

Désactive (en décochant) la ligne corespondante avec Autoruns:
<---------------------------------------------------coRRespondante

AArrgg!

--
Claude LaFrenière

Claude LaFrenière a formulé la demande :
[...]

... sinon envoie le log d'HJT ici.

Salut l'ami Claude ;-) Bien amic@lement à toi l-) m@mie
Voilà son log Logfile of HijackThis v1.99.1
Scan saved at 11:14:49, on 08/12/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:WINDOWSSystem32smss.exe
C:WINDOWSsystem32winlogon.exe
C:WINDOWSsystem32services.exe
C:WINDOWSsystem32lsass.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSSystem32svchost.exe
C:WINDOWSsystem32spoolsv.exe
C:WINDOWSExplorer.EXE
C:WINDOWSSystem32GEARSec.exe
C:Program FilesSymantecNorton GhostAgentPQV2iSvc.exe
C:Program FilesSoftwinBitDefender8bdmcon.exe
C:Program FilesSoftwinBitDefender8bdoesrv.exe
C:Program FilesSagem - Utilitaire pour Clé Wi-Fi USB
802.11bWlanUtility.exe
C:WINDOWSsystem32pctspk.exe
C:WINDOWSSystem32svchost.exe
C:Program FilesFichiers communsSoftwinBitDefender
Communicatorxcommsvr.exe
C:Program FilesFichiers communsSoftwinBitDefender Scan
Serverbdss.exe
C:PROGRA~1EUROBA~1erobar.exe
C:Program FilesBonjourmDNSResponder.exe
C:Program FilesSoftwinBitDefender8vsserv.exe
C:Program FilesHijack thisHijackThis.exe

R0 - HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page http://www.ogame.fr/
R0 - HKCUSoftwareMicrosoftInternet ExplorerMain,Local Page R0 - HKLMSoftwareMicrosoftInternet ExplorerMain,Local Page R1 - HKCUSoftwareMicrosoftWindowsCurrentVersionInternet
Settings,ProxyOverride = local.,
R0 - HKCUSoftwareMicrosoftInternet ExplorerToolbar,LinksFolderName
Liens
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} -
C:PROGRA~1SPYBOT~1SDHelper.dll
O2 - BHO: Google Toolbar Helper -
{AA58ED58-01DD-4d91-8333-CF10577473F7} -
c:program filesgooglegoogletoolbar1.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} -
C:WINDOWSSystem32msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} -
c:program
filesgooglegoogletoolbar1.dll
O4 - HKLM..Run: [BDMCon] C:Program
FilesSoftwinBitDefender8bdmcon.exe
O4 - HKLM..Run: [BDOESRV] C:Program
FilesSoftwinBitDefender8bdoesrv.exe
O4 - Startup: Eurobarre.lnk = C:Program Fileseurobarreeb.exe
O4 - Global Startup: Sagem - Utilitaire pour Clé Wi-Fi USB.lnk = ?
O8 - Extra context menu item: &Traduire à partir de l'anglais -
res://C:Program FilesGoogleGoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Pages liées - res://C:Program
FilesGoogleGoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Pages similaires - res://C:Program
FilesGoogleGoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Recherche &Google - res://C:Program
FilesGoogleGoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Version de la page actuelle disponible
dans le
cache Google - res://C:Program
FilesGoogleGoogleToolbar1.dll/cmcache.html
O10 - Unknown file in Winsock LSP: c:program filesbonjourmdnsnsp.dll
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient
Class) -
http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine
Advantage
Validation Tool) - http://go.microsoft.com/fwlink/?linkid9204
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags
Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class)
-
http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1127765804801
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient
Class) -
http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF}
(MsnMessengerSetupDownloadControl Class) -
http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) -
http://messenger.zone.msn.com/binary/ZIntro.cab32846.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} -
"C:PROGRA~1MSNMES~1msgrapp.dll" (file missing)
O20 - AppInit_DLLs: sockspy.dll sockspy.dll sockspy.dll sockspy.dll
sockspy.dll sockspy.dll sockspy.dll sockspy.dll
O23 - Service: BitDefender Scan Server (bdss) - Unknown owner -
C:Program
FilesFichiers communsSoftwinBitDefender Scan Serverbdss.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Computer, Inc.
-
C:Program FilesBonjourmDNSResponder.exe
O23 - Service: GEARSecurity - GEAR Software -
C:WINDOWSSystem32GEARSec.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision
Corporation - C:Program FilesFichiers
communsInstallShieldDriver11Intel 32IDriverT.exe
O23 - Service: Norton Ghost - Symantec Corporation - C:Program
FilesSymantecNorton GhostAgentPQV2iSvc.exe
O23 - Service: PCTEL Speaker Phone (Pctspk) - PCtel, Inc. -
C:WINDOWSsystem32pctspk.exe
O23 - Service: PDEngine - Raxco Software, Inc. - C:Program
FilesRaxcoPerfectDiskPDEngine.exe
O23 - Service: PDScheduler (PDSched) - Raxco Software, Inc. -
C:Program
FilesRaxcoPerfectDiskPDSched.exe
O23 - Service: TuneUp WinStyler Theme Service (TUWinStylerThemeSvc) -
TuneUp
Software GmbH - C:Program FilesTuneUp Utilities
2004WinStylerThemeSvc.exe
O23 - Service: BitDefender Virus Shield (VSSERV) - SOFTWIN S.R.L. -
C:Program FilesSoftwinBitDefender8vsserv.exe
O23 - Service: BitDefender Communicator (XCOMM) - Softwin - C:Program
FilesFichiers communsSoftwinBitDefender Communicatorxcommsvr.exe






