Virus Security Pro

Nanounoumea Messages postés 8 Statut Membre -  
Nanounoumea Messages postés 8 Statut Membre -
Bonjour,

Je viens de télécharger sur votre site RoqueKiller. Le processus a bien marché. Ne sachanrt pas ou poster le rapport, je le poste ici.
Je vous remercie de votre aide. Dois faire autre chose pour me débarrasser definitivement de ce virus.
Merci à tous pour votre réponse
RogueKiller V8.7.11 [Dec 3 2013] par Tigzy
mail : tigzyRK<at>gmail<dot>com
Remontees : http://www.adlice.com/forum/
Site Web : https://www.luanagames.com/index.fr.html
Blog : http://tigzyrk.blogspot.com/

Systeme d'exploitation : Windows Vista (6.0.6002 Service Pack 2) 32 bits version
Demarrage : Mode normal
Utilisateur : nanou [Droits d'admin]
Mode : Suppression -- Date : 12/05/2013 14:03:02
| ARK || FAK || MBR |

¤¤¤ Processus malicieux : 1 ¤¤¤
[SUSP PATH] 37nlpnrX.exe -- C:\ProgramData\37nlpnrX\37nlpnrX.exe [-] -> TUÉ [TermProc]

¤¤¤ Entrees de registre : 4 ¤¤¤
[RUN][ZeroAccess] HKCU\[...]\Run : Google Update ("C:\Users\nanou\AppData\Local\Google\Desktop\Install\{ff24043d-55f8-5ce9-a20a-8337d9b4b888}\?????????\?????????\?????\{ff24043d-55f8-5ce9-a20a-8337d9b4b888}\GoogleUpdate.exe" >) -> SUPPRIMÉ
[RUN][SUSP PATH] HKCU\[...]\Run : AS2014 (C:\ProgramData\37nlpnrX\37nlpnrX.exe [-]) -> SUPPRIMÉ
[RUN][ZeroAccess] HKUS\S-1-5-21-1990934522-1809484261-1882248070-1000\[...]\Run : Google Update ("C:\Users\nanou\AppData\Local\Google\Desktop\Install\{ff24043d-55f8-5ce9-a20a-8337d9b4b888}\?????????\?????????\?????\{ff24043d-55f8-5ce9-a20a-8337d9b4b888}\GoogleUpdate.exe" >) -> [0xc0000034] Unknown error
[RUN][SUSP PATH] HKUS\S-1-5-21-1990934522-1809484261-1882248070-1000\[...]\Run : AS2014 (C:\ProgramData\37nlpnrX\37nlpnrX.exe [-]) -> [0x2] Le fichier spécifié est introuvable.

¤¤¤ Tâches planifiées : 0 ¤¤¤

¤¤¤ Entrées Startup : 0 ¤¤¤

¤¤¤ Navigateurs web : 0 ¤¤¤

¤¤¤ Fichiers / Dossiers particuliers: ¤¤¤
[ZeroAccess][Repertoire] Install : C:\Users\nanou\AppData\Local\Google\Desktop\Install [-] --> SUPPRIMÉ
[ZeroAccess][Fichier] @ : C:\Users\nanou\AppData\Local\Google\Desktop\Install\{ff24043d-55f8-5ce9-a20a-8337d9b4b888}\?????????\?????????\?????\{ff24043d-55f8-5ce9-a20a-8337d9b4b888}\@ [-] --> SUPPRIMÉ
[ZeroAccess][Fichier] GoogleUpdate.exe : C:\Users\nanou\AppData\Local\Google\Desktop\Install\{ff24043d-55f8-5ce9-a20a-8337d9b4b888}\?????????\?????????\?????\{ff24043d-55f8-5ce9-a20a-8337d9b4b888}\GoogleUpdate.exe [-] --> SUPPRIMÉ
[ZeroAccess][Repertoire] L : C:\Users\nanou\AppData\Local\Google\Desktop\Install\{ff24043d-55f8-5ce9-a20a-8337d9b4b888}\?????????\?????????\?????\{ff24043d-55f8-5ce9-a20a-8337d9b4b888}\L [-] --> SUPPRIMÉ
[ZeroAccess][Fichier] 00000001.@ : C:\Users\nanou\AppData\Local\Google\Desktop\Install\{ff24043d-55f8-5ce9-a20a-8337d9b4b888}\?????????\?????????\?????\{ff24043d-55f8-5ce9-a20a-8337d9b4b888}\U\00000001.@ [-] --> SUPPRIMÉ
[ZeroAccess][Fichier] 00000002.@ : C:\Users\nanou\AppData\Local\Google\Desktop\Install\{ff24043d-55f8-5ce9-a20a-8337d9b4b888}\?????????\?????????\?????\{ff24043d-55f8-5ce9-a20a-8337d9b4b888}\U\00000002.@ [-] --> SUPPRIMÉ
[ZeroAccess][Fichier] 80000000.@ : C:\Users\nanou\AppData\Local\Google\Desktop\Install\{ff24043d-55f8-5ce9-a20a-8337d9b4b888}\?????????\?????????\?????\{ff24043d-55f8-5ce9-a20a-8337d9b4b888}\U\80000000.@ [-] --> SUPPRIMÉ
[ZeroAccess][Fichier] 80000001.@ : C:\Users\nanou\AppData\Local\Google\Desktop\Install\{ff24043d-55f8-5ce9-a20a-8337d9b4b888}\?????????\?????????\?????\{ff24043d-55f8-5ce9-a20a-8337d9b4b888}\U\80000001.@ [-] --> SUPPRIMÉ
[ZeroAccess][Fichier] 800000cb.@ : C:\Users\nanou\AppData\Local\Google\Desktop\Install\{ff24043d-55f8-5ce9-a20a-8337d9b4b888}\?????????\?????????\?????\{ff24043d-55f8-5ce9-a20a-8337d9b4b888}\U\800000cb.@ [-] --> SUPPRIMÉ
[ZeroAccess][Repertoire] U : C:\Users\nanou\AppData\Local\Google\Desktop\Install\{ff24043d-55f8-5ce9-a20a-8337d9b4b888}\?????????\?????????\?????\{ff24043d-55f8-5ce9-a20a-8337d9b4b888}\U [-] --> SUPPRIMÉ
[ZeroAccess][Repertoire] {ff24043d-55f8-5ce9-a20a-8337d9b4b888} : C:\Users\nanou\AppData\Local\Google\Desktop\Install\{ff24043d-55f8-5ce9-a20a-8337d9b4b888}\?????????\?????????\?????\{ff24043d-55f8-5ce9-a20a-8337d9b4b888} [-] --> SUPPRIMÉ
[ZeroAccess][Repertoire] ????? : C:\Users\nanou\AppData\Local\Google\Desktop\Install\{ff24043d-55f8-5ce9-a20a-8337d9b4b888}\?????????\?????????\????? [-] --> SUPPRIMÉ
[ZeroAccess][Repertoire] ????????? : C:\Users\nanou\AppData\Local\Google\Desktop\Install\{ff24043d-55f8-5ce9-a20a-8337d9b4b888}\?????????\????????? [-] --> SUPPRIMÉ
[ZeroAccess][Repertoire] ????????? : C:\Users\nanou\AppData\Local\Google\Desktop\Install\{ff24043d-55f8-5ce9-a20a-8337d9b4b888}\????????? [-] --> SUPPRIMÉ
[ZeroAccess][Repertoire] {ff24043d-55f8-5ce9-a20a-8337d9b4b888} : C:\Users\nanou\AppData\Local\Google\Desktop\Install\{ff24043d-55f8-5ce9-a20a-8337d9b4b888} [-] --> SUPPRIMÉ

