cjoint

Publicité


Publicité

Format du document : text/plain

Prévisualisation

ÿþRogueKiller V11.0.12.0 [Feb 15 2016] (Free) (H'37) (1F'E, Adlice
'D(1J/ 'D%DC*1HFJ : http://www.adlice.com/contact/
Feedback : http://forum.adlice.com
'DEHB9 : http://www.adlice.com/software/roguekiller/
Blog : http://www.adlice.com

F8'E 'D*4:JD : Windows 7 (6.1.7601 Service Pack 1) 32 bits version
J(/# AJ : 'DH69 'D7(J9J
'DE3*./E : ameer [E3$HD]
Started from : C:\Users\ameer\Downloads\Programs\RogueKiller.exe
'DH69 : A-5 -- 'DJHE : 02/18/2016 19:05:34

¤¤¤ 'D9EDJ) : 5 ¤¤¤
[PUP|VT.FraudTool.YAC] iSafeSvc.exe(1004) -- C:\Program Files\Elex-tech\YAC\iSafeSvc.exe[7] -> *E -0A) [DrvNtTerm]
[PUP|VT.FraudTool.YAC] iSafeSvc2.exe(1112) -- C:\Program Files\Elex-tech\YAC\iSafeSvc2.exe[7] -> *E -0A) [TermThr]
[Suspicious.Path|VT.BrowserModifier:Win32/SupTab] WdMan.exe(2184) -- C:\ProgramData\OWdMO\WdMan.exe[-] -> *E -0A) [TermProc]
[PUP|VT.FraudTool.YAC] iSafeTray.exe(3296) -- C:\Program Files\Elex-tech\YAC\iSafeTray.exe[7] -> *E -0A) [TermThr]
[PUP|VT.FraudTool.YAC] iDskDllPatch.dll(2800) -- C:\Program Files\Elex-tech\YAC\iDskDllPatch.dll[7] -> :J1 E-ED