--
http://www.microsoft.com/france/technet/virtuallab.mspx
Ceci est une signature automatique de MesNews.
Site : http://www.mesnews.net
Cdlt@+ à tous

Bonjour *j@ckie* :

Claude LaFrenière a formulé la demande :
[...]

... sinon envoie le log d'HJT ici.

Salut l'ami Claude ;-) Bien amic@lement à toi l-) m@mie
Voilà son log
Merci Madame.

:)


--
Claude LaFrenière [MVP] :-{)
courriel: http://viadresse.com?39135017
http://climenole.serendipia.net/

«My Principal Design Was To Inform, Not To Amuse Thee.»
Lemuel Gulliver, The Travels (IV:12)

Bonjour *j@ckie* :

Claude LaFrenière a formulé la demande :
[...]

... sinon envoie le log d'HJT ici.

Salut l'ami Claude ;-) Bien amic@lement à toi l-) m@mie
Voilà son log > Logfile of HijackThis v1.99.1
Scan saved at 11:14:49, on 08/12/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:WINDOWSSystem32smss.exe
C:WINDOWSsystem32winlogon.exe
C:WINDOWSsystem32services.exe
C:WINDOWSsystem32lsass.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSSystem32svchost.exe
C:WINDOWSsystem32spoolsv.exe
C:WINDOWSExplorer.EXE
C:WINDOWSSystem32GEARSec.exe
C:Program FilesSymantecNorton GhostAgentPQV2iSvc.exe
C:Program FilesSoftwinBitDefender8bdmcon.exe
C:Program FilesSoftwinBitDefender8bdoesrv.exe
C:Program FilesSagem - Utilitaire pour Clé Wi-Fi USB
802.11bWlanUtility.exe
C:WINDOWSsystem32pctspk.exe
C:WINDOWSSystem32svchost.exe
C:Program FilesFichiers communsSoftwinBitDefender
Communicatorxcommsvr.exe
C:Program FilesFichiers communsSoftwinBitDefender Scan
Serverbdss.exe
C:PROGRA~1EUROBA~1erobar.exe
C:Program FilesBonjourmDNSResponder.exe
C:Program FilesSoftwinBitDefender8vsserv.exe
C:Program FilesHijack thisHijackThis.exe

R0 - HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page > http://www.ogame.fr/
R0 - HKCUSoftwareMicrosoftInternet ExplorerMain,Local Page > R0 - HKLMSoftwareMicrosoftInternet ExplorerMain,Local Page > R1 - HKCUSoftwareMicrosoftWindowsCurrentVersionInternet
Settings,ProxyOverride = local.,
R0 - HKCUSoftwareMicrosoftInternet ExplorerToolbar,LinksFolderName

