cjoint

Publicité


Publicité

Format du document : text/plain

Prévisualisation

ÿþRogueKiller V12.9.1.0 (x64) [Jan 2 2017] (Premium) par Adlice Software
email : http://www.adlice.com/contact/
Remontées : http://forum.adlice.com
Site web : http://www.adlice.com/fr/download/roguekiller/
Blog : http://www.adlice.com

Système d'exploitation : Windows 7 (6.1.7601 Service Pack 1) 64 bits version
Démarré en : Mode normal
Utilisateur : yassine [Administrateur]
Démarré depuis : C:\Program Files\RogueKiller\RogueKiller64.exe
Mode : Scan -- Date : 01/07/2017 23:28:11 (Durée : 01:51:36)

¤¤¤ Processus : 2 ¤¤¤
[VT.ApplicUnwnt] netcut.exe(4120) -- C:\Program Files (x86)\netcut\netcut.exe[-] -> Trouvé(e)
[Suspicious.Path|VT.Backdoor:MSIL/Bladabindi.B] server.exe(4872) -- C:\Users\yassine\AppData\Local\Temp\server.exe[-] -> Trouvé(e)

¤¤¤ Registre : 18 ¤¤¤
[Suspicious.Path] (X64) HKEY_CLASSES_ROOT\CLSID\{5F51FFFE-7463-4220-B711-E5B9ACB8EDFE} (C:\ProgramData\igfxDH.dll) -> Trouvé(e)
[Suspicious.Path] (X64) HKEY_CLASSES_ROOT\CLSID\{6A8DE730-CB76-11E6-88C8-64006A5CFC23} (C:\Users\yassine\AppData\Roaming\Atowution\Stowat.dll) -> Trouvé(e)
[PUP.Gen0] (X64) HKEY_CLASSES_ROOT\CLSID\{E104B9E4-01BA-4AAF-9957-6A525CC5451A} -> Trouvé(e)
[PUP.Gen1] (X64) HKEY_USERS\S-1-5-21-1607161227-1741431587-2329729702-1000\Software\IM -> Trouvé(e)
[PUP.Gen1] (X86) HKEY_USERS\S-1-5-21-1607161227-1741431587-2329729702-1000\Software\IM -> Trouvé(e)
[Suspicious.Path] (X64) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks | {5F51FFFE-7463-4220-B711-E5B9ACB8EDFE} : (C:\ProgramData\igfxDH.dll) [x] -> Trouvé(e)
[Suspicious.Path] (X64) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks | {6A8DE730-CB76-11E6-88C8-64006A5CFC23} : (C:\Users\yassine\AppData\Roaming\Atowution\Stowat.dll) [-] -> Trouvé(e)
[Suspicious.Path|VT.Backdoor:MSIL/Bladabindi.B] (X86) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run | 68d194b5db1a31d61c2552bfaf739bb7 : "C:\Users\yassine\AppData\Local\Temp\server.exe" .. [-] -> Trouvé(e)
[Suspicious.Path|VT.Backdoor:MSIL/Bladabindi.B] (X64) HKEY_USERS\S-1-5-21-1607161227-1741431587-2329729702-1000\Software\Microsoft\Windows\CurrentVersion\Run | 68d194b5db1a31d61c2552bfaf739bb7 : "C:\Users\yassine\AppData\Local\Temp\server.exe" .. [-] -> Trouvé(e)
[Suspicious.Path|VT.Backdoor:MSIL/Bladabindi.B] (X86) HKEY_USERS\S-1-5-21-1607161227-1741431587-2329729702-1000\Software\Microsoft\Windows\CurrentVersion\Run | 68d194b5db1a31d61c2552bfaf739bb7 : "C:\Users\yassine\AppData\Local\Temp\server.exe" .. [-] -> Trouvé(e)
[PUM.SEH] (X64) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer | EnableShellExecuteHooks : 1 -> Trouvé(e)
[PUM.SEH] (X86) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer | EnableShellExecuteHooks : 1 -> Trouvé(e)
[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Tcpip\Parameters\Interfaces\{5F586AFD-BCCC-4111-A0E4-FFFC70EAC646} | NameServer : 217.212.1.1,212.217.0.1 ([Sweden][-]) -> Trouvé(e)
[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\ControlSet002\Services\Tcpip\Parameters\Interfaces\{5F586AFD-BCCC-4111-A0E4-FFFC70EAC646} | NameServer : 217.212.1.1,212.217.0.1 ([Sweden][-]) -> Trouvé(e)
[PUP.Gen1] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules | {4929D06A-CBE5-4E18-BB54-6EF808C488AB} : v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=6|Profile=Public|App=C:\Program Files (x86)\Popcorn Time\PopcornTimeDesktop.exe|Name=Popcorn Time| [-] -> Trouvé(e)
[PUP.Gen1] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules | {73C8B707-F253-4343-831A-BCF5767EFFAC} : v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=17|Profile=Public|App=C:\Program Files (x86)\Popcorn Time\PopcornTimeDesktop.exe|Name=Popcorn Time| [-] -> Trouvé(e)
[PUP.Gen1] (X64) HKEY_LOCAL_MACHINE\System\ControlSet002\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules | {4929D06A-CBE5-4E18-BB54-6EF808C488AB} : v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=6|Profile=Public|App=C:\Program Files (x86)\Popcorn Time\PopcornTimeDesktop.exe|Name=Popcorn Time| [-] -> Trouvé(e)
[PUP.Gen1] (X64) HKEY_LOCAL_MACHINE\System\ControlSet002\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules | {73C8B707-F253-4343-831A-BCF5767EFFAC} : v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=17|Profile=Public|App=C:\Program Files (x86)\Popcorn Time\PopcornTimeDesktop.exe|Name=Popcorn Time| [-] -> Trouvé(e)

