Show Posts

This section allows you to view all posts made by this member. Note that you can only see posts made in areas you currently have access to.


Messages - roushi

Pages: [1]
1
RogueKiller / Re: ===> False Positives <===
« on: March 26, 2015, 10:13:51 AM »
Hi curson,
I don't know how to find full path. I'm not advanced user. However, I search and found that this .dll file belongs to zemana anti logger (I use anti keylogger)
and located in :
C:\Program Files (x86)\KeyCryptSDK
thanks

2
RogueKiller / Re: ===> False Positives <===
« on: March 24, 2015, 04:25:18 PM »
Hi curson,
I scan with newer version of rogue killer

however, i got warning about userland rootkit, IAT hook

here is my log:
RogueKiller V10.5.7.0 (x64) [Mar 22 2015] by Adlice Software
mail : http://www.adlice.com/contact/
Feedback : http://forum.adlice.com
Website : http://www.adlice.com/softwares/roguekiller/
Blog : http://www.adlice.com

Operating System : Windows 8.1 (6.3.9200 ) 64 bits version
Started in : Normal mode
User : fajar [Administrator]
Started from : F:\New folder\Softwares\RogueKillerX64.exe
Mode : Scan -- Date : 03/24/2015  22:14:42

¤¤¤ Processes : 1 ¤¤¤
[Suspicious.Path] (SVC) SLEE_18_DRIVER -- \??\C:\WINDOWS\Sleen1864.sys[7] -> Stopped

¤¤¤ Registry : 13 ¤¤¤
[Hidden.From.SCM] (X64) HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Partizan (system32\drivers\Partizan.sys) -> Found
[Suspicious.Path] (X64) HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\SLEE_18_DRIVER (\??\C:\WINDOWS\Sleen1864.sys) -> Found
[Suspicious.Path] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\SLEE_18_DRIVER (\??\C:\WINDOWS\Sleen1864.sys) -> Found
[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{8EF8906D-A45A-4663-8558-C4D00C3B3B13} | NameServer : 8.8.8.8,8.8.4.4,4.2.2.1,4.2.2.2,208.67.222.222,208.67.220.220,8.26.56.26,8.20.247.20,156.154.70.1,156.154.71.1 [UNITED STATES (US)][UNITED STATES (US)][PHILIPPINES (PH)][UNITED STATES (US)]  -> Found
[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Tcpip\Parameters\Interfaces\{8EF8906D-A45A-4663-8558-C4D00C3B3B13} | NameServer : 8.8.8.8,8.8.4.4,4.2.2.1,4.2.2.2,208.67.222.222,208.67.220.220,8.26.56.26,8.20.247.20,156.154.70.1,156.154.71.1 [UNITED STATES (US)][UNITED STATES (US)][PHILIPPINES (PH)][UNITED STATES (US)]  -> Found
[PUM.DesktopIcons] (X64) HKEY_USERS\S-1-5-21-4056015360-625216753-3323311208-1002\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\ClassicStartMenu | {59031A47-3F72-44A7-89C5-5595FE6B30EE} : 1  -> Found
[PUM.DesktopIcons] (X64) HKEY_USERS\S-1-5-21-4056015360-625216753-3323311208-1002\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\ClassicStartMenu | {20D04FE0-3AEA-1069-A2D8-08002B30309D} : 1  -> Found
[PUM.DesktopIcons] (X86) HKEY_USERS\S-1-5-21-4056015360-625216753-3323311208-1002\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\ClassicStartMenu | {59031A47-3F72-44A7-89C5-5595FE6B30EE} : 1  -> Found
[PUM.DesktopIcons] (X86) HKEY_USERS\S-1-5-21-4056015360-625216753-3323311208-1002\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\ClassicStartMenu | {20D04FE0-3AEA-1069-A2D8-08002B30309D} : 1  -> Found
[PUM.DesktopIcons] (X64) HKEY_USERS\S-1-5-21-4056015360-625216753-3323311208-1002\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {59031A47-3F72-44A7-89C5-5595FE6B30EE} : 1  -> Found
[PUM.DesktopIcons] (X64) HKEY_USERS\S-1-5-21-4056015360-625216753-3323311208-1002\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {20D04FE0-3AEA-1069-A2D8-08002B30309D} : 1  -> Found
[PUM.DesktopIcons] (X86) HKEY_USERS\S-1-5-21-4056015360-625216753-3323311208-1002\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {59031A47-3F72-44A7-89C5-5595FE6B30EE} : 1  -> Found
[PUM.DesktopIcons] (X86) HKEY_USERS\S-1-5-21-4056015360-625216753-3323311208-1002\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {20D04FE0-3AEA-1069-A2D8-08002B30309D} : 1  -> Found

