[Résolu] virus rootkits

voici le rapport hijackthis Logfile of HijackThis v1.99.1
Scan saved at 15:13:19, on 18/09/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
J:\WINDOWS\System32\smss.exe
J:\WINDOWS\system32\winlogon.exe
J:\WINDOWS\system32\services.exe
J:\WINDOWS\system32\lsass.exe
J:\WINDOWS\system32\svchost.exe
J:\WINDOWS\System32\svchost.exe
J:\WINDOWS\system32\spoolsv.exe
J:\PROGRA~1\ANTIVI~1\backweb\6588780\Program\SERVIC~1.EXE
J:\Program Files\AntivirusFirewall\Anti-Virus\fsgk32st.exe
J:\Program Files\AntivirusFirewall\Anti-Virus\FSGK32.EXE
J:\Program Files\AntivirusFirewall\backweb\6588780\program\fsbwsys.exe
J:\Program Files\AntivirusFirewall\Anti-Virus\fssm32.exe
J:\Program Files\AntivirusFirewall\Common\FSMA32.EXE
J:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
J:\Program Files\AntivirusFirewall\Common\FSMB32.EXE
J:\WINDOWS\system32\nvsvc32.exe
J:\Program Files\AntivirusFirewall\Common\FCH32.EXE
J:\Program Files\AntivirusFirewall\Anti-Virus\fsqh.exe
J:\Program Files\AntivirusFirewall\Common\FAMEH32.EXE
J:\Program Files\AntivirusFirewall\Anti-Virus\fsrw.exe
J:\WINDOWS\system32\svchost.exe
J:\Program Files\AntivirusFirewall\Anti-Virus\fsav32.exe
J:\WINDOWS\AGRSMMSG.exe
J:\Program Files\Home Cinema\PowerCinema\PCMService.exe
J:\WINDOWS\Dit.exe
J:\Program Files\AntivirusFirewall\FWES\Program\fsdfwd.exe
J:\WINDOWS\system32\LVCOMSX.EXE
J:\Program Files\Logitech\Video\LogiTray.exe
J:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
J:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe
J:\Program Files\QuickTime\qttask.exe
J:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
J:\Program Files\AntivirusFirewall\Common\FSM32.EXE
J:\Program Files\Logitech\Video\FxSvr2.exe
J:\Program Files\AntivirusFirewall\FSGUI\ispnews.exe
J:\WINDOWS\system32\ctfmon.exe
J:\PROGRA~1\ANTIVI~1\ANTI-S~1\fsaw.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
J:\Program Files\AntivirusFirewall\FSGUI\fsguidll.exe
J:\Program Files\MessengerSkinner\MessengerSkinner.exe
J:\Program Files\AntivirusFirewall\backweb\6588780\Program\fspex.exe
J:\WINDOWS\System32\svchost.exe
J:\WINDOWS\explorer.exe
J:\Program Files\MSN Messenger\usnsvc.exe
J:\Program Files\Internet Explorer\iexplore.exe
J:\Program Files\WinRAR\WinRAR.exe
J:\DOCUME~1\Papa\LOCALS~1\Temp\Rar$EX00.656\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.orange.fr/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: (no name) - {EC57A831-054E-D73B-BCE8-4C4B531932E1} - bnui.dll (file missing)
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - J:\Program Files\MSN Apps\MSN Toolbar\01.02.5000.1021\fr\msntb.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE J:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE J:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [F-Secure TNB] "J:\Program Files\Securitoo\av_fw\TNB\TNBUtil.exe" /CHECKALL /WAITFORSW
O4 - HKLM\..\Run: [NeroFilterCheck] J:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [PCMService] "J:\Program Files\Home Cinema\PowerCinema\PCMService.exe"
O4 - HKLM\..\Run: [Dit] Dit.exe
O4 - HKLM\..\Run: [FSASWREG] "J:\Program Files\Securitoo\av_fw\Anti-Spyware\fsaswreg.exe"
O4 - HKLM\..\Run: [Raccourci vers la page des propriétés de High Definition Audio] HDAudPropShortcut.exe
O4 - HKLM\..\Run: [MW1HelperStartUp] J:\PROGRA~1\MAGICW~1\MW1HEL~1.EXE /partner MW1
O4 - HKLM\..\Run: [LVCOMSX] J:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechVideoRepair] J:\Program Files\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [LogitechVideoTray] J:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [TkBellExe] "J:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [BO1HelperStartUp] J:\PROGRA~1\BUTTER~1\BO1HEL~1.EXE /partner BO1
O4 - HKLM\..\Run: [AQ3HelperStartUp] J:\PROGRA~1\AQUATI~1\AQ3HEL~1.EXE /partner AQ3
O4 - HKLM\..\Run: [WinInitDll] MONITER.exe
O4 - HKLM\..\Run: [NopeZ] new32.exe
O4 - HKLM\..\Run: [dmuun.exe] J:\WINDOWS\system32\dmuun.exe
O4 - HKLM\..\Run: [ExtraFilmHemmaAgent] "J:\Program Files\Extrafilm FotoFacil\Agent.exe"
O4 - HKLM\..\Run: [DXM6Patch_981116] J:\WINDOWS\p_981116.exe /Q:A
O4 - HKLM\..\Run: [uwa6pcw] "J:\Program Files\WinAntiVirus Pro 2006\uwa6pcw.exe" -c
O4 - HKLM\..\Run: [QuickTime Task] "J:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [SunJavaUpdateSched] "J:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [F-Secure Manager] "J:\Program Files\AntivirusFirewall\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [F-Secure Startup Wizard] "J:\Program Files\AntivirusFirewall\FSGUI\FSSW.EXE" /reboot
O4 - HKLM\..\Run: [News Service] "J:\Program Files\AntivirusFirewall\FSGUI\ispnews.exe"
O4 - HKLM\..\Run: [czafsi] j:\windows\system32\czafsi.exe czafsi
O4 - HKLM\..\Run: [SystemOptimizer] rundll32.exe "J:\WINDOWS\system32\odhdpwrd.dll",forkonce
O4 - HKCU\..\Run: [CTFMON.EXE] J:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "J:\Program Files\Logitech\Video\ManifestEngine.exe" boot
O4 - HKCU\..\Run: [desktop] J:\WINDOWS\system32\idemlog.exe
O4 - HKCU\..\Run: [msag] media64.exe
O4 - HKCU\..\Run: [SetupExeDll] UserSp1.exe
O4 - HKCU\..\Run: [LOPTCON] dePloy.exe
O4 - HKCU\..\Run: [messengerskinner] J:\Program Files\MessengerSkinner\MessengerSkinner.exe
O4 - HKCU\..\Run: [dkcpvgojn] j:\windows\system32\dkcpvgojn.exe dkcpvgojn
O4 - Global Startup: Antivirus Firewall.lnk = J:\Program Files\AntivirusFirewall\backweb\6588780\Program\fspex.exe
O4 - Global Startup: GStartup.lnk = J:\Program Files\Fichiers communs\GMT\GMT.exe
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = J:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O4 - Global Startup: Microsoft Office.lnk = J:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &Bloquer cette fenêtre publicitaire - J:\Program Files\AntivirusFirewall\Anti-Spyware\blockpopups.htm
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://J:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - J:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - J:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: Protection Internet Explorer - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - J:\Program Files\AntivirusFirewall\Anti-Spyware\ieshield.dll
O9 - Extra 'Tools' menuitem: Protection Internet Explorer... - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - J:\Program Files\AntivirusFirewall\Anti-Spyware\ieshield.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - J:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - J:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} - http://212.157.152.82/AxisCamControl.ocx
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/ [...] loader.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{33E60B27-1042-4D8F-82AA-73F0F77B6F6A}: NameServer = 85.255.113.146,85.255.112.81
O17 - HKLM\System\CCS\Services\Tcpip\..\{3DF46FAB-E5F2-4E99-90AB-649F7F09E616}: NameServer = 85.255.113.146,85.255.112.81
O17 - HKLM\System\CCS\Services\Tcpip\..\{9A7657FF-B106-4A04-9898-A5B5DF0BA524}: NameServer = 85.255.113.146,85.255.112.81
O17 - HKLM\System\CCS\Services\Tcpip\..\{DBB0B651-0119-468B-8ADD-EFAA0A618E34}: NameServer = 85.255.113.146,85.255.112.81
O17 - HKLM\System\CS1\Services\Tcpip\..\{33E60B27-1042-4D8F-82AA-73F0F77B6F6A}: NameServer = 85.255.113.146,85.255.112.81
O17 - HKLM\System\CS2\Services\Tcpip\..\{33E60B27-1042-4D8F-82AA-73F0F77B6F6A}: NameServer = 85.255.113.146,85.255.112.81
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - J:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - J:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - J:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Antivirus Firewall (BackWeb Plug-in - 6588780) - Securitoo Portal - J:\PROGRA~1\ANTIVI~1\backweb\6588780\Program\SERVIC~1.EXE
O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corporation - J:\Program Files\AntivirusFirewall\Anti-Virus\fsgk32st.exe
O23 - Service: fsbwsys - F-Secure Corp. - J:\Program Files\AntivirusFirewall\backweb\6588780\program\fsbwsys.exe
O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - J:\Program Files\AntivirusFirewall\FWES\Program\fsdfwd.exe
O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - J:\Program Files\AntivirusFirewall\Common\FSMA32.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - J:\WINDOWS\system32\nvsvc32.exe
O23 - Service: X10 Device Network Service (x10nets) - X10 - J:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe

rt hijackthis

merci mais ou se trouve run fixit?

voila le rapport de fixwareoutUsername "Papa" - 18/09/2007 18:47:59 [Fixwareout edited 9/01/2007]

~~~~~ Prerun check
HKLM\SOFTWARE\~\CurrentVersion\Run\ ="dmuun"
HKLM\SOFTWARE\~\Winlogon\ "System"="cscor.exe"

HKEY_LOCAL_MACHINE\system\currentcontrolset\services\tcpip\parameters\interfaces\{33E60B27-1042-4D8F-82AA-73F0F77B6F6A}
"nameserver"="85.255.113.146,85.255.112.81" <Value cleared.
HKEY_LOCAL_MACHINE\system\currentcontrolset\services\tcpip\parameters\interfaces\{3DF46FAB-E5F2-4E99-90AB-649F7F09E616}
"nameserver"="85.255.113.146,85.255.112.81" <Value cleared.
HKEY_LOCAL_MACHINE\system\currentcontrolset\services\tcpip\parameters\interfaces\{9A7657FF-B106-4A04-9898-A5B5DF0BA524}
"nameserver"="85.255.113.146,85.255.112.81" <Value cleared.
HKEY_LOCAL_MACHINE\system\currentcontrolset\services\tcpip\parameters\interfaces\{DBB0B651-0119-468B-8ADD-EFAA0A618E34}
"nameserver"="85.255.113.146,85.255.112.81" <Value cleared.

Cache de résolution DNS vidé.


System was rebooted successfully.

~~~~~ Postrun check
HKLM\SOFTWARE\~\Winlogon\ "system"=""
....
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion "rocsc" Value deleted
HKCR\CLSID\{49E8F646-2898-4708-B654-706D615DC7A8}\_h\4 Deleted.
....
~~~~~ Misc files.
J:\WINDOWS\RDT.INI Deleted
J:\WINDOWS\System32\close.bmp Deleted
J:\WINDOWS\System32\dating.bmp Deleted
J:\WINDOWS\System32\drivers\zpmodemnt.sys Deleted
J:\WINDOWS\System32\gambling.bmp Deleted
J:\WINDOWS\System32\idesk.conf Deleted
J:\WINDOWS\System32\insurance.bmp Deleted
J:\WINDOWS\System32\pharmacy.bmp Deleted
....
~~~~~ Checking for older varients.
....

~~~~~ Current runs (hklm hkcu "run" Keys Only)
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="RUNDLL32.EXE J:\\WINDOWS\\system32\\NvCpl.dll,NvStartup"
"nwiz"="nwiz.exe /install"
"NvMediaCenter"="RUNDLL32.EXE J:\\WINDOWS\\system32\\NvMcTray.dll,NvTaskbarInit"
"AGRSMMSG"="AGRSMMSG.exe"
"F-Secure TNB"="\"J:\\Program Files\\Securitoo\\av_fw\\TNB\\TNBUtil.exe\" /CHECKALL /WAITFORSW"
"NeroFilterCheck"="J:\\WINDOWS\\system32\\NeroCheck.exe"
"PCMService"="\"J:\\Program Files\\Home Cinema\\PowerCinema\\PCMService.exe\""
"Dit"="Dit.exe"
"FSASWREG"="\"J:\\Program Files\\Securitoo\\av_fw\\Anti-Spyware\\fsaswreg.exe\""
"Raccourci vers la page des propriétés de High Definition Audio"="HDAudPropShortcut.exe"
"MW1HelperStartUp"="J:\\PROGRA~1\\MAGICW~1\\MW1HEL~1.EXE /partner MW1"
"LVCOMSX"="J:\\WINDOWS\\system32\\LVCOMSX.EXE"
"LogitechVideoRepair"="J:\\Program Files\\Logitech\\Video\\ISStart.exe "
"LogitechVideoTray"="J:\\Program Files\\Logitech\\Video\\LogiTray.exe"
"TkBellExe"="\"J:\\Program Files\\Fichiers communs\\Real\\Update_OB\\realsched.exe\" -osboot"
"BO1HelperStartUp"="J:\\PROGRA~1\\BUTTER~1\\BO1HEL~1.EXE /partner BO1"
"AQ3HelperStartUp"="J:\\PROGRA~1\\AQUATI~1\\AQ3HEL~1.EXE /partner AQ3"
"WinInitDll"="MONITER.exe"
"NopeZ"="new32.exe"
"ExtraFilmHemmaAgent"="\"J:\\Program Files\\Extrafilm FotoFacil\\Agent.exe\""
"DXM6Patch_981116"="J:\\WINDOWS\\p_981116.exe /Q:A"
"uwa6pcw"="\"J:\\Program Files\\WinAntiVirus Pro 2006\\uwa6pcw.exe\" -c"
"QuickTime Task"="\"J:\\Program Files\\QuickTime\\qttask.exe\" -atboottime"
"KernelFaultCheck"=hex(2):25,73,79,73,74,65,6d,72,6f,6f,74,25,5c,73,79,73,74,\
65,6d,33,32,5c,64,75,6d,70,72,65,70,20,30,20,2d,6b,00
"SunJavaUpdateSched"="\"J:\\Program Files\\Java\\jre1.6.0_02\\bin\\jusched.exe\""
"F-Secure Manager"="\"J:\\Program Files\\AntivirusFirewall\\Common\\FSM32.EXE\" /splash"
"F-Secure Startup Wizard"="\"J:\\Program Files\\AntivirusFirewall\\FSGUI\\FSSW.EXE\" /reboot"
"News Service"="\"J:\\Program Files\\AntivirusFirewall\\FSGUI\\ispnews.exe\""
"czafsi"="j:\\windows\\system32\\czafsi.exe czafsi"
"SystemOptimizer"="rundll32.exe \"J:\\WINDOWS\\system32\\odhdpwrd.dll\",forkonce"

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="J:\\WINDOWS\\system32\\ctfmon.exe"
"LDM"="C:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"
"LogitechSoftwareUpdate"="\"J:\\Program Files\\Logitech\\Video\\ManifestEngine.exe\" boot"
"msag"="media64.exe"
"SetupExeDll"="UserSp1.exe"
"LOPTCON"="dePloy.exe"
"messengerskinner"="J:\\Program Files\\MessengerSkinner\\MessengerSkinner.exe"
"dkcpvgojn"="j:\\windows\\system32\\dkcpvgojn.exe dkcpvgojn"
"xomssc"="j:\\windows\\system32\\xomssc.exe xomssc"
"byttnntcf"="j:\\windows\\system32\\byttnntcf.exe byttnntcf"
....
Hosts file was reset, If you use a custom hosts file please replace it...
~~~~~ End report ~~~~~