¤¤¤ 'DE3,D : 42 ¤¤¤
[PUP] HKEY_LOCAL_MACHINE\Software\Elex-tech -> H,/
[PUP] HKEY_LOCAL_MACHINE\Software\Hola -> H,/
[PUP] HKEY_LOCAL_MACHINE\Software\Picexa -> H,/
[PUP] HKEY_LOCAL_MACHINE\Software\RayDld -> H,/
[PUP] HKEY_LOCAL_MACHINE\Software\Tencent -> H,/
[PUP] HKEY_LOCAL_MACHINE\Software\Uniblue -> H,/
[PUP|VT.FraudTool.YAC] HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\iSafeKrnl (\??\C:\Program Files\Elex-tech\YAC\iSafeKrnl.sys) -> H,/
[PUP|VT.FraudTool.YAC] HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\iSafeKrnlBoot (system32\DRIVERS\iSafeKrnlBoot.sys) -> H,/
[PUP|VT.FraudTool.YAC] HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\iSafeKrnlKit (\??\C:\Program Files\Elex-tech\YAC\iSafeKrnlKit.sys) -> H,/
[PUP|VT.FraudTool.YAC] HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\iSafeKrnlR3 (\??\C:\Program Files\Elex-tech\YAC\iSafeKrnlR3.sys) -> H,/
[PUP|VT.FraudTool.YAC] HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\iSafeNetFilter (system32\DRIVERS\iSafeNetFilter.sys) -> H,/
[PUP|VT.FraudTool.YAC] HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\iSafeService (C:\Program Files\Elex-tech\YAC\iSafeSvc.exe) -> H,/
[Suspicious.Path|VT.BrowserModifier:Win32/SupTab] HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\WdMan (C:\ProgramData\OWdMO\WdMan.exe -svr) -> H,/
[PUP|VT.FraudTool.YAC] HKEY_LOCAL_MACHINE\System\ControlSet001\Services\iSafeKrnl (\??\C:\Program Files\Elex-tech\YAC\iSafeKrnl.sys) -> H,/
[PUP|VT.FraudTool.YAC] HKEY_LOCAL_MACHINE\System\ControlSet001\Services\iSafeKrnlBoot (system32\DRIVERS\iSafeKrnlBoot.sys) -> H,/
[PUP|VT.FraudTool.YAC] HKEY_LOCAL_MACHINE\System\ControlSet001\Services\iSafeKrnlKit (\??\C:\Program Files\Elex-tech\YAC\iSafeKrnlKit.sys) -> H,/
[PUP|VT.FraudTool.YAC] HKEY_LOCAL_MACHINE\System\ControlSet001\Services\iSafeKrnlR3 (\??\C:\Program Files\Elex-tech\YAC\iSafeKrnlR3.sys) -> H,/
[PUP|VT.FraudTool.YAC] HKEY_LOCAL_MACHINE\System\ControlSet001\Services\iSafeNetFilter (system32\DRIVERS\iSafeNetFilter.sys) -> H,/
[PUP|VT.FraudTool.YAC] HKEY_LOCAL_MACHINE\System\ControlSet001\Services\iSafeService (C:\Program Files\Elex-tech\YAC\iSafeSvc.exe) -> H,/
[Suspicious.Path|VT.BrowserModifier:Win32/SupTab] HKEY_LOCAL_MACHINE\System\ControlSet001\Services\WdMan (C:\ProgramData\OWdMO\WdMan.exe -svr) -> H,/
[PUP|VT.FraudTool.YAC] HKEY_LOCAL_MACHINE\System\ControlSet002\Services\iSafeKrnl (\??\C:\Program Files\Elex-tech\YAC\iSafeKrnl.sys) -> H,/
[PUP|VT.FraudTool.YAC] HKEY_LOCAL_MACHINE\System\ControlSet002\Services\iSafeKrnlBoot (system32\DRIVERS\iSafeKrnlBoot.sys) -> H,/
[PUP|VT.FraudTool.YAC] HKEY_LOCAL_MACHINE\System\ControlSet002\Services\iSafeKrnlKit (\??\C:\Program Files\Elex-tech\YAC\iSafeKrnlKit.sys) -> H,/
[PUP|VT.FraudTool.YAC] HKEY_LOCAL_MACHINE\System\ControlSet002\Services\iSafeKrnlR3 (\??\C:\Program Files\Elex-tech\YAC\iSafeKrnlR3.sys) -> H,/
[PUP|VT.FraudTool.YAC] HKEY_LOCAL_MACHINE\System\ControlSet002\Services\iSafeNetFilter (system32\DRIVERS\iSafeNetFilter.sys) -> H,/
[PUP|VT.FraudTool.YAC] HKEY_LOCAL_MACHINE\System\ControlSet002\Services\iSafeService (C:\Program Files\Elex-tech\YAC\iSafeSvc.exe) -> H,/
[Suspicious.Path|VT.BrowserModifier:Win32/SupTab] HKEY_LOCAL_MACHINE\System\ControlSet002\Services\WdMan (C:\ProgramData\OWdMO\WdMan.exe -svr) -> H,/
[PUM.Proxy] HKEY_USERS\S-1-5-21-1492318256-3304386808-505400124-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings | ProxyServer : http=127.0.0.1:8555;https=127.0.0.1:8555 -> H,/
[PUM.HomePage] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main | Start Page : http://www.yoursites123.com/?type=hp&ts=1449813463&z=4833ec2fa39884e55e25a68gdz0z6t1b4gacbzdw6b&from=ient07021&uid=HitachiXHDP725025GLA380_GEM264RS27Y2HM27Y2HMX -> H,/
[PUM.HomePage] HKEY_USERS\S-1-5-19\Software\Microsoft\Internet Explorer\Main | Start Page : http://www.v9.com/?type=hp&ts=1445840242&from=mych123&uid=hitachixhdp725025gla380_gem264rs27y2hm27y2hmx&z=c0f426b47d41ff2e71305b8gczfz2w0b7z2e6oaz8c -> H,/
[PUM.HomePage] HKEY_USERS\S-1-5-20\Software\Microsoft\Internet Explorer\Main | Start Page : http://www.v9.com/?type=hp&ts=1445840242&from=mych123&uid=hitachixhdp725025gla380_gem264rs27y2hm27y2hmx&z=c0f426b47d41ff2e71305b8gczfz2w0b7z2e6oaz8c -> H,/
[PUM.HomePage] HKEY_USERS\S-1-5-21-1492318256-3304386808-505400124-1000\Software\Microsoft\Internet Explorer\Main | Start Page : http://www.yoursites123.com/?type=hp&ts=1449813463&z=4833ec2fa39884e55e25a68gdz0z6t1b4gacbzdw6b&from=ient07021&uid=HitachiXHDP725025GLA380_GEM264RS27Y2HM27Y2HMX -> H,/
[PUM.HomePage] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main | Default_Page_URL : http://www.yoursites123.com/?type=hp&ts=1449813463&z=4833ec2fa39884e55e25a68gdz0z6t1b4gacbzdw6b&from=ient07021&uid=HitachiXHDP725025GLA380_GEM264RS27Y2HM27Y2HMX -> H,/
[PUM.HomePage] HKEY_USERS\S-1-5-19\Software\Microsoft\Internet Explorer\Main | Default_Page_URL : http://www.v9.com/?type=hp&ts=1445840242&from=mych123&uid=hitachixhdp725025gla380_gem264rs27y2hm27y2hmx&z=c0f426b47d41ff2e71305b8gczfz2w0b7z2e6oaz8c -> H,/
[PUM.HomePage] HKEY_USERS\S-1-5-20\Software\Microsoft\Internet Explorer\Main | Default_Page_URL : http://www.v9.com/?type=hp&ts=1445840242&from=mych123&uid=hitachixhdp725025gla380_gem264rs27y2hm27y2hmx&z=c0f426b47d41ff2e71305b8gczfz2w0b7z2e6oaz8c -> H,/
[PUM.HomePage] HKEY_USERS\S-1-5-21-1492318256-3304386808-505400124-1000\Software\Microsoft\Internet Explorer\Main | Default_Page_URL : http://www.yoursites123.com/?type=hp&ts=1449813463&z=4833ec2fa39884e55e25a68gdz0z6t1b4gacbzdw6b&from=ient07021&uid=HitachiXHDP725025GLA380_GEM264RS27Y2HM27Y2HMX -> H,/
[PUM.SearchPage] HKEY_USERS\S-1-5-21-1492318256-3304386808-505400124-1000\Software\Microsoft\Internet Explorer\Main | Search Bar : Preserve -> H,/
[PUM.Dns] HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{9DCDC237-D0E4-4087-901C-BFAF8477448F} | DhcpNameServer : 62.68.60.6 41.208.116.8 ([X][X]) -> H,/
[PUM.Dns] HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Tcpip\Parameters\Interfaces\{9DCDC237-D0E4-4087-901C-BFAF8477448F} | DhcpNameServer : 62.68.60.6 41.208.116.8 ([X][X]) -> H,/
[PUM.Dns] HKEY_LOCAL_MACHINE\System\ControlSet002\Services\Tcpip\Parameters\Interfaces\{9DCDC237-D0E4-4087-901C-BFAF8477448F} | DhcpNameServer : 62.68.60.6 41.208.116.8 ([X][X]) -> H,/
[PUM.Policies] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System | ConsentPromptBehaviorAdmin : 0 -> H,/
[PUM.StartMenu] HKEY_USERS\S-1-5-21-1492318256-3304386808-505400124-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced | Start_TrackProgs : 0 -> H,/

