Log rootkit revealer
Résolu
SchneiderBZH
Messages postés
761
Statut
Membre
-
jlpjlp Messages postés 52399 Statut Contributeur sécurité -
jlpjlp Messages postés 52399 Statut Contributeur sécurité -
Bonjour,
Je ne pense pas être infecté mais si vous pouviez jeter un coup d'œil a mon log rootkit revealer,merc
HKLM\SYSTEM\ControlSet001\Services\kl1\InData 24/03/2008 09:21 8 bytes Data mismatch between Windows API and raw hive data.
HKLM\SYSTEM\ControlSet001\Services\kl1\OutData 24/03/2008 09:21 8 bytes Data mismatch between Windows API and raw hive data.
I:\Documents and Settings\Schneider\Local Settings\Application Data\Microsoft\Messenger\I_will_be_back4you@hotmail.com\SharingMetadata\Working\database_3CE0_840D_E083_CB98\fsr0003B.log 22/03/2008 19:38 128.00 KB Visible in Windows API, but not in MFT or directory index.
I:\Documents and Settings\Schneider\Local Settings\Application Data\Microsoft\Messenger\I_will_be_back4you@hotmail.com\SharingMetadata\Working\database_3CE0_840D_E083_CB98\fsr0003C.log 22/03/2008 20:48 128.00 KB Visible in Windows API, but not in MFT or directory index.
I:\Documents and Settings\Schneider\Local Settings\Application Data\Microsoft\Messenger\I_will_be_back4you@hotmail.com\SharingMetadata\Working\database_3CE0_840D_E083_CB98\fsr0003D.log 24/03/2008 09:22 128.00 KB Hidden from Windows API.
I:\Documents and Settings\Schneider\Local Settings\Application Data\Microsoft\Messenger\I_will_be_back4you@hotmail.com\SharingMetadata\Working\database_3CE0_840D_E083_CB98\fsr0003E.log 24/03/2008 09:25 128.00 KB Hidden from Windows API.
I:\Documents and Settings\Schneider\Local Settings\Application Data\Microsoft\Messenger\I_will_be_back4you@hotmail.com\SharingMetadata\Working\database_3CE0_840D_E083_CB98\fsr0003F.log 24/03/2008 09:27 128.00 KB Hidden from Windows API.
I:\Documents and Settings\Schneider\Local Settings\Application Data\Microsoft\Messenger\I_will_be_back4you@hotmail.com\SharingMetadata\Working\database_3CE0_840D_E083_CB98\fsr00040.log 24/03/2008 09:28 128.00 KB Hidden from Windows API.
I:\Documents and Settings\Schneider\Local Settings\Application Data\Microsoft\Messenger\I_will_be_back4you@hotmail.com\SharingMetadata\Working\database_3CE0_840D_E083_CB98\fsr00041.log 24/03/2008 09:30 128.00 KB Hidden from Windows API.
I:\Documents and Settings\Schneider\Local Settings\Application Data\Microsoft\Messenger\I_will_be_back4you@hotmail.com\SharingMetadata\Working\database_3CE0_840D_E083_CB98\fsr00042.log 24/03/2008 09:32 128.00 KB Hidden from Windows API.
I:\Documents and Settings\Schneider\Local Settings\Application Data\Microsoft\Messenger\I_will_be_back4you@hotmail.com\SharingMetadata\Working\database_3CE0_840D_E083_CB98\fsr00043.log 24/03/2008 09:34 128.00 KB Hidden from Windows API.
I:\Documents and Settings\Schneider\Local Settings\Application Data\Microsoft\Messenger\I_will_be_back4you@hotmail.com\SharingMetadata\Working\database_3CE0_840D_E083_CB98\fsrtmp.log 24/03/2008 09:34 128.00 KB Hidden from Windows API.
I:\Documents and Settings\Schneider\Local Settings\Application Data\Mozilla\Firefox\Profiles\2b0zlbl7.default\Cache\1D45993Bd01 24/03/2008 09:31 50.18 KB Hidden from Windows API.
I:\Documents and Settings\Schneider\Local Settings\Application Data\Mozilla\Firefox\Profiles\2b0zlbl7.default\Cache\246A5F8Ed01 24/03/2008 09:32 17.36 KB Hidden from Windows API.
I:\Documents and Settings\Schneider\Local Settings\Application Data\Mozilla\Firefox\Profiles\2b0zlbl7.default\Cache\26FC82E1d01 24/03/2008 09:29 18.61 KB Hidden from Windows API.
