RogueKiller V10.2.0.0 (x64) [Jan 19 2015] by Adlice Software mail : http://www.adlice.com/contact/ Feedback : http://forum.adlice.com Website : http://www.adlice.com/softwares/roguekiller/ Blog : http://www.adlice.com Operating System : Windows 7 (6.1.7601 Service Pack 1) 64 bits version Started in : Normal mode User : TeamTkac [Administrator] Mode : Delete -- Date : 02/11/2015 18:09:52 ¤¤¤ Processes : 0 ¤¤¤ ¤¤¤ Registry : 19 ¤¤¤ [PUM.HomePage] (X64) HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Main | Start Page : http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome -> Not selected [PUM.HomePage] (X86) HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Main | Start Page : http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome -> Not selected [PUM.HomePage] (X64) HKEY_USERS\S-1-5-21-563202287-1717114301-743867805-1000\Software\Microsoft\Internet Explorer\Main | Start Page : https://www.yahoo.com/ -> Not selected [PUM.HomePage] (X86) HKEY_USERS\S-1-5-21-563202287-1717114301-743867805-1000\Software\Microsoft\Internet Explorer\Main | Start Page : https://www.yahoo.com/ -> Not selected [PUM.HomePage] (X64) HKEY_USERS\S-1-5-18\Software\Microsoft\Internet Explorer\Main | Start Page : http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome -> Not selected [PUM.HomePage] (X86) HKEY_USERS\S-1-5-18\Software\Microsoft\Internet Explorer\Main | Start Page : http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome -> Not selected [PUM.SearchPage] (X64) HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Main | Search Page : http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch -> Not selected [PUM.SearchPage] (X86) HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Main | Search Page : http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch -> Not selected [PUM.SearchPage] (X64) HKEY_USERS\S-1-5-21-563202287-1717114301-743867805-1000\Software\Microsoft\Internet Explorer\Main | Search Page : http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch -> Not selected [PUM.SearchPage] (X86) HKEY_USERS\S-1-5-21-563202287-1717114301-743867805-1000\Software\Microsoft\Internet Explorer\Main | Search Page : http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch -> Not selected [PUM.SearchPage] (X64) HKEY_USERS\S-1-5-18\Software\Microsoft\Internet Explorer\Main | Search Page : http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch -> Not selected [PUM.SearchPage] (X86) HKEY_USERS\S-1-5-18\Software\Microsoft\Internet Explorer\Main | Search Page : http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch -> Not selected [PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{07975DFE-1B7B-404C-9ECF-7ED968287C24} | DhcpNameServer : 209.222.18.222 209.222.18.218 [UNITED STATES (US)][UNITED STATES (US)] -> Not selected [PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Tcpip\Parameters\Interfaces\{07975DFE-1B7B-404C-9ECF-7ED968287C24} | DhcpNameServer : 209.222.18.222 209.222.18.218 [UNITED STATES (US)][UNITED STATES (US)] -> Not selected [PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\ControlSet002\Services\Tcpip\Parameters\Interfaces\{07975DFE-1B7B-404C-9ECF-7ED968287C24} | DhcpNameServer : 209.222.18.222 209.222.18.218 [UNITED STATES (US)][UNITED STATES (US)] -> Not selected [PUM.DesktopIcons] (X64) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {20D04FE0-3AEA-1069-A2D8-08002B30309D} : 1 -> Not selected [PUM.DesktopIcons] (X64) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {59031a47-3f72-44a7-89c5-5595fe6b30ee} : 1 -> Not selected [PUM.DesktopIcons] (X86) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {20D04FE0-3AEA-1069-A2D8-08002B30309D} : 1 -> Not selected [PUM.DesktopIcons] (X86) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {59031a47-3f72-44a7-89c5-5595fe6b30ee} : 1 -> Not selected ¤¤¤ Tasks : 0 ¤¤¤ ¤¤¤ Files : 0 ¤¤¤ ¤¤¤ Hosts File : 3 ¤¤¤ [C:\Windows\System32\drivers\etc\hosts] 127.0.0.1 localhost [C:\Windows\System32\drivers\etc\hosts] ::1 localhost [C:\Windows\System32\drivers\etc\hosts] ਍਍‣湵档捥祫扟来湩਍‣桔獥⁥畲敬⁳敷敲愠摤摥戠⁹桴⁥湕档捥祫瀠潲牧浡椠牯敤⁲潴戠潬正愠癤牥楴楳杮猠景睴牡⁥潭畤敬൳《〮〮〮〠〮〮〮⌠映硩映牯琠慲散潲瑵⁥湡⁤敮獴慴⁴楤灳慬⁹湡浯污൹《〮〮〮琠慲正湩⹧灯湥慣摮⹹潣⹭㍳愮慭潺慮獷挮浯਍⸰⸰⸰‰敭楤⹡灯湥慣摮⹹潣൭《〮〮〮挠湤漮数据湡祤挮浯਍⸰⸰⸰‰牴捡楫杮漮数据湡祤挮浯਍⸰⸰⸰‰灡⹩灯湥慣摮⹹潣൭《〮〮〮椠獮慴汬牥戮瑥整楲獮慴汬牥挮浯਍⸰⸰⸰‰湩瑳污敬⹲楦敬畢汬潤⹧潣൭《〮〮〮搠漳瑸ㅮ㍸㡢㝤⹩汣畯晤潲瑮渮瑥਍⸰⸰⸰‰湩潮戮獩癲挮浯਍⸰⸰⸰‰獮獩戮獩癲挮浯਍⸰⸰⸰‰摣⹮楦敬搲獥瑫灯挮浯਍⸰⸰⸰‰摣⹮潧瑡慥瑳慣档甮൳《〮〮〮挠湤朮瑵慴瑳瑡此甮൳《〮〮〮挠湤椮獮楫浮摥慩挮浯਍⸰⸰⸰‰摣⹮湩瑳⹡楯畢摮敬㉳挮浯਍⸰⸰⸰‰摣⹮湩瑳⹡汰祡牢瑹⹥潣൭《〮〮〮挠湤氮潬敧晴獡捴捡⹨獵਍⸰⸰⸰‰摣⹮潭瑮敩慲挮浯਍⸰⸰⸰‰摣⹮獭睤汮⹤潣൭《〮〮〮挠湤洮灹扣捡畫⹰潣൭《〮〮〮挠湤瀮摰睯汮慯⹤潣൭《〮〮〮挠湤爮捩慥整獡捴捡⹨獵਍⸰⸰⸰‰摣⹮桳慹潰慴潴甮൳《〮〮〮挠湤献汯浩慢挮浯਍⸰⸰⸰‰摣⹮畴潴瀴⹣潣൭《〮〮〮挠湤愮灰潲湵⹤楢ൺ《〮〮〮挠湤戮杩灳敥灤潲挮浯਍⸰⸰⸰‰摣⹮楢灳⹤潣൭《〮〮〮挠湤戮獩癲挮浯਍⸰⸰⸰‰摣⹮摣摮⹰潣൭《〮〮〮挠湤搮睯汮慯⹤睳敥灴捡獫挮浯਍⸰⸰⸰‰摣⹮灤潤湷潬摡挮浯਍⸰⸰⸰‰摣⹮楶畳污敢⹥敮൴⌊甠据敨正役湥൤ ¤¤¤ Antirootkit : 2 (Driver: Loaded) ¤¤¤ [IAT:Inl(Hook.IEAT)] (iexplore.exe) ntdll.dll - LdrUnloadDll : Unknown @ 0x2a075c (jmp 0xffffffff88cdcc4b) [IAT:Inl(Hook.IEAT)] (iexplore.exe) ntdll.dll - LdrLoadDll : Unknown @ 0x2a03a4 (jmp 0xffffffff88cd88e3) ¤¤¤ Web browsers : 0 ¤¤¤ ¤¤¤ MBR Check : ¤¤¤ +++++ PhysicalDrive0: ST9640320AS +++++ --- User --- [MBR] 199225418a6fbd36d3346537c4b8339f [BSP] 41eae1541570870bc951db3a1c5d04e2 : Windows Vista/7/8 MBR Code Partition table: 0 - [XXXXXX] ACER (0x27) [VISIBLE] Offset (sectors): 2048 | Size: 16384 MB 1 - [ACTIVE] NTFS (0x7) [VISIBLE] Offset (sectors): 33556480 | Size: 100 MB [Windows Vista/7/8 Bootstrap | Windows Vista/7/8 Bootloader] 2 - [XXXXXX] NTFS (0x7) [VISIBLE] Offset (sectors): 33761280 | Size: 593994 MB [Windows Vista/7/8 Bootstrap | Windows Vista/7/8 Bootloader] User = LL1 ... OK User = LL2 ... OK ============================================ RKreport_SCN_02102015_161700.log - RKreport_SCN_02112015_180653.log