RogueKiller V8.8.7 [Feb 11 2014] by Tigzy
mail : tigzyRK<at>gmail<dot>com
Feedback :
http://forum.adlice.com
Website :
http://www.adlice.com/softwares/roguekiller/
Blog :
http://www.adlice.com
Operating System : Windows 7 (6.1.7601 Service Pack 1) 32 bits version
Started in : Normal mode
User : AZE [Admin rights]
Mode : Scan -- Date : 02/23/2014 08:01:00
| ARK || FAK || MBR |
¤¤¤ Bad processes : 1 ¤¤¤
[SUSP PATH] LoLPing.exe -- C:\Users\AZE\AppData\Local\Temp\Rar$EXa0.501\LoLPing.exe [-] -> KILLED [TermProc]
¤¤¤ Registry Entries : 9 ¤¤¤
[DNS][PUM] HKLM\[...]\CCSet\[...]\{380966A7-8B08-4B33-B3D4-A2369520925D} : NameServer (8.8.8.8,207.96.76.5 [UNITED STATES (US) - UNITED STATES (US)]) -> FOUND
[DNS][PUM] HKLM\[...]\CS001\[...]\{380966A7-8B08-4B33-B3D4-A2369520925D} : NameServer (8.8.8.8,207.96.76.5 [UNITED STATES (US) - UNITED STATES (US)]) -> FOUND
[DNS][PUM] HKLM\[...]\CS002\[...]\{380966A7-8B08-4B33-B3D4-A2369520925D} : NameServer (8.8.8.8,207.96.76.5 [UNITED STATES (US) - UNITED STATES (US)]) -> FOUND
[HJ POL][PUM] HKCU\[...]\System : DisableRegistryTools (0) -> FOUND
[HJ POL][PUM] HKLM\[...]\System : DisableRegistryTools (0) -> FOUND
[HJ DESK][PUM] HKCU\[...]\ClassicStartMenu : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> FOUND
[HJ DESK][PUM] HKCU\[...]\ClassicStartMenu : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND
[HJ DESK][PUM] HKCU\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> FOUND
[HJ DESK][PUM] HKCU\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND
¤¤¤ Scheduled tasks : 0 ¤¤¤
¤¤¤ Startup Entries : 0 ¤¤¤
¤¤¤ Web browsers : 0 ¤¤¤
¤¤¤ Browser Addons : 0 ¤¤¤
¤¤¤ Particular Files / Folders: ¤¤¤
¤¤¤ Driver : [LOADED] ¤¤¤
¤¤¤ External Hives: ¤¤¤
-> E:\windows\system32\config\SYSTEM | DRVINFO [Drv - E:] | SYSTEMINFO [Sys - G:] [Sys32 - FOUND] | USERINFO [Startup - FOUND]
-> E:\windows\system32\config\SOFTWARE | DRVINFO [Drv - E:] | SYSTEMINFO [Sys - G:] [Sys32 - FOUND] | USERINFO [Startup - FOUND]
-> E:\windows\system32\config\SECURITY | DRVINFO [Drv - E:] | SYSTEMINFO [Sys - G:] [Sys32 - FOUND] | USERINFO [Startup - FOUND]
-> E:\windows\system32\config\SAM | DRVINFO [Drv - E:] | SYSTEMINFO [Sys - G:] [Sys32 - FOUND] | USERINFO [Startup - FOUND]
-> E:\windows\system32\config\DEFAULT | DRVINFO [Drv - E:] | SYSTEMINFO [Sys - G:] [Sys32 - FOUND] | USERINFO [Startup - FOUND]
-> E:\Documents and Settings\AZE\NTUSER.DAT | DRVINFO [Drv - E:] | SYSTEMINFO [Sys - G:] [Sys32 - FOUND] | USERINFO [Startup - FOUND]
-> E:\Documents and Settings\AZE160\NTUSER.DAT | DRVINFO [Drv - E:] | SYSTEMINFO [Sys - G:] [Sys32 - FOUND] | USERINFO [Startup - FOUND]
-> E:\Documents and Settings\Default User\NTUSER.DAT | DRVINFO [Drv - E:] | SYSTEMINFO [Sys - G:] [Sys32 - FOUND] | USERINFO [Startup - FOUND]
-> E:\Documents and Settings\LocalService\NTUSER.DAT | DRVINFO [Drv - E:] | SYSTEMINFO [Sys - G:] [Sys32 - FOUND] | USERINFO [Startup - FOUND]
-> E:\Documents and Settings\NetworkService\NTUSER.DAT | DRVINFO [Drv - E:] | SYSTEMINFO [Sys - G:] [Sys32 - FOUND] | USERINFO [Startup - FOUND]
-> E:\Documents and Settings\UpdatusUser\NTUSER.DAT | DRVINFO [Drv - E:] | SYSTEMINFO [Sys - G:] [Sys32 - FOUND] | USERINFO [Startup - FOUND]
¤¤¤ Infection : ¤¤¤
¤¤¤ HOSTS File: ¤¤¤
--> %SystemRoot%\System32\drivers\etc\hosts
127.0.0.1 localhost
¤¤¤ MBR Check: ¤¤¤
+++++ PhysicalDrive0: (\\.\PHYSICALDRIVE0 @ IDE) ST500DM005 HD502HJ ATA Device +++++
--- User ---
[MBR] f7d990b070d36fd7cd8ccfa67e152fbb
[BSP] bfedcdddb154587225b46023c5e349bf : Windows XP MBR Code
Partition table:
0 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 63 | Size: 10001 Mo
1 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 20688896 | Size: 44901 Mo
2 - [XXXXXX] EXTEN-LBA (0x0f) [VISIBLE] Offset (sectors): 112647780 | Size: 421933 Mo
User = LL1 ... OK!
User = LL2 ... OK!
+++++ PhysicalDrive1: (\\.\PHYSICALDRIVE1 @ IDE) SAMSUNG HA320KJ ATA Device +++++
--- User ---
[MBR] 33550c25e0f3151e2370a86e23f90f70
[BSP] 917fa29889a523b42391b0d315a9d2e5 : Empty MBR Code
Partition table:
0 - [XXXXXX] EXTEN-LBA (0x0f) [VISIBLE] Offset (sectors): 262243 | Size: 249999 Mo
1 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 512262242 | Size: 55114 Mo
User = LL1 ... OK!
User = LL2 ... OK!
Finished : << RKreport[0]_S_02232014_080100.txt >>