cjoint

Publicité


Publicité

Format du document : text/plain

Prévisualisation

RogueKiller V8.6.1 [Jun 19 2013] par Tigzy
mail : tigzyRKgmailcom
Remontees : http://www.sur-la-toile.com/discussion-193725-1--RogueKiller-Remontees.html
Site Web : http://www.sur-la-toile.com/RogueKiller/
Blog : http://tigzyrk.blogspot.com/

Systeme d'exploitation : Windows XP (5.1.2600 Service Pack 3) 32 bits version
Demarrage : Mode normal
Utilisateur : Emilie [Droits d'admin]
Mode : Suppression -- Date : 06/23/2013 12:29:49
| ARK || FAK || MBR |

¤¤¤ Processus malicieux : 1 ¤¤¤
[SUSP PATH] soundman.exe -- C:\WINDOWS\soundman.exe [7] -> TUÉ [TermProc]

¤¤¤ Entrees de registre : 3 ¤¤¤
[HJ POL] HKCU\[...]\System : DisableTaskMgr (0) -> SUPPRIMÉ
[HJ POL] HKCU\[...]\System : DisableRegistryTools (0) -> SUPPRIMÉ
[HJ DESK] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> REMPLACÉ (0)

¤¤¤ Tâches planifiées : 0 ¤¤¤

¤¤¤ Entrées Startup : 0 ¤¤¤

¤¤¤ Navigateurs web : 0 ¤¤¤

¤¤¤ Fichiers / Dossiers particuliers: ¤¤¤

¤¤¤ Driver : [CHARGE] ¤¤¤
[Address] SSDT[25] : NtClose @ 0x80567C07 -> HOOKED (Unknown @ 0xF7C5F8EC)
[Address] SSDT[41] : NtCreateKey @ 0x80573887 -> HOOKED (Unknown @ 0xF7C5F8A6)
[Address] SSDT[50] : NtCreateSection @ 0x80565433 -> HOOKED (Unknown @ 0xF7C5F8F6)
[Address] SSDT[53] : NtCreateThread @ 0x80578925 -> HOOKED (Unknown @ 0xF7C5F89C)
[Address] SSDT[63] : NtDeleteKey @ 0x80595ABA -> HOOKED (Unknown @ 0xF7C5F8AB)
[Address] SSDT[65] : NtDeleteValueKey @ 0x805936DA -> HOOKED (Unknown @ 0xF7C5F8B5)
[Address] SSDT[68] : NtDuplicateObject @ 0x805749DA -> HOOKED (Unknown @ 0xF7C5F8E7)
[Address] SSDT[98] : NtLoadKey @ 0x805ADCBB -> HOOKED (Unknown @ 0xF7C5F8BA)
[Address] SSDT[122] : NtOpenProcess @ 0x80574BC1 -> HOOKED (Unknown @ 0xF7C5F888)
[Address] SSDT[128] : NtOpenThread @ 0x80590CFC -> HOOKED (Unknown @ 0xF7C5F88D)
[Address] SSDT[177] : NtQueryValueKey @ 0x8056A531 -> HOOKED (Unknown @ 0xF7C5F90F)
[Address] SSDT[193] : NtReplaceKey @ 0x80650166 -> HOOKED (Unknown @ 0xF7C5F8C4)
[Address] SSDT[200] : NtRequestWaitReplyPort @ 0x8056DD9E -> HOOKED (Unknown @ 0xF7C5F900)
[Address] SSDT[204] : NtRestoreKey @ 0x8064FCFD -> HOOKED (Unknown @ 0xF7C5F8BF)
[Address] SSDT[213] : NtSetContextThread @ 0x8062E937 -> HOOKED (Unknown @ 0xF7C5F8FB)
[Address] SSDT[237] : NtSetSecurityObject @ 0x80598227 -> HOOKED (Unknown @ 0xF7C5F905)
[Address] SSDT[247] : NtSetValueKey @ 0x8057DAF3 -> HOOKED (Unknown @ 0xF7C5F8B0)
[Address] SSDT[255] : NtSystemDebugControl @ 0x8064AD45 -> HOOKED (Unknown @ 0xF7C5F90A)
[Address] SSDT[257] : NtTerminateProcess @ 0x80585851 -> HOOKED (Unknown @ 0xF7C5F897)
[Address] Shadow SSDT[549] : NtUserSetWindowsHookEx -> HOOKED (Unknown @ 0xF7C5F91E)
[Address] Shadow SSDT[552] : NtUserSetWinEventHook -> HOOKED (Unknown @ 0xF7C5F923)

¤¤¤ Ruches Externes: ¤¤¤

¤¤¤ Infection : ¤¤¤

¤¤¤ Fichier HOSTS: ¤¤¤
--> %SystemRoot%\System32\drivers\etc\hosts


127.0.0.1 localhost


¤¤¤ MBR Verif: ¤¤¤

+++++ PhysicalDrive0: HDT722516DLA380 +++++
--- User ---
[MBR] 3ddfa861a06e08cd0db3b3624caf3d99
[BSP] 1caba431543df420fc9e05e5e72ec698 : Windows XP MBR Code
Partition table:
0 - [XXXXXX] COMPAQ (0x12) [VISIBLE] Offset (sectors): 63 | Size: 4996 Mo
1 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 10233856 | Size: 118547 Mo
2 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 253020160 | Size: 33519 Mo
User = LL1 ... OK!
User = LL2 ... OK!

Termine : << RKreport[0]_D_06232013_122949.txt >>
RKreport[0]_S_06232013_122618.txt




Publicité


Signaler le contenu de ce document

Publicité