796
RogueKiller / Re: ROGUEKILLER Rootkit iexplore.exe - Interpreting Scan
« on: June 09, 2014, 08:16:11 PM »
Np, I just wrote it 
You're not the first to ask
You're not the first to ask
Show Posts
This section allows you to view all posts made by this member. Note that you can only see posts made in areas you currently have access to.
797
RogueKiller / Re: ROGUEKILLER Rootkit iexplore.exe - Interpreting Scan
« on: June 09, 2014, 05:51:45 PM »798
RogueKiller / Re: RK crashing
« on: June 09, 2014, 03:49:42 PM »
wow, that's strange. dxgkrnl.sys is the DirectX driver I think.
If it was really corrupted, I think you'd have BSoD soon or later.
If it was really corrupted, I think you'd have BSoD soon or later.
799
RogueKiller / Re: Interpreting a report
« on: June 09, 2014, 02:25:22 PM »
Hello
You can remove everything except the DNS, which seems legit (Belgium)
You can remove everything except the DNS, which seems legit (Belgium)
800
RogueKiller / Re: new to this RogueKiller stuff any suggestions
« on: June 09, 2014, 08:20:39 AM »
Hello
Nothing special to say, almost nothing detected.
Waht is your question?
Nothing special to say, almost nothing detected.
Waht is your question?
801
RogueKiller / Re: Process Hidden and report
« on: June 09, 2014, 08:19:53 AM »
Yes, it is ok.
There's still some bug with Hidden process detection, we have to investigate.
You'll not find them in task manager because 1/ They are supposed to be hidden 2/ They are supposed to be killed
There's still some bug with Hidden process detection, we have to investigate.
You'll not find them in task manager because 1/ They are supposed to be hidden 2/ They are supposed to be killed
802
RogueKiller / Re: RogueKiller64 & root.Zekos
« on: June 09, 2014, 08:18:35 AM »
Ok, makes sense.
Can you do a scan with Malwarebytes and provide the report?
Can you do a scan with Malwarebytes and provide the report?
803
RogueKiller / Re: RogueKiller64 & root.Zekos
« on: June 07, 2014, 03:32:43 PM »
Hello
This is in-memory injection. YOU DON'T HAVE TO REPLACE THE FILE!
If there's nothing in file directory, then this is because it's not properly detected.
Do you have the report?
This is in-memory injection. YOU DON'T HAVE TO REPLACE THE FILE!
If there's nothing in file directory, then this is because it's not properly detected.
Do you have the report?
804
RogueKiller / Re: RK x64 Report: SYNCENG.dll is rootkit?
« on: June 06, 2014, 08:22:01 AM »
Hello
The DLL is legit, it will be whitelisted for next version.
The DLL is legit, it will be whitelisted for next version.
805
RogueKiller / Re: RK crashing
« on: June 06, 2014, 08:20:32 AM »
Do you know the moment where it's crashing?
Is it while scanning the MBR?
Is it while scanning the MBR?
806
RogueKiller / Re: RK crashing
« on: June 05, 2014, 07:15:03 PM »
I didn't. I think there was no dump to send. 
807
RogueKiller / Re: RK crashing
« on: June 05, 2014, 05:23:39 PM »
That doesn't change. I think the dump is corrupted.
Could be generate another one?
Could be generate another one?
808
RogueKiller / Re: RK crashing
« on: June 05, 2014, 03:02:35 PM »
It looks like the dump is corrupted. Can you zip it before upload it?
809
RogueKiller / Re: RK crashing
« on: June 05, 2014, 02:42:19 PM »
Exactly, thanks
It's supposed to be sent at next execution though.
But thanks anyway.
It's supposed to be sent at next execution though.
But thanks anyway.
810
RogueKiller / Re: installed rogue killer
« on: June 05, 2014, 09:48:31 AM »
If you're still here...
There's a program to restore all the files quarantined: http://www.surlatoile.org/RogueKiller/FixesRK/restorefiles.exe
Please tell me if it worked.
There's a program to restore all the files quarantined: http://www.surlatoile.org/RogueKiller/FixesRK/restorefiles.exe
Please tell me if it worked.
