rapport hijackthis aide merci

Drog- · le 16 juillet 2008

voila je met mon rapports ici j aimerais savoir ce qui va pas merci d avance.

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 20:53:33, on 16/07/2008

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16574)

Boot mode: Normal

Running processes:

I:\WINDOWS\System32\smss.exe

I:\WINDOWS\system32\csrss.exe

I:\WINDOWS\system32\winlogon.exe

I:\WINDOWS\system32\services.exe

I:\WINDOWS\system32\lsass.exe

I:\WINDOWS\system32\svchost.exe

I:\WINDOWS\System32\svchost.exe

I:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe

I:\WINDOWS\Explorer.EXE

I:\WINDOWS\system32\spoolsv.exe

I:\program files\powerstrip\pstrip.exe

I:\Program Files\Home Cinema\PowerCinema\PCMService.exe

I:\WINDOWS\VM_STI.EXE

I:\Program Files\a-squared Anti-Malware\a2guard.exe

I:\WINDOWS\system32\ctfmon.exe

I:\program files\valve\steam\steam.exe

I:\Program Files\Google\Google Updater\GoogleUpdater.exe

I:\Program Files\a-squared Anti-Malware\a2service.exe

I:\Program Files\AntiVir PersonalEdition Classic\sched.exe

I:\Program Files\AntiVir PersonalEdition Classic\avguard.exe

I:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe

I:\WINDOWS\System32\FTRTSVC.exe

I:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

I:\WINDOWS\system32\nvsvc32.exe

I:\WINDOWS\system32\oodag.exe

I:\WINDOWS\system32\PnkBstrA.exe

I:\WINDOWS\System32\svchost.exe

I:\WINDOWS\System32\alg.exe

I:\Program Files\MSN Messenger\usnsvc.exe

I:\Program Files\Internet Explorer\IEXPLORE.EXE

I:\Program Files\WinRAR\WinRAR.exe

I:\DOCUME~1\BENOIT~1\LOCALS~1\Temp\Rar$EX00.562\HijackThis.exe

I:\WINDOWS\System32\wbem\wmiprvse.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://google.icq.com/search/search_frame.php

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://google.icq.com

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://orange.fr/

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens

R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - I:\PROGRA~1\Wanadoo\SEARCH~1.DLL

R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - I:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx

O2 - BHO: (no name) - {140BD8E3-C167-11D4-B4A3-080000180323} - (no file)

O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - I:\PROGRA~1\SPYBOT~1\SDHelper.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - I:\Program Files\Java\jre1.6.0_05\bin\ssv.dll

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - i:\program files\google\googletoolbar1.dll

O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - I:\Program Files\Google\GoogleToolbarNotifier\2.1.615.5858\swg.dll

O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - i:\program files\google\googletoolbar1.dll

O4 - HKLM\..\Run: [unlockerAssistant] "I:\Program Files\Unlocker\UnlockerAssistant.exe"

O4 - HKLM\..\Run: [PowerStrip] i:\program files\powerstrip\pstrip.exe

O4 - HKLM\..\Run: [PCMService] "I:\Program Files\Home Cinema\PowerCinema\PCMService.exe"

O4 - HKLM\..\Run: [OODefragTray] I:\WINDOWS\system32\oodtray.exe

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE I:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [Microsoft Corporation Svchost Service] mssvc.exe

O4 - HKLM\..\Run: [MessengerPlus3] "I:\Program Files\MessengerPlus! 3\MsgPlus.exe"

O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k

O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd

O4 - HKLM\..\Run: [bigDogPath] I:\WINDOWS\VM_STI.EXE ZSMC USB PC Camera

O4 - HKLM\..\Run: [{7147f2b1-74f9-82c9-6bdd-49be6cbfe9fb}] I:\WINDOWS\System32\Rundll32.exe "I:\WINDOWS\system32\kcjzxnuekosgnnaxj.dll" DllStart

O4 - HKLM\..\Run: [a-squared] "I:\Program Files\a-squared Anti-Malware\a2guard.exe" /d=60

O4 - HKLM\..\RunServices: [Microsoft Corporation Svchost Service] mssvc.exe

O4 - HKCU\..\Run: [ctfmon.exe] I:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [swg] I:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

O4 - HKCU\..\Run: [steam] "i:\program files\valve\steam\steam.exe" -silent

O4 - HKCU\..\Run: [Orb] "I:\Program Files\Winamp Remote\bin\OrbTray.exe" /background

O4 - HKCU\..\Run: [msnmsgr] "I:\Program Files\MSN Messenger\MsnMsgr.Exe" /background

