TROJ_DRASTWOR.A

[WILLIAM13]

Bonsoir,

une analyse réalisée avec TREND micro pc cillin fait ressortir un virus : TROJ_DRASTWOR.A que je n'arrive pas à supprimer.

Ci dessous le log hijackthis :

 

Logfile of HijackThis v1.99.1

Scan saved at 20:59:11, on 20/01/2008

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

 

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\Trend Micro\Internet Security 12\pccguide.exe

C:\Program Files\VIAudioi\SBADeck\ADeck.exe

C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe

C:\Program Files\MessengerPlus! 3\MsgPlus.exe

C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe

C:\Program Files\Trust\DS-4500X Wireless Laser Deskset\Keyboard\kbdap32a.EXE

C:\Program Files\Trust\DS-4500X Wireless Laser Deskset\Mouse\mouse32a.exe

C:\Program Files\ATI Technologies\ATI.ACE\cli.exe

C:\WINDOWS\system32\LVCOMSX.EXE

C:\Program Files\Logitech\Video\LogiTray.exe

C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe

C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.0\Apps\apdproxy.exe

C:\DOCUME~1\Admin\LOCALS~1\Temp\services.exe

C:\WINDOWS\mrofinu1148.exe

C:\WINDOWS\system32\B6BDBBB8B9BCC2.exe

C:\Program Files\Fichiers communs\Ahead\lib\NMBgMonitor.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Dot1XCfg\Dot1XCfg.exe

C:\DOCUME~1\Admin\MESDOC~1\TSKS~1\chkdsk.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\WINDOWS\W?nSxS\?hkntfs.exe

C:\Program Files\Words\Words.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE

C:\Program Files\palmOne\Hotsync.exe

C:\Program Files\Siemens\Gigaset USB Adapter 108\Gcc.exe

C:\Program Files\Windows Live\Messenger\msnmsgr.exe

C:\PROGRA~2\TRENDM~1\INTERN~1\PcCtlCom.exe

C:\WINDOWS\system32\svchost.exe

C:\PROGRA~2\TRENDM~1\INTERN~1\Tmntsrv.exe

C:\PROGRA~2\TRENDM~1\INTERN~1\tmproxy.exe

C:\Program Files\Siemens\Gigaset USB Adapter 108\OdHost.exe

C:\Program Files\Logitech\Video\FxSvr2.exe

C:\PROGRA~2\TRENDM~1\INTERN~1\TmPfw.exe

C:\WINDOWS\system32\wuauclt.exe

C:\Program Files\Fichiers communs\Teleca Shared\Generic.exe

C:\Program Files\Java\jre1.5.0_11\bin\jucheck.exe

C:\WINDOWS\17PHolmes1148.exe

C:\Program Files\Windows Live\Messenger\usnsvc.exe

C:\WINDOWS\17PHolmes1148.exe

C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\PROGRA~2\MICROS~2\Office12\OUTLOOK.EXE

C:\WINDOWS\system32\wuauclt.exe

C:\Program Files\Hijackthis Version Française\VERSION TRADUITE ORIGINALE.EXE

C:\Program Files\Windows Live Toolbar\msn_sl.exe

 

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =

 

http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens

O2 - BHO: (no name) - {1916F764-4C8A-6127-F8B9-11A3E3F8A89B} - C:\WINDOWS\system32\ybtwkf.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program

 

Files\Java\jre1.5.0_11\bin\ssv.dll

O2 - BHO: (no name) - {773E8BEE-5C7D-4E79-B0D8-099BE946DF74} - C:\Program Files\ComPlus

 

Applications\hokero455101.dll

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live -

 

{9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows

 

Live\WindowsLiveLogin.dll

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program

 

files\google\googletoolbar2.dll

O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program

 

Files\Windows Live Toolbar\msntb.dll

O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program

 

files\google\googletoolbar2.dll

O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program

 

Files\Windows Live Toolbar\msntb.dll

O4 - HKLM\..\Run: [pccguide.exe] "C:\Program Files\Trend Micro\Internet Security 12\pccguide.exe"

O4 - HKLM\..\Run: [AudioDeck] C:\Program Files\VIAudioi\SBADeck\ADeck.exe 1

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe

O4 - HKLM\..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN

O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe"

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe"

O4 - HKLM\..\Run: [mmtask] "C:\Program Files\Musicmatch\Musicmatch Jukebox\mmtask.exe"

O4 - HKLM\..\Run: [PhilipsRemote] C:\Program Files\Musicmatch\Musicmatch Jukebox\PhilipsRemote.exe

O4 - HKLM\..\Run: [ssAAD.exe] C:\PROGRA~2\Sony\SONICS~1\SsAAD.exe

O4 - HKLM\..\Run: [OFFICEKB] C:\Program Files\Trust\DS-4500X Wireless Laser

 

Deskset\Keyboard\kbdap32a.EXE

O4 - HKLM\..\Run: [FLMOFFICE4DMOUSE] C:\Program Files\Trust\DS-4500X Wireless Laser

 

Deskset\Mouse\mouse32a.exe

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime

O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE

O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe

O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe

O4 - HKLM\..\Run: [sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Mobile2\Application

 

Launcher\Application Launcher.exe" /startoptions

O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Edition

 

Découverte\3.0\Apps\apdproxy.exe"

O4 - HKLM\..\Run: [user bib mp3 plan] C:\Documents and Settings\All Users\Application Data\Amok

 

