Police et gendarmerie

Bonjour, un de plus dans la liste des victimes...roguekiller me dit:Mode: Recherche -- Date: 11/07/2012 22:12:27

¤¤¤ Processus malicieux: 0 ¤¤¤

¤¤¤ Entrees de registre: 8 ¤¤¤
[SUSP PATH] HKCU\[...]\Run : Update (C:\Users\mchevalier\AppData\Roaming\glom0_og.exe) -> FOUND
[SUSP PATH] HKLM\[...]\Run : Update (C:\Users\mchevalier\AppData\Roaming\glom0_og.exe) -> FOUND
[SUSP PATH] HKUS\S-1-5-21-569336838-665206767-1128034812-66171[...]\Run : Update (C:\Users\mchevalier\AppData\Roaming\glom0_og.exe) -> FOUND
[HJ] HKLM\[...]\System : ConsentPromptBehaviorAdmin (0) -> FOUND
[HJ] HKLM\[...]\System : EnableLUA (0) -> FOUND
[HJ] HKCU\[...]\Advanced : Start_ShowMyGames (0) -> FOUND
[HJ] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> FOUND
[HJ] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND

¤¤¤ Fichiers / Dossiers particuliers: ¤¤¤

¤¤¤ Driver: [CHARGE] ¤¤¤
SSDT[13] : NtAlertResumeThread @ 0x82AF0CA9 -> HOOKED (Unknown @ 0x85911798)
SSDT[14] : NtAlertThread @ 0x82A43BC0 -> HOOKED (Unknown @ 0x85911878)
SSDT[59] : ExpInterlockedPopEntrySListResume @ 0x82A8AF59 -> HOOKED (Unknown @ 0x858E0E00)
SSDT[74] : NtCreateMutant @ 0x82A2328E -> HOOKED (Unknown @ 0x859114E8)
SSDT[87] : NtCreateThread @ 0x82AEEED6 -> HOOKED (Unknown @ 0x859123C8)
SSDT[145] : NtImpersonateAnonymousToken @ 0x82A088BC -> HOOKED (Unknown @ 0x859115D8)
SSDT[147] : NtImpersonateThread @ 0x82A8C84C -> HOOKED (Unknown @ 0x859116B8)
SSDT[168] : NtMapViewOfSection @ 0x82A59512 -> HOOKED (Unknown @ 0x85911F70)
SSDT[177] : NtOpenEvent @ 0x82A22C8A -> HOOKED (Unknown @ 0x85911408)
SSDT[191] : NtOpenProcessToken @ 0x82A7721F -> HOOKED (Unknown @ 0x85912308)
SSDT[199] : NtOpenThreadToken @ 0x82A8B534 -> HOOKED (Unknown @ 0x85911D10)
SSDT[304] : NtResumeThread @ 0x82A83572 -> HOOKED (Unknown @ 0x859139F0)
SSDT[316] : NtSetContextThread @ 0x82AF0755 -> HOOKED (Unknown @ 0x85911C50)
SSDT[333] : NtSetInformationProcess @ 0x82A4B76D -> HOOKED (Unknown @ 0x85911DE0)
SSDT[335] : NtSetInformationThread @ 0x82A7CCD6 -> HOOKED (Unknown @ 0x85911B80)
SSDT[366] : NtSuspendProcess @ 0x82AF0BE3 -> HOOKED (Unknown @ 0x85911328)
SSDT[367] : NtSuspendThread @ 0x82AA8085 -> HOOKED (Unknown @ 0x859119C0)
SSDT[371] : NtTerminateThread @ 0x82A8B584 -> HOOKED (Unknown @ 0x85911AA0)
SSDT[385] : NtUnmapViewOfSection @ 0x82A7785A -> HOOKED (Unknown @ 0x85911EB0)

¤¤¤ Infection : ¤¤¤
¤¤¤ Fichier HOSTS: ¤¤¤


¤¤¤ MBR Verif: ¤¤¤

+++++ PhysicalDrive0: ST9160414ASG ATA Device +++++
--- User ---
[MBR] ebb2d91b9046b2acf3c41c776c2295b7
[BSP] 55fee1cd531ef738a8f606bd7b86bb1f : Windows 7 MBR Code
Partition table:
0 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 2048 | Size: 152315 Mo
1 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 311943168 | Size: 300 Mo
User = LL1 ... OK!
User = LL2 ... OK!

Termine : << RKreport[2].txt >>
RKreport[1].txt ; RKreport[2].txt


à l'aide!!! Merci





(Posté via Carrefour Multimedia)