Analyse de Rapport Hijack suite à Virus

[Jamesson]

Bonjour,

 

 

Mon avast détecte un virus, mais je ne suis pas expert en analyse de rapport de Hijack. Si quelqu'un peut apporter ses lumières sur son analyse du rapport je le remercie.

 

Merci de vos conseils.

 

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 19:28:56, on 11/11/2009

Platform: Windows Vista SP2 (WinNT 6.00.1906)

MSIE: Internet Explorer v7.00 (7.00.6002.18005)

Boot mode: Normal

 

Running processes:

C:\Windows\system32\Dwm.exe

C:\Windows\system32\taskeng.exe

C:\Windows\Explorer.EXE

C:\Windows\system32\taskeng.exe

C:\Windows\mHotkey.exe

C:\Windows\CDCtr.exe

C:\Windows\ModHidKey.exe

C:\Program Files\Windows Defender\MSASCui.exe

C:\Windows\RtHDVCpl.exe

C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe

C:\Program Files\Fingerprint Sensor\ATSwpNav.exe

C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe

C:\Program Files\Softex\OmniPass\scureapp.exe

C:\Program Files\Picasa2\PicasaMediaDetector.exe

C:\Program Files\Packard Bell\TVenhance\TVEService.exe

C:\Program Files\Alwil Software\Avast4\ashDisp.exe

C:\Windows\System32\rundll32.exe

C:\Program Files\Common Files\Real\Update_OB\realsched.exe

C:\Windows\WindowsMobile\wmdSync.exe

C:\Program Files\Java\jre6\bin\jusched.exe

C:\Windows\ehome\ehtray.exe

C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe

C:\Program Files\Packard Bell\SetUpMyPC\SmpSys.exe

C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

C:\Windows\ehome\ehmsas.exe

C:\Program Files\Windows Media Player\wmpnscfg.exe

C:\Windows\system32\wbem\unsecapp.exe

C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\CPSHelpRunner.exe

C:\Documents and Settings\Ced\Downloads\HiJackThis.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Program Files\Mozilla Firefox\firefox.exe

 

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.ustart.org

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://format.packardbell.com/cgi-bin/redi...amp;key=IESTART

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.ustart.org

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

O1 - Hosts: ::1 localhost

O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)

O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll

O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide

O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe

O4 - HKLM\..\Run: [iAAnotif] "C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe"

O4 - HKLM\..\Run: [LchMHotkey] LchMHKey.exe

O4 - HKLM\..\Run: [ATSwpNav] "C:\Program Files\Fingerprint Sensor\ATSwpNav" -run

O4 - HKLM\..\Run: [RoxWatchTray] "C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe"

O4 - HKLM\..\Run: [OmniPass] C:\Program Files\Softex\OmniPass\scureapp.exe

O4 - HKLM\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe

O4 - HKLM\..\Run: [TVEService] "C:\Program Files\Packard Bell\TVenhance\TVEService.exe"

O4 - HKLM\..\Run: [toolbar_eula_launcher] C:\Program Files\Packard Bell\GOOGLE_EULA\EULALauncher.exe

O4 - HKLM\..\Run: [EPSON Stylus DX3800 Series] C:\Windows\system32\spool\DRIVERS\W32X86\3\E_FATIACE.EXE /F "C:\Windows\TEMP\E_S5B20.tmp" /EF "HKLM"

O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"

O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot

O4 - HKLM\..\Run: [Windows Mobile-based device management] %windir%\WindowsMobile\wmdSync.exe

O4 - HKLM\..\Run: [skytel] Skytel.exe

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"

O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe

O4 - HKCU\..\Run: [iSUSPM] "C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" -scheduler

O4 - HKCU\..\Run: [smpcSys] C:\Program Files\Packard Bell\SetUpMyPC\SmpSys.exe

O4 - HKCU\..\Run: [spybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

O4 - HKCU\..\Run: [devconf] C:\Users\Ced\AppData\Roaming\DeviceMetadataStore\conf.pif

O4 - HKUS\S-1-5-19\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')

O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')

O4 - HKUS\S-1-5-20\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')

O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe

O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O13 - Gopher Prefix:

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc...ash/swflash.cab

O17 - HKLM\System\CCS\Services\Tcpip\..\{1353BFF7-D1E0-47FD-8387-988AEA757D79}: NameServer = 212.27.53.252,212.27.54.252

O17 - HKLM\System\CCS\Services\Tcpip\..\{8DB1A33D-6261-4157-9003-2E444BB3D209}: NameServer = 212.27.53.252,212.27.54.252

O17 - HKLM\System\CCS\Services\Tcpip\..\{BB24A1A0-EDB5-45DD-8846-002EC667EA6E}: NameServer = 192.168.0.1

O17 - HKLM\System\CS1\Services\Tcpip\..\{1353BFF7-D1E0-47FD-8387-988AEA757D79}: NameServer = 212.27.53.252,212.27.54.252

