API tools faq
paste
Advertisement
Guest User

Untitled

a guest
Oct 7th, 2013
262
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 4.91 KB | None | 0 0
raw download clone embed print report
  1. RogueKiller V8.7.1 [Oct 3 2013] by Tigzy
  2. mail : tigzyRK<at>gmail<dot>com
  3. Feedback : http://www.adlice.com/forum/
  4. Website : http://www.adlice.com/softwares/roguekiller/
  5. Blog : http://tigzyrk.blogspot.com/
  6.  
  7. Operating System : Windows 7 (6.1.7600 ) 32 bits version
  8. Started in : Normal mode
  9. User : Antony [Admin rights]
  10. Mode : Scan -- Date : 10/07/2013 18:39:46
  11. | ARK || FAK || MBR |
  12.  
  13. ¤¤¤ Bad processes : 0 ¤¤¤
  14.  
  15. ¤¤¤ Registry Entries : 8 ¤¤¤
  16. [HJ POL][PUM] HKLM\[...]\System : ConsentPromptBehaviorAdmin (0) -> FOUND
  17. [HJ POL][PUM] HKLM\[...]\System : EnableLUA (0) -> FOUND
  18. [HJ SMENU][PUM] HKCU\[...]\Advanced : Start_ShowMyGames (0) -> FOUND
  19. [HJ SMENU][PUM] HKCU\[...]\Advanced : Start_ShowSetProgramAccessAndDefaults (0) -> FOUND
  20. [HJ DESK][PUM] HKCU\[...]\ClassicStartMenu : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> FOUND
  21. [HJ DESK][PUM] HKCU\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> FOUND
  22. [HJ DESK][PUM] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> FOUND
  23. [HJ DESK][PUM] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND
  24.  
  25. ¤¤¤ Scheduled tasks : 0 ¤¤¤
  26.  
  27. ¤¤¤ Startup Entries : 0 ¤¤¤
  28.  
  29. ¤¤¤ Web browsers : 0 ¤¤¤
  30.  
  31. ¤¤¤ Particular Files / Folders: ¤¤¤
  32.  
  33. ¤¤¤ Driver : [LOADED] ¤¤¤
  34. [Address] SSDT[84] : NtCreateSection @ 0x82E7B1B3 -> HOOKED (Unknown @ 0x912B0B5E)
  35. [Address] SSDT[299] : NtRequestWaitReplyPort @ 0x82EC0FAA -> HOOKED (Unknown @ 0x912B0B68)
  36. [Address] SSDT[316] : NtSetContextThread @ 0x82F261AB -> HOOKED (Unknown @ 0x912B0B63)
  37. [Address] SSDT[347] : NtSetSecurityObject @ 0x82E60397 -> HOOKED (Unknown @ 0x912B0B6D)
  38. [Address] SSDT[368] : NtSystemDebugControl @ 0x82E5366F -> HOOKED (Unknown @ 0x912B0B72)
  39. [Address] SSDT[370] : NtTerminateProcess @ 0x82EAC01D -> HOOKED (Unknown @ 0x912B0AFF)
  40. [Address] Shadow SSDT[585] : NtUserSetWindowsHookEx -> HOOKED (Unknown @ 0x912B0B86)
  41. [Address] Shadow SSDT[588] : NtUserSetWinEventHook -> HOOKED (Unknown @ 0x912B0B8B)
  42. [Inline] EAT @iexplore.exe (NtMapViewOfSection) : ntdll.dll -> HOOKED (Unknown @ 0x719F0022)
  43. [Inline] EAT @iexplore.exe (ZwMapViewOfSection) : ntdll.dll -> HOOKED (Unknown @ 0x719F0022)
  44. [Inline] EAT @iexplore.exe (CoCreateInstanceEx) : ole32.dll -> HOOKED (Unknown @ 0x717D0022)
  45. [Inline] EAT @iexplore.exe (GetAddrInfoExW) : WS2_32.dll -> HOOKED (Unknown @ 0x710E0022)
  46. [Inline] EAT @iexplore.exe (connect) : WS2_32.dll -> HOOKED (Unknown @ 0x71090022)
