Rapport

Bonjour,



Voilà le rapport roguekiller:
RogueKiller V7.6.6 [10/08/2012] par Tigzy
mail: tigzyRK<at>gmail<dot>com
Remontees: http://www.sur-la-toile.com/discussion-193725-1-BRogueKillerD-Remontees.html
Blog: http://tigzyrk.blogspot.com

Systeme d'exploitation: Windows XP (5.1.2600 Service Pack 3) 32 bits version
Demarrage : Mode normal
Utilisateur: Sylvie [Droits d'admin]
Mode: Suppression -- Date: 11/08/2012 18:34:55

¤¤¤ Processus malicieux: 2 ¤¤¤
[ZeroAccess] n -- c:\windows\system32\n -> UNLOADED
[ZeroAccess] n -- c:\windows\system32\n -> UNLOADED

¤¤¤ Entrees de registre: 7 ¤¤¤
[ZeroAccess] HKCR\[...]\InprocServer32 :

(\\.\globalroot\systemroot\Installer\{c1c1ff85-ca8e-4fae-c1c2-1b69efe62191}\n.) -> REPLACED

(c:\windows\system32\wbem\wbemess.dll)
[ZeroAccess] HKCR\[...]\InprocServer32 : (C:\Documents and Settings\Sylvie\Local

Settings\Application Data\{c1c1ff85-ca8e-4fae-c1c2-1b69efe62191}\n.) -> REPLACED

(c:\windows\system32\shell32.dll)
[HJ] HKCU\[...]\Advanced : Start_ShowRecentDocs (0) -> REPLACED (1)
[HJ] HKCU\[...]\Advanced : Start_ShowMyPics (0) -> REPLACED (1)
[HJ] HKCU\[...]\Advanced : Start_ShowMyMusic (0) -> REPLACED (1)
[HJ] HKCU\[...]\Advanced : Start_ShowPrinters (0) -> REPLACED (1)
[HJ] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) ->

REPLACED (0)

¤¤¤ Fichiers / Dossiers particuliers: ¤¤¤
[ZeroAccess][FILE] n : c:\windows\installer\{c1c1ff85-ca8e-4fae-c1c2-1b69efe62191}\n -->

REMOVED AT REBOOT
[ZeroAccess][FILE] @ : c:\windows\installer\{c1c1ff85-ca8e-4fae-c1c2-1b69efe62191}\@ -->

REMOVED AT REBOOT
[Del.Parent][FILE] 00000001.@ :

c:\windows\installer\{c1c1ff85-ca8e-4fae-c1c2-1b69efe62191}\U\00000001.@ --> REMOVED
[Del.Parent][FILE] 80000000.@ :

c:\windows\installer\{c1c1ff85-ca8e-4fae-c1c2-1b69efe62191}\U\80000000.@ --> REMOVED
[Del.Parent][FILE] 800000cb.@ :

c:\windows\installer\{c1c1ff85-ca8e-4fae-c1c2-1b69efe62191}\U\800000cb.@ --> REMOVED
[ZeroAccess][FOLDER] U : c:\windows\installer\{c1c1ff85-ca8e-4fae-c1c2-1b69efe62191}\U

--> REMOVED
[ZeroAccess][FOLDER] L : c:\windows\installer\{c1c1ff85-ca8e-4fae-c1c2-1b69efe62191}\L -->

REMOVED
[ZeroAccess][FILE] n : c:\documents and settings\sylvie\local settings\application

data\{c1c1ff85-ca8e-4fae-c1c2-1b69efe62191}\n --> REMOVED
[ZeroAccess][FILE] @ : c:\documents and settings\sylvie\local settings\application

data\{c1c1ff85-ca8e-4fae-c1c2-1b69efe62191}\@ --> REMOVED
[ZeroAccess][FOLDER] U : c:\documents and settings\sylvie\local settings\application

data\{c1c1ff85-ca8e-4fae-c1c2-1b69efe62191}\U --> REMOVED
[ZeroAccess][FOLDER] L : c:\documents and settings\sylvie\local settings\application

data\{c1c1ff85-ca8e-4fae-c1c2-1b69efe62191}\L --> REMOVED

¤¤¤ Driver: [CHARGE] ¤¤¤
SSDT[41] : NtCreateKey @ 0x80578ABE -> HOOKED (Unknown @ 0xF7EF1F76)
SSDT[53] : NtCreateThread @ 0x805860C0 -> HOOKED (Unknown @ 0xF7EF1F6C)
SSDT[63] : NtDeleteKey @ 0x8059A5CD -> HOOKED (Unknown @ 0xF7EF1F7B)
SSDT[65] : NtDeleteValueKey @ 0x805991EC -> HOOKED (Unknown @ 0xF7EF1F85)
SSDT[98] : NtLoadKey @ 0x805D608D -> HOOKED (Unknown @ 0xF7EF1F8A)
SSDT[122] : NtOpenProcess @ 0x8057BB80 -> HOOKED (Unknown @ 0xF7EF1F58)
SSDT[128] : NtOpenThread @ 0x80596A0F -> HOOKED (Unknown @ 0xF7EF1F5D)
SSDT[193] : NtReplaceKey @ 0x806570B6 -> HOOKED (Unknown @ 0xF7EF1F94)
SSDT[204] : NtRestoreKey @ 0x80656C4D -> HOOKED (Unknown @ 0xF7EF1F8F)
SSDT[247] : NtSetValueKey @ 0x8057B4EF -> HOOKED (Unknown @ 0xF7EF1F80)

¤¤¤ Infection : ZeroAccess ¤¤¤

¤¤¤ Fichier HOSTS: ¤¤¤
127.0.0.1 localhost
127.0.0.1 www.007guard.com
127.0.0.1 007guard.com
127.0.0.1 008i.com
127.0.0.1 www.008k.com
127.0.0.1 008k.com
127.0.0.1 www.00hq.com
127.0.0.1 00hq.com
127.0.0.1 010402.com
127.0.0.1 www.032439.com
127.0.0.1 032439.com
127.0.0.1 www.0scan.com
127.0.0.1 0scan.com
127.0.0.1 www.1000gratisproben.com
127.0.0.1 1000gratisproben.com
127.0.0.1 www.1001namen.com
127.0.0.1 1001namen.com
127.0.0.1 100888290cs.com
127.0.0.1 www.100888290cs.com
127.0.0.1 100sexlinks.com
[...]

¤¤¤ MBR Verif: ¤¤¤

+++++ PhysicalDrive0: Maxtor 6L200P0 +++++
--- User ---
[MBR] 849ba9829e81f33e456436d766b5aa37
[BSP] 2aab77516992ba936b50f51cc7e5ed74 : Windows XP MBR Code
Partition table:
0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 63 | Size: 194466 Mo
User = LL1 ... OK!
User = LL2 ... OK!

Termine : << RKreport[2].txt >>
RKreport[1].txt ; RKreport[2].txt