[Résolu] Trojan gen avec Avast

tea4one · le 5 mars 2007

Par contre, en utilisant killbox, je n'arrive apparemment pas à supprimer car à la fin de la manip, j'ai le message "PendingFile RenameOperating Data has been Removed by External Process " J'avais oublié de le preciser dans les posts precedents.

Malekal_morte · le 6 mars 2007

- Télécharge Vundoxfix de Atribune - mirror si le lien ne fonctionne pas : http://www.softpedia.com/get/Antivirus/VundoFix.shtml

- Double-clique VundoFix.exe afin de le lancer.

- Clique sur le bouton Scan for Vundo.

- Lorsque le scan est complété, clique sur le bouton Remove Vundo.

- Une invite te demandera si tu veux supprimer les fichiers, clique YES

- Après avoir cliqué "Yes", le Bureau disparaîtra un moment lors de la suppression des fichiers.

- Tu verras une invite qui t'annonce que ton PC va s'éteindre ("shutdown") ; clique OK

- Démarre ton PC à nouveau.

- Copie/colle le contenu du rapport situé dans C:\vundofix.txt ainsi qu'un nouveau rapport HiJackThis! dans ta prochaine réponse.

tea4one · le 6 mars 2007

Ci joint rapport vundofix. Quand j'ai cliqué sur remove à la fin de l'analyse, je n'ai pas eu de message me demandant si je voulais effacer les fichiers0. J'ai du fermer manuellement vundo et redemarrer manuellement le pc. Est ce normal? Toujours la meme alerte au redemarrage du pc

VundoFix V6.3.12

Checking Java version...

Java version is 1.5.0.6

Old versions of java are exploitable and should be removed.

Scan started at 22:37:41 06/03/2007

Listing files found while scanning....

C:\WINDOWS\system32\awttuut.dll

C:\WINDOWS\system32\gebxvst.dll

C:\WINDOWS\system32\hggdcby.dll

C:\WINDOWS\system32\hggghhf.dll

C:\WINDOWS\system32\ljjigde.dll

C:\WINDOWS\system32\mlnmp.bak1

C:\WINDOWS\system32\mlnmp.bak2

C:\WINDOWS\system32\mlnmp.ini

C:\WINDOWS\system32\opnmjge.dll

C:\WINDOWS\system32\pmnlm.dll

C:\WINDOWS\system32\pmnlmlj.dll

C:\WINDOWS\system32\ssqooon.dll

C:\WINDOWS\system32\ssqromj.dll

C:\WINDOWS\system32\urqqpoo.dll

C:\WINDOWS\system32\vturqrr.dll

C:\WINDOWS\system32\vtussrq.dll

C:\WINDOWS\system32\wvusqpq.dll

C:\WINDOWS\system32\yayxywt.dll

Beginning removal...

Logfile of HijackThis v1.99.1

Scan saved at 00:04:21, on 07/03/2007

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16414)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\System32\Ati2evxx.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\System32\xpmsserv.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\Program Files\Securitoo\av_fw\fswsclds.exe

C:\Program Files\Eset\nod32krn.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\AGRSMMSG.exe

C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe

C:\WINDOWS\system32\ezSP_Px.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Program Files\Eset\nod32kui.exe

C:\Program Files\SlySoft\AnyDVD\AnyDVD.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Documents and Settings\PHILIPPE\Mes documents\Logiciels\INTERNET\HiJackThis\hijackthis\Hijackthis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens

O3 - Toolbar: (no name) - {ACB1E670-3217-45C4-A021-6B829A8A27CB} - (no file)

O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll

O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll

O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll

O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar5.dll

O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe

O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe

O4 - HKLM\..\Run: [ezShieldProtector for Px] C:\WINDOWS\system32\ezSP_Px.exe

O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE

O4 - HKLM\..\Run: [2chkdsk] rundll32.exe "C:\WINDOWS\system32\uovckguu.dll",setvm

O4 - HKCU\..\Run: [AnyDVD] C:\Program Files\SlySoft\AnyDVD\AnyDVD.exe

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O8 - Extra context menu item: &eBay Search - res://C:\Program Files\eBay\eBay Toolbar2\eBayTb.dll/RCSearch.html

O8 - Extra context menu item: &Recherche AOL Toolbar - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML

O8 - Extra context menu item: &Traduire à partir de l'anglais - res://C:\Program Files\Google\GoogleToolbar2.dll/cmwordtrans.html

O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm

O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx

O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000

O8 - Extra context menu item: Pages liées - res://C:\Program Files\Google\GoogleToolbar2.dll/cmbacklinks.html

O8 - Extra context menu item: Pages similaires - res://C:\Program Files\Google\GoogleToolbar2.dll/cmsimilar.html

