ComboFix 13-08-02.01 - Chelsea 08/02/2013 14:50:49.1.2 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.3838.2503 [GMT -7:00]
Running from: c:\users\Chelsea\Downloads\ComboFix.exe
AV: Microsoft Security Essentials *Disabled/Updated* {641105E6-77ED-3F35-A304-765193BCB75F}
SP: Microsoft Security Essentials *Disabled/Updated* {DF70E402-51D7-30BB-99B4-4D23E83BFDE2}
SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((( Files Created from 2013-07-02 to 2013-08-02 )))))))))))))))))))))))))))))))
.
.
2013-08-02 18:04 . 2013-08-02 18:44--------d-----w-c:\programdata\Malwarebytes' Anti-Malware (portable)
2013-08-02 17:59 . 2013-07-02 08:349460976----a-w-c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{C1F86D93-4A47-40DA-BE1E-7581C34B0789}\mpengine.dll
2013-08-02 02:50 . 2013-08-02 02:50--------d-----w-c:\program files\HitmanPro
2013-08-02 02:47 . 2013-08-02 02:54--------d-----w-c:\programdata\HitmanPro
2013-08-01 17:37 . 2013-07-02 08:349460976----a-w-c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2013-07-25 01:27 . 2013-07-25 01:27--------d-----w-c:\users\Public\CyberLink
2013-07-25 01:26 . 2013-07-25 01:26--------d-----w-c:\programdata\CyberLink
2013-07-25 01:26 . 2013-07-25 01:26--------d-----w-c:\users\Chelsea\AppData\Roaming\CyberLink
2013-07-25 00:50 . 2013-07-25 00:50--------d-----w-c:\program files (x86)\Malwarebytes' Anti-Malware
2013-07-25 00:50 . 2013-04-04 21:5025928----a-w-c:\windows\system32\drivers\mbam.sys
2013-07-24 23:49 . 2013-07-24 23:49--------d-----w-c:\users\Chelsea\AppData\Local\PackageAware
2013-07-19 19:40 . 2013-07-24 22:55--------d-----w-c:\program files (x86)\SpeedFan
2013-07-17 03:41 . 2013-07-17 03:40941720------w-c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{100B5BCD-A4BD-4183-8D14-11FEF1E3D3F5}\gapaengine.dll
2013-07-12 21:42 . 2013-07-12 21:426129024----a-w-c:\program files (x86)\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}\components\SkypeFfComponent.dll
2013-07-12 21:42 . 2013-07-12 21:426129024----a-w-c:\program files (x86)\Mozilla Firefox\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}\components\SkypeFfComponent.dll
2013-07-12 14:57 . 2013-07-12 15:00--------d-----w-c:\windows\system32\MRT
2013-07-10 02:44 . 2013-07-10 02:449216----a-w-c:\program files (x86)\Windows Defender\MpAsDesc.dll
2013-07-10 02:44 . 2013-07-10 02:44571904----a-w-c:\program files\Windows Defender\MpClient.dll
2013-07-10 02:44 . 2013-07-10 02:4454784----a-w-c:\program files (x86)\Windows Defender\MpOAV.dll
2013-07-10 02:44 . 2013-07-10 02:444608----a-w-c:\program files (x86)\Windows Defender\MsMpLics.dll
2013-07-10 02:44 . 2013-07-10 02:44392704----a-w-c:\program files (x86)\Windows Defender\MpClient.dll
2013-07-10 02:44 . 2013-07-10 02:44314880----a-w-c:\program files\Windows Defender\MpCommu.dll
2013-07-10 02:44 . 2013-07-10 02:441011712----a-w-c:\program files\Windows Defender\MpSvc.dll
2013-07-10 02:43 . 2013-07-10 02:44--------d-----w-C:\565123a6910668540fe1f527fa589e
2013-07-10 02:43 . 2013-07-10 02:433153920----a-w-c:\windows\system32\win32k.sys
2013-07-10 02:41 . 2013-07-10 02:41624128----a-w-c:\windows\system32\qedit.dll
2013-07-10 02:41 . 2013-07-10 02:41509440----a-w-c:\windows\SysWow64\qedit.dll