Copy User Bib\remote dupe.exe

O4 - HKLM\..\Run: [Flash Player2] C:\DOCUME~1\Admin\LOCALS~1\Temp\services.exe

O4 - HKLM\..\Run: [Windows Service] C:\Documents and Settings\Admin\ujutyn.exe

O4 - HKLM\..\Run: [runner1] C:\WINDOWS\mrofinu1148.exe

 

61A847B5BBF72813339F30466188719AB689201522886B092CBD44BD8689220221DD3257

O4 - HKLM\..\Run: [5D64625F60636966] B6BDBBB8B9BCC2.exe

O4 - HKCU\..\Run: [bgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers

 

communs\Ahead\lib\NMBgMonitor.exe"

O4 - HKCU\..\Run: [info blah] C:\DOCUME~1\Admin\APPLIC~1\VCAIMB~1\TRANS SECT.exe

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe" /WinStart

O4 - HKCU\..\Run: [Dot1XCfg] C:\Program Files\Dot1XCfg\Dot1XCfg.exe

O4 - HKCU\..\Run: [Mest] "C:\DOCUME~1\Admin\MESDOC~1\TSKS~1\chkdsk.exe" -vt yazb

O4 - HKCU\..\Run: [Tvr] C:\WINDOWS\W?nSxS\?hkntfs.exe

O4 - HKCU\..\Run: [Words] C:\Program Files\Words\Words.exe

O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background

O4 - Global Startup: Barre d'état système d'ATI CATALYST.lnk = C:\Program Files\ATI

 

Technologies\ATI.ACE\CLI.exe

O4 - Global Startup: DataViz Inc Messenger.lnk = C:\Program Files\Fichiers

 

communs\DataViz\DvzIncMsgr.exe

O4 - Global Startup: HotSync Manager.lnk = C:\Program Files\palmOne\Hotsync.exe

O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE

O4 - Global Startup: Moniteur Gigaset WLAN Adapter.lnk = C:\Program Files\Siemens\Gigaset USB

 

Adapter 108\Gcc.exe

O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live

 

Toolbar\msntb.dll/search.htm

O8 - Extra context menu item: E&xport to Microsoft Excel -

 

res://C:\PROGRA~2\MICROS~2\Office10\EXCEL.EXE/3000

O8 - Extra context menu item: E&xporter vers Microsoft Excel -

 

res://C:\PROGRA~2\MICROS~2\Office12\EXCEL.EXE/3000

O8 - Extra context menu item: Ouvrir dans un nouvel onglet d'arrière-plan - res://C:\Program

 

Files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/229?7ddb55b5b5d14e9ea24f41cf30bb05b8

O8 - Extra context menu item: Ouvrir dans un nouvel onglet de premier plan - res://C:\Program

 

Files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/230?7ddb55b5b5d14e9ea24f41cf30bb05b8

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program

 

Files\Java\jre1.5.0_11\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} -

 

C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} -

 

C:\PROGRA~2\MICROS~2\Office12\REFIEBAR.DLL

O15 - Trusted Zone: http://www.secuser.com

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) -

 

http://update.microsoft.com/windowsupdate/...b?1142926749387

O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) -

 

http://a840.g.akamai.net/7/840/537/2005111...all/xscan53.cab

O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} -

 

C:\PROGRA~2\WI1F86~1\MESSEN~1\MSGRAP~1.DLL

O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Fichiers

 

communs\Microsoft Shared\Help\hxds.dll

O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} -

 

C:\PROGRA~2\WI1F86~1\MESSEN~1\MSGRAP~1.DLL

O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} -

 

C:\PROGRA~2\FICHIE~1\MICROS~1\OFFICE12\MSOXMLMF.DLL

O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll

O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe

O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe

O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google

 

Updater\GoogleUpdaterService.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program

 

Files\Fichiers communs\InstallShield\Driver\1150\Intel 32\IDriverT.exe

O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Fichiers communs\Sony

 

Shared\AVLib\MSCSPTISRV.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation -

 

C:\WINDOWS\system32\nvsvc32.exe

O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Fichiers communs\Sony

 

Shared\AVLib\PACSPTISVR.exe

O23 - Service: Trend Micro Central Control Component (PcCtlCom) - Trend Micro Incorporated. -

 

C:\PROGRA~2\TRENDM~1\INTERN~1\PcCtlCom.exe

O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Fichiers

 

communs\Sony Shared\AVLib\SPTISRV.exe

O23 - Service: Trend Micro Real-time Service (Tmntsrv) - Trend Micro Incorporated. -

 

C:\PROGRA~2\TRENDM~1\INTERN~1\Tmntsrv.exe

O23 - Service: Trend Micro Personal Firewall (TmPfw) - Trend Micro Inc. -

 

C:\PROGRA~2\TRENDM~1\INTERN~1\TmPfw.exe

O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Inc. -

 

C:\PROGRA~2\TRENDM~1\INTERN~1\tmproxy.exe

puis je avoir un d'aide, merci d'avance.

[Lien Rag]

fais ce Hijack stp

 

Télécharge HijackThis

 

Tuto réalisé par Bruce Lee : http://cybersecurite.xooit.com/t138-HijackThis-2-0-2.htm

 

Clique alors sur "Do a system scan and save a logfile"

Le scan se fait très rapidement, puis un bloc-note apparaît

(le "logfile")

Dans ce bloc-note, va dans "Edition", puis "Selectionner Tout",

le texte est alors séléctionné, retourne dans "Edition" toujours

en laissant le texte séléctionné, et clique sur copier.

Colle le contenu ici dans ta prochaine réponse