Liens
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} -

C:PROGRA~1SPYBOT~1SDHelper.dll
O2 - BHO: Google Toolbar Helper -
{AA58ED58-01DD-4d91-8333-CF10577473F7} -
c:program filesgooglegoogletoolbar1.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} -
C:WINDOWSSystem32msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} -
c:program
filesgooglegoogletoolbar1.dll
O4 - HKLM..Run: [BDMCon] C:Program
FilesSoftwinBitDefender8bdmcon.exe
O4 - HKLM..Run: [BDOESRV] C:Program
FilesSoftwinBitDefender8bdoesrv.exe
O4 - Startup: Eurobarre.lnk = C:Program Fileseurobarreeb.exe
O4 - Global Startup: Sagem - Utilitaire pour Clé Wi-Fi USB.lnk = ?
O8 - Extra context menu item: &Traduire à partir de l'anglais -
res://C:Program FilesGoogleGoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Pages liées - res://C:Program
FilesGoogleGoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Pages similaires - res://C:Program
FilesGoogleGoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Recherche &Google - res://C:Program
FilesGoogleGoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Version de la page actuelle disponible
dans le
cache Google - res://C:Program
FilesGoogleGoogleToolbar1.dll/cmcache.html
O10 - Unknown file in Winsock LSP: c:program filesbonjourmdnsnsp.dll
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient
Class) -
http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine
Advantage
Validation Tool) - http://go.microsoft.com/fwlink/?linkid9204
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags
Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class)
-
http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1127765804801
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient
Class) -
http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF}
(MsnMessengerSetupDownloadControl Class) -
http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) -
http://messenger.zone.msn.com/binary/ZIntro.cab32846.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} -
"C:PROGRA~1MSNMES~1msgrapp.dll" (file missing)
O20 - AppInit_DLLs: sockspy.dll sockspy.dll sockspy.dll sockspy.dll
sockspy.dll sockspy.dll sockspy.dll sockspy.dll
O23 - Service: BitDefender Scan Server (bdss) - Unknown owner -
C:Program
FilesFichiers communsSoftwinBitDefender Scan Serverbdss.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Computer, Inc.
-
C:Program FilesBonjourmDNSResponder.exe
O23 - Service: GEARSecurity - GEAR Software -
C:WINDOWSSystem32GEARSec.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision
Corporation - C:Program FilesFichiers
communsInstallShieldDriver11Intel 32IDriverT.exe
O23 - Service: Norton Ghost - Symantec Corporation - C:Program
FilesSymantecNorton GhostAgentPQV2iSvc.exe
O23 - Service: PCTEL Speaker Phone (Pctspk) - PCtel, Inc. -
C:WINDOWSsystem32pctspk.exe
O23 - Service: PDEngine - Raxco Software, Inc. - C:Program
FilesRaxcoPerfectDiskPDEngine.exe
O23 - Service: PDScheduler (PDSched) - Raxco Software, Inc. -
C:Program
FilesRaxcoPerfectDiskPDSched.exe
O23 - Service: TuneUp WinStyler Theme Service (TUWinStylerThemeSvc) -
TuneUp
Software GmbH - C:Program FilesTuneUp Utilities
2004WinStylerThemeSvc.exe
O23 - Service: BitDefender Virus Shield (VSSERV) - SOFTWIN S.R.L. -
C:Program FilesSoftwinBitDefender8vsserv.exe
O23 - Service: BitDefender Communicator (XCOMM) - Softwin - C:Program
FilesFichiers communsSoftwinBitDefender Communicatorxcommsvr.exe

Refaire un scan avec HJT, cocher les lignes suivantes et faire un FIX.

C:PROGRA~1EUROBA~1erobar.exe

O4 - Startup: Eurobarre.lnk = C:Program Fileseurobarreeb.exe

O20 - AppInit_DLLs: sockspy.dll sockspy.dll sockspy.dll sockspy.dllsockspy.dll sockspy.dll sockspy.dll sockspy.dll

À lire :
http://climenole.serendipia.net/archives/17-Securite-et-Windows-XP-revisitee....html

et ça tant qu'à y être:
http://climenole.serendipia.net/archives/16-Entretien-Preventif.html

:)
--
Claude LaFrenière [MVP] :-{)
courriel: http://viadresse.com?39135017
http://climenole.serendipia.net/

«My Principal Design Was To Inform, Not To Amuse Thee.»
Lemuel Gulliver, The Travels (IV:12)