Disabled Windows Defender this time and reran combofix.
ComboFix 14-11-25.01 - ghurka 11/27/2014 20:11:59.4.8 - x64
Microsoft Windows 7 Ultimate 6.1.7601.1.1252.1.1033.18.8169.5036 [GMT -8:00]
Running from: c:\users\ghurka\Desktop\ComboFix.exe
AV: avast! Antivirus *Disabled/Updated* {17AD7D40-BA12-9C46-7131-94903A54AD8B}
SP: avast! Antivirus *Disabled/Updated* {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((( Files Created from 2014-10-28 to 2014-11-28 )))))))))))))))))))))))))))))))
.
.
2014-11-28 04:16 . 2014-11-28 04:16 -------- d-----w- c:\users\HomeGroupUser$\AppData\Local\temp
2014-11-28 04:16 . 2014-11-28 04:16 -------- d-----w- c:\users\Guest\AppData\Local\temp
2014-11-28 04:16 . 2014-11-28 04:16 -------- d-----w- c:\users\Default\AppData\Local\temp
2014-11-28 04:16 . 2014-11-28 04:16 -------- d-----w- c:\users\Administrator\AppData\Local\temp
2014-11-27 19:42 . 2014-11-27 19:45 -------- d-----w- C:\FRST
2014-11-27 14:28 . 2014-11-27 14:28 -------- d-----w- c:\windows\ERUNT
2014-11-27 07:16 . 2014-11-28 03:38 -------- d-----w- c:\programdata\Malwarebytes' Anti-Malware (portable)
2014-11-27 07:09 . 2014-11-28 03:22 34808 ----a-w- c:\windows\system32\drivers\TrueSight.sys
2014-11-27 07:09 . 2014-11-27 07:09 -------- d-----w- c:\programdata\RogueKiller
2014-11-26 20:12 . 2014-11-26 20:12 -------- d-----w- c:\programdata\ATI
2014-11-26 20:12 . 2014-11-26 20:12 -------- d-----w- c:\program files (x86)\AMD AVT
2014-11-26 20:11 . 2014-11-26 20:11 -------- d-----w- c:\program files (x86)\ATI Technologies
2014-11-26 20:04 . 2014-11-26 20:04 -------- d-----w- C:\AMD
2014-11-26 02:02 . 2014-11-26 02:02 -------- d-----w- c:\users\ghurka\AppData\Roaming\Foxit Software
2014-11-26 02:02 . 2014-11-26 02:02 -------- d-----w- c:\program files (x86)\Foxit Software
2014-11-26 01:58 . 2014-11-26 01:59 -------- d-----w- c:\users\ghurka\AppData\Roaming\Dropbox
2014-11-26 01:48 . 2014-11-26 01:48 -------- d-----w- c:\users\ghurka\AppData\Roaming\AVAST Software
2014-11-26 01:44 . 2014-11-26 01:44 116728 ----a-w- c:\windows\system32\drivers\aswStm.sys
2014-11-26 01:44 . 2014-11-26 01:44 267632 ----a-w- c:\windows\system32\drivers\aswVmm.sys
2014-11-26 01:44 . 2014-11-26 01:44 436624 ----a-w- c:\windows\system32\drivers\aswSP.sys
2014-11-26 01:44 . 2014-11-26 01:44 83280 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys
2014-11-26 01:44 . 2014-11-26 01:44 65776 ----a-w- c:\windows\system32\drivers\aswRvrt.sys
2014-11-26 01:44 . 2014-11-26 01:44 29208 ----a-w- c:\windows\system32\drivers\aswHwid.sys
2014-11-26 01:44 . 2014-11-26 01:44 93568 ----a-w- c:\windows\system32\drivers\aswRdr2.sys
2014-11-26 01:44 . 2014-11-26 01:44 1050432 ----a-w- c:\windows\system32\drivers\aswsnx.sys
2014-11-26 01:44 . 2014-11-26 01:44 364512 ----a-w- c:\windows\system32\aswBoot.exe
2014-11-26 01:44 . 2014-11-26 01:44 43152 ----a-w- c:\windows\avastSS.scr
2014-11-26 01:41 . 2014-11-26 01:41 -------- d-----w- c:\program files\AVAST Software
