Author Topic: After a RogueKiller scan  (Read 5478 times)

0 Members and 1 Guest are viewing this topic.

September 13, 2014, 02:13:11 PM

unreald00m

  • Guest
After a RogueKiller scan
« on: September 13, 2014, 02:13:11 PM »
Hi guys

After a scan with RogueKiller I end up here: http://www.adlice.com/kernelmode-rootkits-part-3-kernel-filters/
What should I do? Am I infected? I could really need some help here.

Here is a log from RogueKiller
RogueKiller V9.2.10.0 (x64) [Jul 11 2014] by Adlice Software
mail : http://www.adlice.com/contact/
Feedback : http://forum.adlice.com
Website : http://www.adlice.com/softwares/roguekiller/
Blog : http://www.adlice.com

Operating System : Windows 7 (6.1.7601 Service Pack 1) 64 bits version
Started in : Normal mode
User : Mr.X [Admin rights]
Mode : Remove -- Date : 09/13/2014  13:58:53

¤¤¤ Bad processes : 0 ¤¤¤

¤¤¤ Registry Entries : 0 ¤¤¤

¤¤¤ Scheduled tasks : 0 ¤¤¤

¤¤¤ Files : 0 ¤¤¤

¤¤¤ HOSTS File : 0 ¤¤¤

¤¤¤ Antirootkit : 6 (Driver: LOADED) ¤¤¤
[Filter(Kernel.Filter)] \Driver\atapi @ Unknown : \Driver\edevmon @ \Device\00000073 (\SystemRoot\System32\drivers\rdyboost.sys)
[Filter(Kernel.Filter)] \Driver\atapi @ Unknown : \Driver\edevmon @ \Device\00000072 (\SystemRoot\System32\drivers\rdyboost.sys)
[Filter(Kernel.Filter)] \Driver\atapi @ \Device\Ide\IdeDeviceP0T0L0-0 : \Driver\cdrom @ \Device\CdRom0 (\SystemRoot\system32\drivers\34423650.sys)
[Filter(Kernel.Filter)] \Driver\atapi @ \Device\CdRom0 : \Driver\edevmon @ \Device\00000075 (\SystemRoot\System32\drivers\rdyboost.sys)
[Filter(Kernel.Filter)] \Driver\Disk @ Unknown : \Driver\edevmon @ \Device\00000073 (\SystemRoot\System32\drivers\rdyboost.sys)
[Filter(Kernel.Filter)] \Driver\Disk @ Unknown : \Driver\edevmon @ \Device\00000072 (\SystemRoot\System32\drivers\rdyboost.sys)

¤¤¤ Web browsers : 0 ¤¤¤

¤¤¤ MBR Check : ¤¤¤
+++++ PhysicalDrive0: Samsung SSD 840 EVO 120GB ATA Device +++++
--- User ---
[MBR] 04fb85cf760df569f7e4ce1953663e89
[BSP] a23bb8269db0e46edcd273869f954d20 : Windows Vista/7/8 MBR Code
Partition table:
0 - [ACTIVE] NTFS (0x7) [VISIBLE] Offset (sectors): 2048 | Size: 100 MB
1 - [XXXXXX] NTFS (0x7) [VISIBLE] Offset (sectors): 206848 | Size: 114371 MB
User = LL1 ... OK
User = LL2 ... OK

+++++ PhysicalDrive1: SAMSUNG HD753LJ ATA Device +++++
--- User ---
[MBR] 793fa93840f03455be27ce846aab1dd4
[BSP] 3fc0b538638c517f0bb877a7ae2cf2b0 : Windows Vista/7/8 MBR Code
Partition table:
0 - [XXXXXX] NTFS (0x7) [VISIBLE] Offset (sectors): 2048 | Size: 199995 MB
1 - [ACTIVE] NTFS (0x7) [VISIBLE] Offset (sectors): 409593240 | Size: 515405 MB
User = LL1 ... OK
User = LL2 ... OK


============================================
RKreport_DEL_09032014_201611.log - RKreport_DEL_09032014_215630.log - RKreport_DEL_09032014_220055.log - RKreport_DEL_09032014_222200.log
RKreport_DEL_09052014_214358.log - RKreport_DEL_09132014_134727.log - RKreport_SCN_09032014_201602.log - RKreport_SCN_09032014_213739.log
RKreport_SCN_09032014_214110.log - RKreport_SCN_09032014_214325.log - RKreport_SCN_09032014_214407.log - RKreport_SCN_09032014_215452.log
RKreport_SCN_09032014_215621.log - RKreport_SCN_09032014_220033.log - RKreport_SCN_09032014_222150.log - RKreport_SCN_09042014_230501.log
RKreport_SCN_09052014_145912.log - RKreport_SCN_09052014_152803.log - RKreport_SCN_09052014_214230.log - RKreport_SCN_09112014_133919.log
RKreport_SCN_09132014_134351.log - RKreport_SCN_09132014_135349.log

Best regards
unreald00m

Reply #1September 15, 2014, 12:27:35 AM

Tigzy

  • Administrator
  • Hero Member

  • Offline
  • *****

  • 957
  • Reputation:
    91
  • Personal Text
    Owner, Adlice Software
    • View Profile
    • Adlice Software
Re: After a RogueKiller scan
« Reply #1 on: September 15, 2014, 12:27:35 AM »
hello
that a FP, already whitelisted in the next release