2013-07-10 02:35 . 2013-07-10 02:351732608----a-w-c:\program files\Windows Journal\NBDoc.DLL
2013-07-10 02:35 . 2013-07-10 02:351393152----a-w-c:\program files\Windows Journal\JNTFiltr.dll
2013-07-10 02:35 . 2013-07-10 02:35936448----a-w-c:\program files (x86)\Common Files\Microsoft Shared\ink\journal.dll
2013-07-10 02:35 . 2013-07-10 02:351402880----a-w-c:\program files\Windows Journal\JNWDRV.dll
2013-07-10 02:35 . 2013-07-10 02:351367040----a-w-c:\program files\Common Files\Microsoft Shared\ink\journal.dll
2013-07-10 02:34 . 2013-07-10 02:341887744----a-w-c:\windows\system32\WMVDECOD.DLL
2013-07-10 02:34 . 2013-07-10 02:341620480----a-w-c:\windows\SysWow64\WMVDECOD.DLL
2013-07-10 02:34 . 2013-07-10 02:341643520----a-w-c:\windows\system32\DWrite.dll
2013-07-10 02:34 . 2013-07-10 02:341247744----a-w-c:\windows\SysWow64\DWrite.dll
2013-07-09 23:13 . 2013-07-10 07:20--------d-----w-C:\Joymax
2013-07-06 23:49 . 2008-05-30 21:11540688----a-w-c:\windows\system32\d3dx10_38.dll
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-06-24 07:57 . 2012-12-28 18:1778277128----a-w-c:\windows\system32\MRT.exe
2013-06-23 02:39 . 2013-06-23 02:3928672----a-w-c:\windows\SysWow64\burutter.dll
2013-06-20 23:58 . 2013-03-12 15:52964552------w-c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\NISBackup\gapaengine.dll
2013-06-19 04:50 . 2013-06-19 04:50247216----a-w-c:\windows\system32\drivers\MpFilter.sys
2013-06-19 04:50 . 2012-08-31 06:03139616----a-w-c:\windows\system32\drivers\NisDrvWFP.sys
2013-06-12 08:04 . 2012-12-29 00:1371048----a-w-c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2013-06-12 08:04 . 2012-12-29 00:13692104----a-w-c:\windows\SysWow64\FlashPlayerApp.exe
2013-05-14 23:59 . 2010-06-24 19:3322240----a-w-c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll
2013-05-13 05:51 . 2013-06-12 19:21184320----a-w-c:\windows\system32\cryptsvc.dll
2013-05-13 05:51 . 2013-06-12 19:211464320----a-w-c:\windows\system32\crypt32.dll
2013-05-13 05:51 . 2013-06-12 19:21139776----a-w-c:\windows\system32\cryptnet.dll
2013-05-13 05:50 . 2013-06-12 19:2152224----a-w-c:\windows\system32\certenc.dll
2013-05-13 04:45 . 2013-06-12 19:211160192----a-w-c:\windows\SysWow64\crypt32.dll
2013-05-13 04:45 . 2013-06-12 19:21103936----a-w-c:\windows\SysWow64\cryptnet.dll
2013-05-13 04:45 . 2013-06-12 19:21140288----a-w-c:\windows\SysWow64\cryptsvc.dll
2013-05-13 03:43 . 2013-06-12 19:211192448----a-w-c:\windows\system32\certutil.exe
2013-05-13 03:08 . 2013-06-12 19:21903168----a-w-c:\windows\SysWow64\certutil.exe
2013-05-13 03:08 . 2013-06-12 19:2143008----a-w-c:\windows\SysWow64\certenc.dll
2013-05-10 05:49 . 2013-06-12 19:2130720----a-w-c:\windows\system32\cryptdlg.dll
2013-05-10 03:20 . 2013-06-12 19:2124576----a-w-c:\windows\SysWow64\cryptdlg.dll
2013-05-08 06:39 . 2013-06-12 19:211910632----a-w-c:\windows\system32\drivers\tcpip.sys
2013-05-07 13:46 . 2013-05-07 13:46226304----a-w-c:\windows\system32\elshyph.dll
2013-05-07 13:46 . 2013-05-07 13:46185344----a-w-c:\windows\SysWow64\elshyph.dll
2013-05-07 13:46 . 2013-05-07 13:461054720----a-w-c:\windows\system32\MsSpellCheckingFacility.exe
2013-05-07 13:46 . 2013-05-07 13:46158720----a-w-c:\windows\SysWow64\msls31.dll