2014-11-26 01:38 . 2014-11-26 01:41 -------- d-----w- c:\programdata\AVAST Software
2014-11-26 01:10 . 2014-11-26 01:15 -------- d-----w- c:\program files\EBC57807-80BF-4BD7-886C-9075B34F0F4A
2014-11-26 01:10 . 2014-10-22 02:55 60728 ----a-w- c:\windows\system32\drivers\gfilterdrv.sys
2014-11-25 12:16 . 2014-11-02 04:20 11632448 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{71495BDA-319A-4DAA-92E5-AEB22E29F166}\mpengine.dll
2014-11-25 07:48 . 2014-11-25 07:51 -------- d-----w- c:\program files (x86)\656C4FBB-6D62-4880-9183-2D9C3161E1B6
2014-11-25 07:48 . 2014-11-14 23:44 370592 ----a-w- c:\windows\system32\ProtectMe64.dll
2014-11-25 07:47 . 2014-11-14 23:44 324728 ----a-w- c:\windows\SysWow64\ProtectMe.dll
2014-11-25 07:46 . 2014-11-26 01:29 -------- d-----w- c:\program files\010
2014-11-25 05:23 . 2014-11-25 05:23 -------- d-----w- c:\users\ghurka\AppData\Roaming\Far Cry 4
2014-11-19 20:17 . 2014-11-19 20:17 -------- d-----w- c:\users\ghurka\AppData\Roaming\Microsoft Games
2014-11-19 19:53 . 2014-11-19 19:53 -------- d-----w- c:\users\ghurka\AppData\Roaming\Steam
2014-11-19 19:41 . 2007-04-05 02:53 81768 ----a-w- c:\windows\SysWow64\xinput1_3.dll
2014-11-19 04:08 . 2014-11-11 03:08 241152 ----a-w- c:\windows\system32\pku2u.dll
2014-11-19 04:08 . 2014-11-11 03:08 728064 ----a-w- c:\windows\system32\kerberos.dll
2014-11-19 04:08 . 2014-11-11 02:44 186880 ----a-w- c:\windows\SysWow64\pku2u.dll
2014-11-19 04:08 . 2014-11-11 02:44 550912 ----a-w- c:\windows\SysWow64\kerberos.dll
2014-11-17 23:08 . 2014-11-17 23:08 51200 ----a-w- c:\windows\system32\kdbsdk64.dll
2014-11-17 23:03 . 2014-11-17 23:03 38912 ----a-w- c:\windows\SysWow64\kdbsdk32.dll
2014-11-17 20:16 . 2014-11-17 20:16 78432 ----a-w- c:\windows\system32\atimpc64.dll
2014-11-17 20:16 . 2014-11-17 20:16 78432 ----a-w- c:\windows\system32\amdpcom64.dll
2014-11-17 20:16 . 2014-11-17 20:16 71704 ----a-w- c:\windows\SysWow64\atimpc32.dll
2014-11-17 20:16 . 2014-11-17 20:16 71704 ----a-w- c:\windows\SysWow64\amdpcom32.dll
2014-11-17 20:15 . 2014-11-17 20:15 126848 ----a-w- c:\windows\SysWow64\atiuxpag.dll
2014-11-17 20:15 . 2014-11-17 20:15 100032 ----a-w- c:\windows\SysWow64\atiu9pag.dll
2014-11-17 20:15 . 2014-11-17 20:15 1118720 ----a-w- c:\windows\SysWow64\aticfx32.dll
2014-11-17 20:15 . 2014-11-17 20:15 9314984 ----a-w- c:\windows\SysWow64\atidxx32.dll
2014-11-17 20:15 . 2014-11-17 20:15 7208104 ----a-w- c:\windows\SysWow64\atiumdva.dll
2014-11-17 20:15 . 2014-11-17 20:15 7028336 ----a-w- c:\windows\SysWow64\atiumdag.dll
2014-11-17 20:13 . 2014-11-17 20:13 297672 ----a-w- c:\windows\system32\drivers\amdacpksd.sys
2014-11-17 20:11 . 2014-11-17 20:11 16756736 ----a-w- c:\windows\system32\drivers\atikmdag.sys
2014-11-17 19:57 . 2014-11-17 19:57 235008 ----a-w- c:\windows\system32\clinfo.exe
2014-11-17 19:57 . 2014-11-17 19:57 98816 ----a-w- c:\windows\system32\OpenVideo64.dll
2014-11-17 19:57 . 2014-11-17 19:57 83456 ----a-w- c:\windows\SysWow64\OpenVideo.dll
