RogueKiller V8.8.15 _x64_ [Mar 27 2014] par Adlice Software mail : http://www.adlice.com/contact/ Remontees : http://forum.adlice.com Site Web : http://www.surlatoile.org/RogueKiller/ Blog : http://www.adlice.com Systeme d'exploitation : Windows 8.1 (6.3.9200 ) 64 bits version Demarrage : Mode normal Utilisateur : Frederic [Droits d'admin] Mode : Recherche -- Date : 04/27/2014 12:29:58 | ARK || FAK || MBR | ¤¤¤ Processus malicieux : 0 ¤¤¤ ¤¤¤ Entrees de registre : 7 ¤¤¤ [HJ POL][PUM] HKLM\[...]\System : DisableTaskMgr (0) -> TROUVÉ [HJ POL][PUM] HKLM\[...]\System : DisableRegistryTools (0) -> TROUVÉ [HJ POL][PUM] HKLM\[...]\Wow6432Node\[...]\System : DisableTaskMgr (0) -> TROUVÉ [HJ POL][PUM] HKLM\[...]\Wow6432Node\[...]\System : DisableRegistryTools (0) -> TROUVÉ [HJ SMENU][PUM] HKCU\[...]\Advanced : Start_TrackProgs (0) -> TROUVÉ [HJ DESK][PUM] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> TROUVÉ [HJ DESK][PUM] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> TROUVÉ ¤¤¤ Tâches planifiées : 0 ¤¤¤ ¤¤¤ Entrées Startup : 0 ¤¤¤ ¤¤¤ Navigateurs web : 0 ¤¤¤ ¤¤¤ Addons navigateur : 0 ¤¤¤ ¤¤¤ Fichiers / Dossiers particuliers: ¤¤¤ ¤¤¤ Driver : [NON CHARGE 0x0] ¤¤¤ [Address] EAT @explorer.exe (DllCanUnloadNow) : MSIMG32.dll -> HOOKED (C:\WINDOWS\SYSTEM32\dwmapi.dll @ 0x98C6274C) [Address] EAT @explorer.exe (DllGetClassObject) : MSIMG32.dll -> HOOKED (C:\WINDOWS\SYSTEM32\dwmapi.dll @ 0x98C64984) [Address] EAT @explorer.exe (DwmAttachMilContent) : MSIMG32.dll -> HOOKED (C:\WINDOWS\SYSTEM32\dwmapi.dll @ 0x98C68180) [Address] EAT @explorer.exe (DwmDefWindowProc) : MSIMG32.dll -> HOOKED (C:\WINDOWS\SYSTEM32\dwmapi.dll @ 0x98C62C30) [Address] EAT @explorer.exe (DwmDetachMilContent) : MSIMG32.dll -> HOOKED (C:\WINDOWS\SYSTEM32\dwmapi.dll @ 0x98C68180) [Address] EAT @explorer.exe (DwmEnableBlurBehindWindow) : MSIMG32.dll -> HOOKED (C:\WINDOWS\SYSTEM32\dwmapi.dll @ 0x98C62A70) [Address] EAT @explorer.exe (DwmEnableComposition) : MSIMG32.dll -> HOOKED (C:\WINDOWS\SYSTEM32\dwmapi.dll @ 0x98C6C60C) [Address] EAT @explorer.exe (DwmEnableMMCSS) : MSIMG32.dll -> HOOKED (C:\WINDOWS\SYSTEM32\dwmapi.dll @ 0x98C63788) [Address] EAT @explorer.exe (DwmExtendFrameIntoClientArea) : MSIMG32.dll -> HOOKED (C:\WINDOWS\SYSTEM32\dwmapi.dll @ 0x98C62DC0) [Address] EAT @explorer.exe (DwmFlush) : MSIMG32.dll -> HOOKED (C:\WINDOWS\SYSTEM32\dwmapi.dll @ 0x98C626C0) [Address] EAT @explorer.exe (DwmGetColorizationColor) : MSIMG32.dll -> HOOKED (C:\WINDOWS\SYSTEM32\dwmapi.dll @ 0x98C6C118) [Address] EAT @explorer.exe (DwmGetCompositionTimingInfo) : MSIMG32.dll -> HOOKED (C:\WINDOWS\SYSTEM32\dwmapi.dll @ 0x98C61D40) [Address] EAT @explorer.exe (DwmGetGraphicsStreamClient) : MSIMG32.dll -> HOOKED (C:\WINDOWS\SYSTEM32\dwmapi.dll @ 0x98C68180) [Address] EAT @explorer.exe (DwmGetGraphicsStreamTransformHint) : MSIMG32.dll -> HOOKED (C:\WINDOWS\SYSTEM32\dwmapi.dll @ 0x98C68180) [Address] EAT @explorer.exe (DwmGetTransportAttributes) : MSIMG32.dll -> HOOKED (C:\WINDOWS\SYSTEM32\dwmapi.dll @ 0x98C6C8B0) [Address] EAT @explorer.exe (DwmGetWindowAttribute) : MSIMG32.dll -> HOOKED (C:\WINDOWS\SYSTEM32\dwmapi.dll @ 0x98C61010) [Address] EAT @explorer.exe (DwmInvalidateIconicBitmaps) : MSIMG32.dll -> HOOKED (C:\WINDOWS\SYSTEM32\dwmapi.dll @ 0x98C66308) [Address] EAT @explorer.exe (DwmIsCompositionEnabled) : MSIMG32.dll -> HOOKED (C:\WINDOWS\SYSTEM32\dwmapi.dll @ 0x98C611B0) [Address] EAT @explorer.exe (DwmModifyPreviousDxFrameDuration) : MSIMG32.dll -> HOOKED (C:\WINDOWS\SYSTEM32\dwmapi.dll @ 0x98C6D050) [Address] EAT @explorer.exe (DwmQueryThumbnailSourceSize) : MSIMG32.dll -> HOOKED (C:\WINDOWS\SYSTEM32\dwmapi.dll @ 0x98C66F34) [Address] EAT @explorer.exe (DwmRegisterThumbnail) : MSIMG32.dll -> HOOKED (C:\WINDOWS\SYSTEM32\dwmapi.dll @ 0x98C669A8) [Address] EAT @explorer.exe (DwmRenderGesture) : MSIMG32.dll -> HOOKED (C:\WINDOWS\SYSTEM32\dwmapi.dll @ 0x98C67CEC) [Address] EAT @explorer.exe (DwmSetDxFrameDuration) : MSIMG32.dll -> HOOKED (C:\WINDOWS\SYSTEM32\dwmapi.dll @ 0x98C6D050) [Address] EAT @explorer.exe (DwmSetIconicLivePreviewBitmap) : MSIMG32.dll -> HOOKED (C:\WINDOWS\SYSTEM32\dwmapi.dll @ 0x98C6D1CC) [Address] EAT @explorer.exe (DwmSetIconicThumbnail) : MSIMG32.dll -> HOOKED (C:\WINDOWS\SYSTEM32\dwmapi.dll @ 0x98C6D558) [Address] EAT @explorer.exe (DwmSetPresentParameters) : MSIMG32.dll -> HOOKED (C:\WINDOWS\SYSTEM32\dwmapi.dll @ 0x98C6D050) [Address] EAT @explorer.exe (DwmSetWindowAttribute) : MSIMG32.dll -> HOOKED (C:\WINDOWS\SYSTEM32\dwmapi.dll @ 0x98C610E8) [Address] EAT @explorer.exe (DwmShowContact) : MSIMG32.dll -> HOOKED (C:\WINDOWS\SYSTEM32\dwmapi.dll @ 0x98C63A90) [Address] EAT @explorer.exe (DwmTetherContact) : MSIMG32.dll -> HOOKED (C:\WINDOWS\SYSTEM32\dwmapi.dll @ 0x98C6CB1C) [Address] EAT @explorer.exe (DwmTransitionOwnedWindow) : MSIMG32.dll -> HOOKED (C:\WINDOWS\SYSTEM32\dwmapi.dll @ 0x98C6DBD8) [Address] EAT @explorer.exe (DwmUnregisterThumbnail) : MSIMG32.dll -> HOOKED (C:\WINDOWS\SYSTEM32\dwmapi.dll @ 0x98C6677C) [Address] EAT @explorer.exe (DwmUpdateThumbnailProperties) : MSIMG32.dll -> HOOKED (C:\WINDOWS\SYSTEM32\dwmapi.dll @ 0x98C63A10) [Address] EAT @explorer.exe (DwmpAllocateSecurityDescriptor) : MSIMG32.dll -> HOOKED (C:\WINDOWS\SYSTEM32\dwmapi.dll @ 0x98C62320) [Address] EAT @explorer.exe (DwmpDxGetWindowSharedSurface) : MSIMG32.dll -> HOOKED (C:\WINDOWS\SYSTEM32\dwmapi.dll @ 0x98C65FE0) [Address] EAT @explorer.exe (DwmpDxUpdateWindowSharedSurface) : MSIMG32.dll -> HOOKED (C:\WINDOWS\SYSTEM32\dwmapi.dll @ 0x98C67710) [Address] EAT @explorer.exe (DwmpDxgiIsThreadDesktopComposited) : MSIMG32.dll -> HOOKED (C:\WINDOWS\SYSTEM32\dwmapi.dll @ 0x98C63760) [Address] EAT @explorer.exe (DwmpFreeSecurityDescriptor) : MSIMG32.dll -> HOOKED (C:\WINDOWS\SYSTEM32\dwmapi.dll @ 0x98C622E4) [Address] EAT @explorer.exe (DwmpRenderFlick) : MSIMG32.dll -> HOOKED (C:\WINDOWS\SYSTEM32\dwmapi.dll @ 0x98C6CE70) [Address] EAT @explorer.exe (AccConvertAccessMaskToActrlAccess) : d2d1.dll -> HOOKED (C:\WINDOWS\SYSTEM32\ntmarta.dll @ 0x9486FA0C) [Address] EAT @explorer.exe (AccConvertAccessToSD) : d2d1.dll -> HOOKED (C:\WINDOWS\SYSTEM32\ntmarta.dll @ 0x9486FB80) [Address] EAT @explorer.exe (AccConvertAccessToSecurityDescriptor) : d2d1.dll -> HOOKED (C:\WINDOWS\SYSTEM32\ntmarta.dll @ 0x9486FD3C) [Address] EAT @explorer.exe (AccConvertAclToAccess) : d2d1.dll -> HOOKED (C:\WINDOWS\SYSTEM32\ntmarta.dll @ 0x9486FE90) [Address] EAT @explorer.exe (AccConvertSDToAccess) : d2d1.dll -> HOOKED (C:\WINDOWS\SYSTEM32\ntmarta.dll @ 0x9486FF2C) [Address] EAT @explorer.exe (AccFreeIndexArray) : d2d1.dll -> HOOKED (C:\WINDOWS\SYSTEM32\ntmarta.dll @ 0x94860D80) [Address] EAT @explorer.exe (AccGetAccessForTrustee) : d2d1.dll -> HOOKED (C:\WINDOWS\SYSTEM32\ntmarta.dll @ 0x948701A8) [Address] EAT @explorer.exe (AccGetExplicitEntries) : d2d1.dll -> HOOKED (C:\WINDOWS\SYSTEM32\ntmarta.dll @ 0x94870288) [Address] EAT @explorer.exe (AccGetInheritanceSource) : d2d1.dll -> HOOKED (C:\WINDOWS\SYSTEM32\ntmarta.dll @ 0x94860EA0) [Address] EAT @explorer.exe (AccLookupAccountName) : d2d1.dll -> HOOKED (C:\WINDOWS\SYSTEM32\ntmarta.dll @ 0x94870348) [Address] EAT @explorer.exe (AccLookupAccountSid) : d2d1.dll -> HOOKED (C:\WINDOWS\SYSTEM32\ntmarta.dll @ 0x94870648) [Address] EAT @explorer.exe (AccLookupAccountTrustee) : d2d1.dll -> HOOKED (C:\WINDOWS\SYSTEM32\ntmarta.dll @ 0x948709CC) [Address] EAT @explorer.exe (AccProvCancelOperation) : d2d1.dll -> HOOKED (C:\WINDOWS\SYSTEM32\ntmarta.dll @ 0x9486CAFC) [Address] EAT @explorer.exe (AccProvGetAccessInfoPerObjectType) : d2d1.dll -> HOOKED (C:\WINDOWS\SYSTEM32\ntmarta.dll @ 0x9486CB74) [Address] EAT @explorer.exe (AccProvGetAllRights) : d2d1.dll -> HOOKED (C:\WINDOWS\SYSTEM32\ntmarta.dll @ 0x9486CC1C) [Address] EAT @explorer.exe (AccProvGetCapabilities) : d2d1.dll -> HOOKED (C:\WINDOWS\SYSTEM32\ntmarta.dll @ 0x94858100) [Address] EAT @explorer.exe (AccProvGetOperationResults) : d2d1.dll -> HOOKED (C:\WINDOWS\SYSTEM32\ntmarta.dll @ 