Rapport Hijackthis

AarK · le 30 avril 2007

bonjour ! étant embété par avast qui revient toute les deux minutes à la charge avec : Win32:Horst-Hv j'ai suivi votre méthode merci d'avance de vos réponses

Rapport :

Logfile of HijackThis v1.99.1

Scan saved at 19:12:46, on 30/04/2007

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Intel\Wireless\Bin\EvtEng.exe

C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe

C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe

C:\Program Files\Alwil Software\Avast4\ashServ.exe

C:\Program Files\AlienGUIse\wbload.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\eHome\ehRecvr.exe

C:\WINDOWS\eHome\ehSched.exe

C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe

C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE

C:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE

C:\WINDOWS\system32\nvsvc32.exe

C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe

C:\PROGRA~1\NORTON~1\SPEEDD~1\nopdb.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe

C:\Program Files\Alwil Software\Avast4\ashWebSv.exe

C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9BE.EXE

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\ctfmon.exe

c:\progra~1\intern~1\iexplore.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\WINDOWS\system32\dllhost.exe

C:\Program Files\MSN Messenger\msnmsgr.exe

C:\WINDOWS\system32\NOTEPAD.EXE

C:\Program Files\Mozilla Firefox\firefox.exe

C:\DOCUME~1\Flo\LOCALS~1\Temp\52exinjs.a9.exe

C:\DOCUME~1\Flo\LOCALS~1\Temp\7exym50.a.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\DOCUME~1\Flo\LOCALS~1\Temp\46exgmreg18.exe

C:\Program Files\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.asus.com

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.asus.com

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

O4 - HKLM\..\Run: [.nvsvc] C:\WINDOWS\system\smss.exe /w

O4 - HKLM\..\Run: [\\POPABOX\EPSON Stylus CX3600 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9BE.EXE /P36 "\\POPABOX\EPSON Stylus CX3600 Series" /O6 "USB001" /M "Stylus CX3600"

O4 - HKCU\..\Run: [intra Scr] C:\DOCUME~1\Flo\APPLIC~1\RDRGRI~1\city sect.exe

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000

O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll

O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O14 - IERESET.INF: START_PAGE_URL=http://www.asus.com

O17 - HKLM\System\CCS\Services\Tcpip\..\{76E889A5-7E6A-4F14-A5EE-63F126470590}: NameServer = 192.168.1.1

O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL

O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL

O20 - Winlogon Notify: WB - C:\Program Files\AlienGUIse\fastload.dll

O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll

O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe

O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe

O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)

O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)

O23 - Service: Intel® PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe

O23 - Service: Service de l'iPod (iPod Service) - Unknown owner - C:\Program Files\iPod\bin\iPodService.exe (file missing)

O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe

O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

O23 - Service: Intel® PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe

O23 - Service: Intel® PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe

O23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\NORTON~1\SPEEDD~1\nopdb.exe

angelique · le 30 avril 2007

Je ne m'occuperais pas de toi mais pour faire avançer ton délire, un conseillé va suivre la suite !!

Télécharge SDFix(créé par AndyManchesta) et sauvegarde le sur ton Bureau.

http://downloads.andymanchesta.com/RemovalTools/SDFix.zip

Redémarre ton ordinateur en mode sans échec en suivant la procédure que voici :

* Redémarre ton ordinateur

* Après avoir entendu l'ordinateur biper lors du démarrage, mais avant que l'icône Windows apparaisse, tapote la touche F8 , F5 pour certains pc

* A la place du chargement normal de Windows, un menu avec différentes options devrait apparaître.

* Choisis la première option, pour exécuter Windows en mode sans échec, puis appuie sur "Entrée".

* Choisis ton compte.

Déroule la liste des instructions ci-dessous :

* En mode sans échec, fais un clic droit sur le fichier SDFix.zip et choisis extraire tout,

* Ouvre le dossier SDFix.exe qui vient d'être créé et double clique sur SDFix.exe pour lancer la decompression.

*lance c:\SDFix\SDFix.bat

* Appuie sur Y pour commencer le script.

* Il va supprimer les services de certains trojans, effectuera aussi quelques réparations du Registre et il te demandera d'appuyer sur une touche pour redémarrer.