2013-05-07 13:46 . 2013-05-07 13:46719360----a-w-c:\windows\SysWow64\mshtmlmedia.dll
2013-05-07 13:46 . 2013-05-07 13:46523264----a-w-c:\windows\SysWow64\vbscript.dll
2013-05-07 13:46 . 2013-05-07 13:46150528----a-w-c:\windows\SysWow64\iexpress.exe
2013-05-07 13:46 . 2013-05-07 13:46138752----a-w-c:\windows\SysWow64\wextract.exe
2013-05-07 13:46 . 2013-05-07 13:46137216----a-w-c:\windows\SysWow64\ieUnatt.exe
2013-05-07 13:46 . 2013-05-07 13:4612800----a-w-c:\windows\SysWow64\mshta.exe
2013-05-07 13:46 . 2013-05-07 13:4638400----a-w-c:\windows\SysWow64\imgutil.dll
2013-05-07 13:46 . 2013-05-07 13:4673728----a-w-c:\windows\SysWow64\SetIEInstalledDate.exe
2013-05-07 13:46 . 2013-05-07 13:4648640----a-w-c:\windows\SysWow64\mshtmler.dll
2013-05-07 13:46 . 2013-05-07 13:46110592----a-w-c:\windows\SysWow64\IEAdvpack.dll
2013-05-07 13:46 . 2013-05-07 13:4661952----a-w-c:\windows\SysWow64\tdc.ocx
2013-05-07 13:46 . 2013-05-07 13:46361984----a-w-c:\windows\SysWow64\html.iec
2013-05-07 13:46 . 2013-05-07 13:4623040----a-w-c:\windows\SysWow64\licmgr10.dll
2013-05-07 13:46 . 2013-05-07 13:461441280----a-w-c:\windows\SysWow64\inetcpl.cpl
2013-05-07 13:46 . 2013-05-07 13:46216064----a-w-c:\windows\system32\msls31.dll
2013-05-07 13:46 . 2013-05-07 13:46197120----a-w-c:\windows\system32\msrating.dll
2013-05-07 13:46 . 2013-05-07 13:46905728----a-w-c:\windows\system32\mshtmlmedia.dll
2013-05-07 13:46 . 2013-05-07 13:4681408----a-w-c:\windows\system32\icardie.dll
2013-05-07 13:46 . 2013-05-07 13:46762368----a-w-c:\windows\system32\ieapfltr.dll
2013-05-07 13:46 . 2013-05-07 13:46452096----a-w-c:\windows\system32\dxtmsft.dll
2013-05-07 13:46 . 2013-05-07 13:46441856----a-w-c:\windows\system32\html.iec
2013-05-07 13:46 . 2013-05-07 13:46281600----a-w-c:\windows\system32\dxtrans.dll
2013-05-07 13:46 . 2013-05-07 13:4627648----a-w-c:\windows\system32\licmgr10.dll
2013-05-07 13:46 . 2013-05-07 13:46270848----a-w-c:\windows\system32\iedkcs32.dll
2013-05-07 13:46 . 2013-05-07 13:46247296----a-w-c:\windows\system32\webcheck.dll
2013-05-07 13:46 . 2013-05-07 13:46235008----a-w-c:\windows\system32\url.dll
2013-05-07 13:46 . 2013-05-07 13:461509376----a-w-c:\windows\system32\inetcpl.cpl
2013-05-07 13:46 . 2013-05-07 13:461400416----a-w-c:\windows\system32\ieapfltr.dat
2013-05-07 13:46 . 2013-05-07 13:46102912----a-w-c:\windows\system32\inseng.dll
2013-05-07 13:46 . 2013-05-07 13:4697280----a-w-c:\windows\system32\mshtmled.dll
2013-05-07 13:46 . 2013-05-07 13:46599552----a-w-c:\windows\system32\vbscript.dll
2013-05-07 13:46 . 2013-05-07 13:46173568----a-w-c:\windows\system32\ieUnatt.exe
2013-05-07 13:46 . 2013-05-07 13:46167424----a-w-c:\windows\system32\iexpress.exe
2013-05-07 13:46 . 2013-05-07 13:46144896----a-w-c:\windows\system32\wextract.exe
2013-05-07 13:46 . 2013-05-07 13:4692160----a-w-c:\windows\system32\SetIEInstalledDate.exe
2013-05-07 13:46 . 2013-05-07 13:4662976----a-w-c:\windows\system32\pngfilt.dll
2013-05-07 13:46 . 2013-05-07 13:4652224----a-w-c:\windows\system32\msfeedsbs.dll
2013-05-07 13:46 . 2013-05-07 13:4651200----a-w-c:\windows\system32\imgutil.dll
2013-05-07 13:46 . 2013-05-07 13:46149504----a-w-c:\windows\system32\occache.dll
