RogueKiller V12.0.3.0 [Mar 21 2016] (Free) بواسطة برنامج Adlice البريد الإلكتروني : http://www.adlice.com/contact/ Feedback : http://forum.adlice.com الموقع : http://www.adlice.com/software/roguekiller/ Blog : http://www.adlice.com نظام التشغيل : Windows 8.1 (6.3.9600) 64 bits version يبدأ في : الوضع الطبيعي المستخدم : MouiMou_2 [مسؤول] Started from : C:\Users\MouiMou_2\Desktop\RogueKiller.exe الوضع : حذف -- اليوم : 03/28/2016 01:57:13 ¤¤¤ العملية : 2 ¤¤¤ [Suspicious.Path|VT.HackTool:Win32/AutoKMS] KMSSS.exe(1760) -- C:\ProgramData\KMSAutoS\bin\KMSSS.exe[-] -> تم حذفة [TermProc] [Suspicious.Path|VT.HackTool:Win32/AutoKMS] (SVC) KMSEmulator -- "C:\ProgramData\KMSAutoS\bin\KMSSS.exe" -Port 1688 -PWin RandomKMSPID -PO14 RandomKMSPID -PO15 RandomKMSPID -AI 43200 -RI 43200 KillProcessOnPort -Log -IP[-] -> متوقف ¤¤¤ المسجل : 17 ¤¤¤ [PUP] (X64) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\.QMDeskTopGCIcon | (default) : {B7667919-3765-4815-A66D-98A09BE662D6} -> محذوف [Suspicious.Path|VT.HackTool:Win32/AutoKMS] (X64) HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\KMSEmulator ("C:\ProgramData\KMSAutoS\bin\KMSSS.exe" -Port 1688 -PWin RandomKMSPID -PO14 RandomKMSPID -PO15 RandomKMSPID -AI 43200 -RI 43200 KillProcessOnPort -Log -IP) -> محذوف [PUP] (X64) HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\TSDefenseBt (\??\C:\Program Files (x86)\Tencent\QQPCMgr\11.4.17339.217\TSDefenseBT64.sys) -> محذوف [Suspicious.Path|VT.HackTool:Win32/AutoKMS] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\KMSEmulator ("C:\ProgramData\KMSAutoS\bin\KMSSS.exe" -Port 1688 -PWin RandomKMSPID -PO14 RandomKMSPID -PO15 RandomKMSPID -AI 43200 -RI 43200 KillProcessOnPort -Log -IP) -> محذوف [PUP] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\TSDefenseBt (\??\C:\Program Files (x86)\Tencent\QQPCMgr\11.4.17339.217\TSDefenseBT64.sys) -> محذوف [PUM.SearchPage] (X64) HKEY_USERS\S-1-5-21-2231676356-680805681-2855567490-1002\Software\Microsoft\Internet Explorer\Main | Search Page : http://www.bing.com/search?q={searchTerms} -> إستبدال (http://go.microsoft.com/fwlink/?LinkId=54896) [PUM.SearchPage] (X86) HKEY_USERS\S-1-5-21-2231676356-680805681-2855567490-1002\Software\Microsoft\Internet Explorer\Main | Search Page : http://www.bing.com/search?q={searchTerms} -> إستبدال (http://go.microsoft.com/fwlink/?LinkId=54896) [PUM.SearchPage] (X64) HKEY_USERS\S-1-5-21-2231676356-680805681-2855567490-1002\Software\Microsoft\Internet Explorer\Main | Search Bar : http://www.bing.com/search?q={searchTerms} -> إستبدال (http://search.msn.com/spbasic.htm) [PUM.SearchPage] (X86) HKEY_USERS\S-1-5-21-2231676356-680805681-2855567490-1002\Software\Microsoft\Internet Explorer\Main | Search Bar : http://www.bing.com/search?q={searchTerms} -> إستبدال (http://search.msn.com/spbasic.htm) [PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters | DhcpNameServer : 192.168.1.1 0.0.0.0 ([-][X]) -> إستبدال () [PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Tcpip\Parameters | DhcpNameServer : 192.168.1.1 0.0.0.0 ([-][X]) -> إستبدال () [PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{1AC93C44-CEB1-476D-9613-94F29F8D7302} | DhcpNameServer : 43.249.38.68 43.249.38.70 ([X][-]) -> إستبدال () [PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{B113BC25-FFB8-486A-8F62-6FBD99C3BF47} | DhcpNameServer : 192.168.1.1 0.0.0.0 ([-][X]) -> إستبدال () [PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{B98279C9-2939-4C7E-A4D6-1AD26059F2A2} | DhcpNameServer : 192.168.1.1 0.0.0.0 ([-][X]) -> إستبدال () [PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Tcpip\Parameters\Interfaces\{1AC93C44-CEB1-476D-9613-94F29F8D7302} | DhcpNameServer : 43.249.38.68 43.249.38.70 ([X][-]) -> إستبدال () [PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Tcpip\Parameters\Interfaces\{B113BC25-FFB8-486A-8F62-6FBD99C3BF47} | DhcpNameServer : 192.168.1.1 0.0.0.0 ([-][X]) -> إستبدال () [PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Tcpip\Parameters\Interfaces\{B98279C9-2939-4C7E-A4D6-1AD26059F2A2} | DhcpNameServer : 192.168.1.1 0.0.0.0 ([-][X]) -> إستبدال () ¤¤¤ المهام : 2 ¤¤¤ [Suspicious.Path] %WINDIR%\Tasks\GoogleUpdateTaskMachineUA.job -- C:\Program Files (x86)\Google\Update\GoogleUpdate.exe (/ua /installsource scheduler) -> محذوف [Suspicious.Path] \GoogleUpdateTaskMachineUA -- C:\Program Files (x86)\Google\Update\GoogleUpdate.exe (/ua /installsource scheduler) -> محذوف ¤¤¤ الملفات : 9 ¤¤¤ [PUP][ملف] C:\Users\MouiMou_2\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Online Soccer Manager Hack v 4.0.0.lnk [LNK@] C:\ProgramData\{76042086-6b5d-6874-7604-420866b58219}\Online Soccer Manager Hack v 4.0.0.exe --startup=1 -> محذوف [PUP][ملف] C:\Users\MouiMou_2\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Online Soccer Manager Hack.lnk [LNK@] C:\ProgramData\{09be4c16-41f7-cefc-09be-e4c1641f3059}\Online Soccer Manager Hack.exe --startup=1 -> محذوف [Hidden.ADS][Stream] C:\Users\MouiMou_2\AppData\Roaming:NT -> محذوف [Hidden.ADS][Stream] C:\Users\MouiMou_2\AppData\Roaming:NT2 -> محذوف [PUP][ملف] C:\Users\MouiMou_2\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Online Soccer Manager Hack v 4.0.0.lnk [LNK@] C:\ProgramData\{76042086-6b5d-6874-7604-420866b58219}\Online Soccer Manager Hack v 4.0.0.exe --startup=1 -> إزالة من التقرير [2] [PUP][ملف] C:\Users\MouiMou_2\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Online Soccer Manager Hack.lnk [LNK@] C:\ProgramData\{09be4c16-41f7-cefc-09be-e4c1641f3059}\Online Soccer Manager Hack.exe --startup=1 -> إزالة من التقرير [2] [Hidden.ADS][Stream] C:\ProgramData:NT -> إزالة من التقرير [5] [Hidden.ADS][Stream] C:\ProgramData:NT2 -> إزالة من التقرير [5] [Hj.Name][ملف] C:\$Recycle.Bin\S-1-5-21-2231676356-680805681-2855567490-1002\$R2VJIZ2\I386\SYSTEM32\SMSS.EXE -> محذوف ¤¤¤ ملف الهوست : 0 ¤¤¤ ¤¤¤ Antirootkit : 0 (Driver: لم يتم التحميل [0xc000036b]) ¤¤¤ ¤¤¤ المتصفح : 1 ¤¤¤ [PUM.HomePage][FIREFX:Config] CCACCBF1-7AB4-4CF5-B32D-668C686A539F : user_pref("browser.startup.homepage", "http://www.hohosearch.com/?ts=AHEpCH4lAn4nAU..&v=20160323&uid=B7DB45E91869FAED2AB403D1661638F7&ptid=amz&mode=ffseng"); -> إستبدال (about:home) ¤¤¤ فحص ال MBR : ¤¤¤ +++++ PhysicalDrive0: ST500LM012 HN-M500MBB +++++ --- User --- [MBR] 7ad22948d68fe8500709c06b834e5b5b [BSP] 307f79ecd0b9f0d18dabfd6fc9a293b6 : Windows Vista/7/8|VT.Unknown MBR Code Partition table: 0 - [ACTIVE] NTFS (0x7) [VISIBLE] Offset (sectors): 2048 | Size: 100 MB [Windows Vista/7/8 Bootstrap | Windows Vista/7/8 Bootloader] 1 - [XXXXXX] EXTEN (0x5) [VISIBLE] Offset (sectors): 524494848 | Size: 220839 MB 2 - [XXXXXX] NTFS (0x7) [VISIBLE] Offset (sectors): 206848 | Size: 256000 MB [Windows Vista/7/8 Bootstrap | Windows Vista/7/8 Bootloader] User = LL1 ... OK User = LL2 ... OK