cjoint

Publicité


Publicité

Format du document : text/plain

Prévisualisation

RogueKiller V10.9.4.0 [Jul 30 2015] par Adlice Software
email : http://www.adlice.com/contact/
Remontées : http://forum.adlice.com
Site web : http://www.adlice.com/fr/logiciels/roguekiller/
Blog : http://www.adlice.com

Système d'exploitation : Windows 7 (6.1.7601 Service Pack 1) 64 bits version
Démarré en : Mode normal
Utilisateur : hp [Administrateur]
Démarré depuis : C:\Users\hp\Desktop\RogueKiller_2.exe
Mode : Suppression -- Date : 08/01/2015 14:03:54

¤¤¤ Processus : 1 ¤¤¤
[Proc.Injected] Dropbox.exe(2864) -- C:\Users\hp\AppData\Roaming\Dropbox\bin\Dropbox.exe[7] -> Tué(e) [TermProc]

¤¤¤ Registre : 10 ¤¤¤
[Suspicious.Path] (X64) HKEY_USERS\S-1-5-21-1386845314-2381527918-4033854710-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce | Uninstall C:\Users\hp\AppData\Local\Microsoft\OneDrive\17.3.4726.0226 : C:\Windows\system32\cmd.exe /q /c rmdir /s /q "C:\Users\hp\AppData\Local\Microsoft\OneDrive\17.3.4726.0226" [7][x][x][x][x][x][-] -> ERROR [0]
[Suspicious.Path] (X86) HKEY_USERS\S-1-5-21-1386845314-2381527918-4033854710-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce | Uninstall C:\Users\hp\AppData\Local\Microsoft\OneDrive\17.3.4726.0226 : C:\Windows\system32\cmd.exe /q /c rmdir /s /q "C:\Users\hp\AppData\Local\Microsoft\OneDrive\17.3.4726.0226" [7][x][x][x][x][x][-] -> ERROR [2]
[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters | DhcpNameServer : ([-][(Private Address) (XX)]) -> Remplacé(e) ()
[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Tcpip\Parameters | DhcpNameServer : ([-][(Private Address) (XX)]) -> Remplacé(e) ()
[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\ControlSet002\Services\Tcpip\Parameters | DhcpNameServer : ([-][(Private Address) (XX)]) -> Remplacé(e) ()
[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{66439100-3D04-468F-90CC-448D2F0DBCA5} | DhcpNameServer : ([-][(Private Address) (XX)]) -> Remplacé(e) ()
[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Tcpip\Parameters\Interfaces\{66439100-3D04-468F-90CC-448D2F0DBCA5} | DhcpNameServer : ([-][(Private Address) (XX)]) -> Remplacé(e) ()
[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\ControlSet002\Services\Tcpip\Parameters\Interfaces\{66439100-3D04-468F-90CC-448D2F0DBCA5} | DhcpNameServer : ([-][(Private Address) (XX)]) -> Remplacé(e) ()
[PUM.Policies] (X64) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System | ConsentPromptBehaviorAdmin : 2 -> Remplacé(e) (2)
[PUM.Policies] (X86) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System | ConsentPromptBehaviorAdmin : 2 -> Remplacé(e) (2)

¤¤¤ Tâches : 1 ¤¤¤
[Suspicious.Path] \Microsoft System Certificates -- C:\Users\hp\AppData\Roaming\Microsoft\SystemCertificates\My\Updater\updater.exe -> Non sélectionné

¤¤¤ Fichiers : 0 ¤¤¤

¤¤¤ Fichier Hosts : 1 ¤¤¤
[C:\Windows\System32\drivers\etc\hosts] 127.0.0.1 localhost

¤¤¤ Antirootkit : 12 (Driver: Non chargé [0xc000036b]) ¤¤¤
[IAT:Inl(Hook.IEAT)] (chrome.exe @ USER32.dll) ntdll.dll - NlsAnsiCodePage : Unknown @ 0xfffffffff6df3f19 (call 0x7f003f09)
[IAT:Inl(Hook.IEAT)] (chrome.exe @ USER32.dll) ntdll.dll - NlsAnsiCodePage : Unknown @ 0xffffffffd6df3f19 (call 0x5f003f09)
[IAT:Inl(Hook.IEAT)] (chrome.exe @ USER32.dll) ntdll.dll - NlsAnsiCodePage : Unknown @ 0x6fdf3f19 (call 0xf8003f09)
[IAT:Inl(Hook.IEAT)] (chrome.exe @ USER32.dll) ntdll.dll - NlsAnsiCodePage : Unknown @ 0x40df3f19 (call 0xc9003f09)
[IAT:Inl(Hook.IEAT)] (chrome.exe @ USER32.dll) ntdll.dll - NlsAnsiCodePage : Unknown @ 0x21df3f19 (call 0xaa003f09)
[IAT:Inl(Hook.IEAT)] (chrome.exe @ USER32.dll) ntdll.dll - NlsAnsiCodePage : Unknown @ 0xfffffffff2df3f19 (call 0x7b003f09)
[IAT:Inl(Hook.IEAT)] (chrome.exe @ USER32.dll) ntdll.dll - NlsAnsiCodePage : Unknown @ 0xffffffffc4df3f19 (call 0x4d003f09)
[IAT:Inl(Hook.IEAT)] (chrome.exe @ USER32.dll) ntdll.dll - NlsAnsiCodePage : Unknown @ 0x37df3f19 (call 0xc0003f09)
[IAT:Inl(Hook.IEAT)] (chrome.exe @ USER32.dll) ntdll.dll - NlsAnsiCodePage : Unknown @ 0xfffffffff8df3f19 (call 0x81003f09)
[IAT:Inl(Hook.IEAT)] (chrome.exe @ USER32.dll) ntdll.dll - NlsAnsiCodePage : Unknown @ 0xffffffffd7df3f19 (call 0x60003f09)
[IAT:Inl(Hook.IEAT)] (chrome.exe @ USER32.dll) ntdll.dll - NlsAnsiCodePage : Unknown @ 0x6df3f19 (call 0x8f003f09)
[IAT:Inl(Hook.IEAT)] (chrome.exe @ USER32.dll) ntdll.dll - NlsAnsiCodePage : Unknown @ 0x27df3f19 (call 0xb0003f09)

¤¤¤ Navigateurs web : 1 ¤¤¤
[PUP][FIREFX:Addon] ir8xr7q9.default : Hotspot Shield Helper (Please allow this installation) [afurladvisor@anchorfree.com] -> Non sélectionné

¤¤¤ Vérification MBR : ¤¤¤
+++++ PhysicalDrive0: TOSHIBA MK6476GSX ATA Device +++++
--- User ---
[MBR] 1a6b26332c0fa7ce902e04bbc3d709f7
[BSP] cd27ed3eb96aab5c994ff939e1f9cca6 : Windows Vista/7/8 MBR Code
Partition table:
0 - [ACTIVE] NTFS (0x7) [VISIBLE] Offset (sectors): 2048 | Size: 100 MB [Windows Vista/7/8 Bootstrap | Windows Vista/7/8 Bootloader]
1 - [XXXXXX] NTFS (0x7) [VISIBLE] Offset (sectors): 206848 | Size: 316722 MB [Windows Vista/7/8 Bootstrap | Windows Vista/7/8 Bootloader]
2 - [XXXXXX] NTFS (0x7) [VISIBLE] Offset (sectors): 648853504 | Size: 293656 MB [Windows Vista/7/8 Bootstrap | Windows Vista/7/8 Bootloader]
User = LL1 ... OK
User = LL2 ... OK


Publicité


Signaler le contenu de ce document

Publicité