Infection ? rapport roguekiller

Fermé
cesar30 - 18 avril 2014 à 13:44
 bendrop - 18 avril 2014 à 14:54
bonjour mon pc est tres lent au demarrage , voicin un rapport rogue killer qui suit ... merci pour votre aide a comprendre ce rapport pour savoir si probleme il y a ........RogueKiller V8.8.15 [Mar 27 2014] par Adlice Software
mail : http://www.adlice.com/contact/
Remontees : http://forum.adlice.com
Site Web : http://www.surlatoile.org/RogueKiller/
Blog : http://www.adlice.com

Systeme d'exploitation : Windows XP (5.1.2600 Service Pack 3) 32 bits version
Demarrage : Mode normal
Utilisateur : nicolas [Droits d'admin]
Mode : Recherche -- Date : 04/18/2014 13:42:05
| ARK || FAK || MBR |

¤¤¤ Processus malicieux : 1 ¤¤¤
[SUSP PATH] vntldr.exe -- C:\Documents and Settings\nicolas\Local Settings\Application Data\VNT\vntldr.exe [7] -> TUÉ [TermProc]

¤¤¤ Entrees de registre : 2 ¤¤¤
[HJ DESK][PUM] HKCU\[...]\ClassicStartMenu : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> TROUVÉ
[HJ DESK][PUM] HKCU\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> TROUVÉ

¤¤¤ Tâches planifiées : 0 ¤¤¤

¤¤¤ Entrées Startup : 0 ¤¤¤

¤¤¤ Navigateurs web : 0 ¤¤¤

¤¤¤ Addons navigateur : 0 ¤¤¤

¤¤¤ Fichiers / Dossiers particuliers: ¤¤¤

¤¤¤ Driver : [CHARGE] ¤¤¤
[Address] SSDT[25] : NtClose @ 0x8056F8D7 -> HOOKED (Unknown @ 0xF7B53974)
[Address] SSDT[41] : NtCreateKey @ 0x80578AB4 -> HOOKED (Unknown @ 0xF7B5392E)
[Address] SSDT[50] : NtCreateSection @ 0x8056DB66 -> HOOKED (Unknown @ 0xF7B5397E)
[Address] SSDT[53] : NtCreateThread @ 0x80584D39 -> HOOKED (Unknown @ 0xF7B53924)
[Address] SSDT[63] : NtDeleteKey @ 0x8059A5C9 -> HOOKED (Unknown @ 0xF7B53933)
[Address] SSDT[65] : NtDeleteValueKey @ 0x805991E8 -> HOOKED (Unknown @ 0xF7B5393D)
[Address] SSDT[68] : NtDuplicateObject @ 0x8057F18D -> HOOKED (Unknown @ 0xF7B5396F)
[Address] SSDT[98] : NtLoadKey @ 0x805B8287 -> HOOKED (Unknown @ 0xF7B53942)
[Address] SSDT[122] : NtOpenProcess @ 0x8057F93A -> HOOKED (Unknown @ 0xF7B53910)
[Address] SSDT[128] : NtOpenThread @ 0x80596743 -> HOOKED (Unknown @ 0xF7B53915)
[Address] SSDT[177] : NtQueryValueKey @ 0x80572F19 -> HOOKED (Unknown @ 0xF7B53997)
[Address] SSDT[193] : NtReplaceKey @ 0x806571A8 -> HOOKED (Unknown @ 0xF7B5394C)
[Address] SSDT[200] : NtRequestWaitReplyPort @ 0x8057D13B -> HOOKED (Unknown @ 0xF7B53988)
[Address] SSDT[204] : NtRestoreKey @ 0x80656D3D -> HOOKED (Unknown @ 0xF7B53947)
[Address] SSDT[213] : NtSetContextThread @ 0x80635EFB -> HOOKED (Unknown @ 0xF7B53983)
[Address] SSDT[237] : NtSetSecurityObject @ 0x805E8694 -> HOOKED (Unknown @ 0xF7B5398D)
[Address] SSDT[247] : NtSetValueKey @ 0x80580088 -> HOOKED (Unknown @ 0xF7B53938)
[Address] SSDT[255] : NtSystemDebugControl @ 0x80651A75 -> HOOKED (Unknown @ 0xF7B53992)
[Address] SSDT[257] : NtTerminateProcess @ 0x8058E8B1 -> HOOKED (Unknown @ 0xF7B5391F)
[Address] Shadow SSDT[549] : NtUserSetWindowsHookEx -> HOOKED (Unknown @ 0xF7B539A6)
[Address] Shadow SSDT[552] : NtUserSetWinEventHook -> HOOKED (Unknown @ 0xF7B539AB)

¤¤¤ Ruches Externes: ¤¤¤

¤¤¤ Infection : ¤¤¤

¤¤¤ Fichier HOSTS: ¤¤¤
--> %SystemRoot%\System32\drivers\etc\hosts


127.0.0.1 localhost


¤¤¤ MBR Verif: ¤¤¤

+++++ PhysicalDrive0: (\\.\PHYSICALDRIVE0 @ IDE) WDC WD1600BEVT-22ZCT0 +++++
--- User ---
[MBR] 7cb3943294ecd87e39cd94dc8f24b530
[BSP] 0639599f9f10526a8845373803eb7b9b : Acer MBR Code
Partition table:
0 - [XXXXXX] COMPAQ (0x12) [VISIBLE] Offset (sectors): 63 | Size: 4996 MB
1 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 10233405 | Size: 147628 MB
User = LL1 ... OK!
User = LL2 ... OK!

Termine : << RKreport[0]_S_04182014_134205.txt >>

1 réponse

Salut,

Effectivement tu as une infection avec la toolbar ask.
va ici pour éradiquer définitivement ce virus:
http://www.sosvirus.net/vntldr-exe-variant-win32-bundled-toolbar-ask-t36176.html

Cdlt.
0