Author Topic: My Roguekiller scan  (Read 5894 times)

0 Members and 1 Guest are viewing this topic.

August 16, 2014, 04:16:06 PM

valker04

  • Guest
My Roguekiller scan
« on: August 16, 2014, 04:16:06 PM »
Hello! First of all I want to warn you that my English isn't perfect, so it can be a little difficult for you to understand me. Sorry for that!

Here is my scan, there is nothing wrong except for a few orange results in "Antirootkit" tab. Maybe I'm overreactive, but I'm kinda worried.



RogueKiller V9.2.8.0 (x64) [Jul 11 2014] by Adlice Software
mail : http://www.adlice.com/contact/
Feedback : http://forum.adlice.com
Website : http://www.adlice.com/softwares/roguekiller/
Blog : http://www.adlice.com

Operating System : Windows 8 (6.2.9200 ) 64 bits version
Started in : Normal mode
User : Kaszalubabob [Admin rights]
Mode : Scan -- Date : 08/16/2014  16:13:22

¤¤¤ Bad processes : 0 ¤¤¤

¤¤¤ Registry Entries : 4 ¤¤¤
[PUM.DesktopIcons] (X64) HKEY_USERS\S-1-5-21-1466461157-2003470282-435635890-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\ClassicStartMenu | {59031A47-3F72-44A7-89C5-5595FE6B30EE} : 1  -> FOUND
[PUM.DesktopIcons] (X86) HKEY_USERS\S-1-5-21-1466461157-2003470282-435635890-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\ClassicStartMenu | {59031A47-3F72-44A7-89C5-5595FE6B30EE} : 1  -> FOUND
[PUM.DesktopIcons] (X64) HKEY_USERS\S-1-5-21-1466461157-2003470282-435635890-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {59031A47-3F72-44A7-89C5-5595FE6B30EE} : 1  -> FOUND
[PUM.DesktopIcons] (X86) HKEY_USERS\S-1-5-21-1466461157-2003470282-435635890-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {59031A47-3F72-44A7-89C5-5595FE6B30EE} : 1  -> FOUND

¤¤¤ Scheduled tasks : 0 ¤¤¤

¤¤¤ Files : 0 ¤¤¤

¤¤¤ HOSTS File : 0 ¤¤¤

¤¤¤ Antirootkit : 36 (Driver: LOADED) ¤¤¤
[EAT:Addr] (explorer.exe) acppage.dll - BiChangeApplicationStateForPackageName : C:\Windows\System32\twinapi.dll @ 0x7fb8538ab80
[EAT:Addr] (explorer.exe) acppage.dll - BiChangeSessionState : C:\Windows\System32\twinapi.dll @ 0x7fb853a53d8
[EAT:Addr] (explorer.exe) acppage.dll - BiNotifyNewSession : C:\Windows\System32\twinapi.dll @ 0x7fb853a6f0c
[EAT:Addr] (explorer.exe) acppage.dll - BiPtActivateWorkItem : C:\Windows\System32\twinapi.dll @ 0x7fb853fbce0
[EAT:Addr] (explorer.exe) acppage.dll - BiPtAssociateActivationProxy : C:\Windows\System32\twinapi.dll @ 0x7fb853aa7ec
[EAT:Addr] (explorer.exe) acppage.dll - BiPtAssociateApplicationExtensionClass : C:\Windows\System32\twinapi.dll @ 0x7fb853fbbd0
[EAT:Addr] (explorer.exe) acppage.dll - BiPtCreateEventForPackageName : C:\Windows\System32\twinapi.dll @ 0x7fb853fbac0
[EAT:Addr] (explorer.exe) acppage.dll - BiPtDeleteEvent : C:\Windows\System32\twinapi.dll @ 0x7fb853fba50
[EAT:Addr] (explorer.exe) acppage.dll - BiPtDisassociateWorkItem : C:\Windows\System32\twinapi.dll @ 0x7fb853fb9b0
[EAT:Addr] (explorer.exe) acppage.dll - BiPtEnumerateBrokeredEvents : C:\Windows\System32\twinapi.dll @ 0x7fb853a6a70
[EAT:Addr] (explorer.exe) acppage.dll - BiPtEnumerateWorkItemsForPackageName : C:\Windows\System32\twinapi.dll @ 0x7fb853fb8c0
[EAT:Addr] (explorer.exe) acppage.dll - BiPtFreeMemory : C:\Windows\System32\twinapi.dll @ 0x7fb85385fe0
[EAT:Addr] (explorer.exe) acppage.dll - BiPtQueryBrokeredEvent : C:\Windows\System32\twinapi.dll @ 0x7fb85385df0
[EAT:Addr] (explorer.exe) acppage.dll - BiPtQuerySystemStateBroadcastChannels : C:\Windows\System32\twinapi.dll @ 0x7fb853a6a0c
[EAT:Addr] (explorer.exe) acppage.dll - BiPtQueryWorkItem : C:\Windows\System32\twinapi.dll @ 0x7fb853fb804
[EAT:Addr] (explorer.exe) acppage.dll - BiPtSignalEvent : C:\Windows\System32\twinapi.dll @ 0x7fb853fb738
[EAT:Addr] (explorer.exe) acppage.dll - BiPtSignalMultipleEvents : C:\Windows\System32\twinapi.dll @ 0x7fb853fb660
[EAT:Addr] (explorer.exe) acppage.dll - BiResetActiveSessionForPackage : C:\Windows\System32\twinapi.dll @ 0x7fb853fb57c
[EAT:Addr] (explorer.exe) acppage.dll - BiSetActiveSessionForPackage : C:\Windows\System32\twinapi.dll @ 0x7fb853fb4e0
[EAT:Addr] (explorer.exe) acppage.dll - BiUpdateLockScreenApplications : C:\Windows\System32\twinapi.dll @ 0x7fb853fb430
[EAT:Addr] (explorer.exe) acppage.dll - DllCanUnloadNow : C:\Windows\System32\twinapi.dll @ 0x7fb85381340
[EAT:Addr] (explorer.exe) acppage.dll - DllGetActivationFactory : C:\Windows\System32\twinapi.dll @ 0x7fb85382f60
[EAT:Addr] (explorer.exe) acppage.dll - DllGetClassObject : C:\Windows\System32\twinapi.dll @ 0x7fb85382110
[EAT:Addr] (explorer.exe) acppage.dll - PsmBlockAppStateChangeCompletion : C:\Windows\System32\twinapi.dll @ 0x7fb853fbdd4
[EAT:Addr] (explorer.exe) acppage.dll - PsmIsProcessInApplication : C:\Windows\System32\twinapi.dll @ 0x7fb85397d60
[EAT:Addr] (explorer.exe) acppage.dll - PsmQueryApplicationInformation : C:\Windows\System32\twinapi.dll @ 0x7fb853873f0
[EAT:Addr] (explorer.exe) acppage.dll - PsmQueryApplicationList : C:\Windows\System32\twinapi.dll @ 0x7fb85382770
[EAT:Addr] (explorer.exe) acppage.dll - PsmQueryCurrentAppState : C:\Windows\System32\twinapi.dll @ 0x7fb853fbd70
[EAT:Addr] (explorer.exe) acppage.dll - PsmQueryProcessList : C:\Windows\System32\twinapi.dll @ 0x7fb853824f0
[EAT:Addr] (explorer.exe) acppage.dll - PsmRegisterAppStateChangeNotification : C:\Windows\System32\twinapi.dll @ 0x7fb8538cf00
[EAT:Addr] (explorer.exe) acppage.dll - PsmRegisterApplicationNotification : C:\Windows\System32\twinapi.dll @ 0x7fb853871e0
[EAT:Addr] (explorer.exe) acppage.dll - PsmSetApplicationState : C:\Windows\System32\twinapi.dll @ 0x7fb8538a870
[EAT:Addr] (explorer.exe) acppage.dll - PsmShutdownApplication : C:\Windows\System32\twinapi.dll @ 0x7fb853fbec0
[EAT:Addr] (explorer.exe) acppage.dll - PsmUnblockAppStateChangeCompletion : C:\Windows\System32\twinapi.dll @ 0x7fb853fbe0c
[EAT:Addr] (explorer.exe) acppage.dll - PsmUnregisterAppStateChangeNotification : C:\Windows\System32\twinapi.dll @ 0x7fb85390a68
[EAT:Addr] (explorer.exe) acppage.dll - PsmWaitForAppResume : C:\Windows\System32\twinapi.dll @ 0x7fb853fbe5c

¤¤¤ Web browsers : 0 ¤¤¤

¤¤¤ MBR Check : ¤¤¤
+++++ PhysicalDrive0: SAMSUNG HD501LJ ATA Device +++++
--- User ---
[MBR] 890fdc9d64343530439ce0349d6a7c9d
[BSP] e0a710e9c751fb1451f92f32ee7c38a2 : Windows Vista/7/8 MBR Code
Partition table:
0 - [ACTIVE] NTFS (0x7) [VISIBLE] Offset (sectors): 63 | Size: 476929 MB
User = LL1 ... OK
User = LL2 ... OK

+++++ PhysicalDrive1: KINGSTON SV300S37A120G ATA Device +++++
--- User ---
[MBR] 4e9a1e20b9c240e4e62b8c78bb7fe2f0
[BSP] bc44478ef9e3b2e0bac52d91816d5736 : Windows Vista/7/8 MBR Code
Partition table:
0 - [XXXXXX] NTFS (0x7) [VISIBLE] Offset (sectors): 2048 | Size: 114470 MB
User = LL1 ... OK
User = LL2 ... OK


============================================
RKreport_DEL_08152014_210142.log - RKreport_DEL_08152014_210650.log - RKreport_SCN_07202014_202400.log - RKreport_SCN_07202014_203454.log
RKreport_SCN_07202014_214400.log - RKreport_SCN_08032014_195001.log - RKreport_SCN_08042014_162926.log - RKreport_SCN_08042014_165355.log
RKreport_SCN_08042014_201107.log - RKreport_SCN_08152014_210025.log - RKreport_SCN_08152014_210342.log - RKreport_SCN_08162014_133712.log
RKreport_SCN_08162014_155620.log



I ran a scan with malwarebytes and MBAR, but it found nothing. Same thing with Avast, obviously. Should I be worried or am I perfectly fine?

Reply #1August 18, 2014, 09:40:54 PM

valker04

  • Guest
Re: My Roguekiller scan
« Reply #1 on: August 18, 2014, 09:40:54 PM »
Hey, I just ran another scan and it seems that these suspicious results... disappeared. Now all of my results in the "antirootkit" tab are green. I'm not sure what happened, here is the report.

RogueKiller V9.2.8.0 (x64) [Jul 11 2014] by Adlice Software
mail : http://www.adlice.com/contact/
Feedback : http://forum.adlice.com
Website : http://www.adlice.com/softwares/roguekiller/
Blog : http://www.adlice.com

Operating System : Windows 8 (6.2.9200 ) 64 bits version
Started in : Normal mode
User : Kaszalubabob [Admin rights]
Mode : Scan -- Date : 08/18/2014  21:39:59

¤¤¤ Bad processes : 0 ¤¤¤

¤¤¤ Registry Entries : 4 ¤¤¤
[PUM.DesktopIcons] (X64) HKEY_USERS\S-1-5-21-1466461157-2003470282-435635890-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\ClassicStartMenu | {59031A47-3F72-44A7-89C5-5595FE6B30EE} : 1  -> FOUND
[PUM.DesktopIcons] (X86) HKEY_USERS\S-1-5-21-1466461157-2003470282-435635890-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\ClassicStartMenu | {59031A47-3F72-44A7-89C5-5595FE6B30EE} : 1  -> FOUND
[PUM.DesktopIcons] (X64) HKEY_USERS\S-1-5-21-1466461157-2003470282-435635890-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {59031A47-3F72-44A7-89C5-5595FE6B30EE} : 1  -> FOUND
[PUM.DesktopIcons] (X86) HKEY_USERS\S-1-5-21-1466461157-2003470282-435635890-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {59031A47-3F72-44A7-89C5-5595FE6B30EE} : 1  -> FOUND

¤¤¤ Scheduled tasks : 0 ¤¤¤

¤¤¤ Files : 0 ¤¤¤

¤¤¤ HOSTS File : 0 ¤¤¤

¤¤¤ Antirootkit : 0 (Driver: LOADED) ¤¤¤

¤¤¤ Web browsers : 0 ¤¤¤

¤¤¤ MBR Check : ¤¤¤
+++++ PhysicalDrive0: SAMSUNG HD501LJ ATA Device +++++
--- User ---
[MBR] 890fdc9d64343530439ce0349d6a7c9d
[BSP] e0a710e9c751fb1451f92f32ee7c38a2 : Windows Vista/7/8 MBR Code
Partition table:
0 - [ACTIVE] NTFS (0x7) [VISIBLE] Offset (sectors): 63 | Size: 476929 MB
User = LL1 ... OK
User = LL2 ... OK

+++++ PhysicalDrive1: KINGSTON SV300S37A120G ATA Device +++++
--- User ---
[MBR] 4e9a1e20b9c240e4e62b8c78bb7fe2f0
[BSP] bc44478ef9e3b2e0bac52d91816d5736 : Windows Vista/7/8 MBR Code
Partition table:
0 - [XXXXXX] NTFS (0x7) [VISIBLE] Offset (sectors): 2048 | Size: 114470 MB
User = LL1 ... OK
User = LL2 ... OK


============================================
RKreport_DEL_08152014_210142.log - RKreport_DEL_08152014_210650.log - RKreport_SCN_07202014_202400.log - RKreport_SCN_07202014_203454.log
RKreport_SCN_07202014_214400.log - RKreport_SCN_08032014_195001.log - RKreport_SCN_08042014_162926.log - RKreport_SCN_08042014_165355.log
RKreport_SCN_08042014_201107.log - RKreport_SCN_08152014_210025.log - RKreport_SCN_08152014_210342.log - RKreport_SCN_08162014_133712.log
RKreport_SCN_08162014_155620.log - RKreport_SCN_08162014_161322.log - RKreport_SCN_08182014_213312.log - RKreport_SCN_08182014_213708.log

Reply #2August 20, 2014, 08:21:26 AM

Tigzy

  • Administrator
  • Hero Member

  • Offline
  • *****

  • 954
  • Reputation:
    90
  • Personal Text
    Owner, Adlice Software
    • View Profile
    • Adlice Software
Re: My Roguekiller scan
« Reply #2 on: August 20, 2014, 08:21:26 AM »
Hello
Sometimes the hooks are set dynamically

Looks like twinapi is legit.
http://systemexplorer.net/fr/file-database/file/twinapi-dll

Reply #3August 20, 2014, 09:21:36 AM

valker04

  • Guest
Re: My Roguekiller scan
« Reply #3 on: August 20, 2014, 09:21:36 AM »
Thank you!