RogueKiller V9.2.8.0 (x64) [Jul 11 2014] par Adlice Software
Mail : http://www.adlice.com/contact/
Remontées : http://forum.adlice.com
Site Web : http://www.surlatoile.org/RogueKiller/
Blog : http://www.adlice.com

Système d'exploitation : Windows 7 (6.1.7601 Service Pack 1) 64 bits version
Démarrage : Mode normal
Utilisateur : Kaki [Droits d'admin]
Mode : Recherche -- Date : 08/18/2014 00:14:38

¤¤¤ Processus malicieux : 1 ¤¤¤
[Proc.Hidden] -- [x] -> TUÉ [TermThr]

¤¤¤ Entrées de registre : 26 ¤¤¤
[PUM.Proxy] (X64) HKEY_USERS\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings | ProxyServer : -> TROUVÉ
[PUM.Proxy] (X86) HKEY_USERS\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings | ProxyServer : -> TROUVÉ
[PUM.Proxy] (X64) HKEY_USERS\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings | ProxyServer : -> TROUVÉ
[PUM.Proxy] (X86) HKEY_USERS\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings | ProxyServer : -> TROUVÉ
[PUM.Policies] (X64) HKEY_USERS\S-1-5-21-2861097751-2107483224-206683470-1001\Software\Microsoft\Windows\CurrentVersion\Policies\System | DisableTaskMgr : 0 -> TROUVÉ
[PUM.Policies] (X64) HKEY_USERS\S-1-5-21-2861097751-2107483224-206683470-1001\Software\Microsoft\Windows\CurrentVersion\Policies\System | DisableRegistryTools : 0 -> TROUVÉ
[PUM.Policies] (X86) HKEY_USERS\S-1-5-21-2861097751-2107483224-206683470-1001\Software\Microsoft\Windows\CurrentVersion\Policies\System | DisableTaskMgr : 0 -> TROUVÉ
[PUM.Policies] (X86) HKEY_USERS\S-1-5-21-2861097751-2107483224-206683470-1001\Software\Microsoft\Windows\CurrentVersion\Policies\System | DisableRegistryTools : 0 -> TROUVÉ
[PUM.Policies] (X64) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System | EnableLUA : 0 -> TROUVÉ
[PUM.Policies] (X86) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System | EnableLUA : 0 -> TROUVÉ
[PUM.Policies] (X64) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System | ConsentPromptBehaviorAdmin : 0 -> TROUVÉ
[PUM.Policies] (X86) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System | ConsentPromptBehaviorAdmin : 0 -> TROUVÉ
[PUM.Desktop] (X64) HKEY_USERS\S-1-5-21-2861097751-2107483224-206683470-1001\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop | NoChangingWallpaper : 0 -> TROUVÉ
[PUM.Desktop] (X86) HKEY_USERS\S-1-5-21-2861097751-2107483224-206683470-1001\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop | NoChangingWallpaper : 0 -> TROUVÉ
[PUM.StartMenu] (X64) HKEY_USERS\S-1-5-21-2861097751-2107483224-206683470-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced | Start_TrackProgs : 0 -> TROUVÉ
[PUM.StartMenu] (X86) HKEY_USERS\S-1-5-21-2861097751-2107483224-206683470-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced | Start_TrackProgs : 0 -> TROUVÉ
[PUM.DesktopIcons] (X64) HKEY_USERS\S-1-5-21-2861097751-2107483224-206683470-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\ClassicStartMenu | {20D04FE0-3AEA-1069-A2D8-08002B30309D} : 1 -> TROUVÉ
[PUM.DesktopIcons] (X86) HKEY_USERS\S-1-5-21-2861097751-2107483224-206683470-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\ClassicStartMenu | {20D04FE0-3AEA-1069-A2D8-08002B30309D} : 1 -> TROUVÉ
[PUM.DesktopIcons] (X64) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {20D04FE0-3AEA-1069-A2D8-08002B30309D} : 1 -> TROUVÉ
[PUM.DesktopIcons] (X64) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {59031a47-3f72-44a7-89c5-5595fe6b30ee} : 1 -> TROUVÉ
[PUM.DesktopIcons] (X86) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {20D04FE0-3AEA-1069-A2D8-08002B30309D} : 1 -> TROUVÉ
[PUM.DesktopIcons] (X86) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {59031a47-3f72-44a7-89c5-5595fe6b30ee} : 1 -> TROUVÉ
[PUM.DesktopIcons] (X64) HKEY_USERS\S-1-5-21-2861097751-2107483224-206683470-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {20D04FE0-3AEA-1069-A2D8-08002B30309D} : 1 -> TROUVÉ
[PUM.DesktopIcons] (X86) HKEY_USERS\S-1-5-21-2861097751-2107483224-206683470-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {20D04FE0-3AEA-1069-A2D8-08002B30309D} : 1 -> TROUVÉ
[PUM.HomePage] (X64) HKEY_USERS\S-1-5-21-2861097751-2107483224-206683470-1001\Software\Microsoft\Internet Explorer\Main | Start Page : http://r.orange.fr/r/Ohome_portail?ref=O_OI_defaultPage_IE -> TROUVÉ
[PUM.HomePage] (X86) HKEY_USERS\S-1-5-21-2861097751-2107483224-206683470-1001\Software\Microsoft\Internet Explorer\Main | Start Page : http://r.orange.fr/r/Ohome_portail?ref=O_OI_defaultPage_IE -> TROUVÉ

¤¤¤ Tâches planifiées : 2 ¤¤¤
[Suspicious.Path] WSE_Astromenda.job -- C:\Users\Kaki\AppData\Roaming\WSE_AS~1\UPDATE~1\UPDATE~1.EXE (/Check) -> TROUVÉ
[Suspicious.Path] \\WSE_Astromenda -- C:\Users\Kaki\AppData\Roaming\WSE_AS~1\UPDATE~1\UPDATE~1.EXE (/Check) -> TROUVÉ

¤¤¤ Fichiers : 0 ¤¤¤

¤¤¤ Fichier HOSTS : 0 [Too big!] ¤¤¤

¤¤¤ Antirootkit : 0 (Driver: CHARGE) ¤¤¤

¤¤¤ Navigateurs web : 0 ¤¤¤

¤¤¤ MBR Verif : ¤¤¤
+++++ PhysicalDrive0: TOSHIBA MK5056GSY +++++
--- User ---
[MBR] bf71f433e49796a086ad8c01e5372036
[BSP] a87f5aefe79b4f344c4a08d74ec8a315 : Unknown MBR Code
Partition table:
0 - [ACTIVE] NTFS (0x7) [VISIBLE] Offset (sectors): 2048 | Size: 199 MB
1 - [XXXXXX] NTFS (0x7) [VISIBLE] Offset (sectors): 409600 | Size: 462351 MB
2 - [XXXXXX] NTFS (0x7) [VISIBLE] Offset (sectors): 947304448 | Size: 14285 MB
3 - [XXXXXX] FAT32-LBA (0xc) [VISIBLE] Offset (sectors): 976560128 | Size: 103 MB
User = LL1 ... OK
User = LL2 ... OK


============================================
RKreport_DEL_08152014_172810.log - RKreport_SCN_08152014_172630.log