API tools faq
paste
Advertisement
Guest User

Untitled

a guest
Mar 11th, 2017
1,349
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 11.62 KB | None | 0 0
raw download clone embed print report
  1. RogueKiller V12.9.9.0 (x64) [Feb 27 2017] (Free) by Adlice Software
  2. mail : http://www.adlice.com/contact/
  3. Feedback : http://forum.adlice.com
  4. Website : http://www.adlice.com/download/roguekiller/
  5. Blog : http://www.adlice.com
  6.  
  7. Operating System : Windows 10 (10.0.14393) 64 bits version
  8. Started in : Normal mode
  9. User : Jean-Michel Crapaud [Administrator]
  10. Started from : C:\Program Files\RogueKiller\RogueKiller64.exe
  11. Mode : Scan -- Date : 03/11/2017 17:13:59 (Duration : 00:19:56)
  12.  
  13. ¤¤¤ Processes : 2 ¤¤¤
  14. [PUP.AMule|VT.Adwareare.Elex.Gen7!c] ed2k.exe(5228) -- C:\Program Files (x86)\amulell\ed2k.exe[-] -> Found
  15. [PUP.AMule|VT.Adwareare.Elex.Gen7!c] (SVC) ed2kidle -- "C:\Program Files (x86)\amulell\ed2k.exe" -downloadwhenidle[-] -> Found
  16.  
  17. ¤¤¤ Registry : 22 ¤¤¤
  18. [Suspicious.Path] (X64) HKEY_CLASSES_ROOT\CLSID\{39BE6DD8-FFDC-11E6-B0D9-64006A5CFC23} (C:\Users\Bernard\AppData\Roaming\Coabesedapy\Pedotion.dll) -> Found
  19. [Adw.Elex] (X64) HKEY_LOCAL_MACHINE\Software\InterSect Alliance -> Found
  20. [Adw.Elex] (X64) HKEY_USERS\S-1-5-21-2792659385-62999317-2928674910-1001\Software\WinSnare -> Found
  21. [Adw.Elex] (X86) HKEY_USERS\S-1-5-21-2792659385-62999317-2928674910-1001\Software\WinSnare -> Found
  22. [Suspicious.Path] (X64) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks | {39BE6DD8-FFDC-11E6-B0D9-64006A5CFC23} : (C:\Users\Bernard\AppData\Roaming\Coabesedapy\Pedotion.dll) [x] -> Found
  23. [Adw.Elex|Suspicious.Path] (X64) HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost | WinSnare : (C:\Users\Bernard\AppData\Roaming\WinSnare\WinSnare.dll) [x] -> Found
  24. [PUP.AMule|VT.Adwareare.Elex.Gen7!c] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\ed2kidle ("C:\Program Files (x86)\amulell\ed2k.exe" -downloadwhenidle) -> Found
  25. [Adw.Elex|Suspicious.Path] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\WinSnare (C:\Users\Bernard\AppData\Roaming\WinSnare\WinSnare.dll) -> Found
  26. [Suspicious.Path] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules | UDP Query User{3B03F5D1-8C7E-44C8-80DD-C89D8193037F}C:\users\bernard\appdata\local\webtorrent\app-0.14.0\webtorrent.exe : v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=17|Profile=Private|Profile=Public|App=C:\users\bernard\appdata\local\webtorrent\app-0.14.0\webtorrent.exe|Name=webtorrent.exe|Desc=webtorrent.exe|Defer=User| [x] -> Found
  27. [Suspicious.Path] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules | TCP Query User{6972D8BB-B14F-45BD-8D74-03A2E0370CC7}C:\users\bernard\appdata\local\webtorrent\app-0.14.0\webtorrent.exe : v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=6|Profile=Private|Profile=Public|App=C:\users\bernard\appdata\local\webtorrent\app-0.14.0\webtorrent.exe|Name=webtorrent.exe|Desc=webtorrent.exe|Defer=User| [x] -> Found
  28. [Suspicious.Path] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules | UDP Query User{E66B562D-05B6-485F-84EC-31B7D2C16023}C:\users\bernard\appdata\local\webtorrent\app-0.12.0\webtorrent.exe : v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=17|Profile=Private|Profile=Public|App=C:\users\bernard\appdata\local\webtorrent\app-0.12.0\webtorrent.exe|Name=webtorrent.exe|Desc=webtorrent.exe|Defer=User| [x] -> Found
  29. [Suspicious.Path] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules | TCP Query User{3C859870-BD11-4564-9613-FED00E5377F1}C:\users\bernard\appdata\local\webtorrent\app-0.12.0\webtorrent.exe : v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=6|Profile=Private|Profile=Public|App=C:\users\bernard\appdata\local\webtorrent\app-0.12.0\webtorrent.exe|Name=webtorrent.exe|Desc=webtorrent.exe|Defer=User| [x] -> Found
  30. [Suspicious.Path] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules | TCP Query User{C4C2359C-2CB9-4C30-91CB-7AFEAB90B949}C:\users\bernard\appdata\local\webtorrent\app-0.17.0-ia32\webtorrent.exe : v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=6|Profile=Private|Profile=Public|App=C:\users\bernard\appdata\local\webtorrent\app-0.17.0-ia32\webtorrent.exe|Name=webtorrent.exe|Desc=webtorrent.exe|Defer=User| [x] -> Found
