cjoint

Publicité


Publicité

Format du document : text/plain

Prévisualisation

ÿþRogueKiller V12.0.3.0 [Mar 21 2016] (Free) (H'37) (1F'E, Adlice
'D(1J/ 'D%DC*1HFJ : http://www.adlice.com/contact/
Feedback : http://forum.adlice.com
'DEHB9 : http://www.adlice.com/software/roguekiller/
Blog : http://www.adlice.com

F8'E 'D*4:JD : Windows 8.1 (6.3.9600) 64 bits version
J(/# AJ : 'DH69 'D7(J9J
'DE3*./E : MouiMou_2 [E3$HD]
Started from : C:\Users\MouiMou_2\Desktop\RogueKiller.exe
'DH69 : A-5 -- 'DJHE : 03/28/2016 01:55:15

¤¤¤ 'D9EDJ) : 2 ¤¤¤
[Suspicious.Path|VT.HackTool:Win32/AutoKMS] KMSSS.exe(1760) -- C:\ProgramData\KMSAutoS\bin\KMSSS.exe[x] -> H,/
[Suspicious.Path|VT.HackTool:Win32/AutoKMS] (SVC) KMSEmulator -- "C:\ProgramData\KMSAutoS\bin\KMSSS.exe" -Port 1688 -PWin RandomKMSPID -PO14 RandomKMSPID -PO15 RandomKMSPID -AI 43200 -RI 43200 KillProcessOnPort -Log -IP[x] -> H,/

¤¤¤ 'DE3,D : 17 ¤¤¤
[PUP] (X64) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\.QMDeskTopGCIcon | (default) : {B7667919-3765-4815-A66D-98A09BE662D6} -> H,/
[Suspicious.Path|VT.HackTool:Win32/AutoKMS] (X64) HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\KMSEmulator ("C:\ProgramData\KMSAutoS\bin\KMSSS.exe" -Port 1688 -PWin RandomKMSPID -PO14 RandomKMSPID -PO15 RandomKMSPID -AI 43200 -RI 43200 KillProcessOnPort -Log -IP) -> H,/
[PUP] (X64) HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\TSDefenseBt (\??\C:\Program Files (x86)\Tencent\QQPCMgr\11.4.17339.217\TSDefenseBT64.sys) -> H,/
[Suspicious.Path|VT.HackTool:Win32/AutoKMS] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\KMSEmulator ("C:\ProgramData\KMSAutoS\bin\KMSSS.exe" -Port 1688 -PWin RandomKMSPID -PO14 RandomKMSPID -PO15 RandomKMSPID -AI 43200 -RI 43200 KillProcessOnPort -Log -IP) -> H,/
[PUP] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\TSDefenseBt (\??\C:\Program Files (x86)\Tencent\QQPCMgr\11.4.17339.217\TSDefenseBT64.sys) -> H,/
[PUM.SearchPage] (X64) HKEY_USERS\S-1-5-21-2231676356-680805681-2855567490-1002\Software\Microsoft\Internet Explorer\Main | Search Page : http://www.bing.com/search?q={searchTerms} -> H,/
[PUM.SearchPage] (X86) HKEY_USERS\S-1-5-21-2231676356-680805681-2855567490-1002\Software\Microsoft\Internet Explorer\Main | Search Page : http://www.bing.com/search?q={searchTerms} -> H,/
[PUM.SearchPage] (X64) HKEY_USERS\S-1-5-21-2231676356-680805681-2855567490-1002\Software\Microsoft\Internet Explorer\Main | Search Bar : http://www.bing.com/search?q={searchTerms} -> H,/
[PUM.SearchPage] (X86) HKEY_USERS\S-1-5-21-2231676356-680805681-2855567490-1002\Software\Microsoft\Internet Explorer\Main | Search Bar : http://www.bing.com/search?q={searchTerms} -> H,/
[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters | DhcpNameServer : 192.168.1.1 0.0.0.0 ([-][X]) -> H,/
[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Tcpip\Parameters | DhcpNameServer : 192.168.1.1 0.0.0.0 ([-][X]) -> H,/
[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{1AC93C44-CEB1-476D-9613-94F29F8D7302} | DhcpNameServer : 43.249.38.68 43.249.38.70 ([X][-]) -> H,/
[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{B113BC25-FFB8-486A-8F62-6FBD99C3BF47} | DhcpNameServer : 192.168.1.1 0.0.0.0 ([-][X]) -> H,/
[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{B98279C9-2939-4C7E-A4D6-1AD26059F2A2} | DhcpNameServer : 192.168.1.1 0.0.0.0 ([-][X]) -> H,/
[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Tcpip\Parameters\Interfaces\{1AC93C44-CEB1-476D-9613-94F29F8D7302} | DhcpNameServer : 43.249.38.68 43.249.38.70 ([X][-]) -> H,/
[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Tcpip\Parameters\Interfaces\{B113BC25-FFB8-486A-8F62-6FBD99C3BF47} | DhcpNameServer : 192.168.1.1 0.0.0.0 ([-][X]) -> H,/
[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Tcpip\Parameters\Interfaces\{B98279C9-2939-4C7E-A4D6-1AD26059F2A2} | DhcpNameServer : 192.168.1.1 0.0.0.0 ([-][X]) -> H,/

