Lecture hijackthis et SDFix pour virus msn!!!

Bonjour,
Un de mes amis a attrapé comme tout le monde la fameuse invitation msn genre "Qu'est-ce que ta photo fait sur ce site?" N'étant pas un expert je me suis renseigné sur la démarche à suivre et je lui ai donc conseillé d'effectuer un scan SDFix et Hijackthis. Si quelqu'un pouvait m'aider à interpréter ces scans et me dire quelles lignes supprimer et pour quelles raisons se serait vraiment sympa!

Voici tout d'abord le scan SDFix :

[b]SDFix: Version 1.159 [/b]

Run by ......... on 19/03/2008 at 16:34

Microsoft Windows XP [version 5.1.2600]
Running From: C:\SDFix

[b]Checking Services [/b]:

Restoring Windows Registry Values
Restoring Windows Default Hosts File

Rebooting

[b]Checking Files [/b]:

Trojan Files Found:

C:\WINDOWS\b155.exe - Deleted
C:\WINDOWS\mrofinu1423.exe.tmp - Deleted
C:\WINDOWS\system32\real.txt - Deleted

Folder C:\Program Files\Temporary - Removed

Removing Temp Files

[b]ADS Check [/b]:

[b]Final Check [/b]:

catchme 0.3.1344.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-03-19 16:40:59
Windows 5.1.2600 Service Pack 2 FAT NTAPI

scanning hidden processes ...

C:\DOCUMENTS AND SETTINGS\ERIC\LOCAL SETTINGS\TEMP\SERVICES.EXE [1988] 0x81868020

scanning hidden services ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden processes: 1
hidden services: 0
hidden files: 0

[b]Remaining Services [/b]:

Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\Real\\RealPlayer\\REALPLAY.EXE"="C:\\Program Files\\Real\\RealPlayer\\REALPLAY.EXE:*:Enabled:RealPlayer"
"C:\\Program Files\\eMule\\emule.exe"="C:\\Program Files\\eMule\\emule.exe:*:Enabled:eMule"
"C:\\Program Files\\Red Storm Entertainment\\Ghost Recon\\GhostRecon.exe"="C:\\Program Files\\Red Storm Entertainment\\Ghost Recon\\GhostRecon.exe:*:Disabled:GhostRecon"
"C:\\Program Files\\IncrediMail\\bin\\IMApp.exe"="C:\\Program Files\\IncrediMail\\bin\\IMApp.exe:*:Enabled:IncrediMail"
"C:\\Program Files\\IncrediMail\\bin\\IncMail.exe"="C:\\Program Files\\IncrediMail\\bin\\IncMail.exe:*:Enabled:IncrediMail"
"C:\\Program Files\\IncrediMail\\bin\\ImpCnt.exe"="C:\\Program Files\\IncrediMail\\bin\\ImpCnt.exe:*:Enabled:IncrediMail"
"C:\\Program Files\\IncrediMail\\bin\\ImLc.exe"="C:\\Program Files\\IncrediMail\\bin\\ImLc.exe:*:Enabled:IncrediMail"
"C:\\Program Files\\Lecteur CANALPLAY\\CanalPlayer.exe"="C:\\Program Files\\Lecteur CANALPLAY\\CanalPlayer.exe:*:Enabled:Lecteur CANALPLAY"
"C:\\Program Files\\Lecteur CANALPLAY\\CanalPlayerHelper.exe"="C:\\Program Files\\Lecteur CANALPLAY\\CanalPlayerHelper.exe:*:Enabled:Lecteur CANALPLAY Helper"
"C:\\Documents and Settings\\D‚borah\\Mes documents\\incredimail_install.exe"="C:\\Documents and Settings\\D‚borah\\Mes documents\\incredimail_install.exe:*:Enabled:IncrediMail Installer"
"C:\\Documents and Settings\\D‚borah\\Local Settings\\Temp\\ImInstaller\\IncrediMail\\incredimail_install.exe"="C:\\Documents and Settings\\D‚borah\\Local Settings\\Temp\\ImInstaller\\IncrediMail\\incredimail_install.exe:*:Enabled:IncrediMail Installer"
"C:\\Documents and Settings\\Eric\\Local Settings\\Temp\\ImInstaller\\IncrediMail\\incredimail_install.exe"="C:\\Documents and Settings\\Eric\\Local Settings\\Temp\\ImInstaller\\IncrediMail\\incredimail_install.exe:*:Enabled:IncrediMail Installer"
"C:\\Program Files\\Internet Explorer\\iexplore.exe"="C:\\Program Files\\Internet Explorer\\iexplore.exe:*:Enabled:Internet Explorer"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"="C:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe:*:Enabled:Logitech Desktop Messenger"
"C:\\Program Files\\Cyanide\\Pro Cycling Manager - Saison 2006 - Demo\\pcm.exe"="C:\\Program Files\\Cyanide\\Pro Cycling Manager - Saison 2006 - Demo\\pcm.exe:*:Disabled:pcm"
"C:\\Program Files\\Messenger\\MSMSGS.EXE"="C:\\Program Files\\Messenger\\MSMSGS.EXE:*:Enabled:Windows Messenger"
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"
"C:\\Program Files\\SightSpeed\\SightSpeed.exe"="C:\\Program Files\\SightSpeed\\SightSpeed.exe:*:Enabled:SightSpeed"
"C:\\DOCUME~1\\Eric\\LOCALS~1\\Temp\\services.exe"="C:\\DOCUME~1\\Eric\\LOCALS~1\\Temp\\services.exe:*:Enabled:Flash Media"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"="C:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe:*:Enabled:Logitech Desktop Messenger"
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"