  31. [Suspicious.Path] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules | UDP Query User{7434BB7D-48CA-4945-83BA-0EF158CFD540}C:\users\bernard\appdata\local\webtorrent\app-0.17.0-ia32\webtorrent.exe : v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=17|Profile=Private|Profile=Public|App=C:\users\bernard\appdata\local\webtorrent\app-0.17.0-ia32\webtorrent.exe|Name=webtorrent.exe|Desc=webtorrent.exe|Defer=User| [x] -> Found
  32. [Suspicious.Path] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules | TCP Query User{E0D3C6A8-23B2-46A8-83B1-EDCD9DDE3EF9}C:\users\bernard\appdata\local\webtorrent\app-0.17.0\webtorrent.exe : v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=6|Profile=Private|Profile=Public|App=C:\users\bernard\appdata\local\webtorrent\app-0.17.0\webtorrent.exe|Name=webtorrent.exe|Desc=webtorrent.exe|Defer=User| [x] -> Found
  33. [Suspicious.Path] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules | UDP Query User{FB26FA68-FA1E-4030-9B41-2F222B36C122}C:\users\bernard\appdata\local\webtorrent\app-0.17.0\webtorrent.exe : v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=17|Profile=Private|Profile=Public|App=C:\users\bernard\appdata\local\webtorrent\app-0.17.0\webtorrent.exe|Name=webtorrent.exe|Desc=webtorrent.exe|Defer=User| [x] -> Found
  34. [Suspicious.Path] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules | TCP Query User{696C3689-F155-4029-94F0-5EE383EA2E4A}C:\users\bernard\appdata\local\webtorrent\app-0.17.1\webtorrent.exe : v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=6|Profile=Private|Profile=Public|App=C:\users\bernard\appdata\local\webtorrent\app-0.17.1\webtorrent.exe|Name=webtorrent.exe|Desc=webtorrent.exe|Defer=User| [x] -> Found
  35. [Suspicious.Path] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules | UDP Query User{62B81FD1-CFAA-4718-8AEC-F88EF93AD243}C:\users\bernard\appdata\local\webtorrent\app-0.17.1\webtorrent.exe : v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=17|Profile=Private|Profile=Public|App=C:\users\bernard\appdata\local\webtorrent\app-0.17.1\webtorrent.exe|Name=webtorrent.exe|Desc=webtorrent.exe|Defer=User| [x] -> Found
  36. [Suspicious.Path] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules | TCP Query User{AB7B46E4-A8FC-4CD3-AC59-724196F305A3}C:\users\bernard\appdata\local\webtorrent\app-0.17.2\webtorrent.exe : v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=6|Profile=Private|Profile=Public|App=C:\users\bernard\appdata\local\webtorrent\app-0.17.2\webtorrent.exe|Name=webtorrent.exe|Desc=webtorrent.exe|Defer=User| [7] -> Found
  37. [Suspicious.Path] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules | UDP Query User{83FEAA0A-BC1B-42AD-B0CC-F5B706EF8875}C:\users\bernard\appdata\local\webtorrent\app-0.17.2\webtorrent.exe : v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=17|Profile=Private|Profile=Public|App=C:\users\bernard\appdata\local\webtorrent\app-0.17.2\webtorrent.exe|Name=webtorrent.exe|Desc=webtorrent.exe|Defer=User| [7] -> Found
  38. [PUM.Policies] (X64) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System | ConsentPromptBehaviorAdmin : 0 -> Found
  39. [PUM.Policies] (X86) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System | ConsentPromptBehaviorAdmin : 0 -> Found
  40.  
  41. ¤¤¤ Tasks : 6 ¤¤¤
  42. [Suspicious.Path] \9143B8360B8160r2323 -- C:\WINDOWS\system32\rundll32.exe ("C:\ProgramData\9143B8360B8160r2323\9143B8360B8160r2323.dll",BrHjPRQ) -> Found
  43. [Suspicious.Path] \9143B8360B8160r2323-dll -- C:\WINDOWS\system32\rundll32.exe ("C:\ProgramData\9143B8360B8160r2323\9143B8360B8160r2323.dll",BrHjPRQ) -> Found
  44. [Suspicious.Path] \boustrocode -- C:\WINDOWS\system32\rundll32.exe ("C:\ProgramData\9143B8360B8160r2323\9143B8360B8160r2323.dll",BrHjPRQ) -> Found
  45. [Suspicious.Path] \firefox -- C:\WINDOWS\system32\rundll32.exe ("C:\ProgramData\9143B8360B8160r2323\9143B8360B8160r2323.dll",BrHjPRQ) -> Found
  46. [Suspicious.Path] \manager -- C:\WINDOWS\system32\rundll32.exe ("C:\ProgramData\9143B8360B8160r2323\9143B8360B8160r2323.dll",BrHjPRQ) -> Found
  47. [Suspicious.Path] \updater -- C:\WINDOWS\system32\rundll32.exe ("C:\ProgramData\9143B8360B8160r2323\9143B8360B8160r2323.dll",BrHjPRQ) -> Found
  48.  
