RogueKiller V8.5.4 [Mar 18 2013] by Tigzy
mail : tigzyRK<at>gmail<dot>com
Feedback :
https://www.techspot.com/downloads/5562-roguekiller.html
Website :
http://tigzy.geekstogo.com/roguekiller.php
Blog :
http://tigzyrk.blogspot.com/
Operating System : Windows 7 (6.1.7601 Service Pack 1) 32 bits version
Started in : Normal mode
User : clientb [Admin rights]
Mode : Remove -- Date : 04/10/2013 08:35:00
| ARK || FAK || MBR |
¤¤¤ Bad processes : 5 ¤¤¤
[SVCHOST] svchost.exe -- C:\Windows\System32\svchost.exe [x] -> KILLED [TermProc]
[DLL] explorer.exe -- C:\Windows\explorer.exe : C:\Users\clientb\AppData\Local\Adobe\drfohxkk.dll [x] -> UNLOADED
[DLL] rundll32.exe -- C:\Windows\System32\rundll32.exe : C:\Users\clientb\AppData\Local\VIDEO WMX Moniker Class\DevnetPlay.dll [x] -> KILLED [TermProc]
[DLL] explorer.exe -- C:\Windows\explorer.exe : C:\Users\clientb\AppData\Local\Adobe\drfohxkk.dll [x] -> UNLOADED
[DLL] explorer.exe -- C:\Windows\explorer.exe : C:\Users\clientb\AppData\Local\Adobe\drfohxkk.dll [x] -> UNLOADED
¤¤¤ Registry Entries : 5 ¤¤¤
[RUN][SUSP PATH] HKCU\[...]\Run : VIDEOWMX (rundll32.exe "C:\Users\clientb\AppData\Local\VIDEO WMX Moniker Class\DevnetPlay.dll",kbdapi80 BthPadplugin) [x] -> DELETED
[RUN][SUSP PATH] HKCU\[...]\Run : Adobe (regsvr32.exe C:\Users\clientb\AppData\Local\Adobe\drfohxkk.dll) [-] -> DELETED
[HJ SMENU] HKCU\[...]\Advanced : Start_ShowMyGames (0) -> REPLACED (1)
[HJ DESK] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> REPLACED (0)
[HJ DESK] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> REPLACED (0)
¤¤¤ Particular Files / Folders: ¤¤¤
¤¤¤ Driver : [LOADED] ¤¤¤
SSDT[13] : NtAlertResumeThread @ 0x82AF7C99 -> HOOKED (Unknown @ 0x868D0C20)
SSDT[14] : NtAlertThread @ 0x82A4ABE0 -> HOOKED (Unknown @ 0x868D0DB8)
SSDT[19] : NtAllocateVirtualMemory @ 0x82A43BEC -> HOOKED (Unknown @ 0x868BEAA0)
SSDT[22] : NtAlpcConnectPort @ 0x82A8F44E -> HOOKED (Unknown @ 0x85E99C90)
SSDT[43] : NtAssignProcessToJobObject @ 0x82A18FEE -> HOOKED (Unknown @ 0x868D00F8)
SSDT[74] : NtCreateMutant @ 0x82A2A2B2 -> HOOKED (Unknown @ 0x868D0800)
SSDT[86] : NtCreateSymbolicLinkObject @ 0x82A1B911 -> HOOKED (Unknown @ 0x868FB8E0)
SSDT[87] : NtCreateThread @ 0x82AF5ECA -> HOOKED (Unknown @ 0x868BEFB0)
SSDT[88] : NtCreateThreadEx @ 0x82A8A36B -> HOOKED (Unknown @ 0x868FBCB8)
SSDT[96] : NtDebugActiveProcess @ 0x82AC7D9A -> HOOKED (Unknown @ 0x868D0200)
SSDT[111] : NtDuplicateObject @ 0x82A4B67A -> HOOKED (Unknown @ 0x868BEC70)
SSDT[131] : NtFreeVirtualMemory @ 0x828D1AEC -> HOOKED (Unknown @ 0x868BE858)
SSDT[145] : NtImpersonateAnonymousToken @ 0x82A0F8E0 -> HOOKED (Unknown @ 0x868D09A8)
SSDT[147] : NtImpersonateThread @ 0x82A9384C -> HOOKED (Unknown @ 0x868D0B40)
SSDT[155] : NtLoadDriver @ 0x829DFC20 -> HOOKED (Unknown @ 0x85E771A0)