¤¤¤ 'DEG'E : 2 ¤¤¤
[Suspicious.Path] %WINDIR%\Tasks\GoogleUpdateTaskMachineUA.job -- C:\Program Files\Google\Update\GoogleUpdate.exe (/ua /installsource scheduler) -> H,/
[Suspicious.Path] \GoogleUpdateTaskMachineUA -- C:\Program Files\Google\Update\GoogleUpdate.exe (/ua /installsource scheduler) -> H,/

¤¤¤ 'DEDA'* : 6 ¤¤¤
[PUP][EDA] C:\Users\Emad\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\QQ??.lnk [LNK@] C:\Program Files\Tencent\QQPlayer\QQPlayer.exe -> H,/
[PUP][EDA] C:\ProgramData\{1C6FDDD8-FC9E-4C12-9FA5-1AAD377097B3} -> H,/
[PUP][EDA] C:\Program Files\Elex-tech -> H,/
[PUP][EDA] C:\Program Files\Hola -> H,/
[PUP][EDA] C:\Program Files\Uniblue -> H,/
[PUP][EDA] C:\Program Files\WinZipper -> H,/

¤¤¤ EDA 'DGH3* : 0 ¤¤¤

¤¤¤ Antirootkit : 100 (Driver: E-ED) ¤¤¤
[IAT:Addr(Hook.IEAT|VT.FraudTool.YAC)] (explorer.exe) USER32!MoveWindow : C:\Program Files\Elex-tech\YAC\iDskDllPatch.dll @ 0x72d11880
[IAT:Addr(Hook.IEAT|VT.FraudTool.YAC)] (explorer.exe) USER32!SetWindowPos : C:\Program Files\Elex-tech\YAC\iDskDllPatch.dll @ 0x72d119d0
[IAT:Addr(Hook.IEAT|VT.FraudTool.YAC)] (explorer.exe) USER32!EndPaint : C:\Program Files\Elex-tech\YAC\iDskDllPatch.dll @ 0x72d11c80
[IAT:Addr(Hook.IEAT|VT.FraudTool.YAC)] (explorer.exe) USER32!DeferWindowPos : C:\Program Files\Elex-tech\YAC\iDskDllPatch.dll @ 0x72d11b10
[IAT:Addr(Hook.IEAT|VT.FraudTool.YAC)] (explorer.exe @ SHELL32.dll) USER32!DeferWindowPos : C:\Program Files\Elex-tech\YAC\iDskDllPatch.dll @ 0x72d11b10
[IAT:Addr(Hook.IEAT|VT.FraudTool.YAC)] (explorer.exe @ SHELL32.dll) USER32!MoveWindow : C:\Program Files\Elex-tech\YAC\iDskDllPatch.dll @ 0x72d11880
[IAT:Addr(Hook.IEAT|VT.FraudTool.YAC)] (explorer.exe @ SHELL32.dll) USER32!SetWindowPos : C:\Program Files\Elex-tech\YAC\iDskDllPatch.dll @ 0x72d119d0
[IAT:Addr(Hook.IEAT|VT.FraudTool.YAC)] (explorer.exe @ SHELL32.dll) USER32!EndPaint : C:\Program Files\Elex-tech\YAC\iDskDllPatch.dll @ 0x72d11c80
[IAT:Addr(Hook.IEAT|VT.FraudTool.YAC)] (explorer.exe @ ole32.dll) USER32!MoveWindow : C:\Program Files\Elex-tech\YAC\iDskDllPatch.dll @ 0x72d11880
[IAT:Addr(Hook.IEAT|VT.FraudTool.YAC)] (explorer.exe @ EXPLORERFRAME.dll) USER32!EndPaint : C:\Program Files\Elex-tech\YAC\iDskDllPatch.dll @ 0x72d11c80
[IAT:Addr(Hook.IEAT|VT.FraudTool.YAC)] (explorer.exe @ EXPLORERFRAME.dll) USER32!MoveWindow : C:\Program Files\Elex-tech\YAC\iDskDllPatch.dll @ 0x72d11880
[IAT:Addr(Hook.IEAT|VT.FraudTool.YAC)] (explorer.exe @ EXPLORERFRAME.dll) USER32!SetWindowPos : C:\Program Files\Elex-tech\YAC\iDskDllPatch.dll @ 0x72d119d0
[IAT:Addr(Hook.IEAT|VT.FraudTool.YAC)] (explorer.exe @ DUser.dll) USER32!EndPaint : C:\Program Files\Elex-tech\YAC\iDskDllPatch.dll @ 0x72d11c80
[IAT:Addr(Hook.IEAT|VT.FraudTool.YAC)] (explorer.exe @ DUI70.dll) USER32!SetWindowPos : C:\Program Files\Elex-tech\YAC\iDskDllPatch.dll @ 0x72d119d0
[IAT:Addr(Hook.IEAT|VT.FraudTool.YAC)] (explorer.exe @ IMM32.dll) USER32!EndPaint : C:\Program Files\Elex-tech\YAC\iDskDllPatch.dll @ 0x72d11c80
[IAT:Addr(Hook.IEAT|VT.FraudTool.YAC)] (explorer.exe @ IMM32.dll) USER32!SetWindowPos : C:\Program Files\Elex-tech\YAC\iDskDllPatch.dll @ 0x72d119d0