O4 - HKCU\..\Run: [Microsoft Corporation Svchost Service] mssvc.exe

O4 - HKCU\..\RunServices: [Microsoft Corporation Svchost Service] mssvc.exe

O4 - Global Startup: InstantTimeZone.lnk = I:\Program Files\InstantTimeZone\InstantTimeZone.exe

O4 - Global Startup: Outil de mise à jour Google.lnk = I:\Program Files\Google\Google Updater\GoogleUpdater.exe

O8 - Extra context menu item: &ICQ Toolbar Search - res://I:\Program Files\ICQToolbar\toolbaru.dll/SEARCH.HTML

O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - I:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - I:\Program Files\Messenger\msmsgs.exe

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - I:\Program Files\Java\jre1.6.0_05\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - I:\Program Files\Java\jre1.6.0_05\bin\ssv.dll

O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - I:\WINDOWS\bdoscandel.exe

O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - I:\WINDOWS\bdoscandel.exe

O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - I:\Program Files\ICQLite\ICQLite.exe (file missing)

O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - I:\Program Files\ICQLite\ICQLite.exe (file missing)

O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - I:\Program Files\ICQ6\ICQ.exe

O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - I:\Program Files\ICQ6\ICQ.exe

O9 - Extra button: Orange - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - http://www.orange.fr (file missing) (HKCU)

O10 - Broken Internet access because of LSP provider 'i:\program files\bonjour\mdnsnsp.dll' missing

O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - I:\Program Files\Yahoo!\Common\yinsthelper.dll

O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.zebulon.fr/scan8/oscan8.cab

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupd...b?1215792905944

O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2005111...all/xscan53.cab

O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab

O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} - http://game08.zylom.com/activex/zylomgamesplayer.cab

O16 - DPF: {D0C0F75C-683A-4390-A791-1ACFD5599AB8} (Oberon Flash Game Host) - http://jeuxentelechargement.orange.fr/Game...ronGameHost.cab

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc...ash/swflash.cab

O20 - AppInit_DLLs: SF3.DLL

O23 - Service: a-squared Anti-Malware Service (a2AntiMalware) - Emsi Software GmbH - I:\Program Files\a-squared Anti-Malware\a2service.exe

O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - I:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe

O23 - Service: AntiVir Scheduler (AntiVirScheduler) - H+BEDV Datentechnik GmbH - I:\Program Files\AntiVir PersonalEdition Classic\sched.exe

O23 - Service: AntiVir PersonalEdition Classic Service (AntiVirService) - H+BEDV Datentechnik GmbH - I:\Program Files\AntiVir PersonalEdition Classic\avguard.exe

O23 - Service: Application Driver Auto Removal Service (01) (appdrvrem01) - Protection Technology - I:\WINDOWS\System32\appdrvrem01.exe

O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - I:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe

O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - I:\Program Files\Fichiers communs\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe

O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - I:\WINDOWS\System32\FTRTSVC.exe

O23 - Service: Google Updater Service (gusvc) - Google - I:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - I:\WINDOWS\system32\nvsvc32.exe

O23 - Service: O&O Defrag - O&O Software GmbH - I:\WINDOWS\system32\oodag.exe

O23 - Service: PnkBstrA - Unknown owner - I:\WINDOWS\system32\PnkBstrA.exe

O23 - Service: SiSoftware Database Agent Service (SandraDataSrv) - SiSoftware - I:\Program Files\SiSoftware\SiSoftware Sandra Lite XIIc\Win32\RpcDataSrv.exe

O23 - Service: SiSoftware Sandra Agent Service (SandraTheSrv) - SiSoftware - I:\Program Files\SiSoftware\SiSoftware Sandra Lite XIIc\RpcSandraSrv.exe

O23 - Service: X10 Device Network Service (x10nets) - X10 - I:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe

--

End of file - 9824 bytes

guigui14100 · le 16 juillet 2008

Salut

Envoi ce fichier sur virus total et colle le rapport stp

I:\WINDOWS\system32\kcjzxnuekosgnnaxj.dll

http://www.virustotal.com/fr/

AVG antispyware est dépasé il me semble qui n'y a plus de mise a jour

Fait un scan avec malwarebytes antimalware

http://malwarebytes.org/mbam.php

Désinstalle les toolbars, il ne serve a rien.

Citation
The unsafe files using this name are associated with the malware group NGV.Some files using the name MSSVC.EXE are also associated with the malware groups:

* Trojan.Vundo

* Downloader.Small.27.AE

Tu es infecté utilise vundofix http://www.atribune.org/ccount/click.php?id=4

Citation
* Double-click VundoFix.exe to run it.
* When VundoFix opens, click the Scan for Vundo button.

* Once it's done scanning, click the Remove Vundo button.

* You will receive a prompt asking if you want to remove the files, click YES

* Once you click yes, your desktop will go blank as it starts removing Vundo.