¤¤¤ Driver : [CHARGE] ¤¤¤
[Address] SSDT[13] : NtAlertResumeThread @ 0x82E94823 -> HOOKED (Unknown @ 0x8ADDF018)
[Address] SSDT[14] : NtAlertThread @ 0x82E0D34F -> HOOKED (Unknown @ 0x8A7F3B08)
[Address] SSDT[18] : NtAllocateVirtualMemory @ 0x82E4969D -> HOOKED (Unknown @ 0x8A9F3D98)
[Address] SSDT[21] : NtAlpcConnectPort @ 0x82DEB8A7 -> HOOKED (Unknown @ 0x8A1891B8)
[Address] SSDT[42] : NtAssignProcessToJobObject @ 0x82DBEB32 -> HOOKED (Unknown @ 0x8A5F0110)
[Address] SSDT[67] : NtCreateMutant @ 0x82E21993 -> HOOKED (Unknown @ 0x8A9EF068)
[Address] SSDT[77] : NtCreateSymbolicLinkObject @ 0x82DC1349 -> HOOKED (Unknown @ 0x8A50A1F0)
[Address] SSDT[78] : NtCreateThread @ 0x82E92E40 -> HOOKED (Unknown @ 0x8A50A470)
[Address] SSDT[116] : NtDebugActiveProcess @ 0x82E65ED4 -> HOOKED (Unknown @ 0x8A5EF110)
[Address] SSDT[129] : NtDuplicateObject @ 0x82DF9579 -> HOOKED (Unknown @ 0x8A9F2410)
[Address] SSDT[147] : NtFreeVirtualMemory @ 0x82C85E75 -> HOOKED (Unknown @ 0x8A9F9880)
[Address] SSDT[156] : NtImpersonateAnonymousToken @ 0x82DBBF3F -> HOOKED (Unknown @ 0x8A5232D0)
[Address] SSDT[158] : NtImpersonateThread @ 0x82DD1589 -> HOOKED (Unknown @ 0x8A523EC8)
[Address] SSDT[165] : NtLoadDriver @ 0x82D6CE12 -> HOOKED (Unknown @ 0x8A170008)
[Address] SSDT[177] : NtMapViewOfSection @ 0x82E11994 -> HOOKED (Unknown @ 0x8A523900)
[Address] SSDT[184] : NtOpenEvent @ 0x82DFADF7 -> HOOKED (Unknown @ 0x8A5EA110)
[Address] SSDT[194] : NtOpenProcess @ 0x82E2212F -> HOOKED (Unknown @ 0x8A800DF8)
[Address] SSDT[195] : NtOpenProcessToken @ 0x82E02A58 -> HOOKED (Unknown @ 0x8A751918)
[Address] SSDT[197] : NtOpenSection @ 0x82E1278C -> HOOKED (Unknown @ 0x8A52D110)
[Address] SSDT[201] : NtOpenThread @ 0x82E1D62B -> HOOKED (Unknown @ 0x8A9EE888)
[Address] SSDT[210] : NtProtectVirtualMemory @ 0x82E1B3E2 -> HOOKED (Unknown @ 0x8A3EC660)
[Address] SSDT[282] : NtResumeThread @ 0x82E1CC4A -> HOOKED (Unknown @ 0x925820D0)
[Address] SSDT[289] : NtSetContextThread @ 0x82E942CF -> HOOKED (Unknown @ 0x8A561460)
[Address] SSDT[305] : NtSetInformationProcess @ 0x82E159E6 -> HOOKED (Unknown @ 0x8A9F4980)
[Address] SSDT[317] : NtSetSystemInformation @ 0x82DE7F1E -> HOOKED (Unknown @ 0x8A5EC110)
[Address] SSDT[330] : NtSuspendProcess @ 0x82E9475F -> HOOKED (Unknown @ 0x8A50B110)
[Address] SSDT[331] : NtSuspendThread @ 0x82D9B945 -> HOOKED (Unknown @ 0x8A3F4D80)
[Address] SSDT[334] : NtTerminateProcess @ 0x82DF216B -> HOOKED (Unknown @ 0x8A3F2150)
[Address] SSDT[335] : NtTerminateThread @ 0x82E1D660 -> HOOKED (Unknown @ 0x8A736350)
[Address] SSDT[348] : NtUnmapViewOfSection @ 0x82E11C57 -> HOOKED (Unknown @ 0x92101038)
[Address] SSDT[358] : NtWriteVirtualMemory @ 0x82E0EA27 -> HOOKED (Unknown @ 0x8A9F9F60)
[Address] SSDT[382] : NtCreateThreadEx @ 0x82E1D115 -> HOOKED (Unknown @ 0x8A520110)
[Address] Shadow SSDT[317] : NtUserAttachThreadInput -> HOOKED (Unknown @ 0x92937950)
[Address] Shadow SSDT[397] : NtUserGetAsyncKeyState -> HOOKED (Unknown @ 0x929239D0)
[Address] Shadow SSDT[428] : NtUserGetKeyboardState -> HOOKED (Unknown @ 0x92948910)
[Address] Shadow SSDT[430] : NtUserGetKeyState -> HOOKED (Unknown @ 0x929F72B8)
[Address] Shadow SSDT[442] : NtUserGetRawInputData -> HOOKED (Unknown @ 0x92FF1360)
[Address] Shadow SSDT[479] : NtUserMessageCall -> HOOKED (Unknown @ 0x940821D0)
[Address] Shadow SSDT[497] : NtUserPostMessage -> HOOKED (Unknown @ 0x879A2648)
[Address] Shadow SSDT[498] : NtUserPostThreadMessage -> HOOKED (Unknown @ 0x879A2578)
[Address] Shadow SSDT[573] : NtUserSetWindowsHookEx -> HOOKED (Unknown @ 0x92FC4B08)
[Address] Shadow SSDT[576] : NtUserSetWinEventHook -> HOOKED (Unknown @ 0x92FE96F8)
[Address] IRP[IRP_MJ_INTERNAL_DEVICE_CONTROL] : C:\Windows\system32\drivers\iastorv.sys -> HOOKED (C:\Windows\System32\drivers\sfsync03.sys @ 0x8323395C)
[Inline] EAT @explorer.exe (FwDoNothingOnObject) : FirewallAPI.dll -> HOOKED (Unknown @ 0x36C67D66)
[Inline] EAT @explorer.exe (FwEnableMemTracing) : FirewallAPI.dll -> HOOKED (Unknown @ 0x36C67D66)
[Inline] EAT @explorer.exe (FwSetMemLeakPolicy) : FirewallAPI.dll -> HOOKED (Unknown @ 0x36C67D66)
[Inline] EAT @explorer.exe (FwDoNothingOnObject) : FirewallAPI.dll -> HOOKED (Unknown @ 0x36C67D66)
[Inline] EAT @explorer.exe (FwEnableMemTracing) : FirewallAPI.dll -> HOOKED (Unknown @ 0x36C67D66)
[Inline] EAT @explorer.exe (FwSetMemLeakPolicy) : FirewallAPI.dll -> HOOKED (Unknown @ 0x36C67D66)

¤¤¤ Ruches Externes: ¤¤¤

¤¤¤ Infection : ZeroAccess ¤¤¤

¤¤¤ Fichier HOSTS: ¤¤¤
--> %SystemRoot%\System32\drivers\etc\hosts

127.0.0.1 localhost
::1 localhost

¤¤¤ MBR Verif: ¤¤¤

+++++ PhysicalDrive0: (\\.\PHYSICALDRIVE0 @ IDE) ST9500325AS ATA Device ++++

7 réponses

  1.
    Nanounoumea Messages postés 8 Statut Membre
     
    Houps j'ai oublié de coller le rapport... le voici
    RogueKiller V8.7.11 [Dec 3 2013] par Tigzy
    mail : tigzyRK<at>gmail<dot>com
    Remontees : http://www.adlice.com/forum/
    Site Web : https://www.luanagames.com/index.fr.html
    Blog : http://tigzyrk.blogspot.com/

