RogueKiller V10.5.10.0 (x64) [Apr 14 2015] par Adlice Software email : http://www.adlice.com/contact/ Remontées : http://forum.adlice.com Site web : http://www.adlice.com/fr/logiciels/roguekiller/ Blog : http://www.adlice.com Système d'exploitation : Windows 8.1 (6.3.9200 ) 64 bits version Démarré en : Mode normal Utilisateur : Alain_2 [Administrateur] Démarré depuis : C:\Program Files\RogueKiller\RogueKiller.exe Mode : Suppression -- Date : 04/17/2015 16:22:08 ¤¤¤ Processus : 0 ¤¤¤ ¤¤¤ Registre : 16 ¤¤¤ [PUP] (X64) HKEY_CLASSES_ROOT\CLSID\{31AD400D-1B06-4E33-A59A-90C2C140CBA0} (mscoree.dll) -> Non sélectionné [PUP] (X64) HKEY_CLASSES_ROOT\CLSID\{56561B2A-FB5D-363A-9631-4C03D6054209} (mscoree.dll) -> Non sélectionné [PUP] (X64) HKEY_CLASSES_ROOT\CLSID\{A717364F-69F3-3A24-ADD5-3901A57F880E} (mscoree.dll) -> Non sélectionné [PUP] (X64) HKEY_CLASSES_ROOT\CLSID\{AE07101B-46D4-4A98-AF68-0333EA26E113} (mscoree.dll) -> Non sélectionné [PUP] (X64) HKEY_CLASSES_ROOT\CLSID\{CCB08265-B35D-30B2-A6AF-6986CA957358} (mscoree.dll) -> Non sélectionné [PUP] (X64) HKEY_CLASSES_ROOT\CLSID\{CD92622E-49B9-33B7-98D1-EC51049457D7} (mscoree.dll) -> Non sélectionné [PUP] (X64) HKEY_CLASSES_ROOT\CLSID\{E041E037-FA4B-364A-B440-7A1051EA0301} (mscoree.dll) -> Non sélectionné [PUP] (X86) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1d970ed5-3eda-438d-bffd-715931e2775b} -> Non sélectionné [PUM.HomePage] (X64) HKEY_USERS\S-1-5-21-1482412152-871333260-297434807-1007\Software\Microsoft\Internet Explorer\Main | Start Page : http://r.orange.fr/r/Ohome_portail?ref=O_OI_defaultPage_IE -> Non sélectionné [PUM.HomePage] (X86) HKEY_USERS\S-1-5-21-1482412152-871333260-297434807-1007\Software\Microsoft\Internet Explorer\Main | Start Page : http://r.orange.fr/r/Ohome_portail?ref=O_OI_defaultPage_IE -> Non sélectionné [PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{DD770C78-5B71-4962-A5A7-B3393A67EB34} | DhcpNameServer : 10.11.0.1 [(Private Address) (XX)] -> Non sélectionné [PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Tcpip\Parameters\Interfaces\{DD770C78-5B71-4962-A5A7-B3393A67EB34} | DhcpNameServer : 10.11.0.1 [(Private Address) (XX)] -> Non sélectionné [PUM.DesktopIcons] (X64) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {20D04FE0-3AEA-1069-A2D8-08002B30309D} : 1 -> Non sélectionné [PUM.DesktopIcons] (X64) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {59031a47-3f72-44a7-89c5-5595fe6b30ee} : 1 -> Non sélectionné [PUM.DesktopIcons] (X86) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {20D04FE0-3AEA-1069-A2D8-08002B30309D} : 1 -> Non sélectionné [PUM.DesktopIcons] (X86) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {59031a47-3f72-44a7-89c5-5595fe6b30ee} : 1 -> Non sélectionné ¤¤¤ Tâches : 1 ¤¤¤ [Suspicious.Path] \\Microsoft OneDrive Auto Update Task-S-1-5-21-1482412152-871333260-297434807-1007 -- %localappdata%\Microsoft\OneDrive\OneDrive.exe -> Supprimé(e) ¤¤¤ Fichiers : 0 ¤¤¤ ¤¤¤ Fichier Hosts : 0 ¤¤¤ ¤¤¤ Antirootkit : 4 (Driver: Chargé) ¤¤¤ [IAT:Addr(Hook.IEAT)] (firefox.exe @ ole32.dll) msvcrt.dll - free : C:\Windows\AppPatch\AcSpecfc.DLL @ 0x5d58cfa0 [IAT:Addr(Hook.IEAT)] (firefox.exe @ combase.dll) msvcrt.dll - free : C:\Windows\AppPatch\AcSpecfc.DLL @ 0x5d58cfa0 [IAT:Addr(Hook.IEAT)] (firefox.exe @ MSONSEXT.DLL) pkmws.dll - lstrcmpiW : C:\Windows\AppPatch\AcSpecfc.DLL @ 0x5d58d010 [IAT:Addr(Hook.IEAT)] (firefox.exe @ MSONSEXT.DLL) msvcrt.dll - free : C:\Windows\AppPatch\AcSpecfc.DLL @ 0x5d58cfa0 ¤¤¤ Navigateurs web : 1 ¤¤¤ [PUM.HomePage][FIREFX:Config] i9hm83ud.default-1420103269633 : user_pref("browser.startup.homepage", "http://www.spacedaily.com/"); -> Non sélectionné ¤¤¤ Vérification MBR : ¤¤¤ +++++ PhysicalDrive0: Samsung SSD 840 EVO 250GB +++++ --- User --- [MBR] 9cadf88cd7df2e963e47d3e12f37e56f [BSP] cf82c2e739af19426727c602441fb226 : HP MBR Code Partition table: 0 - [ACTIVE] NTFS (0x7) [VISIBLE] Offset (sectors): 2048 | Size: 100 MB [Windows Vista/7/8 Bootstrap | Windows Vista/7/8 Bootloader] 1 - [XXXXXX] NTFS (0x7) [VISIBLE] Offset (sectors): 206848 | Size: 238371 MB [Windows Vista/7/8 Bootstrap | Windows Vista/7/8 Bootloader] User = LL1 ... OK User = LL2 ... OK +++++ PhysicalDrive1: WDC WD10EZEX-00RKKA0 +++++ --- User --- [MBR] d907c2a77102045332e10507fb2ac582 [BSP] 5896a13294b34adf819e51f626e5b5ce : Windows Vista/7/8 MBR Code Partition table: 0 - [XXXXXX] NTFS (0x7) [VISIBLE] Offset (sectors): 2048 | Size: 953867 MB [Windows Vista/7/8 Bootstrap | Windows Vista/7/8 Bootloader] User = LL1 ... OK User = LL2 ... OK +++++ PhysicalDrive2: Hitachi HTS547550A9E384 USB Device +++++ --- User --- [MBR] fd800af49d693a0241cdcb3878f4ffeb [BSP] 2df4e4393ef6efc24351e5bc0934916b : Windows Vista/7/8 MBR Code Partition table: 0 - [XXXXXX] FAT32-LBA (0xc) [VISIBLE] Offset (sectors): 2048 | Size: 25600 MB 1 - [ACTIVE] NTFS (0x7) [VISIBLE] Offset (sectors): 52430848 | Size: 451338 MB [Windows Vista/7/8 Bootstrap | Windows Vista/7/8 Bootloader] User = LL1 ... OK Error reading LL2 MBR! ([32] Cette demande n?est pas prise en charge. ) ============================================ RKreport_SCN_04172015_161823.log