RootkitBuster
אני עושה עם התוכנה הזו סריקה ומופיעה לי הדברים האלה :
http://imageshack.us/photo/my-images/40/27309454.png/
ואחרי סריקה מופעה הלוג :
+----------------------------------------------------
| Trend Micro RootkitBuster
| Module version: 3.60.0.1016
| Computer Name: XP
| User Name: user
+----------------------------------------------------
--== Dump Hidden MBR, Hidden Files and Alternate Data Streams on C:\ ==--
No hidden files found.
--== Dump Hidden Registry Value on HKLM ==--
[HIDDEN_REGISTRY][Hidden Reg Value]:
KeyPath : HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg
Root : 0
SubKey : Cfg
ValueName : s1
Data : 771343423
ValueType : 4
AccessType: 0
FullLength: 0x3d
DataSize : 0x4
[HIDDEN_REGISTRY][Hidden Reg Value]:
KeyPath : HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg
Root : 0
SubKey : Cfg
ValueName : s2
Data : 285507792
ValueType : 4
AccessType: 0
FullLength: 0x3d
DataSize : 0x4
[HIDDEN_REGISTRY][Hidden Reg Value]:
KeyPath : HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg
Root : 0
SubKey : Cfg
ValueName : g0
Data : 38 23 E8 D0 BF F2 2D 6F ...
ValueType : 3
AccessType: 0
FullLength: 0x3d
DataSize : 0x20
[HIDDEN_REGISTRY][Hidden Reg Value]:
KeyPath : HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg
Root : 0
SubKey : Cfg
ValueName : h0
Data : 1
ValueType : 4
AccessType: 0
FullLength: 0x3d
DataSize : 0x4
[HIDDEN_REGISTRY][Hidden Reg Key]:
KeyPath : HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3 CF1058D9A64CEC
SubKey : 14919EA49A8F3B4AA3CF1058D9A64CEC
FullLength: 0x5e
5 hidden registry entries found.
--== Dump Hidden Process ==--
No hidden processes found.
--== Dump Hidden Driver ==--
No hidden drivers found.
--== Service Win32 API Hook List ==--
[HOOKED_SERVICE_API]:
Service API : ZwClose
Image Path :
OriginalHandler : 0x805b1da4
CurrentHandler : 0xf7b83a74
ServiceNumber : 0x19
ModuleName :
SDTType : 0x0
[HOOKED_SERVICE_API]:
Service API : ZwCreateKey
Image Path :
OriginalHandler : 0x8061ac12
CurrentHandler : 0xf7b83a2e
ServiceNumber : 0x29
ModuleName :
SDTType : 0x0
[HOOKED_SERVICE_API]:
Service API : ZwCreateSection
Image Path :
OriginalHandler : 0x805a082c
CurrentHandler : 0xf7b83a7e
ServiceNumber : 0x32
ModuleName :
SDTType : 0x0
[HOOKED_SERVICE_API]:
Service API : ZwCreateThread
Image Path :
OriginalHandler : 0x805c738e
CurrentHandler : 0xf7b83a24
ServiceNumber : 0x35
ModuleName :
SDTType : 0x0
[HOOKED_SERVICE_API]:
Service API : ZwDeleteKey
Image Path :
OriginalHandler : 0x8061b0ae
CurrentHandler : 0xf7b83a33
ServiceNumber : 0x3f
ModuleName :
SDTType : 0x0
[HOOKED_SERVICE_API]:
Service API : ZwDeleteValueKey
Image Path :
OriginalHandler : 0x8061b27e
CurrentHandler : 0xf7b83a3d
ServiceNumber : 0x41
ModuleName :
SDTType : 0x0
[HOOKED_SERVICE_API]:
Service API : ZwDuplicateObject
Image Path :
OriginalHandler : 0x805b39b8
CurrentHandler : 0xf7b83a6f
ServiceNumber : 0x44
ModuleName :
SDTType : 0x0
[HOOKED_SERVICE_API]:
Service API : ZwEnumerateKey
