rootkit recalcitrant (resolu merci falkra)

[narca]

re

 

 

voici ce que j'obtiens avec rootrepeal

 

pour l'onglet drivers

 

ROOTREPEAL © AD, 2007-2009

==================================================

Scan Start Time: 2009/10/14 17:33

Program Version: Version 1.3.5.0

Windows Version: Windows XP SP3

==================================================

 

Drivers

-------------------

Name: ACPI.sys

Image Path: ACPI.sys

Address: 0xF84E6000 Size: 188672 File Visible: - Signed: -

Status: -

 

Name: ACPI_HAL

Image Path: \Driver\ACPI_HAL

Address: 0x804D7000 Size: 2191104 File Visible: - Signed: -

Status: -

 

Name: afd.sys

Image Path: C:\WINDOWS\System32\drivers\afd.sys

Address: 0xF61D5000 Size: 138496 File Visible: - Signed: -

Status: -

 

Name: amdk7.sys

Image Path: C:\WINDOWS\system32\DRIVERS\amdk7.sys

Address: 0xF7AB4000 Size: 41856 File Visible: - Signed: -

Status: -

 

Name: atapi.sys

Image Path: atapi.sys

Address: 0xF849E000 Size: 96512 File Visible: - Signed: -

Status: -

 

Name: ATMFD.DLL

Image Path: C:\WINDOWS\System32\ATMFD.DLL

Address: 0xBFFA0000 Size: 286720 File Visible: - Signed: -

Status: -

 

Name: audstub.sys

Image Path: C:\WINDOWS\system32\DRIVERS\audstub.sys

Address: 0xF8B20000 Size: 3072 File Visible: - Signed: -

Status: -

 

Name: bdfm.sys

Image Path: C:\WINDOWS\system32\drivers\bdfm.sys

Address: 0xB8D02000 Size: 145664 File Visible: - Signed: -

Status: -

 

Name: bdfndisf.sys

Image Path: C:\WINDOWS\system32\DRIVERS\bdfndisf.sys

Address: 0xF7582000 Size: 104192 File Visible: - Signed: -

Status: -

 

Name: bdfsfltr.sys

Image Path: bdfsfltr.sys

Address: 0xF8427000 Size: 279040 File Visible: - Signed: -

Status: -

 

Name: bdftdif.sys

Image Path: C:\Program Files\Fichiers communs\BitDefender\BitDefender Firewall\bdftdif.sys

Address: 0xF621F000 Size: 111872 File Visible: - Signed: -

Status: -

 

Name: BDHV.SYS

Image Path: C:\WINDOWS\system32\drivers\BDHV.SYS

Address: 0xB8CE9000 Size: 102400 File Visible: - Signed: -

Status: -

 

Name: bdselfpr.sys

Image Path: C:\Program Files\BitDefender\BitDefender 2010\bdselfpr.sys

Address: 0xB8F93000 Size: 8832 File Visible: - Signed: -

Status: -

 

Name: bdvedisk.sys

Image Path: C:\Program Files\BitDefender\BitDefender 2010\bdvedisk.sys

Address: 0xB9675000 Size: 76032 File Visible: - Signed: -

Status: -

 

Name: Beep.SYS

Image Path: C:\WINDOWS\System32\Drivers\Beep.SYS

Address: 0xF8A66000 Size: 4224 File Visible: - Signed: -

Status: -

 

Name: BOOTVID.dll

Image Path: C:\WINDOWS\system32\BOOTVID.dll

Address: 0xF8946000 Size: 12288 File Visible: - Signed: -

Status: -

 

Name: Cdfs.SYS

Image Path: C:\WINDOWS\System32\Drivers\Cdfs.SYS

Address: 0xF8786000 Size: 63744 File Visible: - Signed: -

Status: -

 

Name: cdrom.sys

Image Path: C:\WINDOWS\system32\DRIVERS\cdrom.sys

Address: 0xF85D6000 Size: 62976 File Visible: - Signed: -

Status: -

 

Name: CLASSPNP.SYS

Image Path: C:\WINDOWS\system32\DRIVERS\CLASSPNP.SYS

Address: 0xF8576000 Size: 53248 File Visible: - Signed: -

Status: -

 

Name: disk.sys

Image Path: disk.sys

Address: 0xF8566000 Size: 36352 File Visible: - Signed: -

Status: -

 

Name: drmk.sys

Image Path: C:\WINDOWS\system32\drivers\drmk.sys

Address: 0xF8686000 Size: 61440 File Visible: - Signed: -

Status: -

 

