Virus " enter both words below separated ...&

Salut vikipetit

On va vérifier cela, télécharge RSIT (de random/random) sur le bureau ici :
http://images.malwareremoval.com/random/RSIT.exe

Fais un clique droit sur RSIT sur le bureau et choisir Propriétés, ensuite va sur l'onglet Compatibilité et coche la case devant Exécuter ce programme en mode compatibilité pour..., choisir Windows xp sp3.

Fais Appliquer et ok .

- Clique droit sur RSIT.exe qui est sur le bureau et choisir exécuter en tant qu'administrateur

- Clique sur Continue dans la fenêtre
- RSIT téléchargera HijackThis si il n’est pas présent où détecté, alors il faudra accepter la licence
- Poste le contenue des deux rapports, log.txt et info.txt(réduit dans la barre des tâches) à la fin de l’analyse

Les rapports sont dans le dossier ici C:\rsit

@++ :)

Voila le Log.txt

eLogfile of random's system information tool 1.06 (written by random/random)
Run by Bruno at 2010-03-12 21:39:47
Microsoft Windows 7 Édition Familiale Premium Service Pack 3
System drive C: has 529 GB (89%) free of 596 GB
Total RAM: 4095 MB (61% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:39:52, on 12/03/2010
Platform: Unknown Windows (WinNT 6.01.3504)
MSIE: Internet Explorer v8.00 (8.00.7600.16385)
Boot mode: Normal

Running processes:
C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe
C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe
C:\Program Files (x86)\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe
C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files (x86)\Steam\Steam.exe
C:\Program Files (x86)\Hewlett-Packard\HP Odometer\hpsysdrv.exe
C:\Program Files (x86)\Hewlett-Packard\HP Remote Solution\HP_Remote_Solution.exe
C:\Program Files (x86)\hp\HP Software Update\hpwuschd2.exe
C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
c:\Program Files (x86)\Hewlett-Packard\Media\DVD\DVDAgent.exe
C:\Program Files (x86)\Internet Explorer\IELowutil.exe
c:\Program Files (x86)\Hewlett-Packard\TouchSmart\Media\Kernel\CLML\CLMLSvc.exe
C:\Windows\SysWOW64\rundll32.exe
c:\program files (x86)\aol\aol toolbar 5.0\AolTbServer.exe
C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbarUser_32.exe
C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Users\Bruno\Desktop\RSIT.exe
C:\Program Files (x86)\trend micro\Bruno.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr?cobrand=hp-desktop.msn.com&ocid=HPDHP&pc=HPDTDF
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr?cobrand=hp-desktop.msn.com&ocid=HPDHP&pc=HPDTDF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr?cobrand=hp-desktop.msn.com&ocid=HPDHP&pc=HPDTDF
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
F2 - REG:system.ini: UserInit=userinit.exe
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: AOL Toolbar BHO - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - C:\Program Files (x86)\AOL\AOL Toolbar 5.0\aoltb.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files (x86)\Google\GoogleToolbarNotifier\5.5.4723.1820\swg.dll
O3 - Toolbar: AOL Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files (x86)\AOL\AOL Toolbar 5.0\aoltb.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll
O4 - HKLM\..\Run: [hpsysdrv] c:\program files (x86)\hewlett-packard\HP odometer\hpsysdrv.exe
O4 - HKLM\..\Run: [HP Remote Solution] %ProgramFiles%\Hewlett-Packard\HP Remote Solution\HP_Remote_Solution.exe
O4 - HKLM\..\Run: [HP Software Update] c:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [NortonOnlineBackupReminder] "C:\Program Files (x86)\Symantec\Norton Online Backup\Activation\NobuActivation.exe" UNATTENDED
O4 - HKLM\..\Run: [Easybits Recovery] C:\Program Files (x86)\EasyBits For Kids\ezRecover.exe
O4 - HKLM\..\Run: [UpdatePRCShortCut] "C:\Program Files (x86)\Hewlett-Packard\Recovery\MUITransfer\MUIStartMenu.exe" "C:\Program Files (x86)\Hewlett-Packard\Recovery" UpdateWithCreateOnce "Software\CyberLink\PowerRecover"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [avgnt] "C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKLM\..\Run: [sysfbtray] c:\windows\bill103.exe
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [Livestation] C:\Program Files (x86)\Livestation\Livestation.exe -startup
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe" -autorun
O4 - HKCU\..\Run: [Sony Ericsson PC Suite] "C:\Program Files (x86)\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe" /systray /nologon
O4 - HKCU\..\Run: [swg] "C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O4 - HKCU\..\Run: [Steam] "C:\Program Files (x86)\Steam\Steam.exe" -silent
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'SERVICE RÉSEAU')
O4 - Startup: Adobe Gamma.lnk = C:\Program Files (x86)\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O8 - Extra context menu item: &Recherche AOL Toolbar - C:\ProgramData\AOL\ieToolbar\resources\fr-FR\local\search.html
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\Windows\system32\GPhotos.scr/200
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~2\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Google Sidewiki... - res://C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll/cmsidewiki.html
O9 - Extra button: Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: &Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~2\Office12\REFIEBAR.DLL
O13 - Gopher Prefix:
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://appldnld.apple.com/QuickTime/qtactivex/qtplugin.cab
O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} (Ma-Config control) - http://fichiers.touslesdrivers.com/maconfig/MaConfig_4_0_1_3.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files (x86)\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: Avira AntiVir Planificateur (AntiVirSchedulerService) - Avira GmbH - C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files (x86)\Bonjour\mDNSResponder.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: GameConsoleService - WildTangent, Inc. - C:\Program Files (x86)\HP Games\HP Game Console\GameConsoleService.exe
O23 - Service: Service Google Update (gupdate) (gupdate) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files (x86)\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: HP Health Check Service - Hewlett-Packard - C:\Program Files (x86)\Hewlett-Packard\HP Health Check\hphc_service.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files (x86)\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files (x86)\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - c:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe
O23 - Service: Ma-Config Service (maconfservice) - CybelSoft - C:\Program Files (x86)\ma-config.com\maconfservice.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (nvsvc) - Unknown owner - C:\Windows\system32\nvvsvc.exe (file missing)
O23 - Service: Sony Ericsson OMSI download service (OMSI download service) - Unknown owner - C:\Program Files (x86)\Sony Ericsson\Sony Ericsson PC Suite\SupServ.exe
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files (x86)\Common Files\Steam\SteamService.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: webserver - Unknown owner - C:\Program Files (x86)\webserver\webserver.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