2014-11-17 19:56 . 2014-11-17 19:56 86528 ----a-w- c:\windows\system32\OVDecode64.dll
2014-11-17 19:56 . 2014-11-17 19:56 73216 ----a-w- c:\windows\SysWow64\OVDecode.dll
2014-11-17 19:56 . 2014-11-17 19:56 33869824 ----a-w- c:\windows\system32\amdocl64.dll
2014-11-17 19:53 . 2014-11-17 19:53 28772352 ----a-w- c:\windows\SysWow64\amdocl.dll
2014-11-17 19:50 . 2014-11-17 19:50 65024 ----a-w- c:\windows\system32\OpenCL.dll
2014-11-17 19:50 . 2014-11-17 19:50 58880 ----a-w- c:\windows\SysWow64\OpenCL.dll
2014-11-17 19:12 . 2014-11-17 19:12 127488 ----a-w- c:\windows\system32\mantle64.dll
2014-11-17 19:11 . 2014-11-17 19:11 113664 ----a-w- c:\windows\SysWow64\mantle32.dll
2014-11-17 19:11 . 2014-11-17 19:11 5836800 ----a-w- c:\windows\system32\amdmantle64.dll
2014-11-17 19:10 . 2014-11-17 19:10 28356608 ----a-w- c:\windows\system32\atio6axx.dll
2014-11-17 18:54 . 2014-11-17 18:54 4590080 ----a-w- c:\windows\SysWow64\amdmantle32.dll
2014-11-17 18:49 . 2014-11-17 18:49 23627264 ----a-w- c:\windows\SysWow64\atioglxx.dll
2014-11-17 18:40 . 2014-11-17 18:40 91648 ----a-w- c:\windows\system32\mantleaxl64.dll
2014-11-17 18:40 . 2014-11-17 18:40 85504 ----a-w- c:\windows\SysWow64\mantleaxl32.dll
2014-11-17 18:40 . 2014-11-17 18:40 367104 ----a-w- c:\windows\system32\atiapfxx.exe
2014-11-17 18:39 . 2014-11-17 18:39 62464 ----a-w- c:\windows\system32\aticalrt64.dll
2014-11-17 18:39 . 2014-11-17 18:39 52224 ----a-w- c:\windows\SysWow64\aticalrt.dll
2014-11-17 18:39 . 2014-11-17 18:39 55808 ----a-w- c:\windows\system32\aticalcl64.dll
2014-11-17 18:39 . 2014-11-17 18:39 49152 ----a-w- c:\windows\SysWow64\aticalcl.dll
2014-11-17 18:39 . 2014-11-17 18:39 15716352 ----a-w- c:\windows\system32\aticaldd64.dll
2014-11-17 18:36 . 2014-11-17 18:36 14302208 ----a-w- c:\windows\SysWow64\aticaldd.dll
2014-11-17 18:21 . 2014-11-17 18:21 31232 ----a-w- c:\windows\system32\atimuixx.dll
2014-11-17 18:21 . 2014-11-17 18:21 623616 ----a-w- c:\windows\system32\atieclxx.exe
2014-11-17 18:21 . 2014-11-17 18:21 239616 ----a-w- c:\windows\system32\atiesrxx.exe
2014-11-17 18:20 . 2014-11-17 18:20 190976 ----a-w- c:\windows\system32\atitmm64.dll
2014-11-17 18:17 . 2014-11-17 18:17 48128 ----a-w- c:\windows\system32\amdmmcl6.dll
2014-11-17 18:17 . 2014-11-17 18:17 37888 ----a-w- c:\windows\SysWow64\amdmmcl.dll
2014-11-17 17:55 . 2014-11-17 17:55 901120 ----a-w- c:\windows\SysWow64\atiadlxy.dll
2014-11-17 17:54 . 2014-11-17 17:54 75264 ----a-w- c:\windows\system32\atig6pxx.dll
2014-11-17 17:54 . 2014-11-17 17:54 69632 ----a-w- c:\windows\SysWow64\atiglpxx.dll
2014-11-17 17:54 . 2014-11-17 17:54 69632 ----a-w- c:\windows\system32\atiglpxx.dll
2014-11-17 17:54 . 2014-11-17 17:54 146944 ----a-w- c:\windows\system32\atig6txx.dll
2014-11-17 17:54 . 2014-11-17 17:54 133632 ----a-w- c:\windows\SysWow64\atigktxx.dll
2014-11-17 17:54 . 2014-11-17 17:54 581120 ----a-w- c:\windows\system32\drivers\atikmpag.sys