2013-05-07 13:46 . 2013-05-07 13:4613824----a-w-c:\windows\system32\mshta.exe
2013-05-07 13:46 . 2013-05-07 13:46136192----a-w-c:\windows\system32\iepeers.dll
2013-05-07 13:46 . 2013-05-07 13:46135680----a-w-c:\windows\system32\IEAdvpack.dll
2013-05-07 13:46 . 2013-05-07 13:4612800----a-w-c:\windows\system32\msfeedssync.exe
2013-05-07 13:46 . 2013-05-07 13:4677312----a-w-c:\windows\system32\tdc.ocx
2013-05-07 13:46 . 2013-05-07 13:4648640----a-w-c:\windows\system32\mshtmler.dll
2013-05-07 13:42 . 2013-05-07 13:424096---ha-w-c:\windows\SysWow64\api-ms-win-downlevel-user32-l1-1-0.dll
2013-05-07 13:42 . 2013-05-07 13:424096---ha-w-c:\windows\system32\api-ms-win-downlevel-user32-l1-1-0.dll
2013-05-07 13:42 . 2013-05-07 13:423072---ha-w-c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
2013-05-07 13:42 . 2013-05-07 13:429728---ha-w-c:\windows\system32\api-ms-win-downlevel-shlwapi-l1-1-0.dll
2013-05-07 13:42 . 2013-05-07 13:429728---ha-w-c:\windows\SysWow64\api-ms-win-downlevel-shlwapi-l1-1-0.dll
2013-05-07 13:42 . 2013-05-07 13:425632---ha-w-c:\windows\SysWow64\api-ms-win-downlevel-shlwapi-l2-1-0.dll
2013-05-07 13:42 . 2013-05-07 13:425632---ha-w-c:\windows\SysWow64\api-ms-win-downlevel-ole32-l1-1-0.dll
2013-05-07 13:42 . 2013-05-07 13:425632---ha-w-c:\windows\system32\api-ms-win-downlevel-shlwapi-l2-1-0.dll
2013-05-07 13:42 . 2013-05-07 13:425632---ha-w-c:\windows\system32\api-ms-win-downlevel-ole32-l1-1-0.dll
2013-05-07 13:42 . 2013-05-07 13:42364544----a-w-c:\windows\SysWow64\XpsGdiConverter.dll
2013-05-07 13:42 . 2013-05-07 13:423584---ha-w-c:\windows\SysWow64\api-ms-win-downlevel-advapi32-l2-1-0.dll
2013-05-07 13:42 . 2013-05-07 13:423584---ha-w-c:\windows\system32\api-ms-win-downlevel-advapi32-l2-1-0.dll
2013-05-07 13:42 . 2013-05-07 13:423072---ha-w-c:\windows\SysWow64\api-ms-win-downlevel-version-l1-1-0.dll
2013-05-07 13:42 . 2013-05-07 13:423072---ha-w-c:\windows\SysWow64\api-ms-win-downlevel-shell32-l1-1-0.dll
2013-05-07 13:42 . 2013-05-07 13:423072---ha-w-c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
2013-05-07 13:42 . 2013-05-07 13:422560---ha-w-c:\windows\SysWow64\api-ms-win-downlevel-normaliz-l1-1-0.dll
2013-05-07 13:42 . 2013-05-07 13:422560---ha-w-c:\windows\system32\api-ms-win-downlevel-normaliz-l1-1-0.dll
2013-05-07 13:42 . 2013-05-07 13:421158144----a-w-c:\windows\SysWow64\XpsPrint.dll
2013-05-07 13:42 . 2013-05-07 13:4210752---ha-w-c:\windows\SysWow64\api-ms-win-downlevel-advapi32-l1-1-0.dll
2013-05-07 13:42 . 2013-05-07 13:4210752---ha-w-c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
2013-05-07 13:42 . 2013-05-07 13:421682432----a-w-c:\windows\system32\XpsPrint.dll
2013-05-07 13:42 . 2013-05-07 13:42522752----a-w-c:\windows\system32\XpsGdiConverter.dll
2013-05-07 13:42 . 2013-05-07 13:42465920----a-w-c:\windows\system32\WMPhoto.dll
2013-05-07 13:42 . 2013-05-07 13:422284544----a-w-c:\windows\SysWow64\msmpeg2vdec.dll
2013-05-07 13:42 . 2013-05-07 13:422776576----a-w-c:\windows\system32\msmpeg2vdec.dll
2013-05-07 13:42 . 2013-05-07 13:42417792----a-w-c:\windows\SysWow64\WMPhoto.dll
2013-05-07 13:42 . 2013-05-07 13:423928064----a-w-c:\windows\system32\d2d1.dll
2013-05-07 13:42 . 2013-05-07 13:42363008----a-w-c:\windows\system32\dxgi.dll