[IAT:Addr(Hook.IEAT|VT.FraudTool.YAC)] (explorer.exe @ MSCTF.dll) USER32!MoveWindow : C:\Program Files\Elex-tech\YAC\iDskDllPatch.dll @ 0x72d11880
[IAT:Addr(Hook.IEAT|VT.FraudTool.YAC)] (explorer.exe @ MSCTF.dll) USER32!SetWindowPos : C:\Program Files\Elex-tech\YAC\iDskDllPatch.dll @ 0x72d119d0
[IAT:Addr(Hook.IEAT|VT.FraudTool.YAC)] (explorer.exe @ MSCTF.dll) USER32!EndPaint : C:\Program Files\Elex-tech\YAC\iDskDllPatch.dll @ 0x72d11c80
[IAT:Addr(Hook.IEAT|VT.FraudTool.YAC)] (explorer.exe @ UxTheme.dll) USER32!SetWindowPos : C:\Program Files\Elex-tech\YAC\iDskDllPatch.dll @ 0x72d119d0
[IAT:Addr(Hook.IEAT|VT.FraudTool.YAC)] (explorer.exe @ SETUPAPI.dll) USER32!MoveWindow : C:\Program Files\Elex-tech\YAC\iDskDllPatch.dll @ 0x72d11880
[IAT:Addr(Hook.IEAT|VT.FraudTool.YAC)] (explorer.exe @ SETUPAPI.dll) USER32!SetWindowPos : C:\Program Files\Elex-tech\YAC\iDskDllPatch.dll @ 0x72d119d0
[IAT:Addr(Hook.IEAT|VT.FraudTool.YAC)] (explorer.exe @ COMCTL32.dll) USER32!DeferWindowPos : C:\Program Files\Elex-tech\YAC\iDskDllPatch.dll @ 0x72d11b10
[IAT:Addr(Hook.IEAT|VT.FraudTool.YAC)] (explorer.exe @ COMCTL32.dll) USER32!SetWindowPos : C:\Program Files\Elex-tech\YAC\iDskDllPatch.dll @ 0x72d119d0
[IAT:Addr(Hook.IEAT|VT.FraudTool.YAC)] (explorer.exe @ COMCTL32.dll) USER32!MoveWindow : C:\Program Files\Elex-tech\YAC\iDskDllPatch.dll @ 0x72d11880
[IAT:Addr(Hook.IEAT|VT.FraudTool.YAC)] (explorer.exe @ COMCTL32.dll) USER32!EndPaint : C:\Program Files\Elex-tech\YAC\iDskDllPatch.dll @ 0x72d11c80
[IAT:Addr(Hook.IEAT|VT.FraudTool.YAC)] (explorer.exe @ CLBCatQ.DLL) USER32!SetWindowPos : C:\Program Files\Elex-tech\YAC\iDskDllPatch.dll @ 0x72d119d0
[IAT:Addr(Hook.IEAT|VT.FraudTool.YAC)] (explorer.exe @ msi.dll) USER32!MoveWindow : C:\Program Files\Elex-tech\YAC\iDskDllPatch.dll @ 0x72d11880
[IAT:Addr(Hook.IEAT|VT.FraudTool.YAC)] (explorer.exe @ msi.dll) USER32!SetWindowPos : C:\Program Files\Elex-tech\YAC\iDskDllPatch.dll @ 0x72d119d0
[IAT:Addr(Hook.IEAT|VT.FraudTool.YAC)] (explorer.exe @ GR469A~1.DLL) USER32!SetWindowPos : C:\Program Files\Elex-tech\YAC\iDskDllPatch.dll @ 0x72d119d0
[IAT:Addr(Hook.IEAT|VT.FraudTool.YAC)] (explorer.exe @ GR469A~1.DLL) USER32!EndPaint : C:\Program Files\Elex-tech\YAC\iDskDllPatch.dll @ 0x72d11c80
[IAT:Addr(Hook.IEAT|VT.FraudTool.YAC)] (explorer.exe @ GrooveUtil.DLL) USER32!EndPaint : C:\Program Files\Elex-tech\YAC\iDskDllPatch.dll @ 0x72d11c80
[IAT:Addr(Hook.IEAT|VT.FraudTool.YAC)] (explorer.exe @ cscui.dll) USER32!SetWindowPos : C:\Program Files\Elex-tech\YAC\iDskDllPatch.dll @ 0x72d119d0
[IAT:Addr(Hook.IEAT|VT.FraudTool.YAC)] (explorer.exe @ ntshrui.dll) USER32!SetWindowPos : C:\Program Files\Elex-tech\YAC\iDskDllPatch.dll @ 0x72d119d0
[IAT:Addr(Hook.IEAT|VT.FraudTool.YAC)] (explorer.exe @ ntshrui.dll) USER32!DeferWindowPos : C:\Program Files\Elex-tech\YAC\iDskDllPatch.dll @ 0x72d11b10
[IAT:Addr(Hook.IEAT|VT.FraudTool.YAC)] (explorer.exe @ timedate.cpl) USER32!SetWindowPos : C:\Program Files\Elex-tech\YAC\iDskDllPatch.dll @ 0x72d119d0
[IAT:Addr(Hook.IEAT|VT.FraudTool.YAC)] (explorer.exe @ timedate.cpl) USER32!MoveWindow : C:\Program Files\Elex-tech\YAC\iDskDllPatch.dll @ 0x72d11880