Name: dump_atapi.sys

Image Path: C:\WINDOWS\System32\Drivers\dump_atapi.sys

Address: 0xF6070000 Size: 98304 File Visible: No Signed: -

Status: -

 

Name: dump_WMILIB.SYS

Image Path: C:\WINDOWS\System32\Drivers\dump_WMILIB.SYS

Address: 0xF8A8A000 Size: 8192 File Visible: No Signed: -

Status: -

 

Name: Dxapi.sys

Image Path: C:\WINDOWS\System32\drivers\Dxapi.sys

Address: 0xF61A9000 Size: 12288 File Visible: - Signed: -

Status: -

 

Name: dxg.sys

Image Path: C:\WINDOWS\System32\drivers\dxg.sys

Address: 0xBF000000 Size: 73728 File Visible: - Signed: -

Status: -

 

Name: dxgthk.sys

Image Path: C:\WINDOWS\System32\drivers\dxgthk.sys

Address: 0xF8B04000 Size: 4096 File Visible: - Signed: -

Status: -

 

Name: EIO.sys

Image Path: C:\WINDOWS\system32\drivers\EIO.sys

Address: 0xF8A3C000 Size: 7648 File Visible: - Signed: -

Status: -

 

Name: Fastfat.SYS

Image Path: C:\WINDOWS\System32\Drivers\Fastfat.SYS

Address: 0xB8DC6000 Size: 143744 File Visible: - Signed: -

Status: -

 

Name: fdc.sys

Image Path: C:\WINDOWS\system32\DRIVERS\fdc.sys

Address: 0xF889E000 Size: 27392 File Visible: - Signed: -

Status: -

 

Name: Fips.SYS

Image Path: C:\WINDOWS\System32\Drivers\Fips.SYS

Address: 0xF86D6000 Size: 44672 File Visible: - Signed: -

Status: -

 

Name: flpydisk.sys

Image Path: C:\WINDOWS\system32\DRIVERS\flpydisk.sys

Address: 0xF88DE000 Size: 20480 File Visible: - Signed: -

Status: -

 

Name: fltmgr.sys

Image Path: fltmgr.sys

Address: 0xF847E000 Size: 129792 File Visible: - Signed: -

Status: -

 

Name: Fs_Rec.SYS

Image Path: C:\WINDOWS\System32\Drivers\Fs_Rec.SYS

Address: 0xF8A64000 Size: 7936 File Visible: - Signed: -

Status: -

 

Name: ftdisk.sys

Image Path: ftdisk.sys

Address: 0xF84B6000 Size: 126080 File Visible: - Signed: -

Status: -

 

Name: GearAspiWDM.SYS

Image Path: C:\WINDOWS\System32\Drivers\GearAspiWDM.SYS

Address: 0xF8896000 Size: 28672 File Visible: - Signed: -

Status: -

 

Name: hal.dll

Image Path: C:\WINDOWS\system32\hal.dll

Address: 0x806EE000 Size: 131840 File Visible: - Signed: -

Status: -

 

Name: HPZid412.sys

Image Path: C:\WINDOWS\system32\DRIVERS\HPZid412.sys

Address: 0xB9073000 Size: 50848 File Visible: - Signed: -

Status: -

 

Name: HPZipr12.sys

Image Path: C:\WINDOWS\system32\DRIVERS\HPZipr12.sys

Address: 0xB8D62000 Size: 16224 File Visible: - Signed: -

Status: -

 

Name: HPZius12.sys

Image Path: C:\WINDOWS\system32\DRIVERS\HPZius12.sys

Address: 0xF8806000 Size: 21472 File Visible: - Signed: -

Status: -

 

Name: HTTP.sys

Image Path: C:\WINDOWS\System32\Drivers\HTTP.sys

Address: 0xB8F2A000 Size: 264832 File Visible: - Signed: -

Status: -

 

Name: i8042prt.sys

Image Path: C:\WINDOWS\system32\DRIVERS\i8042prt.sys

Address: 0xF85F6000 Size: 54144 File Visible: - Signed: -

Status: -

 

Name: imapi.sys

Image Path: C:\WINDOWS\system32\DRIVERS\imapi.sys

Address: 0xF85C6000 Size: 42112 File Visible: - Signed: -

Status: -

 

Name: ioperm.sys

Image Path: C:\cygwin\bin\ioperm.sys

Address: 0xB9984000 Size: 16384 File Visible: - Signed: -

Status: -

 

Name: ipnat.sys

Image Path: C:\WINDOWS\system32\DRIVERS\ipnat.sys

Address: 0xF60B0000 Size: 152832 File Visible: - Signed: -

Status: -

 