eLogfile of random's system information tool 1.06 (written by random/random)
Run by Bruno at 2010-03-12 21:39:47
Microsoft Windows 7 Édition Familiale Premium Service Pack 3
System drive C: has 529 GB (89%) free of 596 GB
Total RAM: 4095 MB (61% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:39:52, on 12/03/2010
Platform: Unknown Windows (WinNT 6.01.3504)
MSIE: Internet Explorer v8.00 (8.00.7600.16385)
Boot mode: Normal

Running processes:
C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe
C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe
C:\Program Files (x86)\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe
C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files (x86)\Steam\Steam.exe
C:\Program Files (x86)\Hewlett-Packard\HP Odometer\hpsysdrv.exe
C:\Program Files (x86)\Hewlett-Packard\HP Remote Solution\HP_Remote_Solution.exe
C:\Program Files (x86)\hp\HP Software Update\hpwuschd2.exe
C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
c:\Program Files (x86)\Hewlett-Packard\Media\DVD\DVDAgent.exe
C:\Program Files (x86)\Internet Explorer\IELowutil.exe
c:\Program Files (x86)\Hewlett-Packard\TouchSmart\Media\Kernel\CLML\CLMLSvc.exe
C:\Windows\SysWOW64\rundll32.exe
c:\program files (x86)\aol\aol toolbar 5.0\AolTbServer.exe
C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbarUser_32.exe
C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Users\Bruno\Desktop\RSIT.exe
C:\Program Files (x86)\trend micro\Bruno.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/...
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/...
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/...
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
F2 - REG:system.ini: UserInit=userinit.exe
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: AOL Toolbar BHO - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - C:\Program Files (x86)\AOL\AOL Toolbar 5.0\aoltb.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files (x86)\Google\GoogleToolbarNotifier\5.5.4723.1820\swg.dll
O3 - Toolbar: AOL Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files (x86)\AOL\AOL Toolbar 5.0\aoltb.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll
O4 - HKLM\..\Run: [hpsysdrv] c:\program files (x86)\hewlett-packard\HP odometer\hpsysdrv.exe
O4 - HKLM\..\Run: [HP Remote Solution] %ProgramFiles%\Hewlett-Packard\HP Remote Solution\HP_Remote_Solution.exe
O4 - HKLM\..\Run: [HP Software Update] c:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [NortonOnlineBackupReminder] "C:\Program Files (x86)\Symantec\Norton Online Backup\Activation\NobuActivation.exe" UNATTENDED
O4 - HKLM\..\Run: [Easybits Recovery] C:\Program Files (x86)\EasyBits For Kids\ezRecover.exe
O4 - HKLM\..\Run: [UpdatePRCShortCut] "C:\Program Files (x86)\Hewlett-Packard\Recovery\MUITransfer\MUIStartMenu.exe" "C:\Program Files (x86)\Hewlett-Packard\Recovery" UpdateWithCreateOnce "Software\CyberLink\PowerRecover"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [avgnt] "C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKLM\..\Run: [sysfbtray] c:\windows\bill103.exe
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [Livestation] C:\Program Files (x86)\Livestation\Livestation.exe -startup
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe" -autorun
O4 - HKCU\..\Run: [Sony Ericsson PC Suite] "C:\Program Files (x86)\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe" /systray /nologon
O4 - HKCU\..\Run: [swg] "C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O4 - HKCU\..\Run: [Steam] "C:\Program Files (x86)\Steam\Steam.exe" -silent
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'SERVICE RÉSEAU')
O4 - Startup: Adobe Gamma.lnk = C:\Program Files (x86)\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O8 - Extra context menu item: &Recherche AOL Toolbar - C:\ProgramData\AOL\ieToolbar\resources\fr-FR\local\search.html
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\Windows\system32\GPhotos.scr/200
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~2\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Google Sidewiki... - res://C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll/cmsidewiki.html
O9 - Extra button: Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: &Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~2\Office12\REFIEBAR.DLL
O13 - Gopher Prefix:
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://appldnld.apple.com.edgesuite.net/...
O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} (Ma-Config control) - http://fichiers.touslesdrivers.com/maconfig/MaConfig_4_0_1_3.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files (x86)\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: Avira AntiVir Planificateur (AntiVirSchedulerService) - Avira GmbH - C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files (x86)\Bonjour\mDNSResponder.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: GameConsoleService - WildTangent, Inc. - C:\Program Files (x86)\HP Games\HP Game Console\GameConsoleService.exe
O23 - Service: Service Google Update (gupdate) (gupdate) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files (x86)\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: HP Health Check Service - Hewlett-Packard - C:\Program Files (x86)\Hewlett-Packard\HP Health Check\hphc_service.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files (x86)\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files (x86)\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - c:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe
O23 - Service: Ma-Config Service (maconfservice) - CybelSoft - C:\Program Files (x86)\ma-config.com\maconfservice.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (nvsvc) - Unknown owner - C:\Windows\system32\nvvsvc.exe (file missing)
O23 - Service: Sony Ericsson OMSI download service (OMSI download service) - Unknown owner - C:\Program Files (x86)\Sony Ericsson\Sony Ericsson PC Suite\SupServ.exe
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files (x86)\Common Files\Steam\SteamService.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: webserver - Unknown owner - C:\Program Files (x86)\webserver\webserver.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