[IAT:Addr(Hook.IEAT|VT.FraudTool.YAC)] (explorer.exe @ timedate.cpl) USER32!EndPaint : C:\Program Files\Elex-tech\YAC\iDskDllPatch.dll @ 0x72d11c80
[IAT:Addr(Hook.IEAT|VT.FraudTool.YAC)] (explorer.exe @ ATL.DLL) USER32!SetWindowPos : C:\Program Files\Elex-tech\YAC\iDskDllPatch.dll @ 0x72d119d0
[IAT:Addr(Hook.IEAT|VT.FraudTool.YAC)] (explorer.exe @ ATL.DLL) USER32!EndPaint : C:\Program Files\Elex-tech\YAC\iDskDllPatch.dll @ 0x72d11c80
[IAT:Addr(Hook.IEAT|VT.FraudTool.YAC)] (explorer.exe @ shdocvw.dll) USER32!EndPaint : C:\Program Files\Elex-tech\YAC\iDskDllPatch.dll @ 0x72d11c80
[IAT:Addr(Hook.IEAT|VT.FraudTool.YAC)] (explorer.exe @ shdocvw.dll) USER32!SetWindowPos : C:\Program Files\Elex-tech\YAC\iDskDllPatch.dll @ 0x72d119d0
[IAT:Addr(Hook.IEAT|VT.FraudTool.YAC)] (explorer.exe @ msutb.dll) USER32!MoveWindow : C:\Program Files\Elex-tech\YAC\iDskDllPatch.dll @ 0x72d11880
[IAT:Addr(Hook.IEAT|VT.FraudTool.YAC)] (explorer.exe @ msutb.dll) USER32!SetWindowPos : C:\Program Files\Elex-tech\YAC\iDskDllPatch.dll @ 0x72d119d0
[IAT:Addr(Hook.IEAT|VT.FraudTool.YAC)] (explorer.exe @ msutb.dll) USER32!EndPaint : C:\Program Files\Elex-tech\YAC\iDskDllPatch.dll @ 0x72d11c80
[IAT:Addr(Hook.IEAT|VT.FraudTool.YAC)] (explorer.exe @ MsftEdit.dll) USER32!SetWindowPos : C:\Program Files\Elex-tech\YAC\iDskDllPatch.dll @ 0x72d119d0
[IAT:Addr(Hook.IEAT|VT.FraudTool.YAC)] (explorer.exe @ MsftEdit.dll) USER32!EndPaint : C:\Program Files\Elex-tech\YAC\iDskDllPatch.dll @ 0x72d11c80
[IAT:Addr(Hook.IEAT|VT.FraudTool.YAC)] (explorer.exe @ MsftEdit.dll) USER32!MoveWindow : C:\Program Files\Elex-tech\YAC\iDskDllPatch.dll @ 0x72d11880
[IAT:Addr(Hook.IEAT|VT.FraudTool.YAC)] (explorer.exe @ authui.dll) USER32!SetWindowPos : C:\Program Files\Elex-tech\YAC\iDskDllPatch.dll @ 0x72d119d0
[IAT:Addr(Hook.IEAT|VT.FraudTool.YAC)] (explorer.exe @ authui.dll) USER32!EndPaint : C:\Program Files\Elex-tech\YAC\iDskDllPatch.dll @ 0x72d11c80
[IAT:Addr(Hook.IEAT|VT.FraudTool.YAC)] (explorer.exe @ authui.dll) USER32!MoveWindow : C:\Program Files\Elex-tech\YAC\iDskDllPatch.dll @ 0x72d11880
[IAT:Addr(Hook.IEAT|VT.FraudTool.YAC)] (explorer.exe @ CRYPTUI.dll) USER32!MoveWindow : C:\Program Files\Elex-tech\YAC\iDskDllPatch.dll @ 0x72d11880
[IAT:Addr(Hook.IEAT|VT.FraudTool.YAC)] (explorer.exe @ CRYPTUI.dll) USER32!EndPaint : C:\Program Files\Elex-tech\YAC\iDskDllPatch.dll @ 0x72d11c80
[IAT:Addr(Hook.IEAT|VT.FraudTool.YAC)] (explorer.exe @ CRYPTUI.dll) USER32!SetWindowPos : C:\Program Files\Elex-tech\YAC\iDskDllPatch.dll @ 0x72d119d0
[IAT:Addr(Hook.IEAT|VT.FraudTool.YAC)] (explorer.exe @ urlmon.dll) USER32!SetWindowPos : C:\Program Files\Elex-tech\YAC\iDskDllPatch.dll @ 0x72d119d0
[IAT:Addr(Hook.IEAT|VT.FraudTool.YAC)] (explorer.exe @ MSACM32.dll) USER32!MoveWindow : C:\Program Files\Elex-tech\YAC\iDskDllPatch.dll @ 0x72d11880
[IAT:Addr(Hook.IEAT|VT.FraudTool.YAC)] (explorer.exe @ stobject.dll) USER32!SetWindowPos : C:\Program Files\Elex-tech\YAC\iDskDllPatch.dll @ 0x72d119d0
