<https://forum.zebulon.fr/topic/116534-analyse-rapports-hijackthis/>
<http://schema.org/text>
"Bonjour tout le monde et dsl de m'être interféré dans la désinfection d'un autre membre \n  \nPourriez-vs m'aider à me débarrasser du virus \"Da uma olhada nas fotos dessa festa... muito \"svp,je poste mon rapport hijackthis en esperant que vous pourriez m'aider merci d'avance \n  \nLogfile of HijackThis v1.99.1 \nScan saved at 00:32:46, on 21/02/2007 \nPlatform: Windows XP SP2 (WinNT 5.01.2600) \nMSIE: Internet Explorer v7.00 (7.00.6000.16414) \n  \nRunning processes: \nC:\\WINDOWS\\System32\\smss.exe \nC:\\WINDOWS\\system32\\csrss.exe \nC:\\WINDOWS\\system32\\winlogon.exe \nC:\\WINDOWS\\system32\\services.exe \nC:\\WINDOWS\\system32\\lsass.exe \nC:\\WINDOWS\\system32\\svchost.exe \nC:\\WINDOWS\\system32\\svchost.exe \nC:\\WINDOWS\\System32\\svchost.exe \nC:\\WINDOWS\\system32\\svchost.exe \nC:\\WINDOWS\\system32\\svchost.exe \nC:\\WINDOWS\\system32\\spoolsv.exe \nC:\\WINDOWS\\Explorer.EXE \nC:\\Program Files\\Alwil Software\\Avast4\\aswUpdSv.exe \nC:\\Program Files\\Alwil Software\\Avast4\\ashServ.exe \nC:\\WINDOWS\\System32\\svchost.exe \nC:\\Norman\\Bin\\Zanda.exe \nC:\\WINDOWS\\system32\\nvsvc32.exe \nC:\\Program Files\\Phoenix Technologies Ltd\\RecoverPro_XP\\VBPTASK.EXE \nC:\\WINDOWS\\SOUNDMAN.EXE \nC:\\Program Files\\CyberLink\\PowerDVD\\PDVDServ.exe \nC:\\Norman\\bin\\ZLH.EXE \nC:\\WINDOWS\\system32\\RUNDLL32.EXE \nC:\\WINDOWS\\system32\\svchost.exe \nC:\\Program Files\\QuickTime\\qttask.exe \nC:\\Program Files\\iTunes\\iTunesHelper.exe \nC:\\Program Files\\Adobe\\Photoshop Album Starter Edition\\3.0\\Apps\\apdproxy.exe \nC:\\PROGRA~1\\MUSICM~1\\MUSICM~1\\mm_tray.exe \nC:\\Program Files\\Musicmatch\\Musicmatch Jukebox\\mmtask.exe \nC:\\PROGRA~1\\ALWILS~1\\Avast4\\ashDisp.exe \nC:\\Program Files\\Java\\jre1.5.0_11\\bin\\jusched.exe \nC:\\Program Files\\Hewlett-Packard\\HP Share-to-Web\\hpgs2wnd.exe \nC:\\WINDOWS\\system32\\dllvirtual.exe \nC:\\WINDOWS\\system32\\ctfmon.exe \nC:\\Program Files\\Messenger\\msmsgs.exe \nC:\\Program Files\\Windows Media Player\\WMPNetwk.exe \nC:\\Program Files\\Windows Media Player\\WMPNSCFG.exe \nC:\\Program Files\\Alwil Software\\Avast4\\ashMaiSv.exe \nC:\\PROGRA~1\\HEWLET~1\\HPSHAR~1\\hpgs2wnf.exe \nc:\\progra~1\\intern~1\\iexplore.exe \nC:\\Program Files\\Internet Explorer\\IEXPLORE.EXE \nC:\\Program Files\\Alwil Software\\Avast4\\ashWebSv.exe \nC:\\Norman\\Nvc\\BIN\\NIP.EXE \nC:\\Program Files\\iPod\\bin\\iPodService.exe \nC:\\Norman\\Nvc\\BIN\\NVCSCHED.EXE \nC:\\Norman\\bin\\NJEEVES.EXE \nC:\\Norman\\Nvc\\BIN\\nipsvc.exe \nC:\\WINDOWS\\System32\\alg.exe \nC:\\Program Files\\OpenOffice.org 2.0\\program\\soffice.exe \nC:\\Program Files\\OpenOffice.org 2.0\\program\\soffice.BIN \nC:\\Program Files\\MSN Messenger\\usnsvc.exe \nC:\\Documents and Settings\\Molièze\\Mes documents\\TELECHARGEMENT\\HijackThis.exe \n  \nR0 - HKCU\\Software\\Microsoft\\Internet Explorer\\Main,Start Page = http://runonce.msn.com/?v=msgrv75 \nR1 - HKLM\\Software\\Microsoft\\Internet Explorer\\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 \nR1 - HKLM\\Software\\Microsoft\\Internet