Salut vikipetit

Faire un scan de ce fichier captcha.dll ici :

https://www.virustotal.com/gui/

Clique sur Parcourir et copie/colle ceci :
C:\Windows\system32\captcha.dll
Après tu clique sur Envoyer le fichier et attendre le résultat de l’analyse.

Si il te dit que le fichier a déjà été analysé, sélectionne le bouton :
Reanalyse le fichier maintenant et attendre le résultat de l'analyse, poste le résultat au complet.

Poste le résultat au complet

Aide : http://bibou0007.com/scans-en-ligne-f75/tutorial-sur-virustotal-t190.htm

@++ :)

Impression des résultats Votre fichier a expiré ou n'existe pas.
Le service est en ce moment, stoppé, votre fichier attend d'être analysé (position : ) depuis une durée indéfinie.
Vous pouvez attendre une réponse du Web (re-chargement automatique) ou taper votre e-mail dans le formulaire ci-dessous et cliquer "Demande" pour que le système vous envoie une notification quand l'analyse sera terminée. Email:

Antivirus Version Dernière mise à jour Résultat
a-squared 4.5.0.50 2010.03.12 -
AhnLab-V3 5.0.0.2 2010.03.12 -
AntiVir 8.2.1.180 2010.03.12 Worm/Koobface.fvz
Antiy-AVL 2.0.3.7 2010.03.12 Worm/Win32.Koobface
Authentium 5.2.0.5 2010.03.12 -
Avast 4.8.1351.0 2010.03.12 -
Avast5 5.0.332.0 2010.03.12 -
AVG 9.0.0.787 2010.03.12 -
BitDefender 7.2 2010.03.12 -
CAT-QuickHeal 10.00 2010.03.12 -
ClamAV 0.96.0.0-git 2010.03.12 Worm.Koobface-118
Comodo 4240 2010.03.12 Backdoor.Win32.PcClient.~a
DrWeb 5.0.1.12222 2010.03.12 -
eSafe 7.0.17.0 2010.03.11 -
eTrust-Vet 35.2.7357 2010.03.12 Win32/Koobface.LL
F-Prot 4.5.1.85 2010.03.12 -
F-Secure 9.0.15370.0 2010.03.12 -
Fortinet 4.0.14.0 2010.03.09 -
GData 19 2010.03.12 -
Ikarus T3.1.1.80.0 2010.03.12 -
Jiangmin 13.0.900 2010.03.12 -
K7AntiVirus 7.10.996 2010.03.12 -
Kaspersky 7.0.0.125 2010.03.12 Net-Worm.Win32.Koobface.fvz
McAfee 5918 2010.03.12 -
McAfee+Artemis 5918 2010.03.12 Artemis!177AF17589E6
McAfee-GW-Edition 6.8.5 2010.03.12 Worm.Koobface.fvz
Microsoft 1.5502 2010.03.12 Trojan:Win32/Koobface.gen!J
NOD32 4940 2010.03.12 -
Norman 6.04.08 2010.03.12 -
nProtect 2009.1.8.0 2010.03.12 -
Panda 10.0.2.2 2010.03.12 Trj/CI.A
PCTools 7.0.3.5 2010.03.12 -
Rising 22.38.04.03 2010.03.12 Trojan.Win32.Generic.51FAEC00
Sophos 4.51.0 2010.03.12 Mal/DownLdr-O
Sunbelt 5843 2010.03.12 Trojan.Win32.Generic!BT
Symantec 20091.2.0.41 2010.03.12 Suspicious.Insight
TheHacker 6.5.2.0.232 2010.03.12 W32/Koobface.fvz
TrendMicro 9.120.0.1004 2010.03.12 PAK_Generic.001
VBA32 3.12.12.2 2010.03.12 -
ViRobot 2010.3.12.2224 2010.03.12 -
VirusBuster 5.0.27.0 2010.03.12 -
Information additionnelle
File size: 18944 bytes
MD5...: 177af17589e6099605631a481f697315
SHA1..: 30a3d9d341d8cb9fef4708557c8a0a6f619e4232
SHA256: ef8cd79b25b29f7019b5747f60c63df971c9c3b555e620861a1ed434d4fad4d7
ssdeep: 384:8dPr58Ag/7CHFcLfpWj7z01Ma2tU9oChN249dzkSM+LOkaGMt1O:8dTSAg/W
HOi7zwMad9oSdwSMewt