SSDT[168] : NtMapViewOfSection @ 0x82A60532 -> HOOKED (Unknown @ 0x868BE6A0)
SSDT[177] : NtOpenEvent @ 0x82A29CAE -> HOOKED (Unknown @ 0x868FBFD0)
SSDT[190] : NtOpenProcess @ 0x82A2BAF8 -> HOOKED (Unknown @ 0x868BEE78)
SSDT[191] : NtOpenProcessToken @ 0x82A7E23F -> HOOKED (Unknown @ 0x868BEB90)
SSDT[194] : NtOpenSection @ 0x82A838BB -> HOOKED (Unknown @ 0x868D0428)
SSDT[198] : NtOpenThread @ 0x82A77FC3 -> HOOKED (Unknown @ 0x868BED88)
SSDT[215] : NtProtectVirtualMemory @ 0x82A5C5A1 -> HOOKED (Unknown @ 0x868FBDB8)
SSDT[304] : NtResumeThread @ 0x82A8A592 -> HOOKED (Unknown @ 0x868D0F50)
SSDT[316] : NtSetContextThread @ 0x82AF7745 -> HOOKED (Unknown @ 0x868BE338)
SSDT[333] : NtSetInformationProcess @ 0x82A5278D -> HOOKED (Unknown @ 0x868BE4D0)
SSDT[350] : NtSetSystemInformation @ 0x82A6829A -> HOOKED (Unknown @ 0x868D02E0)
SSDT[366] : NtSuspendProcess @ 0x82AF7BD3 -> HOOKED (Unknown @ 0x868D05C0)
SSDT[367] : NtSuspendThread @ 0x82AAF085 -> HOOKED (Unknown @ 0x868BE178)
SSDT[370] : NtTerminateProcess @ 0x82A74BFB -> HOOKED (Unknown @ 0x868B61C0)
SSDT[371] : unknown @ 0x82A92584 -> HOOKED (Unknown @ 0x868BE258)
SSDT[385] : NtUnmapViewOfSection @ 0x82A7E87A -> HOOKED (Unknown @ 0x868BE5C0)
SSDT[399] : NtWriteVirtualMemory @ 0x82A79958 -> HOOKED (Unknown @ 0x868BE948)
S_SSDT[318] : NtUserAttachThreadInput -> HOOKED (Unknown @ 0x84ED4848)
S_SSDT[402] : NtUserGetAsyncKeyState -> HOOKED (Unknown @ 0x869FC3B0)
S_SSDT[434] : NtUserGetKeyboardState -> HOOKED (Unknown @ 0x86A27BF8)
S_SSDT[436] : NtUserGetKeyState -> HOOKED (Unknown @ 0x86A52AB8)
S_SSDT[448] : NtUserGetRawInputData -> HOOKED (Unknown @ 0x85D0F698)
S_SSDT[490] : NtUserMessageCall -> HOOKED (Unknown @ 0x86BF2C38)
S_SSDT[508] : NtUserPostMessage -> HOOKED (Unknown @ 0x86BD4C38)
S_SSDT[509] : NtUserPostThreadMessage -> HOOKED (Unknown @ 0x86BE67A8)
S_SSDT[585] : NtUserSetWindowsHookEx -> HOOKED (Unknown @ 0x86A621D8)
S_SSDT[588] : NtUserSetWinEventHook -> HOOKED (Unknown @ 0x86BA4098)
¤¤¤ HOSTS File: ¤¤¤
--> C:\Windows\system32\drivers\etc\hosts
¤¤¤ MBR Check: ¤¤¤
+++++ PhysicalDrive0: ST3400832AS ATA Device +++++
--- User ---
[MBR] 5efd045731889a604ec3892c35e6c54f
[BSP] 73a416a01c7af87de45a54d5d5a14472 : Windows 7/8 MBR Code
Partition table:
0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 63 | Size: 39 Mo
1 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 80325 | Size: 381512 Mo
User = LL1 ... OK!
User != LL2 ... KO!
--- LL2 ---
[MBR] f7ddfe522abcd18587657865c9b08a91
[BSP] 73a416a01c7af87de45a54d5d5a14472 : Windows 7/8 MBR Code
Partition table:
1 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 63 | Size: 39 Mo
2 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 80325 | Size: 381512 Mo
Finished : << RKreport[2]_D_04102013_02d0835.txt >>
RKreport[1]_S_04102013_02d0831.txt ; RKreport[2]_D_04102013_02d0835.txt