Explorer\\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 \nR1 - HKLM\\Software\\Microsoft\\Internet Explorer\\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 \nR0 - HKLM\\Software\\Microsoft\\Internet Explorer\\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 \nR0 - HKCU\\Software\\Microsoft\\Internet Explorer\\Toolbar,LinksFolderName = Liens \nO2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\\Program Files\\Fichiers communs\\Adobe\\Acrobat\\ActiveX\\AcroIEHelper.dll \nO2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\\Program Files\\Java\\jre1.5.0_11\\bin\\ssv.dll \nO2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) \nO2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\\Program Files\\Fichiers communs\\Microsoft Shared\\Windows Live\\WindowsLiveLogin.dll \nO4 - HKLM\\..\\Run: [RestoreIT!] \"C:\\Program Files\\Phoenix Technologies Ltd\\RecoverPro_XP\\VBPTASK.EXE\" VBStart \nO4 - HKLM\\..\\Run: [NvCplDaemon] RUNDLL32.EXE C:\\WINDOWS\\system32\\NvCpl.dll,NvStartup \nO4 - HKLM\\..\\Run: [nwiz] nwiz.exe /install \nO4 - HKLM\\..\\Run: [soundMan] SOUNDMAN.EXE \nO4 - HKLM\\..\\Run: [fenaffiche] C:\\Program Files\\FenAffiche\\FenUnika.exe \nO4 - HKLM\\..\\Run: [NeroFilterCheck] C:\\WINDOWS\\system32\\NeroCheck.exe \nO4 - HKLM\\..\\Run: [RemoteControl] \"C:\\Program Files\\CyberLink\\PowerDVD\\PDVDServ.exe\" \nO4 - HKLM\\..\\Run: [Norman ZANDA] C:\\Norman\\bin\\ZLH.EXE /LOAD /SPLASH \nO4 - HKLM\\..\\Run: [NvMediaCenter] RUNDLL32.EXE C:\\WINDOWS\\system32\\NvMcTray.dll,NvTaskbarInit \nO4 - HKLM\\..\\Run: [QuickTime Task] \"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime \nO4 - HKLM\\..\\Run: [iTunesHelper] \"C:\\Program Files\\iTunes\\iTunesHelper.exe\" \nO4 - HKLM\\..\\Run: [Adobe Photo Downloader] \"C:\\Program Files\\Adobe\\Photoshop Album Starter Edition\\3.0\\Apps\\apdproxy.exe\" \nO4 - HKLM\\..\\Run: [MMTray] C:\\PROGRA~1\\MUSICM~1\\MUSICM~1\\mm_tray.exe \nO4 - HKLM\\..\\Run: [mmtask] \"C:\\Program Files\\Musicmatch\\Musicmatch Jukebox\\mmtask.exe\" \nO4 - HKLM\\..\\Run: [avast!] C:\\PROGRA~1\\ALWILS~1\\Avast4\\ashDisp.exe \nO4 - HKLM\\..\\Run: [sunJavaUpdateSched] \"C:\\Program Files\\Java\\jre1.5.0_11\\bin\\jusched.exe\" \nO4 - HKLM\\..\\Run: [share-to-Web Namespace Daemon] C:\\Program Files\\Hewlett-Packard\\HP Share-to-Web\\hpgs2wnd.exe \nO4 - HKLM\\..\\Run: [ ] C:\\WINDOWS\\system32\\dllvirtual.exe \nO4 - HKLM\\..\\Run: [sAFE FORD BLEH OWNS] C:\\Documents and Settings\\All Users\\Application Data\\Pop third safe ford\\Multi Platform.exe \nO4 - HKCU\\..\\Run: [CTFMON.EXE] C:\\WINDOWS\\system32\\ctfmon.exe \nO4 - HKCU\\..\\Run: [msnmsgr] \"C:\\Program Files\\MSN Messenger\\MsnMsgr.Exe\" /background \nO4 - HKCU\\..\\Run: [MSMSGS] \"C:\\Program Files\\Messenger\\msmsgs.exe\" /background \nO4 - HKCU\\..\\Run: [WMPNSCFG] C:\\Program Files\\Windows Media Player\\WMPNSCFG.exe \nO4 - HKCU\\..