<https://forum.zebulon.fr/topic/80101-probleme-trojan-trojzlob-bc/#comment-612852>
<http://schema.org/text>
"merci pour vos reponses \n  \nvoila une copie de la page de virusscan \n  \nFile to upload &amp; scan:            \nService   \nService load:  0%        100%   \n  \nFile:  msctl32.dll   \nStatus:  INFECTED/MALWARE (Note: this file has been scanned before. Therefore, this file's scan results will not be stored in the database)   \nMD5  f51d46dbac0702e0295da25d0e32f83a   \nPackers detected:  -  \nScanner results   \nAntiVir  Found nothing  \nArcaVir  Found nothing  \nAvast  Found nothing  \nAVG Antivirus  Found nothing  \nBitDefender  Found nothing  \nClamAV  Found nothing  \nDr.Web  Found Trojan.MailSpam   \nF-Prot Antivirus  Found nothing  \nFortinet  Found nothing  \nKaspersky Anti-Virus  Found nothing  \nNOD32  Found nothing  \nNorman Virus Control  Found nothing  \nUNA  Found nothing  \nVBA32  Found nothing  \n  \nPowered by   \n  \nDisclaimer   \nThis service is by no means 100% safe. If this scanner says 'OK', it does not necessarily mean the file is clean. There could be a whole new virus on the loose. NEVER EVER rely on one single product only, not even this service, even though it utilizes several products. Therefore, We cannot and will not be held responsible for any damage caused by results presented by this non-profit online service.  \n  \nAlso, we are aware of the implications of a setup like this. We are sure this whole thing is by no means scientifically correct, since this is a fully automated service (although manual correction is possible). We are aware, in spite of efforts to proactively counter these, false positives might occur, for example. We do not consider this a very big issue, so please do not e-mail us about it. This is a simple online scan service, not the university of Wichita.  \n  \nScanning can take a while, since several scanners are being used, plus the fact some scanners use very high levels of (time consuming) heuristics. Scanners used are Linux versions, differences with Windows scanners may or may not occur. Another note: some scanners will only report one virus when scanning archives with multiple pieces of malware. \n  \nVirus definitions are updated every hour. There is a 15Mb limit per file. Please refrain from uploading tons of hex-edited or repacked variants of the same sample.  \n  \nPlease do not ask for viruses uploaded here, unless you work for an anti-virus vendor. They are not for trade. This is a legitimate service, not a VX site. Viruses uploaded here will be distributed to antivirus vendors without exception.  \n  \nSponsored by donations (in random order) from: Stormbyte Technologies LLC, The ClamAV project, James Love, Gideon Pertzov, Malcolm Murray, Nigel Thomas, Wendy Dickerson, Anthony Midmore, \"ethereal\", Mark Rubins, Steve S., Eric Johansen, Eric Schechter, Paul Bokel, Wilders Security, Wilfried Lilie, Prevx, SonicWALL, Lance Mueller, Ewido networks, and some people who prefer to remain anonymous... many thanks to all!   \n  \nStatistics   \nLast file scanned at least one scanner reported something about: nrb7.exe, detected by: \n  \nScanner  Malware name   \nAntiVir  X   \nArcaVir  X   \nAvast  Win32:NucRat   \nAVG Antivirus  X   \nBitDefender  X   \nClamAV  X   \nDr.Web  DLOADER.Trojan   \nF-Prot Antivirus  X   \nFortinet  X   \nKaspersky Anti-Virus  X   \nNOD32  probably unknown NewHeur_PE   \nNorman Virus Control  X   \nUNA  X   \nVBA32  Backdoor.Delf.226 (paranoid heuristics)   \n  \n  \nYou're free to (mis)interpret these automated, flawed statistics at your own discretion. For antivirus comparisons, visit AV comparatives \nWe are not affiliated with any third parties that conduct tests using this service. \n  \nApres avoir suivi toutes tes instructions voila le resultat \n  \nLogfile of HijackThis v1.99.1 \nScan saved at 02:09:30, on 20/11/2005 \nPlatform: Windows XP SP2 (WinNT 5.01.2600) \nMSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) \n  \nRunning processes: \nC:\\WINDOWS\\System32\\smss.exe \nC:\\WINDOWS\\system32\\winlogon.exe \nC:\\WINDOWS\\system32\\services.exe \nC:\\WINDOWS\\system32\\lsass.exe \nC:\\WINDOWS\\system32\\svchost.exe \nC:\\WINDOWS\\System32\\svchost.exe \nC:\\WINDOWS\\system32\\spoolsv.exe \nC:\\PROGRA~1\\Grisoft\\AVG7\\avgamsvr.exe \nC:\\PROGRA~1\\Grisoft\\AVG7\\avgupsvc.exe \nC:\\WINDOWS\\system32\\drivers\\CDAC11BA.EXE \nC:\\WINDOWS\\system32\\cisvc.exe \nC:\\Program Files\\Sony\\MD Simple Burner\\NetMDSB.exe \nC:\\WINDOWS\\system32\\nvsvc32.exe \nC:\\WINDOWS\\System32\\snmp.exe \nC:\\WINDOWS\\System32\\svchost.exe \nC:\\WINDOWS\\Explorer.EXE \nC:\\PROGRA~1\\Grisoft\\AVG7\\avgcc.exe \nC:\\PROGRA~1\\Grisoft\\AVG7\\avgemc.exe \nC:\\Program Files\\UnH Solutions\\IE Privacy Keeper\\IEPrivacyKeeper.exe \nC:\\PROGRA~1\\Sony\\SONICS~1\\SsAAD.exe \nC:\\WINDOWS\\system32\\rundll32.exe \nC:\\Program Files\\InterVideo\\Common\\Bin\\WinCinemaMgr.exe \nC:\\Program Files\\Adobe\\Acrobat 7.0\\Reader\\reader_sl.exe \nC:\\Program Files\\HijackThis\\HijackThis.exe \n  \nR0 - HKCU\\Software\\Microsoft\\Internet Explorer\\Main,Start Page = http://www.google.fr/ \nR0 - HKCU\\Software\\Microsoft\\Internet Explorer\\Main,Local Page =  \nR0 - HKCU\\Software\\Microsoft\\Internet Explorer\\Toolbar,LinksFolderName = Liens \nO2 - BHO: IE Privacy Keeper - Last IE Window Detector - {1201333E-BAD9-481C-BCF5-6904498CF85B} - C:\\Program Files\\UnH Solutions\\IE Privacy Keeper\\IEPKbho.dll \nO2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\\PROGRA~1\\SPYBOT~1\\SDHelper.dll \nO2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\\program files\\google\\googletoolbar1.dll \nO2 - BHO: NTIECatcher Class - {C56CB6B0-0D96-11D6-8C65-B2868B609932} - C:\\Program Files\\Xi\\NetTransport 2\\NTIEHelper.dll \nO3 - Toolbar: &amp;Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\\program files\\google\\googletoolbar1.dll \nO4 - HKLM\\..\\Run: [AVG7_CC] C:\\PROGRA~1\\Grisoft\\AVG7\\avgcc.exe /STARTUP \nO4 - HKLM\\..\\Run: [AVG7_EMC] C:\\PROGRA~1\\Grisoft\\AVG7\\avgemc.exe \nO4 - HKLM\\..\\Run: [NvCplDaemon] RUNDLL32.EXE C:\\WINDOWS\\system32\\NvCpl.dll,NvStartup \nO4 - HKLM\\..\\Run: [nwiz] nwiz.exe /install \nO4 - HKLM\\..\\Run: [NeroCheck] C:\\WINDOWS\\system32\\\\NeroCheck.exe \nO4 - HKLM\\..\\Run: [iE Privacy Keeper] \"C:\\Program Files\\UnH Solutions\\IE Privacy Keeper\\IEPrivacyKeeper.exe\" -stcleanup \nO4 - HKLM\\..\\Run: [ssAAD.exe] C:\\PROGRA~1\\Sony\\SONICS~1\\SsAAD.exe \nO4 - HKLM\\..\\Run: [NvMediaCenter] RUNDLL32.EXE C:\\WINDOWS\\system32\\NvMcTray.dll,NvTaskbarInit \nO4 - HKCU\\..