0x9486CDF8) [Address] EAT @explorer.exe (AccProvGetTrusteesAccess) : d2d1.dll -> HOOKED (C:\WINDOWS\SYSTEM32\ntmarta.dll @ 0x9486CF38) [Address] EAT @explorer.exe (AccProvGrantAccessRights) : d2d1.dll -> HOOKED (C:\WINDOWS\SYSTEM32\ntmarta.dll @ 0x9486D040) [Address] EAT @explorer.exe (AccProvHandleGetAccessInfoPerObjectType) : d2d1.dll -> HOOKED (C:\WINDOWS\SYSTEM32\ntmarta.dll @ 0x9486D1B0) [Address] EAT @explorer.exe (AccProvHandleGetAllRights) : d2d1.dll -> HOOKED (C:\WINDOWS\SYSTEM32\ntmarta.dll @ 0x9486D298) [Address] EAT @explorer.exe (AccProvHandleGetTrusteesAccess) : d2d1.dll -> HOOKED (C:\WINDOWS\SYSTEM32\ntmarta.dll @ 0x9486D410) [Address] EAT @explorer.exe (AccProvHandleGrantAccessRights) : d2d1.dll -> HOOKED (C:\WINDOWS\SYSTEM32\ntmarta.dll @ 0x9486C4D0) [Address] EAT @explorer.exe (AccProvHandleIsAccessAudited) : d2d1.dll -> HOOKED (C:\WINDOWS\SYSTEM32\ntmarta.dll @ 0x9486D48C) [Address] EAT @explorer.exe (AccProvHandleIsObjectAccessible) : d2d1.dll -> HOOKED (C:\WINDOWS\SYSTEM32\ntmarta.dll @ 0x9486D524) [Address] EAT @explorer.exe (AccProvHandleRevokeAccessRights) : d2d1.dll -> HOOKED (C:\WINDOWS\SYSTEM32\ntmarta.dll @ 0x9486D660) [Address] EAT @explorer.exe (AccProvHandleRevokeAuditRights) : d2d1.dll -> HOOKED (C:\WINDOWS\SYSTEM32\ntmarta.dll @ 0x9486D738) [Address] EAT @explorer.exe (AccProvHandleSetAccessRights) : d2d1.dll -> HOOKED (C:\WINDOWS\SYSTEM32\ntmarta.dll @ 0x9486D810) [Address] EAT @explorer.exe (AccProvIsAccessAudited) : d2d1.dll -> HOOKED (C:\WINDOWS\SYSTEM32\ntmarta.dll @ 0x9486D910) [Address] EAT @explorer.exe (AccProvIsObjectAccessible) : d2d1.dll -> HOOKED (C:\WINDOWS\SYSTEM32\ntmarta.dll @ 0x9486DA24) [Address] EAT @explorer.exe (AccProvRevokeAccessRights) : d2d1.dll -> HOOKED (C:\WINDOWS\SYSTEM32\ntmarta.dll @ 0x9486DE74) [Address] EAT @explorer.exe (AccProvRevokeAuditRights) : d2d1.dll -> HOOKED (C:\WINDOWS\SYSTEM32\ntmarta.dll @ 0x9486DFB0) [Address] EAT @explorer.exe (AccProvSetAccessRights) : d2d1.dll -> HOOKED (C:\WINDOWS\SYSTEM32\ntmarta.dll @ 0x9486E0EC) [Address] EAT @explorer.exe (AccRewriteGetExplicitEntriesFromAcl) : d2d1.dll -> HOOKED (C:\WINDOWS\SYSTEM32\ntmarta.dll @ 0x94857BD4) [Address] EAT @explorer.exe (AccRewriteGetHandleRights) : d2d1.dll -> HOOKED (C:\WINDOWS\SYSTEM32\ntmarta.dll @ 0x94861510) [Address] EAT @explorer.exe (AccRewriteGetNamedRights) : d2d1.dll -> HOOKED (C:\WINDOWS\SYSTEM32\ntmarta.dll @ 0x94861680) [Address] EAT @explorer.exe (AccRewriteSetEntriesInAcl) : d2d1.dll -> HOOKED (C:\WINDOWS\SYSTEM32\ntmarta.dll @ 0x94853070) [Address] EAT @explorer.exe (AccRewriteSetHandleRights) : d2d1.dll -> HOOKED (C:\WINDOWS\SYSTEM32\ntmarta.dll @ 