¤¤¤ Tasks : 0 ¤¤¤

¤¤¤ Files : 0 ¤¤¤

¤¤¤ Hosts File : 0 ¤¤¤

¤¤¤ Antirootkit : 61 (Driver: Loaded) ¤¤¤
[IAT:Inl(Hook.IEAT)] (chrome.exe) USER32.dll - PeekMessageW : C:\PROGRA~2\KEYCRY~1\KEYCRY~3.DLL @ 0x74d54230 (ret )
[IAT:Inl(Hook.IEAT)] (chrome.exe) USER32.dll - PeekMessageA : C:\PROGRA~2\KEYCRY~1\KEYCRY~3.DLL @ 0x74d54180 (ret )
[IAT:Inl(Hook.IEAT)] (chrome.exe) USER32.dll - IsDialogMessageW : C:\PROGRA~2\KEYCRY~1\KEYCRY~3.DLL @ 0x74d53fc0 (ret )
[IAT:Inl(Hook.IEAT)] (chrome.exe) USER32.dll - IsDialogMessageA : C:\PROGRA~2\KEYCRY~1\KEYCRY~3.DLL @ 0x74d53f40 (ret )
[IAT:Inl(Hook.IEAT)] (chrome.exe) USER32.dll - PeekMessageW : C:\PROGRA~2\KEYCRY~1\KEYCRY~3.DLL @ 0x74d54230 (ret )
[IAT:Inl(Hook.IEAT)] (chrome.exe) USER32.dll - PeekMessageA : C:\PROGRA~2\KEYCRY~1\KEYCRY~3.DLL @ 0x74d54180 (ret )
[IAT:Inl(Hook.IEAT)] (chrome.exe) USER32.dll - IsDialogMessageW : C:\PROGRA~2\KEYCRY~1\KEYCRY~3.DLL @ 0x74d53fc0 (ret )
[IAT:Inl(Hook.IEAT)] (chrome.exe) USER32.dll - PeekMessageW : C:\PROGRA~2\KEYCRY~1\KEYCRY~3.DLL @ 0x74d54230 (ret )
[IAT:Inl(Hook.IEAT)] (chrome.exe) USER32.dll - PeekMessageA : C:\PROGRA~2\KEYCRY~1\KEYCRY~3.DLL @ 0x74d54180 (ret )
[IAT:Inl(Hook.IEAT)] (chrome.exe) USER32.dll - IsDialogMessageW : C:\PROGRA~2\KEYCRY~1\KEYCRY~3.DLL @ 0x74d53fc0 (ret )
[IAT:Inl(Hook.IEAT)] (chrome.exe) USER32.dll - PeekMessageW : C:\PROGRA~2\KEYCRY~1\KEYCRY~3.DLL @ 0x74d54230 (ret )
[IAT:Inl(Hook.IEAT)] (chrome.exe) USER32.dll - PeekMessageA : C:\PROGRA~2\KEYCRY~1\KEYCRY~3.DLL @ 0x74d54180 (ret )
[IAT:Inl(Hook.IEAT)] (chrome.exe) USER32.dll - IsDialogMessageW : C:\PROGRA~2\KEYCRY~1\KEYCRY~3.DLL @ 0x74d53fc0 (ret )
[IAT:Inl(Hook.IEAT)] (chrome.exe) USER32.dll - PeekMessageW : C:\PROGRA~2\KEYCRY~1\KEYCRY~3.DLL @ 0x74d54230 (ret )
[IAT:Inl(Hook.IEAT)] (chrome.exe) USER32.dll - PeekMessageA : C:\PROGRA~2\KEYCRY~1\KEYCRY~3.DLL @ 0x74d54180 (ret )
[IAT:Inl(Hook.IEAT)] (chrome.exe) USER32.dll - IsDialogMessageW : C:\PROGRA~2\KEYCRY~1\KEYCRY~3.DLL @ 0x74d53fc0 (ret )
[IAT:Inl(Hook.IEAT)] (chrome.exe) USER32.dll - PeekMessageW : C:\PROGRA~2\KEYCRY~1\KEYCRY~3.DLL @ 0x74d54230 (ret )
[IAT:Inl(Hook.IEAT)] (chrome.exe) USER32.dll - PeekMessageA : C:\PROGRA~2\KEYCRY~1\KEYCRY~3.DLL @ 0x74d54180 (ret )
[IAT:Inl(Hook.IEAT)] (chrome.exe) USER32.dll - IsDialogMessageW : C:\PROGRA~2\KEYCRY~1\KEYCRY~3.DLL @ 0x74d53fc0 (ret )
[IAT:Inl(Hook.IEAT)] (chrome.exe) USER32.dll - PeekMessageW : C:\PROGRA~2\KEYCRY~1\KEYCRY~3.DLL @ 0x74d54230 (ret )