* Appuie sur une touche pour redémarrer le PC.

* Ton système sera plus long pour redémarrer qu'à l'accoutumée car l'outil va continuer à s'exécuter et supprimer des fichiers.

* Après le chargement du Bureau, l'outil terminera son travail et affichera Finished.

* Appuie sur une touche pour finir l'exécution du script et charger les icônes de ton Bureau.

* Enfin, ouvre le dossier de SDFix sur ton Bureau et copie/colle le contenu du fichier Report.txt dans ta prochaine réponse sur le forum, avec un nouveau log Hijackthis !

N.B.: Le fichier SDFIX_README.htm (dans le dossier SDFix) contient la liste des malwares pris en compte par

AarK · le 1 mai 2007

bonjour voila le rapport merci d'avance :

SDFix: Version 1.81

Run by Flo - 01/05/2007 - 9:36:42,10

Microsoft Windows XP [version 5.1.2600]

Service Pack 2

Running From: C:\DOCUME~1\Flo\Bureau\SDFix\SDFix

Safe Mode:

Checking Services:

Restoring Windows Registry Values

Restoring Windows Default Hosts File

Rebooting...

Normal Mode:

Checking Files:

Below files will be copied to Backups folder then removed:

C:\WINDOWS\odbc.INI - Deleted

C:\WINDOWS\system\smss.exe - Deleted

Removing Temp Files

ADS Check:

Checking if ADS is attached to system32 Folder

C:\WINDOWS\system32

No streams found.

Checking if ADS is attached to svchost.exe

C:\WINDOWS\system32\svchost.exe

No streams found.

Final Check:

Remaining Services:

------------------

Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

"C:\\Program Files\\MSN Messenger\\msncall.exe"="C:\\Program Files\\MSN Messenger\\msncall.exe:*:Enabled:Windows Live Messenger 8.0 (Phone)"

"C:\\Program Files\\eMule\\EMULE.EXE"="C:\\Program Files\\eMule\\EMULE.EXE:*:Enabled:eMule"

"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"

"C:\\Program Files\\MSN Messenger\\livecall.exe"="C:\\Program Files\\MSN Messenger\\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"

"C:\\Program Files\\Microsoft Games\\Age of Empires II\\empires2.exe"="C:\\Program Files\\Microsoft Games\\Age of Empires II\\empires2.exe:*:Enabled:Age of Empires II"

"C:\\WINDOWS\\System32\\dplaysvr.exe"="C:\\WINDOWS\\System32\\dplaysvr.exe:*:Enabled:Microsoft DirectPlay Helper"

"C:\\Program Files\\Azureus\\Azureus.exe"="C:\\Program Files\\Azureus\\Azureus.exe:*:Enabled:Azureus"

"C:\\WINDOWS\\system32\\svchost.exe"="C:\\WINDOWS\\system32\\svchost.exe:*:Enabled:Microsoft Update"

"C:\\DOCUME~1\\Flo\\LOCALS~1\\Temp\\38exinjs.a4.exe"="C:\\DOCUME~1\\Flo\\LOCALS~1\\Temp\\38exinjs.a4.exe:*:Enabled:Microsoft Update"

"C:\\DOCUME~1\\Flo\\LOCALS~1\\Temp\\3exinjs.a4.exe"="C:\\DOCUME~1\\Flo\\LOCALS~1\\Temp\\3exinjs.a4.exe:*:Enabled:Microsoft Update"

"C:\\DOCUME~1\\Flo\\LOCALS~1\\Temp\\27exinjs.a4.exe"="C:\\DOCUME~1\\Flo\\LOCALS~1\\Temp\\27exinjs.a4.exe:*:Enabled:Microsoft Update"

"C:\\DOCUME~1\\Flo\\LOCALS~1\\Temp\\20exinjs.a4.exe"="C:\\DOCUME~1\\Flo\\LOCALS~1\\Temp\\20exinjs.a4.exe:*:Enabled:Microsoft Update"

"C:\\DOCUME~1\\Flo\\LOCALS~1\\Temp\\74exinjs.a4.exe"="C:\\DOCUME~1\\Flo\\LOCALS~1\\Temp\\74exinjs.a4.exe:*:Enabled:Microsoft Update"