2013-05-07 13:42 . 2013-05-07 13:422565120----a-w-c:\windows\system32\d3d10warp.dll
2013-05-07 13:42 . 2013-05-07 13:42249856----a-w-c:\windows\SysWow64\d3d10_1core.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"Desktop Disc Tool"="c:\program files (x86)\Roxio\Roxio Burn\RoxioBurnLauncher.exe" [2009-08-03 498160]
"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2009-07-30 98304]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-04-04 958576]
"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-11-28 59280]
"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2012-12-12 152544]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\!SASCORE]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\hitmanpro37]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\hitmanpro37.sys]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
R1 A2DDA;A2 Direct Disk Access Support Driver;e:\program files (x86)\EMSISOFT ANTI-MALWARE\a2ddax64.sys;e:\program files (x86)\EMSISOFT ANTI-MALWARE\a2ddax64.sys [x]
R2 a2AntiMalware;Emsisoft Anti-Malware 8.0 - Service;e:\program files (x86)\EMSISOFT ANTI-MALWARE\a2service.exe;e:\program files (x86)\EMSISOFT ANTI-MALWARE\a2service.exe [x]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 gupdate;Google Update Service (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe;c:\program files (x86)\Google\Update\GoogleUpdate.exe [x]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]
R3 a2acc;a2acc;e:\program files (x86)\EMSISOFT ANTI-MALWARE\a2accx64.sys;e:\program files (x86)\EMSISOFT ANTI-MALWARE\a2accx64.sys [x]
R3 BBUpdate;BBUpdate;c:\program files (x86)\Microsoft\BingBar\7.2.233.0\SeaPort.exe;c:\program files (x86)\Microsoft\BingBar\7.2.233.0\SeaPort.exe [x]
R3 EagleX64;EagleX64;c:\windows\system32\drivers\EagleX64.sys;c:\windows\SYSNATIVE\drivers\EagleX64.sys [x]
R3 gupdatem;Google Update Service (gupdatem);c:\program files (x86)\Google\Update\GoogleUpdate.exe;c:\program files (x86)\Google\Update\GoogleUpdate.exe [x]
R3 hidkmdf;KMDF Driver;c:\windows\system32\DRIVERS\hidkmdf.sys;c:\windows\SYSNATIVE\DRIVERS\hidkmdf.sys [x]
R3 netr28x;Ralink 802.11n Wireless Driver for Windows Vista;c:\windows\system32\DRIVERS\netr28x.sys;c:\windows\SYSNATIVE\DRIVERS\netr28x.sys [x]
R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys;c:\windows\SYSNATIVE\DRIVERS\NisDrvWFP.sys [x]
R3 NisSrv;Microsoft Network Inspection;c:\program files\Microsoft Security Client\NisSrv.exe;c:\program files\Microsoft Security Client\NisSrv.exe [x]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys;c:\windows\SYSNATIVE\drivers\rdpvideominiport.sys [x]
R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUStor.sys;c:\windows\SYSNATIVE\Drivers\RtsUStor.sys [x]
R3 SrvHsfHDA;SrvHsfHDA;c:\windows\system32\DRIVERS\VSTAZL6.SYS;c:\windows\SYSNATIVE\DRIVERS\VSTAZL6.SYS [x]
R3 SrvHsfV92;SrvHsfV92;c:\windows\system32\DRIVERS\VSTDPV6.SYS;c:\windows\SYSNATIVE\DRIVERS\VSTDPV6.SYS [x]
R3 SrvHsfWinac;SrvHsfWinac;c:\windows\system32\DRIVERS\VSTCNXT6.SYS;c:\windows\SYSNATIVE\DRIVERS\VSTCNXT6.SYS [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys;c:\windows\SYSNATIVE\Drivers\usbaapl64.sys [x]
