Comment supprimer Security Shield
Mise à jour du 23/03/2012:
Ce
Rogue à lancé une nouvelle campagne ces derniers jours, employant
exactement le même fonctionnel, le même nom et la même
interface.
2011/11/23 Update:
This rogue comes back these days with the same functionnal, name and GUI.
_______________________________________
- Télécharger et lancer RogueKiller en mode "Scan" -- Download and start RogueKiller with mode Scan
- S'il ne peut pas se lancer, renommez le en "winlogon.exe" ou "RogueKiller.com" -- Il you are unable to lauch it, rename it as "winlogon.exe" or "RogueKiller.com"
- Vous devriez avoir le rapport suivant -- You should obtain the following report
RogueKiller V7.3.2 [20/03/2012] par Tigzy
mail: tigzyRK<at>gmail<dot>com
Remontees: http://www.sur-la-toile.com/discussion-193725-1-BRogueKillerD-Remontees.html
Blog: http://tigzyrk.blogspot.com
Systeme d'exploitation: Windows XP (5.1.2600 Service Pack 3) 32 bits version
Demarrage : Mode normal
Utilisateur: Administrateur [Droits d'admin]
Mode: Recherche -- Date: 23/03/2012 11:30:54
¤¤¤ Processus malicieux: 2 ¤¤¤
[WINDOW : Security Shield] syecx.exe -- C:\Documents and Settings\Administrateur\Local Settings\Application Data\syecx.exe -> KILLED [TermProc]
[SUSP PATH] syecx.exe -- C:\DOCUME~1\ADMINI~1\LOCALS~1\APPLIC~1\syecx.exe -> KILLED [TermProc]
¤¤¤ Entrees de registre: 0 ¤¤¤
¤¤¤ Fichiers / Dossiers particuliers: ¤¤¤
¤¤¤ Driver: [CHARGE] ¤¤¤
¤¤¤ Infection : Rogue.AntiSpy-ST ¤¤¤
¤¤¤ Fichier HOSTS: ¤¤¤
127.0.0.1 localhost
::1 localhost
¤¤¤ MBR Verif: ¤¤¤
+++++ PhysicalDrive0: VBOX HARDDISK +++++
--- User ---
[MBR] c708b764ca9daa4f8f33e4e8b3b517da
[BSP] f4eb87199eee8a432bb482bb55118447 : Windows XP MBR Code
Partition table:
0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 63 | Size: 4086 Mo
User = LL1 ... OK!
User = LL2 ... OK!
Termine : << RKreport[1].txt >>
RKreport[1].txt
- Ensuite passer un scan avec Malwarebytes -- Then do a scan with Malwarebytes
- Le rogue devrait être supprimé -- The rogue must have been deleted
Nice work, Tigzy :)
RépondreSupprimerIt will kill the new Security Shield before but I see that you allow RogueKille to properly identify which infection it kills :)
Thank you a lot...
RépondreSupprimerFast & efficient.
Merci beaucoup...
Rapide et efficace.
merci effet 100%
RépondreSupprimerMerci mille fois, effet immédiat, super !!!
RépondreSupprimersuper, effet immediat. je suis soulagé
RépondreSupprimerde la bombe, g failli formater et perdre 270 Go de données et des heures de travail , un GRAND merci !
RépondreSupprimerTigzy, I noticed you updated RK to deal with Gendarmerie ransom. Are you supposed to run RK after the ransom is removed? I do not understand as Safe Mode and Normal Mode are blocked.
RépondreSupprimerIf you could help me understand this better I'd appreciate it :)
superbe merci beaucoup!
RépondreSupprimerexcelente muito obrigado!
RépondreSupprimermuito bom amigo
RépondreSupprimerMerci infiniment
RépondreSupprimertrouvé en 2 secondes sur la toile et efficace en un rien de temps. cool
RépondreSupprimerMerci beaucoup, vraiment très efficace, chapeau bas !
RépondreSupprimerWow, une chance qu'on a des personnes comme toi! MERCI!
RépondreSupprimermerci efficace
RépondreSupprimermerci beaucoup !
RépondreSupprimerRogueKiller V7.3.2 [20/03/2012] par Tigzy
RépondreSupprimermail: tigzyRKgmailcom
Remontees: http://www.sur-la-toile.com/discussion-193725-1-BRogueKillerD-Remontees.html
Blog: http://tigzyrk.blogspot.com
Systeme d'exploitation: Windows XP (5.1.2600 Service Pack 3) 32 bits version
Demarrage : Mode normal
Utilisateur: Administrateur [Droits d'admin]
Mode: Recherche -- Date: 23/03/2012 11:30:54
¤¤¤ Processus malicieux: 2 ¤¤¤
[WINDOW : Security Shield] syecx.exe -- C:\Documents and Settings\Administrateur\Local Settings\Application Data\syecx.exe -> KILLED [TermProc]
[SUSP PATH] syecx.exe -- C:\DOCUME~1\ADMINI~1\LOCALS~1\APPLIC~1\syecx.exe -> KILLED [TermProc]
¤¤¤ Entrees de registre: 0 ¤¤¤
¤¤¤ Fichiers / Dossiers particuliers: ¤¤¤
¤¤¤ Driver: [CHARGE] ¤¤¤
¤¤¤ Infection : Rogue.AntiSpy-ST ¤¤¤
¤¤¤ Fichier HOSTS: ¤¤¤
127.0.0.1 localhost
::1 localhost
¤¤¤ MBR Verif: ¤¤¤
+++++ PhysicalDrive0: VBOX HARDDISK +++++
--- User ---
[MBR] c708b764ca9daa4f8f33e4e8b3b517da
[BSP] f4eb87199eee8a432bb482bb55118447 : Windows XP MBR Code
Partition table:
0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 63 | Size: 4086 Mo
User = LL1 ... OK!
User = LL2 ... OK!
Termine : << RKreport[1].txt >>
RKreport[1].txt
excellent work!
RépondreSupprimerFinally got rid of "Live Security Platinum" - Rouge programme.