¤¤¤ Tâches : 3 ¤¤¤
[PUP.Gen0] %WINDIR%\Tasks\NC.job -- C:\Program Files (x86)\Microleaves\Traffic Exchange\nc.exe -> Trouvé(e)
[PUP.Gen0] \NC -- C:\Program Files (x86)\Microleaves\Traffic Exchange\nc.exe -> Trouvé(e)
[Tr.Gen0|Suspicious.Path|VT.Adware.OxyPumper] \Microsoft\Windows\Multimedia\Manager -- C:\Users\yassine\AppData\Roaming\Adobe\Manager.exe (604C4206-B430-43E1-A102-8BF11249AEC2) -> Trouvé(e)

¤¤¤ Fichiers : 30 ¤¤¤
[Hj.Shortcut][Fichier] C:\Users\Public\Desktop\Google Chrome.lnk [LNK@] C:\Program Files (x86)\Google\Chrome\APPLIC~1\chrome.exe --load-extension="C:\Users\yassine\AppData\Local\kemgadeojglibflomicgnfeopkdfflnk" http://qtipr.com/ -> Trouvé(e)
[Hj.Shortcut][Fichier] C:\Users\Public\Desktop\Mozilla Firefox.lnk [LNK@] C:\Program Files (x86)\MOZILL~1\firefox.exe http://qtipr.com/ -> Trouvé(e)
[PUP.Gen1][Fichier] C:\Users\Public\Desktop\Popcorn Time.lnk [LNK@] C:\Program Files (x86)\POPCOR~1\POPCOR~1.EXE --no-proxy-server -> Trouvé(e)
[Hj.Shortcut][Fichier] C:\Users\yassine\Desktop\Internet Explorer.lnk [LNK@] C:\Program Files\Internet Explorer\iexplore.exe http://qtipr.com/ -> Trouvé(e)
[Hj.Shortcut][Fichier] C:\Users\yassine\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk [LNK@] C:\Program Files\Internet Explorer\iexplore.exe http://qtipr.com/ -> Trouvé(e)
[Hj.Shortcut][Fichier] C:\Users\yassine\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk [LNK@] C:\Program Files (x86)\Google\Chrome\APPLIC~1\chrome.exe --load-extension="C:\Users\yassine\AppData\Local\kemgadeojglibflomicgnfeopkdfflnk" http://qtipr.com/ -> Trouvé(e)
[Hj.Shortcut][Fichier] C:\Users\yassine\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Internet Explorer.LNK [LNK@] C:\Program Files\Internet Explorer\iexplore.exe http://qtipr.com/ -> Trouvé(e)
[Hj.Shortcut][Fichier] C:\Users\yassine\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk [LNK@] C:\Program Files\Internet Explorer\iexplore.exe http://qtipr.com/ -> Trouvé(e)
[Hj.Shortcut][Fichier] C:\Users\yassine\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Google Chrome (2).lnk [LNK@] C:\Program Files (x86)\Google\Chrome\APPLIC~1\chrome.exe --load-extension="C:\Users\yassine\AppData\Local\kemgadeojglibflomicgnfeopkdfflnk" http://qtipr.com/ -> Trouvé(e)
[Hj.Shortcut][Fichier] C:\Users\yassine\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Google Chrome.lnk [LNK@] C:\Program Files (x86)\Google\Chrome\APPLIC~1\chrome.exe --load-extension="C:\Users\yassine\AppData\Local\kemgadeojglibflomicgnfeopkdfflnk" http://qtipr.com/ -> Trouvé(e)