* When completed, it will prompt that it will reboot your computer, click OK.

Modifié le 16 juillet 2008 par guigui14100

Drog- · le 17 juillet 2008

merci de ta réponse je te poste le rapport avec virus total :

Fichier kcjzxnuekosgnnaxj.dll reçu le 2008.07.17 18:22:52 (CET)

Situation actuelle: en cours de chargement ... mis en file d'attente en attente en cours d'analyse terminé NON TROUVE ARRETE

Résultat: 1/31 (3.23%)

Antivirus Version Dernière mise à jour Résultat

AhnLab-V3 2008.7.17.0 2008.07.17 -

AntiVir 7.8.0.68 2008.07.17 -

Authentium 5.1.0.4 2008.07.16 -

Avast 4.8.1195.0 2008.07.17 -

AVG 8.0.0.130 2008.07.17 -

BitDefender 7.2 2008.07.17 -

CAT-QuickHeal 9.50 2008.07.17 -

ClamAV 0.93.1 2008.07.17 -

DrWeb 4.44.0.09170 2008.07.17 -

eSafe 7.0.17.0 2008.07.17 -

eTrust-Vet 31.6.5962 2008.07.17 -

Ewido 4.0 2008.07.17 -

F-Prot 4.4.4.56 2008.07.16 -

F-Secure 7.60.13501.0 2008.07.17 -

Fortinet 3.14.0.0 2008.07.17 -

GData 2.0.7306.1023 2008.07.17 -

Ikarus T3.1.1.34.0 2008.07.17 -

Kaspersky 7.0.0.125 2008.07.17 -

McAfee 5340 2008.07.16 -

Microsoft 1.3704 2008.07.17 -

NOD32v2 3276 2008.07.17 -

Norman 5.80.02 2008.07.16 -

Panda 9.0.0.4 2008.07.16 -

Prevx1 V2 2008.07.17 Malicious Software

Rising 20.53.32.00 2008.07.17 -

Sophos 4.31.0 2008.07.17 -

Sunbelt 3.1.1536.1 2008.07.17 -

TheHacker 6.2.96.381 2008.07.16 -

TrendMicro 8.700.0.1004 2008.07.17 -

VirusBuster 4.5.11.0 2008.07.17 -

Webwasher-Gateway 6.6.2 2008.07.17 -

Information additionnelle

File size: 158208 bytes

MD5...: 6c792f798f11b23a4379c18b363aac8f

SHA1..: 6fb4e7851b74a59289843ea985b842ec6637d61a

SHA256: ba94bc7531733b81fe8a0ed5869eb07d44ae3badc38a520d87a07606a04e94ed

SHA512: a0a483b4801ba16429ca5e93707a9d08eb65c98e0f5e8727c96063b0c620be77

4e6eebbc1b58b34500b1e40a9975ab66aeb6e3bad1ec2f8ece0a7d7e63c5fbe5

PEiD..: -

PEInfo: PE Structure information

( base data )

entrypointaddress.: 0x1000fe28

timedatestamp.....: 0x4871fd0d (Mon Jul 07 11:25:01 2008)

machinetype.......: 0x14c (I386)

( 5 sections )

name viradd virsiz rawdsiz ntrpy md5

.text 0x1000 0x1cc7e 0x1ce00 6.60 ead23f93499418c785aeea3c5b66d47c

.rdata 0x1e000 0x597d 0x5a00 5.30 89d79eadbeac3f10587de7a028e2ceae

.data 0x24000 0x3440 0x1400 3.74 a7ec6e13a846f6fcad6597f26741b779

.rsrc 0x28000 0x370 0x400 4.63 688f151042092891e7221d464b5ef6a3

.reloc 0x29000 0x240c 0x2600 4.61 45e4e57064c8b358d43a641d1b1fb46d

( 9 imports )