I:\Documents and Settings\Schneider\Local Settings\Application Data\Mozilla\Firefox\Profiles\2b0zlbl7.default\Cache\29D310A4d01 24/03/2008 09:29 21.05 KB Hidden from Windows API.
I:\Documents and Settings\Schneider\Local Settings\Application Data\Mozilla\Firefox\Profiles\2b0zlbl7.default\Cache\36C03406d01 24/03/2008 09:31 27.06 KB Hidden from Windows API.
I:\Documents and Settings\Schneider\Local Settings\Application Data\Mozilla\Firefox\Profiles\2b0zlbl7.default\Cache\3EC9FD3Fd01 24/03/2008 09:31 44.53 KB Hidden from Windows API.
I:\Documents and Settings\Schneider\Local Settings\Application Data\Mozilla\Firefox\Profiles\2b0zlbl7.default\Cache\4AF6EE3Bd01 24/03/2008 09:31 140.16 KB Hidden from Windows API.
I:\Documents and Settings\Schneider\Local Settings\Application Data\Mozilla\Firefox\Profiles\2b0zlbl7.default\Cache\6225D706d01 24/03/2008 09:30 18.29 KB Hidden from Windows API.
I:\Documents and Settings\Schneider\Local Settings\Application Data\Mozilla\Firefox\Profiles\2b0zlbl7.default\Cache\66B6F9D3d01 24/03/2008 09:31 54.39 KB Hidden from Windows API.
I:\Documents and Settings\Schneider\Local Settings\Application Data\Mozilla\Firefox\Profiles\2b0zlbl7.default\Cache\7EDFD79Ad01 24/03/2008 09:29 20.23 KB Hidden from Windows API.
I:\Documents and Settings\Schneider\Local Settings\Application Data\Mozilla\Firefox\Profiles\2b0zlbl7.default\Cache\9FEC5EE3d01 24/03/2008 09:33 146.93 KB Hidden from Windows API.
I:\Documents and Settings\Schneider\Local Settings\Application Data\Mozilla\Firefox\Profiles\2b0zlbl7.default\Cache\AA077FEDd01 24/03/2008 09:29 27.96 KB Hidden from Windows API.
I:\Documents and Settings\Schneider\Local Settings\Application Data\Mozilla\Firefox\Profiles\2b0zlbl7.default\Cache\E0D86ECDd01 24/03/2008 09:31 79.74 KB Hidden from Windows API.
I:\Documents and Settings\Schneider\Local Settings\Application Data\Mozilla\Firefox\Profiles\2b0zlbl7.default\Cache\F6AFADD9d01 24/03/2008 09:29 27.58 KB Hidden from Windows API.
I:\Documents and Settings\Schneider\Local Settings\Temp\MessengerCache\2Y01LeEwDweWgm2F7ZZlfBvS9ukw= 24/03/2008 09:27 13.82 KB Hidden from Windows API.
I:\System Volume Information\_restore{2D443716-D48E-41FD-B904-80C4B48041F7}\RP46\A0011969.RDB 24/03/2008 09:17 1.36 MB Hidden from Windows API.
I:\System Volume Information\_restore{2D443716-D48E-41FD-B904-80C4B48041F7}\RP46\A0011970.old 22/03/2008 22:43 70 bytes Hidden from Windows API.
I:\System Volume Information\_restore{2D443716-D48E-41FD-B904-80C4B48041F7}\RP46\A0011971.RDB 24/03/2008 09:21 1.37 MB Hidden from Windows API.
I:\System Volume Information\_restore{2D443716-D48E-41FD-B904-80C4B48041F7}\RP46\A0011972.RDB 24/03/2008 09:26 1.37 MB Hidden from Windows API.
I:\System Volume Information\_restore{2D443716-D48E-41FD-B904-80C4B48041F7}\RP46\A0011973.RDB 24/03/2008 09:31 1.37 MB Hidden from Windows API.
I:\WINDOWS\assembly\GAC_32\System.EnterpriseServices\2.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.dll 02/03/2008 10:33 252.00 KB Visible in Windows API, but not in MFT or directory index.
I:\WINDOWS\assembly\GAC_32\System.EnterpriseServices\2.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll 02/03/2008 10:33 111.00 KB Visible in Windows API, but not in MFT or directory index.
I:\WINDOWS\assembly\GAC_MSIL\IEExecRemote\2.0.0.0__b03f5f7f11d50a3a\IEExecRemote.dll 02/03/2008 10:33 8.00 KB Visible in Windows API, but not in MFT or directory index.