    Systeme d'exploitation : Windows Vista (6.0.6002 Service Pack 2) 32 bits version
    Demarrage : Mode normal
    Utilisateur : nanou [Droits d'admin]
    Mode : Suppression -- Date : 12/05/2013 14:03:02
    | ARK || FAK || MBR |

    ¤¤¤ Processus malicieux : 1 ¤¤¤
    [SUSP PATH] 37nlpnrX.exe -- C:\ProgramData\37nlpnrX\37nlpnrX.exe [-] -> TUÉ [TermProc]

    ¤¤¤ Entrees de registre : 4 ¤¤¤
    [RUN][ZeroAccess] HKCU\[...]\Run : Google Update ("C:\Users\nanou\AppData\Local\Google\Desktop\Install\{ff24043d-55f8-5ce9-a20a-8337d9b4b888}\?????????\?????????\?????\{ff24043d-55f8-5ce9-a20a-8337d9b4b888}\GoogleUpdate.exe" >) -> SUPPRIMÉ
    [RUN][SUSP PATH] HKCU\[...]\Run : AS2014 (C:\ProgramData\37nlpnrX\37nlpnrX.exe [-]) -> SUPPRIMÉ
    [RUN][ZeroAccess] HKUS\S-1-5-21-1990934522-1809484261-1882248070-1000\[...]\Run : Google Update ("C:\Users\nanou\AppData\Local\Google\Desktop\Install\{ff24043d-55f8-5ce9-a20a-8337d9b4b888}\?????????\?????????\?????\{ff24043d-55f8-5ce9-a20a-8337d9b4b888}\GoogleUpdate.exe" >) -> [0xc0000034] Unknown error
    [RUN][SUSP PATH] HKUS\S-1-5-21-1990934522-1809484261-1882248070-1000\[...]\Run : AS2014 (C:\ProgramData\37nlpnrX\37nlpnrX.exe [-]) -> [0x2] Le fichier spécifié est introuvable.

    ¤¤¤ Tâches planifiées : 0 ¤¤¤

    ¤¤¤ Entrées Startup : 0 ¤¤¤

    ¤¤¤ Navigateurs web : 0 ¤¤¤

    ¤¤¤ Fichiers / Dossiers particuliers: ¤¤¤
    [ZeroAccess][Repertoire] Install : C:\Users\nanou\AppData\Local\Google\Desktop\Install [-] --> SUPPRIMÉ
    [ZeroAccess][Fichier] @ : C:\Users\nanou\AppData\Local\Google\Desktop\Install\{ff24043d-55f8-5ce9-a20a-8337d9b4b888}\?????????\?????????\?????\{ff24043d-55f8-5ce9-a20a-8337d9b4b888}\@ [-] --> SUPPRIMÉ
    [ZeroAccess][Fichier] GoogleUpdate.exe : C:\Users\nanou\AppData\Local\Google\Desktop\Install\{ff24043d-55f8-5ce9-a20a-8337d9b4b888}\?????????\?????????\?????\{ff24043d-55f8-5ce9-a20a-8337d9b4b888}\GoogleUpdate.exe [-] --> SUPPRIMÉ
    [ZeroAccess][Repertoire] L : C:\Users\nanou\AppData\Local\Google\Desktop\Install\{ff24043d-55f8-5ce9-a20a-8337d9b4b888}\?????????\?????????\?????\{ff24043d-55f8-5ce9-a20a-8337d9b4b888}\L [-] --> SUPPRIMÉ
    [ZeroAccess][Fichier] 00000001.@ : C:\Users\nanou\AppData\Local\Google\Desktop\Install\{ff24043d-55f8-5ce9-a20a-8337d9b4b888}\?????????\?????????\?????\{ff24043d-55f8-5ce9-a20a-8337d9b4b888}\U\00000001.@ [-] --> SUPPRIMÉ
    [ZeroAccess][Fichier] 00000002.@ : C:\Users\nanou\AppData\Local\Google\Desktop\Install\{ff24043d-55f8-5ce9-a20a-8337d9b4b888}\?????????\?????????\?????\{ff24043d-55f8-5ce9-a20a-8337d9b4b888}\U\00000002.@ [-] --> SUPPRIMÉ
    [ZeroAccess][Fichier] 80000000.@ : C:\Users\nanou\AppData\Local\Google\Desktop\Install\{ff24043d-55f8-5ce9-a20a-8337d9b4b888}\?????????\?????????\?????\{ff24043d-55f8-5ce9-a20a-8337d9b4b888}\U\80000000.@ [-] --> SUPPRIMÉ
    [ZeroAccess][Fichier] 80000001.@ : C:\Users\nanou\AppData\Local\Google\Desktop\Install\{ff24043d-55f8-5ce9-a20a-8337d9b4b888}\?????????\?????????\?????\{ff24043d-55f8-5ce9-a20a-8337d9b4b888}\U\80000001.@ [-] --> SUPPRIMÉ
    [ZeroAccess][Fichier] 800000cb.@ : C:\Users\nanou\AppData\Local\Google\Desktop\Install\{ff24043d-55f8-5ce9-a20a-8337d9b4b888}\?????????\?????????\?????\{ff24043d-55f8-5ce9-a20a-8337d9b4b888}\U\800000cb.@ [-] --> SUPPRIMÉ
    [ZeroAccess][Repertoire] U : C:\Users\nanou\AppData\Local\Google\Desktop\Install\{ff24043d-55f8-5ce9-a20a-8337d9b4b888}\?????????\?????????\?????\{ff24043d-55f8-5ce9-a20a-8337d9b4b888}\U [-] --> SUPPRIMÉ
    [ZeroAccess][Repertoire] {ff24043d-55f8-5ce9-a20a-8337d9b4b888} : C:\Users\nanou\AppData\Local\Google\Desktop\Install\{ff24043d-55f8-5ce9-a20a-8337d9b4b888}\?????????\?????????\?????\{ff24043d-55f8-5ce9-a20a-8337d9b4b888} [-] --> SUPPRIMÉ
    [ZeroAccess][Repertoire] ????? : C:\Users\nanou\AppData\Local\Google\Desktop\Install\{ff24043d-55f8-5ce9-a20a-8337d9b4b888}\?????????\?????????\????? [-] --> SUPPRIMÉ
    [ZeroAccess][Repertoire] ????????? : C:\Users\nanou\AppData\Local\Google\Desktop\Install\{ff24043d-55f8-5ce9-a20a-8337d9b4b888}\?????????\????????? [-] --> SUPPRIMÉ
    [ZeroAccess][Repertoire] ????????? : C:\Users\nanou\AppData\Local\Google\Desktop\Install\{ff24043d-55f8-5ce9-a20a-8337d9b4b888}\????????? [-] --> SUPPRIMÉ
    [ZeroAccess][Repertoire] {ff24043d-55f8-5ce9-a20a-8337d9b4b888} : C:\Users\nanou\AppData\Local\Google\Desktop\Install\{ff24043d-55f8-5ce9-a20a-8337d9b4b888} [-] --> SUPPRIMÉ