Re,

Télécharge Navilog1.exe (IL-MAFIOSO)
Enregistre-le sur ton Bureau.
Lance l'installation en double cliquant sur navilog.exe.
Une fois l'installation terminée, l'utilitaire s'exécutera automatiquement.
(Si ce n'est pas le cas, double clique sur le raccourci présent sur le Bureau)

Laisse-toi guider par l'utilitaire. Choisis l'option 1 puis valide.
! N'utilise pas l'option 2, 3 et 4 sans notre accord !
Patiente jusqu'à l'apparition de ce message :
"*** Analyse Termine le ..... ***"
Appuie sur une touche comme demandé. Le Bloc-notes va s'ouvrir. Poste-nous son contenu de cette manière :

-> Edition / Sélectionner tout
-> Edition / Copier
-> Clique-Droit / Coller dans ta réponse

NOTE : Le rapport se trouve également ici : C:\fixnavi.txt

Re,

Double clique sur le raccourci de Navilog1 présent sur ton Bureau.
Suis les instructions. Choisis ensuite l'option 2 puis valide.
Laisse toi guider et réponds aux questions éventuelles.

L'utilitaire va t'informer qu'il va redémarrer l'ordinateur.
**Ferme toutes les fenêtres ouvertes et enregistre tes documents personnels ouverts**
Appuie maintenant sur une touche, comme demandé.
(si ton PC ne redémarre pas automatiquement, fais-le manuellement)

Patiente jusqu'à l'apparition de ce message :
"*** Nettoyage Termine le ..... ***"

Le Bloc-notes va s'ouvrir.
Sauvegarde le rapport de manière à le retrouver.
Referme le Bloc-notes. Ton bureau va maintenant réapparaître.

NOTE : Si ton Bureau ne réapparait pas, appuie simultanément sur Ctrl+Alt+Suppr pour ouvrir le Gestionnaire des tâches.
Rends-toi sur l'onglet "Processus". Clique en haut à gauche sur Fichier et choisis "Exécuter..."
Tape explorer puis valide.

Poste le rapport sauvegardé auparavant (C:\cleannavi.txt)

&

• Télécharge combofix.exe (par sUBs) sur ton Bureau.
• Double clique combofix.exe.
• Tape sur la touche 1 (Yes) pour démarrer le scan.
• Lorsque le scan sera complété, un rapport apparaîtra. Copie/colle ce rapport dans ta prochaine réponse.

NOTE : Le rapport se trouve également ici : C:\Combofix.txt

voila le rapport de combofixComboFix 07-09-18.4 - "Papa" 2007-09-18 19:43:11.1 - NTFSx86
Microsoft Windows XP dition familiale 5.1.2600.2.1252.1.1036.18.560 [GMT 2:00]
* Created a new restore point
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

J:\DOCUME~1\Moumi\Bureau\internet.lnk
J:\DOCUME~1\Papa\Bureau\internet.lnk
J:\WINDOWS\cookies.ini
J:\WINDOWS\system32\askbtnyf.dll
J:\WINDOWS\system32\cimyjjpd.dll
J:\WINDOWS\system32\dpjjymic.ini
J:\WINDOWS\system32\drwpdhdo.ini
J:\WINDOWS\system32\eamaedhj.dll
J:\WINDOWS\system32\fyntbksa.ini
J:\WINDOWS\system32\huhillro.ini
J:\WINDOWS\system32\lctpjhbu.dll
J:\WINDOWS\system32\nkwrygcw.ini
J:\WINDOWS\system32\nqtss.bak1
J:\WINDOWS\system32\nqtss.bak2
J:\WINDOWS\system32\nqtss.ini
J:\WINDOWS\system32\odhdpwrd.dll
J:\WINDOWS\system32\ojesmpvn.dll
J:\WINDOWS\system32\orllihuh.dll
J:\WINDOWS\system32\sstqn.dll
J:\WINDOWS\system32\stera.job
J:\WINDOWS\system32\ubhjptcl.ini
J:\WINDOWS\system32\wcgyrwkn.dll

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))


-------\vspf
-------\vspf_hk


((((((((((((((((((((((((((((( Fichiers créés 2007-08-18 to 2007-09-18 ))))))))))))))))))))))))))))))))))))
.