O17 - HKLM\System\CS2\Services\Tcpip\..\{1353BFF7-D1E0-47FD-8387-988AEA757D79}: NameServer = 212.27.53.252,212.27.54.252

O17 - HKLM\System\CS4\Services\Tcpip\..\{1353BFF7-D1E0-47FD-8387-988AEA757D79}: NameServer = 212.27.53.252,212.27.54.252

O17 - HKLM\System\CS5\Services\Tcpip\..\{1353BFF7-D1E0-47FD-8387-988AEA757D79}: NameServer = 212.27.53.252,212.27.54.252

O17 - HKLM\System\CS6\Services\Tcpip\..\{1353BFF7-D1E0-47FD-8387-988AEA757D79}: NameServer = 212.27.53.252,212.27.54.252

O17 - HKLM\System\CS7\Services\Tcpip\..\{1353BFF7-D1E0-47FD-8387-988AEA757D79}: NameServer = 212.27.53.252,212.27.54.252

O17 - HKLM\System\CS8\Services\Tcpip\..\{1353BFF7-D1E0-47FD-8387-988AEA757D79}: NameServer = 212.27.53.252,212.27.54.252

O17 - HKLM\System\CS9\Services\Tcpip\..\{1353BFF7-D1E0-47FD-8387-988AEA757D79}: NameServer = 212.27.53.252,212.27.54.252

O17 - HKLM\System\CS10\Services\Tcpip\..\{1353BFF7-D1E0-47FD-8387-988AEA757D79}: NameServer = 212.27.53.252,212.27.54.252

O17 - HKLM\System\CS11\Services\Tcpip\..\{1353BFF7-D1E0-47FD-8387-988AEA757D79}: NameServer = 212.27.53.252,212.27.54.252

O17 - HKLM\System\CS12\Services\Tcpip\..\{1353BFF7-D1E0-47FD-8387-988AEA757D79}: NameServer = 212.27.53.252,212.27.54.252

O17 - HKLM\System\CS13\Services\Tcpip\..\{1353BFF7-D1E0-47FD-8387-988AEA757D79}: NameServer = 212.27.53.252,212.27.54.252

O17 - HKLM\System\CS14\Services\Tcpip\..\{1353BFF7-D1E0-47FD-8387-988AEA757D79}: NameServer = 212.27.53.252,212.27.54.252

O17 - HKLM\System\CS15\Services\Tcpip\..\{1353BFF7-D1E0-47FD-8387-988AEA757D79}: NameServer = 212.27.53.252,212.27.54.252

O17 - HKLM\System\CS16\Services\Tcpip\..\{1353BFF7-D1E0-47FD-8387-988AEA757D79}: NameServer = 212.27.53.252,212.27.54.252

O17 - HKLM\System\CS17\Services\Tcpip\..\{1353BFF7-D1E0-47FD-8387-988AEA757D79}: NameServer = 212.27.53.252,212.27.54.252

O17 - HKLM\System\CS18\Services\Tcpip\..\{1353BFF7-D1E0-47FD-8387-988AEA757D79}: NameServer = 212.27.53.252,212.27.54.252

O17 - HKLM\System\CS19\Services\Tcpip\..\{1353BFF7-D1E0-47FD-8387-988AEA757D79}: NameServer = 212.27.53.252,212.27.54.252

O17 - HKLM\System\CS20\Services\Tcpip\..\{1353BFF7-D1E0-47FD-8387-988AEA757D79}: NameServer = 212.27.53.252,212.27.54.252

O17 - HKLM\System\CS21\Services\Tcpip\..\{1353BFF7-D1E0-47FD-8387-988AEA757D79}: NameServer = 212.27.53.252,212.27.54.252

O17 - HKLM\System\CS22\Services\Tcpip\..\{1353BFF7-D1E0-47FD-8387-988AEA757D79}: NameServer = 212.27.53.252,212.27.54.252

O17 - HKLM\System\CS23\Services\Tcpip\..\{1353BFF7-D1E0-47FD-8387-988AEA757D79}: NameServer = 212.27.53.252,212.27.54.252

O17 - HKLM\System\CS24\Services\Tcpip\..\{1353BFF7-D1E0-47FD-8387-988AEA757D79}: NameServer = 212.27.53.252,212.27.54.252

O17 - HKLM\System\CS25\Services\Tcpip\..\{1353BFF7-D1E0-47FD-8387-988AEA757D79}: NameServer = 212.27.53.252,212.27.54.252

O17 - HKLM\System\CS26\Services\Tcpip\..\{1353BFF7-D1E0-47FD-8387-988AEA757D79}: NameServer = 212.27.53.252,212.27.54.252

O17 - HKLM\System\CS27\Services\Tcpip\..\{1353BFF7-D1E0-47FD-8387-988AEA757D79}: NameServer = 212.27.53.252,212.27.54.252

O17 - HKLM\System\CS28\Services\Tcpip\..\{1353BFF7-D1E0-47FD-8387-988AEA757D79}: NameServer = 212.27.53.252,212.27.54.252