    ¤¤¤ Driver : [CHARGE] ¤¤¤
    [Address] SSDT[13] : NtAlertResumeThread @ 0x82E94823 -> HOOKED (Unknown @ 0x8ADDF018)
    [Address] SSDT[14] : NtAlertThread @ 0x82E0D34F -> HOOKED (Unknown @ 0x8A7F3B08)
    [Address] SSDT[18] : NtAllocateVirtualMemory @ 0x82E4969D -> HOOKED (Unknown @ 0x8A9F3D98)
    [Address] SSDT[21] : NtAlpcConnectPort @ 0x82DEB8A7 -> HOOKED (Unknown @ 0x8A1891B8)
    [Address] SSDT[42] : NtAssignProcessToJobObject @ 0x82DBEB32 -> HOOKED (Unknown @ 0x8A5F0110)
    [Address] SSDT[67] : NtCreateMutant @ 0x82E21993 -> HOOKED (Unknown @ 0x8A9EF068)
    [Address] SSDT[77] : NtCreateSymbolicLinkObject @ 0x82DC1349 -> HOOKED (Unknown @ 0x8A50A1F0)
    [Address] SSDT[78] : NtCreateThread @ 0x82E92E40 -> HOOKED (Unknown @ 0x8A50A470)
    [Address] SSDT[116] : NtDebugActiveProcess @ 0x82E65ED4 -> HOOKED (Unknown @ 0x8A5EF110)
    [Address] SSDT[129] : NtDuplicateObject @ 0x82DF9579 -> HOOKED (Unknown @ 0x8A9F2410)
    [Address] SSDT[147] : NtFreeVirtualMemory @ 0x82C85E75 -> HOOKED (Unknown @ 0x8A9F9880)
    [Address] SSDT[156] : NtImpersonateAnonymousToken @ 0x82DBBF3F -> HOOKED (Unknown @ 0x8A5232D0)
    [Address] SSDT[158] : NtImpersonateThread @ 0x82DD1589 -> HOOKED (Unknown @ 0x8A523EC8)
    [Address] SSDT[165] : NtLoadDriver @ 0x82D6CE12 -> HOOKED (Unknown @ 0x8A170008)
    [Address] SSDT[177] : NtMapViewOfSection @ 0x82E11994 -> HOOKED (Unknown @ 0x8A523900)
    [Address] SSDT[184] : NtOpenEvent @ 0x82DFADF7 -> HOOKED (Unknown @ 0x8A5EA110)
    [Address] SSDT[194] : NtOpenProcess @ 0x82E2212F -> HOOKED (Unknown @ 0x8A800DF8)
    [Address] SSDT[195] : NtOpenProcessToken @ 0x82E02A58 -> HOOKED (Unknown @ 0x8A751918)
    [Address] SSDT[197] : NtOpenSection @ 0x82E1278C -> HOOKED (Unknown @ 0x8A52D110)
    [Address] SSDT[201] : NtOpenThread @ 0x82E1D62B -> HOOKED (Unknown @ 0x8A9EE888)
    [Address] SSDT[210] : NtProtectVirtualMemory @ 0x82E1B3E2 -> HOOKED (Unknown @ 0x8A3EC660)
    [Address] SSDT[282] : NtResumeThread @ 0x82E1CC4A -> HOOKED (Unknown @ 0x925820D0)
    [Address] SSDT[289] : NtSetContextThread @ 0x82E942CF -> HOOKED (Unknown @ 0x8A561460)
    [Address] SSDT[305] : NtSetInformationProcess @ 0x82E159E6 -> HOOKED (Unknown @ 0x8A9F4980)
    [Address] SSDT[317] : NtSetSystemInformation @ 0x82DE7F1E -> HOOKED (Unknown @ 0x8A5EC110)
    [Address] SSDT[330] : NtSuspendProcess @ 0x82E9475F -> HOOKED (Unknown @ 0x8A50B110)
    [Address] SSDT[331] : NtSuspendThread @ 0x82D9B945 -> HOOKED (Unknown @ 0x8A3F4D80)
    [Address] SSDT[334] : NtTerminateProcess @ 0x82DF216B -> HOOKED (Unknown @ 0x8A3F2150)
    [Address] SSDT[335] : NtTerminateThread @ 0x82E1D660 -> HOOKED (Unknown @ 0x8A736350)
    [Address] SSDT[348] : NtUnmapViewOfSection @ 0x82E11C57 -> HOOKED (Unknown @ 0x92101038)
    [Address] SSDT[358] : NtWriteVirtualMemory @ 0x82E0EA27 -> HOOKED (Unknown @ 0x8A9F9F60)
    [Address] SSDT[382] : NtCreateThreadEx @ 0x82E1D115 -> HOOKED (Unknown @ 0x8A520110)
    [Address] Shadow SSDT[317] : NtUserAttachThreadInput -> HOOKED (Unknown @ 0x92937950)
    [Address] Shadow SSDT[397] : NtUserGetAsyncKeyState -> HOOKED (Unknown @ 0x929239D0)
    [Address] Shadow SSDT[428] : NtUserGetKeyboardState -> HOOKED (Unknown @ 0x92948910)
    [Address] Shadow SSDT[430] : NtUserGetKeyState -> HOOKED (Unknown @ 0x929F72B8)
    [Address] Shadow SSDT[442] : NtUserGetRawInputData -> HOOKED (Unknown @ 0x92FF1360)
    [Address] Shadow SSDT[479] : NtUserMessageCall -> HOOKED (Unknown @ 0x940821D0)
    [Address] Shadow SSDT[497] : NtUserPostMessage -> HOOKED (Unknown @ 0x879A2648)
    [Address] Shadow SSDT[498] : NtUserPostThreadMessage -> HOOKED (Unknown @ 0x879A2578)
    [Address] Shadow SSDT[573] : NtUserSetWindowsHookEx -> HOOKED (Unknown @ 0x92FC4B08)
    [Address] Shadow SSDT[576] : NtUserSetWinEventHook -> HOOKED (Unknown @ 0x92FE96F8)
    [Address] IRP[IRP_MJ_INTERNAL_DEVICE_CONTROL] : C:\Windows\system32\drivers\iastorv.sys -> HOOKED (C:\Windows\System32\drivers\sfsync03.sys @ 0x8323395C)
    [Inline] EAT @explorer.exe (FwDoNothingOnObject) : FirewallAPI.dll -> HOOKED (Unknown @ 0x36C67D66)
    [Inline] EAT @explorer.exe (FwEnableMemTracing) : FirewallAPI.dll -> HOOKED (Unknown @ 0x36C67D66)
    [Inline] EAT @explorer.exe (FwSetMemLeakPolicy) : FirewallAPI.dll -> HOOKED (Unknown @ 0x36C67D66)
    [Inline] EAT @explorer.exe (FwDoNothingOnObject) : FirewallAPI.dll -> HOOKED (Unknown @ 0x36C67D66)
    [Inline] EAT @explorer.exe (FwEnableMemTracing) : FirewallAPI.dll -> HOOKED (Unknown @ 0x36C67D66)
    [Inline] EAT @explorer.exe (FwSetMemLeakPolicy) : FirewallAPI.dll -> HOOKED (Unknown @ 0x36C67D66)

    ¤¤¤ Ruches Externes: ¤¤¤

    ¤¤¤ Infection : ZeroAccess ¤¤¤

    ¤¤¤ Fichier HOSTS: ¤¤¤
    --> %SystemRoot%\System32\drivers\etc\hosts

    127.0.0.1 localhost
    ::1 localhost

    ¤¤¤ MBR Verif: ¤¤¤

    +++++ PhysicalDrive0: (\\.\PHYSICALDRIVE0 @ IDE) ST9500325AS ATA Device ++++
    0
  2. Bridget. Messages postés 3816 Date d'inscription   Statut Contributeur Dernière intervention   404
     
    Bonjour,

    Refais en un en mode recherche et mets-le en entier. Je veux la fin.
    0
  3. Nanounoumea Messages postés 8 Statut Membre
     