This is really a pain in the ass~
excellent job with your programm much love <3
RogueKiller V8.1.1 [03/10/2012] par Tigzy
Supprimermail: tigzyRKgmailcom
Remontees: http://www.sur-la-toile.com/discussion-193725-1-BRogueKillerD-Remontees.html
Website: http://www.sur-la-toile.com/RogueKiller/
Blog: http://tigzyrk.blogspot.com
Systeme d'exploitation: Windows XP (5.1.2600 Service Pack 3) 32 bits version
Demarrage : Mode normal
Utilisateur : DELL [Droits d'admin]
Mode : Suppression -- Date : 12/10/2012 19:52:28
¤¤¤ Processus malicieux : 1 ¤¤¤
¤¤¤ Entrees de registre : 7 ¤¤¤
[RUN][SUSP PATH] HKCU\[...]\Run : HKCU (C:\DOCUME~1\DELL\LOCALS~1\Temp\Rar$EX97.000\crack.EXE) -> SUPPRIMÉ
[RUN][SUSP PATH] HKLM\[...]\Run : HKLM (C:\DOCUME~1\DELL\LOCALS~1\Temp\Rar$EX97.000\crack.EXE) -> SUPPRIMÉ
[RUN][Rogue.AntiSpy-ST] HKCU\[...]\RunOnce : 5CF0F3F8492536CF00A55CF04F3F6D9E (C:\Documents and Settings\All Users\Application Data\5CF0F3F8492536CF00A55CF04F3F6D9E\5CF0F3F8492536CF00A55CF04F3F6D9E.exe) -> SUPPRIMÉ
[RUN][SUSP PATH] HKCU\[...]\Policies\Explorer\\Run : Policies (C:\DOCUME~1\DELL\LOCALS~1\Temp\Rar$EX97.000\crack.EXE) -> SUPPRIMÉ
[RUN][SUSP PATH] HKLM\[...]\Policies\Explorer\\Run : Policies (C:\DOCUME~1\DELL\LOCALS~1\Temp\Rar$EX97.000\crack.EXE) -> SUPPRIMÉ
[HJ DESK] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> REMPLACÉ (0)
[APPINIT][SUSP PATH] HKLM\[...]\Windows : AppInit_DLLs (c:\docume~1\alluse~1\applic~1\browse~1\22643~1.41\{16cdf~1\browse~1.dll c:\progra~1\sprote~1\sprote~1.dll) -> REMPLACÉ ()
¤¤¤ Fichiers / Dossiers particuliers: ¤¤¤
¤¤¤ Driver : [CHARGE] ¤¤¤
IRP[IRP_MJ_CREATE] : Unknown -> HOOKED ([MAJOR] atapi.sys @ 0xF7316B40)
IRP[IRP_MJ_CLOSE] : Unknown -> HOOKED ([MAJOR] atapi.sys @ 0xF7316B40)
IRP[IRP_MJ_DEVICE_CONTROL] : Unknown -> HOOKED ([MAJOR] atapi.sys @ 0xF7316B40)
IRP[IRP_MJ_INTERNAL_DEVICE_CONTROL] : Unknown -> HOOKED ([MAJOR] atapi.sys @ 0xF7316B40)
IRP[IRP_MJ_POWER] : Unknown -> HOOKED ([MAJOR] atapi.sys @ 0xF7316B40)
IRP[IRP_MJ_SYSTEM_CONTROL] : Unknown -> HOOKED ([MAJOR] atapi.sys @ 0xF7316B40)
IRP[IRP_MJ_PNP] : Unknown -> HOOKED ([MAJOR] atapi.sys @ 0xF7316B40)
IRP[DriverStartIo] : Unknown -> HOOKED ([MAJOR] atapi.sys @ 0xF7314864)
¤¤¤ Infection : Rogue.AntiSpy-ST ¤¤¤
¤¤¤ Fichier HOSTS: ¤¤¤
--> C:\WINDOWS\system32\drivers\etc\hosts
127.0.0.1 localhost
¤¤¤ MBR Verif: ¤¤¤
+++++ PhysicalDrive0: SAMSUNG HS122JC +++++
--- User ---
[MBR] 3ade97bcfb4f2c098e4f87caea161022
[BSP] 0861d0abafb3590e0e354015798b0e41 : Windows XP MBR Code
Partition table:
0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 63 | Size: 114470 Mo
User = LL1 ... OK!
User = LL2 ... OK!
+++++ PhysicalDrive1: USB DISK 2.0 USB Device +++++
--- User ---
[MBR] ff13248ce2ea1c1feb627ddfcebc6a6c
[BSP] 3eb3657f0a1679bdcaf0b7ba970deba3 : MBR Code unknown
Partition table:
0 - [XXXXXX] FAT32-LBA (0x0c) [VISIBLE] Offset (sectors): 8064 | Size: 3810 Mo
User = LL1 ... OK!
Error reading LL2 MBR!
Termine : << RKreport[2].txt >>
RKreport[1].txt ; RKreport[2].txt
RogueKiller V8.2.3 [07/11/2012] par Tigzy
RépondreSupprimermail: tigzyRKgmailcom
Remontees: http://www.sur-la-toile.com/discussion-193725-1-BRogueKillerD-Remontees.html
Website: http://www.sur-la-toile.com/RogueKiller/
Blog: http://tigzyrk.blogspot.com
Systeme d'exploitation: Windows XP (5.1.2600 Service Pack 3) 32 bits version
Demarrage : Mode normal
Utilisateur : Gilles [Droits d'admin]
Mode : Recherche -- Date : 08/11/2012 11:13:08
¤¤¤ Processus malicieux : 1 ¤¤¤
¤¤¤ Entrees de registre : 8 ¤¤¤
[RUN][SUSP PATH] HKCU\[...]\Run : Google Update ("C:\Documents and Settings\Gilles\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c) -> TROUVÉ
[RUN][SUSP PATH] HKUS\S-1-5-21-1275210071-1767777339-1177238915-1004[...]\Run : Google Update ("C:\Documents and Settings\Gilles\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c) -> TROUVÉ
[RUN][Rogue.AntiSpy-ST] HKCU\[...]\RunOnce : 58B7B1493B126DE8000058B75898747A (C:\Documents and Settings\All Users\Application Data\58B7B1493B126DE8000058B75898747A\58B7B1493B126DE8000058B75898747A.exe) -> TROUVÉ
[RUN][Rogue.AntiSpy-ST] HKUS\S-1-5-21-1275210071-1767777339-1177238915-1004[...]\RunOnce : 58B7B1493B126DE8000058B75898747A (C:\Documents and Settings\All Users\Application Data\58B7B1493B126DE8000058B75898747A\58B7B1493B126DE8000058B75898747A.exe) -> TROUVÉ
[TASK][SUSP PATH] GoogleUpdateTaskUserS-1-5-21-1275210071-1767777339-1177238915-1004UA.job : C:\Documents and Settings\Gilles\Local Settings\Application Data\Google\Update\GoogleUpdate.exe -> TROUVÉ
[TASK][SUSP PATH] GoogleUpdateTaskUserS-1-5-21-1275210071-1767777339-1177238915-1004Core.job : C:\Documents and Settings\Gilles\Local Settings\Application Data\Google\Update\GoogleUpdate.exe -> TROUVÉ
[HJ SMENU] HKCU\[...]\Advanced : Start_ShowRecentDocs (0) -> TROUVÉ
[HJ DESK] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> TROUVÉ
¤¤¤ Fichiers / Dossiers particuliers: ¤¤¤
¤¤¤ Driver : [CHARGE] ¤¤¤
¤¤¤ Infection : Rogue.AntiSpy-ST ¤¤¤
¤¤¤ Fichier HOSTS: ¤¤¤
--> C:\WINDOWS\system32\drivers\etc\hosts
127.0.0.1 localhost
¤¤¤ MBR Verif: ¤¤¤
+++++ PhysicalDrive0: Maxtor 6L160M0 +++++
--- User ---
[MBR] 7c1048e094869d664311f5142eee82b3
[BSP] bc8e0bb4d4d29271ba8f21786691b6b4 : Windows XP MBR Code
Partition table:
0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 63 | Size: 156327 Mo
User = LL1 ... OK!
User = LL2 ... OK!
+++++ PhysicalDrive1: G & T USB Flash Drive USB Device +++++
--- User ---
[MBR] 6645ac52525ed66a1f53ce024514330e
[BSP] e8d89618b5fc3c8068cdc2193def5787 : Standard MBR Code
Partition table:
0 - [ACTIVE] FAT16 (0x06) [VISIBLE] Offset (sectors): 32 | Size: 1919 Mo
User = LL1 ... OK!
Error reading LL2 MBR!