PEiD..: -
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0xeff0
timedatestamp.....: 0x4b98b8d1 (Thu Mar 11 09:33:05 2010)
machinetype.......: 0x14c (I386)

( 3 sections )
name viradd virsiz rawdsiz ntrpy md5
UPX0 0x1000 0xa000 0x0 0.00 d41d8cd98f00b204e9800998ecf8427e
UPX1 0xb000 0x5000 0x4200 7.87 44f0d64bfbfb2ba190331c93cc0ddcb8
.rsrc 0x10000 0x1000 0x400 3.40 83306953ba3e32154c776b385008987c

( 11 imports )
> KERNEL32.DLL: LoadLibraryA, GetProcAddress, VirtualProtect, VirtualAlloc, VirtualFree
> ADVAPI32.dll: SetServiceStatus
> COMCTL32.dll: _TrackMouseEvent
> GDI32.dll: BitBlt
> MFC42.DLL: -
> MSVCRT.dll: free
> ole32.dll: CoInitialize
> OLEPRO32.DLL: -
> SHELL32.dll: ShellExecuteExA
> urlmon.dll: URLDownloadToFileA
> USER32.dll: SetTimer

( 1 exports )
ServiceMain

RDS...: NSRL Reference Data Set
-
pdfid.: -
trid..: UPX compressed Win32 Executable (39.5%)
Win32 EXE Yoda's Crypter (34.3%)
Win32 Executable Generic (11.0%)
Win32 Dynamic Link Library (generic) (9.8%)
Generic Win/DOS Executable (2.5%)
packers (Kaspersky): PE_Patch.UPX, UPX
sigcheck:
publisher....: n/a
copyright....: n/a
product......: n/a
description..: n/a
original name: n/a
internal name: n/a
file version.: n/a
comments.....: n/a
signers......: -
signing date.: -
verified.....: Unsigned

packers (Antiy-AVL): ACProtect V1.3X-1.4X DLL
packers (F-Prot): UPX

Fichier captcha.dll reçu le 2010.03.12 21:00:45 (UTC)Antivirus Version Dernière mise à jour Résultat
a-squared 4.5.0.50 2010.03.12 -
AhnLab-V3 5.0.0.2 2010.03.12 -
AntiVir 8.2.1.180 2010.03.12 Worm/Koobface.fvz
Antiy-AVL 2.0.3.7 2010.03.12 Worm/Win32.Koobface
Authentium 5.2.0.5 2010.03.12 -
Avast 4.8.1351.0 2010.03.12 -
Avast5 5.0.332.0 2010.03.12 -
AVG 9.0.0.787 2010.03.12 -
BitDefender 7.2 2010.03.12 -
CAT-QuickHeal 10.00 2010.03.12 -
ClamAV 0.96.0.0-git 2010.03.12 Worm.Koobface-118
Comodo 4240 2010.03.12 Backdoor.Win32.PcClient.~a
DrWeb 5.0.1.12222 2010.03.12 -
eSafe 7.0.17.0 2010.03.11 -
eTrust-Vet 35.2.7357 2010.03.12 Win32/Koobface.LL
F-Prot 4.5.1.85 2010.03.12 -
F-Secure 9.0.15370.0 2010.03.12 -
Fortinet 4.0.14.0 2010.03.09 -
GData 19 2010.03.12 -
Ikarus T3.1.1.80.0 2010.03.12 -
Jiangmin 13.0.900 2010.03.12 -
K7AntiVirus 7.10.996 2010.03.12 -
Kaspersky 7.0.0.125 2010.03.12 Net-Worm.Win32.Koobface.fvz
McAfee 5918 2010.03.12 -
McAfee+Artemis 5918 2010.03.12 Artemis!177AF17589E6
McAfee-GW-Edition 6.8.5 2010.03.12 Worm.Koobface.fvz
Microsoft 1.5502 2010.03.12 Trojan:Win32/Koobface.gen!J
NOD32 4940 2010.03.12 -
Norman 6.04.08 2010.03.12 -
nProtect 2009.1.8.0 2010.03.12 -
Panda 10.0.2.2 2010.03.12 Trj/CI.A
PCTools 7.0.3.5 2010.03.12 -
Rising 22.38.04.03 2010.03.12 Trojan.Win32.Generic.51FAEC00
Sophos 4.51.0 2010.03.12 Mal/DownLdr-O
Sunbelt 5843 2010.03.12 Trojan.Win32.Generic!BT
Symantec 20091.2.0.41 2010.03.12 Suspicious.Insight
TheHacker 6.5.2.0.232 2010.03.12 W32/Koobface.fvz
TrendMicro 9.120.0.1004 2010.03.12 PAK_Generic.001
VBA32 3.12.12.2 2010.03.12 -
ViRobot 2010.3.12.2224 2010.03.12 -
VirusBuster 5.0.27.0 2010.03.12 -

