Marie - erreur 554

[MERCOU]

Bonsoir Marie (Ex - bonemine),

Suite à notre conversation d'aujourd'hui, je vous joins le fichier d'active scan et vous copie aussi le log de HijackThis.

Avec tous mes remerciements,
Laurent M.


Active Scan :



Incident Status Location

Virus:Trj/Ruins.EN Disinfected C:\WINDOWS\system32\dmhjd.exe
Spyware:Cookie/Tradedoubler Not disinfected C:\Documents and Settings\Maison\Local Settings\Temp\Cookies\maison@tradedoubler[2].txt
Spyware:Cookie/Xiti Not disinfected C:\Documents and Settings\Maison\Local Settings\Temp\Cookies\maison@xiti[1].txt
Spyware:Cookie/Atlas DMT Not disinfected C:\Documents and Settings\Maison\Local Settings\Temp\Cookies\maison@atdmt[2].txt
Spyware:Cookie/Casalemedia Not disinfected C:\Documents and Settings\Maison\Local Settings\Temp\Cookies\maison@casalemedia[1].txt
Spyware:Cookie/Advertising Not disinfected C:\Documents and Settings\Maison\Local Settings\Temp\Cookies\maison@advertising[1].txt
Spyware:Cookie/FastClick Not disinfected C:\Documents and Settings\Maison\Local Settings\Temp\Cookies\maison@fastclick[2].txt
Spyware:Cookie/FastClick Not disinfected C:\Documents and Settings\Maison\Local Settings\Temp\Cookies\maison@media.fastclick[1].txt
Spyware:Cookie/BurstNet Not disinfected C:\Documents and Settings\Maison\Local Settings\Temp\Cookies\maison@burstnet[2].txt
Spyware:Cookie/YieldManager Not disinfected C:\Documents and Settings\Maison\Local Settings\Temp\Cookies\maison@ad.yieldmanager[1].txt
Spyware:Cookie/Doubleclick Not disinfected C:\Documents and Settings\Maison\Local Settings\Temp\Cookies\maison@doubleclick[1].txt
Spyware:Cookie/Mediaplex Not disinfected C:\Documents and Settings\Maison\Local Settings\Temp\Cookies\maison@mediaplex[1].txt
Spyware:Cookie/Weborama Not disinfected C:\Documents and Settings\Maison\Local Settings\Temp\Cookies\maison@weborama[1].txt
Spyware:Cookie/Adtech Not disinfected C:\Documents and Settings\Maison\Local Settings\Temp\Cookies\maison@adtech[2].txt
Spyware:Cookie/MetriWeb Not disinfected C:\Documents and Settings\Maison\Local Settings\Temp\Cookies\maison@metriweb[1].txt
Spyware:Cookie/Comclick Not disinfected C:\Documents and Settings\Maison\Local Settings\Temp\Cookies\maison@fl01.ct2.comclick[2].txt
Spyware:Cookie/Bluestreak Not disinfected C:\Documents and Settings\Maison\Local Settings\Temp\Cookies\maison@bluestreak[1].txt
Spyware:Cookie/Xiti Not disinfected C:\Documents and Settings\Maison\Cookies\maison@xiti[2].txt
Spyware:Cookie/Xiti Not disinfected C:\Documents and Settings\Maison\Cookies\maison@xiti[1].txt
Spyware:Cookie/Atlas DMT Not disinfected C:\Documents and Settings\Maison\Cookies\maison@atdmt[2].txt
Spyware:Cookie/Bluestreak Not disinfected C:\Documents and Settings\Maison\Cookies\maison@bluestreak[1].txt
Spyware:Cookie/Overture Not disinfected C:\Documents and Settings\Maison\Cookies\maison@overture[1].txt
Spyware:Cookie/adultfriendfinder Not disinfected C:\Documents and Settings\Maison\Cookies\maison@adultfriendfinder[2].txt
Spyware:Cookie/Doubleclick Not disinfected C:\Documents and Settings\Maison\Cookies\maison@doubleclick[1].txt
Spyware:Cookie/Mediaplex Not disinfected C:\Documents and Settings\Maison\Cookies\maison@mediaplex[1].txt
Spyware:Cookie/Doubleclick Not disinfected C:\Documents and Settings\Maison\Application Data\Mozilla\Firefox\Profiles\s37accm6.default\cookies.txt[.doubleclick.net/]
Spyware:Cookie/Weborama Not disinfected C:\Documents and Settings\Maison\Application Data\Mozilla\Firefox\Profiles\s37accm6.default\cookies.txt[.weborama.fr/]
Spyware:Cookie/Adtech Not disinfected C:\Documents and Settings\Maison\Application Data\Mozilla\Firefox\Profiles\s37accm6.default\cookies.txt[.adtech.de/]
Spyware:Cookie/Weborama Not disinfected C:\Documents and Settings\Maison\Application Data\Mozilla\Firefox\Profiles\s37accm6.default\cookies.txt[.weborama.fr/]
Spyware:Cookie/Adtech Not disinfected C:\Documents and Settings\Maison\Application Data\Mozilla\Firefox\Profiles\s37accm6.default\cookies.txt[.adtech.de/]
Spyware:Cookie/Findwhat Not disinfected C:\Documents and Settings\Maison\Application Data\Mozilla\Firefox\Profiles\s37accm6.default\cookies.txt[.findwhat.com/]
Spyware:Cookie/Overture Not disinfected C:\Documents and Settings\Maison\Application Data\Mozilla\Firefox\Profiles\s37accm6.default\cookies.txt[.overture.com/]
Spyware:Cookie/Atlas DMT Not disinfected C:\Documents and Settings\Maison\Application Data\Mozilla\Firefox\Profiles\s37accm6.default\cookies.txt[.atdmt.com/]
Spyware:Cookie/Mediaplex Not disinfected C:\Documents and Settings\Maison\Application Data\Mozilla\Firefox\Profiles\s37accm6.default\cookies.txt[.mediaplex.com/]
Spyware:Cookie/Xiti Not disinfected C:\Documents and Settings\Maison\Application Data\Mozilla\Firefox\Profiles\s37accm6.default\cookies.txt[.xiti.com/]
Spyware:Cookie/adultfriendfinder Not disinfected C:\Documents and Settings\Maison\Application Data\Mozilla\Firefox\Profiles\s37accm6.default\cookies.txt[.adultfriendfinder.com/]
Spyware:Cookie/Bluestreak Not disinfected C:\Documents and Settings\Maison\Application Data\Mozilla\Firefox\Profiles\s37accm6.default\cookies.txt[.bluestreak.com/]


