RogueKiller V12.9.4.0 (x64) [Jan 16 2017] (Premium) par Adlice Software email : http://www.adlice.com/contact/ Remontées : http://forum.adlice.com Site web : http://www.adlice.com/fr/download/roguekiller/ Blog : http://www.adlice.com Système d'exploitation : Windows 10 (10.0.14393) 64 bits version Démarré en : Mode normal Utilisateur : MOHPC [Administrateur] Démarré depuis : C:\Program Files\RogueKiller\RogueKiller64.exe Mode : Suppression -- Date : 01/19/2017 22:38:58 (Durée : 00:24:53) ¤¤¤ Processus : 2 ¤¤¤ [PUP.Gen0|PUP.Gen1|Suspicious.Path|Proc.Injected|VT.not-a-virus:WebToolbar.Win32.Linkury.aps] CloudPrinter.exe(3000) -- C:\ProgramData\CloudPrinter\CloudPrinter.exe[-] -> Tué(e) [TermProc] [PUP.Gen0|VT.not-a-virus:WebToolbar.Win32.Linkury.aps] (SVC) CloudPrinter -- C:\ProgramData\\CloudPrinter\\CloudPrinter.exe shuz -f "C:\ProgramData\\CloudPrinter\\CloudPrinter.dat" -l -a[-] -> ERROR [6d] ¤¤¤ Registre : 14 ¤¤¤ [PUP.Gen0] (X64) HKEY_CLASSES_ROOT\CLSID\{BAC72C85-CEC6-4B86-AF06-FA20C259FAB8} (C:\Program Files (x86)\Amazon\Amazon1ButtonApp\Amazon1ButtonBrowserHelper64.dll) -> Supprimé(e) [PUP.Gen0] (X64) HKEY_CLASSES_ROOT\CLSID\{BD6ECB00-7C4A-4F97-B425-44117F2A7AAE} (C:\Program Files (x86)\Amazon\Amazon1ButtonApp\AmazonAppIE64.dll) -> Supprimé(e) [PUP.Gen1] (X64) HKEY_USERS\S-1-5-21-2332951298-1162863722-1781813760-1002\Software\Distromatic -> Supprimé(e) [PUP.Gen1] (X64) HKEY_USERS\S-1-5-21-2332951298-1162863722-1781813760-1002\Software\DriverToolkit -> Supprimé(e) [PUP.Gen1] (X86) HKEY_USERS\S-1-5-21-2332951298-1162863722-1781813760-1002\Software\Distromatic -> Supprimé(e) [PUP.Gen1] (X86) HKEY_USERS\S-1-5-21-2332951298-1162863722-1781813760-1002\Software\DriverToolkit -> Supprimé(e) [PUP.Gen1] (X86) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\Amazon Assistant -> Supprimé(e) [PUP.Gen0|PUP.Gen1|Suspicious.Path|VT.not-a-virus:WebToolbar.Win32.Linkury.aps] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\CloudPrinter (C:\ProgramData\\CloudPrinter\\CloudPrinter.exe shuz -f "C:\ProgramData\\CloudPrinter\\CloudPrinter.dat" -l -a) -> Supprimé(e) [PUM.HomePage] (X64) HKEY_USERS\S-1-5-21-2332951298-1162863722-1781813760-1002\Software\Microsoft\Internet Explorer\Main | Start Page : http://forum.kooora.com/f.aspx?f=119 -> Remplacé(e) (http://go.microsoft.com/fwlink/p/?LinkId=255141) [PUM.HomePage] (X86) HKEY_USERS\S-1-5-21-2332951298-1162863722-1781813760-1002\Software\Microsoft\Internet Explorer\Main | Start Page : http://forum.kooora.com/f.aspx?f=119 -> Remplacé(e) (http://go.microsoft.com/fwlink/p/?LinkId=255141) [PUM.SearchPage] (X64) HKEY_USERS\S-1-5-21-2332951298-1162863722-1781813760-1002\Software\Microsoft\Internet Explorer\Main | Search Page : https://%66%65%65%64.