\\Run: [skype] \"C:\\Program Files\\Skype\\Phone\\Skype.exe\" /nosplash /minimized \nO4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\\Program Files\\InterVideo\\Common\\Bin\\WinCinemaMgr.exe \nO4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\\Program Files\\Adobe\\Acrobat 7.0\\Reader\\reader_sl.exe \nO8 - Extra context menu item: &amp;Traduire à partir de l'anglais - res://C:\\Program Files\\Google\\GoogleToolbar1.dll/cmwordtrans.html \nO8 - Extra context menu item: Pages liées - res://C:\\Program Files\\Google\\GoogleToolbar1.dll/cmbacklinks.html \nO8 - Extra context menu item: Pages similaires - res://C:\\Program Files\\Google\\GoogleToolbar1.dll/cmsimilar.html \nO8 - Extra context menu item: Recherche &amp;Google - res://C:\\Program Files\\Google\\GoogleToolbar1.dll/cmsearch.html \nO8 - Extra context menu item: Version de la page actuelle disponible dans le cache Google - res://C:\\Program Files\\Google\\GoogleToolbar1.dll/cmcache.html \nO9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\\Program Files\\Java\\jre1.5.0_04\\bin\\npjpi150_04.dll \nO9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\\Program Files\\Java\\jre1.5.0_04\\bin\\npjpi150_04.dll \nO9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\\Program Files\\Messenger\\msmsgs.exe \nO9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\\Program Files\\Messenger\\msmsgs.exe \nO10 - Hijacked Internet access by New.Net \nO10 - Hijacked Internet access by New.Net \nO10 - Hijacked Internet access by New.Net \nO10 - Hijacked Internet access by New.Net \nO10 - Hijacked Internet access by New.Net \nO16 - DPF: {09C21411-B9A2-4DE6-8416-4E3B58577BE0} (France Telecom MDM ActiveX Control) - http://minitelweb.minitel.com/imin_data/ocx/MDM.cab \nO17 - HKLM\\System\\CCS\\Services\\Tcpip\\..\\{86AA2B9E-CF0A-4726-B74B-7AEBFFD8F5ED}: NameServer = 80.10.246.1,80.10.246.136 \nO17 - HKLM\\System\\CCS\\Services\\Tcpip\\..\\{8DF9C412-2384-44A1-ABEA-B074DF5532D9}: NameServer = 80.10.246.1,80.10.246.132 \nO23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\\PROGRA~1\\Grisoft\\AVG7\\avgamsvr.exe \nO23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\\PROGRA~1\\Grisoft\\AVG7\\avgupsvc.exe \nO23 - Service: C-DillaCdaC11BA - Macrovision - C:\\WINDOWS\\system32\\drivers\\CDAC11BA.EXE \nO23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\\Program Files\\Fichiers communs\\InstallShield\\Driver\\1050\\Intel 32\\IDriverT.exe \nO23 - Service: MSCSPTISRV - Sony Corporation - C:\\Program Files\\Fichiers communs\\Sony Shared\\AVLib\\MSCSPTISRV.exe \nO23 - Service: MD Simple Burner Service (NetMDSB) - Sony Corporation - C:\\Program Files\\Sony\\MD Simple Burner\\NetMDSB.exe \nO23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\\WINDOWS\\system32\\nvsvc32.exe \nO23 - Service: PACSPTISVR - Sony Corporation - C:\\Program Files\\Fichiers communs\\Sony Shared\\AVLib\\PACSPTISVR.exe \nO23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\\Program Files\\Fichiers communs\\Sony Shared\\AVLib\\SPTISRV.exe \nO23 - Service: SonicStage SCSI Service (SSScsiSV) - Sony Corporation - C:\\Program Files\\Fichiers communs\\Sony Shared\\AVLib\\SSScsiSV.exe \n  \nmais j'ai toujours le meme probleme d'affichage(fond d'ecran bleu avec un cadre noir où \"spyware infection\" et ecrit suivi d'un texte en anglais qui me dit que windows a detecte un spyware et qu'il faut que je le supprime avec un anti spyware et patati et patata......) \n  \nimpossible de chager de fond d'ecran et impossible de trouver ce Troj/Zlob-BC pour le supprimer \n"
<https://forum.zebulon.fr/topic/80101-probleme-trojan-trojzlob-bc/>