[IAT:Addr(Hook.IEAT|VT.FraudTool.YAC)] (explorer.exe @ es.dll) USER32!SetWindowPos : C:\Program Files\Elex-tech\YAC\iDskDllPatch.dll @ 0x72d119d0
[IAT:Addr(Hook.IEAT|VT.FraudTool.YAC)] (explorer.exe @ dxp.dll) USER32!SetWindowPos : C:\Program Files\Elex-tech\YAC\iDskDllPatch.dll @ 0x72d119d0
[IAT:Addr(Hook.IEAT|VT.FraudTool.YAC)] (explorer.exe @ netshell.dll) USER32!MoveWindow : C:\Program Files\Elex-tech\YAC\iDskDllPatch.dll @ 0x72d11880
[IAT:Addr(Hook.IEAT|VT.FraudTool.YAC)] (explorer.exe @ netshell.dll) USER32!EndPaint : C:\Program Files\Elex-tech\YAC\iDskDllPatch.dll @ 0x72d11c80
[IAT:Addr(Hook.IEAT|VT.FraudTool.YAC)] (explorer.exe @ netshell.dll) USER32!SetWindowPos : C:\Program Files\Elex-tech\YAC\iDskDllPatch.dll @ 0x72d119d0
[IAT:Addr(Hook.IEAT|VT.FraudTool.YAC)] (explorer.exe @ AltTab.dll) USER32!EndPaint : C:\Program Files\Elex-tech\YAC\iDskDllPatch.dll @ 0x72d11c80
[IAT:Addr(Hook.IEAT|VT.FraudTool.YAC)] (explorer.exe @ AltTab.dll) USER32!SetWindowPos : C:\Program Files\Elex-tech\YAC\iDskDllPatch.dll @ 0x72d119d0
[IAT:Addr(Hook.IEAT|VT.FraudTool.YAC)] (explorer.exe @ pnidui.dll) USER32!SetWindowPos : C:\Program Files\Elex-tech\YAC\iDskDllPatch.dll @ 0x72d119d0
[IAT:Addr(Hook.IEAT|VT.FraudTool.YAC)] (explorer.exe @ PhoneBrowser.dll) USER32!SetWindowPos : C:\Program Files\Elex-tech\YAC\iDskDllPatch.dll @ 0x72d119d0
[IAT:Addr(Hook.IEAT|VT.FraudTool.YAC)] (explorer.exe @ PhoneBrowser.dll) USER32!EndPaint : C:\Program Files\Elex-tech\YAC\iDskDllPatch.dll @ 0x72d11c80
[IAT:Addr(Hook.IEAT|VT.FraudTool.YAC)] (explorer.exe @ PhoneBrowser.dll) USER32!MoveWindow : C:\Program Files\Elex-tech\YAC\iDskDllPatch.dll @ 0x72d11880
[IAT:Addr(Hook.IEAT|VT.FraudTool.YAC)] (explorer.exe @ NGSCM.DLL) USER32!SetWindowPos : C:\Program Files\Elex-tech\YAC\iDskDllPatch.dll @ 0x72d119d0
[IAT:Addr(Hook.IEAT|VT.FraudTool.YAC)] (explorer.exe @ NGSCM.DLL) USER32!EndPaint : C:\Program Files\Elex-tech\YAC\iDskDllPatch.dll @ 0x72d11c80
[IAT:Addr(Hook.IEAT|VT.FraudTool.YAC)] (explorer.exe @ NGSCM.DLL) USER32!MoveWindow : C:\Program Files\Elex-tech\YAC\iDskDllPatch.dll @ 0x72d11880
[IAT:Addr(Hook.IEAT|VT.FraudTool.YAC)] (explorer.exe @ COMDLG32.dll) USER32!SetWindowPos : C:\Program Files\Elex-tech\YAC\iDskDllPatch.dll @ 0x72d119d0
[IAT:Addr(Hook.IEAT|VT.FraudTool.YAC)] (explorer.exe @ COMDLG32.dll) USER32!EndPaint : C:\Program Files\Elex-tech\YAC\iDskDllPatch.dll @ 0x72d11c80
[IAT:Addr(Hook.IEAT|VT.FraudTool.YAC)] (explorer.exe @ COMDLG32.dll) USER32!DeferWindowPos : C:\Program Files\Elex-tech\YAC\iDskDllPatch.dll @ 0x72d11b10
[IAT:Addr(Hook.IEAT|VT.FraudTool.YAC)] (explorer.exe @ COMDLG32.dll) USER32!MoveWindow : C:\Program Files\Elex-tech\YAC\iDskDllPatch.dll @ 0x72d11880
[IAT:Addr(Hook.IEAT|VT.FraudTool.YAC)] (explorer.exe @ srchadmin.dll) USER32!SetWindowPos : C:\Program Files\Elex-tech\YAC\iDskDllPatch.dll @ 0x72d119d0
[IAT:Addr(Hook.IEAT|VT.FraudTool.YAC)] (explorer.exe @ srchadmin.dll) USER32!DeferWindowPos : C:\Program Files\Elex-tech\YAC\iDskDllPatch.dll @ 0x72d11b10
[IAT:Addr(Hook.IEAT|VT.FraudTool.YAC)] (explorer.exe @ bthprops.cpl) USER32!DeferWindowPos : C:\Program Files\Elex-tech\YAC\iDskDllPatch.dll @ 0x72d11b10
