Show Posts
1
RogueKiller / I have no skills please read these for me
« on: January 07, 2015, 09:07:50 PM »
RogueKiller V10.1.2.0 [Jan 7 2015] by Adlice Software
mail : http://www.adlice.com/contact/
Feedback : http://forum.adlice.com
Website : http://www.adlice.com/softwares/roguekiller/
Blog : http://www.adlice.com
Operating System : Windows 7 (6.1.7601 Service Pack 1) 32 bits version
Started in : Normal mode
User : Trina [Administrator]
Mode : Scan -- Date : 01/07/2015 13:53:03
¤¤¤ Processes : 1 ¤¤¤
[Suspicious.Path] (SVC) PAExec -- C:\Windows\PAExec.exe -service[-] -> Stopped
¤¤¤ Registry : 19 ¤¤¤
[PUP] HKEY_CLASSES_ROOT\CLSID\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} -> Found
[Suspicious.Path] HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\BRDriver (\??\C:\ProgramData\BitRaider\BRDriver.sys) -> Found
[Suspicious.Path] HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\BRSptSvc ("C:\ProgramData\BitRaider\BRSptSvc.exe") -> Found
[Hidden.From.SCM] HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\HWiNFO32 (\??\C:\Windows\system32\drivers\HWiNFO32.SYS) -> Found
[Suspicious.Path] HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\vtany (\??\C:\Windows\vtany.sys) -> Found
[Suspicious.Path] HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\xhunter1 (\??\C:\Windows\xhunter1.sys) -> Found
[Suspicious.Path] HKEY_LOCAL_MACHINE\System\ControlSet001\Services\BRDriver (\??\C:\ProgramData\BitRaider\BRDriver.sys) -> Found
[Suspicious.Path] HKEY_LOCAL_MACHINE\System\ControlSet001\Services\BRSptSvc ("C:\ProgramData\BitRaider\BRSptSvc.exe") -> Found
[Suspicious.Path] HKEY_LOCAL_MACHINE\System\ControlSet001\Services\vtany (\??\C:\Windows\vtany.sys) -> Found
[Suspicious.Path] HKEY_LOCAL_MACHINE\System\ControlSet001\Services\xhunter1 (\??\C:\Windows\xhunter1.sys) -> Found
[Suspicious.Path] HKEY_LOCAL_MACHINE\System\ControlSet002\Services\BRDriver (\??\C:\ProgramData\BitRaider\BRDriver.sys) -> Found
[Suspicious.Path] HKEY_LOCAL_MACHINE\System\ControlSet002\Services\BRSptSvc ("C:\ProgramData\BitRaider\BRSptSvc.exe") -> Found
[Suspicious.Path] HKEY_LOCAL_MACHINE\System\ControlSet002\Services\vtany (\??\C:\Windows\vtany.sys) -> Found
[Suspicious.Path] HKEY_LOCAL_MACHINE\System\ControlSet002\Services\xhunter1 (\??\C:\Windows\xhunter1.sys) -> Found
[PUM.HomePage] HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Main | Start Page : www.google.com -> Found
[PUM.HomePage] HKEY_USERS\S-1-5-21-3137014297-3521311179-362356191-1002\Software\Microsoft\Internet Explorer\Main | Start Page : http://us.yahoo.com?fr=fp-comodo -> Found
[PUM.HomePage] HKEY_USERS\S-1-5-18\Software\Microsoft\Internet Explorer\Main | Start Page : www.google.com -> Found