¤¤¤ 'DEG'E : 2 ¤¤¤
[Suspicious.Path] %WINDIR%\Tasks\GoogleUpdateTaskMachineUA.job -- C:\Program Files (x86)\Google\Update\GoogleUpdate.exe (/ua /installsource scheduler) -> H,/
[Suspicious.Path] \GoogleUpdateTaskMachineUA -- C:\Program Files (x86)\Google\Update\GoogleUpdate.exe (/ua /installsource scheduler) -> H,/

¤¤¤ 'DEDA'* : 9 ¤¤¤
[PUP][EDA] C:\Users\MouiMou_2\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Online Soccer Manager Hack v 4.0.0.lnk [LNK@] C:\ProgramData\{76042086-6b5d-6874-7604-420866b58219}\Online Soccer Manager Hack v 4.0.0.exe --startup=1 -> H,/
[PUP][EDA] C:\Users\MouiMou_2\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Online Soccer Manager Hack.lnk [LNK@] C:\ProgramData\{09be4c16-41f7-cefc-09be-e4c1641f3059}\Online Soccer Manager Hack.exe --startup=1 -> H,/
[Hidden.ADS][Stream] C:\Users\MouiMou_2\AppData\Roaming:NT -> H,/
[Hidden.ADS][Stream] C:\Users\MouiMou_2\AppData\Roaming:NT2 -> H,/
[PUP][EDA] C:\Users\MouiMou_2\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Online Soccer Manager Hack v 4.0.0.lnk [LNK@] C:\ProgramData\{76042086-6b5d-6874-7604-420866b58219}\Online Soccer Manager Hack v 4.0.0.exe --startup=1 -> H,/
[PUP][EDA] C:\Users\MouiMou_2\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Online Soccer Manager Hack.lnk [LNK@] C:\ProgramData\{09be4c16-41f7-cefc-09be-e4c1641f3059}\Online Soccer Manager Hack.exe --startup=1 -> H,/
[Hidden.ADS][Stream] C:\ProgramData:NT -> H,/
[Hidden.ADS][Stream] C:\ProgramData:NT2 -> H,/
[Hj.Name][EDA] C:\$Recycle.Bin\S-1-5-21-2231676356-680805681-2855567490-1002\$R2VJIZ2\I386\SYSTEM32\SMSS.EXE -> H,/

¤¤¤ EDA 'DGH3* : 0 ¤¤¤

¤¤¤ Antirootkit : 0 (Driver: DE J*E 'D*-EJD [0xc000036b]) ¤¤¤

¤¤¤ 'DE*5A- : 1 ¤¤¤
[PUM.HomePage][FIREFX:Config] CCACCBF1-7AB4-4CF5-B32D-668C686A539F : user_pref("browser.startup.homepage", "http://www.hohosearch.com/?ts=AHEpCH4lAn4nAU..&v=20160323&uid=B7DB45E91869FAED2AB403D1661638F7&ptid=amz&mode=ffseng"); -> H,/

¤¤¤ A-5 'D MBR : ¤¤¤
+++++ PhysicalDrive0: ST500LM012 HN-M500MBB +++++
--- User ---
[MBR] 7ad22948d68fe8500709c06b834e5b5b
[BSP] 307f79ecd0b9f0d18dabfd6fc9a293b6 : Windows Vista/7/8|VT.Unknown MBR Code
Partition table:
0 - [ACTIVE] NTFS (0x7) [VISIBLE] Offset (sectors): 2048 | Size: 100 MB [Windows Vista/7/8 Bootstrap | Windows Vista/7/8 Bootloader]
1 - [XXXXXX] EXTEN (0x5) [VISIBLE] Offset (sectors): 524494848 | Size: 220839 MB
2 - [XXXXXX] NTFS (0x7) [VISIBLE] Offset (sectors): 206848 | Size: 256000 MB [Windows Vista/7/8 Bootstrap | Windows Vista/7/8 Bootloader]
User = LL1 ... OK
User = LL2 ... OK


Publicité


Signaler le contenu de ce document

Publicité