> RPCRT4.dll: UuidToStringW, RpcStringFreeW

> VERSION.dll: VerQueryValueW, GetFileVersionInfoW, GetFileVersionInfoSizeW

> imagehlp.dll: MapAndLoad, UnMapAndLoad

> SHLWAPI.dll: SHSetValueW, StrStrIW, UrlEscapeW, StrCmpIW, SHDeleteKeyW

> KERNEL32.dll: GetStringTypeW, GetStringTypeA, LCMapStringA, GetLocaleInfoA, GetConsoleMode, GetConsoleCP, lstrlenW, CloseHandle, SetEvent, CreateProcessW, GetProcAddress, LoadLibraryW, ExitThread, WaitForSingleObject, CreateThread, CreateEventW, OpenProcess, Sleep, CreateMutexW, GetSystemTime, GlobalFree, GlobalAlloc, LocalFree, LocalAlloc, InterlockedIncrement, InterlockedDecrement, lstrcmpW, GetModuleFileNameW, SystemTimeToFileTime, GetLocalTime, LoadLibraryA, ExpandEnvironmentStringsW, WideCharToMultiByte, MultiByteToWideChar, GetTempFileNameW, GetTickCount, GetEnvironmentVariableW, VirtualQuery, GetVolumeInformationW, GetWindowsDirectoryW, GetSystemInfo, SetFilePointer, HeapSize, HeapReAlloc, VirtualAlloc, EnterCriticalSection, LeaveCriticalSection, GetSystemTimeAsFileTime, GetCurrentProcessId, QueryPerformanceCounter, VirtualFree, HeapDestroy, HeapCreate, GetEnvironmentStringsW, FreeEnvironmentStringsW, GetEnvironmentStrings, FreeEnvironmentStringsA, DeleteCriticalSection, GetStartupInfoA, GetFileType, SetHandleCount, ExitProcess, LCMapStringW, IsValidCodePage, GetOEMCP, GetACP, GetCPInfo, InitializeCriticalSectionAndSpinCount, SetStdHandle, WriteConsoleA, GetConsoleOutputCP, WriteConsoleW, CreateFileA, FlushFileBuffers, FreeLibrary, GetModuleFileNameA, GetStdHandle, WriteFile, GetModuleHandleA, SetLastError, TlsFree, TlsSetValue, TlsAlloc, TlsGetValue, GetModuleHandleW, HeapAlloc, HeapFree, GetLastError, GetCommandLineA, GetCurrentThreadId, RtlUnwind, RaiseException, TerminateProcess, GetCurrentProcess, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsDebuggerPresent

> USER32.dll: GetWindowTextW, EnumChildWindows, RealGetWindowClassW, CallWindowProcW, SetWindowLongW, SetPropW, SetWindowPos, SetActiveWindow, PostMessageW, SetCursorPos, GetWindowThreadProcessId, GetPropW, SendInput, SetWindowTextW, EnumWindows, GetSystemMetrics, GetWindowInfo, GetWindowRect, TranslateMessage, PeekMessageW, RemovePropW, DispatchMessageW, GetCursorPos, GetClassNameW, SendMessageW, MsgWaitForMultipleObjects

> ADVAPI32.dll: CryptGenRandom, CryptCreateHash, CryptHashData, CryptGetHashParam, CryptDestroyHash, CryptAcquireContextW, CryptReleaseContext, RegQueryValueExW, RegCreateKeyW, RegDeleteValueW, RegOpenKeyExW, RegSetValueExW, RegCloseKey

> ole32.dll: CoCreateInstance, CoInitializeEx, CoTaskMemFree, CoUninitialize

> OLEAUT32.dll: -, -, -, -, -, -, -, -, -, -, -

( 5 exports )

DllCanUnloadNow, DllGetClassObject, DllRegisterServer, DllStart, DllUnregisterServer

Prevx info: http://info.prevx.com/aboutprogramtext.asp...A58E60047BE53FD

angelique · le 17 juillet 2008

il a reposté là http://forum.zebulon.fr/mon-rapport-hijact...80#entry1254580

je lui ai donné qlqs consignes pour qu'il te poste ses rapport ici , guigui14100 \o_

Vu l'absence de O2&O20 y'a p't être du Vundo en plus ; MP si besoin d'aide , fait lui DL :

Télécharge combofix.exe (par sUBs) et sauvegarde le sur ton bureau en le renommant dans la fenetre d'enregistrement par Combo-Fix

http://download.bleepingcomputer.com/sUBs/ComboFix.exe

* Double-clique combofix.exe afin de l'exécuter et suis les instructions.

* Lorsque l'analyse sera complétée, un rapport apparaîtra que tu me posteras.

* Si le fichier n'apparait pas, il se trouve ici > C:\ComboFix.txt

ou MBAM http://www.malekal.com/tutorial_MalwareBytes_AntiMalware.php

Drog- · le 17 juillet 2008

[ok merci v essaye tous se que tu ma dit et désolé pour le doublon

Modifié le 17 juillet 2008 par angelique
tu fais ce qui est dit sur ton sujet Fermé avant!!

Drog- · le 17 juillet 2008

[REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\services]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupfolder]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupfolder\I:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Microsoft Office.lnk]

"path"="I:\\Documents and Settings\\All Users\\Menu Démarrer\\Programmes\\Démarrage\\Microsoft Office.lnk"

"backup"="I:\\WINDOWS\\pss\\Microsoft Office.lnkCommon Startup"

"location"="Common Startup"

"command"="I:\\PROGRA~1\\MICROS~3\\Office\\OSA9.EXE -b -l"

"item"="Microsoft Office"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\!AVG Anti-Spyware]