RogueKiller V8.8.15 _x64_ [Mar 27 2014] par Adlice Software mail : http://www.adlice.com/contact/ Remontees : http://forum.adlice.com Site Web : http://www.surlatoile.org/RogueKiller/ Blog : http://www.adlice.com Systeme d'exploitation : Windows 7 (6.1.7601 Service Pack 1) 64 bits version Demarrage : Mode normal Utilisateur : PIERRE [Droits d'admin] Mode : Recherche -- Date : 04/23/2014 08:54:27 | ARK || FAK || MBR | ¤¤¤ Processus malicieux : 0 ¤¤¤ ¤¤¤ Entrees de registre : 4 ¤¤¤ [HJ POL][PUM] HKCU\[...]\System : DisableTaskMgr (0) -> TROUVÉ [HJ POL][PUM] HKCU\[...]\System : DisableRegistryTools (0) -> TROUVÉ [HJ DESK][PUM] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> TROUVÉ [HJ DESK][PUM] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> TROUVÉ ¤¤¤ Tâches planifiées : 3 ¤¤¤ [V1][SUSP PATH] Gameo Updater.job : C:\Users\PIERRE\AppData\Roaming\GAMEOU~1\UPDATE~1\UPDATE~1.EXE - /Check [x] -> TROUVÉ [V1][SUSP PATH] {2AAF654E-A086-4411-8BC9-268C2C2A6943}.job : C:\ProgramData\BetterSoft\SaveByClick\SaveByClick.exe - /schedule /profile "C:\PROGRA~3\BETTER~1\SAVEBY~1\profile.ini" [x][x] -> TROUVÉ [V2][SUSP PATH] Gameo Updater : C:\Users\PIERRE\AppData\Roaming\GAMEOU~1\UPDATE~1\UPDATE~1.EXE - /Check [x] -> TROUVÉ ¤¤¤ Entrées Startup : 0 ¤¤¤ ¤¤¤ Navigateurs web : 0 ¤¤¤ ¤¤¤ Addons navigateur : 0 ¤¤¤ ¤¤¤ Fichiers / Dossiers particuliers: ¤¤¤ ¤¤¤ Driver : [NON CHARGE 0x0] ¤¤¤ [Address] EAT @firefox.exe (BeginBufferedAnimation) : rsaenh.dll -> HOOKED (C:\Windows\SysWOW64\UxTheme.dll @ 0x7116DF38) [Address] EAT @firefox.exe (BeginBufferedPaint) : rsaenh.dll -> HOOKED (C:\Windows\SysWOW64\UxTheme.dll @ 0x7116B741) [Address] EAT @firefox.exe (BeginPanningFeedback) : rsaenh.dll -> HOOKED (C:\Windows\SysWOW64\UxTheme.dll @ 0x711876AF) [Address] EAT @firefox.exe (BufferedPaintClear) : rsaenh.dll -> HOOKED (C:\Windows\SysWOW64\UxTheme.dll @ 0x7116BBDB) [Address] EAT @firefox.exe (BufferedPaintInit) : rsaenh.dll -> HOOKED (C:\Windows\SysWOW64\UxTheme.dll @ 0x7116B8D4) [Address] EAT @firefox.exe (BufferedPaintRenderAnimation) : rsaenh.dll -> HOOKED (C:\Windows\SysWOW64\UxTheme.dll @ 0x7116DE83) [Address] EAT @firefox.exe (BufferedPaintSetAlpha) : rsaenh.dll -> HOOKED (C:\Windows\SysWOW64\UxTheme.dll @ 0x7118CE19) [Address] EAT @firefox.exe (BufferedPaintStopAllAnimations) : rsaenh.dll -> HOOKED (C:\Windows\SysWOW64\UxTheme.dll @ 0x7116E428) [Address] EAT @firefox.exe (BufferedPaintUnInit) : rsaenh.dll -> HOOKED (C:\Windows\SysWOW64\UxTheme.dll @ 0x71177525) [Address] EAT @firefox.exe (CloseThemeData) : rsaenh.dll -> HOOKED (C:\Windows\SysWOW64\UxTheme.dll @ 0x71161FA1) [Address] EAT @firefox.exe (DrawThemeBackground) : rsaenh.dll -> HOOKED (C:\Windows\SysWOW64\UxTheme.dll @ 0x7116D464) [Address] EAT @firefox.exe (DrawThemeBackgroundEx) : rsaenh.dll -> HOOKED (C:\Windows\SysWOW64\UxTheme.dll @ 0x7117436D) [Address] EAT @firefox.exe (DrawThemeEdge) : rsaenh.dll -> HOOKED (C:\Windows\SysWOW64\UxTheme.dll @ 0x7118C01C) [Address] EAT @firefox.exe (DrawThemeIcon) : rsaenh.dll -> HOOKED (C:\Windows\SysWOW64\UxTheme.dll @ 0x7118D123) [Address] EAT @firefox.exe (DrawThemeParentBackground) : rsaenh.dll -> HOOKED (C:\Windows\SysWOW64\UxTheme.dll @ 0x7116E776) [Address] EAT @firefox.exe (DrawThemeParentBackgroundEx) : rsaenh.dll -> HOOKED (C:\Windows\SysWOW64\UxTheme.dll @ 0x7116E5C5) [Address] EAT @firefox.exe (DrawThemeText) : rsaenh.dll -> HOOKED (C:\Windows\SysWOW64\UxTheme.dll @ 0x7116DB21) [Address] EAT @firefox.exe (DrawThemeTextEx) : rsaenh.dll -> HOOKED (C:\Windows\SysWOW64\UxTheme.dll @ 0x7116A70C) [Address] EAT @firefox.exe (EnableThemeDialogTexture) : rsaenh.dll -> HOOKED (C:\Windows\SysWOW64\UxTheme.dll @ 0x7117786D) [Address] EAT @firefox.exe (EnableTheming) : rsaenh.dll -> HOOKED (C:\Windows\SysWOW64\UxTheme.dll @ 0x7118C9FF) [Address] EAT @firefox.exe (EndBufferedAnimation) : rsaenh.dll -> HOOKED (C:\Windows\SysWOW64\UxTheme.dll @ 0x7116ACE8) [Address] EAT @firefox.exe (EndBufferedPaint) : rsaenh.dll -> HOOKED (C:\Windows\SysWOW64\UxTheme.dll @ 0x7116ACE8) [Address] EAT @firefox.exe (EndPanningFeedback) : rsaenh.dll -> HOOKED (C:\Windows\SysWOW64\UxTheme.dll @ 0x7118762C) [Address] EAT @firefox.exe (GetBufferedPaintBits) : rsaenh.dll -> HOOKED (C:\Windows\SysWOW64\UxTheme.dll @ 0x7116CF26) [Address] EAT @firefox.exe (GetBufferedPaintDC) : rsaenh.dll -> HOOKED (C:\Windows\SysWOW64\UxTheme.dll @ 0x7118CDCF) [Address] EAT @firefox.exe (GetBufferedPaintTargetDC) : rsaenh.dll -> HOOKED (C:\Windows\SysWOW64\UxTheme.dll @ 0x7118CD86) [Address] EAT @firefox.exe (GetBufferedPaintTargetRect) : rsaenh.dll -> HOOKED (C:\Windows\SysWOW64\UxTheme.dll @ 0x7118C893) [Address] EAT @firefox.exe (GetCurrentThemeName) : rsaenh.dll -> HOOKED (C:\Windows\SysWOW64\UxTheme.dll @ 0x711763AE) [Address] EAT @firefox.exe (GetThemeAppProperties) : rsaenh.dll -> HOOKED (C:\Windows\SysWOW64\UxTheme.dll @ 0x7116EBD6) [Address] EAT @firefox.exe (GetThemeBackgroundContentRect) : rsaenh.dll -> HOOKED (C:\Windows\SysWOW64\UxTheme.dll @ 0x7116DA9E) [Address] EAT @firefox.exe (GetThemeBackgroundExtent) : rsaenh.dll -> HOOKED (C:\Windows\SysWOW64\UxTheme.dll @ 0x71177155) [Address] EAT @firefox.exe (GetThemeBackgroundRegion) : rsaenh.dll -> HOOKED (C:\Windows\SysWOW64\UxTheme.dll @ 0x71170190) [Address] EAT @firefox.exe (GetThemeBitmap) : rsaenh.dll -> HOOKED (C:\Windows\SysWOW64\UxTheme.dll @ 0x71164B9C) [Address] EAT @firefox.exe (GetThemeBool) : rsaenh.dll -> HOOKED (C:\Windows\SysWOW64\UxTheme.dll @ 0x71166651) [Address] EAT @firefox.exe (GetThemeColor) : rsaenh.dll -> HOOKED (C:\Windows\SysWOW64\UxTheme.dll @ 0x711627C0) [Address] EAT @firefox.exe (GetThemeDocumentationProperty) : rsaenh.dll -> HOOKED (C:\Windows\SysWOW64\UxTheme.dll @ 0x7118C346) [Address] EAT @firefox.exe (GetThemeEnumValue) : rsaenh.dll -> HOOKED (C:\Windows\SysWOW64\UxTheme.dll @ 0x711627C0) [Address] EAT @firefox.exe (GetThemeFilename) : rsaenh.dll -> HOOKED (C:\Windows\SysWOW64\UxTheme.dll @ 0x7118B997) [Address] EAT @firefox.exe (GetThemeFont) : rsaenh.dll -> HOOKED (C:\Windows\SysWOW64\UxTheme.dll @ 0x711776A2) [Address] EAT @firefox.exe (GetThemeInt) : rsaenh.dll -> HOOKED (C:\Windows\SysWOW64\UxTheme.dll @ 0x711627C0) [Address] EAT @firefox.exe (GetThemeIntList) : rsaenh.dll -> HOOKED (C:\Windows\SysWOW64\UxTheme.dll @ 0x7118B86E) [Address] EAT @firefox.exe (GetThemeMargins) : rsaenh.dll -> HOOKED (C:\Windows\SysWOW64\UxTheme.dll @ 0x71162F97) [Address] EAT @firefox.exe (GetThemeMetric) : rsaenh.dll -> HOOKED (C:\Windows\SysWOW64\UxTheme.dll @ 0x711755B4) [Address] EAT @firefox.exe (GetThemePartSize) : rsaenh.dll -> HOOKED (C:\Windows\SysWOW64\UxTheme.dll @ 0x7116289F) [Address] EAT @firefox.exe (GetThemePosition) : rsaenh.dll -> HOOKED (C:\Windows\SysWOW64\UxTheme.dll @ 0x7118B80D) [Address] EAT @firefox.exe (GetThemePropertyOrigin) : rsaenh.dll -> HOOKED (C:\Windows\SysWOW64\UxTheme.dll @ 0x71170923) [Address] EAT @firefox.exe (GetThemeRect) : rsaenh.dll -> HOOKED (C:\Windows\SysWOW64\UxTheme.dll @ 0x7118B936) [Address] EAT @firefox.exe (GetThemeStream) : rsaenh.dll -> HOOKED (C:\Windows\SysWOW64\UxTheme.dll @ 0x7118B8CF) [Address] EAT @firefox.exe (GetThemeString) : rsaenh.dll -> HOOKED (C:\Windows\SysWOW64\UxTheme.dll @ 0x7118B7A1) [Address] EAT @firefox.exe (GetThemeSysBool) : rsaenh.dll -> HOOKED (C:\Windows\SysWOW64\UxTheme.dll @ 0x7118CB86) [Address] EAT @firefox.exe (GetThemeSysColor) : rsaenh.dll -> HOOKED (C:\Windows\SysWOW64\UxTheme.dll @ 0x71175530) [Address] EAT @firefox.exe (GetThemeSysColorBrush) : rsaenh.dll -> HOOKED (C:\Windows\SysWOW64\UxTheme.dll @ 0x7118CA32) [Address] EAT @firefox.exe (GetThemeSysFont) : rsaenh.dll -> HOOKED (C:\Windows\SysWOW64\UxTheme.dll @ 0x7118C3D8) [Address] EAT @firefox.exe (GetThemeSysInt) : rsaenh.dll -> HOOKED (C:\Windows\SysWOW64\UxTheme.dll @ 0x7118C5E7) [Address] EAT @firefox.exe (GetThemeSysSize) : rsaenh.dll -> HOOKED (C:\Windows\SysWOW64\UxTheme.dll @ 0x7118CC61) [Address] EAT @firefox.exe (GetThemeSysString) : rsaenh.dll -> HOOKED (C:\Windows\SysWOW64\UxTheme.dll @ 0x7118C553) [Address] EAT @firefox.exe (GetThemeTextExtent) : rsaenh.dll -> HOOKED (C:\Windows\SysWOW64\UxTheme.dll @ 0x711689FE) [Address] EAT @firefox.exe (GetThemeTextMetrics) : rsaenh.dll -> HOOKED (C:\Windows\SysWOW64\UxTheme.dll @ 0x7117778C) [Address] EAT @firefox.exe (GetThemeTransitionDuration) : rsaenh.dll -> HOOKED (C:\Windows\SysWOW64\UxTheme.dll @ 0x7116E1A1) [Address] EAT @firefox.exe (GetWindowTheme) : rsaenh.dll -> HOOKED (C:\Windows\SysWOW64\UxTheme.dll @ 0x7117535B) [Address] EAT @firefox.exe (HitTestThemeBackground) : rsaenh.dll -> HOOKED (C:\Windows\SysWOW64\UxTheme.dll @ 0x71172DC1) [Address] EAT @firefox.exe (IsAppThemed) : rsaenh.dll -> HOOKED (C:\Windows\SysWOW64\UxTheme.dll @ 0x71177009) [Address] EAT @firefox.exe (IsCompositionActive) : rsaenh.dll -> HOOKED (C:\Windows\SysWOW64\UxTheme.dll @ 0x711665DF) [Address] EAT @firefox.exe (IsThemeActive) : rsaenh.dll -> HOOKED (C:\Windows\SysWOW64\UxTheme.dll @ 0x71176F36) [Address] EAT @firefox.exe (IsThemeBackgroundPartiallyTransparent) : rsaenh.dll -> HOOKED (C:\Windows\SysWOW64\UxTheme.dll @ 0x7116281C) [Address] EAT @firefox.exe (IsThemeDialogTextureEnabled) : rsaenh.dll -> HOOKED (C:\Windows\SysWOW64\UxTheme.dll @ 0x7118CB3F) [Address] EAT @firefox.exe (IsThemePartDefined) : rsaenh.dll -> HOOKED (C:\Windows\SysWOW64\UxTheme.dll @ 0x711630CF) [Address] EAT @firefox.exe (OpenThemeData) : rsaenh.dll -> HOOKED (C:\Windows\SysWOW64\UxTheme.dll @ 0x71165F29) [Address] EAT @firefox.exe (OpenThemeDataEx) : rsaenh.dll -> HOOKED (C:\Windows\SysWOW64\UxTheme.dll @ 0x711706FE) [Address] EAT @firefox.exe (SetThemeAppProperties) : rsaenh.dll -> HOOKED (C:\Windows\SysWOW64\UxTheme.dll @ 0x7118CCEC) [Address] EAT @firefox.exe (SetWindowTheme) : rsaenh.dll -> HOOKED (C:\Windows\SysWOW64\UxTheme.dll @ 0x71177AFC) [Address] EAT @firefox.exe (SetWindowThemeAttribute) : rsaenh.dll -> HOOKED (C:\Windows\SysWOW64\UxTheme.dll @ 0x71169E39) [Address] EAT @firefox.exe (ThemeInitApiHook) : rsaenh.dll -> HOOKED (C:\Windows\SysWOW64\UxTheme.dll @ 0x71164571) [Address] EAT @firefox.exe (UpdatePanningFeedback) : rsaenh.dll -> HOOKED (C:\Windows\SysWOW64\UxTheme.dll @ 0x711875ED) ¤¤¤ Ruches Externes: ¤¤¤ ¤¤¤ Infection : ¤¤¤ ¤¤¤ Fichier HOSTS: ¤¤¤ --> %SystemRoot%\System32\drivers\etc\hosts 127.0.0.1 08sr.combineads.info # hosts anti-adware / pups 127.0.0.1 08srvr.combineads.info # hosts anti-adware / pups 127.0.0.1 12srvr.combineads.info # hosts anti-adware / pups 127.0.0.1 2010-fr.com # hosts anti-adware / pups 127.0.0.1 2012-new.biz # hosts anti-adware / pups 127.0.0.1 212link.com # hosts anti-adware / pups 127.0.0.1 2319825.ourtoolbar.com # hosts anti-adware / pups 127.0.0.1 24h00business.com # hosts anti-adware / pups 127.0.0.1 a.daasafterdusk.com # hosts anti-adware / pups 127.0.0.1 ad.adn360.com # hosts anti-adware / pups 127.0.0.1 adeartss.eu # hosts anti-adware / pups 127.0.0.1 adesoeasy.eu # hosts anti-adware / pups 127.0.0.1 adf.girldatesforfree.net # hosts anti-adware / pups 127.0.0.1 adm.soft365.com # hosts anti-adware / pups 127.0.0.1 adomicileavail.googlepages.com # hosts anti-adware / pups 127.0.0.1 ads7.complexadveising.com # hosts anti-adware / pups 127.0.0.1 ads.aff.co # hosts anti-adware / pups 127.0.0.1 ads.alpha00001.com # hosts anti-adware / pups 127.0.0.1 ads.cloud4ads.com # hosts anti-adware / pups 127.0.0.1 ads.eorezo.com # hosts anti-adware / pups [...] ¤¤¤ MBR Verif: ¤¤¤ +++++ PhysicalDrive0: (\\.\PHYSICALDRIVE0 @ IDE) ATA SAMSUNG HN-M750M SCSI Disk Device +++++ --- User --- [MBR] 491f13b62ac12a38ee21cea3d8e78560 [BSP] 71ef0362f912cf5f1f5301fa26f4ee91 : Windows 7/8 MBR Code Partition table: 0 - [XXXXXX] ACER (0x27) [VISIBLE] Offset (sectors): 2048 | Size: 19000 MB 1 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 38914048 | Size: 100 MB 2 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 39118848 | Size: 348023 MB 3 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 751869952 | Size: 348279 MB User = LL1 ... OK! User = LL2 ... OK! Termine : << RKreport[0]_S_04232014_085427.txt >>