2007-09-18 19:41 51,200 --a------ J:\WINDOWS\NirCmd.exe
2007-09-18 19:10 <REP> d-------- J:\Program Files\Navilog1
2007-09-17 15:30 <REP> d-------- J:\DOCUME~1\ADMINI~1\APPLIC~1\ispnews
2007-09-16 17:56 <REP> d-------- J:\WINDOWS\ERUNT
2007-09-08 16:46 <REP> d-------- J:\Program Files\JoWooD
2007-08-25 17:37 92,208 --a------ J:\WINDOWS\system\WING.DLL
2007-08-25 17:37 12,800 --a------ J:\WINDOWS\system\WING32.DLL
2007-08-25 17:36 <REP> d-------- J:\Program Files\Speed Thief
2007-08-25 13:03 <REP> d-------- J:\Program Files\Fichiers communs\DirectX
2007-08-24 19:12 <REP> d--h----- J:\SBE

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-09-18 19:48 17408 --a------ J:\WINDOWS\system32\drivers\USBCRFT.SYS
2007-09-15 17:28 --------- d--h----- J:\Program Files\InstallShield Installation Information
2007-09-08 13:40 163644 --a------ J:\WINDOWS\system32\drivers\secdrv.sys
2007-08-27 17:14 --------- d-------- J:\Program Files\Microsoft Games
2007-08-13 18:53 --------- d-------- J:\Program Files\Empire Interactive
2007-07-30 19:19 92504 --a------ J:\WINDOWS\system32\cdm.dll
2007-07-30 19:19 549720 --a------ J:\WINDOWS\system32\wuapi.dll
2007-07-30 19:19 53080 --a------ J:\WINDOWS\system32\wuauclt.exe
2007-07-30 19:19 43352 --a------ J:\WINDOWS\system32\wups2.dll
2007-07-30 19:19 325976 --a------ J:\WINDOWS\system32\wucltui.dll
2007-07-30 19:19 203096 --a------ J:\WINDOWS\system32\wuweb.dll
2007-07-30 19:19 1712984 --a------ J:\WINDOWS\system32\wuaueng.dll
2007-07-30 19:18 33624 --a------ J:\WINDOWS\system32\wups.dll
2007-07-30 14:20 --------- d-------- J:\DOCUME~1\Moumi\APPLIC~1\F-Secure
2007-07-30 14:17 --------- d-------- J:\DOCUME~1\Moumi\APPLIC~1\ispnews
2007-07-29 12:24 --------- d-------- J:\DOCUME~1\ALLUSE~1\APPLIC~1\QubeSoft
2007-07-29 11:35 --------- d-------- J:\Program Files\LEGO Software
2007-07-28 03:54 606848 --a------ J:\WINDOWS\flashax.exe
2007-07-28 03:54 12288 --a------ J:\WINDOWS\impborl.dll
2007-07-22 10:13 --------- d-------- J:\Program Files\FirstClass
2007-07-08 16:06 118842 -r------- J:\WINDOWS\bwUnin-6.3.2.123-6588780L.exe
2007-07-05 09:00 268288 --a------ J:\WINDOWS\system32\gwrjmgvm.exe
2007-06-26 08:09 1104896 --a------ J:\WINDOWS\system32\msxml3.dll
2007-06-19 15:32 282112 --a------ J:\WINDOWS\system32\gdi32.dll
.

((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.

*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="J:\WINDOWS\system32\NvCpl.dll" [2004-12-15 13:01]
"nwiz"="nwiz.exe" [2004-12-15 13:01 J:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter"="J:\WINDOWS\system32\NvMcTray.dll" [2004-12-15 13:01]
"AGRSMMSG"="AGRSMMSG.exe" [2005-03-04 12:01 J:\WINDOWS\AGRSMMSG.exe]
"F-Secure TNB"="J:\Program Files\Securitoo\av_fw\TNB\TNBUtil.exe" [2005-07-18 16:51]
"NeroFilterCheck"="J:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 10:50]
"PCMService"="J:\Program Files\Home Cinema\PowerCinema\PCMService.exe" [2004-11-09 05:14]
"Dit"="Dit.exe" [2004-07-20 18:18 J:\WINDOWS\Dit.exe]
"FSASWREG"="J:\Program Files\Securitoo\av_fw\Anti-Spyware\fsaswreg.exe" []
"Raccourci vers la page des propriétés de High Definition Audio"="HDAudPropShortcut.exe" [2004-03-17 16:10 J:\WINDOWS\system32\Hdaudpropshortcut.exe]
"MW1HelperStartUp"="J:\PROGRA~1\MAGICW~1\MW1HEL~1.exe" []
"LVCOMSX"="J:\WINDOWS\system32\LVCOMSX.EXE" [2004-10-08 11:52]
"LogitechVideoRepair"="J:\Program Files\Logitech\Video\ISStart.exe" [2004-10-08 12:31]
"LogitechVideoTray"="J:\Program Files\Logitech\Video\LogiTray.exe" [2004-10-08 12:24]
"TkBellExe"="J:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" [2005-11-11 18:06]
"BO1HelperStartUp"="J:\PROGRA~1\BUTTER~1\BO1HEL~1.exe" []
"AQ3HelperStartUp"="J:\PROGRA~1\AQUATI~1\AQ3HEL~1.exe" []
"WinInitDll"="MONITER.exe" []
"NopeZ"="new32.exe" []
"ExtraFilmHemmaAgent"="J:\Program Files\Extrafilm FotoFacil\Agent.exe" []
"DXM6Patch_981116"="J:\WINDOWS\p_981116.exe" [1998-11-30 18:04]
"QuickTime Task"="J:\Program Files\QuickTime\qttask.exe" [2006-10-13 20:29]
"SunJavaUpdateSched"="J:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" [2007-07-12 04:00]
"F-Secure Manager"="J:\Program Files\AntivirusFirewall\Common\FSM32.exe" [2005-10-26 03:51]
"F-Secure Startup Wizard"="J:\Program Files\AntivirusFirewall\FSGUI\FSSW.exe" [2005-10-18 10:29]
"News Service"="J:\Program Files\AntivirusFirewall\FSGUI\ispnews.exe" [2005-05-31 14:45]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="J:\WINDOWS\system32\ctfmon.exe" [2004-08-05 14:00]
"LDM"="C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe" [2007-03-19 20:29]
"LogitechSoftwareUpdate"="J:\Program Files\Logitech\Video\ManifestEngine.exe" [2004-10-08 12:06]
"msag"="media64.exe" []
"SetupExeDll"="UserSp1.exe" []
"LOPTCON"="dePloy.exe" []

J:\DOCUME~1\ALLUSE~1\MENUDM~1\PROGRA~1\DMARRA~1\
Antivirus Firewall.lnk - J:\Program Files\AntivirusFirewall\backweb\6588780\Program\fspex.exe [2007-07-08 16:06:51]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\byxwwvt]
byxwwvt.dll