Information additionnelle
File size: 18944 bytes
MD5...: 177af17589e6099605631a481f697315
SHA1..: 30a3d9d341d8cb9fef4708557c8a0a6f619e4232
SHA256: ef8cd79b25b29f7019b5747f60c63df971c9c3b555e620861a1ed434d4fad4d7
ssdeep: 384:8dPr58Ag/7CHFcLfpWj7z01Ma2tU9oChN249dzkSM+LOkaGMt1O:8dTSAg/W<BR>HOi7zwMad9oSdwSMewt<BR>
PEiD..: -
PEInfo: PE Structure information<BR><BR>( base data )<BR>entrypointaddress.: 0xeff0<BR>timedatestamp.....: 0x4b98b8d1 (Thu Mar 11 09:33:05 2010)<BR>machinetype.......: 0x14c (I386)<BR><BR>( 3 sections )<BR>name viradd virsiz rawdsiz ntrpy md5<BR>UPX0 0x1000 0xa000 0x0 0.00 d41d8cd98f00b204e9800998ecf8427e<BR>UPX1 0xb000 0x5000 0x4200 7.87 44f0d64bfbfb2ba190331c93cc0ddcb8<BR>.rsrc 0x10000 0x1000 0x400 3.40 83306953ba3e32154c776b385008987c<BR><BR>( 11 imports ) <BR>> KERNEL32.DLL: LoadLibraryA, GetProcAddress, VirtualProtect, VirtualAlloc, VirtualFree<BR>> ADVAPI32.dll: SetServiceStatus<BR>> COMCTL32.dll: _TrackMouseEvent<BR>> GDI32.dll: BitBlt<BR>> MFC42.DLL: -<BR>> MSVCRT.dll: free<BR>> ole32.dll: CoInitialize<BR>> OLEPRO32.DLL: -<BR>> SHELL32.dll: ShellExecuteExA<BR>> urlmon.dll: URLDownloadToFileA<BR>> USER32.dll: SetTimer<BR><BR>( 1 exports ) <BR>ServiceMain<BR>
RDS...: NSRL Reference Data Set<BR>-
pdfid.: -
trid..: UPX compressed Win32 Executable (39.5%)<BR>Win32 EXE Yoda's Crypter (34.3%)<BR>Win32 Executable Generic (11.0%)<BR>Win32 Dynamic Link Library (generic) (9.8%)<BR>Generic Win/DOS Executable (2.5%)
packers (Kaspersky): PE_Patch.UPX, UPX
sigcheck:<BR>publisher....: n/a<BR>copyright....: n/a<BR>product......: n/a<BR>description..: n/a<BR>original name: n/a<BR>internal name: n/a<BR>file version.: n/a<BR>comments.....: n/a<BR>signers......: -<BR>signing date.: -<BR>verified.....: Unsigned<BR>
packers (Antiy-AVL): ACProtect V1.3X-1.4X DLL
packers (F-Prot): UPX

Fichier captcha.dll reçu le 2010.03.12 21:00:45 (UTC)Antivirus Version Dernière mise à jour Résultat
a-squared 4.5.0.50 2010.03.12 -
AhnLab-V3 5.0.0.2 2010.03.12 -
AntiVir 8.2.1.180 2010.03.12 Worm/Koobface.fvz
Antiy-AVL 2.0.3.7 2010.03.12 Worm/Win32.Koobface
Authentium 5.2.0.5 2010.03.12 -
Avast 4.8.1351.0 2010.03.12 -
Avast5 5.0.332.0 2010.03.12 -
AVG 9.0.0.787 2010.03.12 -
BitDefender 7.2 2010.03.12 -
CAT-QuickHeal 10.00 2010.03.12 -
ClamAV 0.96.0.0-git 2010.03.12 Worm.Koobface-118
Comodo 4240 2010.03.12 Backdoor.Win32.PcClient.~a
DrWeb 5.0.1.12222 2010.03.12 -
eSafe 7.0.17.0 2010.03.11 -
eTrust-Vet 35.2.7357 2010.03.12 Win32/Koobface.LL
F-Prot 4.5.1.85 2010.03.12 -
F-Secure 9.0.15370.0 2010.03.12 -
Fortinet 4.0.14.0 2010.03.09 -
GData 19 2010.03.12 -
Ikarus T3.1.1.80.0 2010.03.12 -
Jiangmin 13.0.900 2010.03.12 -
K7AntiVirus 7.10.996 2010.03.12 -
Kaspersky 7.0.0.125 2010.03.12 Net-Worm.Win32.Koobface.fvz
McAfee 5918 2010.03.12 -
McAfee+Artemis 5918 2010.03.12 Artemis!177AF17589E6
McAfee-GW-Edition 6.8.5 2010.03.12 Worm.Koobface.fvz
Microsoft 1.5502 2010.03.12 Trojan:Win32/Koobface.gen!J
NOD32 4940 2010.03.12 -
Norman 6.04.08 2010.03.12 -
nProtect 2009.1.8.0 2010.03.12 -
Panda 10.0.2.2 2010.03.12 Trj/CI.A
PCTools 7.0.3.5 2010.03.12 -
Rising 22.38.04.03 2010.03.12 Trojan.Win32.Generic.51FAEC00
Sophos 4.51.0 2010.03.12 Mal/DownLdr-O
Sunbelt 5843 2010.03.12 Trojan.Win32.Generic!BT
Symantec 20091.2.0.41 2010.03.12 Suspicious.Insight
TheHacker 6.5.2.0.232 2010.03.12 W32/Koobface.fvz
TrendMicro 9.120.0.1004 2010.03.12 PAK_Generic.001
VBA32 3.12.12.2 2010.03.12 -
ViRobot 2010.3.12.2224 2010.03.12 -
VirusBuster 5.0.27.0 2010.03.12 -

Information additionnelle
File size: 18944 bytes
MD5...: 177af17589e6099605631a481f697315
SHA1..: 30a3d9d341d8cb9fef4708557c8a0a6f619e4232
SHA256: ef8cd79b25b29f7019b5747f60c63df971c9c3b555e620861a1ed434d4fad4d7
ssdeep: 384:8dPr58Ag/7CHFcLfpWj7z01Ma2tU9oChN249dzkSM+LOkaGMt1O:8dTSAg/W<BR>HOi7zwMad9oSdwSMewt<BR>
PEiD..: -
PEInfo: PE Structure information<BR><BR>( base data )<BR>entrypointaddress.: 0xeff0<BR>timedatestamp.....: 0x4b98b8d1 (Thu Mar 11 09:33:05 2010)<BR>machinetype.......: 0x14c (I386)<BR><BR>( 3 sections )<BR>name viradd virsiz rawdsiz ntrpy md5<BR>UPX0 0x1000 0xa000 0x0 0.00 d41d8cd98f00b204e9800998ecf8427e<BR>UPX1 0xb000 0x5000 0x4200 7.87 44f0d64bfbfb2ba190331c93cc0ddcb8<BR>.rsrc 0x10000 0x1000 0x400 3.40 83306953ba3e32154c776b385008987c<BR><BR>( 11 imports ) <BR>> KERNEL32.DLL: LoadLibraryA, GetProcAddress, VirtualProtect, VirtualAlloc, VirtualFree<BR>> ADVAPI32.dll: SetServiceStatus<BR>> COMCTL32.dll: _TrackMouseEvent<BR>> GDI32.dll: BitBlt<BR>> MFC42.DLL: -<BR>> MSVCRT.dll: free<BR>> ole32.dll: CoInitialize<BR>> OLEPRO32.DLL: -<BR>> SHELL32.dll: ShellExecuteExA<BR>> urlmon.dll: URLDownloadToFileA<BR>> USER32.dll: SetTimer<BR><BR>( 1 exports ) <BR>ServiceMain<BR>
RDS...: NSRL Reference Data Set<BR>-
pdfid.: -
trid..: UPX compressed Win32 Executable (39.5%)<BR>Win32 EXE Yoda's Crypter (34.3%)<BR>Win32 Executable Generic (11.0%)<BR>Win32 Dynamic Link Library (generic) (9.8%)<BR>Generic Win/DOS Executable (2.5%)
packers (Kaspersky): PE_Patch.UPX, UPX
sigcheck:<BR>publisher....: n/a<BR>copyright....: n/a<BR>product......: n/a<BR>description..: n/a<BR>original name: n/a<BR>internal name: n/a<BR>file version.: n/a<BR>comments.....: n/a<BR>signers......: -<BR>signing date.: -<BR>verified.....: Unsigned<BR>
packers (Antiy-AVL): ACProtect V1.3X-1.4X DLL
packers (F-Prot): UPX

Fichier captcha.dll reçu le 2010.03.12 21:00:45 (UTC)Antivirus Version Dernière mise à jour Résultat
a-squared 4.5.0.50 2010.03.12 -
AhnLab-V3 5.0.0.2 2010.03.12 -
AntiVir 8.2.1.180 2010.03.12 Worm/Koobface.fvz
Antiy-AVL 2.0.3.7 2010.03.12 Worm/Win32.Koobface
Authentium 5.2.0.5 2010.03.12 -
Avast 4.8.1351.0 2010.03.12 -
Avast5 5.0.332.0 2010.03.12 -
AVG 9.0.0.787 2010.03.12 -
BitDefender 7.2 2010.03.12 -
CAT-QuickHeal 10.00 2010.03.12 -
ClamAV 0.96.0.0-git 2010.03.12 Worm.Koobface-118
Comodo 4240 2010.03.12 Backdoor.Win32.PcClient.~a
DrWeb 5.0.1.12222 2010.03.12 -
eSafe 7.0.17.0 2010.03.11 -
eTrust-Vet 35.2.7357 2010.03.12 Win32/Koobface.LL
F-Prot 4.5.1.85 2010.03.12 -
F-Secure 9.0.15370.0 2010.03.12 -
Fortinet 4.0.14.0 2010.03.09 -
GData 19 2010.03.12 -
Ikarus T3.1.1.80.0 2010.03.12 -
Jiangmin 13.0.900 2010.03.12 -
K7AntiVirus 7.10.996 2010.03.12 -
Kaspersky 7.0.0.125 2010.03.12 Net-Worm.Win32.Koobface.fvz
McAfee 5918 2010.03.12 -
McAfee+Artemis 5918 2010.03.12 Artemis!177AF17589E6
McAfee-GW-Edition 6.8.5 2010.03.12 Worm.Koobface.fvz
Microsoft 1.5502 2010.03.12 Trojan:Win32/Koobface.gen!J
NOD32 4940 2010.03.12 -
Norman 6.04.08 2010.03.12 -
nProtect 2009.1.8.0 2010.03.12 -
Panda 10.0.2.2 2010.03.12 Trj/CI.A
PCTools 7.0.3.5 2010.03.12 -
Rising 22.38.04.03 2010.03.12 Trojan.Win32.Generic.51FAEC00
Sophos 4.51.0 2010.03.12 Mal/DownLdr-O
Sunbelt 5843 2010.03.12 Trojan.Win32.Generic!BT
Symantec 20091.2.0.41 2010.03.12 Suspicious.Insight
TheHacker 6.5.2.0.232 2010.03.12 W32/Koobface.fvz
TrendMicro 9.120.0.1004 2010.03.12 PAK_Generic.001
VBA32 3.12.12.2 2010.03.12 -
ViRobot 2010.3.12.2224 2010.03.12 -
VirusBuster 5.0.27.0 2010.03.12 -

Information additionnelle
File size: 18944 bytes
MD5...: 177af17589e6099605631a481f697315
SHA1..: 30a3d9d341d8cb9fef4708557c8a0a6f619e4232
SHA256: ef8cd79b25b29f7019b5747f60c63df971c9c3b555e620861a1ed434d4fad4d7
ssdeep: 384:8dPr58Ag/7CHFcLfpWj7z01Ma2tU9oChN249dzkSM+LOkaGMt1O:8dTSAg/W<BR>HOi7zwMad9oSdwSMewt<BR>
PEiD..: -
PEInfo: PE Structure information<BR><BR>( base data )<BR>entrypointaddress.: 0xeff0<BR>timedatestamp.....: 0x4b98b8d1 (Thu Mar 11 09:33:05 2010)<BR>machinetype.......: 0x14c (I386)<BR><BR>( 3 sections )<BR>name viradd virsiz rawdsiz ntrpy md5<BR>UPX0 0x1000 0xa000 0x0 0.00 d41d8cd98f00b204e9800998ecf8427e<BR>UPX1 0xb000 0x5000 0x4200 7.87 44f0d64bfbfb2ba190331c93cc0ddcb8<BR>.rsrc 0x10000 0x1000 0x400 3.40 83306953ba3e32154c776b385008987c<BR><BR>( 11 imports ) <BR>> KERNEL32.DLL: LoadLibraryA, GetProcAddress, VirtualProtect, VirtualAlloc, VirtualFree<BR>> ADVAPI32.dll: SetServiceStatus<BR>> COMCTL32.dll: _TrackMouseEvent<BR>> GDI32.dll: BitBlt<BR>> MFC42.DLL: -<BR>> MSVCRT.dll: free<BR>> ole32.dll: CoInitialize<BR>> OLEPRO32.DLL: -<BR>> SHELL32.dll: ShellExecuteExA<BR>> urlmon.dll: URLDownloadToFileA<BR>> USER32.dll: SetTimer<BR><BR>( 1 exports ) <BR>ServiceMain<BR>
RDS...: NSRL Reference Data Set<BR>-
pdfid.: -
trid..: UPX compressed Win32 Executable (39.5%)<BR>Win32 EXE Yoda's Crypter (34.3%)<BR>Win32 Executable Generic (11.0%)<BR>Win32 Dynamic Link Library (generic) (9.8%)<BR>Generic Win/DOS Executable (2.5%)
packers (Kaspersky): PE_Patch.UPX, UPX
sigcheck:<BR>publisher....: n/a<BR>copyright....: n/a<BR>product......: n/a<BR>description..: n/a<BR>original name: n/a<BR>internal name: n/a<BR>file version.: n/a<BR>comments.....: n/a<BR>signers......: -<BR>signing date.: -<BR>verified.....: Unsigned<BR>
packers (Antiy-AVL): ACProtect V1.3X-1.4X DLL
packers (F-Prot): UPX

Salut vikipetit

Télécharge OTM (de Old_Timer) sur le bureau :

http://www.geekstogo.com/forum/files/file/402-otm-oldtimers-move-it/

Clique droit sur OTM.exe sur le bureau et choisir exécuter en tant qu'administrateur

- Copie le texte qui se trouve en gras ci-dessous et colle le dans le cadre de gauche de OTM nommé Paste Instructions for Items to be Moved

:services
webserver

:reg
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"sysfbtray"=-

:files
C:\Windows\system32\captcha.dll
C:\Program Files (x86)\webserver

:commands
[purity]
[emptytemp]
[reboot]

- Clique sur MoveIt! pour lancer la suppression.
- Ferme OTM

Ton PC va redémarrer pour finir la suppression, si il ne le fais pas lui-même, redémarre le.

Poste le rapport de OTMoveIt qui se trouve dans C:\_OTM\MovedFiles.

-----

-Télécharge et installe MalwareByte's Anti-Malware
http://www.malwarebytes.org/mbam/program/mbam-setup.exe

- Mets le à jour

---

- Redémarre en mode sans échec :

Au redémarrage de ton PC tapote sur la touche F8 ou F5, sur l'écran suivant déplace toi avec les flèches de direction et choisis Mode sans échec. Choisis ta session habituelle et non la session Administrateur

---

- Double clique sur le raccourci de MalwareByte's Anti-Malware qui est sur le bureau.
- Sélectionne Exécuter un examen complet si ce n'est pas déjà fait
- clique sur Rechercher

- Une fois le scan terminé, une fenêtre s'ouvre, clique sur sur OK

- Si MalwareByte's n'a rien détecté, clique sur OK Un rapport va apparaître ferme-le.

- Si MalwareByte's a détecté des infections, clique sur Afficher les résultats ensuite sur Supprimer la sélection

- Enregistre le rapport sur ton Bureau comme cela il sera plus facile à retrouver, poste ensuite ce rapport.

Note : Si MalwareByte's a besoin de redémarrer pour terminer la suppression, accepte en cliquant sur OK

Tutoriel pour MalwareByte's ici :
https://www.malekal.com/tutoriel-malwarebyte-anti-malware/

@++ :)

All processes killed
========== SERVICES/DRIVERS ==========
Service webserver stopped successfully!
Service webserver deleted successfully!
========== REGISTRY ==========
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersio­n\Run not found.
========== FILES ==========
DllUnregisterServer procedure not found in C:\Windows\system32\captcha.dll
C:\Windows\system32\captcha.dll moved successfully.
C:\Program Files (x86)\webserver folder moved successfully.
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Bruno
->Temp folder emptied: 952705 bytes
->Temporary Internet Files folder emptied: 33840209 bytes
->Google Chrome cache emptied: 6774509 bytes
->Flash cache emptied: 43754 bytes

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->Flash cache emptied: 41620 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Public

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 708678 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 50540 bytes
RecycleBin emptied: 614 bytes

Total Files Cleaned = 40,00 mb

OTM by OldTimer - Version 3.1.10.0 log created on 03122010_221745

Files moved on Reboot...
C:\Users\Bruno\AppData\Local\Temp\15039791.tmp moved successfully.
C:\Users\Bruno\AppData\Local\Temp\15911555.tmp moved successfully.
C:\Users\Bruno\AppData\Local\Temp\16416344.tmp moved successfully.
C:\Users\Bruno\AppData\Local\Temp\16736224.tmp moved successfully.
C:\Users\Bruno\AppData\Local\Temp\17056759.tmp moved successfully.
C:\Users\Bruno\AppData\Local\Temp\17372598.tmp moved successfully.
C:\Users\Bruno\AppData\Local\Temp\17893891.tmp moved successfully.
C:\Users\Bruno\AppData\Local\Temp\18211853.tmp moved successfully.
C:\Users\Bruno\AppData\Local\Temp\18765407.tmp moved successfully.
C:\Users\Bruno\AppData\Local\Temp\19082853.tmp moved successfully.
C:\Users\Bruno\AppData\Local\Temp\19406103.tmp moved successfully.
C:\Users\Bruno\AppData\Local\Temp\19939111.tmp moved successfully.
C:\Users\Bruno\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.
File C:\Users\Bruno\AppData\Local\Temp\~DF0C00286087793F2D.TMP not found!
File C:\Users\Bruno\AppData\Local\Temp\~DF12DE0B422A4A07C4.TMP not found!
File C:\Users\Bruno\AppData\Local\Temp\~DF58D95758EB003F0B.TMP not found!
File C:\Users\Bruno\AppData\Local\Temp\~DF6881623FB0B23141.TMP not found!
File C:\Users\Bruno\AppData\Local\Temp\~DF7FD0FA0FB7E34CC7.TMP not found!
C:\Users\Bruno\AppData\Local\Temp\~DFDC13CD66C78DCCA2.TMP moved successfully.
File C:\Users\Bruno\AppData\Local\Temp\~DFE635BB5AAE727634.TMP not found!
C:\Users\Bruno\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\SuggestedSites.dat moved successfully.
C:\Users\Bruno\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\D0992MU7\affich-16981849-virus-enter-both-words-below-separated[1].txt moved successfully.

Registry entries deleted on Reboot...

Malwarebytes' Anti-Malware 1.44
Version de la base de données: 3861
Windows 6.1.7600 (Safe Mode)
Internet Explorer 8.0.7600.16385

12/03/2010 22:56:43
mbam-log-2010-03-12 (22-56-43).txt

Type de recherche: Examen complet (C:\|D:\|)
Eléments examinés: 320785
Temps écoulé: 26 minute(s), 6 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 2
Valeur(s) du Registre infectée(s): 2
Elément(s) de données du Registre infecté(s): 1
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 9

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\cpqoko6 (Worm.KoobFace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\apto6ko (Worm.KoobFace) -> Quarantined and deleted successfully.

Valeur(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost\tapisrvs (Worm.KoobFace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sysfbtray (Worm.KoobFace) -> Quarantined and deleted successfully.

Elément(s) de données du Registre infecté(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoActiveDesktopChanges (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
C:\Windows\System32\erokosvc.dll (Worm.KoobFace) -> Quarantined and deleted successfully.
C:\Windows\System32\drivers\imapioko.sys (Worm.KoobFace) -> Quarantined and deleted successfully.
C:\Windows\SysWOW64\erokosvc.dll (Worm.KoobFace) -> Quarantined and deleted successfully.
C:\Windows\SysWOW64\drivers\imapioko.sys (Worm.KoobFace) -> Quarantined and deleted successfully.
C:\Windows\ligh (Koobface.Trace) -> Quarantined and deleted successfully.
C:\Windows\bk20856.dat (KoobFace.Trace) -> Quarantined and deleted successfully.
C:\Windows\bk23567.dat (KoobFace.Trace) -> Quarantined and deleted successfully.
C:\Windows\fdgg34353edfgdfdf (KoobFace.Trace) -> Quarantined and deleted successfully.
C:\Users\Bruno\Local Settings\Application Data\010112010146111103.xxe (Worm.KoobFace) -> Quarantined and deleted successfully.

Salut vikipetit

Faire un scan avec Nod32 en ligne (il faut utiliser Internet Explorer) ici :

https://www.eset.com/int/home/online-scanner/

(coche toutes les cases à chaque fois, sauf les deux dernières a la fin du scan, sinon le rapport est supprimer)
A la fin, colle le rapport : C:\Program Files\EsetOnlineScanner\log.txt

@++ :)