  47. [Inline] EAT @iexplore.exe (getaddrinfo) : WS2_32.dll -> HOOKED (Unknown @ 0x71040022)
  48. [Inline] EAT @iexplore.exe (NtMapViewOfSection) : ntdll.dll -> HOOKED (Unknown @ 0x719F0022)
  49. [Inline] EAT @iexplore.exe (ZwMapViewOfSection) : ntdll.dll -> HOOKED (Unknown @ 0x719F0022)
  50. [Inline] EAT @iexplore.exe (CoCreateInstanceEx) : ole32.dll -> HOOKED (Unknown @ 0x717D0022)
  51. [Inline] EAT @iexplore.exe (GetAddrInfoExW) : WS2_32.dll -> HOOKED (Unknown @ 0x71120022)
  52. [Inline] EAT @iexplore.exe (connect) : WS2_32.dll -> HOOKED (Unknown @ 0x710D0022)
  53. [Inline] EAT @iexplore.exe (getaddrinfo) : WS2_32.dll -> HOOKED (Unknown @ 0x71080022)
  54. [Inline] EAT @iexplore.exe (NtMapViewOfSection) : ntdll.dll -> HOOKED (Unknown @ 0x719F0022)
  55. [Inline] EAT @iexplore.exe (ZwMapViewOfSection) : ntdll.dll -> HOOKED (Unknown @ 0x719F0022)
  56. [Inline] EAT @iexplore.exe (CoCreateInstanceEx) : ole32.dll -> HOOKED (Unknown @ 0x717D0022)
  57. [Inline] EAT @iexplore.exe (GetAddrInfoExW) : WS2_32.dll -> HOOKED (Unknown @ 0x71120022)
  58. [Inline] EAT @iexplore.exe (connect) : WS2_32.dll -> HOOKED (Unknown @ 0x710D0022)
  59. [Inline] EAT @iexplore.exe (getaddrinfo) : WS2_32.dll -> HOOKED (Unknown @ 0x71080022)
  60. [Inline] EAT @iexplore.exe (NtMapViewOfSection) : ntdll.dll -> HOOKED (Unknown @ 0x719F0022)
  61. [Inline] EAT @iexplore.exe (ZwMapViewOfSection) : ntdll.dll -> HOOKED (Unknown @ 0x719F0022)
  62. [Inline] EAT @iexplore.exe (CoCreateInstanceEx) : ole32.dll -> HOOKED (Unknown @ 0x717D0022)
  63. [Inline] EAT @iexplore.exe (GetAddrInfoExW) : WS2_32.dll -> HOOKED (Unknown @ 0x71120022)
  64. [Inline] EAT @iexplore.exe (connect) : WS2_32.dll -> HOOKED (Unknown @ 0x710D0022)
  65. [Inline] EAT @iexplore.exe (getaddrinfo) : WS2_32.dll -> HOOKED (Unknown @ 0x71080022)
  66.  
  67. ¤¤¤ External Hives: ¤¤¤
  68.  
  69. ¤¤¤ Infection : ¤¤¤
  70.  
  71. ¤¤¤ HOSTS File: ¤¤¤
  72. --> %SystemRoot%\System32\drivers\etc\hosts
  73.  
  74.  
  75.  
  76.  
  77. ¤¤¤ MBR Check: ¤¤¤
  78.  
  79. +++++ PhysicalDrive0: (\\.\PHYSICALDRIVE0 @ IDE) (Standard disk drives) - ST31000528AS ATA Device +++++
  80. --- User ---
  81. [MBR] 250b57680c3234531694b3382ecdc5e2
  82. [BSP] 177e45c7901afd183114ec3f50f18cd0 : Windows 7/8 MBR Code
  83. Partition table:
  84. 0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 2048 | Size: 100 Mo
  85. 1 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 206848 | Size: 599900 Mo
  86. 2 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 1228802048 | Size: 353866 Mo
  87. User = LL1 ... OK!
  88. User = LL2 ... OK!
  89.  
  90. Finished : << RKreport[0]_S_10072013_183946.txt >>
  91. RKreport[0]_S_10032013_183210.txt;RKreport[0]_S_10072013_180950.txt
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement
Public Pastes
Advertisement
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!