R3 WacHidRouter;Wacom Hid Router;c:\windows\system32\DRIVERS\wachidrouter.sys;c:\windows\SYSNATIVE\DRIVERS\wachidrouter.sys [x]
R3 wacomrouterfilter;Wacom Router Filter Driver;c:\windows\system32\DRIVERS\wacomrouterfilter.sys;c:\windows\SYSNATIVE\DRIVERS\wacomrouterfilter.sys [x]
R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe;c:\windows\SYSNATIVE\Wat\WatAdminSvc.exe [x]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe;c:\program files\Windows Live\Mesh\wlcrasvc.exe [x]
S0 PxHlpa64;PxHlpa64;c:\windows\System32\Drivers\PxHlpa64.sys;c:\windows\SYSNATIVE\Drivers\PxHlpa64.sys [x]
S1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV64.SYS;c:\program files\SUPERAntiSpyware\SASDIFSV64.SYS [x]
S1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL64.SYS;c:\program files\SUPERAntiSpyware\SASKUTIL64.SYS [x]
S2 !SASCORE;SAS Core Service;c:\program files\SUPERAntiSpyware\SASCORE64.EXE;c:\program files\SUPERAntiSpyware\SASCORE64.EXE [x]
S2 AdobeActiveFileMonitor9.0;Adobe Active File Monitor V9;c:\program files (x86)\Adobe\Elements 9 Organizer\PhotoshopElementsFileAgent.exe;c:\program files (x86)\Adobe\Elements 9 Organizer\PhotoshopElementsFileAgent.exe [x]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe;c:\windows\SYSNATIVE\atiesrxx.exe [x]
S2 BBSvc;BingBar Service;c:\program files (x86)\Microsoft\BingBar\7.2.233.0\BBSvc.exe;c:\program files (x86)\Microsoft\BingBar\7.2.233.0\BBSvc.exe [x]
S2 ePowerSvc;Acer ePower Service;c:\program files\Gateway\Gateway Power Management\ePowerSvc.exe;c:\program files\Gateway\Gateway Power Management\ePowerSvc.exe [x]
S2 Greg_Service;GRegService;c:\program files (x86)\Gateway\Registration\GregHSRW.exe;c:\program files (x86)\Gateway\Registration\GregHSRW.exe [x]
S2 HitmanProScheduler;HitmanPro Scheduler;c:\program files\HitmanPro\hmpsched.exe;c:\program files\HitmanPro\hmpsched.exe [x]
S2 HsfXAudioService;HsfXAudioService;c:\windows\system32\svchost.exe;c:\windows\SYSNATIVE\svchost.exe [x]
S2 MBAMScheduler;MBAMScheduler;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [x]
S2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [x]
S2 NTI IScheduleSvc;NTI IScheduleSvc;c:\program files (x86)\NewTech Infosystems\Gateway MyBackup\IScheduleSvc.exe;c:\program files (x86)\NewTech Infosystems\Gateway MyBackup\IScheduleSvc.exe [x]
S2 Skype C2C Service;Skype C2C Service;c:\programdata\Skype\Toolbars\Skype C2C Service\c2c_service.exe;c:\programdata\Skype\Toolbars\Skype C2C Service\c2c_service.exe [x]
S2 Updater Service;Updater Service;c:\program files\Gateway\Gateway Updater\UpdaterService.exe;c:\program files\Gateway\Gateway Updater\UpdaterService.exe [x]
S2 WTabletServiceCon;Wacom Consumer Service;c:\program files\Tablet\Pen\WTabletServiceCon.exe;c:\program files\Tablet\Pen\WTabletServiceCon.exe [x]
S3 CAXHWAZL;CAXHWAZL;c:\windows\system32\DRIVERS\CAXHWAZL.sys;c:\windows\SYSNATIVE\DRIVERS\CAXHWAZL.sys [x]
S3 k57nd60a;Broadcom NetLink (TM) Gigabit Ethernet - NDIS 6.0;c:\windows\system32\DRIVERS\k57nd60a.sys;c:\windows\SYSNATIVE\DRIVERS\k57nd60a.sys [x]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys;c:\windows\SYSNATIVE\drivers\mbam.sys [x]
S3 usbfilter;AMD USB Filter Driver;c:\windows\system32\DRIVERS\usbfilter.sys;c:\windows\SYSNATIVE\DRIVERS\usbfilter.sys [x]
.