%68%65%6C%70%65%72%62%61%72.%63%6F%6D/?p=mKO_AwFzXIpYRaHdGKBRGNclVS1AC6sNoH2TlPbfGRogFolvddZyMlFK6K0Hlz6ELDNiCNKYYmQDBRXVc_6_W88Y8irPLTXhMdH85Ic5_1khlBDaDW7KGT7NOPiCilcxlj8Ua7xPQcIy2ZrbIC0SR9Ja2_4g73tLqcPN--2Ktpgjw_UJHha-gC7iJoZmKKYgB5TjFlu1czr3&q={searchTerms} -> Remplacé(e) (http://go.microsoft.com/fwlink/?LinkId=54896) [PUM.SearchPage] (X86) HKEY_USERS\S-1-5-21-2332951298-1162863722-1781813760-1002\Software\Microsoft\Internet Explorer\Main | Search Page : https://%66%65%65%64.%68%65%6C%70%65%72%62%61%72.%63%6F%6D/?p=mKO_AwFzXIpYRaHdGKBRGNclVS1AC6sNoH2TlPbfGRogFolvddZyMlFK6K0Hlz6ELDNiCNKYYmQDBRXVc_6_W88Y8irPLTXhMdH85Ic5_1khlBDaDW7KGT7NOPiCilcxlj8Ua7xPQcIy2ZrbIC0SR9Ja2_4g73tLqcPN--2Ktpgjw_UJHha-gC7iJoZmKKYgB5TjFlu1czr3&q={searchTerms} -> Remplacé(e) (http://go.microsoft.com/fwlink/?LinkId=54896) [PUM.SearchPage] (X64) HKEY_USERS\S-1-5-21-2332951298-1162863722-1781813760-1002\Software\Microsoft\Internet Explorer\Main | Search Bar : https://%66%65%65%64.%68%65%6C%70%65%72%62%61%72.%63%6F%6D/?p=mKO_AwFzXIpYRaHdGKBRGNclVS1AC6sNoH2TlPbfGRogFolvddZyMlFK6K0Hlz6ELDNiCNKYYmQDBRXVc_6_W88Y8irPLTXhMdH85Ic5_1khlBDaDW7KGT7NOPiCilcxlj8Ua7xPQcIy2ZrbIC0SR9Ja2_4g73tLqcPN--2Ktpgjw_UJHha-gC7iJoZmKKYgB5TjFlu1czr3&q={searchTerms} -> Remplacé(e) (http://search.msn.com/spbasic.htm) [PUM.SearchPage] (X86) HKEY_USERS\S-1-5-21-2332951298-1162863722-1781813760-1002\Software\Microsoft\Internet Explorer\Main | Search Bar : https://%66%65%65%64.%68%65%6C%70%65%72%62%61%72.%63%6F%6D/?p=mKO_AwFzXIpYRaHdGKBRGNclVS1AC6sNoH2TlPbfGRogFolvddZyMlFK6K0Hlz6ELDNiCNKYYmQDBRXVc_6_W88Y8irPLTXhMdH85Ic5_1khlBDaDW7KGT7NOPiCilcxlj8Ua7xPQcIy2ZrbIC0SR9Ja2_4g73tLqcPN--2Ktpgjw_UJHha-gC7iJoZmKKYgB5TjFlu1czr3&q={searchTerms} -> Remplacé(e) (http://search.msn.com/spbasic.htm) ¤¤¤ Tâches : 2 ¤¤¤ [PUP.Gen0|PUP.Gen1] %WINDIR%\Tasks\DriverToolkit Autorun.job -- C:\Program Files (x86)\DriverToolkit\DriverToolkit.exe (--autorun) -> Supprimé(e) [PUP.Gen1] \DriverToolkit Autorun -- C:\Program Files (x86)\DriverToolkit\DriverToolkit.exe (--autorun) -> Supprimé(e) ¤¤¤ Fichiers : 13 ¤¤¤ [PUP.Gen0|PUP.Gen1][Répertoire] C:\ProgramData\CloudPrinter -> Supprimé(e) [PUP.Gen0|PUP.Gen1][Fichier] C:\ProgramData\CloudPrinter\CloudPrinter.dat -> Supprimé(e) [PUP.Gen0|PUP.Gen1][Fichier] C:\ProgramData\CloudPrinter\CloudPrinter.exe -> Supprimé(e) [PUP.Gen0|PUP.Gen1][Fichier] C:\ProgramData\CloudPrinter\Config.xml -> Supprimé(e) [PUP.Gen0|PUP.Gen1][Fichier] C:\ProgramData\CloudPrinter\Jackson.exe -> Supprimé(e) [PUP.HackTool][Répertoire] C:\ProgramData\KMSAutoS -> Supprimé(e) [PUP.HackTool][Fichier] C:\ProgramData\KMSAutoS\bin\driver\oas_sert.cer -> Supprimé(e) [PUP.HackTool][Fichier] C:\ProgramData\KMSAutoS\bin\driver\tap0901.cer -> Supprimé(e) [PUP.HackTool][Fichier] C:\ProgramData\KMSAutoS\bin\driver\x64TAP1\devcon.exe -> Supprimé(e) [PUP.HackTool][Fichier] C:\ProgramData\KMSAutoS\bin\driver\x64TAP1\OemVista.inf -> Supprimé(e) [PUP.HackTool][Fichier] C:\ProgramData\KMSAutoS\bin\driver\x64TAP1\ptun0901.cat -> Supprimé(e) [PUP.HackTool][Fichier] C:\ProgramData\KMSAutoS\bin\driver\x64TAP1\ptun0901.sys -> Supprimé(e) [PUP.HackTool][Répertoire] C:\ProgramData\KMSAutoS\bin\driver\x64TAP1 -> Supprimé(e) [PUP.HackTool][Fichier] C:\ProgramData\KMSAutoS\bin\driver\x64TAP2\devcon.exe -> Supprimé(e) [PUP.HackTool][Fichier] C:\ProgramData\KMSAutoS\bin\driver\x64TAP2\tapoas.cat -> Supprimé(e) [PUP.HackTool][Fichier] C:\ProgramData\KMSAutoS\bin\driver\x64TAP2\tapoas.inf -> Supprimé(e) [PUP.HackTool][Fichier] C:\ProgramData\KMSAutoS\bin\driver\x64TAP2\tapoas.sys -> Supprimé(e) [PUP.HackTool][Répertoire] C:\ProgramData\KMSAutoS\bin\driver\x64TAP2 -> Supprimé(e) [PUP.HackTool][Fichier] C:\ProgramData\KMSAutoS\bin\driver\x64WDV\FakeClient.exe -> Supprimé(e) [PUP.HackTool][Fichier] C:\ProgramData\KMSAutoS\bin\driver\x64WDV\WdfCoInstaller01009.dll -> Supprimé(e) [PUP.HackTool][Fichier] C:\ProgramData\KMSAutoS\bin\driver\x64WDV\WinDivert.dll -> Supprimé(e) [PUP.HackTool][Fichier] C:\ProgramData\KMSAutoS\bin\driver\x64WDV\WinDivert.inf -> Supprimé(e) [PUP.HackTool][Fichier] C:\ProgramData\KMSAutoS\bin\driver\x64WDV\WinDivert.sys -> Supprimé(e) [PUP.HackTool][Répertoire] C:\ProgramData\KMSAutoS\bin\driver\x64WDV -> Supprimé(e) [PUP.HackTool][Répertoire] C:\ProgramData\KMSAutoS\bin\driver -> Supprimé(e) [PUP.HackTool][Fichier] C:\ProgramData\KMSAutoS\bin\KMSSS.exe -> Supprimé(e) [PUP.HackTool][Fichier] C:\ProgramData\KMSAutoS\bin\KMSSS.log -> Supprimé(e) [PUP.HackTool][Fichier] C:\ProgramData\KMSAutoS\bin\TunMirror.exe -> Supprimé(e) [PUP.HackTool][Fichier] C:\ProgramData\KMSAutoS\bin\TunMirror2.exe -> Supprimé(e) [PUP.HackTool][Répertoire] C:\ProgramData\KMSAutoS\bin -> Supprimé(e) [PUP.HackTool][Fichier] C:\ProgramData\KMSAutoS\KMSAuto Net.exe -> Supprimé(e) [PUP.HackTool][Fichier] C:\ProgramData\KMSAutoS\kmsauto.ini -> Supprimé(e) [PUP.Gen1][Répertoire] C:\ProgramData\Logic Handler -> Supprimé(e) [PUP.Gen1][Fichier] C:\ProgramData\Logic Handler\Config.json -> Supprimé(e) [PUP.Gen1][Fichier] C:\ProgramData\Logic Handler\set.exe.config -> Supprimé(e) [PUP.Gen1][Fichier] C:\ProgramData\Logic Handler\System.Data.SQLite.dll -> Supprimé(e) [PUP.Gen1][Fichier] C:\ProgramData\Logic Handler\System.Data.SQLite.Linq.dll -> Supprimé(e) [PUP.Gen1][Fichier] C:\ProgramData\Logic Handler\System.Data.SQLite.xml -> Supprimé(e) [PUP.Gen1][Fichier] C:\ProgramData\Logic Handler\X64\SQLite.Interop.dll -> Supprimé(e) [PUP.Gen1][Répertoire] C:\ProgramData\Logic Handler\X64 -> Supprimé(e) [PUP.Gen1][Fichier] C:\ProgramData\Logic Handler\X86\SQLite.Interop.dll -> Supprimé(e) [PUP.Gen1][Répertoire] C:\ProgramData\Logic Handler\X86 -> Supprimé(e) [Tr.Gen0][Fichier] C:\Users\MOHPC\AppData\Roaming\uTorrent\updates\3.4.8_42445\utorrentie.exe -> Supprimé(e) [PUP.Gen1][Répertoire] C:\Users\MOHPC\AppData\Local\Amazon Browser Settings -> Supprimé(e) [PUP.Gen1][Fichier] C:\Users\MOHPC\AppData\Local\Amazon Browser Settings\protect.json -> Supprimé(e) [PUP.Gen1][Répertoire] C:\Users\MOHPC\AppData\Local\DriverToolkit -> Supprimé(e) [PUP.Gen1][Répertoire] C:\Users\MOHPC\AppData\Local\PackageAware -> Supprimé(e) [PUP.Gen0|PUP.Gen1][Répertoire] C:\ProgramData\CloudPrinter -> ERROR [3] [PUP.HackTool][Répertoire] C:\ProgramData\KMSAutoS -> ERROR [3] [PUP.Gen1][Répertoire] C:\ProgramData\Logic Handler -> ERROR [3] [PUP.Gen1][Répertoire] C:\Program Files (x86)\Amazon\Amazon1ButtonApp -> Supprimé(e) au redémarrage [91] [PUP.Gen1][Fichier] C:\Program Files (x86)\Amazon\Amazon1ButtonApp\Amazon1ButtonBrowserHelper.dll -> Supprimé(e) [PUP.Gen1][Fichier] C:\Program Files (x86)\Amazon\Amazon1ButtonApp\Amazon1ButtonBrowserHelper64.dll -> Supprimé(e) [PUP.Gen1][Fichier] C:\Program Files (x86)\Amazon\Amazon1ButtonApp\Amazon1ButtonRuntime.dll -> Supprimé(e) [PUP.Gen1][Fichier] C:\Program Files (x86)\Amazon\Amazon1ButtonApp\Amazon1ButtonService64.Exe -> ERROR [5] [PUP.Gen1][Fichier] C:\Program Files (x86)\Amazon\Amazon1ButtonApp\AmazonAppIE.dll -> Supprimé(e) [PUP.Gen1][Fichier] C:\Program Files (x86)\Amazon\Amazon1ButtonApp\AmazonAppIE64.dll -> ERROR [5] [PUP.Gen1][Fichier] C:\Program Files (x86)\Amazon\Amazon1ButtonApp\AmazonExtIE.dll -> Supprimé(e) [PUP.Gen1][Fichier] C:\Program Files (x86)\Amazon\Amazon1ButtonApp\AmazonExtIE64.dll -> ERROR [5] [PUP.Gen1][Répertoire] C:\Program Files (x86)\Amazon Browser Settings -> Supprimé(e) [PUP.Gen1][Fichier] C:\Program Files (x86)\Amazon Browser Settings\AmznSearchProtect.exe -> Supprimé(e) [PUP.Gen1][Fichier] C:\Program Files (x86)\Amazon Browser Settings\installer.json -> Supprimé(e) [PUP.Gen1][Fichier] C:\Program Files (x86)\Amazon Browser Settings\uninstall.ico -> Supprimé(e) [PUP.Gen1][Fichier] C:\Program Files (x86)\Amazon Browser Settings\uninstall.json -> Supprimé(e) [PUP.Gen1][Fichier] C:\Program Files (x86)\Amazon Browser Settings\uninstaller.exe -> Supprimé(e) [PUP.Gen1][Fichier] C:\Program Files (x86)\Amazon Browser Settings\updater.exe -> Supprimé(e) [PUP.Gen1][Répertoire] C:\Program Files (x86)\DriverToolkit -> Supprimé(e) [PUP.Gen1][Répertoire] C:\Program Files (x86)\DriverToolkit\Backup -> Supprimé(e) [PUP.Gen1][Fichier] C:\Program Files (x86)\DriverToolkit\Download\0e68c904b3796d6910c20bc46944f32b.zip.tmp -> Supprimé(e) [PUP.Gen1][Fichier] C:\Program Files (x86)\DriverToolkit\Download\0fcc93f1c49310711a8fe4acdc0ed611.zip.tmp -> Supprimé(e) [PUP.Gen1][Fichier] C:\Program Files (x86)\DriverToolkit\Download\1409dc6a98f307e576aec51f73c7a949.zip.tmp -> Supprimé(e) [PUP.Gen1][Fichier] C:\Program Files (x86)\DriverToolkit\Download\16a1147fe7c4885b80523cc1cb4aee20.zip.tmp -> Supprimé(e) [PUP.Gen1][Fichier] C:\Program Files (x86)\DriverToolkit\Download\1c38b7b870ea511d5a7457068483b880.zip.tmp -> Supprimé(e) [PUP.Gen1][Fichier] C:\Program Files (x86)\DriverToolkit\Download\270c6f23e4bc4d047ae5a9339fb47043.zip.tmp -> Supprimé(e) [PUP.Gen1][Fichier] C:\Program Files (x86)\DriverToolkit\Download\315aa3ed9fec1cc0151a65cdc5d74004.zip.tmp -> Supprimé(e) [PUP.Gen1][Fichier] C:\Program Files (x86)\DriverToolkit\Download\4117003e78c2dbd64401f1ea1543a987.zip.tmp -> Supprimé(e) [PUP.Gen1][Fichier] C:\Program Files (x86)\DriverToolkit\Download\4436675646baa5a4a64aa1864639c07e.zip.tmp -> Supprimé(e) [PUP.Gen1][Fichier] C:\Program Files (x86)\DriverToolkit\Download\444c1ca71698d522ae78838e98f09880.zip.tmp -> Supprimé(e) [PUP.Gen1][Fichier] C:\Program Files (x86)\DriverToolkit\Download\4477bdc731b50d93e95ca9ceaf16ca38.zip.tmp -> Supprimé(e) [PUP.Gen1][Fichier] C:\Program Files (x86)\DriverToolkit\Download\4fd32dc0a39eb9371f74dfbf72e5c9fd.zip.tmp -> Supprimé(e) [PUP.Gen1][Fichier] C:\Program Files (x86)\DriverToolkit\Download\5b6761e31a6eb11683d1ab5262042fa8.zip.tmp -> Supprimé(e) [PUP.Gen1][Fichier] C:\Program Files (x86)\DriverToolkit\Download\655573b9db9bd5aea2f97392b7e34708.zip.tmp -> Supprimé(e) [PUP.Gen1][Fichier] C:\Program Files (x86)\DriverToolkit\Download\83d0b9677848ed21b5629c8341394ad8.zip.tmp -> Supprimé(e) [PUP.Gen1][Fichier] C:\Program Files (x86)\DriverToolkit\Download\af1d12574d1ad7b6be36da6fa6c8d693.zip.tmp -> Supprimé(e) [PUP.Gen1][Fichier] C:\Program Files (x86)\DriverToolkit\Download\b0a37aa0f039b7a7b7d7382abd2c7694.zip.tmp -> Supprimé(e) [PUP.Gen1][Fichier] C:\Program Files (x86)\DriverToolkit\Download\bdba5ffba9aaeb49a417d2ff3e308afe.zip.tmp -> Supprimé(e) [PUP.Gen1][Fichier] C:\Program Files (x86)\DriverToolkit\Download\c46d0f53950ae2fc23038fa8b4087751.zip.tmp -> Supprimé(e) [PUP.Gen1][Fichier] C:\Program Files (x86)\DriverToolkit\Download\c8d5302eeeb9324568c6686e0215bb8a.zip.tmp -> Supprimé(e) [PUP.Gen1][Fichier] C:\Program Files (x86)\DriverToolkit\Download\d28beb2a48d97d9187d920ba43ede1ac.zip.tmp -> Supprimé(e) [PUP.Gen1][Répertoire] C:\Program Files (x86)\DriverToolkit\Download -> Supprimé(e) ¤¤¤ WMI : 0 ¤¤¤ ¤¤¤ Fichier Hosts : 0 ¤¤¤ ¤¤¤ Antirootkit : 0 (Driver: Chargé) ¤¤¤ ¤¤¤ Navigateurs web : 2 ¤¤¤ [PUM.HomePage][Firefox:Config] 9lbim0gg.default : user_pref("browser.startup.homepage", "https://www.facebook.com/"); -> Remplacé(e) (about:home) [PUM.HomePage][Chrome:Config] Default [SecurePrefs] : session.startup_urls [http://www.yalla-shoot.com/live/] -> Supprimé(e) ¤¤¤ Vérification MBR : ¤¤¤ +++++ PhysicalDrive0: CT240BX200SSD1 +++++ --- User --- [MBR] 4beee101a57029c2079b1935b3e6df2b [BSP] 03942602e084d1677b7710f4e4a02a50 : Windows Vista/7/8|VT.Unknown MBR Code Partition table: 0 - [ACTIVE] NTFS (0x7) [VISIBLE] Offset (sectors): 2048 | Size: 500 MB [Windows Vista/7/8 Bootstrap | Windows Vista/7/8 Bootloader] 1 - [XXXXXX] NTFS (0x7) [VISIBLE] Offset (sectors): 1026048 | Size: 227983 MB [Windows Vista/7/8 Bootstrap | Windows Vista/7/8 Bootloader] 2 - [XXXXXX] ACER (0x27) [VISIBLE] Offset (sectors): 467935232 | Size: 450 MB User = LL1 ... OK User = LL2 ... OK +++++ PhysicalDrive1: WDC WD10EZRX-00A8LB0 +++++ --- User --- [MBR] 7b374079b8945bf19024a0cb873f485c [BSP] 9e1e157ea27a8cb49bb696dce64be4d1 : Windows Vista/7/8|VT.Unknown MBR Code Partition table: 0 - [ACTIVE] NTFS (0x7) [VISIBLE] Offset (sectors): 2048 | Size: 350 MB [Windows Vista/7/8 Bootstrap | Windows Vista/7/8 Bootloader] 1 - [XXXXXX] NTFS (0x7) [VISIBLE] Offset (sectors): 718848 | Size: 399650 MB [Windows Vista/7/8 Bootstrap | Windows Vista/7/8 Bootloader] 2 - [XXXXXX] NTFS (0x7) [VISIBLE] Offset (sectors): 1351682048 | Size: 293868 MB [Windows Vista/7/8 Bootstrap | Windows Vista/7/8 Bootloader] 3 - [XXXXXX] EXTEN-LBA (0xf) [VISIBLE] Offset (sectors): 819204033 | Size: 259996 MB User = LL1 ... OK User = LL2 ... OK +++++ PhysicalDrive2: SAMSUNG HD502HJ +++++ --- User --- [MBR] d104548d7bbc771e2036025698e65219 [BSP] 2b61ad0785806f33f2b4b523fe525a55 : Windows Vista/7/8|VT.Unknown MBR Code Partition table: 0 - [ACTIVE] NTFS (0x7) [VISIBLE] Offset (sectors): 2048 | Size: 300000 MB [Windows Vista/7/8 Bootstrap | Windows Vista/7/8 Bootloader] 1 - [XXXXXX] NTFS (0x7) [VISIBLE] Offset (sectors): 614402048 | Size: 176938 MB [Windows Vista/7/8 Bootstrap | Windows Vista/7/8 Bootloader] User = LL1 ... OK User = LL2 ... OK +++++ PhysicalDrive3: Brother DCP-195C USB Device +++++ Error reading User MBR! ([15] Le périphérique n?est pas prêt. ) Error reading LL1 MBR! NOT VALID! Error reading LL2 MBR! ([32] Cette demande n?est pas prise en charge. )