Termine : << RKreport[1]_S_08112012_111308.txt >>
RKreport[1]_S_08112012_111308.txt
RogueKiller V8.3.1 [Dec 2 2012] par Tigzy
RépondreSupprimermail : tigzyRKgmailcom
Remontees : http://www.geekstogo.com/forum/files/file/413-roguekiller/
Site Web : http://www.sur-la-toile.com/RogueKiller/
Blog : http://tigzyrk.blogspot.com/
Systeme d'exploitation : Windows 7 (6.1.7600 ) 64 bits version
Demarrage : Mode normal
Utilisateur : Touati [Droits d'admin]
Mode : Recherche -- Date : 04/12/2012 22:08:05
¤¤¤ Processus malicieux : 3 ¤¤¤
[SUSP PATH] WxDFast.exe -- C:\ProgramData\Premium\WxDFast\WxDFast.exe -> TUÉ [TermProc]
[SUSP PATH] browsemngr.exe -- C:\ProgramData\Browser Manager\2.3.787.43\{16cdff19-861d-48e3-a751-d99a27784753}\browsemngr.exe -> TUÉ [TermProc]
[Rogue.AntiSpy-ST][BLACKLIST] B2AA63EBA5F4F6A50000B2A9B147FCAD.exe -- C:\ProgramData\B2AA63EBA5F4F6A50000B2A9B147FCAD\B2AA63EBA5F4F6A50000B2A9B147FCAD.exe -> TUÉ [TermProc]
¤¤¤ Entrees de registre : 9 ¤¤¤
[RUN][Rogue.AntiSpy-ST] HKCU\[...]\RunOnce : B2AA63EBA5F4F6A50000B2A9B147FCAD (C:\ProgramData\B2AA63EBA5F4F6A50000B2A9B147FCAD\B2AA63EBA5F4F6A50000B2A9B147FCAD.exe) -> TROUVÉ
[RUN][Rogue.AntiSpy-ST] HKUS\S-1-5-21-2122172008-296734720-4173993877-1000[...]\RunOnce : B2AA63EBA5F4F6A50000B2A9B147FCAD (C:\ProgramData\B2AA63EBA5F4F6A50000B2A9B147FCAD\B2AA63EBA5F4F6A50000B2A9B147FCAD.exe) -> TROUVÉ
[TASK][SUSP PATH] WxDFastUpdaterTask{7C7E1E6C-F1CC-40C9-AF3A-3537D31616CC}.job : C:\ProgramData\Premium\WxDFast\WxDFast.exe /schedule /profilepath "C:\ProgramData\Premium\WxDFast\profile.ini" -> TROUVÉ
[TASK][SUSP PATH] OptimizerPro1UpdaterTask{420EEB50-192C-409B-80A6-C5E5445755B9}.job : C:\ProgramData\Premium\OptimizerPro1\OptimizerPro1.exe /schedule /profilepath "C:\ProgramData\Premium\OptimizerPro1\profile.ini" -> TROUVÉ
[STARTUP][SUSP PATH] Xacti Screen Capture 1.1.lnk @Touati : C:\Users\Touati\AppData\Roaming\Microsoft\Installer\{37327654-EBF7-410C-9161-C24D68E02753}\_E47B9B72500055712D025F.exe -> TROUVÉ
[HJ] HKLM\[...]\System : ConsentPromptBehaviorAdmin (0) -> TROUVÉ
[HJ] HKLM\[...]\Wow6432Node\System : ConsentPromptBehaviorAdmin (0) -> TROUVÉ
[HJ DESK] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> TROUVÉ
[HJ DESK] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> TROUVÉ
¤¤¤ Fichiers / Dossiers particuliers: ¤¤¤
¤¤¤ Driver : [NON CHARGE] ¤¤¤
¤¤¤ Infection : Rogue.AntiSpy-ST ¤¤¤
¤¤¤ Fichier HOSTS: ¤¤¤
--> C:\Windows\system32\drivers\etc\hosts
¤¤¤ MBR Verif: ¤¤¤
+++++ PhysicalDrive0: WDC WD5000AAKS-00V1A0 ATA Device +++++
--- User ---
[MBR] d21a0c489e1366a4d27de675c9cb7c0e
[BSP] f82b496e981e2f19d2ec3cc8ce2e821f : Windows 7/8 MBR Code
Partition table:
0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 2048 | Size: 100 Mo
1 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 206848 | Size: 49900 Mo
2 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 102402048 | Size: 210000 Mo
3 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 532482048 | Size: 216938 Mo
User = LL1 ... OK!
User = LL2 ... OK!
+++++ PhysicalDrive1: SanDisk Cruzer Blade USB Device +++++
--- User ---
[MBR] 33a0f33fb7e7f518f64aedcb9dad35b0
[BSP] df4f83c1f72e36823a12b0dfc7617313 : MBR Code unknown
Partition table:
0 - [XXXXXX] FAT32 (0x0b) [VISIBLE] Offset (sectors): 32 | Size: 7633 Mo
User = LL1 ... OK!
Error reading LL2 MBR!
Termine : << RKreport[1]_S_04122012_220805.txt >>
RKreport[1]_S_04122012_220805.txt
RogueKiller V8.3.1 [Dec 2 2012] par Tigzy
RépondreSupprimermail : tigzyRKgmailcom
Remontees : http://www.geekstogo.com/forum/files/file/413-roguekiller/
Site Web : http://www.sur-la-toile.com/RogueKiller/
Blog : http://tigzyrk.blogspot.com/
Systeme d'exploitation : Windows 7 (6.1.7600 ) 64 bits version
Demarrage : Mode normal
Utilisateur : Touati [Droits d'admin]
Mode : Recherche -- Date : 04/12/2012 22:08:05
¤¤¤ Processus malicieux : 3 ¤¤¤
[SUSP PATH] WxDFast.exe -- C:\ProgramData\Premium\WxDFast\WxDFast.exe -> TUÉ [TermProc]
[SUSP PATH] browsemngr.exe -- C:\ProgramData\Browser Manager\2.3.787.43\{16cdff19-861d-48e3-a751-d99a27784753}\browsemngr.exe -> TUÉ [TermProc]
[Rogue.AntiSpy-ST][BLACKLIST] B2AA63EBA5F4F6A50000B2A9B147FCAD.exe -- C:\ProgramData\B2AA63EBA5F4F6A50000B2A9B147FCAD\B2AA63EBA5F4F6A50000B2A9B147FCAD.exe -> TUÉ [TermProc]
¤¤¤ Entrees de registre : 9 ¤¤¤
[RUN][Rogue.AntiSpy-ST] HKCU\[...]\RunOnce : B2AA63EBA5F4F6A50000B2A9B147FCAD (C:\ProgramData\B2AA63EBA5F4F6A50000B2A9B147FCAD\B2AA63EBA5F4F6A50000B2A9B147FCAD.exe) -> TROUVÉ
[RUN][Rogue.AntiSpy-ST] HKUS\S-1-5-21-2122172008-296734720-4173993877-1000[...]\RunOnce : B2AA63EBA5F4F6A50000B2A9B147FCAD (C:\ProgramData\B2AA63EBA5F4F6A50000B2A9B147FCAD\B2AA63EBA5F4F6A50000B2A9B147FCAD.exe) -> TROUVÉ
[TASK][SUSP PATH] WxDFastUpdaterTask{7C7E1E6C-F1CC-40C9-AF3A-3537D31616CC}.job : C:\ProgramData\Premium\WxDFast\WxDFast.exe /schedule /profilepath "C:\ProgramData\Premium\WxDFast\profile.ini" -> TROUVÉ
[TASK][SUSP PATH] OptimizerPro1UpdaterTask{420EEB50-192C-409B-80A6-C5E5445755B9}.job : C:\ProgramData\Premium\OptimizerPro1\OptimizerPro1.exe /schedule /profilepath "C:\ProgramData\Premium\OptimizerPro1\profile.ini" -> TROUVÉ
[STARTUP][SUSP PATH] Xacti Screen Capture 1.1.lnk @Touati : C:\Users\Touati\AppData\Roaming\Microsoft\Installer\{37327654-EBF7-410C-9161-C24D68E02753}\_E47B9B72500055712D025F.exe -> TROUVÉ
[HJ] HKLM\[...]\System : ConsentPromptBehaviorAdmin (0) -> TROUVÉ
[HJ] HKLM\[...]\Wow6432Node\System : ConsentPromptBehaviorAdmin (0) -> TROUVÉ
[HJ DESK] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> TROUVÉ
[HJ DESK] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> TROUVÉ
¤¤¤ Fichiers / Dossiers particuliers: ¤¤¤
¤¤¤ Driver : [NON CHARGE] ¤¤¤
¤¤¤ Infection : Rogue.AntiSpy-ST ¤¤¤
¤¤¤ Fichier HOSTS: ¤¤¤
--> C:\Windows\system32\drivers\etc\hosts
¤¤¤ MBR Verif: ¤¤¤
+++++ PhysicalDrive0: WDC WD5000AAKS-00V1A0 ATA Device +++++
--- User ---
[MBR] d21a0c489e1366a4d27de675c9cb7c0e
[BSP] f82b496e981e2f19d2ec3cc8ce2e821f : Windows 7/8 MBR Code
Partition table:
0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 2048 | Size: 100 Mo
1 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 206848 | Size: 49900 Mo
2 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 102402048 | Size: 210000 Mo
3 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 532482048 | Size: 216938 Mo
User = LL1 ... OK!