I:\WINDOWS\SoftwareDistribution\DataStore\Logs\tmp.edb 24/03/2008 09:13 64.00 KB Visible in Windows API, but not in MFT or directory index.
Je ne pense pas être infecté mais si vous pouviez jeter un coup d'œil a mon log rootkit revealer,merc
HKLM\SYSTEM\ControlSet001\Services\kl1\InData 24/03/2008 09:21 8 bytes Data mismatch between Windows API and raw hive data.
HKLM\SYSTEM\ControlSet001\Services\kl1\OutData 24/03/2008 09:21 8 bytes Data mismatch between Windows API and raw hive data.
I:\Documents and Settings\Schneider\Local Settings\Application Data\Microsoft\Messenger\I_will_be_back4you@hotmail.com\SharingMetadata\Working\database_3CE0_840D_E083_CB98\fsr0003B.log 22/03/2008 19:38 128.00 KB Visible in Windows API, but not in MFT or directory index.
I:\Documents and Settings\Schneider\Local Settings\Application Data\Microsoft\Messenger\I_will_be_back4you@hotmail.com\SharingMetadata\Working\database_3CE0_840D_E083_CB98\fsr0003C.log 22/03/2008 20:48 128.00 KB Visible in Windows API, but not in MFT or directory index.
I:\Documents and Settings\Schneider\Local Settings\Application Data\Microsoft\Messenger\I_will_be_back4you@hotmail.com\SharingMetadata\Working\database_3CE0_840D_E083_CB98\fsr0003D.log 24/03/2008 09:22 128.00 KB Hidden from Windows API.
I:\Documents and Settings\Schneider\Local Settings\Application Data\Microsoft\Messenger\I_will_be_back4you@hotmail.com\SharingMetadata\Working\database_3CE0_840D_E083_CB98\fsr0003E.log 24/03/2008 09:25 128.00 KB Hidden from Windows API.
I:\Documents and Settings\Schneider\Local Settings\Application Data\Microsoft\Messenger\I_will_be_back4you@hotmail.com\SharingMetadata\Working\database_3CE0_840D_E083_CB98\fsr0003F.log 24/03/2008 09:27 128.00 KB Hidden from Windows API.
I:\Documents and Settings\Schneider\Local Settings\Application Data\Microsoft\Messenger\I_will_be_back4you@hotmail.com\SharingMetadata\Working\database_3CE0_840D_E083_CB98\fsr00040.log 24/03/2008 09:28 128.00 KB Hidden from Windows API.
I:\Documents and Settings\Schneider\Local Settings\Application Data\Microsoft\Messenger\I_will_be_back4you@hotmail.com\SharingMetadata\Working\database_3CE0_840D_E083_CB98\fsr00041.log 24/03/2008 09:30 128.00 KB Hidden from Windows API.
I:\Documents and Settings\Schneider\Local Settings\Application Data\Microsoft\Messenger\I_will_be_back4you@hotmail.com\SharingMetadata\Working\database_3CE0_840D_E083_CB98\fsr00042.log 24/03/2008 09:32 128.00 KB Hidden from Windows API.
I:\Documents and Settings\Schneider\Local Settings\Application Data\Microsoft\Messenger\I_will_be_back4you@hotmail.com\SharingMetadata\Working\database_3CE0_840D_E083_CB98\fsr00043.log 24/03/2008 09:34 128.00 KB Hidden from Windows API.
I:\Documents and Settings\Schneider\Local Settings\Application Data\Microsoft\Messenger\I_will_be_back4you@hotmail.com\SharingMetadata\Working\database_3CE0_840D_E083_CB98\fsrtmp.log 24/03/2008 09:34 128.00 KB Hidden from Windows API.
I:\Documents and Settings\Schneider\Local Settings\Application Data\Mozilla\Firefox\Profiles\2b0zlbl7.default\Cache\1D45993Bd01 24/03/2008 09:31 50.18 KB Hidden from Windows API.
I:\Documents and Settings\Schneider\Local Settings\Application Data\Mozilla\Firefox\Profiles\2b0zlbl7.default\Cache\246A5F8Ed01 24/03/2008 09:32 17.36 KB Hidden from Windows API.
I:\Documents and Settings\Schneider\Local Settings\Application Data\Mozilla\Firefox\Profiles\2b0zlbl7.default\Cache\26FC82E1d01 24/03/2008 09:29 18.61 KB Hidden from Windows API.