[IAT:Inl(Hook.IEAT)] (chrome.exe) USER32.dll - PeekMessageA : C:\PROGRA~2\KEYCRY~1\KEYCRY~3.DLL @ 0x74d54180 (ret )
[IAT:Inl(Hook.IEAT)] (chrome.exe) USER32.dll - IsDialogMessageW : C:\PROGRA~2\KEYCRY~1\KEYCRY~3.DLL @ 0x74d53fc0 (ret )
[IAT:Inl(Hook.IEAT)] (chrome.exe) USER32.dll - PeekMessageW : C:\PROGRA~2\KEYCRY~1\KEYCRY~3.DLL @ 0x74d54230 (ret )
[IAT:Inl(Hook.IEAT)] (chrome.exe) USER32.dll - PeekMessageA : C:\PROGRA~2\KEYCRY~1\KEYCRY~3.DLL @ 0x74d54180 (ret )
[IAT:Inl(Hook.IEAT)] (chrome.exe) USER32.dll - IsDialogMessageW : C:\PROGRA~2\KEYCRY~1\KEYCRY~3.DLL @ 0x74d53fc0 (ret )
[IAT:Inl(Hook.IEAT)] (chrome.exe) USER32.dll - PeekMessageW : C:\PROGRA~2\KEYCRY~1\KEYCRY~3.DLL @ 0x74d54230 (ret )
[IAT:Inl(Hook.IEAT)] (chrome.exe) USER32.dll - PeekMessageA : C:\PROGRA~2\KEYCRY~1\KEYCRY~3.DLL @ 0x74d54180 (ret )
[IAT:Inl(Hook.IEAT)] (chrome.exe) USER32.dll - IsDialogMessageW : C:\PROGRA~2\KEYCRY~1\KEYCRY~3.DLL @ 0x74d53fc0 (ret )
[IAT:Inl(Hook.IEAT)] (chrome.exe) USER32.dll - PeekMessageW : C:\PROGRA~2\KEYCRY~1\KEYCRY~3.DLL @ 0x74d54230 (ret )
[IAT:Inl(Hook.IEAT)] (chrome.exe) USER32.dll - PeekMessageA : C:\PROGRA~2\KEYCRY~1\KEYCRY~3.DLL @ 0x74d54180 (ret )
[IAT:Inl(Hook.IEAT)] (chrome.exe) USER32.dll - IsDialogMessageW : C:\PROGRA~2\KEYCRY~1\KEYCRY~3.DLL @ 0x74d53fc0 (ret )
[IAT:Inl(Hook.IEAT)] (chrome.exe) USER32.dll - PeekMessageW : C:\PROGRA~2\KEYCRY~1\KEYCRY~3.DLL @ 0x74d54230 (ret )
[IAT:Inl(Hook.IEAT)] (chrome.exe) USER32.dll - PeekMessageA : C:\PROGRA~2\KEYCRY~1\KEYCRY~3.DLL @ 0x74d54180 (ret )
[IAT:Inl(Hook.IEAT)] (chrome.exe) USER32.dll - IsDialogMessageW : C:\PROGRA~2\KEYCRY~1\KEYCRY~3.DLL @ 0x74d53fc0 (ret )
[IAT:Inl(Hook.IEAT)] (chrome.exe) USER32.dll - PeekMessageW : C:\PROGRA~2\KEYCRY~1\KEYCRY~3.DLL @ 0x74d54230 (ret )
[IAT:Inl(Hook.IEAT)] (chrome.exe) USER32.dll - PeekMessageA : C:\PROGRA~2\KEYCRY~1\KEYCRY~3.DLL @ 0x74d54180 (ret )
[IAT:Inl(Hook.IEAT)] (chrome.exe) USER32.dll - IsDialogMessageW : C:\PROGRA~2\KEYCRY~1\KEYCRY~3.DLL @ 0x74d53fc0 (ret )
[IAT:Inl(Hook.IEAT)] (chrome.exe) USER32.dll - PeekMessageW : C:\PROGRA~2\KEYCRY~1\KEYCRY~3.DLL @ 0x74d54230 (ret )
[IAT:Inl(Hook.IEAT)] (chrome.exe) USER32.dll - PeekMessageA : C:\PROGRA~2\KEYCRY~1\KEYCRY~3.DLL @ 0x74d54180 (ret )
[IAT:Inl(Hook.IEAT)] (chrome.exe) USER32.dll - IsDialogMessageW : C:\PROGRA~2\KEYCRY~1\KEYCRY~3.DLL @ 0x74d53fc0 (ret )