User = LL2 ... OK!
+++++ PhysicalDrive1: SanDisk Cruzer Blade USB Device +++++
--- User ---
[MBR] 33a0f33fb7e7f518f64aedcb9dad35b0
[BSP] df4f83c1f72e36823a12b0dfc7617313 : MBR Code unknown
Partition table:
0 - [XXXXXX] FAT32 (0x0b) [VISIBLE] Offset (sectors): 32 | Size: 7633 Mo
User = LL1 ... OK!
Error reading LL2 MBR!
Termine : << RKreport[1]_S_04122012_220805.txt >>
RKreport[1]_S_04122012_220805.txt
j' ai éliminé " system progressive protection", ce vilain rogue..
RépondreSupprimermerci à RogueKiller
je fais un petit don de quelques euros en remerciement
voilà le rapport si cela peut être utile à qq un
RépondreSupprimerRogueKiller V8.4.0 [Dec 12 2012] par Tigzy
mail : tigzyRKgmailcom
Remontees : http://www.geekstogo.com/forum/files/file/413-roguekiller/
Site Web : http://www.sur-la-toile.com/RogueKiller/
Blog : http://tigzyrk.blogspot.com/
Systeme d'exploitation : Windows Vista (6.0.6002 Service Pack 2) 32 bits version
Demarrage : Mode normal
Utilisateur : xxxxxxadmin [Droits d'admin]
Mode : Suppression -- Date : 17/12/2012 20:31:30
¤¤¤ Processus malicieux : 1 ¤¤¤
[Rogue.AntiSpy-ST][BLACKLIST] E4DEF61FE0E6FB6F0000E4DE114700A0.exe -- C:\ProgramData\E4DEF61FE0E6FB6F0000E4DE114700A0\E4DEF61FE0E6FB6F0000E4DE114700A0.exe -> TUÉ [TermProc]
¤¤¤ Entrees de registre : 0 ¤¤¤
¤¤¤ Fichiers / Dossiers particuliers: ¤¤¤
¤¤¤ Driver : [CHARGE] ¤¤¤
SSDT[75] : NtCreateSection @ 0x82633E35 -> HOOKED (Unknown @ 0x8B71457E)
SSDT[276] : NtRequestWaitReplyPort @ 0x82645FE0 -> HOOKED (Unknown @ 0x8B714588)
SSDT[289] : NtSetContextThread @ 0x8269510B -> HOOKED (Unknown @ 0x8B714583)
SSDT[314] : NtSetSecurityObject @ 0x825C203C -> HOOKED (Unknown @ 0x8B71458D)
SSDT[332] : NtSystemDebugControl @ 0x825FAEF1 -> HOOKED (Unknown @ 0x8B714592)
SSDT[334] : NtTerminateProcess @ 0x825F3173 -> HOOKED (Unknown @ 0x8B71451F)
S_SSDT[573] : NtUserSetWindowsHookEx -> HOOKED (Unknown @ 0x8B7145A6)
S_SSDT[576] : NtUserSetWinEventHook -> HOOKED (Unknown @ 0x8B7145AB)
¤¤¤ Infection : Rogue.AntiSpy-ST ¤¤¤
¤¤¤ Fichier HOSTS: ¤¤¤
--> C:\Windows\system32\drivers\etc\hosts
127.0.0.1 localhost
::1 localhost
127.0.0.1 www.007guard.com
127.0.0.1 007guard.com
127.0.0.1 008i.com
127.0.0.1 www.008k.com
127.0.0.1 008k.com
127.0.0.1 www.00hq.com
127.0.0.1 00hq.com
127.0.0.1 010402.com
127.0.0.1 www.032439.com
127.0.0.1 032439.com
127.0.0.1 www.0scan.com
127.0.0.1 0scan.com
127.0.0.1 1000gratisproben.com
127.0.0.1 www.1000gratisproben.com
127.0.0.1 1001namen.com
127.0.0.1 www.1001namen.com
127.0.0.1 100888290cs.com
127.0.0.1 www.100888290cs.com
[...]
¤¤¤ MBR Verif: ¤¤¤
+++++ PhysicalDrive0: ST3250820AS ATA Device +++++
--- User ---
[MBR] 1aec2c46c61274518e69013cd793059a
[BSP] d27fa21b343a251b97ac0a89e4c4cf5a : Acer tatooed MBR Code
Partition table:
0 - [XXXXXX] ACER (0x27) [VISIBLE] Offset (sectors): 63 | Size: 9996 Mo
1 - [ACTIVE] FAT16 (0x06) [VISIBLE] Offset (sectors): 20472480 | Size: 114374 Mo
2 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 254711520 | Size: 114102 Mo
User = LL1 ... OK!
User = LL2 ... OK!
Termine : << RKreport[3]_D_17122012_203130.txt >>
RKreport[1]_S_17122012_202429.txt ; RKreport[2]_D_17122012_202830.txt ; RKreport[3]_D_17122012_203130.txt
RogueKiller V8.5.2 [Feb 23 2013] par Tigzy
RépondreSupprimermail : tigzyRKgmailcom
Remontees : http://www.sur-la-toile.com/discussion-193725-1--RogueKiller-Remontees.html
Site Web : http://www.sur-la-toile.com/RogueKiller/
Blog : http://tigzyrk.blogspot.com/
Systeme d'exploitation : Windows Vista (6.0.6002 Service Pack 2) 32 bits version
Demarrage : Mode sans echec avec prise en charge reseau
Utilisateur : fnac [Droits d'admin]
Mode : Recherche -- Date : 26/02/2013 09:53:56
| ARK || FAK || MBR |
¤¤¤ Processus malicieux : 0 ¤¤¤
¤¤¤ Entrees de registre : 8 ¤¤¤
[RUN][Rogue.AntiSpy-ST] HKCU\[...]\RunOnce : 2CE7928C2C287DC500002CE765A88180 (C:\ProgramData\2CE7928C2C287DC500002CE765A88180\2CE7928C2C287DC500002CE765A88180.exe) [-] -> TROUVÉ
[RUN][Rogue.AntiSpy-ST] HKUS\S-1-5-21-163353038-2384341830-4038691628-1000[...]\RunOnce : 2CE7928C2C287DC500002CE765A88180 (C:\ProgramData\2CE7928C2C287DC500002CE765A88180\2CE7928C2C287DC500002CE765A88180.exe) [-] -> TROUVÉ
[HJ DESK] HKCU\[...]\ClassicStartMenu : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> TROUVÉ
[HJ DESK] HKCU\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> TROUVÉ
[HJ DESK] HKCU\[...]\ClassicStartMenu : {645FF040-5081-101B-9F08-00AA002F954E} (1) -> TROUVÉ
[HJ DESK] HKCU\[...]\NewStartPanel : {645FF040-5081-101B-9F08-00AA002F954E} (1) -> TROUVÉ
[HJ DESK] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> TROUVÉ
[HJ DESK] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> TROUVÉ
¤¤¤ Fichiers / Dossiers particuliers: ¤¤¤
¤¤¤ Driver : [NON CHARGE] ¤¤¤
¤¤¤ Infection : Rogue.AntiSpy-ST ¤¤¤
¤¤¤ Fichier HOSTS: ¤¤¤
--> C:\Windows\system32\drivers\etc\hosts
127.0.0.1 localhost
::1 localhost
¤¤¤ MBR Verif: ¤¤¤
+++++ PhysicalDrive0: WDC WD3200BEVT-22ZCT0 +++++
--- User ---
[MBR] 1b474205fd70a0610bc6337781676052
[BSP] 3318e1ebb523b83c3e9bb7f363c9b46c : Windows Vista MBR Code
Partition table:
0 - [XXXXXX] FAT32-LBA (0x1c) [HIDDEN!] Offset (sectors): 2048 | Size: 10000 Mo
1 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 20482048 | Size: 183146 Mo
2 - [XXXXXX] EXTEN-LBA (0x0f) [VISIBLE] Offset (sectors): 395565056 | Size: 112097 Mo
User = LL1 ... OK!
