Analyse rapport HIJACKTHIS

[frefranat]

Bonjour,

 

je souhaite l'interprétation d'un Helpeur pour analyser ce rapport.

dyndnsclient.exe et WPSScannerSvc.exe m'inquiètent.

 

Merci

 

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 11:53:13, on 03/08/09

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v8.00 (8.00.6001.18702)

Boot mode: Normal

 

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\COMODO\COMODO Internet

 

Security\cmdagent.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\Intel\WiFi\bin\S24EvMon.exe

C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Fichiers

 

communs\LogiShrd\LVMVFM\LVPrcSrv.exe

C:\Program Files\Avira\AntiVir Desktop\sched.exe

C:\Program Files\Avira\AntiVir Desktop\avguard.exe

C:\Program Files\Fichiers communs\Apple\Mobile Device

 

Support\bin\AppleMobileDeviceService.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\WINDOWS\system32\cisvc.exe

C:\WINDOWS\system32\crypserv.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Intel\WiFi\bin\EvtEng.exe

C:\Program Files\Flomerics\MicroStripes 7.5\License\lmgrd.exe

C:\Program Files\Flomerics\MicroStripes 7.5\License\lmgrd.exe

C:\Program Files\Java\jre6\bin\jqs.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\Fichiers

 

communs\LogiShrd\LVCOMSER\LVComSer.exe

C:\Program Files\Fichiers

 

communs\LogiShrd\LVCOMSER\LVComSer.exe

C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\Program Files\Fichiers

 

communs\Intel\WirelessCommon\RegSrvc.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\UltraVNC\WinVNC.exe

C:\Program Files\Viewpoint\Common\ViewpointService.exe

C:\Program Files\Intel\WiFi\bin\WLKeeper.exe

C:\Program Files\UltraVNC\WinVNC.exe

C:\WINDOWS\System32\wbem\wmiapsrv.exe

C:\WINDOWS\system32\rundll32.exe

C:\WINDOWS\stsystra.exe

C:\Program Files\Dell\QuickSet\quickset.exe

C:\WINDOWS\system32\RunDLL32.exe

C:\Program Files\Fichiers

 

communs\LogiShrd\LComMgr\Communications_Helper.exe

C:\Program Files\Logitech\QuickCam\Quickcam.exe

C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe

C:\Program Files\Brother\ControlCenter2\brctrcen.exe

C:\Program Files\Apoint\Apoint.exe

C:\Program Files\Intel\WiFi\bin\ZCfgSvc.exe

C:\Program Files\Fichiers

 

communs\Intel\WirelessCommon\iFrmewrk.exe

C:\Program Files\Notebook Hardware Control\nhc.exe

C:\WINDOWS\system32\rundll32.exe

C:\Program Files\Apoint\HidFind.exe

C:\Program Files\Apoint\Apntex.exe

C:\Program Files\Microsoft IntelliPoint\ipoint.exe

C:\Program Files\Avira\AntiVir Desktop\avgnt.exe

C:\WINDOWS\System32\wbem\unsecapp.exe

C:\Program Files\Java\jre6\bin\jusched.exe

C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe

C:\Program Files\Winamp\winampa.exe

C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe

C:\Program Files\Google\Google Desktop

 

Search\GoogleDesktop.exe

C:\Program Files\Microsoft IntelliPoint\dpupdchk.exe

C:\Program Files\COMODO\COMODO Internet Security\cfp.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Skype\Phone\Skype.exe

C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

C:\Program Files\Google\Google Desktop

 

Search\GoogleDesktop.exe

C:\Program Files\Fichiers

 

communs\Logishrd\LQCVFX\COCIManager.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Program Files\MagicDisc\MagicDisc.exe

C:\Program Files\Mozilla Thunderbird\thunderbird.exe

C:\Program Files\Skype\Plugin Manager\skypePM.exe

C:\WINDOWS\system32\cidaemon.exe

C:\WINDOWS\system32\rundll32.exe

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

 

R1 - HKCU\Software\Microsoft\Internet

 

Explorer\Main,Default_Page_URL = http://fr.msn.com/

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =

 

http://www.google.fr/

R1 - HKLM\Software\Microsoft\Internet

 