O8 - Extra context menu item: Recherche &Google - res://C:\Program Files\Google\GoogleToolbar2.dll/cmsearch.html

O8 - Extra context menu item: Version de la page actuelle disponible dans le cache Google - res://C:\Program Files\Google\GoogleToolbar2.dll/cmcache.html

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll

O9 - Extra button: Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll

O9 - Extra 'Tools' menuitem: &Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL

O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)

O9 - Extra button: Ajouter un Pop-Up - {DE39E849-A37D-4126-8AE1-1551364ADA96} - C:\Program Files\VoissaNoPubs\VoissaNoPubs.exe (file missing)

O9 - Extra 'Tools' menuitem: Tools Menu Item - {DE39E849-A37D-4126-8AE1-1551364ADA96} - C:\Program Files\VoissaNoPubs\VoissaNoPubs.exe (file missing)

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE

O11 - Options group: [iNTERNATIONAL] International*

O14 - IERESET.INF: START_PAGE_URL=http://www.unika.com

O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab

O16 - DPF: {0246ECA8-996F-11D1-BE2F-00A0C9037DFE} (TDServer Control) - http://www.encyclo.wanadoo.fr/JS/tdserver.cab

O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/...nst20040510.cab

O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by104fd.bay104.hotmail.msn.com/resources/MsnPUpld.cab

O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.safety.live.com/resource/d...wlscbase969.cab

O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2005111...all/xscan53.cab

O16 - DPF: {80DD2229-B8E4-4C77-B72F-F22972D723EA} (AvxScanOnline Control) - http://www.inoculer.com/antivirus/Msie/bitdefender.cab

O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab31267.cab

O16 - DPF: {8EB3FF4E-86A1-4717-884D-7BA2D38272CB} (F-Secure Online Scanner) - http://www.securitoo.com/fra/pages/navol/fscax.cab

O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab

O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMesse...pDownloader.cab

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc...ash/swflash.cab

O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/Solit...wn.cab31267.cab

O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL

O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL

O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Fichiers communs\Microsoft Shared\Help\hxds.dll

O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL

O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\FICHIE~1\MICROS~1\OFFICE12\MSOXMLMF.DLL

O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll

O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe

O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe

O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe

O23 - Service: F-Secure Windows Security Center Legacy Detection Service (Fswsclds) - F-Secure Corporation - C:\Program Files\Securitoo\av_fw\fswsclds.exe

O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe

O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe

O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe

O23 - Service: XPMSService - Unknown owner - C:\WINDOWS\System32\xpmsserv.exe

Malekal_morte · le 7 mars 2007

Sur HijackThis, coche cette ligne :

O4 - HKLM\..\Run: [2chkdsk] rundll32.exe "C:\WINDOWS\system32\uovckguu.dll",setvm

--> clic sur fix checked

Redémarre l'ordinateur

Supprime si existant : C:\WINDOWS\system32\uovckguu.dll

Vas sur le site http://virusscan.jotti.org/

- Clic en haut à droite sur "Parcourir", navigue dans les dossiers et sélectionne ce fichier : C:\WINDOWS\System32\xpmsserv.exe

- Clic sur submit toujours en haut à droite

- Le scan va se lancer, ça va prendre un petit instant

- En bas, tu as le résultat du scan, copie/colle le résultat complet du scan ici - ATTENTION de bien prendre le résultat du scan de ton fichier (le nom du fichier apparaît en haut) et non le scan fait avant le tiens!

Aide : http://www.malekal.com/scan_Av_en_ligne.html#mozTocId662799

tea4one · le 7 mars 2007

J'ai reussi à executer vundofix

VundoFix V6.3.12

Checking Java version...

Java version is 1.5.0.6

Old versions of java are exploitable and should be removed.

Scan started at 22:37:41 06/03/2007

Listing files found while scanning....

C:\WINDOWS\system32\awttuut.dll

C:\WINDOWS\system32\gebxvst.dll

C:\WINDOWS\system32\hggdcby.dll

C:\WINDOWS\system32\hggghhf.dll

C:\WINDOWS\system32\ljjigde.dll

C:\WINDOWS\system32\mlnmp.bak1

C:\WINDOWS\system32\mlnmp.bak2

C:\WINDOWS\system32\mlnmp.ini

C:\WINDOWS\system32\opnmjge.dll

C:\WINDOWS\system32\pmnlm.dll

C:\WINDOWS\system32\pmnlmlj.dll

C:\WINDOWS\system32\ssqooon.dll

C:\WINDOWS\system32\ssqromj.dll

C:\WINDOWS\system32\urqqpoo.dll

C:\WINDOWS\system32\vturqrr.dll

C:\WINDOWS\system32\vtussrq.dll

C:\WINDOWS\system32\wvusqpq.dll

C:\WINDOWS\system32\yayxywt.dll

Beginning removal...

