cjoint

Publicité


Publicité

Format du document : text/plain

Prévisualisation

RogueKiller V8.8.15 [Mar 27 2014] par Adlice Software
mail : http://www.adlice.com/contact/
Remontees : http://forum.adlice.com
Site Web : http://www.surlatoile.org/RogueKiller/
Blog : http://www.adlice.com

Systeme d'exploitation : Windows XP (5.1.2600 Service Pack 3) 32 bits version
Demarrage : Mode normal
Utilisateur : lionel [Droits d'admin]
Mode : Recherche -- Date : 05/17/2014 17:06:27
| ARK || FAK || MBR |

¤¤¤ Processus malicieux : 1 ¤¤¤
[SUSP PATH] vntldr.exe -- C:\Documents and Settings\lionel\Local Settings\Application Data\VNT\vntldr.exe [7] -> TUÉ [TermProc]

¤¤¤ Entrees de registre : 5 ¤¤¤
[HJ POL][PUM] HKLM\[...]\System : ConsentPromptBehaviorAdmin (0) -> TROUVÉ
[HJ POL][PUM] HKLM\[...]\System : EnableLUA (0) -> TROUVÉ
[HJ SECU][PUM] HKLM\[...]\Security Center : AntiVirusDisableNotify (1) -> TROUVÉ
[HJ SMENU][PUM] HKCU\[...]\Advanced : Start_ShowRecentDocs (0) -> TROUVÉ
[HJ DESK][PUM] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> TROUVÉ

¤¤¤ Tâches planifiées : 0 ¤¤¤

¤¤¤ Entrées Startup : 0 ¤¤¤

¤¤¤ Navigateurs web : 0 ¤¤¤

¤¤¤ Addons navigateur : 0 ¤¤¤

¤¤¤ Fichiers / Dossiers particuliers: ¤¤¤

¤¤¤ Driver : [CHARGE] ¤¤¤
[Address] SSDT[25] : NtClose @ 0x805BC564 -> HOOKED (Unknown @ 0xA590E9DC)
[Address] SSDT[41] : NtCreateKey @ 0x8062426A -> HOOKED (Unknown @ 0xA590E996)
[Address] SSDT[50] : NtCreateSection @ 0x805AB3FC -> HOOKED (Unknown @ 0xA590E9E6)
[Address] SSDT[53] : NtCreateThread @ 0x805D1068 -> HOOKED (Unknown @ 0xA590E98C)
[Address] SSDT[63] : NtDeleteKey @ 0x80624706 -> HOOKED (Unknown @ 0xA590E99B)
[Address] SSDT[65] : NtDeleteValueKey @ 0x806248D6 -> HOOKED (Unknown @ 0xA590E9A5)
[Address] SSDT[68] : NtDuplicateObject @ 0x805BE03C -> HOOKED (Unknown @ 0xA590E9D7)
[Address] SSDT[98] : NtLoadKey @ 0x8062648E -> HOOKED (Unknown @ 0xA590E9AA)
[Address] SSDT[122] : NtOpenProcess @ 0x805CB486 -> HOOKED (Unknown @ 0xA590E978)
[Address] SSDT[128] : NtOpenThread @ 0x805CB712 -> HOOKED (Unknown @ 0xA590E97D)
[Address] SSDT[177] : NtQueryValueKey @ 0x8062248E -> HOOKED (Unknown @ 0xA590E9FF)
[Address] SSDT[193] : NtReplaceKey @ 0x8062633E -> HOOKED (Unknown @ 0xA590E9B4)
[Address] SSDT[200] : NtRequestWaitReplyPort @ 0x805A2DAA -> HOOKED (Unknown @ 0xA590E9F0)
[Address] SSDT[204] : NtRestoreKey @ 0x80625C4A -> HOOKED (Unknown @ 0xA590E9AF)
[Address] SSDT[213] : NtSetContextThread @ 0x805D2C4A -> HOOKED (Unknown @ 0xA590E9EB)
[Address] SSDT[237] : NtSetSecurityObject @ 0x805C0662 -> HOOKED (Unknown @ 0xA590E9F5)
[Address] SSDT[247] : NtSetValueKey @ 0x806227DC -> HOOKED (Unknown @ 0xA590E9A0)
[Address] SSDT[255] : NtSystemDebugControl @ 0x8061823E -> HOOKED (Unknown @ 0xA590E9FA)
[Address] SSDT[257] : NtTerminateProcess @ 0x805D2308 -> HOOKED (Unknown @ 0xA590E987)
[Address] Shadow SSDT[549] : NtUserSetWindowsHookEx -> HOOKED (Unknown @ 0xA590EA0E)
[Address] Shadow SSDT[552] : NtUserSetWinEventHook -> HOOKED (Unknown @ 0xA590EA13)

¤¤¤ Ruches Externes: ¤¤¤

¤¤¤ Infection : ¤¤¤

¤¤¤ Fichier HOSTS: ¤¤¤
--> %SystemRoot%\System32\drivers\etc\hosts


127.0.0.1 localhost
::1 localhost


¤¤¤ MBR Verif: ¤¤¤

+++++ PhysicalDrive0: (\\.\PHYSICALDRIVE0 @ IDE) Hitachi HTS543216L9SA00 +++++
--- User ---
[MBR] 4ef99f0f027a252f46a52878313f6c86
[BSP] 899311bdb77258f7dd69e4a2581993c0 : Windows XP MBR Code
Partition table:
0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 63 | Size: 73790 MB
1 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 151123455 | Size: 73782 MB
2 - [XXXXXX] FAT32-LBA (0x1c) [HIDDEN!] Offset (sectors): 302230845 | Size: 5004 MB
3 - [XXXXXX] UNKNOWN (0x00) [VISIBLE] Offset (sectors): 312480315 | Size: 47 MB
User = LL1 ... OK!
User = LL2 ... OK!

Termine : << RKreport[0]_S_05172014_170627.txt >>





Publicité


Signaler le contenu de ce document

Publicité