Name: ipsec.sys

Image Path: C:\WINDOWS\system32\DRIVERS\ipsec.sys

Address: 0xF6294000 Size: 75264 File Visible: - Signed: -

Status: -

 

Name: isapnp.sys

Image Path: isapnp.sys

Address: 0xF8536000 Size: 37632 File Visible: - Signed: -

Status: -

 

Name: ISODrive.sys

Image Path: C:\Program Files\UltraISO\drivers\ISODrive.sys

Address: 0xF60D6000 Size: 81920 File Visible: - Signed: -

Status: -

 

Name: kbdclass.sys

Image Path: C:\WINDOWS\system32\DRIVERS\kbdclass.sys

Address: 0xF88AE000 Size: 25216 File Visible: - Signed: -

Status: -

 

Name: KDCOM.DLL

Image Path: C:\WINDOWS\system32\KDCOM.DLL

Address: 0xF8A36000 Size: 8192 File Visible: - Signed: -

Status: -

 

Name: kmixer.sys

Image Path: C:\WINDOWS\system32\drivers\kmixer.sys

Address: 0xB8BF6000 Size: 172416 File Visible: - Signed: -

Status: -

 

Name: ks.sys

Image Path: C:\WINDOWS\system32\DRIVERS\ks.sys

Address: 0xF7A01000 Size: 143360 File Visible: - Signed: -

Status: -

 

Name: KSecDD.sys

Image Path: KSecDD.sys

Address: 0xF83FA000 Size: 92928 File Visible: - Signed: -

Status: -

 

Name: mnmdd.SYS

Image Path: C:\WINDOWS\System32\Drivers\mnmdd.SYS

Address: 0xF8A68000 Size: 4224 File Visible: - Signed: -

Status: -

 

Name: mouclass.sys

Image Path: C:\WINDOWS\system32\DRIVERS\mouclass.sys

Address: 0xF88A6000 Size: 23680 File Visible: - Signed: -

Status: -

 

Name: MountMgr.sys

Image Path: MountMgr.sys

Address: 0xF8546000 Size: 42368 File Visible: - Signed: -

Status: -

 

Name: mrxdav.sys

Image Path: C:\WINDOWS\system32\DRIVERS\mrxdav.sys

Address: 0xB96B0000 Size: 180608 File Visible: - Signed: -

Status: -

 

Name: mrxsmb.sys

Image Path: C:\WINDOWS\system32\DRIVERS\mrxsmb.sys

Address: 0xF60EA000 Size: 455296 File Visible: - Signed: -

Status: -

 

Name: Msfs.SYS

Image Path: C:\WINDOWS\System32\Drivers\Msfs.SYS

Address: 0xF88F6000 Size: 19072 File Visible: - Signed: -

Status: -

 

Name: msgpc.sys

Image Path: C:\WINDOWS\system32\DRIVERS\msgpc.sys

Address: 0xF8636000 Size: 35072 File Visible: - Signed: -

Status: -

 

Name: mssmbios.sys

Image Path: C:\WINDOWS\system32\DRIVERS\mssmbios.sys

Address: 0xF82A1000 Size: 15488 File Visible: - Signed: -

Status: -

 

Name: Mup.sys

Image Path: Mup.sys

Address: 0xF8326000 Size: 105344 File Visible: - Signed: -

Status: -

 

Name: NDIS.sys

Image Path: NDIS.sys

Address: 0xF8340000 Size: 182656 File Visible: - Signed: -

Status: -

 

Name: ndistapi.sys

Image Path: C:\WINDOWS\system32\DRIVERS\ndistapi.sys

Address: 0xF82B1000 Size: 10112 File Visible: - Signed: -

Status: -

 

Name: ndisuio.sys

Image Path: C:\WINDOWS\system32\DRIVERS\ndisuio.sys

Address: 0xBA5C8000 Size: 14592 File Visible: - Signed: -

Status: -

 

Name: ndiswan.sys

Image Path: C:\WINDOWS\system32\DRIVERS\ndiswan.sys

Address: 0xF75AD000 Size: 91520 File Visible: - Signed: -

Status: -

 

Name: NDProxy.SYS

Image Path: C:\WINDOWS\System32\Drivers\NDProxy.SYS

Address: 0xF8666000 Size: 40576 File Visible: - Signed: -

Status: -

 

Name: netbios.sys

Image Path: C:\WINDOWS\system32\DRIVERS\netbios.sys

Address: 0xF86B6000 Size: 34688 File Visible: - Signed: -

Status: -

 