Logfile of HijackThis v1.99.1
Scan saved at 14:21:47, on 29/10/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\Microsoft Hardware\Keyboard\type32.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Micro Application\MediaDICO\MediaDICO.EXE
C:\Program Files\Micro Application\MediaDICO\Rac.EXE
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Fichiers communs\Symantec Shared\Security Center\SymWSC.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\a-squared Free\a2free.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\HijackThis\HijackThis.exe
C:\Program Files\Messenger\msmsgs.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Fichiers communs\Symantec Shared\ccRegVfy.exe"
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [IntelliType] "C:\Program Files\Microsoft Hardware\Keyboard\type32.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [WOOKIT] C:\PROGRA~1\WANADOO\Shell.exe appLaunchClientZone.shl|DEFAULT=cnx|PARAM=
O4 - HKCU\..\Run: [MediaDico] C:\Program Files\Micro Application\MediaDICO\LanceMediaDICO.exe Lancement
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {09C21411-B9A2-4DE6-8416-4E3B58577BE0} (France Telecom MDM ActiveX Control) - http://minitelweb.minitel.com/imin_data/ocx/MDM.cab
O16 - DPF: {2D36AF92-04D3-11D8-B719-0000865F231B} (TMinReq Class) - https://my.sabre.com/jars/TMinReqX.dll
O16 - DPF: {A8F2B9BD-A6A0-486A-9744-18920D898429} (ScorchPlugin Class) - http://www.sibelius.com/download/softwa ... Plugin.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{06F15234-94F0-49BE-A250-D4E5283D0992}: NameServer = 85.255.114.2,85.255.112.117
O17 - HKLM\System\CCS\Services\Tcpip\..\{6B3604A8-9488-4637-A22B-DA3040A1C862}: NameServer = 85.255.114.2,85.255.112.117
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.114.2 85.255.112.117
O17 - HKLM\System\CS1\Services\Tcpip\..\{06F15234-94F0-49BE-A250-D4E5283D0992}: NameServer = 85.255.114.2,85.255.112.117
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer = 85.255.114.2 85.255.112.117
O17 - HKLM\System\CS2\Services\Tcpip\..\{06F15234-94F0-49BE-A250-D4E5283D0992}: NameServer = 85.255.114.2,85.255.112.117
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.114.2 85.255.112.117
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation Service (ccPwdSvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccPwdSvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Service Norton AntiVirus Auto-Protect (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: NetSup - Unknown owner - \\?\C:\Program Files\Fichiers communs\Services\lpt8.exe (file missing)
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\FICHIE~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\Security Center\SymWSC.exe