User = LL2 ... OK!
Termine : << RKreport[1]_S_26022013_095356.txt >>
RKreport[1]_S_26022013_095356.txt
RogueKiller V8.5.3 [Mar 13 2013] par Tigzy
RépondreSupprimermail : tigzyRKgmailcom
Remontees : http://www.sur-la-toile.com/discussion-193725-1--RogueKiller-Remontees.html
Site Web : http://www.sur-la-toile.com/RogueKiller/
Blog : http://tigzyrk.blogspot.com/
Systeme d'exploitation : Windows Vista (6.0.6002 Service Pack 2) 32 bits version
Demarrage : Mode normal
Utilisateur : Ableton [Droits d'admin]
Mode : Suppression -- Date : 13/03/2013 18:46:29
| ARK || FAK || MBR |
¤¤¤ Processus malicieux : 1 ¤¤¤
[Rogue.AntiSpy-ST][BLACKLIST] 459A4A805FF90A580000459A04EC100D.exe -- C:\ProgramData\459A4A805FF90A580000459A04EC100D\459A4A805FF90A580000459A04EC100D.exe [-] -> TUÉ [TermProc]
¤¤¤ Entrees de registre : 0 ¤¤¤
¤¤¤ Fichiers / Dossiers particuliers: ¤¤¤
¤¤¤ Driver : [CHARGE] ¤¤¤
SSDT[75] : NtCreateSection @ 0x83638D75 -> HOOKED (Unknown @ 0x8E92015E)
SSDT[289] : NtSetContextThread @ 0x8369A03F -> HOOKED (Unknown @ 0x8E920163)
SSDT[334] : NtTerminateProcess @ 0x835F80D3 -> HOOKED (Unknown @ 0x8E9200FF)
S_SSDT[573] : NtUserSetWindowsHookEx -> HOOKED (Unknown @ 0x8E920168)
S_SSDT[576] : NtUserSetWinEventHook -> HOOKED (Unknown @ 0x8E92016D)
IRP[IRP_MJ_CREATE] : \SystemRoot\system32\drivers\iastorv.sys -> HOOKED ([MAJOR] Unknown @ 0x86B0C1E8)
IRP[IRP_MJ_CLOSE] : \SystemRoot\system32\drivers\iastorv.sys -> HOOKED ([MAJOR] Unknown @ 0x86B0C1E8)
IRP[IRP_MJ_DEVICE_CONTROL] : \SystemRoot\system32\drivers\iastorv.sys -> HOOKED ([MAJOR] Unknown @ 0x86B0C1E8)
IRP[IRP_MJ_INTERNAL_DEVICE_CONTROL] : \SystemRoot\system32\drivers\iastorv.sys -> HOOKED ([MAJOR] Unknown @ 0x86B0C1E8)
IRP[IRP_MJ_POWER] : \SystemRoot\system32\drivers\iastorv.sys -> HOOKED ([MAJOR] Unknown @ 0x86B0C1E8)
IRP[IRP_MJ_SYSTEM_CONTROL] : \SystemRoot\system32\drivers\iastorv.sys -> HOOKED ([MAJOR] Unknown @ 0x86B0C1E8)
IRP[IRP_MJ_PNP] : \SystemRoot\system32\drivers\iastorv.sys -> HOOKED ([MAJOR] Unknown @ 0x86B0C1E8)
¤¤¤ Infection : Rogue.AntiSpy-ST ¤¤¤
¤¤¤ Fichier HOSTS: ¤¤¤
--> C:\Windows\system32\drivers\etc\hosts
127.0.0.1 localhost
::1 localhost
127.0.0.1 www.007guard.com
127.0.0.1 007guard.com
127.0.0.1 008i.com
127.0.0.1 www.008k.com
127.0.0.1 008k.com
127.0.0.1 www.00hq.com
127.0.0.1 00hq.com
127.0.0.1 010402.com
127.0.0.1 www.032439.com
127.0.0.1 032439.com
127.0.0.1 www.1001-search.info
127.0.0.1 1001-search.info
127.0.0.1 www.100888290cs.com
127.0.0.1 100888290cs.com
127.0.0.1 www.100sexlinks.com
127.0.0.1 100sexlinks.com
127.0.0.1 www.10sek.com
127.0.0.1 10sek.com
[...]
¤¤¤ MBR Verif: ¤¤¤
+++++ PhysicalDrive0: TOSHIBA MK2555GSX ATA Device +++++
--- User ---
[MBR] 24e7a0b3621395080736b7c4f102ed4e
[BSP] 1b9ac74a8b80be4c5d30d05cd69bd922 : Toshiba MBR Code
Partition table:
0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 63 | Size: 228282 Mo
1 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 467523584 | Size: 10189 Mo
User = LL1 ... OK!
User = LL2 ... OK!
+++++ PhysicalDrive1: Ut163 USB2FlashStorage USB Device +++++
--- User ---
[MBR] 3209783a0bf4ddae12e51cd2a3ab7ee9
[BSP] dec9f0908d0564afbcbcc26fa1ab4266 : MBR Code unknown
Partition table:
0 - [ACTIVE] FAT16 (0x06) [VISIBLE] Offset (sectors): 63 | Size: 1967 Mo
User = LL1 ... OK!
Error reading LL2 MBR!
Termine : << RKreport[2]_D_13032013_184629.txt >>
RKreport[1]_S_13032013_184159.txt ; RKreport[2]_D_13032013_184629.txt
RogueKiller V8.5.3 [Mar 13 2013] par Tigzy
RépondreSupprimermail : tigzyRKgmailcom
Remontees : http://www.sur-la-toile.com/discussion-193725-1--RogueKiller-Remontees.html
Site Web : http://www.sur-la-toile.com/RogueKiller/
Blog : http://tigzyrk.blogspot.com/
Systeme d'exploitation : Windows Vista (6.0.6001 Service Pack 1) 32 bits version
Demarrage : Mode normal
Utilisateur : jb [Droits d'admin]
Mode : Recherche -- Date : 16/03/2013 09:55:40
| ARK || FAK || MBR |
¤¤¤ Processus malicieux : 0 ¤¤¤
[Rogue.AntiSpy-ST] 1DBD.tmp -- C:\Users\jb\AppData\Local\Temp\Low\1DBD.tmp [-] -> TUÉ [TermProc]
¤¤¤ Entrees de registre : 2 ¤¤¤
[HJ DESK] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> TROUVÉ
[HJ DESK] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> TROUVÉ
¤¤¤ Fichiers / Dossiers particuliers: ¤¤¤
¤¤¤ Driver : [CHARGE] ¤¤¤
¤¤¤ Infection : Rogue.AntiSpy-ST ¤¤¤
¤¤¤ Fichier HOSTS: ¤¤¤
--> C:\windows\system32\drivers\etc\hosts
127.0.0.1 localhost
::1 localhost
¤¤¤ MBR Verif: ¤¤¤
+++++ PhysicalDrive0: FUJITSU MHZ2160BH G2 +++++
--- User ---
[MBR] e298c15a7ea3a275c9aee5a9bb35b522
[BSP] 0a4c6d6b5cab4f4ba27e7d4a246ae340 : Windows Vista MBR Code
Partition table:
0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 63 | Size: 142384 Mo
1 - [XXXXXX] FAT32-LBA (0x0c) [VISIBLE] Offset (sectors): 291604480 | Size: 1024 Mo
2 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 293703344 | Size: 9218 Mo
User = LL1 ... OK!