0x94852270) [Address] EAT @explorer.exe (AccRewriteSetNamedRights) : d2d1.dll -> HOOKED (C:\WINDOWS\SYSTEM32\ntmarta.dll @ 0x94853BA0) [Address] EAT @explorer.exe (AccSetEntriesInAList) : d2d1.dll -> HOOKED (C:\WINDOWS\SYSTEM32\ntmarta.dll @ 0x94870AD4) [Address] EAT @explorer.exe (AccTreeResetNamedSecurityInfo) : d2d1.dll -> HOOKED (C:\WINDOWS\SYSTEM32\ntmarta.dll @ 0x948558A0) [Address] EAT @explorer.exe (EventGuidToName) : d2d1.dll -> HOOKED (C:\WINDOWS\SYSTEM32\ntmarta.dll @ 0x9485DE68) [Address] EAT @explorer.exe (EventNameFree) : d2d1.dll -> HOOKED (C:\WINDOWS\SYSTEM32\ntmarta.dll @ 0x9485DEF4) [Address] EAT @explorer.exe (GetExplicitEntriesFromAclW) : d2d1.dll -> HOOKED (C:\WINDOWS\SYSTEM32\ntmarta.dll @ 0x94857BCC) [Address] EAT @explorer.exe (GetMartaExtensionInterface) : d2d1.dll -> HOOKED (C:\WINDOWS\SYSTEM32\ntmarta.dll @ 0x94853600) [Address] EAT @explorer.exe (GetNamedSecurityInfoW) : d2d1.dll -> HOOKED (C:\WINDOWS\SYSTEM32\ntmarta.dll @ 0x94852680) [Address] EAT @explorer.exe (GetSecurityInfo) : d2d1.dll -> HOOKED (C:\WINDOWS\SYSTEM32\ntmarta.dll @ 0x94851390) [Address] EAT @explorer.exe (SetEntriesInAclW) : d2d1.dll -> HOOKED (C:\WINDOWS\SYSTEM32\ntmarta.dll @ 0x94853060) [Address] EAT @explorer.exe (SetNamedSecurityInfoW) : d2d1.dll -> HOOKED (C:\WINDOWS\SYSTEM32\ntmarta.dll @ 0x94853E64) [Address] EAT @explorer.exe (SetSecurityInfo) : d2d1.dll -> HOOKED (C:\WINDOWS\SYSTEM32\ntmarta.dll @ 0x948521B0) ¤¤¤ Ruches Externes: ¤¤¤ ¤¤¤ Infection : ¤¤¤ ¤¤¤ Fichier HOSTS: ¤¤¤ --> %SystemRoot%\System32\drivers\etc\hosts 127.0.0.1 localhost ::1 localhost #[IPv6] 0.0.0.0 fr.a2dfp.net 0.0.0.0 m.fr.a2dfp.net 0.0.0.0 mfr.a2dfp.net 0.0.0.0 ad.a8.net 0.0.0.0 asy.a8ww.net 0.0.0.0 static.a-ads.com 0.0.0.0 abcstats.com 0.0.0.0 ad4.abradio.cz 0.0.0.0 a.abv.bg 0.0.0.0 adserver.abv.bg 0.0.0.0 adv.abv.bg 0.0.0.0 bimg.abv.bg 0.0.0.0 ca.abv.bg 0.0.0.0 www2.a-counter.kiev.ua 0.0.0.0 track.acclaimnetwork.com 0.0.0.0 accuserveadsystem.com 0.0.0.0 http://www.accuserveadsystem.com 0.0.0.0 achmedia.com [...] ¤¤¤ MBR Verif: ¤¤¤ +++++ PhysicalDrive0: (\\.\PHYSICALDRIVE0 @ IDE) ST2000DM001-1CH164 +++++ --- User --- [MBR] a428900ea0ef995c1dbeb1d6f7d42a1f [BSP] 81788495c451c77ea82504a5314c6a21 : Empty MBR Code Partition table: 0 - [XXXXXX] UNKNOWN (0x00) [VISIBLE] Offset (sectors): 1 | Size: 2097152 MB User = LL1 ... OK! User = LL2 ... OK! +++++ PhysicalDrive1: (\\.\PHYSICALDRIVE1 @ USB) Generic- Multi-Card USB Device +++++ Error reading User MBR! ([0x15] Le périphérique n?est pas prêt. ) User = LL1 ... OK! Error reading LL2 MBR! ([0x32] Cette demande n?est pas prise en charge. ) Termine : << RKreport[0]_S_04272014_122958.txt >>