Name: netbt.sys

Image Path: C:\WINDOWS\system32\DRIVERS\netbt.sys

Address: 0xF61F7000 Size: 162816 File Visible: - Signed: -

Status: -

 

Name: Npfs.SYS

Image Path: C:\WINDOWS\System32\Drivers\Npfs.SYS

Address: 0xF88FE000 Size: 30848 File Visible: - Signed: -

Status: -

 

Name: Ntfs.sys

Image Path: Ntfs.sys

Address: 0xF836D000 Size: 574976 File Visible: - Signed: -

Status: -

 

Name: ntoskrnl.exe

Image Path: C:\WINDOWS\system32\ntoskrnl.exe

Address: 0x804D7000 Size: 2191104 File Visible: - Signed: -

Status: -

 

Name: Null.SYS

Image Path: C:\WINDOWS\System32\Drivers\Null.SYS

Address: 0xF8BC7000 Size: 2944 File Visible: - Signed: -

Status: -

 

Name: nv4_disp.dll

Image Path: C:\WINDOWS\System32\nv4_disp.dll

Address: 0xBF012000 Size: 4530176 File Visible: - Signed: -

Status: -

 

Name: nv4_mini.sys

Image Path: C:\WINDOWS\system32\DRIVERS\nv4_mini.sys

Address: 0xF75FD000 Size: 3994624 File Visible: - Signed: -

Status: -

 

Name: nv_agp.sys

Image Path: nv_agp.sys

Address: 0xF87C6000 Size: 18688 File Visible: - Signed: -

Status: -

 

Name: nvapu.sys

Image Path: C:\WINDOWS\system32\drivers\nvapu.sys

Address: 0xF74D7000 Size: 311936 File Visible: - Signed: -

Status: -

 

Name: nvarm.sys

Image Path: C:\WINDOWS\system32\drivers\nvarm.sys

Address: 0xF73EF000 Size: 69632 File Visible: - Signed: -

Status: -

 

Name: nvax.sys

Image Path: C:\WINDOWS\system32\drivers\nvax.sys

Address: 0xF7AA4000 Size: 38784 File Visible: - Signed: -

Status: -

 

Name: NVENET.sys

Image Path: C:\WINDOWS\system32\DRIVERS\NVENET.sys

Address: 0xF7A24000 Size: 80896 File Visible: - Signed: -

Status: -

 

Name: nvmcp.sys

Image Path: C:\WINDOWS\system32\drivers\nvmcp.sys

Address: 0xF7400000 Size: 733184 File Visible: - Signed: -

Status: -

 

Name: parport.sys

Image Path: C:\WINDOWS\system32\DRIVERS\parport.sys

Address: 0xF75C4000 Size: 80384 File Visible: - Signed: -

Status: -

 

Name: PartMgr.sys

Image Path: PartMgr.sys

Address: 0xF87BE000 Size: 19712 File Visible: - Signed: -

Status: -

 

Name: ParVdm.SYS

Image Path: C:\WINDOWS\System32\Drivers\ParVdm.SYS

Address: 0xF8A3A000 Size: 6912 File Visible: - Signed: -

Status: -

 

Name: pci.sys

Image Path: pci.sys

Address: 0xF84D5000 Size: 68608 File Visible: - Signed: -

Status: -

 

Name: pciide.sys

Image Path: pciide.sys

Address: 0xF8AFE000 Size: 3328 File Visible: - Signed: -

Status: -

 

Name: PCIIDEX.SYS

Image Path: C:\WINDOWS\system32\DRIVERS\PCIIDEX.SYS

Address: 0xF87B6000 Size: 28672 File Visible: - Signed: -

Status: -

 

Name: PnpManager

Image Path: \Driver\PnpManager

Address: 0x804D7000 Size: 2191104 File Visible: - Signed: -

Status: -

 

Name: portcls.sys

Image Path: C:\WINDOWS\system32\drivers\portcls.sys

Address: 0xF74B3000 Size: 147456 File Visible: - Signed: -

Status: -

 

Name: psched.sys

Image Path: C:\WINDOWS\system32\DRIVERS\psched.sys

Address: 0xF759C000 Size: 69120 File Visible: - Signed: -

Status: -

 

Name: ptilink.sys

Image Path: C:\WINDOWS\system32\DRIVERS\ptilink.sys

Address: 0xF88BE000 Size: 17792 File Visible: - Signed: -

Status: -

 

Name: PxHelp20.sys

Image Path: PxHelp20.sys

Address: 0xF8586000 Size: 35712 File Visible: - Signed: -

Status: -

 

Name: rasacd.sys

Image Path: C:\WINDOWS\system32\DRIVERS\rasacd.sys

Address: 0xF7A60000 Size: 8832 File Visible: - Signed: -

Status: -

 

Name: rasl2tp.sys

Image Path: C:\WINDOWS\system32\DRIVERS\rasl2tp.sys

Address: 0xF8606000 Size: 51328 File Visible: - Signed: -

Status: -

 

Name: raspppoe.sys

Image Path: C:\WINDOWS\system32\DRIVERS\raspppoe.sys

Address: 0xF8616000 Size: 41472 File Visible: - Signed: -

Status: -

 

Name: raspptp.sys

Image Path: C:\WINDOWS\system32\DRIVERS\raspptp.sys

Address: 0xF8626000 Size: 48384 File Visible: - Signed: -

Status: -

 

Name: raspti.sys

Image Path: C:\WINDOWS\system32\DRIVERS\raspti.sys

Address: 0xF88C6000 Size: 16512 File Visible: - Signed: -

Status: -

 

Name: RAW

Image Path: \FileSystem\RAW

Address: 0x804D7000 Size: 2191104 File Visible: - Signed: -

Status: -

 

Name: rdbss.sys

Image Path: C:\WINDOWS\system32\DRIVERS\rdbss.sys

Address: 0xF615A000 Size: 175744 File Visible: - Signed: -

Status: -

 

Name: RDPCDD.sys

Image Path: C:\WINDOWS\System32\DRIVERS\RDPCDD.sys

Address: 0xF8A6A000 Size: 4224 File Visible: - Signed: -

Status: -

 

Name: redbook.sys

Image Path: C:\WINDOWS\system32\DRIVERS\redbook.sys

Address: 0xF85E6000 Size: 58752 File Visible: - Signed: -

Status: -

 

Name: rootrepeal.sys

Image Path: C:\WINDOWS\system32\drivers\rootrepeal.sys

Address: 0xB936B000 Size: 49152 File Visible: No Signed: -

Status: -

 

Name: rspndr.sys

Image Path: C:\WINDOWS\system32\DRIVERS\rspndr.sys

Address: 0xBA518000 Size: 62336 File Visible: - Signed: -

Status: -

 

Name: serenum.sys

Image Path: C:\WINDOWS\system32\DRIVERS\serenum.sys

Address: 0xF82B5000 Size: 15744 File Visible: - Signed: -

Status: -

 

Name: serial.sys

Image Path: C:\WINDOWS\system32\DRIVERS\serial.sys

Address: 0xF75D8000 Size: 66048 File Visible: - Signed: -

Status: -

 

Name: sr.sys

Image Path: sr.sys

Address: 0xF846C000 Size: 73600 File Visible: - Signed: -

Status: -

 

Name: srv.sys

Image Path: C:\WINDOWS\system32\DRIVERS\srv.sys

Address: 0xB955B000 Size: 333952 File Visible: - Signed: -

Status: -

 

Name: swenum.sys

Image Path: C:\WINDOWS\system32\DRIVERS\swenum.sys

Address: 0xF8A60000 Size: 4352 File Visible: - Signed: -

Status: -

 

Name: symlcbrd.sys

Image Path: C:\WINDOWS\system32\drivers\symlcbrd.sys

Address: 0xF886E000 Size: 24576 File Visible: - Signed: -

Status: -

 

Name: SymSnap.sys

Image Path: SymSnap.sys

Address: 0xF8411000 Size: 87136 File Visible: - Signed: -

Status: -

 

Name: sysaudio.sys

Image Path: C:\WINDOWS\system32\drivers\sysaudio.sys

Address: 0xB9AC0000 Size: 60800 File Visible: - Signed: -

Status: -

 

Name: tcpip.sys

Image Path: C:\WINDOWS\system32\DRIVERS\tcpip.sys

Address: 0xF623B000 Size: 361600 File Visible: - Signed: -

Status: -

 

Name: TDI.SYS

Image Path: C:\WINDOWS\system32\DRIVERS\TDI.SYS

Address: 0xF88B6000 Size: 20480 File Visible: - Signed: -

Status: -

 

Name: termdd.sys

Image Path: C:\WINDOWS\system32\DRIVERS\termdd.sys

Address: 0xF8656000 Size: 40704 File Visible: - Signed: -

Status: -

 

Name: update.sys

Image Path: C:\WINDOWS\system32\DRIVERS\update.sys

Address: 0xF7524000 Size: 384768 File Visible: - Signed: -

Status: -

 

Name: usbccgp.sys

Image Path: C:\WINDOWS\system32\DRIVERS\usbccgp.sys

Address: 0xF888E000 Size: 32128 File Visible: - Signed: -

Status: -

 

Name: USBD.SYS

Image Path: C:\WINDOWS\system32\DRIVERS\USBD.SYS

Address: 0xF8A62000 Size: 8192 File Visible: - Signed: -

Status: -

 

Name: usbehci.sys

Image Path: C:\WINDOWS\system32\DRIVERS\usbehci.sys

Address: 0xF8886000 Size: 30208 File Visible: - Signed: -

Status: -

 

Name: usbhub.sys

Image Path: C:\WINDOWS\system32\DRIVERS\usbhub.sys

Address: 0xF8676000 Size: 59520 File Visible: - Signed: -

Status: -

 

Name: usbohci.sys

Image Path: C:\WINDOWS\system32\DRIVERS\usbohci.sys

Address: 0xF887E000 Size: 17152 File Visible: - Signed: -

Status: -

 

Name: USBPORT.SYS

Image Path: C:\WINDOWS\system32\DRIVERS\USBPORT.SYS

Address: 0xF7A38000 Size: 147456 File Visible: - Signed: -

Status: -

 

Name: usbprint.sys

Image Path: C:\WINDOWS\system32\DRIVERS\usbprint.sys

Address: 0xF893E000 Size: 25856 File Visible: - Signed: -

Status: -

 

Name: usbscan.sys

Image Path: C:\WINDOWS\system32\DRIVERS\usbscan.sys

Address: 0xB8DAE000 Size: 15104 File Visible: - Signed: -

Status: -

 

Name: V2IMount.SYS

Image Path: C:\WINDOWS\System32\Drivers\V2IMount.SYS

Address: 0xF86C6000 Size: 39456 File Visible: - Signed: -

Status: -

 

Name: vga.sys

Image Path: C:\WINDOWS\System32\drivers\vga.sys

Address: 0xF88EE000 Size: 20992 File Visible: - Signed: -

Status: -

 

Name: VIDEOPRT.SYS

Image Path: C:\WINDOWS\system32\DRIVERS\VIDEOPRT.SYS

Address: 0xF75E9000 Size: 81920 File Visible: - Signed: -

Status: -

 

Name: VolSnap.sys

Image Path: VolSnap.sys

Address: 0xF8556000 Size: 53376 File Visible: - Signed: -

Status: -

 

Name: wanarp.sys

Image Path: C:\WINDOWS\system32\DRIVERS\wanarp.sys

Address: 0xF86E6000 Size: 34560 File Visible: - Signed: -

Status: -

 

Name: watchdog.sys

Image Path: C:\WINDOWS\System32\watchdog.sys

Address: 0xF8926000 Size: 20480 File Visible: - Signed: -

Status: -

 

Name: wdmaud.sys

Image Path: C:\WINDOWS\system32\drivers\wdmaud.sys

Address: 0xB98C3000 Size: 83072 File Visible: - Signed: -

Status: -

 

Name: Win32k

Image Path: \Driver\Win32k

Address: 0xBF800000 Size: 1847296 File Visible: - Signed: -

Status: -

 

Name: win32k.sys

Image Path: C:\WINDOWS\System32\win32k.sys

Address: 0xBF800000 Size: 1847296 File Visible: - Signed: -

Status: -

 

Name: WMILIB.SYS

Image Path: C:\WINDOWS\system32\DRIVERS\WMILIB.SYS

Address: 0xF8A38000 Size: 8192 File Visible: - Signed: -

Status: -

 

Name: WMIxWDM

Image Path: \Driver\WMIxWDM

Address: 0x804D7000 Size: 2191104 File Visible: - Signed: -

Status: -

[narca]

et enfin pour l'onglet process

 

 

ROOTREPEAL © AD, 2007-2009

==================================================

Scan Start Time: 2009/10/14 17:34

Program Version: Version 1.3.5.0

Windows Version: Windows XP SP3

==================================================

 

Processes

-------------------

Path: System

PID: 4 Status: -

 

Path: C:\Program Files\HP\HP Software Update\hpwuSchd2.exe

PID: 244 Status: -

 

Path: C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe

PID: 272 Status: -

 

Path: C:\WINDOWS\system32\spoolsv.exe

PID: 396 Status: -

 

Path: C:\WINDOWS\system32\msfeedssync.exe

PID: 436 Status: -

 

Path: C:\Program Files\mFaraj DB viewer4.0.0\dbvstart.bat

PID: 464 Status: -

 