R0 FSFW;F-Secure Firewall Driver;J:\WINDOWS\system32\drivers\fsdfw.sys
R2 BackWeb Plug-in - 6588780;Antivirus Firewall;J:\PROGRA~1\ANTIVI~1\backweb\6588780\Program\SERVIC~1.EXE
R2 F-Secure Filter;F-Secure File System Filter;\??\J:\Program Files\AntivirusFirewall\Anti-Virus\Win2K\FSfilter.sys
R2 F-Secure Gatekeeper;F-Secure Gatekeeper;\??\J:\Program Files\AntivirusFirewall\Anti-Virus\Win2K\FSgk.sys
R2 F-Secure Recognizer;F-Secure File System Recognizer;\??\J:\Program Files\AntivirusFirewall\Anti-Virus\Win2K\FSrec.sys
R2 FSpm;F-Secure Policy Manager;\??\J:\Program Files\Securitoo\av_fw\Common\FSPM.SYS
R3 3xHybrid;3xHybrid service;J:\WINDOWS\system32\DRIVERS\3xHybrid.sys
R3 PRISM_A00;CREATIX 802.11g Driver;J:\WINDOWS\system32\DRIVERS\PRISMA00.sys
S3 CardReaderFilter;Card Reader Filter;\??\J:\WINDOWS\system32\Drivers\USBCRFT.SYS
S3 X10UIF;%DESCRIPTION%;J:\WINDOWS\system32\Drivers\x10uif.sys

.
Contenu du dossier 'Scheduled Tasks/Tâches planifiées'
"2007-09-18 04:46:07 J:\WINDOWS\Tasks\Scheduled scanning task.job"
.
**************************************************************************

catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-09-18 19:48:25
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-09-18 19:49:34 - machine was rebooted
J:\ComboFix-quarantined-files.txt ... 2007-09-18 19:49
.
--- E O F ---
merci

voila le rapport hijackthisLogfile of HijackThis v1.99.1
Scan saved at 20:31:26, on 18/09/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
J:\WINDOWS\System32\smss.exe
J:\WINDOWS\system32\winlogon.exe
J:\WINDOWS\system32\services.exe
J:\WINDOWS\system32\lsass.exe
J:\WINDOWS\system32\svchost.exe
J:\WINDOWS\System32\svchost.exe
J:\WINDOWS\system32\spoolsv.exe
J:\PROGRA~1\ANTIVI~1\backweb\6588780\Program\SERVIC~1.EXE
J:\Program Files\AntivirusFirewall\Anti-Virus\fsgk32st.exe
J:\Program Files\AntivirusFirewall\backweb\6588780\program\fsbwsys.exe
J:\Program Files\AntivirusFirewall\Anti-Virus\FSGK32.EXE
J:\Program Files\AntivirusFirewall\Anti-Virus\fssm32.exe
J:\Program Files\AntivirusFirewall\Common\FSMA32.EXE
J:\Program Files\AntivirusFirewall\Common\FSMB32.EXE
J:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
J:\WINDOWS\system32\nvsvc32.exe
J:\WINDOWS\system32\svchost.exe
J:\Program Files\AntivirusFirewall\Common\FCH32.EXE
J:\Program Files\AntivirusFirewall\Common\FAMEH32.EXE
J:\Program Files\AntivirusFirewall\Anti-Virus\fsqh.exe
J:\Program Files\AntivirusFirewall\Anti-Virus\fsrw.exe
J:\Program Files\AntivirusFirewall\FWES\Program\fsdfwd.exe
J:\Program Files\AntivirusFirewall\Anti-Virus\fsav32.exe
J:\WINDOWS\Explorer.EXE
J:\WINDOWS\AGRSMMSG.exe
J:\Program Files\Home Cinema\PowerCinema\PCMService.exe
J:\WINDOWS\Dit.exe
J:\WINDOWS\system32\LVCOMSX.EXE
J:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe
J:\Program Files\Logitech\Video\LogiTray.exe
J:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
J:\Program Files\QuickTime\qttask.exe
J:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
J:\Program Files\AntivirusFirewall\Common\FSM32.EXE
J:\Program Files\AntivirusFirewall\FSGUI\ispnews.exe
J:\WINDOWS\system32\ctfmon.exe
J:\PROGRA~1\ANTIVI~1\ANTI-S~1\fsaw.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
J:\Program Files\AntivirusFirewall\FSGUI\fsguidll.exe
J:\Program Files\AntivirusFirewall\backweb\6588780\Program\fspex.exe
J:\Program Files\Logitech\Video\FxSvr2.exe
J:\WINDOWS\System32\svchost.exe
J:\Program Files\internet explorer\iexplore.exe
J:\Program Files\WinRAR\WinRAR.exe
J:\DOCUME~1\Papa\LOCALS~1\Temp\Rar$EX00.609\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.orange.fr/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: (no name) - {EC57A831-054E-D73B-BCE8-4C4B531932E1} - bnui.dll (file missing)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - J:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - J:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - J:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - J:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - J:\Program Files\MSN Apps\MSN Toolbar\01.02.5000.1021\fr\msntb.dll
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - J:\Program Files\MSN Apps\MSN Toolbar\01.02.5000.1021\fr\msntb.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE J:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE J:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [F-Secure TNB] "J:\Program Files\Securitoo\av_fw\TNB\TNBUtil.exe" /CHECKALL /WAITFORSW
O4 - HKLM\..\Run: [NeroFilterCheck] J:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [PCMService] "J:\Program Files\Home Cinema\PowerCinema\PCMService.exe"
O4 - HKLM\..\Run: [Dit] Dit.exe
O4 - HKLM\..\Run: [FSASWREG] "J:\Program Files\Securitoo\av_fw\Anti-Spyware\fsaswreg.exe"
O4 - HKLM\..\Run: [Raccourci vers la page des propriétés de High Definition Audio] HDAudPropShortcut.exe
O4 - HKLM\..\Run: [MW1HelperStartUp] J:\PROGRA~1\MAGICW~1\MW1HEL~1.EXE /partner MW1
O4 - HKLM\..\Run: [LVCOMSX] J:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechVideoRepair] J:\Program Files\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [LogitechVideoTray] J:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [TkBellExe] "J:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [BO1HelperStartUp] J:\PROGRA~1\BUTTER~1\BO1HEL~1.EXE /partner BO1
O4 - HKLM\..\Run: [AQ3HelperStartUp] J:\PROGRA~1\AQUATI~1\AQ3HEL~1.EXE /partner AQ3
O4 - HKLM\..\Run: [WinInitDll] MONITER.exe
O4 - HKLM\..\Run: [NopeZ] new32.exe
O4 - HKLM\..\Run: [ExtraFilmHemmaAgent] "J:\Program Files\Extrafilm FotoFacil\Agent.exe"
O4 - HKLM\..\Run: [DXM6Patch_981116] J:\WINDOWS\p_981116.exe /Q:A
O4 - HKLM\..\Run: [QuickTime Task] "J:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] "J:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [F-Secure Manager] "J:\Program Files\AntivirusFirewall\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [F-Secure Startup Wizard] "J:\Program Files\AntivirusFirewall\FSGUI\FSSW.EXE" /reboot
O4 - HKLM\..\Run: [News Service] "J:\Program Files\AntivirusFirewall\FSGUI\ispnews.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] J:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "J:\Program Files\Logitech\Video\ManifestEngine.exe" boot
O4 - HKCU\..\Run: [msag] media64.exe
O4 - HKCU\..\Run: [SetupExeDll] UserSp1.exe
O4 - HKCU\..\Run: [LOPTCON] dePloy.exe
O4 - Global Startup: Antivirus Firewall.lnk = J:\Program Files\AntivirusFirewall\backweb\6588780\Program\fspex.exe
O4 - Global Startup: GStartup.lnk = J:\Program Files\Fichiers communs\GMT\GMT.exe
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = J:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O4 - Global Startup: Microsoft Office.lnk = J:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &Bloquer cette fenêtre publicitaire - J:\Program Files\AntivirusFirewall\Anti-Spyware\blockpopups.htm
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://J:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - J:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - J:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: Protection Internet Explorer - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - J:\Program Files\AntivirusFirewall\Anti-Spyware\ieshield.dll
O9 - Extra 'Tools' menuitem: Protection Internet Explorer... - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - J:\Program Files\AntivirusFirewall\Anti-Spyware\ieshield.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - J:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - J:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} - http://212.157.152.82/AxisCamControl.ocx
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/ [...] loader.cab
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - J:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - J:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: byxwwvt - byxwwvt.dll (file missing)
O20 - Winlogon Notify: WgaLogon - J:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - J:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Antivirus Firewall (BackWeb Plug-in - 6588780) - Securitoo Portal - J:\PROGRA~1\ANTIVI~1\backweb\6588780\Program\SERVIC~1.EXE
O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corporation - J:\Program Files\AntivirusFirewall\Anti-Virus\fsgk32st.exe
O23 - Service: fsbwsys - F-Secure Corp. - J:\Program Files\AntivirusFirewall\backweb\6588780\program\fsbwsys.exe
O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - J:\Program Files\AntivirusFirewall\FWES\Program\fsdfwd.exe
O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - J:\Program Files\AntivirusFirewall\Common\FSMA32.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - J:\WINDOWS\system32\nvsvc32.exe
O23 - Service: X10 Device Network Service (x10nets) - X10 - J:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe

merci

voila le rapport de clean 18/09/2007 a 20:54:50,90

*** Recherche des fichiers dans J:

*** Recherche des fichiers dans J:\WINDOWS\

*** Recherche des fichiers dans J:\WINDOWS\system32
J:\WINDOWS\system32\mcrh.tmp FOUND

*** Recherche des fichiers dans J:\Program Files
*** Fin du rapport !
merci

Bonsoir, voici le rapport AVG AS
---------------------------------------------------------
AVG Anti-Spyware - Rapport d'analyse
---------------------------------------------------------

+ Créé à: 22:51:08 18/09/2007

+ Résultat de l'analyse:



HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Public Messenger ver 2.03 -> Adware.Generic : Ignoré.
J:\Documents and Settings\Moumi\Cookies\moumi@www.adobe[1].txt -> TrackingCookie.Adobe : Ignoré.
J:\Documents and Settings\Papa\Cookies\papa@cpvfeed[2].txt -> TrackingCookie.Cpvfeed : Ignoré.
J:\Documents and Settings\Papa\Cookies\papa@ie.search.msn[2].txt -> TrackingCookie.Msn : Ignoré.
J:\Documents and Settings\Papa\Cookies\papa@ssl-hints.netflame[1].txt -> TrackingCookie.Netflame : Ignoré.
J:\Documents and Settings\Moumi\Cookies\moumi@m.webtrends[1].txt -> TrackingCookie.Webtrends : Ignoré.


