Rapport unhooker

tarzie Messages postés 63 Statut Membre -  
tarzie Messages postés 63 Statut Membre -
Bonjour,suite un scan j'obtient se rapport avec une possibilité d'infection mais c'est pas sur esque se logiciel est fiable

>SSDT State
NtAllocateVirtualMemory
Actual Address 0xF7A10B30
Hooked by: C:\WINDOWS\system32\drivers\wpsdrvnt.sys

NtCreateThread
Actual Address 0xF7F0ECAC
Hooked by: Unknown module filename

NtMapViewOfSection
Actual Address 0xF7A10470
Hooked by: C:\WINDOWS\system32\drivers\wpsdrvnt.sys

NtOpenProcess
Actual Address 0xF7F0EC98
Hooked by: Unknown module filename

NtOpenThread
Actual Address 0xF7F0EC9D
Hooked by: Unknown module filename

NtProtectVirtualMemory
Actual Address 0xF7A10C50
Hooked by: C:\WINDOWS\system32\drivers\wpsdrvnt.sys

NtShutdownSystem
Actual Address 0xF7A10990
Hooked by: C:\WINDOWS\system32\drivers\wpsdrvnt.sys

NtTerminateProcess
Actual Address 0xF7F0ECA7
Hooked by: Unknown module filename

NtWriteVirtualMemory
Actual Address 0xF7F0ECA2
Hooked by: Unknown module filename

>Shadow
>Processes
>Drivers
>Stealth
>Files
>Hooks
ntoskrnl.exe+0x00004AA2, Type: Inline - RelativeJump at address 0x804DBAA2 hook handler located in [ntoskrnl.exe]
ntoskrnl.exe+0x0000B858, Type: Inline - RelativeJump at address 0x804E2858 hook handler located in [ntoskrnl.exe]
tcpip.sys+0x00003CFA, Type: Inline - RelativeCall at address 0xF46FDCFA hook handler located in [Teefer.sys]
tcpip.sys+0x0000544E, Type: Inline - RelativeCall at address 0xF46FF44E hook handler located in [Teefer.sys]
tcpip.sys+0x0000A4E0, Type: Inline - RelativeCall at address 0xF47044E0 hook handler located in [Teefer.sys]
tcpip.sys-->ndis.sys-->NdisCloseAdapter, Type: IAT modification at address 0xF4738F28 hook handler located in [Teefer.sys]
tcpip.sys-->ndis.sys-->NdisOpenAdapter, Type: IAT modification at address 0xF4738F54 hook handler located in [Teefer.sys]
tcpip.sys-->ndis.sys-->NdisRegisterProtocol, Type: IAT modification at address 0xF4738F60 hook handler located in [Teefer.sys]
wanarp.sys+0x000053FD, Type: Inline - RelativeCall at address 0xF7A833FD hook handler located in [Teefer.sys]
wanarp.sys-->ndis.sys-->NdisCloseAdapter, Type: IAT modification at address 0xF7A83B4C hook handler located in [Teefer.sys]
wanarp.sys-->ndis.sys-->NdisDeregisterProtocol, Type: IAT modification at address 0xF7A83B1C hook handler located in [Teefer.sys]
wanarp.sys-->ndis.sys-->NdisOpenAdapter, Type: IAT modification at address 0xF7A83B3C hook handler located in [Teefer.sys]
wanarp.sys-->ndis.sys-->NdisRegisterProtocol, Type: IAT modification at address 0xF7A83B28 hook handler located in [Teefer.sys]
[288]explorer.exe-->kernel32.dll-->GetProcAddress, Type: IAT modification at address 0x01001268 hook handler located in [shimeng.dll]
!!POSSIBLE ROOTKIT ACTIVITY DETECTED!! =)

2 réponses

jalobservateur Messages postés 7372 Date d'inscription   Statut Contributeur sécurité Dernière intervention   930
 
Je passe vite simplement pour te dire que ces censés ''Hooks'', sont en fait des composantes de ton pare-feu Sygate et donc des faux positifs. Alors si tu veux investiguer plus loin , il y aura sûrement un helper pour te guider.
@+ jal
0
tarzie Messages postés 63 Statut Membre 4
 
salut

merci c'est cool de t'être arrêter sur le topic
0