RogueKiller V12.9.4.0 [Jan 16 2017] (Premium) par Adlice Software email : http://www.adlice.com/contact/ Remontées : http://forum.adlice.com Site web : http://www.adlice.com/fr/download/roguekiller/ Blog : http://www.adlice.com Système d'exploitation : Windows 7 (6.1.7600) 32 bits version Démarré en : Mode normal Utilisateur : byc-info [Administrateur] Démarré depuis : C:\Program Files\RogueKiller\RogueKiller.exe Mode : Suppression -- Date : 01/20/2017 20:10:16 (Durée : 00:43:55) ¤¤¤ Processus : 0 ¤¤¤ ¤¤¤ Registre : 8 ¤¤¤ [PUP.Gen0] HKEY_CLASSES_ROOT\CLSID\{6E993643-8FBC-44FE-BC85-D318495C4D96} (C:\Program Files\Common Files\WONDER~1\WONDER~1\WSHelper.exe) -> Supprimé(e) [Suspicious.Path] HKEY_CLASSES_ROOT\CLSID\{881BAA28-DB96-11E6-9F63-64006A5CFC23} (C:\Users\byc-info\AppData\Roaming\Nogation\Plemuther.dll) -> Supprimé(e) [Suspicious.Path] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks | {881BAA28-DB96-11E6-9F63-64006A5CFC23} : (C:\Users\byc-info\AppData\Roaming\Nogation\Plemuther.dll) [x] -> Supprimé(e) [PUM.Proxy] HKEY_USERS\S-1-5-21-342121905-4264983168-326372114-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings | AutoConfigUrl : http://noblockweb.biz/wpad.dat?c3cdff00552baae1a3f2a9842e25aeec23934189 -> Supprimé(e) [PUM.Proxy] HKEY_LOCAL_MACHINE\System\ControlSet001\Services\NlaSvc\Parameters\Internet\ManualProxies | (default) : 0http://noblockweb.biz/wpad.dat?c3cdff00552baae1a3f2a9842e25aeec23934189 -> Supprimé(e) [PUM.Proxy] HKEY_LOCAL_MACHINE\System\ControlSet002\Services\NlaSvc\Parameters\Internet\ManualProxies | (default) : 0http://noblockweb.biz/wpad.dat?c3cdff00552baae1a3f2a9842e25aeec23934189 -> Supprimé(e) [PUM.Policies] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System | ConsentPromptBehaviorAdmin : 0 -> Remplacé(e) (2) [PUM.StartMenu] HKEY_USERS\S-1-5-21-342121905-4264983168-326372114-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced | Start_ShowMyGames : 0 -> Remplacé(e) (1) ¤¤¤ Tâches : 0 ¤¤¤ ¤¤¤ Fichiers : 4 ¤¤¤ [Hj.Shortcut][Fichier] C:\Users\byc-info\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk [LNK@] C:\Program Files\Internet Explorer\iexplore.exe http://fanli90.cn/ -> Raccourci nettoyé [Hj.Shortcut][Fichier] C:\Users\byc-info\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk [LNK@] C:\Program Files\Internet Explorer\iexplore.exe http://fanli90.cn/ -> Raccourci nettoyé [Hj.Shortcut][Fichier] C:\Users\byc-info\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Internet Explorer.lnk [LNK@] C:\Program Files\Internet Explorer\iexplore.exe http://fanli90.cn/ -> Raccourci nettoyé [Hj.Shortcut][Fichier] C:\Users\byc-info\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk [LNK@] C:\Program Files\Internet Explorer\iexplore.exe http://fanli90.cn/ -> Supprimé(e) ¤¤¤ WMI : 1 ¤¤¤ [PUP.Yeahbests] instance (ActiveScriptEventConsumer) \ROOT\subscription:ActiveScriptEventConsumer.Name="ASEC" -> Supprimé(e) ¤¤¤ Fichier Hosts : 0 ¤¤¤ ¤¤¤ Antirootkit : 0 (Driver: Chargé) ¤¤¤ ¤¤¤ Navigateurs web : 0 ¤¤¤ ¤¤¤ Vérification MBR : ¤¤¤ +++++ PhysicalDrive0: ST9500325AS +++++ --- User --- [MBR] b4ee5467927464b738c1b9b5679e6dfe [BSP] 111adbac3403df1f24e48854bed08060 : Windows Vista/7/8 MBR Code Partition table: 0 - [ACTIVE] NTFS (0x7) [VISIBLE] Offset (sectors): 2048 | Size: 100 MB [Windows Vista/7/8 Bootstrap | Windows Vista/7/8 Bootloader] 1 - [XXXXXX] NTFS (0x7) [VISIBLE] Offset (sectors): 206848 | Size: 238371 MB [Windows Vista/7/8 Bootstrap | Windows Vista/7/8 Bootloader] 2 - [XXXXXX] NTFS (0x7) [VISIBLE] Offset (sectors): 488390656 | Size: 238467 MB [Windows Vista/7/8 Bootstrap | Windows Vista/7/8 Bootloader] User = LL1 ... OK User = LL2 ... OK