O17 - HKLM\System\CS29\Services\Tcpip\..\{1353BFF7-D1E0-47FD-8387-988AEA757D79}: NameServer = 212.27.53.252,212.27.54.252

O17 - HKLM\System\CS30\Services\Tcpip\..\{1353BFF7-D1E0-47FD-8387-988AEA757D79}: NameServer = 212.27.53.252,212.27.54.252

O17 - HKLM\System\CS31\Services\Tcpip\..\{1353BFF7-D1E0-47FD-8387-988AEA757D79}: NameServer = 212.27.53.252,212.27.54.252

O17 - HKLM\System\CS32\Services\Tcpip\..\{1353BFF7-D1E0-47FD-8387-988AEA757D79}: NameServer = 212.27.53.252,212.27.54.252

O17 - HKLM\System\CS33\Services\Tcpip\..\{1353BFF7-D1E0-47FD-8387-988AEA757D79}: NameServer = 212.27.53.252,212.27.54.252

O17 - HKLM\System\CS34\Services\Tcpip\..\{1353BFF7-D1E0-47FD-8387-988AEA757D79}: NameServer = 212.27.53.252,212.27.54.252

O17 - HKLM\System\CS35\Services\Tcpip\..\{1353BFF7-D1E0-47FD-8387-988AEA757D79}: NameServer = 212.27.53.252,212.27.54.252

O17 - HKLM\System\CS36\Services\Tcpip\..\{1353BFF7-D1E0-47FD-8387-988AEA757D79}: NameServer = 212.27.53.252,212.27.54.252

O17 - HKLM\System\CS37\Services\Tcpip\..\{1353BFF7-D1E0-47FD-8387-988AEA757D79}: NameServer = 212.27.53.252,212.27.54.252

O17 - HKLM\System\CS38\Services\Tcpip\..\{1353BFF7-D1E0-47FD-8387-988AEA757D79}: NameServer = 212.27.53.252,212.27.54.252

O17 - HKLM\System\CS39\Services\Tcpip\..\{1353BFF7-D1E0-47FD-8387-988AEA757D79}: NameServer = 212.27.53.252,212.27.54.252

O17 - HKLM\System\CS40\Services\Tcpip\..\{1353BFF7-D1E0-47FD-8387-988AEA757D79}: NameServer = 212.27.53.252,212.27.54.252

O17 - HKLM\System\CS41\Services\Tcpip\..\{1353BFF7-D1E0-47FD-8387-988AEA757D79}: NameServer = 212.27.53.252,212.27.54.252

O17 - HKLM\System\CS42\Services\Tcpip\..\{1353BFF7-D1E0-47FD-8387-988AEA757D79}: NameServer = 212.27.53.252,212.27.54.252

O17 - HKLM\System\CS43\Services\Tcpip\..\{1353BFF7-D1E0-47FD-8387-988AEA757D79}: NameServer = 212.27.53.252,212.27.54.252

O17 - HKLM\System\CS44\Services\Tcpip\..\{1353BFF7-D1E0-47FD-8387-988AEA757D79}: NameServer = 212.27.53.252,212.27.54.252

O17 - HKLM\System\CS45\Services\Tcpip\..\{1353BFF7-D1E0-47FD-8387-988AEA757D79}: NameServer = 212.27.53.252,212.27.54.252

O17 - HKLM\System\CS46\Services\Tcpip\..\{1353BFF7-D1E0-47FD-8387-988AEA757D79}: NameServer = 212.27.53.252,212.27.54.252

O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe

O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe

O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe

O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe

O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe

O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: Hexago Gateway6 Client (gw6c) - Hexago, Inc. - C:\Program Files\Hexago\Gateway6 Client\gw6c.exe

O23 - Service: Intel® Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe

O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe

O23 - Service: Nero BackItUp Scheduler 4.0 - Nero AG - C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe

O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe

O23 - Service: Softex OmniPass Service (omniserv) - Softex Inc. - C:\Program Files\Softex\OmniPass\OmniServ.exe

O23 - Service: PACSPTISVR - Unknown owner - C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe

O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe

O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared files\RichVideo.exe

O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe

O23 - Service: Roxio Hard Drive Watcher 9 (RoxWatch9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe

O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe

O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe

O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe

O23 - Service: SonicStage Back-End Service - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SsBeSvc.exe

O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe

O23 - Service: SrvCDEject - Unknown owner - C:\Program Files\Packard Bell\SrvCDEject.exe

O23 - Service: SonicStage SCSI Service (SSScsiSV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SSScsiSV.exe

O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe

O23 - Service: TVEnhance Background Capture Service (TBCS) (TVECapSvc) - Unknown owner - C:\Program Files\Packard Bell\TVenhance\Kernel\TV\TVECapSvc.exe

O23 - Service: TVEnhance Task Scheduler (TTS)) (TVESched) - Unknown owner - C:\Program Files\Packard Bell\TVenhance\Kernel\TV\TVESched.exe

O23 - Service: X10 Device Network Service (x10nets) - X10 - C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe

 

--

End of file - 15612 bytes

Modifié le 11 novembre 2009 par Jamesson