.
--- Other Services/Drivers In Memory ---
.
*NewlyCreated* - WS2IFSL
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2013-07-31 23:221173456----a-w-c:\program files (x86)\Google\Chrome\Application\28.0.1500.95\Installer\chrmstp.exe
.
Contents of the 'Scheduled Tasks' folder
.
2013-08-02 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-12-29 08:04]
.
2013-08-02 c:\windows\Tasks\GlaryInitialize.job
- c:\program files (x86)\Glary Utilities\initialize.exe [2012-12-29 09:22]
.
2013-08-02 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-12-29 00:08]
.
2013-08-02 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-12-29 00:08]
.
2013-08-02 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1618498660-191533590-2752532465-1000Core.job
- c:\users\Chelsea\AppData\Local\Google\Update\GoogleUpdate.exe [2013-04-05 17:55]
.
2013-08-02 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1618498660-191533590-2752532465-1000UA.job
- c:\users\Chelsea\AppData\Local\Google\Update\GoogleUpdate.exe [2013-04-05 17:55]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"cAudioFilterAgent"="c:\program files\Conexant\cAudioFilterAgent\cAudioFilterAgent64.exe" [2009-10-09 508472]
"Apoint"="c:\program files\Apoint2K\Apoint.exe" [2009-05-22 295936]
"PLFSetI"="c:\windows\PLFSetI.exe" [2009-12-16 206208]
"Acer ePower Management"="c:\program files\Gateway\Gateway Power Management\ePowerTray.exe" [2009-09-30 823840]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2013-06-21 1356240]
"AdobeAAMUpdater-1.0"="c:\program files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2010-07-29 497648]
.
------- Supplementary Scan -------
.
uLocal Page = c:\windows\system32\blank.htm
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = *.local;<local>
IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~2\Office12\EXCEL.EXE/3000
Trusted Zone: aeriagames.com
TCP: DhcpNameServer = 192.168.1.1
FF - ProfilePath - c:\users\Chelsea\AppData\Roaming\Mozilla\Firefox\Profiles\opm1c7nq.default\
FF - prefs.js: browser.startup.homepage -
www.yahoo.com
FF - user.js: network.http.pipelining.maxrequests - 8
FF - user.js: network.http.request.max-start-delay - 0
FF - user.js: network.http.max-connections - 48
FF - user.js: network.http.max-connections-per-server - 16
FF - user.js: network.http.max-persistent-connections-per-proxy - 16
FF - user.js: network.http.max-persistent-connections-per-server - 8
FF - user.js: browser.turbo.enabled - true
FF - user.js: browser.display.show_image_placeholders - true
FF - user.js: browser.chrome.favicons - false
FF - user.js: browser.urlbar.autocomplete.enabled - true
FF - user.js: browser.cache.memory.capacity - 65536
FF - user.js: content.notify.ontimer - true
FF - user.js: content.interrupt.parsing - true
FF - user.js: content.max.tokenizing.time - 2250000
FF - user.js: content.switch.threshold - 750000
FF - user.js: plugin.expose_full_path - true
FF - user.js: ui.submenuDelay - 0
.
- - - - ORPHANS REMOVED - - - -
.
Toolbar-Locked - (no file)
HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start
Toolbar-Locked - (no file)
AddRemove-_{53A908D4-99C6-469B-BC13-F4189F260742} - c:\program files (x86)\Corel\Corel Painter Essentials 4\MSILauncher {53A908D4-99C6-469B-BC13-F4189F260742}
.
.
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_7_700_224_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_7_700_224_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_7_700_224_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_7_700_224_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_224.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_224.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_224.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_224.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0004\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Other Running Processes ------------------------
.
c:\program files (x86)\Common Files\Microsoft Shared\Ink\TabTip32.exe
c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
c:\program files\Tablet\Pen\WacomHost.exe
.
**************************************************************************
.
Completion time: 2013-08-02 15:02:57 - machine was rebooted
ComboFix-quarantined-files.txt 2013-08-02 22:02
.
Pre-Run: 425,072,775,168 bytes free
Post-Run: 424,572,182,528 bytes free
.
- - End Of File - - 9F1830465B86A00A428ECBDACC98C132
5C616939100B85E558DA92B899A0FC36
did not have to run rKill