"C:\\DOCUME~1\\Flo\\LOCALS~1\\Temp\exinjs.a4.exe"="C:\\DOCUME~1\\Flo\\LOCALS~1\\Temp\exinjs.a4.exe:*:Enabled:Microsoft Update"

"C:\\DOCUME~1\\Flo\\LOCALS~1\\Temp\\87exinjs.a4.exe"="C:\\DOCUME~1\\Flo\\LOCALS~1\\Temp\\87exinjs.a4.exe:*:Enabled:Microsoft Update"

"C:\\DOCUME~1\\Flo\\LOCALS~1\\Temp\\48exinjs.a4.exe"="C:\\DOCUME~1\\Flo\\LOCALS~1\\Temp\\48exinjs.a4.exe:*:Enabled:Microsoft Update"

"C:\\DOCUME~1\\Flo\\LOCALS~1\\Temp\\51exinjs.a4.exe"="C:\\DOCUME~1\\Flo\\LOCALS~1\\Temp\\51exinjs.a4.exe:*:Enabled:Microsoft Update"

"C:\\WINDOWS\\System32\\spool\\drivers\\W32X86\\3\\SAGENT4.EXE"="C:\\WINDOWS\\System32\\spool\\drivers\\W32X86\\3\\SAGENT4.EXE:*:Enabled:SAgent4"

"C:\\DOCUME~1\\Flo\\LOCALS~1\\Temp\\59exinjs.a4.exe"="C:\\DOCUME~1\\Flo\\LOCALS~1\\Temp\\59exinjs.a4.exe:*:Enabled:Microsoft Update"

"C:\\DOCUME~1\\Flo\\LOCALS~1\\Temp\\34exinjs.a4.exe"="C:\\DOCUME~1\\Flo\\LOCALS~1\\Temp\\34exinjs.a4.exe:*:Enabled:Microsoft Update"

"C:\\DOCUME~1\\Flo\\LOCALS~1\\Temp\\39exinjs.a4.exe"="C:\\DOCUME~1\\Flo\\LOCALS~1\\Temp\\39exinjs.a4.exe:*:Enabled:Microsoft Update"

"C:\\DOCUME~1\\Flo\\LOCALS~1\\Temp\\62exinjs.a4.exe"="C:\\DOCUME~1\\Flo\\LOCALS~1\\Temp\\62exinjs.a4.exe:*:Enabled:Microsoft Update"

"C:\\DOCUME~1\\Flo\\LOCALS~1\\Temp\\5exinjs.a4.exe"="C:\\DOCUME~1\\Flo\\LOCALS~1\\Temp\\5exinjs.a4.exe:*:Enabled:Microsoft Update"

"C:\\DOCUME~1\\Flo\\LOCALS~1\\Temp\\56exinjs.a4.exe"="C:\\DOCUME~1\\Flo\\LOCALS~1\\Temp\\56exinjs.a4.exe:*:Enabled:Microsoft Update"

"C:\\DOCUME~1\\Flo\\LOCALS~1\\Temp\\31exinjs.a4.exe"="C:\\DOCUME~1\\Flo\\LOCALS~1\\Temp\\31exinjs.a4.exe:*:Enabled:Microsoft Update"

"C:\\DOCUME~1\\Flo\\LOCALS~1\\Temp\\42exinjs.a4.exe"="C:\\DOCUME~1\\Flo\\LOCALS~1\\Temp\\42exinjs.a4.exe:*:Enabled:Microsoft Update"

"C:\\DOCUME~1\\Flo\\LOCALS~1\\Temp\\52exinjs.a4.exe"="C:\\DOCUME~1\\Flo\\LOCALS~1\\Temp\\52exinjs.a4.exe:*:Enabled:Microsoft Update"

"C:\\DOCUME~1\\Flo\\LOCALS~1\\Temp\\66exinjs.a8.exe"="C:\\DOCUME~1\\Flo\\LOCALS~1\\Temp\\66exinjs.a8.exe:*:Enabled:Microsoft Update"

"C:\\DOCUME~1\\Flo\\LOCALS~1\\Temp\\21exinjs.a8.exe"="C:\\DOCUME~1\\Flo\\LOCALS~1\\Temp\\21exinjs.a8.exe:*:Enabled:Microsoft Update"