    Merci de ton intérêt a mon Pb. Tu me demandes de faire recherche sur mon ordi de" security pro" c'est bien ça ?
    0
  4. Nanounoumea Messages postés 8 Statut Membre
     
    Voilà les 2 rapport que j'ai trouvé
    RogueKiller V8.7.11 [Dec 3 2013] par Tigzy
    mail : tigzyRK<at>gmail<dot>com
    Remontees : http://www.adlice.com/forum/
    Site Web : https://www.luanagames.com/index.fr.html
    Blog : http://tigzyrk.blogspot.com/

    Systeme d'exploitation : Windows Vista (6.0.6002 Service Pack 2) 32 bits version
    Demarrage : Mode normal
    Utilisateur : nanou [Droits d'admin]
    Mode : Suppression -- Date : 12/05/2013 14:03:02
    | ARK || FAK || MBR |

    ¤¤¤ Processus malicieux : 1 ¤¤¤
    [SUSP PATH] 37nlpnrX.exe -- C:\ProgramData\37nlpnrX\37nlpnrX.exe [-] -> TUÉ [TermProc]

    ¤¤¤ Entrees de registre : 4 ¤¤¤
    [RUN][ZeroAccess] HKCU\[...]\Run : Google Update ("C:\Users\nanou\AppData\Local\Google\Desktop\Install\{ff24043d-55f8-5ce9-a20a-8337d9b4b888}\?????????\?????????\?????\{ff24043d-55f8-5ce9-a20a-8337d9b4b888}\GoogleUpdate.exe" >) -> SUPPRIMÉ
    [RUN][SUSP PATH] HKCU\[...]\Run : AS2014 (C:\ProgramData\37nlpnrX\37nlpnrX.exe [-]) -> SUPPRIMÉ
    [RUN][ZeroAccess] HKUS\S-1-5-21-1990934522-1809484261-1882248070-1000\[...]\Run : Google Update ("C:\Users\nanou\AppData\Local\Google\Desktop\Install\{ff24043d-55f8-5ce9-a20a-8337d9b4b888}\?????????\?????????\?????\{ff24043d-55f8-5ce9-a20a-8337d9b4b888}\GoogleUpdate.exe" >) -> [0xc0000034] Unknown error
    [RUN][SUSP PATH] HKUS\S-1-5-21-1990934522-1809484261-1882248070-1000\[...]\Run : AS2014 (C:\ProgramData\37nlpnrX\37nlpnrX.exe [-]) -> [0x2] Le fichier spécifié est introuvable.

    ¤¤¤ Tâches planifiées : 0 ¤¤¤

    ¤¤¤ Entrées Startup : 0 ¤¤¤

    ¤¤¤ Navigateurs web : 0 ¤¤¤

    ¤¤¤ Fichiers / Dossiers particuliers: ¤¤¤
    [ZeroAccess][Repertoire] Install : C:\Users\nanou\AppData\Local\Google\Desktop\Install [-] --> SUPPRIMÉ
    [ZeroAccess][Fichier] @ : C:\Users\nanou\AppData\Local\Google\Desktop\Install\{ff24043d-55f8-5ce9-a20a-8337d9b4b888}\?????????\?????????\?????\{ff24043d-55f8-5ce9-a20a-8337d9b4b888}\@ [-] --> SUPPRIMÉ
    [ZeroAccess][Fichier] GoogleUpdate.exe : C:\Users\nanou\AppData\Local\Google\Desktop\Install\{ff24043d-55f8-5ce9-a20a-8337d9b4b888}\?????????\?????????\?????\{ff24043d-55f8-5ce9-a20a-8337d9b4b888}\GoogleUpdate.exe [-] --> SUPPRIMÉ
    [ZeroAccess][Repertoire] L : C:\Users\nanou\AppData\Local\Google\Desktop\Install\{ff24043d-55f8-5ce9-a20a-8337d9b4b888}\?????????\?????????\?????\{ff24043d-55f8-5ce9-a20a-8337d9b4b888}\L [-] --> SUPPRIMÉ
    [ZeroAccess][Fichier] 00000001.@ : C:\Users\nanou\AppData\Local\Google\Desktop\Install\{ff24043d-55f8-5ce9-a20a-8337d9b4b888}\?????????\?????????\?????\{ff24043d-55f8-5ce9-a20a-8337d9b4b888}\U\00000001.@ [-] --> SUPPRIMÉ
    [ZeroAccess][Fichier] 00000002.@ : C:\Users\nanou\AppData\Local\Google\Desktop\Install\{ff24043d-55f8-5ce9-a20a-8337d9b4b888}\?????????\?????????\?????\{ff24043d-55f8-5ce9-a20a-8337d9b4b888}\U\00000002.@ [-] --> SUPPRIMÉ
    [ZeroAccess][Fichier] 80000000.@ : C:\Users\nanou\AppData\Local\Google\Desktop\Install\{ff24043d-55f8-5ce9-a20a-8337d9b4b888}\?????????\?????????\?????\{ff24043d-55f8-5ce9-a20a-8337d9b4b888}\U\80000000.@ [-] --> SUPPRIMÉ
    [ZeroAccess][Fichier] 80000001.@ : C:\Users\nanou\AppData\Local\Google\Desktop\Install\{ff24043d-55f8-5ce9-a20a-8337d9b4b888}\?????????\?????????\?????\{ff24043d-55f8-5ce9-a20a-8337d9b4b888}\U\80000001.@ [-] --> SUPPRIMÉ
    [ZeroAccess][Fichier] 800000cb.@ : C:\Users\nanou\AppData\Local\Google\Desktop\Install\{ff24043d-55f8-5ce9-a20a-8337d9b4b888}\?????????\?????????\?????\{ff24043d-55f8-5ce9-a20a-8337d9b4b888}\U\800000cb.@ [-] --> SUPPRIMÉ
    [ZeroAccess][Repertoire] U : C:\Users\nanou\AppData\Local\Google\Desktop\Install\{ff24043d-55f8-5ce9-a20a-8337d9b4b888}\?????????\?????????\?????\{ff24043d-55f8-5ce9-a20a-8337d9b4b888}\U [-] --> SUPPRIMÉ
    [ZeroAccess][Repertoire] {ff24043d-55f8-5ce9-a20a-8337d9b4b888} : C:\Users\nanou\AppData\Local\Google\Desktop\Install\{ff24043d-55f8-5ce9-a20a-8337d9b4b888}\?????????\?????????\?????\{ff24043d-55f8-5ce9-a20a-8337d9b4b888} [-] --> SUPPRIMÉ
    [ZeroAccess][Repertoire] ????? : C:\Users\nanou\AppData\Local\Google\Desktop\Install\{ff24043d-55f8-5ce9-a20a-8337d9b4b888}\?????????\?????????\????? [-] --> SUPPRIMÉ
    [ZeroAccess][Repertoire] ????????? : C:\Users\nanou\AppData\Local\Google\Desktop\Install\{ff24043d-55f8-5ce9-a20a-8337d9b4b888}\?????????\????????? [-] --> SUPPRIMÉ
    [ZeroAccess][Repertoire] ????????? : C:\Users\nanou\AppData\Local\Google\Desktop\Install\{ff24043d-55f8-5ce9-a20a-8337d9b4b888}\????????? [-] --> SUPPRIMÉ
    [ZeroAccess][Repertoire] {ff24043d-55f8-5ce9-a20a-8337d9b4b888} : C:\Users\nanou\AppData\Local\Google\Desktop\Install\{ff24043d-55f8-5ce9-a20a-8337d9b4b888} [-] --> SUPPRIMÉ