[PUM.DesktopIcons] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {20D04FE0-3AEA-1069-A2D8-08002B30309D} : 1 -> Found
[PUM.DesktopIcons] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {59031a47-3f72-44a7-89c5-5595fe6b30ee} : 1 -> Found
¤¤¤ Tasks : 0 ¤¤¤
¤¤¤ Files : 0 ¤¤¤
¤¤¤ Hosts File : 0 ¤¤¤
¤¤¤ Antirootkit : 5 (Driver: Loaded) ¤¤¤
[IAT:Inl(Hook.IEAT)] (chrome.exe) ntdll.dll - NtWriteVirtualMemory : C:\Program Files\AVG\AVG2015\avghookx.dll @ 0x659f1000 (jmp 0xffffffffee53a528)
[IAT:Inl(Hook.IEAT)] (chrome.exe) ntdll.dll - NtWriteVirtualMemory : C:\Program Files\AVG\AVG2015\avghookx.dll @ 0x659f1000 (jmp 0xffffffffee53a528)
[IAT:Inl(Hook.IEAT)] (chrome.exe) ntdll.dll - NtWriteVirtualMemory : C:\Program Files\AVG\AVG2015\avghookx.dll @ 0x659f1000 (jmp 0xffffffffee53a528)
[IAT:Inl(Hook.IEAT)] (chrome.exe) ntdll.dll - NtWriteVirtualMemory : C:\Program Files\AVG\AVG2015\avghookx.dll @ 0x659f1000 (jmp 0xffffffffee53a528)
[IAT:Inl(Hook.IEAT)] (chrome.exe) ntdll.dll - NtWriteVirtualMemory : C:\Program Files\AVG\AVG2015\avghookx.dll @ 0x659f1000 (jmp 0xffffffffee53a528)
¤¤¤ Web browsers : 0 ¤¤¤
¤¤¤ MBR Check : ¤¤¤
+++++ PhysicalDrive0: WDC WD800JD-60LSA5 ATA Device +++++
--- User ---
[MBR] 7bebca7b675c8ebcd197625a781033b8
[BSP] ccf89720c8c51cd062389ff61ff4c3cf : Unknown MBR Code
Partition table:
0 - [ACTIVE] NTFS (0x7) [VISIBLE] Offset (sectors): 2048 | Size: 101 MB
1 - [XXXXXX] NTFS (0x7) [VISIBLE] Offset (sectors): 208896 | Size: 76216 MB
User = LL1 ... OK
User = LL2 ... OK
mail : http://www.adlice.com/contact/
Feedback : http://forum.adlice.com
Website : http://www.adlice.com/softwares/roguekiller/
Blog : http://www.adlice.com
Operating System : Windows 7 (6.1.7601 Service Pack 1) 32 bits version
Started in : Normal mode
User : Trina [Administrator]
Mode : Scan -- Date : 01/07/2015 13:53:03
¤¤¤ Processes : 1 ¤¤¤
[Suspicious.Path] (SVC) PAExec -- C:\Windows\PAExec.exe -service[-] -> Stopped
¤¤¤ Registry : 19 ¤¤¤
[PUP] HKEY_CLASSES_ROOT\CLSID\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} -> Found
[Suspicious.Path] HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\BRDriver (\??\C:\ProgramData\BitRaider\BRDriver.sys) -> Found
[Suspicious.Path] HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\BRSptSvc ("C:\ProgramData\BitRaider\BRSptSvc.exe") -> Found
[Hidden.From.SCM] HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\HWiNFO32 (\??\C:\Windows\system32\drivers\HWiNFO32.SYS) -> Found
[Suspicious.Path] HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\vtany (\??\C:\Windows\vtany.sys) -> Found
[Suspicious.Path] HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\xhunter1 (\??\C:\Windows\xhunter1.sys) -> Found
[Suspicious.Path] HKEY_LOCAL_MACHINE\System\ControlSet001\Services\BRDriver (\??\C:\ProgramData\BitRaider\BRDriver.sys) -> Found