Explorer\Main,Default_Page_URL =

 

http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet

 

Explorer\Main,Default_Search_URL =

 

http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page

 

= http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =

 

http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title

 

= Windows Internet Explorer optimisé pour MSN

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet

 

Settings,ProxyOverride = *.local

R0 - HKCU\Software\Microsoft\Internet

 

Explorer\Toolbar,LinksFolderName = Liens

O2 - BHO: Aide pour le lien d'Adobe PDF Reader -

 

{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program

 

Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

O2 - BHO: QFX Software KeyScrambler -

 

{2B9F5787-88A5-4945-90E7-C4B18563BC5E} - C:\Program

 

Files\KeyScrambler\KeyScramblerIE.dll

O2 - BHO: RealPlayer Download and Record Plugin for Internet

 

Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} -

 

C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll

O2 - BHO: Spybot-S&D IE Protection -

 

{53707962-6F74-2D53-2644-206D7942484F} -

 

C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O2 - BHO: Programme d'aide de l'Assistant de connexion Windows

 

Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program

 

Files\Fichiers communs\Microsoft Shared\Windows

 

Live\WindowsLiveLogin.dll

O2 - BHO: Google Toolbar Notifier BHO -

 

{AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program

 

Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll

O2 - BHO: Java Plug-In 2 SSV Helper -

 

{DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program

 

Files\Java\jre6\bin\jp2ssv.dll

O2 - BHO: JQSIEStartDetectorImpl -

 

{E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program

 

Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE

 

C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet

O4 - HKLM\..\Run: [NVHotkey] rundll32.exe nvHotkey.dll,Start

O4 - HKLM\..\Run: [sigmatelSysTrayApp] stsystra.exe

O4 - HKLM\..\Run: [Dell QuickSet] C:\Program

 

Files\Dell\QuickSet\quickset.exe

O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe

 

NvMCTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Program

 

Files\Fichiers

 

communs\LogiShrd\LComMgr\Communications_Helper.exe"

O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "C:\Program

 

Files\Logitech\QuickCam\Quickcam.exe" /hide

O4 - HKLM\..\Run: [sSBkgdUpdate] "C:\Program Files\Fichiers

 

communs\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe"

 

-Embedding -boot

O4 - HKLM\..\Run: [PaperPort PTD] C:\Program

 

Files\ScanSoft\PaperPort\pptd40nt.exe

O4 - HKLM\..\Run: [indexSearch] C:\Program

 

Files\ScanSoft\PaperPort\IndexSearch.exe

O4 - HKLM\..\Run: [ControlCenter2.0] C:\Program

 

Files\Brother\ControlCenter2\brctrcen.exe /autorun

O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program

 

Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"

O4 - HKLM\..\Run: [intelZeroConfig] "C:\Program

 

Files\Intel\WiFi\bin\ZCfgSvc.exe"

O4 - HKLM\..\Run: [intelWireless] "C:\Program Files\Fichiers

 

communs\Intel\WirelessCommon\iFrmewrk.exe" /tf Intel Wireless

 

Tray

O4 - HKLM\..\Run: [WinVNC] "C:\Program

 

Files\UltraVNC\WinVNC.exe" -servicehelper

O4 - HKLM\..\Run: [NotebookHardwareControl] "C:\Program

 

Files\Notebook Hardware Control\nhc.exe" -quiet

O4 - HKLM\..\Run: [bluetoothAuthenticationAgent] rundll32.exe

 

bthprops.cpl,,BluetoothAuthenticationAgent

O4 - HKLM\..\Run: [intelliPoint] "C:\Program Files\Microsoft

 

IntelliPoint\ipoint.exe"

O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir

 

Desktop\avgnt.exe" /min

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program

 

Files\Java\jre6\bin\jusched.exe"

O4 - HKLM\..\Run: [Ad-Watch] C:\Program

 

Files\Lavasoft\Ad-Aware\AAWTray.exe

O4 - HKLM\..\Run: [WinampAgent] "C:\Program

 

Files\Winamp\winampa.exe"

O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers

 

communs\Real\Update_OB\realsched.exe" -osboot

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program

 

Files\QuickTime\QTTask.exe" -atboottime

O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program

 

Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup

O4 - HKLM\..\Run: [COMODO Internet Security] "C:\Program

 

Files\COMODO\COMODO Internet Security\cfp.exe" -h

O4 - HKCU\..\Run: [DellSupport]

 

"C:\PROGRA~1\DELLSU~1\DSAgnt.exe" /startup

O4 - HKCU\..\Run: [Vidalia] "C:\Program Files\Vidalia

 

Bundle\Vidalia\vidalia.exe"

O4 - HKCU\..\Run: [WengoPhoneNG] C:\Program

 

Files\WengoPhone\qtwengophone.exe -b

O4 - HKCU\..\Run: [ctfmon.exe]

 

C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [skype] "C:\Program

 

Files\Skype\Phone\Skype.exe" /nosplash /minimized

O4 - HKCU\..\Run: [spybotSD TeaTimer] C:\Program Files\Spybot

 

- Search & Destroy\TeaTimer.exe

O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE]

 

C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')

O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE]

 

C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE]

 

C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE]

 

C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')

O4 - Startup: DH-2009.MAF

O4 - Startup: Firefox.exe.lnk = C:\Program Files\Mozilla

 

Firefox\firefox.exe

O4 - Startup: MagicDisc.lnk = C:\Program

 

Files\MagicDisc\MagicDisc.exe

O4 - Startup: Thunderbird.lnk = ?

O4 - Global Startup: DYNDNSCLIENT.lnk = C:\Program

 

Files\darweb-dyndnsclient\dyndnsclient.exe

O8 - Extra context menu item: Add to Google Photos

 

Screensa&ver - res://C:\WINDOWS\system32\GPhotos.scr/200

O9 - Extra button: (no name) -

 

{5C106A59-CC3C-4caa-81A4-6D909B5ACE23} - C:\Program

 

Files\KeyScrambler\KeyScramblerIE.dll

O9 - Extra 'Tools' menuitem: &KeyScrambler... -

 

{5C106A59-CC3C-4caa-81A4-6D909B5ACE23} - C:\Program

 

Files\KeyScrambler\KeyScramblerIE.dll

O9 - Extra button: (no name) -

 

{DFB852A3-47F8-48C4-A200-58CAB36FD2A2} -

 

C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy

 

Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} -

 

C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O9 - Extra button: (no name) -

 

{e2e2dd38-d088-4134-82b7-f2ba38496583} -

 

C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 -

 

{e2e2dd38-d088-4134-82b7-f2ba38496583} -

 

C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger -

 

{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program

 

Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger -

 

{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program

 

Files\Messenger\msmsgs.exe

O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700}

 

(Windows Genuine Advantage Validation Tool) -

 

http://go.microsoft.com/fwlink/?linkid=39204

O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN

 

Photo Upload Tool) -

 

http://gfx2.mail.live.com/mail/w1/resources/MSNPUpld.cab

O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499}

 

(BDSCANONLINE Control) -

 

http://download.bitdefender.com/resources/scan8/oscan8.cab

O16 - DPF: {65FDEDF3-8ED9-4F5B-825E-18C2D44191A7}

 

(OneCCCtl Class) -

 

http://d.64.69.12.114.downloads.estara.com./as/OneCCDM.php?t

 

emplate=41001&sessionid=2024602669_88.170.136.13_2101&=&re

 

q=1226999376359OneCC.cab

O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61}

 

(HouseCall Control) -

 

http://a840.g.akamai.net/7/840/537/2005111...housecall.trend

 

micro.com/housecall/xscan53.cab

O16 - DPF: {E856B973-45FD-4559-8F82-EAB539144667} (Dell PC

 

Checkup Installer Control) -

 

http://pccheckup.dellfix.com/rel/41/install/gtdownde.cab

O17 -

 

HKLM\System\CCS\Services\Tcpip\..\{22F98C93-1E42-4F14-8F1D

 

-907E825648BA}: NameServer = 192.168.1.1

O17 -

 

HKLM\System\CS1\Services\Tcpip\..\{22F98C93-1E42-4F14-8F1D

 

-907E825648BA}: NameServer = 192.168.1.1

O17 -

 

