Rapport unhooker
tarzie
Messages postés
63
Statut
Membre
-
tarzie Messages postés 63 Statut Membre -
tarzie Messages postés 63 Statut Membre -
Bonjour,suite un scan j'obtient se rapport avec une possibilité d'infection mais c'est pas sur esque se logiciel est fiable
>SSDT State
NtAllocateVirtualMemory
Actual Address 0xF7A10B30
Hooked by: C:\WINDOWS\system32\drivers\wpsdrvnt.sys
NtCreateThread
Actual Address 0xF7F0ECAC
Hooked by: Unknown module filename
NtMapViewOfSection
Actual Address 0xF7A10470
Hooked by: C:\WINDOWS\system32\drivers\wpsdrvnt.sys
NtOpenProcess
Actual Address 0xF7F0EC98
Hooked by: Unknown module filename
NtOpenThread
Actual Address 0xF7F0EC9D
Hooked by: Unknown module filename
NtProtectVirtualMemory
Actual Address 0xF7A10C50
Hooked by: C:\WINDOWS\system32\drivers\wpsdrvnt.sys
NtShutdownSystem
Actual Address 0xF7A10990
Hooked by: C:\WINDOWS\system32\drivers\wpsdrvnt.sys
NtTerminateProcess
Actual Address 0xF7F0ECA7
Hooked by: Unknown module filename
NtWriteVirtualMemory
Actual Address 0xF7F0ECA2
Hooked by: Unknown module filename
>Shadow
>Processes
>Drivers
>Stealth
>Files
>Hooks
ntoskrnl.exe+0x00004AA2, Type: Inline - RelativeJump at address 0x804DBAA2 hook handler located in [ntoskrnl.exe]
ntoskrnl.exe+0x0000B858, Type: Inline - RelativeJump at address 0x804E2858 hook handler located in [ntoskrnl.exe]
tcpip.sys+0x00003CFA, Type: Inline - RelativeCall at address 0xF46FDCFA hook handler located in [Teefer.sys]
tcpip.sys+0x0000544E, Type: Inline - RelativeCall at address 0xF46FF44E hook handler located in [Teefer.sys]
tcpip.sys+0x0000A4E0, Type: Inline - RelativeCall at address 0xF47044E0 hook handler located in [Teefer.sys]
tcpip.sys-->ndis.sys-->NdisCloseAdapter, Type: IAT modification at address 0xF4738F28 hook handler located in [Teefer.sys]
tcpip.sys-->ndis.sys-->NdisOpenAdapter, Type: IAT modification at address 0xF4738F54 hook handler located in [Teefer.sys]
tcpip.sys-->ndis.sys-->NdisRegisterProtocol, Type: IAT modification at address 0xF4738F60 hook handler located in [Teefer.sys]
wanarp.sys+0x000053FD, Type: Inline - RelativeCall at address 0xF7A833FD hook handler located in [Teefer.sys]
wanarp.sys-->ndis.sys-->NdisCloseAdapter, Type: IAT modification at address 0xF7A83B4C hook handler located in [Teefer.sys]
wanarp.sys-->ndis.sys-->NdisDeregisterProtocol, Type: IAT modification at address 0xF7A83B1C hook handler located in [Teefer.sys]
wanarp.sys-->ndis.sys-->NdisOpenAdapter, Type: IAT modification at address 0xF7A83B3C hook handler located in [Teefer.sys]
wanarp.sys-->ndis.sys-->NdisRegisterProtocol, Type: IAT modification at address 0xF7A83B28 hook handler located in [Teefer.sys]
[288]explorer.exe-->kernel32.dll-->GetProcAddress, Type: IAT modification at address 0x01001268 hook handler located in [shimeng.dll]
!!POSSIBLE ROOTKIT ACTIVITY DETECTED!! =)
>SSDT State
NtAllocateVirtualMemory
Actual Address 0xF7A10B30
Hooked by: C:\WINDOWS\system32\drivers\wpsdrvnt.sys
NtCreateThread
Actual Address 0xF7F0ECAC
Hooked by: Unknown module filename
NtMapViewOfSection
Actual Address 0xF7A10470
Hooked by: C:\WINDOWS\system32\drivers\wpsdrvnt.sys
NtOpenProcess
Actual Address 0xF7F0EC98
Hooked by: Unknown module filename
NtOpenThread
Actual Address 0xF7F0EC9D
Hooked by: Unknown module filename
NtProtectVirtualMemory
Actual Address 0xF7A10C50
Hooked by: C:\WINDOWS\system32\drivers\wpsdrvnt.sys
NtShutdownSystem
Actual Address 0xF7A10990
Hooked by: C:\WINDOWS\system32\drivers\wpsdrvnt.sys
NtTerminateProcess
Actual Address 0xF7F0ECA7
Hooked by: Unknown module filename
NtWriteVirtualMemory
Actual Address 0xF7F0ECA2
Hooked by: Unknown module filename
>Shadow
>Processes
>Drivers
>Stealth
>Files
>Hooks
ntoskrnl.exe+0x00004AA2, Type: Inline - RelativeJump at address 0x804DBAA2 hook handler located in [ntoskrnl.exe]
ntoskrnl.exe+0x0000B858, Type: Inline - RelativeJump at address 0x804E2858 hook handler located in [ntoskrnl.exe]
tcpip.sys+0x00003CFA, Type: Inline - RelativeCall at address 0xF46FDCFA hook handler located in [Teefer.sys]
tcpip.sys+0x0000544E, Type: Inline - RelativeCall at address 0xF46FF44E hook handler located in [Teefer.sys]
tcpip.sys+0x0000A4E0, Type: Inline - RelativeCall at address 0xF47044E0 hook handler located in [Teefer.sys]
tcpip.sys-->ndis.sys-->NdisCloseAdapter, Type: IAT modification at address 0xF4738F28 hook handler located in [Teefer.sys]
tcpip.sys-->ndis.sys-->NdisOpenAdapter, Type: IAT modification at address 0xF4738F54 hook handler located in [Teefer.sys]
tcpip.sys-->ndis.sys-->NdisRegisterProtocol, Type: IAT modification at address 0xF4738F60 hook handler located in [Teefer.sys]
wanarp.sys+0x000053FD, Type: Inline - RelativeCall at address 0xF7A833FD hook handler located in [Teefer.sys]
wanarp.sys-->ndis.sys-->NdisCloseAdapter, Type: IAT modification at address 0xF7A83B4C hook handler located in [Teefer.sys]
wanarp.sys-->ndis.sys-->NdisDeregisterProtocol, Type: IAT modification at address 0xF7A83B1C hook handler located in [Teefer.sys]
wanarp.sys-->ndis.sys-->NdisOpenAdapter, Type: IAT modification at address 0xF7A83B3C hook handler located in [Teefer.sys]
wanarp.sys-->ndis.sys-->NdisRegisterProtocol, Type: IAT modification at address 0xF7A83B28 hook handler located in [Teefer.sys]
[288]explorer.exe-->kernel32.dll-->GetProcAddress, Type: IAT modification at address 0x01001268 hook handler located in [shimeng.dll]
!!POSSIBLE ROOTKIT ACTIVITY DETECTED!! =)
A voir également:
- Rapport unhooker
- Plan rapport de stage - Guide
- Rapport de crash windows - Guide
- Impression rapport de stage ✓ - Forum Word
- Modifier rapport d'échelle pdf xchange viewer ✓ - Forum PDF
- Acheter un rapport de stage - Forum Programmation