I:\Documents and Settings\Schneider\Local Settings\Application Data\Mozilla\Firefox\Profiles\2b0zlbl7.default\Cache\29D310A4d01 24/03/2008 09:29 21.05 KB Hidden from Windows API.
I:\Documents and Settings\Schneider\Local Settings\Application Data\Mozilla\Firefox\Profiles\2b0zlbl7.default\Cache\36C03406d01 24/03/2008 09:31 27.06 KB Hidden from Windows API.
I:\Documents and Settings\Schneider\Local Settings\Application Data\Mozilla\Firefox\Profiles\2b0zlbl7.default\Cache\3EC9FD3Fd01 24/03/2008 09:31 44.53 KB Hidden from Windows API.
I:\Documents and Settings\Schneider\Local Settings\Application Data\Mozilla\Firefox\Profiles\2b0zlbl7.default\Cache\4AF6EE3Bd01 24/03/2008 09:31 140.16 KB Hidden from Windows API.
I:\Documents and Settings\Schneider\Local Settings\Application Data\Mozilla\Firefox\Profiles\2b0zlbl7.default\Cache\6225D706d01 24/03/2008 09:30 18.29 KB Hidden from Windows API.
I:\Documents and Settings\Schneider\Local Settings\Application Data\Mozilla\Firefox\Profiles\2b0zlbl7.default\Cache\66B6F9D3d01 24/03/2008 09:31 54.39 KB Hidden from Windows API.
I:\Documents and Settings\Schneider\Local Settings\Application Data\Mozilla\Firefox\Profiles\2b0zlbl7.default\Cache\7EDFD79Ad01 24/03/2008 09:29 20.23 KB Hidden from Windows API.
I:\Documents and Settings\Schneider\Local Settings\Application Data\Mozilla\Firefox\Profiles\2b0zlbl7.default\Cache\9FEC5EE3d01 24/03/2008 09:33 146.93 KB Hidden from Windows API.
I:\Documents and Settings\Schneider\Local Settings\Application Data\Mozilla\Firefox\Profiles\2b0zlbl7.default\Cache\AA077FEDd01 24/03/2008 09:29 27.96 KB Hidden from Windows API.
I:\Documents and Settings\Schneider\Local Settings\Application Data\Mozilla\Firefox\Profiles\2b0zlbl7.default\Cache\E0D86ECDd01 24/03/2008 09:31 79.74 KB Hidden from Windows API.
I:\Documents and Settings\Schneider\Local Settings\Application Data\Mozilla\Firefox\Profiles\2b0zlbl7.default\Cache\F6AFADD9d01 24/03/2008 09:29 27.58 KB Hidden from Windows API.
I:\Documents and Settings\Schneider\Local Settings\Temp\MessengerCache\2Y01LeEwDweWgm2F7ZZlfBvS9ukw= 24/03/2008 09:27 13.82 KB Hidden from Windows API.
I:\System Volume Information\_restore{2D443716-D48E-41FD-B904-80C4B48041F7}\RP46\A0011969.RDB 24/03/2008 09:17 1.36 MB Hidden from Windows API.
I:\System Volume Information\_restore{2D443716-D48E-41FD-B904-80C4B48041F7}\RP46\A0011970.old 22/03/2008 22:43 70 bytes Hidden from Windows API.
I:\System Volume Information\_restore{2D443716-D48E-41FD-B904-80C4B48041F7}\RP46\A0011971.RDB 24/03/2008 09:21 1.37 MB Hidden from Windows API.
I:\System Volume Information\_restore{2D443716-D48E-41FD-B904-80C4B48041F7}\RP46\A0011972.RDB 24/03/2008 09:26 1.37 MB Hidden from Windows API.
I:\System Volume Information\_restore{2D443716-D48E-41FD-B904-80C4B48041F7}\RP46\A0011973.RDB 24/03/2008 09:31 1.37 MB Hidden from Windows API.
I:\WINDOWS\assembly\GAC_32\System.EnterpriseServices\2.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.dll 02/03/2008 10:33 252.00 KB Visible in Windows API, but not in MFT or directory index.
I:\WINDOWS\assembly\GAC_32\System.EnterpriseServices\2.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll 02/03/2008 10:33 111.00 KB Visible in Windows API, but not in MFT or directory index.
I:\WINDOWS\assembly\GAC_MSIL\IEExecRemote\2.0.0.0__b03f5f7f11d50a3a\IEExecRemote.dll 02/03/2008 10:33 8.00 KB Visible in Windows API, but not in MFT or directory index.