    ¤¤¤ Driver : [CHARGE] ¤¤¤
    [Address] SSDT[13] : NtAlertResumeThread @ 0x82E94823 -> HOOKED (Unknown @ 0x8ADDF018)
    [Address] SSDT[14] : NtAlertThread @ 0x82E0D34F -> HOOKED (Unknown @ 0x8A7F3B08)
    [Address] SSDT[18] : NtAllocateVirtualMemory @ 0x82E4969D -> HOOKED (Unknown @ 0x8A9F3D98)
    [Address] SSDT[21] : NtAlpcConnectPort @ 0x82DEB8A7 -> HOOKED (Unknown @ 0x8A1891B8)
    [Address] SSDT[42] : NtAssignProcessToJobObject @ 0x82DBEB32 -> HOOKED (Unknown @ 0x8A5F0110)
    [Address] SSDT[67] : NtCreateMutant @ 0x82E21993 -> HOOKED (Unknown @ 0x8A9EF068)
    [Address] SSDT[77] : NtCreateSymbolicLinkObject @ 0x82DC1349 -> HOOKED (Unknown @ 0x8A50A1F0)
    [Address] SSDT[78] : NtCreateThread @ 0x82E92E40 -> HOOKED (Unknown @ 0x8A50A470)
    [Address] SSDT[116] : NtDebugActiveProcess @ 0x82E65ED4 -> HOOKED (Unknown @ 0x8A5EF110)
    [Address] SSDT[129] : NtDuplicateObject @ 0x82DF9579 -> HOOKED (Unknown @ 0x8A9F2410)
    [Address] SSDT[147] : NtFreeVirtualMemory @ 0x82C85E75 -> HOOKED (Unknown @ 0x8A9F9880)
    [Address] SSDT[156] : NtImpersonateAnonymousToken @ 0x82DBBF3F -> HOOKED (Unknown @ 0x8A5232D0)
    [Address] SSDT[158] : NtImpersonateThread @ 0x82DD1589 -> HOOKED (Unknown @ 0x8A523EC8)
    [Address] SSDT[165] : NtLoadDriver @ 0x82D6CE12 -> HOOKED (Unknown @ 0x8A170008)
    [Address] SSDT[177] : NtMapViewOfSection @ 0x82E11994 -> HOOKED (Unknown @ 0x8A523900)
    [Address] SSDT[184] : NtOpenEvent @ 0x82DFADF7 -> HOOKED (Unknown @ 0x8A5EA110)
    [Address] SSDT[194] : NtOpenProcess @ 0x82E2212F -> HOOKED (Unknown @ 0x8A800DF8)
    [Address] SSDT[195] : NtOpenProcessToken @ 0x82E02A58 -> HOOKED (Unknown @ 0x8A751918)
    [Address] SSDT[197] : NtOpenSection @ 0x82E1278C -> HOOKED (Unknown @ 0x8A52D110)
    [Address] SSDT[201] : NtOpenThread @ 0x82E1D62B -> HOOKED (Unknown @ 0x8A9EE888)
    [Address] SSDT[210] : NtProtectVirtualMemory @ 0x82E1B3E2 -> HOOKED (Unknown @ 0x8A3EC660)
    [Address] SSDT[282] : NtResumeThread @ 0x82E1CC4A -> HOOKED (Unknown @ 0x925820D0)
    [Address] SSDT[289] : NtSetContextThread @ 0x82E942CF -> HOOKED (Unknown @ 0x8A561460)
    [Address] SSDT[305] : NtSetInformationProcess @ 0x82E159E6 -> HOOKED (Unknown @ 0x8A9F4980)
    [Address] SSDT[317] : NtSetSystemInformation @ 0x82DE7F1E -> HOOKED (Unknown @ 0x8A5EC110)
    [Address] SSDT[330] : NtSuspendProcess @ 0x82E9475F -> HOOKED (Unknown @ 0x8A50B110)
    [Address] SSDT[331] : NtSuspendThread @ 0x82D9B945 -> HOOKED (Unknown @ 0x8A3F4D80)
    [Address] SSDT[334] : NtTerminateProcess @ 0x82DF216B -> HOOKED (Unknown @ 0x8A3F2150)
    [Address] SSDT[335] : NtTerminateThread @ 0x82E1D660 -> HOOKED (Unknown @ 0x8A736350)
    [Address] SSDT[348] : NtUnmapViewOfSection @ 0x82E11C57 -> HOOKED (Unknown @ 0x92101038)
    [Address] SSDT[358] : NtWriteVirtualMemory @ 0x82E0EA27 -> HOOKED (Unknown @ 0x8A9F9F60)
    [Address] SSDT[382] : NtCreateThreadEx @ 0x82E1D115 -> HOOKED (Unknown @ 0x8A520110)
    [Address] Shadow SSDT[317] : NtUserAttachThreadInput -> HOOKED (Unknown @ 0x92937950)
    [Address] Shadow SSDT[397] : NtUserGetAsyncKeyState -> HOOKED (Unknown @ 0x929239D0)
    [Address] Shadow SSDT[428] : NtUserGetKeyboardState -> HOOKED (Unknown @ 0x92948910)
    [Address] Shadow SSDT[430] : NtUserGetKeyState -> HOOKED (Unknown @ 0x929F72B8)
    [Address] Shadow SSDT[442] : NtUserGetRawInputData -> HOOKED (Unknown @ 0x92FF1360)
    [Address] Shadow SSDT[479] : NtUserMessageCall -> HOOKED (Unknown @ 0x940821D0)
    [Address] Shadow SSDT[497] : NtUserPostMessage -> HOOKED (Unknown @ 0x879A2648)
    [Address] Shadow SSDT[498] : NtUserPostThreadMessage -> HOOKED (Unknown @ 0x879A2578)
    [Address] Shadow SSDT[573] : NtUserSetWindowsHookEx -> HOOKED (Unknown @ 0x92FC4B08)
    [Address] Shadow SSDT[576] : NtUserSetWinEventHook -> HOOKED (Unknown @ 0x92FE96F8)
    [Address] IRP[IRP_MJ_INTERNAL_DEVICE_CONTROL] : C:\Windows\system32\drivers\iastorv.sys -> HOOKED (C:\Windows\System32\drivers\sfsync03.sys @ 0x8323395C)
    [Inline] EAT @explorer.exe (FwDoNothingOnObject) : FirewallAPI.dll -> HOOKED (Unknown @ 0x36C67D66)
    [Inline] EAT @explorer.exe (FwEnableMemTracing) : FirewallAPI.dll -> HOOKED (Unknown @ 0x36C67D66)
    [Inline] EAT @explorer.exe (FwSetMemLeakPolicy) : FirewallAPI.dll -> HOOKED (Unknown @ 0x36C67D66)
    [Inline] EAT @explorer.exe (FwDoNothingOnObject) : FirewallAPI.dll -> HOOKED (Unknown @ 0x36C67D66)
    [Inline] EAT @explorer.exe (FwEnableMemTracing) : FirewallAPI.dll -> HOOKED (Unknown @ 0x36C67D66)
    [Inline] EAT @explorer.exe (FwSetMemLeakPolicy) : FirewallAPI.dll -> HOOKED (Unknown @ 0x36C67D66)

    ¤¤¤ Ruches Externes: ¤¤¤

    ¤¤¤ Infection : ZeroAccess ¤¤¤

    ¤¤¤ Fichier HOSTS: ¤¤¤
    --> %SystemRoot%\System32\drivers\etc\hosts

    127.0.0.1 localhost
    ::1 localhost

    ¤¤¤ MBR Verif: ¤¤¤

    +++++ PhysicalDrive0: (\\.\PHYSICALDRIVE0 @ IDE) ST9500325AS ATA Device +++++
    --- User ---
    [MBR] ccdf17d7e9e510c30e34c616b246449f
    [BSP] 64e337131f490ad902cc12c1a0c940ba : Toshiba MBR Code
    Partition table:
    0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 2048 | Size: 466095 Mo
    1 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 954564608 | Size: 10841 Mo
    User = LL1 ... OK!
    User = LL2 ... OK!