[IAT:Inl(Hook.IEAT)] (chrome.exe) USER32.dll - PeekMessageW : C:\PROGRA~2\KEYCRY~1\KEYCRY~3.DLL @ 0x74d54230 (ret )
[IAT:Inl(Hook.IEAT)] (chrome.exe) USER32.dll - PeekMessageA : C:\PROGRA~2\KEYCRY~1\KEYCRY~3.DLL @ 0x74d54180 (ret )
[IAT:Inl(Hook.IEAT)] (chrome.exe) USER32.dll - IsDialogMessageW : C:\PROGRA~2\KEYCRY~1\KEYCRY~3.DLL @ 0x74d53fc0 (ret )
[IAT:Inl(Hook.IEAT)] (chrome.exe) USER32.dll - PeekMessageW : C:\PROGRA~2\KEYCRY~1\KEYCRY~3.DLL @ 0x74d54230 (ret )
[IAT:Inl(Hook.IEAT)] (chrome.exe) USER32.dll - PeekMessageA : C:\PROGRA~2\KEYCRY~1\KEYCRY~3.DLL @ 0x74d54180 (ret )
[IAT:Inl(Hook.IEAT)] (chrome.exe) USER32.dll - IsDialogMessageW : C:\PROGRA~2\KEYCRY~1\KEYCRY~3.DLL @ 0x74d53fc0 (ret )
[IAT:Inl(Hook.IEAT)] (chrome.exe) USER32.dll - PeekMessageW : C:\PROGRA~2\KEYCRY~1\KEYCRY~3.DLL @ 0x74d54230 (ret )
[IAT:Inl(Hook.IEAT)] (chrome.exe) USER32.dll - PeekMessageA : C:\PROGRA~2\KEYCRY~1\KEYCRY~3.DLL @ 0x74d54180 (ret )
[IAT:Inl(Hook.IEAT)] (chrome.exe) USER32.dll - IsDialogMessageW : C:\PROGRA~2\KEYCRY~1\KEYCRY~3.DLL @ 0x74d53fc0 (ret )
[IAT:Inl(Hook.IEAT)] (chrome.exe) USER32.dll - PeekMessageW : C:\PROGRA~2\KEYCRY~1\KEYCRY~3.DLL @ 0x74d54230 (ret )
[IAT:Inl(Hook.IEAT)] (chrome.exe) USER32.dll - PeekMessageA : C:\PROGRA~2\KEYCRY~1\KEYCRY~3.DLL @ 0x74d54180 (ret )
[IAT:Inl(Hook.IEAT)] (chrome.exe) USER32.dll - IsDialogMessageW : C:\PROGRA~2\KEYCRY~1\KEYCRY~3.DLL @ 0x74d53fc0 (ret )
[IAT:Inl(Hook.IEAT)] (chrome.exe) USER32.dll - PeekMessageW : C:\PROGRA~2\KEYCRY~1\KEYCRY~3.DLL @ 0x74d54230 (ret )
[IAT:Inl(Hook.IEAT)] (chrome.exe) USER32.dll - PeekMessageA : C:\PROGRA~2\KEYCRY~1\KEYCRY~3.DLL @ 0x74d54180 (ret )
[IAT:Inl(Hook.IEAT)] (chrome.exe) USER32.dll - IsDialogMessageW : C:\PROGRA~2\KEYCRY~1\KEYCRY~3.DLL @ 0x74d53fc0 (ret )
[IAT:Inl(Hook.IEAT)] (chrome.exe) USER32.dll - PeekMessageW : C:\PROGRA~2\KEYCRY~1\KEYCRY~3.DLL @ 0x74d54230 (ret )
[IAT:Inl(Hook.IEAT)] (chrome.exe) USER32.dll - PeekMessageA : C:\PROGRA~2\KEYCRY~1\KEYCRY~3.DLL @ 0x74d54180 (ret )
[IAT:Inl(Hook.IEAT)] (chrome.exe) USER32.dll - IsDialogMessageW : C:\PROGRA~2\KEYCRY~1\KEYCRY~3.DLL @ 0x74d53fc0 (ret )
[IAT:Inl(Hook.IEAT)] (chrome.exe) USER32.dll - PeekMessageW : C:\PROGRA~2\KEYCRY~1\KEYCRY~3.DLL @ 0x74d54230 (ret )
[IAT:Inl(Hook.IEAT)] (chrome.exe) USER32.dll - PeekMessageA : C:\PROGRA~2\KEYCRY~1\KEYCRY~3.DLL @ 0x74d54180 (ret )
[IAT:Inl(Hook.IEAT)] (chrome.exe) USER32.dll - IsDialogMessageW : C:\PROGRA~2\KEYCRY~1\KEYCRY~3.DLL @ 0x74d53fc0 (ret )