VundoFix V6.3.12

Checking Java version...

Java version is 1.5.0.6

Old versions of java are exploitable and should be removed.

Scan started at 00:15:32 07/03/2007

Listing files found while scanning....

VundoFix V6.3.12

Checking Java version...

Java version is 1.5.0.6

Old versions of java are exploitable and should be removed.

Scan started at 00:16:23 07/03/2007

Listing files found while scanning....

VundoFix V6.3.12

Checking Java version...

Java version is 1.5.0.6

Old versions of java are exploitable and should be removed.

Scan started at 06:19:10 07/03/2007

Listing files found while scanning....

VundoFix V6.3.12

Checking Java version...

Java version is 1.5.0.6

Old versions of java are exploitable and should be removed.

Scan started at 18:27:00 07/03/2007

Listing files found while scanning....

C:\WINDOWS\system32\awttuut.dll

C:\WINDOWS\system32\gebxvst.dll

C:\WINDOWS\system32\hggdcby.dll

C:\WINDOWS\system32\hggghhf.dll

C:\WINDOWS\system32\ljjigde.dll

C:\WINDOWS\system32\mlnmp.bak1

C:\WINDOWS\system32\mlnmp.bak2

C:\WINDOWS\system32\mlnmp.ini

C:\WINDOWS\system32\opnmjge.dll

C:\WINDOWS\system32\pmnlm.dll

C:\WINDOWS\system32\pmnlmlj.dll

C:\WINDOWS\system32\ssqooon.dll

C:\WINDOWS\system32\ssqromj.dll

C:\WINDOWS\system32\urqqpoo.dll

C:\WINDOWS\system32\vturqrr.dll

C:\WINDOWS\system32\vtussrq.dll

C:\WINDOWS\system32\wvusqpq.dll

C:\WINDOWS\system32\yayxywt.dll

Beginning removal...

Attempting to delete C:\WINDOWS\system32\awttuut.dll

C:\WINDOWS\system32\awttuut.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\gebxvst.dll

C:\WINDOWS\system32\gebxvst.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\hggdcby.dll

C:\WINDOWS\system32\hggdcby.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\hggghhf.dll

C:\WINDOWS\system32\hggghhf.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\ljjigde.dll

C:\WINDOWS\system32\ljjigde.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\mlnmp.bak1

C:\WINDOWS\system32\mlnmp.bak1 Has been deleted!

Attempting to delete C:\WINDOWS\system32\mlnmp.bak2

C:\WINDOWS\system32\mlnmp.bak2 Has been deleted!

Attempting to delete C:\WINDOWS\system32\mlnmp.ini

C:\WINDOWS\system32\mlnmp.ini Has been deleted!

Attempting to delete C:\WINDOWS\system32\opnmjge.dll

C:\WINDOWS\system32\opnmjge.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\pmnlm.dll

C:\WINDOWS\system32\pmnlm.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\pmnlmlj.dll

C:\WINDOWS\system32\pmnlmlj.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\ssqooon.dll

C:\WINDOWS\system32\ssqooon.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\ssqromj.dll

C:\WINDOWS\system32\ssqromj.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\urqqpoo.dll

C:\WINDOWS\system32\urqqpoo.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\vturqrr.dll

C:\WINDOWS\system32\vturqrr.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\vtussrq.dll

C:\WINDOWS\system32\vtussrq.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\wvusqpq.dll

C:\WINDOWS\system32\wvusqpq.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\yayxywt.dll

C:\WINDOWS\system32\yayxywt.dll Has been deleted!

Performing Repairs to the registry.

Done!

tea4one · le 7 mars 2007

Ci-joint log hijackthis apres execution reussie de vundofix

Logfile of HijackThis v1.99.1

Scan saved at 19:23:51, on 07/03/2007

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16414)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\System32\Ati2evxx.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\System32\xpmsserv.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\AGRSMMSG.exe

C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe

C:\WINDOWS\system32\ezSP_Px.exe

C:\Program Files\Eset\nod32kui.exe

C:\Program Files\SlySoft\AnyDVD\AnyDVD.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Securitoo\av_fw\fswsclds.exe

C:\Program Files\Eset\nod32krn.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\WINDOWS\system32\wuauclt.exe

C:\WINDOWS\system32\NOTEPAD.EXE

C:\Documents and Settings\PHILIPPE\Mes documents\Logiciels\INTERNET\HiJackThis\hijackthis\Hijackthis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens

O2 - BHO: (no name) - {00684ED4-C757-4C25-A64E-E2430C49D06B} - C:\WINDOWS\system32\pmnlm.dll (file missing)

O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

O2 - BHO: (no name) - {64F56FC1-1272-44CD-BA6E-39723696E350} - (no file)

O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar5.dll

O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll

O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll