Analyse d'un rapport sur Gomeo - Page 1

Toujours la même erreur !
J'ai pas executé wscntfy.exe je dois le faire ?

ComboFix 11-07-07.06 - Comb 09/07/2011 21:06:40.3.1 - x86 NETWORK
Lancé depuis: c:\documents and settings\USER\Bureau\ComboFix.exe
Commutateurs utilisés :: c:\documents and settings\USER\Bureau\CFScript.txt
* Un nouveau point de restauration a été créé
.
- Mode FONCTIONNALITES REDUITES -
.
.
((((((((((((((((((((((((((((( Fichiers créés du 2011-06-09 au 2011-07-09 ))))))))))))))))))))))))))))))))))))
.
.
2011-07-09 18:27 . 2011-05-29 07:11 39984 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-07-09 18:27 . 2011-07-09 18:27 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2011-07-09 18:27 . 2011-05-29 07:11 22712 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-07-09 18:16 . 2011-07-09 18:16 13824 ----a-w- c:\windows\system32\wscntfy.exe
2011-07-09 18:16 . 2011-07-09 18:16 13824 ----a-w- c:\windows\system32\dllcache\wscntfy.exe
2011-07-09 16:49 . 2011-07-09 18:23 -------- d-----w- c:\program files\VS Revo Group
2011-07-08 18:49 . 2011-07-08 18:49 -------- d-----w- c:\windows\system32\xircom
2011-07-08 18:49 . 2011-07-08 18:49 -------- d-----w- c:\windows\system32\wbem\snmp
2011-07-08 18:49 . 2011-07-08 18:49 -------- d-----w- c:\windows\srchasst
2011-07-08 18:49 . 2011-07-08 18:49 -------- d-----w- c:\program files\microsoft frontpage
2011-07-08 18:31 . 2011-07-08 18:31 -------- d-----w- c:\program files\Google
2011-07-08 12:17 . 2011-07-08 12:17 -------- d-----w- c:\documents and settings\USER\Local Settings\Application Data\PCHealth
2011-07-07 15:29 . 2011-07-07 18:40 -------- d-----w- C:\Kill'em
2011-07-06 21:46 . 2011-07-06 21:46 -------- d-----w- c:\program files\Ad-Remover
2011-07-06 19:56 . 2006-08-01 13:02 49152 ----a-w- c:\windows\system32\ChCfg.exe
2011-07-06 19:55 . 2008-09-24 08:40 4122368 ----a-r- c:\windows\system32\drivers\alcxwdm.sys
2011-07-06 19:55 . 2011-07-06 19:55 -------- d-----w- c:\program files\Realtek AC97
2011-07-06 19:55 . 2006-12-08 13:20 10528768 ----a-w- c:\windows\system32\RTLCPL.exe
2011-07-06 19:55 . 2007-04-16 13:28 577536 ----a-w- c:\windows\soundman.exe
2011-07-06 19:55 . 2006-11-17 03:40 18804736 ----a-w- c:\windows\system32\alsndmgr.cpl
2011-07-06 19:55 . 2006-10-18 00:53 147456 ----a-w- c:\windows\system32\RtlCPAPI.dll
2011-07-06 19:55 . 2006-07-31 09:27 217088 ----a-w- c:\windows\Alcrmv.exe
2011-07-06 19:55 . 2006-07-31 09:19 315392 ----a-w- c:\windows\alcupd.exe
2011-07-06 19:54 . 2006-02-07 13:40 204800 ----a-w- c:\program files\Fichiers communs\InstallShield\Professional\RunTime\11\50\Intel32\iuser.dll
2011-07-06 19:54 . 2006-02-07 13:40 69715 ----a-w- c:\program files\Fichiers communs\InstallShield\Professional\RunTime\11\50\Intel32\ctor.dll
2011-07-06 19:54 . 2006-02-07 13:40 274432 ----a-w- c:\program files\Fichiers communs\InstallShield\Professional\RunTime\11\50\Intel32\iscript.dll
2011-07-06 19:54 . 2005-11-13 21:19 5632 ----a-w- c:\program files\Fichiers communs\InstallShield\Professional\RunTime\11\50\Intel32\DotNetInstaller.exe
2011-07-06 19:54 . 2006-02-07 13:45 757760 ----a-w- c:\program files\Fichiers communs\InstallShield\Professional\RunTime\11\50\Intel32\iKernel.dll
2011-07-06 19:54 . 2011-07-06 19:54 331908 ----a-w- c:\program files\Fichiers communs\InstallShield\Professional\RunTime\11\50\Intel32\setup.dll
2011-07-06 19:54 . 2011-07-06 19:54 200836 ----a-w- c:\program files\Fichiers communs\InstallShield\Professional\RunTime\11\50\Intel32\iGdi.dll
2011-07-06 17:38 . 2011-07-06 17:38 -------- d-----w- C:\INTRPLAY
2011-07-06 17:38 . 2011-07-06 17:38 -------- d-----w- c:\program files\Dofus 2
2011-07-06 15:42 . 2011-07-06 18:50 -------- d-----w- c:\documents and settings\All Users\Application Data\AVAST Software
2011-07-06 15:42 . 2011-07-06 15:42 -------- d-----w- c:\program files\AVAST Software
2011-07-06 00:10 . 2011-07-06 00:10 -------- d-----w- c:\windows\system32\wbem\Repository
2011-07-05 10:06 . 2011-07-05 10:06 -------- d-----r- c:\documents and settings\NetworkService\Favoris
2011-06-23 10:13 . 2011-06-23 10:13 16856 ----a-w- c:\program files\Mozilla Firefox\plugin-container.exe
2011-06-23 10:12 . 2011-06-23 10:12 719832 ----a-w- c:\program files\Mozilla Firefox\mozcpp19.dll
2011-06-17 01:03 . 2011-06-17 11:33 -------- d-----w- c:\windows\SxsCaPendDel
2011-06-16 19:23 . 2011-04-21 13:37 105472 ------w- c:\windows\system32\dllcache\mup.sys
.
.
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-06-12 10:20 . 2009-12-02 17:05 60416 ----a-w- c:\windows\ALCFDRTM.VER
2011-05-02 15:31 . 2009-11-14 17:35 692736 ----a-w- c:\windows\system32\inetcomm.dll
2011-04-29 17:25 . 2008-04-13 18:33 151552 ----a-w- c:\windows\system32\schannel.dll
2011-04-29 16:19 . 2008-04-13 11:17 456320 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
2011-04-21 13:37 . 2008-04-13 11:17 105472 ----a-w- c:\windows\system32\drivers\mup.sys
.
.
------- Sigcheck -------
Note: Unsigned files aren't necessarily malware.
.
[-] 2009-01-17 16:18 . 699D22B70D6CD1B9759A14D10256A715 . 1587712 . . [2001.12.4414.700] . . c:\windows\system32\comres.dll
.
[-] 2009-01-17 . DE669722494CF41F6E39A62B3B08525C . 561152 . . [5.1.2600.5512] . . c:\windows\system32\winlogon.exe
.
[-] 2009-01-17 . DE4A4AC7328FC80156034E7EB283676D . 579584 . . [5.1.2600.5512] . . c:\windows\system32\user32.dll
.
[-] 2009-01-17 . 3C127370AA63C7D9FD756BB4BE173427 . 1573888 . . [6.00.2900.5512] . . c:\windows\explorer.exe
.
[-] 2008-04-13 . AAF8E9C2CF1DB93C3EE5C12BC6A7ACEA . 282624 . . [5.1.2600.5512] . . c:\windows\regedit.exe
.
[-] 2009-01-17 . 58DB2EE838D5B7BAD0F7F10A6C920390 . 40960 . . [5.1.2600.5512] . . c:\windows\system32\ctfmon.exe
.
((((((((((((((((((((((((((((( SnapShot@2011-07-08_16.49.10 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-11-14 17:52 . 2011-07-09 17:13 327680 c:\windows\system32\config\systemprofile\ntuser.dat
- 2009-11-14 17:52 . 2011-07-06 13:13 327680 c:\windows\system32\config\systemprofile\ntuser.dat
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NVIDIA nTune"="c:\program files\NVIDIA Corporation\nTune\nTuneCmd.exe" [2007-09-04 81920]
"IDMan"="c:\program files\Internet Download Manager\IDMan.exe" [2010-05-26 3220912]
"Connexion SFR 9props.exe"="c:\program files\SFR\Kit\9props.exe" [2009-10-15 959808]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2010-04-16 3872080]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BJCFD"="c:\program files\BroadJump\Client Foundation\CFD.exe" [2003-01-27 376912]
"Club-Internet_McciTrayApp"="c:\program files\Club-Internet\Agent Wi-Fi V2.1\McciTrayApp.exe" [2005-11-15 543232]
"Motive SmartBridge"="c:\progra~1\CLUB-I~1\LECOMP~1\SMARTB~3\MotiveSB.exe" [2005-08-24 438359]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2009-09-27 86016]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-09-27 13918208]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2011-05-29 449584]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2009-01-17 40960]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"_nltide_3"="advpack.dll" [2008-08-22 128512]
.
c:\documents and settings\All Users\Menu D'marrer\Programmes\D'marrage\
Adobe Gamma Loader.lnk - [N/A]
Effet Aero de fen^tres.lnk - [N/A]
LE COMPAGNON CLUB.lnk - [N/A]
Menu Vista.lnk - [N/A]
sidebar.lnk - [N/A]
Visual Task Tips.lnk - [N/A]
ZDWLan Utility.lnk - [N/A]
.
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoSMConfigurePrograms"= 1 (0x1)
.
[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoSMHelp"= 1 (0x1)
"ForceClassicControlPanel"= 1 (0x1)
"NoSMConfigurePrograms"= 1 (0x1)
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MSIServer]
@="Service"
.
[HKLM\~\startupfolder\C:^Documents and Settings^USER^Menu Démarrer^Programmes^Démarrage^Club Internet.lnk]
path=c:\documents and settings\USER\Menu Démarrer\Programmes\Démarrage\Club Internet.lnk
backup=c:\windows\pss\Club Internet.lnkStartup
.
[HKLM\~\startupfolder\C:^Documents and Settings^USER^Menu Démarrer^Programmes^Démarrage^OpenOffice.org 3.2.lnk]
path=c:\documents and settings\USER\Menu Démarrer\Programmes\Démarrage\OpenOffice.org 3.2.lnk
backup=c:\windows\pss\OpenOffice.org 3.2.lnkStartup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogMeIn Hamachi Ui]
2011-05-25 15:29 1951112 ----a-w- c:\program files\LogMeIn Hamachi\hamachi-2-ui.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ManyCam]
2010-10-15 05:25 1721640 ----a-w- c:\program files\ManyCam\Bin\ManyCam.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr]
2010-04-16 21:12 3872080 ----a-w- c:\program files\Windows Live\Messenger\msnmsgr.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]
2010-11-16 23:12 1242448 ----a-w- c:\program files\Steam\steam.exe
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Steam\\Steam.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\Steam\\steamapps\\arius1993\\half-life 2 deathmatch\\hl2.exe"=
"c:\\Program Files\\Steam\\steamapps\\common\\aliens vs predator demo\\AvP.exe"=
"c:\\Program Files\\Steam\\steamapps\\arius1993\\source sdk base\\hl2.exe"=
"c:\\Program Files\\Steam\\steamapps\\arius1993\\source sdk base 2007\\hl2.exe"=
"c:\\Program Files\\Steam\\steamapps\\common\\football manager 2010\\fm.exe"=
"c:\\Program Files\\Steam\\steamapps\\common\\stalker clear sky\\bin\\xrEngine.exe"=
"c:\\Program Files\\Internet Download Manager\\IDMan.exe"=
"c:\\Program Files\\Steam\\steamapps\\common\\amnesia the dark descent demo\\Launcher.exe"=
"c:\\Program Files\\Steam\\steamapps\\common\\the void\\bin\\win32\\Game.exe"=
"c:\\Program Files\\Steam\\steamapps\\common\\the void\\bin\\win32\\Config.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\LogMeIn Hamachi\\hamachi-2-ui.exe"=
"c:\\Program Files\\Steam\\steamapps\\common\\alien swarm\\srcds.exe"=
"c:\\Program Files\\Steam\\steamapps\\common\\alien swarm\\swarm.exe"=
"c:\\Program Files\\Steam\\steamapps\\common\\killingfloor\\System\\KillingFloor.exe"=
"c:\\Program Files\\Steam\\steamapps\\common\\killingfloor\\System\\KFEd.exe"=
"c:\\Program Files\\Steam\\steamapps\\arius1993\\zombie panic! source\\hl2.exe"=
"c:\\Program Files\\Steam\\steamapps\\common\\left 4 dead 2\\left4dead2.exe"=
.
R1 vcdrom;Virtual CD-ROM Device Driver;c:\program files\System\CPL Bonus\Vcdrom.sys [2001-12-19 8576]
R2 LBeepKE;Logitech Beep Suppression Driver;c:\windows\system32\Drivers\LBeepKE.sys [2010-03-18 10448]
R3 maconfservice;Ma-Config Service;c:\program files\ma-config.com\maconfservice.exe [2010-08-13 259440]
R3 ManyCam;ManyCam Virtual Webcam, WDM Video Capture Driver;c:\windows\system32\DRIVERS\ManyCam.sys [2008-01-14 21632]
R4 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [2010-10-26 697328]
S2 Hamachi2Svc;LogMeIn Hamachi 2.0 Tunneling Engine;c:\program files\LogMeIn Hamachi\hamachi-2.exe [2011-05-25 1336712]
.
.
--- Autres Services/Pilotes en mémoire ---
.
*NewlyCreated* - VCDROM
.
Contenu du dossier 'Tâches planifiées'
.
2011-07-07 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 10:34]
.
.
------- Examen supplémentaire -------
.
uStart Page = hxxp://www.google.com/
uInternet Settings,ProxyOverride = *.local
IE: Télécharger avec IDM - c:\program files\Internet Download Manager\IEExt.htm
IE: Télécharger le contenu de video FLV avec IDM - c:\program files\Internet Download Manager\IEGetVL.htm
IE: Télécharger tous les liens avec IDM - c:\program files\Internet Download Manager\IEGetAll.htm
LSP: c:\program files\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp.dll
DPF: Microsoft XML Parser for Java - file:///C:/WINDOWS/Java/classes/xmldso.cab
FF - ProfilePath - c:\documents and settings\USER\Application Data\Mozilla\Firefox\Profiles\utcbgeu0.default\
FF - prefs.js: browser.search.selectedEngine - Ask.com
FF - prefs.js: browser.startup.homepage - hxxp://www.mad-movies.com/forums/index.php
FF - prefs.js: keyword.URL - hxxp://websearch.ask.com/redirect?client=ff&src=kw&tb=MYC&o=14300&locale=en_FR&apn_uid=2F05BFE1-903F-49B5-86EE-BE62BED06718&apn_ptnrs=NL&apn_sauid=AEF3DA6C-5F6B-477A-9AB2-49B8EE5EB649&apn_dtid=&q=
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF - Ext: Java Quick Starter: jqs@sun.com - c:\program files\Java\jre6\lib\deploy\jqs\ff
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}
FF - Ext: Autofill Forms: autofillForms@blueimp.net - %profile%\extensions\autofillForms@blueimp.net
FF - Ext: Personas: personas@christopher.beard - %profile%\extensions\personas@christopher.beard
FF - Ext: Firebug: firebug@software.joehewitt.com - %profile%\extensions\firebug@software.joehewitt.com
FF - Ext: DownloadHelper: {b9db16a4-6edc-47ec-a1f4-b86292ed211d} - %profile%\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
FF - Ext: Ask Toolbar: toolbar@ask.com - %profile%\extensions\toolbar@ask.com
FF - Ext: Real-Debrid - Plugin: real@debrid - %profile%\extensions\real@debrid
FF - Ext: IDM CC: mozilla_cc@internetdownloadmanager.com - c:\documents and settings\USER\Application Data\IDM\idmmzcc3
FF - user.js: keyword.URL - hxxp://redirecterror.sfr.fr/?q=
user_pref(extensions.kwiclick.channel.campaign,'AddonFoxInt');
user_pref(extensions.kwiclick.channel.content,'AddonFoxInt');
user_pref(extensions.kwiclick.channel.id,'AddonFoxInt');
user_pref(extensions.kwiclick.channel.cse,'009607407620987551725:3hfwsbgoj80');
user_pref(extensions.kwiclick.channel.medium,'cpa');
user_pref(extensions.kwiclick.channel.source,'AddonFoxInt');
user_pref(extensions.kwiclick.channel.set,true);
user_pref(extensions.kwiclick.channel.campaign,'AddonFoxInt');
user_pref(extensions.kwiclick.channel.content,'AddonFoxInt');
user_pref(extensions.kwiclick.channel.id,'AddonFoxInt');
user_pref(extensions.kwiclick.channel.cse,'009607407620987551725:3hfwsbgoj80');
user_pref(extensions.kwiclick.channel.medium,'cpa');
user_pref(extensions.kwiclick.channel.source,'AddonFoxInt');
user_pref(extensions.kwiclick.channel.set,true);
user_pref(extensions.kwiclick.channel.campaign,'AddonFoxInt');
user_pref(extensions.kwiclick.channel.content,'AddonFoxInt');
user_pref(extensions.kwiclick.channel.id,'AddonFoxInt');
user_pref(extensions.kwiclick.channel.cse,'009607407620987551725:3hfwsbgoj80');
user_pref(extensions.kwiclick.channel.medium,'cpa');
user_pref(extensions.kwiclick.channel.source,'AddonFoxInt');
user_pref(extensions.kwiclick.channel.set,true);
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-07-09 21:10
Windows 5.1.2600 Service Pack 3 NTFS
.
Recherche de processus cachés ...
.
Recherche d'éléments en démarrage automatique cachés ...
.
Recherche de fichiers cachés ...
.
Scan terminé avec succès
Fichiers cachés: 0
.
**************************************************************************
.
--------------------- DLLs chargées dans les processus actifs ---------------------
.
- - - - - - - > 'winlogon.exe'(816)
c:\windows\system32\SETUPAPI.dll
c:\windows\system32\cscui.dll
.
- - - - - - - > 'lsass.exe'(872)
c:\windows\system32\SETUPAPI.dll
.
- - - - - - - > 'explorer.exe'(132)
c:\windows\system32\SHDOCVW.dll
c:\windows\system32\COMRes.dll
c:\windows\System32\cscui.dll
c:\windows\system32\msi.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\SETUPAPI.dll
c:\windows\system32\NETSHELL.dll
c:\windows\system32\credui.dll
c:\windows\system32\MSVCP60.dll
c:\windows\system32\eappprxy.dll
.
Heure de fin: 2011-07-09 21:13:05 - La machine a redémarré
ComboFix-quarantined-files.txt 2011-07-09 19:13
ComboFix2.txt 2011-07-08 17:53
ComboFix3.txt 2011-07-08 16:54
.
Avant-CF: 34 962 198 528 octets libres
Après-CF: 34 960 498 688 octets libres
.
- - End Of File - - 55AFDF0A314D2F3CE74087E8207B5710

Oui ^^'

Non non.

Non toujours pas =/