[Hj.Shortcut][Fichier] C:\Users\yassine\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Internet Explorer.lnk [LNK@] C:\Program Files\Internet Explorer\iexplore.exe http://qtipr.com/ -> Trouvé(e)
[Hj.Shortcut][Fichier] C:\Users\yassine\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Mozilla Firefox.lnk [LNK@] C:\Program Files (x86)\MOZILL~1\firefox.exe http://qtipr.com/ -> Trouvé(e)
[Tr.Gen0][Fichier] C:\Users\yassine\AppData\Roaming\Adobe\Manager.exe -> Trouvé(e)
[Tr.Gen0][Fichier] C:\Users\yassine\AppData\Roaming\uTorrent\updates\3.4.5_41073\utorrentie.exe -> Trouvé(e)
[Tr.Gen0][Fichier] C:\Users\yassine\AppData\Roaming\uTorrent\updates\3.4.5_41162\utorrentie.exe -> Trouvé(e)
[Tr.Gen0][Fichier] C:\Users\yassine\AppData\Roaming\uTorrent\updates\3.4.5_41202\utorrentie.exe -> Trouvé(e)
[Tr.Gen0][Fichier] C:\Users\yassine\AppData\Roaming\uTorrent\updates\3.4.5_41372\utorrentie.exe -> Trouvé(e)
[Tr.Gen0][Fichier] C:\Users\yassine\AppData\Roaming\uTorrent\updates\3.4.5_41712\utorrentie.exe -> Trouvé(e)
[Tr.Gen0][Fichier] C:\Users\yassine\AppData\Roaming\uTorrent\updates\3.4.5_41865\utorrentie.exe -> Trouvé(e)
[Tr.Gen0][Fichier] C:\Users\yassine\AppData\Roaming\uTorrent\updates\3.4.6_42094\utorrentie.exe -> Trouvé(e)
[Tr.Gen0][Fichier] C:\Users\yassine\AppData\Roaming\uTorrent\updates\3.4.7_42330\utorrentie.exe -> Trouvé(e)
[Tr.Gen0][Fichier] C:\Users\yassine\AppData\Roaming\uTorrent\updates\3.4.8_42449\utorrentie.exe -> Trouvé(e)
[Tr.Gen0][Fichier] C:\Users\yassine\AppData\Roaming\uTorrent\updates\3.4.8_42576\utorrentie.exe -> Trouvé(e)
[Tr.Gen0][Fichier] C:\Users\yassine\AppData\Roaming\uTorrent\updates\3.4.9_42606\utorrentie.exe -> Trouvé(e)
[Tr.Gen0][Fichier] C:\Users\yassine\AppData\Roaming\uTorrent\updates\3.4.9_42923\utorrentie.exe -> Trouvé(e)
[Tr.Gen0][Fichier] C:\Users\yassine\AppData\Roaming\uTorrent\updates\3.4.9_42973\utorrentie.exe -> Trouvé(e)
[Tr.Gen0][Fichier] C:\Users\yassine\AppData\Roaming\uTorrent\updates\3.4.9_43085\utorrentie.exe -> Trouvé(e)
[PUP.Gen1][Répertoire] C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Popcorn Time -> Trouvé(e)
[PUP.Gen1][Répertoire] C:\Program Files (x86)\Popcorn Time -> Trouvé(e)
[PUP.Gen1][Fichier] C:\Users\Public\Desktop\Popcorn Time.lnk [LNK@] C:\Program Files (x86)\POPCOR~1\POPCOR~1.EXE --no-proxy-server -> Trouvé(e)