[b]Remaining Files [/b]:

File Backups: - C:\SDFix\backups\backups.zip

[b]Files with Hidden Attributes [/b]:

Wed 27 Oct 2004 1,024 ...HR --- "C:\WINDOWS\system32\NTICDMK32.dll"
Wed 27 Oct 2004 1,024 ...HR --- "C:\WINDOWS\system32\NTIMPEG2.dll"
Thu 29 Nov 2007 35 ..SH. --- "C:\WINDOWS\system32\wirexe.dll"
Mon 7 Feb 2005 0 ...H. --- "C:\WINDOWS\system\ReM.dll"
Mon 7 Feb 2005 500 ...H. --- "C:\WINDOWS\system\MeR.dll"
Tue 23 Oct 2007 5,903,928 A..H. --- "C:\Program Files\Picasa2\setup.exe"
Wed 30 Nov 2005 4,348 A.SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak"
Tue 11 Apr 2006 3,806,976 A..H. --- "C:\Program Files\InstallShield Installation Information\{E9E37358-E3E1-47BA-9E21-375EF3616BC9}\SetupEx.exe"
Thu 6 Dec 2007 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\5d8093d524ba38b2f4036bb4d3aa25e4\BIT2.tmp"
Mon 1 Jan 2007 0 A.SH. --- "C:\Documents and Settings\All Users\DRM\Cache\Indiv02.tmp"
Mon 17 Mar 2008 92,160 ...H. --- "C:\Documents and Settings\D‚borah\Mes documents\_My_eBooks_\~WRL0207.tmp"
Sat 20 Jan 2007 25,600 ...H. --- "C:\Documents and Settings\D‚borah\Mes documents\_My_eBooks_\~WRL0001.tmp"
Tue 11 Mar 2008 26,624 ...H. --- "C:\Documents and Settings\D‚borah\Mes documents\_My_eBooks_\Tpe\~WRL0313.tmp"
Tue 11 Mar 2008 26,624 ...H. --- "C:\Documents and Settings\D‚borah\Mes documents\_My_eBooks_\Tpe\~WRL0717.tmp"
Sat 29 Apr 2006 20 A..H. --- "C:\Documents and Settings\Propri‚taire\Mes documents\Ma musique\Sauvegarde de la licence\drmv1lic.bak"
Wed 30 Nov 2005 4,348 ...H. --- "C:\Documents and Settings\Propri‚taire\Mes documents\Ma musique\Sauvegarde de la licence\drmv1key.bak"
Wed 30 Nov 2005 488 A.SH. --- "C:\Documents and Settings\Propri‚taire\Mes documents\Ma musique\Sauvegarde de la licence\drmv2key.bak"

[b]Finished![/b]

Pour plus de lisibilité je vais faire un second message pour le scan hijackthis. Merci d'avance!