[Suspicious.Path] HKEY_LOCAL_MACHINE\System\ControlSet001\Services\BRSptSvc ("C:\ProgramData\BitRaider\BRSptSvc.exe") -> Found
[Suspicious.Path] HKEY_LOCAL_MACHINE\System\ControlSet001\Services\vtany (\??\C:\Windows\vtany.sys) -> Found
[Suspicious.Path] HKEY_LOCAL_MACHINE\System\ControlSet001\Services\xhunter1 (\??\C:\Windows\xhunter1.sys) -> Found
[Suspicious.Path] HKEY_LOCAL_MACHINE\System\ControlSet002\Services\BRDriver (\??\C:\ProgramData\BitRaider\BRDriver.sys) -> Found
[Suspicious.Path] HKEY_LOCAL_MACHINE\System\ControlSet002\Services\BRSptSvc ("C:\ProgramData\BitRaider\BRSptSvc.exe") -> Found
[Suspicious.Path] HKEY_LOCAL_MACHINE\System\ControlSet002\Services\vtany (\??\C:\Windows\vtany.sys) -> Found
[Suspicious.Path] HKEY_LOCAL_MACHINE\System\ControlSet002\Services\xhunter1 (\??\C:\Windows\xhunter1.sys) -> Found
[PUM.HomePage] HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Main | Start Page : www.google.com -> Found
[PUM.HomePage] HKEY_USERS\S-1-5-21-3137014297-3521311179-362356191-1002\Software\Microsoft\Internet Explorer\Main | Start Page : http://us.yahoo.com?fr=fp-comodo -> Found
[PUM.HomePage] HKEY_USERS\S-1-5-18\Software\Microsoft\Internet Explorer\Main | Start Page : www.google.com -> Found
[PUM.DesktopIcons] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {20D04FE0-3AEA-1069-A2D8-08002B30309D} : 1 -> Found
[PUM.DesktopIcons] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {59031a47-3f72-44a7-89c5-5595fe6b30ee} : 1 -> Found
¤¤¤ Tasks : 0 ¤¤¤
¤¤¤ Files : 0 ¤¤¤
¤¤¤ Hosts File : 0 ¤¤¤
¤¤¤ Antirootkit : 5 (Driver: Loaded) ¤¤¤
[IAT:Inl(Hook.IEAT)] (chrome.exe) ntdll.dll - NtWriteVirtualMemory : C:\Program Files\AVG\AVG2015\avghookx.dll @ 0x659f1000 (jmp 0xffffffffee53a528)
[IAT:Inl(Hook.IEAT)] (chrome.exe) ntdll.dll - NtWriteVirtualMemory : C:\Program Files\AVG\AVG2015\avghookx.dll @ 0x659f1000 (jmp 0xffffffffee53a528)
[IAT:Inl(Hook.IEAT)] (chrome.exe) ntdll.dll - NtWriteVirtualMemory : C:\Program Files\AVG\AVG2015\avghookx.dll @ 0x659f1000 (jmp 0xffffffffee53a528)
[IAT:Inl(Hook.IEAT)] (chrome.exe) ntdll.dll - NtWriteVirtualMemory : C:\Program Files\AVG\AVG2015\avghookx.dll @ 0x659f1000 (jmp 0xffffffffee53a528)
[IAT:Inl(Hook.IEAT)] (chrome.exe) ntdll.dll - NtWriteVirtualMemory : C:\Program Files\AVG\AVG2015\avghookx.dll @ 0x659f1000 (jmp 0xffffffffee53a528)
¤¤¤ Web browsers : 0 ¤¤¤
¤¤¤ MBR Check : ¤¤¤
+++++ PhysicalDrive0: WDC WD800JD-60LSA5 ATA Device +++++
--- User ---
[MBR] 7bebca7b675c8ebcd197625a781033b8
[BSP] ccf89720c8c51cd062389ff61ff4c3cf : Unknown MBR Code
Partition table:
0 - [ACTIVE] NTFS (0x7) [VISIBLE] Offset (sectors): 2048 | Size: 101 MB
1 - [XXXXXX] NTFS (0x7) [VISIBLE] Offset (sectors): 208896 | Size: 76216 MB
User = LL1 ... OK
User = LL2 ... OK