  49. ¤¤¤ Files : 13 ¤¤¤
  50. [PUP.AMule][Folder] C:\Users\Bernard\AppData\Roaming\aMule -> Found
  51. [PUP.Gen1][Folder] C:\Users\Bernard\AppData\Local\Free YouTube Downloader -> Found
  52. [PUP.QRss][Folder] C:\ProgramData\Microsoft\Windows\Start Menu\Programs\BikaQ -> Found
  53. [PUP.Gen0][File] C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DVDVideoSoft\DVDVideoSoft Free Studio.lnk [LNK@] C:\PROGRA~2\COMMON~1\DVDVID~1\FREEST~1.EXE -> Found
  54. [PUP.Gen0][File] C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DVDVideoSoft\Premium Membership.lnk [LNK@] C:\PROGRA~2\COMMON~1\DVDVID~1\PREMIU~1.EXE -> Found
  55. [PUP.Gen0][File] C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DVDVideoSoft\Uninstall.lnk [LNK@] C:\PROGRA~2\COMMON~1\DVDVID~1\lib\UNINST~1.EXE -> Found
  56. [PUP.Gen1][Folder] C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Free YouTube Downloader -> Found
  57. [Hj.Shortcut][File] C:\ProgramData\Microsoft\Windows\Start Menu\Programs\OpenSSL\Official OpenSSL Documentation.lnk [LNK@] C:\PROGRA~1\INTERN~1\iexplore.exe http://www.startpageing123.com/?type=sc&ts=1489157213&z=537dcad076e37520938849fgczcbat6g3w0mdo7g0o&from=che0812&uid=HGSTXHTS721010A9E630_JS10006206LPAT06LPATX -> Found
  58. [Hj.Shortcut][File] C:\ProgramData\Microsoft\Windows\Start Menu\Programs\OpenSSL\Official OpenSSL Website.lnk [LNK@] C:\PROGRA~1\INTERN~1\iexplore.exe http://www.startpageing123.com/?type=sc&ts=1489157213&z=537dcad076e37520938849fgczcbat6g3w0mdo7g0o&from=che0812&uid=HGSTXHTS721010A9E630_JS10006206LPAT06LPATX -> Found
  59. [Hj.Shortcut][File] C:\ProgramData\Microsoft\Windows\Start Menu\Programs\OpenSSL\Windows OpenSSL Website.lnk [LNK@] C:\PROGRA~1\INTERN~1\iexplore.exe http://www.startpageing123.com/?type=sc&ts=1489157213&z=537dcad076e37520938849fgczcbat6g3w0mdo7g0o&from=che0812&uid=HGSTXHTS721010A9E630_JS10006206LPAT06LPATX -> Found
  60. [PUP.AMule][Folder] C:\Program Files (x86)\amulell -> Found
  61. [PUP.Gen0][Folder] C:\Program Files (x86)\Common Files\DVDVideoSoft -> Found
  62. [PUP.Gen1][Folder] C:\Program Files (x86)\Free YouTube Downloader -> Found
  63.  
  64. ¤¤¤ WMI : 0 ¤¤¤
  65.  
  66. ¤¤¤ Hosts File : 0 ¤¤¤
  67.  
  68. ¤¤¤ Antirootkit : 0 (Driver: Loaded) ¤¤¤
  69.  
  70. ¤¤¤ Web browsers : 0 ¤¤¤
  71.  
  72. ¤¤¤ MBR Check : ¤¤¤
  73. +++++ PhysicalDrive0: HGST HTS721010A9E630 +++++
  74. --- User ---
  75. [MBR] 9ae3a5b1a7b051516ee4448f137a2060
  76. [BSP] 048d9c92c4d7a399084fdf70c6629fce : Empty|VT.Unknown MBR Code
  77. Partition table:
  78. 0 - Basic data partition | Offset (sectors): 2048 | Size: 953868 MB
  79. User = LL1 ... OK
  80. User = LL2 ... OK
  81.  
  82. +++++ PhysicalDrive1: SanDisk SD7SB3Q128G1002 +++++
  83. --- User ---
  84. [MBR] f075814b074a80a94120d88394e8fe2b
  85. [BSP] d98d44559707a9a2da67b1dc1cbbbeef : Empty|VT.Unknown MBR Code
  86. Partition table:
  87. 0 - [MAN-MOUNT] EFI system partition | Offset (sectors): 2048 | Size: 260 MB
  88. 1 - [MAN-MOUNT] Microsoft reserved partition | Offset (sectors): 534528 | Size: 16 MB
  89. 2 - Basic data partition | Offset (sectors): 567296 | Size: 121328 MB
  90. 3 - [SYSTEM][MAN-MOUNT] Basic data partition | Offset (sectors): 249047040 | Size: 499 MB
  91. User = LL1 ... OK
  92. User = LL2 ... OK
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement
Public Pastes
Advertisement
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!