User = LL2 ... OK!
Termine : << RKreport[1]_S_16032013_095540.txt >>
RKreport[1]_S_16032013_095540.txt
RogueKiller V8.5.3 [Mar 13 2013] par Tigzy
RépondreSupprimermail : tigzyRKgmailcom
Remontees : http://www.sur-la-toile.com/discussion-193725-1--RogueKiller-Remontees.html
Site Web : http://www.sur-la-toile.com/RogueKiller/
Blog : http://tigzyrk.blogspot.com/
Systeme d'exploitation : Windows Vista (6.0.6001 Service Pack 1) 32 bits version
Demarrage : Mode normal
Utilisateur : jb [Droits d'admin]
Mode : Suppression -- Date : 16/03/2013 10:05:14
| ARK || FAK || MBR |
¤¤¤ Processus malicieux : 0 ¤¤¤
[Rogue.AntiSpy-ST] 1DBD.tmp -- C:\Users\jb\AppData\Local\Temp\Low\1DBD.tmp [-] -> TUÉ [TermProc]
¤¤¤ Entrees de registre : 2 ¤¤¤
[HJ DESK] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> REMPLACÉ (0)
[HJ DESK] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> REMPLACÉ (0)
¤¤¤ Fichiers / Dossiers particuliers: ¤¤¤
¤¤¤ Driver : [CHARGE] ¤¤¤
¤¤¤ Infection : Rogue.AntiSpy-ST ¤¤¤
¤¤¤ Fichier HOSTS: ¤¤¤
--> C:\windows\system32\drivers\etc\hosts
127.0.0.1 localhost
::1 localhost
¤¤¤ MBR Verif: ¤¤¤
+++++ PhysicalDrive0: FUJITSU MHZ2160BH G2 +++++
--- User ---
[MBR] e298c15a7ea3a275c9aee5a9bb35b522
[BSP] 0a4c6d6b5cab4f4ba27e7d4a246ae340 : Windows Vista MBR Code
Partition table:
0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 63 | Size: 142384 Mo
1 - [XXXXXX] FAT32-LBA (0x0c) [VISIBLE] Offset (sectors): 291604480 | Size: 1024 Mo
2 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 293703344 | Size: 9218 Mo
User = LL1 ... OK!
User = LL2 ... OK!
Termine : << RKreport[2]_D_16032013_100514.txt >>
RKreport[1]_S_16032013_095540.txt ; RKreport[2]_D_16032013_100514.txt
RogueKiller V8.5.4 [Mar 18 2013] par Tigzy
Supprimermail : tigzyRKgmailcom
Remontees : http://www.sur-la-toile.com/discussion-193725-1--RogueKiller-Remontees.html
Site Web : http://www.sur-la-toile.com/RogueKiller/
Blog : http://tigzyrk.blogspot.com/
Systeme d'exploitation : Windows 7 (6.1.7601 Service Pack 1) 64 bits version
Demarrage : Mode sans echec avec prise en charge reseau
Utilisateur : Vincent [Droits d'admin]
Mode : Recherche -- Date : 26/04/2013 21:11:31
| ARK || FAK || MBR |
¤¤¤ Processus malicieux : 0 ¤¤¤
¤¤¤ Entrees de registre : 2 ¤¤¤
[RUN][Rogue.AntiSpy-ST] HKCU\[...]\RunOnce : EC80B5B60ED10DC50000EC7FC93D1494 (C:\ProgramData\EC80B5B60ED10DC50000EC7FC93D1494\EC80B5B60ED10DC50000EC7FC93D1494.exe) [-] -> TROUVÉ
[RUN][Rogue.AntiSpy-ST] HKUS\S-1-5-21-482470854-3352828009-632358617-1000[...]\RunOnce : EC80B5B60ED10DC50000EC7FC93D1494 (C:\ProgramData\EC80B5B60ED10DC50000EC7FC93D1494\EC80B5B60ED10DC50000EC7FC93D1494.exe) [-] -> TROUVÉ
¤¤¤ Fichiers / Dossiers particuliers: ¤¤¤
¤¤¤ Driver : [NON CHARGE] ¤¤¤
¤¤¤ Infection : Rogue.AntiSpy-ST ¤¤¤
¤¤¤ Fichier HOSTS: ¤¤¤
--> C:\Windows\system32\drivers\etc\hosts
¤¤¤ MBR Verif: ¤¤¤
+++++ PhysicalDrive0: TOSHIBA MK7575GSX +++++
--- User ---
[MBR] 2b24fec80864ff62b3039b6d6893685b
[BSP] 9a583d1d46c873ffbf1414cc23161aba : Windows 7/8 MBR Code
Partition table:
0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 2048 | Size: 199 Mo
1 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 409600 | Size: 700099 Mo
2 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 1434212352 | Size: 15002 Mo
3 - [XXXXXX] FAT32-LBA (0x0c) [VISIBLE] Offset (sectors): 1464936448 | Size: 102 Mo
User = LL1 ... OK!
User != LL2 ... KO!
--- LL2 ---
[MBR] 42db7c051ef7e77277d006ef3eb1e18f
[BSP] 9a583d1d46c873ffbf1414cc23161aba : Windows 7/8 MBR Code
Partition table:
0 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 409600 | Size: 77824 Mo
1 - [XXXXXX] FAT32-LBA (0x0c) [VISIBLE] Offset (sectors): 159793152 | Size: 400 Mo
Termine : << RKreport[1]_S_26042013_211131.txt >>
RKreport[1]_S_26042013_211131.txt
RogueKiller V8.5.4 [Mar 18 2013] par Tigzy
Supprimermail : tigzyRKgmailcom
Remontees : http://www.sur-la-toile.com/discussion-193725-1--RogueKiller-Remontees.html
Site Web : http://www.sur-la-toile.com/RogueKiller/
Blog : http://tigzyrk.blogspot.com/
Systeme d'exploitation : Windows 7 (6.1.7601 Service Pack 1) 64 bits version
Demarrage : Mode sans echec avec prise en charge reseau
Utilisateur : Vincent [Droits d'admin]
Mode : Suppression -- Date : 26/04/2013 21:13:33
| ARK || FAK || MBR |
¤¤¤ Processus malicieux : 0 ¤¤¤
¤¤¤ Entrees de registre : 1 ¤¤¤
[RUN][Rogue.AntiSpy-ST] HKCU\[...]\RunOnce : EC80B5B60ED10DC50000EC7FC93D1494 (C:\ProgramData\EC80B5B60ED10DC50000EC7FC93D1494\EC80B5B60ED10DC50000EC7FC93D1494.exe) [-] -> SUPPRIMÉ
¤¤¤ Fichiers / Dossiers particuliers: ¤¤¤
¤¤¤ Driver : [NON CHARGE] ¤¤¤
¤¤¤ Infection : Rogue.AntiSpy-ST ¤¤¤
¤¤¤ Fichier HOSTS: ¤¤¤
--> C:\Windows\system32\drivers\etc\hosts
¤¤¤ MBR Verif: ¤¤¤
+++++ PhysicalDrive0: TOSHIBA MK7575GSX +++++
--- User ---
[MBR] 2b24fec80864ff62b3039b6d6893685b
[BSP] 9a583d1d46c873ffbf1414cc23161aba : Windows 7/8 MBR Code
Partition table:
0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 2048 | Size: 199 Mo
1 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 409600 | Size: 700099 Mo
2 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 1434212352 | Size: 15002 Mo
3 - [XXXXXX] FAT32-LBA (0x0c) [VISIBLE] Offset (sectors): 1464936448 | Size: 102 Mo
User = LL1 ... OK!
User != LL2 ... KO!
--- LL2 ---
[MBR] 42db7c051ef7e77277d006ef3eb1e18f
[BSP] 9a583d1d46c873ffbf1414cc23161aba : Windows 7/8 MBR Code
Partition table:
0 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 409600 | Size: 77824 Mo
1 - [XXXXXX] FAT32-LBA (0x0c) [VISIBLE] Offset (sectors): 159793152 | Size: 400 Mo
Termine : << RKreport[2]_D_26042013_211333.txt >>
RKreport[1]_S_26042013_211131.txt ; RKreport[2]_D_26042013_211333.txt
RogueKiller V8.5.4 [Mar 18 2013] par Tigzy
RépondreSupprimermail : tigzyRKgmailcom
Remontees : http://www.sur-la-toile.com/discussion-193725-1--RogueKiller-Remontees.html
Site Web : http://www.sur-la-toile.com/RogueKiller/
Blog : http://tigzyrk.blogspot.com/
Systeme d'exploitation : Windows Vista (6.0.6001 Service Pack 1) 32 bits version
Demarrage : Mode normal
Utilisateur : Administrateur [Droits d'admin]
Mode : DNS RAZ -- Date : 28/04/2013 21:27:49
| ARK || FAK || MBR |
¤¤¤ Processus malicieux : 2 ¤¤¤
[DLL] explorer.exe -- C:\Windows\explorer.exe : C:\Windows\TEMP\logishrd\LVPrcInj02.dll [x] -> DECHARGÉE
[Rogue.AntiSpy-ST][BLACKLIST] AAAEFD843EFEC53C0000AAAE52DFCF1F.exe -- C:\ProgramData\AAAEFD843EFEC53C0000AAAE52DFCF1F\AAAEFD843EFEC53C0000AAAE52DFCF1F.exe [-] -> TUÉ [TermProc]
¤¤¤ Entrees de registre : 0 ¤¤¤
¤¤¤ Driver : [CHARGE] ¤¤¤
¤¤¤ Infection : Rogue.AntiSpy-ST ¤¤¤
Termine : << RKreport[8]_DN_28042013_212749.txt >>
RKreport[1]_S_28042013_125524.txt ; RKreport[2]_H_28042013_125553.txt ; RKreport[3]_H_28042013_125556.txt ; RKreport[4]_PR_28042013_125559.txt ; RKreport[5]_S_28042013_125725.txt ;
RKreport[6]_H_28042013_212647.txt ; RKreport[7]_PR_28042013_212744.txt ; RKreport[8]_DN_28042013_212749.txt
RogueKiller V8.5.4 [Mar 18 2013] par Tigzy
RépondreSupprimermail : tigzyRKgmailcom
Remontees : http://www.sur-la-toile.com/discussion-193725-1--RogueKiller-Remontees.html
Site Web : http://www.sur-la-toile.com/RogueKiller/
Blog : http://tigzyrk.blogspot.com/
Systeme d'exploitation : Windows 7 (6.1.7600 ) 64 bits version
Demarrage : Mode sans echec avec prise en charge reseau
Utilisateur : Jazz [Droits d'admin]
Mode : Suppression -- Date : 04/29/2013 19:26:53
| ARK || FAK || MBR |
¤¤¤ Processus malicieux : 4 ¤¤¤
[SUSP PATH] eXQ.exe -- C:\Users\Jazz\AppData\Roaming\eIntaller\585F368CBD0C4aeaBE77A4E82845D29C\eXQ.exe [7] -> TUÉ [TermProc]
[SUSP PATH] Desk365.exe -- C:\Users\Jazz\AppData\Roaming\eIntaller\585F368CBD0C4aeaBE77A4E82845D29C\Desk365.exe [7] -> TUÉ [TermProc]
[SUSP PATH] eInstall.exe -- C:\Users\Jazz\AppData\Local\Temp\Desk365\eInstall\eInstall.exe [7] -> TUÉ [TermProc]
[SUSP PATH] YontooDesktop.exe -- C:\Users\Jazz\AppData\Roaming\Yontoo\YontooDesktop.exe [7] -> TUÉ [TermProc]
¤¤¤ Entrees de registre : 10 ¤¤¤
[RUN][SUSP PATH] HKCU\[...]\Run : Yontoo Desktop ("C:\Users\Jazz\AppData\Roaming\Yontoo\YontooDesktop.exe") [7] -> SUPPRIMÉ
[RUN][Rogue.AntiSpy-ST] HKCU\[...]\RunOnce : 0C5EF4AD14A481F800000C5EE8528652 (C:\ProgramData\0C5EF4AD14A481F800000C5EE8528652\0C5EF4AD14A481F800000C5EE8528652.exe) [-] -> SUPPRIMÉ
[Services][BLACKLIST] HKLM\[...]\ControlSet001\Services\BrowserProtect (C:\ProgramData\BrowserProtect\2.6.1249.132\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\BrowserProtect.exe) [7] -> SUPPRIMÉ
[Services][BLACKLIST] HKLM\[...]\ControlSet002\Services\BrowserProtect (C:\ProgramData\BrowserProtect\2.6.1249.132\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\BrowserProtect.exe) [7] -> SUPPRIMÉ
[DNS] HKLM\[...]\ControlSet001\Services\Tcpip\Interfaces\{C8747188-A1F6-4F14-987D-6C1244C35197} : NameServer (136.199.8.101,136.199.8.129) -> NON SUPPRIMÉ, UTILISER DNS RAZ
[DNS] HKLM\[...]\ControlSet002\Services\Tcpip\Interfaces\{C8747188-A1F6-4F14-987D-6C1244C35197} : NameServer (136.199.8.101,136.199.8.129) -> NON SUPPRIMÉ, UTILISER DNS RAZ
[HJPOL] HKCU\[...]\System : DisableTaskMgr (0) -> SUPPRIMÉ
[HJPOL] HKCU\[...]\System : DisableRegistryTools (0) -> SUPPRIMÉ
[HJ DESK] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> REMPLACÉ (0)
[HJ DESK] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> REMPLACÉ (0)
¤¤¤ Fichiers / Dossiers particuliers: ¤¤¤
¤¤¤ Driver : [NON CHARGE] ¤¤¤
¤¤¤ Infection : Rogue.AntiSpy-ST ¤¤¤
¤¤¤ Fichier HOSTS: ¤¤¤
--> C:\Windows\system32\drivers\etc\hosts
¤¤¤ MBR Verif: ¤¤¤
+++++ PhysicalDrive0: WDC WD2500BEVT-60ZCT1 ATA Device +++++
--- User ---
[MBR] d00a9bc95faaf30a5abeaadce66b3c90
[BSP] d167981e92c3926007f43ce976cc4adf : Windows Vista/7/8 MBR Code
Partition table:
0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 2048 | Size: 199 Mo
1 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 409600 | Size: 225418 Mo
2 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 462065664 | Size: 12856 Mo
User = LL1 ... OK!
User = LL2 ... OK!