[Marie]

Bonsoir Mercou et bienvenue sur Micro-Astuce.

Suis toutes ces étapes dans l'ordre:

Affiche les fichiers cachés. Pour afficher les fichiers cachés

Arrête le service NetSup:
Fais Démarrer/Executer/saisis services.msc
Dans la liste des services cherche celui nommé précisément NetSup. Double clique dessus.
Vérifie que dans Chemin d'accès des fichiers executables, tu as bien C:\Program Files\Fichiers communs\Services\lpt8.exe
Si c'est le cas:
Dans Etat du service, Clique sur Arrêter
Dans Type de démarrage, choisis Désactiver.
Fais OK pour fermer toutes les fenêtres.

Relance HijackThis.
Clique sur None of the above Just start The Program. Clique sur le bouton Config puis sur le bouton Misc Tools. Ensuite choisis Delete a NT Service.
Dans le champ tu copies exactement le nom suivant:
NetSup puis OK.

Reviens sur la fenêtre principale d'HijackThis et clique sur Do a system Scan and Save a Log File

Coche les lignes suivantes:
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O17 - HKLM\System\CCS\Services\Tcpip\..\{06F15234-94F0-49BE-A250-D4E5283D0992}: NameServer = 85.255.114.2,85.255.112.117
O17 - HKLM\System\CCS\Services\Tcpip\..\{6B3604A8-9488-4637-A22B-DA3040A1C862}: NameServer = 85.255.114.2,85.255.112.117
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.114.2 85.255.112.117
O17 - HKLM\System\CS1\Services\Tcpip\..\{06F15234-94F0-49BE-A250-D4E5283D0992}: NameServer = 85.255.114.2,85.255.112.117
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer = 85.255.114.2 85.255.112.117
O17 - HKLM\System\CS2\Services\Tcpip\..\{06F15234-94F0-49BE-A250-D4E5283D0992}: NameServer = 85.255.114.2,85.255.112.117
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.114.2 85.255.112.117
O23 - Service: NetSup - Unknown owner - \\?\C:\Program Files\Fichiers communs\Services\lpt8.exe (file missing)


Ferme toutes les fenêtres d'Internet Explorer puis clique sur Fix Checked.

Supprime les fichiers suivants (si encore présents):
C:\WINDOWS\system32\dmhjd.exe
C:\Program Files\Fichiers communs\Services\lpt8.exe

Vide la corbeille

Redémarre le PC.
Essaie l'envoie de mails.
Poste un nouveau rapport HijackThis.

@+