¤¤¤ WMI : 1 ¤¤¤
[PUP.Yeahbests] instance (ActiveScriptEventConsumer) \ROOT\subscription:ActiveScriptEventConsumer.Name="ASEC" -> Trouvé(e)

¤¤¤ Fichier Hosts : 0 ¤¤¤

¤¤¤ Antirootkit : 0 (Driver: Chargé) ¤¤¤

¤¤¤ Navigateurs web : 4 ¤¤¤
[PUP.Gen2][Firefox:Addon] wyy7kuna.default : Digital More [{24a2b69f-60b0-4a00-854e-efe78cf2da81}] -> Trouvé(e)
[PUM.SearchEngine][Firefox:Config] wyy7kuna.default : user_pref("browser.search.defaultenginename", "Default"); -> Trouvé(e)
[PUM.SearchPage][Chrome:Config] ChromeDefaultData [SecurePrefs] : default_search_provider_data.template_url_data.keyword [feed.sonic-search.com] -> Trouvé(e)
[PUM.SearchPage][Chrome:Config] ChromeDefaultData [SecurePrefs] : default_search_provider_data.template_url_data.url [http://%66%65%65%64.%73%6F%6E%69%63-%73%65%61%72%63%68.%63%6F%6D/?p=mKO_AwFzXIpYRaHdGIjVkxlyIP4NYe17aVLWpoE9FMzuYVvM8PdPsyP2ILdwqT0j9Q3RPtbn-lyfBNMAM1nbX8uN43xY_SNRnuXDGhTFNjCOjGKmnnsnygKzNswF5IeL4ebpICA83Rg9NYOG0ZZkZI3Gg-N50qowgT84Z_83NnF5oKOBU8q3GAGzBzUV23s3_CcT1tmadeYC&q={searchTerms}] -> Trouvé(e)

¤¤¤ Vérification MBR : ¤¤¤
+++++ PhysicalDrive0: +++++
--- User ---
[MBR] 4f25c959df745ba8a82b4d8b6006e517
[BSP] c3fc2cdf1dec4e6c48dd2582e78202ad : Windows Vista/7/8 MBR Code
Partition table:
0 - [ACTIVE] NTFS (0x7) [VISIBLE] Offset (sectors): 2048 | Size: 100 MB [Windows Vista/7/8 Bootstrap | Windows Vista/7/8 Bootloader]
1 - [XXXXXX] NTFS (0x7) [VISIBLE] Offset (sectors): 206848 | Size: 100838 MB [Windows Vista/7/8 Bootstrap | Windows Vista/7/8 Bootloader]
2 - [XXXXXX] NTFS (0x7) [VISIBLE] Offset (sectors): 206723072 | Size: 375999 MB [Windows Vista/7/8 Bootstrap | Windows Vista/7/8 Bootloader]
User = LL1 ... OK
User = LL2 ... OK

+++++ PhysicalDrive1: Multiple Card Reader USB Device +++++
Error reading User MBR! ([15] Le périphérique n?est pas prêt. )
Error reading LL1 MBR! NOT VALID!
Error reading LL2 MBR! ([32] Cette demande n?est pas prise en charge. )


Publicité


Signaler le contenu de ce document

Publicité