Path: C:\WINDOWS\system32\svchost.exe

PID: 544 Status: -

 

Path: C:\Program Files\BitDefender\BitDefender 2010\bdagent.exe

PID: 676 Status: -

 

Path: C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe

PID: 724 Status: -

 

Path: C:\Program Files\Java\jre6\bin\jusched.exe

PID: 744 Status: -

 

Path: C:\Program Files\DynDNS Updater\DynDNS.exe

PID: 788 Status: -

 

Path: C:\WINDOWS\system32\ctfmon.exe

PID: 816 Status: -

 

Path: C:\WINDOWS\system32\nvsvc32.exe

PID: 880 Status: -

 

Path: C:\WINDOWS\explorer.exe

PID: 952 Status: -

 

Path: C:\WINDOWS\system32\smss.exe

PID: 960 Status: -

 

Path: C:\WINDOWS\system32\csrss.exe

PID: 1060 Status: -

 

Path: C:\WINDOWS\system32\winlogon.exe

PID: 1084 Status: -

 

Path: C:\WINDOWS\system32\services.exe

PID: 1128 Status: -

 

Path: C:\WINDOWS\system32\lsass.exe

PID: 1140 Status: -

 

Path: C:\WINDOWS\system32\svchost.exe

PID: 1268 Status: -

 

Path: C:\WINDOWS\system32\svchost.exe

PID: 1300 Status: -

 

Path: C:\WINDOWS\system32\wdfmgr.exe

PID: 1312 Status: -

 

Path: C:\WINDOWS\system32\svchost.exe

PID: 1380 Status: -

 

Path: C:\Program Files\Fichiers communs\BitDefender\BitDefender Update Service\livesrv.exe

PID: 1504 Status: -

 

Path: C:\Program Files\BitDefender\BitDefender 2010\vsserv.exe

PID: 1548 Status: -

 

Path: C:\WINDOWS\system32\svchost.exe

PID: 1636 Status: -

 

Path: C:\WINDOWS\system32\svchost.exe

PID: 1776 Status: -

 

Path: C:\WINDOWS\system32\gearsec.exe

PID: 1800 Status: -

 

Path: C:\Program Files\Java\jre6\bin\jqs.exe

PID: 1832 Status: -

 

Path: C:\WINDOWS\system32\rundll32.exe

PID: 1876 Status: -

 

Path: C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe

PID: 1884 Status: -

 

Path: C:\Program Files\Norton Ghost\Agent\GhostTray.exe

PID: 1892 Status: -

 

Path: C:\Program Files\Macrogaming\SweetIM\SweetIM.exe

PID: 1900 Status: -

 

Path: C:\Program Files\Norton Ghost\Agent\VProSvc.exe

PID: 1920 Status: -

 

Path: C:\WINDOWS\system32\svchost.exe

PID: 1996 Status: -

 

Path: C:\Program Files\e-Carte Bleue\LA BANQUE POSTALE\CVD ADESIO\ECB.exe

PID: 2028 Status: -

 

Path: C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe

PID: 2044 Status: -

 

Path: C:\Program Files\Internet Explorer\iexplore.exe

PID: 2260 Status: Hidden from the Windows API!

 

Path: C:\Program Files\BitDefender\BitDefender 2010\seccenter.exe

PID: 2444 Status: -

 

Path: C:\Program Files\HP\Digital Imaging\bin\hpqste08.exe

PID: 2468 Status: -

 

Path: C:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exe

PID: 3076 Status: -

 

Path: C:\WINDOWS\system32\alg.exe

PID: 3124 Status: -

 

Path: C:\Program Files\HP\Digital Imaging\Product Assistant\bin\hprblog.exe

PID: 3528 Status: -

 

Path: C:\WINDOWS\system32\HPZipm12.exe

PID: 3632 Status: -

 

Path: C:\rootrepeal\RootRepeal.exe

PID: 3968 Status: -

 

en esperant que c'est un faux rootkit comme tu le pense

[Falkra]

On va devoir voir ça de près.

Path: C:\Program Files\Internet Explorer\iexplore.exe

PID: 2260 Status: Hidden from the Windows API!

 

Fais un scan avec l'onglet "files" stp et poste le rapport. Ce sera un peu plus long car il va regarder les fichiers du disque dur.

[narca]

bonsoir

 

voici le nouveau rapport

 

ROOTREPEAL © AD, 2007-2009

==================================================

Scan Start Time: 2009/10/14 21:41

Program Version: Version 1.3.5.0

Windows Version: Windows XP SP3

==================================================

 

Hidden/Locked Files

-------------------

Path: C:\hiberfil.sys

Status: Locked to the Windows API!