Termine : << RKreport[2]_D_04292013_02d1926.txt >>
RKreport[1]_S_04292013_02d1925.txt ; RKreport[2]_D_04292013_02d1926.txt
RogueKiller V8.5.4 [Mar 18 2013] par Tigzy
RépondreSupprimermail : tigzyRKgmailcom
Remontees : http://www.sur-la-toile.com/discussion-193725-1--RogueKiller-Remontees.html
Site Web : http://www.sur-la-toile.com/RogueKiller/
Blog : http://tigzyrk.blogspot.com/
Systeme d'exploitation : Windows 7 (6.1.7601 Service Pack 1) 32 bits version
Demarrage : Mode sans echec avec prise en charge reseau
Utilisateur : Fred [Droits d'admin]
Mode : Suppression -- Date : 04/05/2013 21:01:13
| ARK || FAK || MBR |
¤¤¤ Processus malicieux : 0 ¤¤¤
¤¤¤ Entrees de registre : 5 ¤¤¤
[RUN][BLPATH] HKCU\[...]\Run : cacaoweb ("C:\Users\Fred\AppData\Roaming\cacaoweb\cacaoweb.exe" -noplayer) [-] -> SUPPRIMÉ
[RUN][SUSP PATH] HKCU\[...]\Run : Install RocketPDF344019.exe ("C:\Users\Fred\AppData\Local\Temp\Install RocketPDF344019.exe" /XML="C:\Users\Fred\AppData\Local\Temp\6B6F.tmp" /ROS /STP=0:2) [7] -> SUPPRIMÉ
[RUN][Rogue.AntiSpy-ST] HKCU\[...]\RunOnce : C48B8B3D9105E4310000C48AC6B6E84F (C:\ProgramData\C48B8B3D9105E4310000C48AC6B6E84F\C48B8B3D9105E4310000C48AC6B6E84F.exe) [-] -> SUPPRIMÉ
[HJ DESK] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> REMPLACÉ (0)
[HJ DESK] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> REMPLACÉ (0)
¤¤¤ Fichiers / Dossiers particuliers: ¤¤¤
¤¤¤ Driver : [NON CHARGE] ¤¤¤
¤¤¤ Infection : Rogue.ProgFiles|Rogue.AntiSpy-ST ¤¤¤
¤¤¤ Fichier HOSTS: ¤¤¤
--> C:\Windows\system32\drivers\etc\hosts
¤¤¤ MBR Verif: ¤¤¤
+++++ PhysicalDrive0: WDC WD10EADS-00M2B0 ATA Device +++++
--- User ---
[MBR] bb6b6fce56e0ee794b796cee1b2c110e
[BSP] e44ba41d1e7f65aaa98256fc10511f2d : Windows 7/8 MBR Code
Partition table:
0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 2048 | Size: 100 Mo
1 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 206848 | Size: 99900 Mo
2 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 204802048 | Size: 853867 Mo
User = LL1 ... OK!
User = LL2 ... OK!
Termine : << RKreport[2]_D_04052013_210113.txt >>
RKreport[1]_S_04052013_210013.txt ; RKreport[2]_D_04052013_210113.txt
))
RépondreSupprimerRogueKiller V8.5.4 [Mar 18 2013] par Tigzy
RépondreSupprimermail : tigzyRKgmailcom
Remontees : http://www.sur-la-toile.com/discussion-193725-1--RogueKiller-Remontees.html
Site Web : http://www.sur-la-toile.com/RogueKiller/
Blog : http://tigzyrk.blogspot.com/
Systeme d'exploitation : Windows 7 (6.1.7600 ) 64 bits version
Demarrage : Mode sans echec avec prise en charge reseau
Utilisateur : andres [Droits d'admin]
Mode : Suppression -- Date : 17/05/2013 12:37:40
| ARK || FAK || MBR |
¤¤¤ Processus malicieux : 0 ¤¤¤
¤¤¤ Entrees de registre : 11 ¤¤¤
[RUN][SUSP PATH] HKCU\[...]\Run : lollipop_04301337 ("c:\users\andres.andres-pc\appdata\local\lollipop\lollipop_04301337.exe" lollipop_04301337) [-] -> SUPPRIMÉ
[RUN][Rogue.AntiSpy-ST] HKCU\[...]\RunOnce : 46C14FD6A592AC61000046C1091BB277 (C:\ProgramData\46C14FD6A592AC61000046C1091BB277\46C14FD6A592AC61000046C1091BB277.exe) [-] -> SUPPRIMÉ
[Services][BLACKLIST] HKLM\[...]\ControlSet001\Services\BrowserProtect (C:\ProgramData\BrowserProtect\2.6.1249.132\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\BrowserProtect.exe) [7] -> SUPPRIMÉ
[Services][BLACKLIST] HKLM\[...]\ControlSet002\Services\BrowserProtect (C:\ProgramData\BrowserProtect\2.6.1249.132\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\BrowserProtect.exe) [7] -> SUPPRIMÉ
[HJ] HKLM\[...]\System : ConsentPromptBehaviorAdmin (0) -> REMPLACÉ (2)
[HJ] HKLM\[...]\System : EnableLUA (0) -> REMPLACÉ (1)
[HJ] HKLM\[...]\Wow6432Node\Security Center : AntiVirusDisableNotify (1) -> REMPLACÉ (0)
[HJ] HKLM\[...]\Wow6432Node\Security Center : FirewallDisableNotify (1) -> REMPLACÉ (0)
[HJ] HKLM\[...]\Wow6432Node\Security Center : UpdatesDisableNotify (1) -> REMPLACÉ (0)
[HJ DESK] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> REMPLACÉ (0)
[HJ DESK] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> REMPLACÉ (0)
¤¤¤ Fichiers / Dossiers particuliers: ¤¤¤
¤¤¤ Driver : [NON CHARGE] ¤¤¤
¤¤¤ Infection : Rogue.AntiSpy-ST ¤¤¤
¤¤¤ Fichier HOSTS: ¤¤¤
--> C:\Windows\system32\drivers\etc\hosts
¤¤¤ MBR Verif: ¤¤¤
+++++ PhysicalDrive0: WDC WD10EARS-22Y5B1 ATA Device +++++
--- User ---
[MBR] ffc3ced4d4b36e025044d2eb118ce9af
[BSP] eb1637f1e3fde0189b5f65061afecbaa : Windows 7/8 MBR Code
Partition table:
0 - [XXXXXX] ACER (0x27) [VISIBLE] Offset (sectors): 2048 | Size: 17408 Mo
1 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 35653632 | Size: 100 Mo
2 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 35858432 | Size: 467918 Mo
3 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 994154496 | Size: 468441 Mo
User = LL1 ... OK!
User = LL2 ... OK!
Termine : << RKreport[3]_D_17052013_123740.txt >>
RKreport[1]_S_17052013_123626.txt ; RKreport[2]_S_17052013_123707.txt ; RKreport[3]_D_17052013_123740.txt
RogueKiller V8.5.4 [Mar 18 2013] par Tigzy
RépondreSupprimermail : tigzyRKgmailcom
Remontees : http://www.sur-la-toile.com/discussion-193725-1--RogueKiller-Remontees.html
Site Web : http://www.sur-la-toile.com/RogueKiller/
Blog : http://tigzyrk.blogspot.com/
Systeme d'exploitation : Windows Vista (6.0.6002 Service Pack 2) 32 bits version
Demarrage : Mode sans echec avec prise en charge reseau
Utilisateur : Famille Bliche [Droits d'admin]
Mode : Suppression -- Date : 19/05/2013 15:17:15
| ARK || FAK || MBR |
¤¤¤ Processus malicieux : 0 ¤¤¤
¤¤¤ Entrees de registre : 0 ¤¤¤
¤¤¤ Fichiers / Dossiers particuliers: ¤¤¤
¤¤¤ Driver : [NON CHARGE] ¤¤¤
¤¤¤ Fichier HOSTS: ¤¤¤
--> C:\Windows\system32\drivers\etc\hosts
127.0.0.1 localhost
::1 localhost
¤¤¤ MBR Verif: ¤¤¤
+++++ PhysicalDrive0: SAMSUNG HM250JI +++++
--- User ---
[MBR] 526d6972554ec79dbf48de972b4d65e9
[BSP] 933d4ae22bfbe5e9b2cdcc993c3e86c8 : MBR Code unknown
Partition table:
0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 63 | Size: 230840 Mo
1 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 472760820 | Size: 7632 Mo
User = LL1 ... OK!
User = LL2 ... OK!
Termine : << RKreport[4]_D_19052013_151715.txt >>
RKreport[1]_S_19052013_151439.txt ; RKreport[2]_D_19052013_151521.txt ; RKreport[3]_D_19052013_151611.txt ; RKreport[4]_D_19052013_151715.txt