"C:\\DOCUME~1\\Flo\\LOCALS~1\\Temp\\92exinjs.a8.exe"="C:\\DOCUME~1\\Flo\\LOCALS~1\\Temp\\92exinjs.a8.exe:*:Enabled:Microsoft Update"

"C:\\DOCUME~1\\Flo\\LOCALS~1\\Temp\\85exinjs.a8.exe"="C:\\DOCUME~1\\Flo\\LOCALS~1\\Temp\\85exinjs.a8.exe:*:Enabled:Microsoft Update"

"C:\\DOCUME~1\\Flo\\LOCALS~1\\Temp\\31exinjs.a9.exe"="C:\\DOCUME~1\\Flo\\LOCALS~1\\Temp\\31exinjs.a9.exe:*:Enabled:Microsoft Update"

"C:\\DOCUME~1\\Flo\\LOCALS~1\\Temp\\23exinjs.a9.exe"="C:\\DOCUME~1\\Flo\\LOCALS~1\\Temp\\23exinjs.a9.exe:*:Enabled:Microsoft Update"

"C:\\DOCUME~1\\Flo\\LOCALS~1\\Temp\\68exinjs.a9.exe"="C:\\DOCUME~1\\Flo\\LOCALS~1\\Temp\\68exinjs.a9.exe:*:Enabled:Microsoft Update"

"C:\\DOCUME~1\\Flo\\LOCALS~1\\Temp\exinjs.a9.exe"="C:\\DOCUME~1\\Flo\\LOCALS~1\\Temp\exinjs.a9.exe:*:Enabled:Microsoft Update"

"C:\\DOCUME~1\\Flo\\LOCALS~1\\Temp\\95exinjs.a9.exe"="C:\\DOCUME~1\\Flo\\LOCALS~1\\Temp\\95exinjs.a9.exe:*:Enabled:Microsoft Update"

"C:\\DOCUME~1\\Flo\\LOCALS~1\\Temp\\78exinjs.a9.exe"="C:\\DOCUME~1\\Flo\\LOCALS~1\\Temp\\78exinjs.a9.exe:*:Enabled:Microsoft Update"

"C:\\DOCUME~1\\Flo\\LOCALS~1\\Temp\\38exinjs.a9.exe"="C:\\DOCUME~1\\Flo\\LOCALS~1\\Temp\\38exinjs.a9.exe:*:Enabled:Microsoft Update"

"C:\\DOCUME~1\\Flo\\LOCALS~1\\Temp\\29exinjs.a9.exe"="C:\\DOCUME~1\\Flo\\LOCALS~1\\Temp\\29exinjs.a9.exe:*:Enabled:Microsoft Update"

"C:\\DOCUME~1\\Flo\\LOCALS~1\\Temp\\52exinjs.a9.exe"="C:\\DOCUME~1\\Flo\\LOCALS~1\\Temp\\52exinjs.a9.exe:*:Enabled:Microsoft Update"

"C:\\DOCUME~1\\Flo\\LOCALS~1\\Temp\\27exinjs.a9.exe"="C:\\DOCUME~1\\Flo\\LOCALS~1\\Temp\\27exinjs.a9.exe:*:Enabled:Microsoft Update"

"C:\\DOCUME~1\\Flo\\LOCALS~1\\Temp\\70exinjs.a9.exe"="C:\\DOCUME~1\\Flo\\LOCALS~1\\Temp\\70exinjs.a9.exe:*:Enabled:Microsoft Update"

"C:\\DOCUME~1\\Flo\\LOCALS~1\\Temp\\1exinjs.a9.exe"="C:\\DOCUME~1\\Flo\\LOCALS~1\\Temp\\1exinjs.a9.exe:*:Enabled:Microsoft Update"

"C:\\DOCUME~1\\Flo\\LOCALS~1\\Temp\\84exinjs.a9.exe"="C:\\DOCUME~1\\Flo\\LOCALS~1\\Temp\\84exinjs.a9.exe:*:Enabled:Microsoft Update"