Fin du rapport

Ayant pris le relais, j'ai seulement trouvé un raport Hijackthis réalisé à 15h13, le voici :
Logfile of HijackThis v1.99.1
Scan saved at 15:13:19, on 18/09/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
J:\WINDOWS\System32\smss.exe
J:\WINDOWS\system32\winlogon.exe
J:\WINDOWS\system32\services.exe
J:\WINDOWS\system32\lsass.exe
J:\WINDOWS\system32\svchost.exe
J:\WINDOWS\System32\svchost.exe
J:\WINDOWS\system32\spoolsv.exe
J:\PROGRA~1\ANTIVI~1\backweb\6588780\Program\SERVIC~1.EXE
J:\Program Files\AntivirusFirewall\Anti-Virus\fsgk32st.exe
J:\Program Files\AntivirusFirewall\Anti-Virus\FSGK32.EXE
J:\Program Files\AntivirusFirewall\backweb\6588780\program\fsbwsys.exe
J:\Program Files\AntivirusFirewall\Anti-Virus\fssm32.exe
J:\Program Files\AntivirusFirewall\Common\FSMA32.EXE
J:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
J:\Program Files\AntivirusFirewall\Common\FSMB32.EXE
J:\WINDOWS\system32\nvsvc32.exe
J:\Program Files\AntivirusFirewall\Common\FCH32.EXE
J:\Program Files\AntivirusFirewall\Anti-Virus\fsqh.exe
J:\Program Files\AntivirusFirewall\Common\FAMEH32.EXE
J:\Program Files\AntivirusFirewall\Anti-Virus\fsrw.exe
J:\WINDOWS\system32\svchost.exe
J:\Program Files\AntivirusFirewall\Anti-Virus\fsav32.exe
J:\WINDOWS\AGRSMMSG.exe
J:\Program Files\Home Cinema\PowerCinema\PCMService.exe
J:\WINDOWS\Dit.exe
J:\Program Files\AntivirusFirewall\FWES\Program\fsdfwd.exe
J:\WINDOWS\system32\LVCOMSX.EXE
J:\Program Files\Logitech\Video\LogiTray.exe
J:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
J:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe
J:\Program Files\QuickTime\qttask.exe
J:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
J:\Program Files\AntivirusFirewall\Common\FSM32.EXE
J:\Program Files\Logitech\Video\FxSvr2.exe
J:\Program Files\AntivirusFirewall\FSGUI\ispnews.exe
J:\WINDOWS\system32\ctfmon.exe
J:\PROGRA~1\ANTIVI~1\ANTI-S~1\fsaw.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
J:\Program Files\AntivirusFirewall\FSGUI\fsguidll.exe
J:\Program Files\MessengerSkinner\MessengerSkinner.exe
J:\Program Files\AntivirusFirewall\backweb\6588780\Program\fspex.exe
J:\WINDOWS\System32\svchost.exe
J:\WINDOWS\explorer.exe
J:\Program Files\MSN Messenger\usnsvc.exe
J:\Program Files\Internet Explorer\iexplore.exe
J:\Program Files\WinRAR\WinRAR.exe
J:\DOCUME~1\Papa\LOCALS~1\Temp\Rar$EX00.656\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.orange.fr/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: (no name) - {EC57A831-054E-D73B-BCE8-4C4B531932E1} - bnui.dll (file missing)
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - J:\Program Files\MSN Apps\MSN Toolbar\01.02.5000.1021\fr\msntb.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE J:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE J:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [F-Secure TNB] "J:\Program Files\Securitoo\av_fw\TNB\TNBUtil.exe" /CHECKALL /WAITFORSW
O4 - HKLM\..\Run: [NeroFilterCheck] J:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [PCMService] "J:\Program Files\Home Cinema\PowerCinema\PCMService.exe"
O4 - HKLM\..\Run: [Dit] Dit.exe
O4 - HKLM\..\Run: [FSASWREG] "J:\Program Files\Securitoo\av_fw\Anti-Spyware\fsaswreg.exe"
O4 - HKLM\..\Run: [Raccourci vers la page des propriétés de High Definition Audio] HDAudPropShortcut.exe
O4 - HKLM\..\Run: [MW1HelperStartUp] J:\PROGRA~1\MAGICW~1\MW1HEL~1.EXE /partner MW1
O4 - HKLM\..\Run: [LVCOMSX] J:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechVideoRepair] J:\Program Files\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [LogitechVideoTray] J:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [TkBellExe] "J:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [BO1HelperStartUp] J:\PROGRA~1\BUTTER~1\BO1HEL~1.EXE /partner BO1
O4 - HKLM\..\Run: [AQ3HelperStartUp] J:\PROGRA~1\AQUATI~1\AQ3HEL~1.EXE /partner AQ3
O4 - HKLM\..\Run: [WinInitDll] MONITER.exe
O4 - HKLM\..\Run: [NopeZ] new32.exe
O4 - HKLM\..\Run: [dmuun.exe] J:\WINDOWS\system32\dmuun.exe
O4 - HKLM\..\Run: [ExtraFilmHemmaAgent] "J:\Program Files\Extrafilm FotoFacil\Agent.exe"
O4 - HKLM\..\Run: [DXM6Patch_981116] J:\WINDOWS\p_981116.exe /Q:A
O4 - HKLM\..\Run: [uwa6pcw] "J:\Program Files\WinAntiVirus Pro 2006\uwa6pcw.exe" -c
O4 - HKLM\..\Run: [QuickTime Task] "J:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [SunJavaUpdateSched] "J:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [F-Secure Manager] "J:\Program Files\AntivirusFirewall\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [F-Secure Startup Wizard] "J:\Program Files\AntivirusFirewall\FSGUI\FSSW.EXE" /reboot
O4 - HKLM\..\Run: [News Service] "J:\Program Files\AntivirusFirewall\FSGUI\ispnews.exe"
O4 - HKLM\..\Run: [czafsi] j:\windows\system32\czafsi.exe czafsi
O4 - HKLM\..\Run: [SystemOptimizer] rundll32.exe "J:\WINDOWS\system32\odhdpwrd.dll",forkonce
O4 - HKCU\..\Run: [CTFMON.EXE] J:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "J:\Program Files\Logitech\Video\ManifestEngine.exe" boot
O4 - HKCU\..\Run: [desktop] J:\WINDOWS\system32\idemlog.exe
O4 - HKCU\..\Run: [msag] media64.exe
O4 - HKCU\..\Run: [SetupExeDll] UserSp1.exe
O4 - HKCU\..\Run: [LOPTCON] dePloy.exe
O4 - HKCU\..\Run: [messengerskinner] J:\Program Files\MessengerSkinner\MessengerSkinner.exe
O4 - HKCU\..\Run: [dkcpvgojn] j:\windows\system32\dkcpvgojn.exe dkcpvgojn
O4 - Global Startup: Antivirus Firewall.lnk = J:\Program Files\AntivirusFirewall\backweb\6588780\Program\fspex.exe
O4 - Global Startup: GStartup.lnk = J:\Program Files\Fichiers communs\GMT\GMT.exe
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = J:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O4 - Global Startup: Microsoft Office.lnk = J:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &Bloquer cette fenêtre publicitaire - J:\Program Files\AntivirusFirewall\Anti-Spyware\blockpopups.htm
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://J:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - J:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - J:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: Protection Internet Explorer - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - J:\Program Files\AntivirusFirewall\Anti-Spyware\ieshield.dll
O9 - Extra 'Tools' menuitem: Protection Internet Explorer... - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - J:\Program Files\AntivirusFirewall\Anti-Spyware\ieshield.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - J:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - J:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} - http://212.157.152.82/AxisCamControl.ocx
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/ [...] loader.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{33E60B27-1042-4D8F-82AA-73F0F77B6F6A}: NameServer = 85.255.113.146,85.255.112.81
O17 - HKLM\System\CCS\Services\Tcpip\..\{3DF46FAB-E5F2-4E99-90AB-649F7F09E616}: NameServer = 85.255.113.146,85.255.112.81
O17 - HKLM\System\CCS\Services\Tcpip\..\{9A7657FF-B106-4A04-9898-A5B5DF0BA524}: NameServer = 85.255.113.146,85.255.112.81
O17 - HKLM\System\CCS\Services\Tcpip\..\{DBB0B651-0119-468B-8ADD-EFAA0A618E34}: NameServer = 85.255.113.146,85.255.112.81
O17 - HKLM\System\CS1\Services\Tcpip\..\{33E60B27-1042-4D8F-82AA-73F0F77B6F6A}: NameServer = 85.255.113.146,85.255.112.81
O17 - HKLM\System\CS2\Services\Tcpip\..\{33E60B27-1042-4D8F-82AA-73F0F77B6F6A}: NameServer = 85.255.113.146,85.255.112.81
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - J:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - J:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - J:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Antivirus Firewall (BackWeb Plug-in - 6588780) - Securitoo Portal - J:\PROGRA~1\ANTIVI~1\backweb\6588780\Program\SERVIC~1.EXE
O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corporation - J:\Program Files\AntivirusFirewall\Anti-Virus\fsgk32st.exe
O23 - Service: fsbwsys - F-Secure Corp. - J:\Program Files\AntivirusFirewall\backweb\6588780\program\fsbwsys.exe
O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - J:\Program Files\AntivirusFirewall\FWES\Program\fsdfwd.exe
O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - J:\Program Files\AntivirusFirewall\Common\FSMA32.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - J:\WINDOWS\system32\nvsvc32.exe
O23 - Service: X10 Device Network Service (x10nets) - X10 - J:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe

Et pour finir le dernier raport clean

Script execute en mode sans echec
Rapport clean par Malekal_morte - http://www.malekal.com
Script execute en mode sans echec 18/09/2007 a 22:56:53,75

Microsoft Windows XP [version 5.1.2600]

*** Suppression des fichiers dans J:

*** Suppression des fichiers dans J:\WINDOWS\

*** Suppression des fichiers dans J:\WINDOWS\system32
tentative de suppression de J:\WINDOWS\system32\mcrh.tmp

*** Suppression des fichiers dans J:\Program Files

*** Suppression des clefs du registre effectuee..
*** Fin du rapport !

Merci

oups!!!! bonjour quand meme !