 

c'est incroyable tous le temps que tu passe pour moi

 

tu es vraiment passioné

 

merci pour tous

[Falkra]

Est-ce que tu arrives à utiliser Internet Explorer, c'est ton navigateur habituel ?

[narca]

re

 

oui c'est IE que j'utilise par defaut sans probleme sauf peut etre depuis que j'ai mis IE8 un peu lent

 

mais faut dire que ce pc est ancien amd 2700 et 512 mo de ram

 

ce n'est plus mon pc principale disons que il est utilisé par mes filles et par moi pour mes demo sat

 

donc IE fonctionne tres bien mais long a ouvrir les pages surtout au demarrage hors ma page de demarrage est google donc tres simple a ouvrir

 

a+

[Falkra]

Je vais demander l'avis des copains, c'est curieux car ta machine semble ok, mais les résultats ne collent pas avec un rootkit pourtant tous y voient un rootkit.

Je pense que c'est ton antivirus qui protège IE en le mettant dans une sorte de sandbox (une bulle logicielle, pour le protéger). Je demande confirmation.

 

En attendant, voici un petit rapport de plus à faire :

Télécharge Security Check de screen317 et enregistre-le sur ton bureau.

• Double-clique sur Security Check.exe
  
• Suis les instructions affichées à l'écran (dans la fenêtre sur fond noir) on te demandera d'appuyer sur une touche.
  Pendant l'étape "DNS Vulnerability Check: / Vulnérabilité DNS", le processus peut te demander une connexion en sortie, donne l'autorisation s'il te plaît.
  
• Un document texte appelé checkup.txt va s'ouvrir automatiquement dans le Bloc-notes (Notepad); merci de poster le contenu de ce document.
  

[narca]

bonjour

 

comme d'habitude je verrai ça ce soir car la je suis au taff

 

ce qui est etrange c'est que bitdefender 2009 ne voyait rien c'est au changement passage a bitdefender 2010 que ce rootkit est apparu.

 

sinon j'ai ouvert un compte chez dyndns et j'utilise leur log dyndns updater pour maintenir a jour mon adresse et l'ip.

 

donc avec un port d'ouvert le 12000 en tcp et udp (je n'ai ouvert aucun autre port) meme si emule ou pando installé sur ma machine cela date d'il y'a 3 ou 4 ans et ma livebox date de cette été(faudrais d'ailleurs que je les desinstalle)

 

est ce que cela peut venir de la?

 

encore merci

[Falkra]

ce qui est etrange c'est que bitdefender 2009 ne voyait rien c'est au changement passage a bitdefender 2010 que ce rootkit est apparu.

Cela peut être lié à BitDefender, s'il intègre ce qu'on appelle une sandbox, un truc qui pourrait faire ça, mais ça reste curieux car il ne se détecterait pas lui-même.

 

Refais un scan Gmer stp (Gmer, par root repeal ou autre). Ne coche que "System", "Devices", "Modules", "Processes", "Threads", "Librairies", "Services", "Registry" et "Files" et rien d'autre pour faire le scan, comme ça dans la colonne de droite, et tu fais "scan" et tu me postes le rapport. Ca prendra un moment à scanner :

 

 

Fais à ton rythme, la machine n'est pas forcément en danger, pas de panique.

[narca]

bonsoir

 

je ne m'affole pas car ce n'est que la vielle becanne pour mes filles elle ne sert pas souvent

 

voici dans un 1er temps le rapport security check

 

Results of screen317's Security Check version 0.99.0

Windows XP Service Pack 3

``````````````````````````````

Antivirus/Firewall Check:

BitDefender Total Security 2010

``````````````````````````````

Anti-malware/Other Utilities Check:

Norton Ghost 10.0

Java 6 Update 15

Java SE Runtime Environment 6 Update 1

Java 6 Update 3

Java 6 Update 5

Java 6 Update 7

Out of date Java installed!

Adobe Flash Player 10

Adobe Reader 9.1 - Français

``````````````````````````````

Process Check:

objlist.exe by Laurent

BitDefender BitDefender 2010 bdagent.exe

BitDefender BitDefender 2010 seccenter.exe

BitDefender BitDefender 2010 vsserv.exe

Fichiers communs BitDefender BitDefender Update Service livesrv.exe

``````````````````````````````

DNS Vulnerability Check:

Unknown. This method cannot test your vulnerability to DNS cache poisoning.

 

`````````End of Log```````````

 

 

maintenant je vais refaire gmer

 

a tout a l'heure