HKLM\System\CS3\Services\Tcpip\..\{22F98C93-1E42-4F14-8F1D

 

-907E825648BA}: NameServer = 192.168.1.1

O18 - Protocol: skype4com -

 

{FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} -

 

C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL

O20 - AppInit_DLLs:

 

C:\PROGRA~1\Google\GO333C~1\GOEC62~1.DLL

 

%SystemRoot%\system32\guard32.dll

O23 - Service: Avira AntiVir Planificateur (AntiVirSchedulerService)

 

- Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe

O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH -

 

C:\Program Files\Avira\AntiVir Desktop\avguard.exe

O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program

 

Files\Fichiers communs\Apple\Mobile Device

 

Support\bin\AppleMobileDeviceService.exe

O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. -

 

C:\Program Files\Bonjour\mDNSResponder.exe

O23 - Service: COMODO Internet Security Helper Service

 

(cmdAgent) - COMODO - C:\Program Files\COMODO\COMODO

 

Internet Security\cmdagent.exe

O23 - Service: Crypkey License - Unknown owner -

 

C:\WINDOWS\SYSTEM32\crypserv.exe

O23 - Service: Intel® PROSet/Wireless Event Log (EvtEng) -

 

Intel® Corporation - C:\Program Files\Intel\WiFi\bin\EvtEng.exe

O23 - Service: Flomerics License Service - Macrovision

 

Corporation - C:\Program Files\Flomerics\MicroStripes

 

7.5\License\lmgrd.exe

O23 - Service: Google Desktop Manager 5.8.809.23506

 

(GoogleDesktopManager-092308-165331) - Google - C:\Program

 

Files\Google\Google Desktop Search\GoogleDesktop.exe

O23 - Service: Google Update Service (gupdate1c985d8e449ed10)

 

(gupdate1c985d8e449ed10) - Google Inc. - C:\Program

 

Files\Google\Update\GoogleUpdate.exe

O23 - Service: Google Software Updater (gusvc) - Google -

 

C:\Program Files\Google\Common\Google

 

Updater\GoogleUpdaterService.exe

O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. -

 

C:\Program Files\iPod\bin\iPodService.exe

O23 - Service: Java Quick Starter (JavaQuickStarterService) -

 

Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe

O23 - Service: Lavasoft Ad-Aware Service - Lavasoft -

 

C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe

O23 - Service: LVCOMSer - Logitech Inc. - C:\Program

 

Files\Fichiers communs\LogiShrd\LVCOMSER\LVComSer.exe

O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. -

 

C:\Program Files\Fichiers

 

communs\LogiShrd\LVMVFM\LVPrcSrv.exe

O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program

 

Files\Fichiers communs\LogiShrd\SrvLnch\SrvLnch.exe

O23 - Service: Ma-Config Service (maconfservice) - CybelSoft -

 

C:\Program Files\ma-config.com\maconfservice.exe

O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program

 

Files\Dell\QuickSet\NICCONFIGSVC.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA

 

Corporation - C:\WINDOWS\system32\nvsvc32.exe

O23 - Service: Intel® PROSet/Wireless Registry Service (RegSrvc)

 

- Intel® Corporation - C:\Program Files\Fichiers

 

communs\Intel\WirelessCommon\RegSrvc.exe

O23 - Service: Intel® PROSet/Wireless WiFi Service

 

(S24EventMonitor) - Intel® Corporation - C:\Program

 

Files\Intel\WiFi\bin\S24EvMon.exe

O23 - Service: uvnc_service - UltraVNC - C:\Program

 

Files\UltraVNC\WinVNC.exe

O23 - Service: Viewpoint Manager Service - Viewpoint Corporation

 

- C:\Program Files\Viewpoint\Common\ViewpointService.exe

O23 - Service: Intel® PROSet/Wireless SSO Service

 

(WLANKEEPER) - Intel® Corporation - C:\Program

 

Files\Intel\WiFi\bin\WLKeeper.exe

O23 - Service: WPS Scanner Service (WPSScannerSvc) - Skyhook

 

Wireless - C:\Program Files\Skyhook Wireless\Wi-Fi

 

Service\WPSScannerSvc.exe

 

--

End of file - 15170 bytes