¤¤¤ Web browsers : 0 ¤¤¤

¤¤¤ MBR Check : ¤¤¤
+++++ PhysicalDrive0: ST1000LM024 HN-M101MBB +++++
--- User ---
[MBR] 35d34ea0725b15bfc5585d344d1a1ee4
[BSP] 9bc2edaef5de5c63af0852ed1c97e416 : Empty MBR Code
Partition table:
0 - [MAN-MOUNT] EFI system partition | Offset (sectors): 2048 | Size: 100 MB
1 - [SYSTEM][MAN-MOUNT] Basic data partition | Offset (sectors): 206848 | Size: 900 MB
2 - [MAN-MOUNT] Microsoft reserved partition | Offset (sectors): 2050048 | Size: 128 MB
3 - Basic data partition | Offset (sectors): 2312192 | Size: 381096 MB
4 - [SYSTEM][MAN-MOUNT]  | Offset (sectors): 782796800 | Size: 450 MB
5 - Basic data partition | Offset (sectors): 783718400 | Size: 150704 MB
6 - Basic data partition | Offset (sectors): 1092360192 | Size: 399999 MB
7 - [SYSTEM][MAN-MOUNT] Basic data partition | Offset (sectors): 1911560192 | Size: 20490 MB
User = LL1 ... OK
User = LL2 ... OK


============================================
RKreport_DEL_03182015_223955.log - RKreport_SCN_03092015_115351.log - RKreport_SCN_03102015_143536.log - RKreport_SCN_03182015_213128.log
RKreport_SCN_03182015_223747.log

I use bitdefender, malwarebytes anti malware and anti exploit, zemana anti logger.

can you give clues whether false positive or rootkit?

thanks a lot

3
General Discussion / Re: Introduce yourself
« on: March 24, 2015, 04:42:03 AM »
hello
my name is roushi, Im from indonesia.
I work as administration staff in indonesian company.
thx for great program tigzy

4
RogueKiller / Re: ===> False Positives <===
« on: March 19, 2015, 05:33:45 PM »
sorry curson, I uninstalled it as soon as detected by RK and I forgot to record full path of the detected process.  :(

5
RogueKiller / Re: ===> False Positives <===
« on: March 19, 2015, 01:49:51 AM »
hello,
recently I use RK and found that my cloud security program, tresorit (tresorit.exe) is suspected malicious program. I download it from their offcial website (https://tresorit.com/). For security concern, I have uninstalled tresorit. But I still want to know whether false positive or rogue application. thanks  ;D

6
RogueKiller / Re: ===> False Positives <===
« on: March 11, 2015, 04:52:10 AM »
thanks a lot curson  :D

7
RogueKiller / Re: ===> False Positives <===
« on: March 10, 2015, 08:49:54 AM »
hello
this my log

RogueKiller V10.5.2.0 (x64) [Mar  9 2015] by Adlice Software
mail : http://www.adlice.com/contact/
Feedback : http://forum.adlice.com
Website : http://www.adlice.com/softwares/roguekiller/
Blog : http://www.adlice.com