[IAT:Addr(Hook.IEAT|VT.FraudTool.YAC)] (explorer.exe @ bthprops.cpl) USER32!SetWindowPos : C:\Program Files\Elex-tech\YAC\iDskDllPatch.dll @ 0x72d119d0
[IAT:Addr(Hook.IEAT|VT.FraudTool.YAC)] (explorer.exe @ Actioncenter.dll) USER32!SetWindowPos : C:\Program Files\Elex-tech\YAC\iDskDllPatch.dll @ 0x72d119d0
[IAT:Addr(Hook.IEAT|VT.FraudTool.YAC)] (explorer.exe @ fxsst.dll) USER32!MoveWindow : C:\Program Files\Elex-tech\YAC\iDskDllPatch.dll @ 0x72d11880
[IAT:Addr(Hook.IEAT|VT.FraudTool.YAC)] (explorer.exe @ fxsst.dll) USER32!SetWindowPos : C:\Program Files\Elex-tech\YAC\iDskDllPatch.dll @ 0x72d119d0
[IAT:Addr(Hook.IEAT|VT.FraudTool.YAC)] (explorer.exe @ hgcpl.dll) USER32!SetWindowPos : C:\Program Files\Elex-tech\YAC\iDskDllPatch.dll @ 0x72d119d0
[IAT:Addr(Hook.IEAT|VT.FraudTool.YAC)] (explorer.exe @ hgcpl.dll) USER32!EndPaint : C:\Program Files\Elex-tech\YAC\iDskDllPatch.dll @ 0x72d11c80
[IAT:Addr(Hook.IEAT|VT.FraudTool.YAC)] (explorer.exe @ ieframe.DLL) USER32!SetWindowPos : C:\Program Files\Elex-tech\YAC\iDskDllPatch.dll @ 0x72d119d0
[IAT:Addr(Hook.IEAT|VT.FraudTool.YAC)] (explorer.exe @ ieframe.DLL) USER32!MoveWindow : C:\Program Files\Elex-tech\YAC\iDskDllPatch.dll @ 0x72d11880
[IAT:Addr(Hook.IEAT|VT.FraudTool.YAC)] (explorer.exe @ ieframe.DLL) USER32!EndPaint : C:\Program Files\Elex-tech\YAC\iDskDllPatch.dll @ 0x72d11c80
[IAT:Addr(Hook.IEAT|VT.FraudTool.YAC)] (explorer.exe @ ieframe.DLL) USER32!DeferWindowPos : C:\Program Files\Elex-tech\YAC\iDskDllPatch.dll @ 0x72d11b10
[IAT:Addr(Hook.IEAT|VT.FraudTool.YAC)] (explorer.exe @ wscui.cpl) USER32!EndPaint : C:\Program Files\Elex-tech\YAC\iDskDllPatch.dll @ 0x72d11c80
[IAT:Addr(Hook.IEAT|VT.FraudTool.YAC)] (explorer.exe @ werconcpl.dll) USER32!EndPaint : C:\Program Files\Elex-tech\YAC\iDskDllPatch.dll @ 0x72d11c80
[IAT:Addr(Hook.IEAT|VT.FraudTool.YAC)] (explorer.exe @ werconcpl.dll) USER32!MoveWindow : C:\Program Files\Elex-tech\YAC\iDskDllPatch.dll @ 0x72d11880
[IAT:Addr(Hook.IEAT|VT.FraudTool.YAC)] (explorer.exe @ werconcpl.dll) USER32!SetWindowPos : C:\Program Files\Elex-tech\YAC\iDskDllPatch.dll @ 0x72d119d0
[IAT:Addr(Hook.IEAT|VT.FraudTool.YAC)] (explorer.exe @ wpdshext.dll) USER32!SetWindowPos : C:\Program Files\Elex-tech\YAC\iDskDllPatch.dll @ 0x72d119d0
[IAT:Inl(Hook.IEAT)] (chrome.exe @ KERNEL32.dll) ntdll!LdrUnloadDll : Unknown @ 0x271903fc (jmp 0xaf803b1e|jmp 0x4ad8d564)
[IAT:Inl(Hook.IEAT)] (chrome.exe @ KERNEL32.dll) ntdll!LdrUnloadDll : Unknown @ 0x67b003fc (jmp 0xf0173b1e|jmp 0xa41d564)
[IAT:Inl(Hook.IEAT)] (chrome.exe @ KERNEL32.dll) ntdll!LdrUnloadDll : Unknown @ 0x1d5a03fc (jmp 0xa5c13b1e|jmp 0x5497d564)
[IAT:Inl(Hook.IEAT)] (chrome.exe @ KERNEL32.dll) ntdll!LdrUnloadDll : Unknown @ 0x286d03fc (jmp 0xb0d43b1e|jmp 0x4984d564)
[IAT:Inl(Hook.IEAT)] (chrome.exe @ KERNEL32.dll) ntdll!LdrUnloadDll : Unknown @ 0x32dd03fc (jmp 0xbb443b1e|jmp 0x3f14d564)
[IAT:Inl(Hook.IEAT)] (chrome.exe @ KERNEL32.dll) ntdll!LdrUnloadDll : Unknown @ 0x6da303fc (jmp 0xf60a3b1e|jmp 0x44ed564)
[IAT:Inl(Hook.IEAT)] (chrome.exe @ KERNEL32.dll) ntdll!LdrUnloadDll : Unknown @ 0x7bd503fc (jmp 0x43c3b1e|jmp 0xf61cd564)