    Termine : << RKreport[0]_D_12052013_140302.txt >>
    RKreport[0]_S_12052013_140214.txt;RKreport[1]_S_25052013_103706.txt;RKreport[2]_D_25052013_120941.txt

    le second

    RogueKiller V8.7.11 [Dec 3 2013] par Tigzy
    mail : tigzyRK<at>gmail<dot>com
    Remontees : http://www.adlice.com/forum/
    Site Web : https://www.luanagames.com/index.fr.html
    Blog : http://tigzyrk.blogspot.com/

    Systeme d'exploitation : Windows Vista (6.0.6002 Service Pack 2) 32 bits version
    Demarrage : Mode normal
    Utilisateur : nanou [Droits d'admin]
    Mode : Recherche -- Date : 12/05/2013 14:02:14
    | ARK || FAK || MBR |

    ¤¤¤ Processus malicieux : 1 ¤¤¤
    [SUSP PATH] 37nlpnrX.exe -- C:\ProgramData\37nlpnrX\37nlpnrX.exe [-] -> TUÉ [TermProc]

    ¤¤¤ Entrees de registre : 6 ¤¤¤
    [RUN][ZeroAccess] HKCU\[...]\Run : Google Update ("C:\Users\nanou\AppData\Local\Google\Desktop\Install\{ff24043d-55f8-5ce9-a20a-8337d9b4b888}\?????????\?????????\?????\{ff24043d-55f8-5ce9-a20a-8337d9b4b888}\GoogleUpdate.exe" >) -> TROUVÉ
    [RUN][SUSP PATH] HKCU\[...]\Run : AS2014 (C:\ProgramData\37nlpnrX\37nlpnrX.exe [-]) -> TROUVÉ
    [RUN][ZeroAccess] HKUS\S-1-5-21-1990934522-1809484261-1882248070-1000\[...]\Run : Google Update ("C:\Users\nanou\AppData\Local\Google\Desktop\Install\{ff24043d-55f8-5ce9-a20a-8337d9b4b888}\?????????\?????????\?????\{ff24043d-55f8-5ce9-a20a-8337d9b4b888}\GoogleUpdate.exe" >) -> TROUVÉ
    [RUN][SUSP PATH] HKUS\S-1-5-21-1990934522-1809484261-1882248070-1000\[...]\Run : AS2014 (C:\ProgramData\37nlpnrX\37nlpnrX.exe [-]) -> TROUVÉ
    [PROXY IE][PUM] HKCU\[...]\Internet Settings : ProxyServer (hxxp=127.0.0.1:56847 [Country: (Private Address) (XX), City: (Private Address)]) -> TROUVÉ
    [PROXY IE][PUM] HKCU\[...]\Internet Settings : ProxyEnable (1) -> TROUVÉ

    ¤¤¤ Tâches planifiées : 0 ¤¤¤

    ¤¤¤ Entrées Startup : 0 ¤¤¤

    ¤¤¤ Navigateurs web : 0 ¤¤¤

    ¤¤¤ Fichiers / Dossiers particuliers: ¤¤¤
    [ZeroAccess][Repertoire] Install : C:\Users\nanou\AppData\Local\Google\Desktop\Install [-] --> TROUVÉ

    ¤¤¤ Driver : [CHARGE] ¤¤¤
    [Address] SSDT[13] : NtAlertResumeThread @ 0x82E94823 -> HOOKED (Unknown @ 0x8ADDF018)
    [Address] SSDT[14] : NtAlertThread @ 0x82E0D34F -> HOOKED (Unknown @ 0x8A7F3B08)
    [Address] SSDT[18] : NtAllocateVirtualMemory @ 0x82E4969D -> HOOKED (Unknown @ 0x8A9F3D98)
    [Address] SSDT[21] : NtAlpcConnectPort @ 0x82DEB8A7 -> HOOKED (Unknown @ 0x8A1891B8)
    [Address] SSDT[42] : NtAssignProcessToJobObject @ 0x82DBEB32 -> HOOKED (Unknown @ 0x8A5F0110)
    [Address] SSDT[67] : NtCreateMutant @ 0x82E21993 -> HOOKED (Unknown @ 0x8A9EF068)
    [Address] SSDT[77] : NtCreateSymbolicLinkObject @ 0x82DC1349 -> HOOKED (Unknown @ 0x8A50A1F0)
    [Address] SSDT[78] : NtCreateThread @ 0x82E92E40 -> HOOKED (Unknown @ 0x8A50A470)
    [Address] SSDT[116] : NtDebugActiveProcess @ 0x82E65ED4 -> HOOKED (Unknown @ 0x8A5EF110)
    [Address] SSDT[129] : NtDuplicateObject @ 0x82DF9579 -> HOOKED (Unknown @ 0x8A9F2410)
    [Address] SSDT[147] : NtFreeVirtualMemory @ 0x82C85E75 -> HOOKED (Unknown @ 0x8A9F9880)
    [Address] SSDT[156] : NtImpersonateAnonymousToken @ 0x82DBBF3F -> HOOKED (Unknown @ 0x8A5232D0)
    [Address] SSDT[158] : NtImpersonateThread @ 0x82DD1589 -> HOOKED (Unknown @ 0x8A523EC8)
    [Address] SSDT[165] : NtLoadDriver @ 0x82D6CE12 -> HOOKED (Unknown @ 0x8A170008)
    [Address] SSDT[177] : NtMapViewOfSection @ 0x82E11994 -> HOOKED (Unknown @ 0x8A523900)
    [Address] SSDT[184] : NtOpenEvent @ 0x82DFADF7 -> HOOKED (Unknown @ 0x8A5EA110)
    [Address] SSDT[194] : NtOpenProcess @ 0x82E2212F -> HOOKED (Unknown @ 0x8A800DF8)
    [Address] SSDT[195] : NtOpenProcessToken @ 0x82E02A58 -> HOOKED (Unknown @ 0x8A751918)
    [Address] SSDT[197] : NtOpenSection @ 0x82E1278C -> HOOKED (Unknown @ 0x8A52D110)
    [Address] SSDT[201] : NtOpenThread @ 0x82E1D62B -> HOOKED (Unknown @ 0x8A9EE888)
    [Address] SSDT[210] : NtProtectVirtualMemory @ 0x82E1B3E2 -> HOOKED (Unknown @ 0x8A3EC660)
    [Address] SSDT[282] : NtResumeThread @ 0x82E1CC4A -> HOOKED (Unknown @ 0x925820D0)
    [Address] SSDT[289] : NtSetContextThread @ 0x82E942CF -> HOOKED (Unknown @ 0x8A561460)
    [Address] SSDT[305] : NtSetInformationProcess @ 0x82E159E6 -> HOOKED (Unknown @ 0x8A9F4980)
    [Address] SSDT[317] : NtSetSystemInformation @ 0x82DE7F1E -> HOOKED (Unknown @ 0x8A5EC110)
    [Address] SSDT[330] : NtSuspendProcess @ 0x82E9475F -> HOOKED (Unknown @ 0x8A50B110)
    [Address] SSDT[331] : NtSuspendThread @ 0x82D9B945 -> HOOKED (Unknown @ 0x8A3F4D80)
    [Address] SSDT[334] : NtTerminateProcess @ 0x82DF216B -> HOOKED (Unknown @ 0x8A3F2150)
    [Address] SSDT[335] : NtTerminateThread @ 0x82E1D660 -> HOOKED (Unknown @ 0x8A736350)
    [Address] SSDT[348] : NtUnmapViewOfSection @ 0x82E11C57 -> HOOKED (Unknown @ 0x92101038)
    [Address] SSDT[358] : NtWriteVirtualMemory @ 0x82E0EA27 -> HOOKED (Unknown @ 0x8A9F9F60)
    [Address] SSDT[382] : NtCreateThreadEx @ 0x82E1D115 -> HOOKED (Unknown @ 0x8A520110)
    [Address] Shadow SSDT[317] : NtUserAttachThreadInput -> HOOKED (Unknown @ 0x92937950)
    [Address] Shadow SSDT[397] : NtUserGetAsyncKeyState -> HOOKED (Unknown @ 0x929239D0)
    [Address] Shadow SSDT[428] : NtUserGetKeyboardState -> HOOKED (Unknown @ 0x92948910)
    [Address] Shadow SSDT[430] : NtUserGetKeyState -> HOOKED (Unknown @ 0x929F72B8)
    [Address] Shadow SSDT[442] : NtUserGetRawInputData -> HOOKED (Unknown @ 0x92FF1360)
    [Address] Shadow SSDT[479] : NtUserMessageCall -> HOOKED (Unknown @ 0x940821D0)
    [Address] Shadow SSDT[497] : NtUserPostMessage -> HOOKED (Unknown @ 0x879A2648)
    [Address] Shadow SSDT[498] : NtUserPostThreadMessage -> HOOKED (Unknown @ 0x879A2578)
    [Address] Shadow SSDT[573] : NtUserSetWindowsHookEx -> HOOKED (Unknown @ 0x92FC4B08)
    [Address] Shadow SSDT[576] : NtUserSetWinEventHook -> HOOKED (Unknown @ 0x92FE96F8)
    [Address] IRP[IRP_MJ_INTERNAL_DEVICE_CONTROL] : C:\Windows\system32\drivers\iastorv.sys -> HOOKED (C:\Windows\System32\drivers\sfsync03.sys @ 0x8323395C)
    [Inline] EAT @explorer.exe (FwDoNothingOnObject) : FirewallAPI.dll -> HOOKED (Unknown @ 0x36C67D66)
    [Inline] EAT @explorer.exe (FwEnableMemTracing) : FirewallAPI.dll -> HOOKED (Unknown @ 0x36C67D66)
    [Inline] EAT @explorer.exe (FwSetMemLeakPolicy) : FirewallAPI.dll -> HOOKED (Unknown @ 0x36C67D66)
    [Inline] EAT @explorer.exe (FwDoNothingOnObject) : FirewallAPI.dll -> HOOKED (Unknown @ 0x36C67D66)
    [Inline] EAT @explorer.exe (FwEnableMemTracing) : FirewallAPI.dll -> HOOKED (Unknown @ 0x36C67D66)
    [Inline] EAT @explorer.exe (FwSetMemLeakPolicy) : FirewallAPI.dll -> HOOKED (Unknown @ 0x36C67D66)