voila le nouveau rapport hijackthis apres le fixLogfile of HijackThis v1.99.1
Scan saved at 15:29:53, on 19/09/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
J:\WINDOWS\System32\smss.exe
J:\WINDOWS\system32\winlogon.exe
J:\WINDOWS\system32\services.exe
J:\WINDOWS\system32\lsass.exe
J:\WINDOWS\system32\svchost.exe
J:\WINDOWS\System32\svchost.exe
J:\WINDOWS\system32\spoolsv.exe
J:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
J:\PROGRA~1\ANTIVI~1\backweb\6588780\Program\SERVIC~1.EXE
J:\Program Files\AntivirusFirewall\Anti-Virus\fsgk32st.exe
J:\Program Files\AntivirusFirewall\Anti-Virus\FSGK32.EXE
J:\Program Files\AntivirusFirewall\backweb\6588780\program\fsbwsys.exe
J:\Program Files\AntivirusFirewall\Anti-Virus\fssm32.exe
J:\Program Files\AntivirusFirewall\Common\FSMA32.EXE
J:\Program Files\AntivirusFirewall\Common\FSMB32.EXE
J:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
J:\WINDOWS\system32\nvsvc32.exe
J:\WINDOWS\system32\svchost.exe
J:\Program Files\AntivirusFirewall\Common\FCH32.EXE
J:\Program Files\AntivirusFirewall\Anti-Virus\fsqh.exe
J:\Program Files\AntivirusFirewall\Common\FAMEH32.EXE
J:\Program Files\AntivirusFirewall\Anti-Virus\fsrw.exe
J:\Program Files\AntivirusFirewall\FWES\Program\fsdfwd.exe
J:\Program Files\AntivirusFirewall\Anti-Virus\fsav32.exe
J:\WINDOWS\Explorer.EXE
J:\WINDOWS\AGRSMMSG.exe
J:\Program Files\Home Cinema\PowerCinema\PCMService.exe
J:\WINDOWS\Dit.exe
J:\WINDOWS\system32\LVCOMSX.EXE
J:\Program Files\Logitech\Video\LogiTray.exe
J:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
J:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe
J:\Program Files\QuickTime\qttask.exe
J:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
J:\Program Files\AntivirusFirewall\Common\FSM32.EXE
J:\Program Files\AntivirusFirewall\FSGUI\ispnews.exe
J:\PROGRA~1\ANTIVI~1\ANTI-S~1\fsaw.exe
J:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
J:\Program Files\AntivirusFirewall\FSGUI\fsguidll.exe
J:\WINDOWS\system32\ctfmon.exe
J:\WINDOWS\System32\svchost.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
J:\Program Files\Logitech\Video\FxSvr2.exe
J:\Program Files\AntivirusFirewall\backweb\6588780\Program\fspex.exe
J:\Program Files\internet explorer\iexplore.exe
J:\Program Files\MSN Messenger\usnsvc.exe
J:\Program Files\WinRAR\WinRAR.exe
J:\DOCUME~1\Papa\LOCALS~1\Temp\Rar$EX00.312\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.orange.fr/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - J:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - J:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - J:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - J:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - J:\Program Files\MSN Apps\MSN Toolbar\01.02.5000.1021\fr\msntb.dll
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - J:\Program Files\MSN Apps\MSN Toolbar\01.02.5000.1021\fr\msntb.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE J:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE J:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [F-Secure TNB] "J:\Program Files\Securitoo\av_fw\TNB\TNBUtil.exe" /CHECKALL /WAITFORSW
O4 - HKLM\..\Run: [NeroFilterCheck] J:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [PCMService] "J:\Program Files\Home Cinema\PowerCinema\PCMService.exe"
O4 - HKLM\..\Run: [Dit] Dit.exe
O4 - HKLM\..\Run: [FSASWREG] "J:\Program Files\Securitoo\av_fw\Anti-Spyware\fsaswreg.exe"
O4 - HKLM\..\Run: [Raccourci vers la page des propriétés de High Definition Audio] HDAudPropShortcut.exe
O4 - HKLM\..\Run: [MW1HelperStartUp] J:\PROGRA~1\MAGICW~1\MW1HEL~1.EXE /partner MW1
O4 - HKLM\..\Run: [LVCOMSX] J:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechVideoRepair] J:\Program Files\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [LogitechVideoTray] J:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [TkBellExe] "J:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [BO1HelperStartUp] J:\PROGRA~1\BUTTER~1\BO1HEL~1.EXE /partner BO1
O4 - HKLM\..\Run: [AQ3HelperStartUp] J:\PROGRA~1\AQUATI~1\AQ3HEL~1.EXE /partner AQ3
O4 - HKLM\..\Run: [ExtraFilmHemmaAgent] "J:\Program Files\Extrafilm FotoFacil\Agent.exe"
O4 - HKLM\..\Run: [DXM6Patch_981116] J:\WINDOWS\p_981116.exe /Q:A
O4 - HKLM\..\Run: [QuickTime Task] "J:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] "J:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [F-Secure Manager] "J:\Program Files\AntivirusFirewall\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [F-Secure Startup Wizard] "J:\Program Files\AntivirusFirewall\FSGUI\FSSW.EXE" /reboot
O4 - HKLM\..\Run: [News Service] "J:\Program Files\AntivirusFirewall\FSGUI\ispnews.exe"
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "J:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [CTFMON.EXE] J:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "J:\Program Files\Logitech\Video\ManifestEngine.exe" boot
O4 - Global Startup: Antivirus Firewall.lnk = J:\Program Files\AntivirusFirewall\backweb\6588780\Program\fspex.exe
O4 - Global Startup: GStartup.lnk = J:\Program Files\Fichiers communs\GMT\GMT.exe
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = J:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O4 - Global Startup: Microsoft Office.lnk = J:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &Bloquer cette fenêtre publicitaire - J:\Program Files\AntivirusFirewall\Anti-Spyware\blockpopups.htm
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://J:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - J:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - J:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: Protection Internet Explorer - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - J:\Program Files\AntivirusFirewall\Anti-Spyware\ieshield.dll
O9 - Extra 'Tools' menuitem: Protection Internet Explorer... - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - J:\Program Files\AntivirusFirewall\Anti-Spyware\ieshield.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - J:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - J:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} - http://212.157.152.82/AxisCamControl.ocx
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/ [...] loader.cab
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - J:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - J:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: WgaLogon - J:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - J:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - J:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Antivirus Firewall (BackWeb Plug-in - 6588780) - Securitoo Portal - J:\PROGRA~1\ANTIVI~1\backweb\6588780\Program\SERVIC~1.EXE
O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corporation - J:\Program Files\AntivirusFirewall\Anti-Virus\fsgk32st.exe
O23 - Service: fsbwsys - F-Secure Corp. - J:\Program Files\AntivirusFirewall\backweb\6588780\program\fsbwsys.exe
O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - J:\Program Files\AntivirusFirewall\FWES\Program\fsdfwd.exe
O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - J:\Program Files\AntivirusFirewall\Common\FSMA32.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - J:\WINDOWS\system32\nvsvc32.exe
O23 - Service: X10 Device Network Service (x10nets) - X10 - J:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe

merci

oui ca a l air de mieux fonctionner

avg as peut t il etre en conflit avec securitoo ?

non tout fonctionnes alors un grand merci et bravo pour cette reparation en ligne peut etre a une autre fois merci encore momo01440