\\Run: [bONE RULE] C:\\DOCUME~1\\MOLIZE~1\\APPLIC~1\\FLAWCOMP\\safebendobj.exe \nO4 - Startup: OpenOffice.org 2.0.lnk = C:\\Program Files\\OpenOffice.org 2.0\\program\\quickstart.exe \nO4 - Global Startup: Adobe Gamma Loader.lnk = C:\\Program Files\\Fichiers communs\\Adobe\\Calibration\\Adobe Gamma Loader.exe \nO4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\\Program Files\\Adobe\\Reader 8.0\\Reader\\reader_sl.exe \nO4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\\Program Files\\Adobe\\Reader 8.0\\Reader\\AdobeCollabSync.exe \nO4 - Global Startup: Winter Fun Wallpaper Changer.lnk = ? \nO8 - Extra context menu item: Add to Windows &amp;Live Favorites - http://favorites.live.com/quickadd.aspx \nO8 - Extra context menu item: E&amp;xporter vers Microsoft Excel - res://C:\\PROGRA~1\\MICROS~2\\OFFICE11\\EXCEL.EXE/3000 \nO9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\\Program Files\\Java\\jre1.5.0_11\\bin\\ssv.dll \nO9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\\Program Files\\Java\\jre1.5.0_11\\bin\\ssv.dll \nO9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\\PROGRA~1\\MICROS~2\\OFFICE11\\REFIEBAR.DLL \nO9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\\Network Diagnostic\\xpnetdiag.exe (file missing) \nO9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\\Network Diagnostic\\xpnetdiag.exe (file missing) \nO9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\\Program Files\\Messenger\\msmsgs.exe \nO9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\\Program Files\\Messenger\\msmsgs.exe \nO11 - Options group: [iNTERNATIONAL] International* \nO16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineS...er.cab31267.cab \nO16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab31267.cab \nO18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\\PROGRA~1\\MSNMES~1\\MSGRAP~1.DLL \nO18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\\PROGRA~1\\MSNMES~1\\MSGRAP~1.DLL \nO21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\\WINDOWS\\system32\\WPDShServiceObj.dll \nO23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\\Program Files\\Alwil Software\\Avast4\\aswUpdSv.exe \nO23 - Service: avast! Antivirus - Unknown owner - C:\\Program Files\\Alwil Software\\Avast4\\ashServ.exe \nO23 - Service: avast! Mail Scanner - Unknown owner - C:\\Program Files\\Alwil Software\\Avast4\\ashMaiSv.exe\" /service (file missing) \nO23 - Service: avast! Web Scanner - Unknown owner - C:\\Program Files\\Alwil Software\\Avast4\\ashWebSv.exe\" /service (file missing) \nO23 - Service: iPod Service - Apple Computer, Inc. - C:\\Program Files\\iPod\\bin\\iPodService.exe \nO23 - Service: Norman API-hooking helper (NipSvc) - Unknown owner - C:\\Norman\\Nvc\\BIN\\nipsvc.exe \nO23 - Service: Norman NJeeves - Unknown owner - C:\\Norman\\bin\\NJEEVES.EXE \nO23 - Service: Norman ZANDA - Unknown owner - C:\\Norman\\Bin\\Zanda.exe \nO23 - Service: Norman Virus Control on-access component (nvcoas) - Norman ASA - C:\\Norman\\Nvc\\bin\\nvcoas.exe \nO23 - Service: Norman Virus Control Scheduler (NVCScheduler) - Norman Data Defense Systems - C:\\Norman\\Nvc\\BIN\\NVCSCHED.EXE \nO23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\\WINDOWS\\system32\\nvsvc32.exe \nO23 - Service: PsShutdown (PsShutdownSvc) - Systems Internals - C:\\WINDOWS\\System32\\PSSDNSVC.EXE \n"
<https://forum.zebulon.fr/topic/116534-analyse-rapports-hijackthis/>