    ¤¤¤ Ruches Externes: ¤¤¤

    ¤¤¤ Infection : ZeroAccess ¤¤¤

    ¤¤¤ Fichier HOSTS: ¤¤¤
    --> %SystemRoot%\System32\drivers\etc\hosts

    127.0.0.1 localhost
    ::1 localhost

    ¤¤¤ MBR Verif: ¤¤¤

    +++++ PhysicalDrive0: (\\.\PHYSICALDRIVE0 @ IDE) ST9500325AS ATA Device +++++
    --- User ---
    [MBR] ccdf17d7e9e510c30e34c616b246449f
    [BSP] 64e337131f490ad902cc12c1a0c940ba : Toshiba MBR Code
    Partition table:
    0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 2048 | Size: 466095 Mo
    1 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 954564608 | Size: 10841 Mo
    User = LL1 ... OK!
    User = LL2 ... OK!

    Termine : << RKreport[0]_S_12052013_140214.txt >>
    RKreport[1]_S_25052013_103706.txt;RKreport[2]_D_25052013_120941.txt
    0

  5. Vous n’avez pas trouvé la réponse que vous recherchez ?

    Posez votre question
  6. Bridget. Messages postés 3816 Date d'inscription   Statut Contributeur Dernière intervention   404
     
    Cà fait 4 fois le même rapport et ce n'est pas bon.
    On va faire comme ça. Suis mes instructions ci-dessous :

    1) Télécharge Roguekiller ici : https://www.luanagames.com/index.fr.html

    Choisis la version adaptée à ton pc : 32 bits.

    ---> Enregistre Roguekiller directement sur le Bureau et pas ailleurs.
    [NB : Les outils de désinfection doivent obligatoirement être placés sur le bureau]
    Si tu l'as enregistré ailleurs, clique sur l'enregistrement et choisis "COUPER", puis clique sur un endroit vide du bureau et choisis "coller"

    --> Exceptée cette page web, ferme tout.

    2) Pour l'examen :

    - Lance RogueKiller.exe par clic-droit sur l'icône et choisis "Exécuter en tant qu'administrateur"
    - Attends la fin du Prescan ...
    - Une fois le pré scan terminé, clique sur "Scan".
    Durant le scan, l'outil peut s'attarder longuement sur une ligne puis repartir, c'est normal. Ne le relance pas.
    - A la fin du scan, clique sur "Rapport".
    ---> Attention : L'outil va te demander de supprimer ce qui a été trouvé, ne supprime surtout pas. Le contenu doit être vérifié. Ferme le logiciel par le X (et non pas en cliquant sur ok).

    3) Pour le rapport : --> Il se trouve sur le <gras>bureau. </gras>

    Rends-toi sur https://www.cjoint.com/
    Clique sur "Parcourir".
    Indique comme emplacement où se trouve le rapport : bureau.
    Une fois le fichier trouvé, clique sur "Ouvrir"
    Puis clique sur "Créér le lien cjoint".
    Un lien sera créé.
    Copie-le et colle-le dans ta réponse.
    @+
    0
  7. Nanounoumea Messages postés 8 Statut Membre
     
    j'ai envoyer le rapport via "cjoint" dans ma réponse mail. Pour ce qui est des rapports présents sur mon bureau que dois-je en faire? les mettre à la corbeille ou les garder
    Merci encore de l'aide
    0
    1. Bridget. Messages postés 3816 Date d'inscription   Statut Contributeur Dernière intervention   404
       
      Bonjour Nanounouméa,

      Il faut donner le lien du dernier rapport demandé (daté du 5 décembre) ici sur le forum. Merci.
      Rien ne doit être jeté avant la fin de la désinfection. Je te dirai quand.
      Bonne journée. Bridget.
      0
    2. Nanounoumea Messages postés 8 Statut Membre
       
      As tu reçu le lien demandé?
      0
    3. Nanounoumea Messages postés 8 Statut Membre
       
      Pas de réponse donc je pense qu'il n'y a pas de commentaire à faire sur le rapport joint. Merci de me confirmer que tout est en ordre sur mon ordi
      A+
      0

Discussions similaires

Security boot fail lors du démarrage
Steu -
Thiecoss -

5 réponses
SecurityHealth est a désactiver ou pas au démarrage de W10 Pro 64 ?
Walti55 -
Walti55 -

2 réponses
Comment retirer le SECURE BOOT ?
Elparigo60 -
ibounwali -

10 réponses
Security Boot Fail Windows 10 Acer
benjamin5800 -
benjamin5800 -

22 réponses