Operating System : Windows 8.1 (6.3.9200 ) 64 bits version
Started in : Normal mode
User : fajar [Administrator]
Started from : C:\Users\fajar\Downloads\RogueKillerX64 (1).exe
Mode : Scan -- Date : 03/10/2015  14:35:36

¤¤¤ Processes : 0 ¤¤¤

¤¤¤ Registry : 10 ¤¤¤
[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters | DhcpNameServer : 192.168.250.1 203.161.30.1 203.161.30.2  -> Found
[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Tcpip\Parameters | DhcpNameServer : 192.168.250.1 203.161.30.1 203.161.30.2  -> Found
[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{9626352A-45DB-4514-A4E4-F37C1C798476} | DhcpNameServer : 192.168.250.1 203.161.30.1 203.161.30.2  -> Found
[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{C7491737-1EF7-4C2E-8F23-E2631A37F61E} | DhcpNameServer : 192.13.128.24  -> Found
[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Tcpip\Parameters\Interfaces\{9626352A-45DB-4514-A4E4-F37C1C798476} | DhcpNameServer : 192.168.250.1 203.161.30.1 203.161.30.2 [INDONESIA (ID)][INDONESIA (ID)]  -> Found
[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Tcpip\Parameters\Interfaces\{C7491737-1EF7-4C2E-8F23-E2631A37F61E} | DhcpNameServer : 192.13.128.24 [UNITED STATES (US)]  -> Found
[PUM.DesktopIcons] (X64) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {20D04FE0-3AEA-1069-A2D8-08002B30309D} : 1  -> Found
[PUM.DesktopIcons] (X64) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {59031a47-3f72-44a7-89c5-5595fe6b30ee} : 1  -> Found
[PUM.DesktopIcons] (X86) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {20D04FE0-3AEA-1069-A2D8-08002B30309D} : 1  -> Found
[PUM.DesktopIcons] (X86) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {59031a47-3f72-44a7-89c5-5595fe6b30ee} : 1  -> Found

¤¤¤ Tasks : 0 ¤¤¤

¤¤¤ Files : 0 ¤¤¤

¤¤¤ Hosts File : 0 ¤¤¤

¤¤¤ Antirootkit : 0 (Driver: Loaded) ¤¤¤

¤¤¤ Web browsers : 0 ¤¤¤

¤¤¤ MBR Check : ¤¤¤
+++++ PhysicalDrive0: ST1000LM024 HN-M101MBB +++++
--- User ---
[MBR] 35d34ea0725b15bfc5585d344d1a1ee4
[BSP] 9bc2edaef5de5c63af0852ed1c97e416 : Empty MBR Code
Partition table:
0 - [MAN-MOUNT] EFI system partition | Offset (sectors): 2048 | Size: 100 MB
1 - [SYSTEM][MAN-MOUNT] Basic data partition | Offset (sectors): 206848 | Size: 900 MB
2 - [MAN-MOUNT] Microsoft reserved partition | Offset (sectors): 2050048 | Size: 128 MB
3 - Basic data partition | Offset (sectors): 2312192 | Size: 381096 MB
4 - [SYSTEM][MAN-MOUNT]  | Offset (sectors): 782796800 | Size: 450 MB
5 - Basic data partition | Offset (sectors): 783718400 | Size: 150704 MB
6 - Basic data partition | Offset (sectors): 1092360192 | Size: 399999 MB
7 - [SYSTEM][MAN-MOUNT] Basic data partition | Offset (sectors): 1911560192 | Size: 20490 MB
User = LL1 ... OK
User = LL2 ... OK

+++++ PhysicalDrive1: Kingston DT 101 G2 USB Device +++++
--- User ---
[MBR] 0d8a95f0177a129bfb88face59b8bdbb
[BSP] 33a07a59d299ab4ea9f4ab0156f9d86f : Windows XP MBR Code
Partition table:
User = LL1 ... OK
Error reading LL2 MBR! ([32] The request is not supported. )


============================================
RKreport_SCN_03092015_115351.log

Is this a false positive or my computer has been infected?

thanks

Pages: [1]