Image Path : sptd.sys
OriginalHandler : 0x8061b45e
CurrentHandler : 0xf739c698
ServiceNumber : 0x47
ModuleName : sptd.sys
SDTType : 0x0
[HOOKED_SERVICE_API]:
Service API : ZwEnumerateValueKey
Image Path : sptd.sys
OriginalHandler : 0x8061b6c8
CurrentHandler : 0xf739ca26
ServiceNumber : 0x49
ModuleName : sptd.sys
SDTType : 0x0
[HOOKED_SERVICE_API]:
Service API : ZwLoadKey
Image Path :
OriginalHandler : 0x8061ce36
CurrentHandler : 0xf7b83a42
ServiceNumber : 0x62
ModuleName :
SDTType : 0x0
[HOOKED_SERVICE_API]:
Service API : ZwOpenKey
Image Path : sptd.sys
OriginalHandler : 0x8061bff0
CurrentHandler : 0xf7368f80
ServiceNumber : 0x77
ModuleName : sptd.sys
SDTType : 0x0
[HOOKED_SERVICE_API]:
Service API : ZwOpenProcess
Image Path :
OriginalHandler : 0x805c1412
CurrentHandler : 0xf7b83a10
ServiceNumber : 0x7a
ModuleName :
SDTType : 0x0
[HOOKED_SERVICE_API]:
Service API : ZwOpenThread
Image Path :
OriginalHandler : 0x805c169e
CurrentHandler : 0xf7b83a15
ServiceNumber : 0x80
ModuleName :
SDTType : 0x0
[HOOKED_SERVICE_API]:
Service API : ZwQueryKey
Image Path : sptd.sys
OriginalHandler : 0x8061c332
CurrentHandler : 0xf739cafe
ServiceNumber : 0xa0
ModuleName : sptd.sys
SDTType : 0x0
[HOOKED_SERVICE_API]:
Service API : ZwQueryValueKey
Image Path :
OriginalHandler : 0x80618e36
CurrentHandler : 0xf7b83a97
ServiceNumber : 0xb1
ModuleName :
SDTType : 0x0
[HOOKED_SERVICE_API]:
Service API : ZwReplaceKey
Image Path :
OriginalHandler : 0x8061cce6
CurrentHandler : 0xf7b83a4c
ServiceNumber : 0xc1
ModuleName :
SDTType : 0x0
[HOOKED_SERVICE_API]:
Service API : ZwRequestWaitReplyPort
Image Path :
OriginalHandler : 0x805981d0
CurrentHandler : 0xf7b83a88
ServiceNumber : 0xc8
ModuleName :
SDTType : 0x0
[HOOKED_SERVICE_API]:
Service API : ZwRestoreKey
Image Path :
OriginalHandler : 0x8061c5f2
CurrentHandler : 0xf7b83a47
ServiceNumber : 0xcc
ModuleName :
SDTType : 0x0
[HOOKED_SERVICE_API]:
Service API : ZwSetContextThread
Image Path :
OriginalHandler : 0x805c8fe6
CurrentHandler : 0xf7b83a83
ServiceNumber : 0xd5
ModuleName :
SDTType : 0x0
[HOOKED_SERVICE_API]:
Service API : ZwSetSecurityObject
Image Path :
OriginalHandler : 0x805b612a
CurrentHandler : 0xf7b83a8d
ServiceNumber : 0xed
ModuleName :
SDTType : 0x0
[HOOKED_SERVICE_API]:
Service API : ZwSetValueKey
Image Path :
OriginalHandler : 0x80619184
CurrentHandler : 0xf7b83a38
ServiceNumber : 0xf7
ModuleName :
SDTType : 0x0
[HOOKED_SERVICE_API]:
Service API : ZwSystemDebugControl
Image Path :
OriginalHandler : 0x8060eb5c
CurrentHandler : 0xf7b83a92
ServiceNumber : 0xff
ModuleName :
SDTType : 0x0
[HOOKED_SERVICE_API]:
Service API : ZwTerminateProcess
Image Path :
OriginalHandler : 0x805c869a
CurrentHandler : 0xf7b83a1f
ServiceNumber : 0x101
ModuleName :
SDTType : 0x0
--== Dump Hidden Port ==--
No hidden ports found.
--== Dump Kernel Code Patching ==--
No kernel code patching detected.
--== Dump Hidden Services ==--
No hidden services found.
אני רוצה לדעת אם יש וירוס או משהו לא תקין
ציטוט ההודעה