I:\WINDOWS\SoftwareDistribution\DataStore\Logs\tmp.edb 24/03/2008 09:13 64.00 KB Visible in Windows API, but not in MFT or directory index.
Configuration: Windows XP SP2 Firefox 2.0.0.12
3 réponses
-
slt,
pour les rootlit navilog est plus clair!
Fais un clic droit sur ce lien : (IL-MAFIOSO)
http://perso.orange.fr/il.mafioso/Navifix/Navilog1.exe
Enregistrer la cible (du lien) sous... et enregistre-le sur ton bureau.
Ensuite double clique sur navilog1.exe pour lancer l'installation.
Une fois l'installation terminée, le fix s'exécutera automatiquement.
(Si ce n'est pas le cas, double-clique sur le raccourci Navilog1 présent sur le bureau).
Laisse-toi guider. Au menu principal, choisis 1 et valides.
(ne fais pas le choix 2,3 ou 4 sans notre avis/accord)
Patiente jusqu'au message :
*** Analyse Termine le ..... ***
Appuie sur une touche comme demandé, le blocnote va s'ouvrir.
Copie-colle l'intégralité dans une réponse. Referme le blocnote.
Le rapport est en outre sauvegardé à la racine du disque (fixnavi.txt)-
merci pour ta réponse!
voici le log navilog1
Search Navipromo version 3.5.1 commencé le 24/03/2008 à 10:06:57,46
!!! Attention,ce rapport peut indiquer des fichiers/programmes légitimes!!!
!!! Postez ce rapport sur le forum pour le faire analyser !!!
!!! Ne lancez pas la partie désinfection sans l'avis d'un spécialiste !!!
Outil exécuté depuis I:\Program Files\navilog1
Session actuelle : "Schneider"
Mise à jour le 23.03.2008 à 22h00 par IL-MAFIOSO
Microsoft Windows XP [version 5.1.2600]
Internet Explorer : 7.0.5730.13
Système de fichiers : NTFS
Executé en mode normal
*** Recherche Programmes installés ***
*** Recherche dossiers dans I:\WINDOWS ***
*** Recherche dossiers dans I:\Program Files ***
*** Recherche dossiers dans I:\DOCUME~1\ALLUSE~1\APPLIC~1 ***
*** Recherche dossiers dans "I:\Documents and Settings\Schneider\applic~1" ***
*** Recherche dossiers dans "I:\Documents and Settings\Schneider\locals~1\applic~1" ***
*** Recherche dossiers dans "I:\Documents and Settings\Schneider\menudm~1\progra~1" ***
*** Recherche dossiers dans I:\DOCUME~1\ALLUSE~1\MENUDM~1\PROGRA~1 ***
*** Recherche avec Catchme-rootkit/stealth malware detector par gmer ***
pour + d'infos : http://www.gmer.net
Aucun Fichier trouvé
*** Recherche avec GenericNaviSearch ***
!!! Tous ces résultats peuvent révéler des fichiers légitimes !!!
!!! A vérifier impérativement avant toute suppression manuelle !!!
* Recherche dans I:\WINDOWS\system32 *
* Recherche dans "I:\Documents and Settings\Schneider\locals~1\applic~1" *
*** Recherche fichiers ***
*** Recherche clés spécifiques dans le Registre ***
*** Module de Recherche complémentaire ***
(Recherche fichiers spécifiques)
1)Recherche nouveaux fichiers Instant Access :
2)Recherche Heuristique :
* Dans I:\WINDOWS\system32 :
* Dans "I:\Documents and Settings\Schneider\locals~1\applic~1" :
3)Recherche Certificats :
Certificat Egroup absent !
Certificat Electronic-Group absent !
Certificat OOO-Favorit absent !
Certificat Sunny-Day-Design-Ltd absent !
4)Recherche fichiers connus :
*** Analyse terminée le 24/03/2008 à 10:08:49,26 ***
-
-
NON AUCUN ROOTKIT!
bonne continuation
sinon pour voir les infections tu peux faire:
bitdefender en ligne :
http://www.bitdefender.fr/scan_fr/scan8/ie.html
Panda en ligne :
http://pandasoftware.fr
Kaspersky en ligne
https://www.kaspersky.fr/?domain=webscanner.kaspersky.fr
secuser en ligne :
http://www.secuser.com/outils/antivirus.htm
scan en ligne firefox
https://www.trendmicro.com/fr_fr/business.html -