"C:\\DOCUME~1\\Flo\\LOCALS~1\\Temp\\58exinjs.a9.exe"="C:\\DOCUME~1\\Flo\\LOCALS~1\\Temp\\58exinjs.a9.exe:*:Enabled:Microsoft Update"

"C:\\DOCUME~1\\Flo\\LOCALS~1\\Temp\\88exinjs.a9.exe"="C:\\DOCUME~1\\Flo\\LOCALS~1\\Temp\\88exinjs.a9.exe:*:Enabled:Microsoft Update"

"C:\\DOCUME~1\\Flo\\LOCALS~1\\Temp\\22exinjs.a9.exe"="C:\\DOCUME~1\\Flo\\LOCALS~1\\Temp\\22exinjs.a9.exe:*:Enabled:Microsoft Update"

"C:\\DOCUME~1\\Flo\\LOCALS~1\\Temp\\39exinjs.a9.exe"="C:\\DOCUME~1\\Flo\\LOCALS~1\\Temp\\39exinjs.a9.exe:*:Enabled:Microsoft Update"

"C:\\DOCUME~1\\Flo\\LOCALS~1\\Temp\\60exinjs.a9.exe"="C:\\DOCUME~1\\Flo\\LOCALS~1\\Temp\\60exinjs.a9.exe:*:Enabled:Microsoft Update"

"C:\\DOCUME~1\\Flo\\LOCALS~1\\Temp\\34exinjs.a9.exe"="C:\\DOCUME~1\\Flo\\LOCALS~1\\Temp\\34exinjs.a9.exe:*:Enabled:Microsoft Update"

"C:\\DOCUME~1\\Flo\\LOCALS~1\\Temp\\36exinjs.a9.exe"="C:\\DOCUME~1\\Flo\\LOCALS~1\\Temp\\36exinjs.a9.exe:*:Enabled:Microsoft Update"

"C:\\DOCUME~1\\Flo\\LOCALS~1\\Temp\\7exinjs.a9.exe"="C:\\DOCUME~1\\Flo\\LOCALS~1\\Temp\\7exinjs.a9.exe:*:Enabled:Microsoft Update"

"C:\\DOCUME~1\\Flo\\LOCALS~1\\Temp\\51exinjs.a9.exe"="C:\\DOCUME~1\\Flo\\LOCALS~1\\Temp\\51exinjs.a9.exe:*:Enabled:Microsoft Update"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

"C:\\Program Files\\MSN Messenger\\msncall.exe"="C:\\Program Files\\MSN Messenger\\msncall.exe:*:Enabled:Windows Live Messenger 8.0 (Phone)"

"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"

"C:\\Program Files\\MSN Messenger\\livecall.exe"="C:\\Program Files\\MSN Messenger\\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"

Remaining Files:

---------------

Backups Folder: - C:\DOCUME~1\Flo\Bureau\SDFix\SDFix\backups\backups.zip

Checking For Files with Hidden Attributes:

C:\System Volume Information\_restore{89297EA4-A133-4595-9730-7AE5F66BAB0E}\RP61\A0012027.DLL

Finished

angelique · le 1 mai 2007

*supprime SDFix C:\DOCUME~1\Flo\Bureau\SDFix

*poste un nouveau rapport Hijackthis stp!!

AarK · le 1 mai 2007

voila :

Logfile of HijackThis v1.99.1

Scan saved at 10:45:56, on 01/05/2007

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Intel\Wireless\Bin\EvtEng.exe

C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe

C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe

C:\Program Files\Alwil Software\Avast4\ashServ.exe

C:\Program Files\AlienGUIse\wbload.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\eHome\ehRecvr.exe

C:\WINDOWS\eHome\ehSched.exe

C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe

C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE

C:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE

C:\WINDOWS\system32\nvsvc32.exe

C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe

C:\PROGRA~1\NORTON~1\SPEEDD~1\nopdb.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe

C:\Program Files\Alwil Software\Avast4\ashWebSv.exe

C:\WINDOWS\system32\dllhost.exe

C:\WINDOWS\system32\wscntfy.exe

C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9BE.EXE

C:\WINDOWS\system32\ctfmon.exe

c:\progra~1\intern~1\iexplore.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\Program Files\MSN Messenger\msnmsgr.exe

C:\Program Files\Azureus\Azureus.exe