RogueKiller V10.0.8.0 [Nov 20 2014] by Adlice Software mail : http://www.adlice.com/contact/ Feedback : http://forum.adlice.com Website : http://www.adlice.com/softwares/roguekiller/ Blog : http://www.adlice.com Operating System : Windows 8.1 (6.3.9200 ) 64 bits version Started in : Normal mode User : Slaterdude [Administrator] Mode : Scan -- Date : 12/01/2014 04:35:59 ¤¤¤ Processes : 0 ¤¤¤ ¤¤¤ Registry : 16 ¤¤¤ [Suspicious.Path] (X64) HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run | HijackThis startup scan : C:\Users\Slaterdude\Desktop\hijack\Trend Micro\HiJackThis\HijackThis.exe /startupscan -> Found [Suspicious.Path] (X86) HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run | HijackThis startup scan : C:\Users\Slaterdude\Desktop\hijack\Trend Micro\HiJackThis\HijackThis.exe /startupscan -> Found [Suspicious.Path] (X64) HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Run | HijackThis startup scan : C:\Users\Slaterdude\Desktop\hijack\Trend Micro\HiJackThis\HijackThis.exe /startupscan -> Found [Suspicious.Path] (X86) HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Run | HijackThis startup scan : C:\Users\Slaterdude\Desktop\hijack\Trend Micro\HiJackThis\HijackThis.exe /startupscan -> Found [PUM.Proxy] (X64) HKEY_USERS\S-1-5-21-512074064-2644309959-2935449538-1002\Software\Microsoft\Windows\CurrentVersion\Internet Settings | ProxyEnable : 1 -> Found [PUM.Proxy] (X86) HKEY_USERS\S-1-5-21-512074064-2644309959-2935449538-1002\Software\Microsoft\Windows\CurrentVersion\Internet Settings | ProxyEnable : 1 -> Found [PUM.Proxy] (X64) HKEY_USERS\S-1-5-21-512074064-2644309959-2935449538-1002\Software\Microsoft\Windows\CurrentVersion\Internet Settings | ProxyServer : http=127.0.0.1:8887;https=127.0.0.1:8887 -> Found [PUM.Proxy] (X86) HKEY_USERS\S-1-5-21-512074064-2644309959-2935449538-1002\Software\Microsoft\Windows\CurrentVersion\Internet Settings | ProxyServer : http=127.0.0.1:8887;https=127.0.0.1:8887 -> Found [PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters | DhcpNameServer : 95.169.183.219 89.41.60.38 37.221.175.198 [(Unknown Country?) (XX)][ROMANIA (RO)][(Unknown Country?) (XX)] -> Found [PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Tcpip\Parameters | DhcpNameServer : 95.169.183.219 89.41.60.38 37.221.175.198 [(Unknown Country?) (XX)][ROMANIA (RO)][(Unknown Country?) (XX)] -> Found [PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{067CB5CE-DE24-4C2A-B1C0-6217EBA36474} | NameServer : 37.221.175.198,95.169.183.219 [(Unknown Country?) (XX)][(Unknown Country?) (XX)] -> Found [PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{D323FD64-4F92-43BA-8FF7-ED52C8245ABC} | NameServer : 37.221.175.198,95.169.183.219 [(Unknown Country?) (XX)][(Unknown Country?) (XX)] -> Found [PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{D323FD64-4F92-43BA-8FF7-ED52C8245ABC} | DhcpNameServer : 95.169.183.219 89.41.60.38 37.221.175.198 [(Unknown Country?) (XX)][ROMANIA (RO)][(Unknown Country?) (XX)] -> Found [PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Tcpip\Parameters\Interfaces\{067CB5CE-DE24-4C2A-B1C0-6217EBA36474} | NameServer : 37.221.175.198,95.169.183.219 [(Unknown Country?) (XX)][(Unknown Country?) (XX)] -> Found [PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Tcpip\Parameters\Interfaces\{D323FD64-4F92-43BA-8FF7-ED52C8245ABC} | NameServer : 37.221.175.198,95.169.183.219 [(Unknown Country?) (XX)][(Unknown Country?) (XX)] -> Found [PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Tcpip\Parameters\Interfaces\{D323FD64-4F92-43BA-8FF7-ED52C8245ABC} | DhcpNameServer : 95.169.183.219 89.41.60.38 37.221.175.198 [(Unknown Country?) (XX)][ROMANIA (RO)][(Unknown Country?) (XX)] -> Found ¤¤¤ Tasks : 0 ¤¤¤ ¤¤¤ Files : 0 ¤¤¤ ¤¤¤ Hosts File : 0 ¤¤¤ ¤¤¤ Antirootkit : 0 (Driver: Not loaded [0x20]) ¤¤¤ ¤¤¤ Web browsers : 0 ¤¤¤ ¤¤¤ MBR Check : ¤¤¤ +++++ PhysicalDrive0: HGST HTS545050A7E680 SATA Disk Device +++++ --- User --- [MBR] 5544e1e8bba011ab4ced67d2423d34e7 [BSP] 8988365775c7a2f32a876d2bf1508a3b : Empty MBR Code Partition table: 0 - [XXXXXX] UNKNOWN (0x0) [VISIBLE] Offset (sectors): 1 | Size: 2097151 MB User = LL1 ... OK User = LL2 ... OK ============================================ RKreport_DEL_11292014_234532.log - RKreport_DEL_11302014_000620.log - RKreport_SCN_11292014_230619.log - RKreport_SCN_11292014_235625.log RKreport_SCN_11302014_002240.log - RKreport_SCN_11302014_024541.log