¤¤¤ 'DE*5A- : 0 ¤¤¤

¤¤¤ A-5 'D MBR : ¤¤¤
+++++ PhysicalDrive0: Hitachi HDP725025GLA380 ATA Device +++++
--- User ---
[MBR] b8a121a1f9a0cfc42cd5d621cae45843
[BSP] 04eb1892f23d3a96192c9cce4c22309c : Windows Vista/7/8|VT.Unknown MBR Code
Partition table:
0 - [ACTIVE] NTFS (0x7) [VISIBLE] Offset (sectors): 2048 | Size: 100005 MB [Windows Vista/7/8 Bootstrap | Windows Vista/7/8 Bootloader]
1 - [XXXXXX] NTFS (0x7) [VISIBLE] Offset (sectors): 204812685 | Size: 138466 MB [Windows XP Bootstrap | Windows XP Bootloader]
User = LL1 ... OK
User = LL2 ... OK

+++++ PhysicalDrive1: Hitachi HDP725025GLA380 ATA Device +++++
--- User ---
[MBR] 550238605925873b81c6e4df9b789e18
[BSP] 9adf037b297fbf9899145f25ad809d6c : Windows Vista/7/8|VT.Unknown MBR Code
Partition table:
0 - [ACTIVE] NTFS (0x7) [VISIBLE] Offset (sectors): 63 | Size: 49332 MB [Windows Vista/7/8 Bootstrap | Windows Vista/7/8 Bootloader]
1 - [XXXXXX] EXTEN-LBA (0xf) [VISIBLE] Offset (sectors): 101048844 | Size: 189124 MB
User = LL1 ... OK
User = LL2 ... OK


Publicité


Signaler le contenu de ce document

Publicité