2014-11-17 17:49 . 2014-11-17 17:49 43520 ----a-w- c:\windows\system32\drivers\ati2erec.dll
2014-11-12 16:33 . 2014-10-14 02:13 3241984 ----a-w- c:\windows\system32\msi.dll
2014-11-12 16:33 . 2014-10-14 01:50 2363904 ----a-w- c:\windows\SysWow64\msi.dll
2014-11-12 16:32 . 2014-10-18 02:05 861696 ----a-w- c:\windows\system32\oleaut32.dll
2014-11-12 16:32 . 2014-10-18 01:33 571904 ----a-w- c:\windows\SysWow64\oleaut32.dll
2014-11-06 21:22 . 2014-11-06 21:22 129752 ----a-w- c:\windows\system32\drivers\2B1F1FB6.sys
2014-11-04 17:39 . 2014-11-04 17:39 -------- d-----w- C:\Riot Games
2014-11-04 17:38 . 2014-11-04 17:38 -------- d-----w- c:\users\ghurka\AppData\Local\lolFlavor.com
2014-10-29 21:06 . 2014-10-29 21:06 -------- d-----w- c:\program files\Bonjour
2014-10-29 21:06 . 2014-10-29 21:06 -------- d-----w- c:\program files (x86)\Bonjour
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2014-11-28 03:32 . 2014-04-11 10:10 135384 ----a-w- c:\windows\system32\drivers\MBAMSwissArmy.sys
2014-11-28 03:31 . 2014-04-11 10:10 96472 ----a-w- c:\windows\system32\drivers\mbamchameleon.sys
2014-11-26 14:08 . 2014-07-06 09:45 71344 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2014-11-26 14:08 . 2014-07-06 09:45 701104 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2014-11-17 20:16 . 2011-04-20 08:21 144328 ----a-w- c:\windows\system32\atiuxp64.dll
2014-11-17 20:15 . 2012-07-28 01:13 118096 ----a-w- c:\windows\system32\atiu9p64.dll
2014-11-17 20:15 . 2012-07-07 11:56 1342760 ----a-w- c:\windows\system32\aticfx64.dll
2014-11-17 20:15 . 2012-07-07 11:56 10889312 ----a-w- c:\windows\system32\atidxx64.dll
2014-11-17 20:15 . 2013-09-21 09:44 8045488 ----a-w- c:\windows\system32\atiumd6a.dll
2014-11-17 20:15 . 2013-09-21 09:44 8295784 ----a-w- c:\windows\system32\atiumd64.dll
2014-11-17 18:22 . 2014-04-18 01:30 442368 ----a-w- c:\windows\system32\atidemgy.dll
2014-11-17 18:06 . 2014-09-15 21:59 839168 ----a-w- c:\windows\system32\coinst_14.30.dll
2014-11-17 17:55 . 2014-04-18 01:09 1211392 ----a-w- c:\windows\system32\atiadlxx.dll
2014-11-12 16:35 . 2012-07-07 10:24 103374192 ----a-w- c:\windows\system32\MRT.exe
2014-11-04 22:30 . 2012-07-07 09:57 275080 ------w- c:\windows\system32\MpSigStub.exe
2014-10-23 19:30 . 2014-10-23 19:30 129752 ----a-w- c:\windows\system32\drivers\76EC0472.sys
2014-10-04 19:22 . 2014-10-04 19:31 24064 ----a-w- c:\windows\zoek-delete.exe
2014-10-01 18:11 . 2014-04-11 10:10 63704 ----a-w- c:\windows\system32\drivers\mwac.sys
2014-10-01 18:11 . 2012-07-07 12:02 25816 ----a-w- c:\windows\system32\drivers\mbam.sys
2014-09-25 02:08 . 2014-10-01 02:41 371712 ----a-w- c:\windows\system32\qdvd.dll
2014-09-25 01:40 . 2014-10-01 02:41 519680 ----a-w- c:\windows\SysWow64\qdvd.dll
2014-09-22 21:40 . 2014-04-20 00:46 122584 ----a-w- c:\windows\system32\drivers\48230029.sys
2014-09-09 22:11 . 2014-09-26 21:10 2048 ----a-w- c:\windows\system32\tzres.dll
2014-09-09 21:47 . 2014-09-26 21:10 2048 ----a-w- c:\windows\SysWow64\tzres.dll
2014-09-05 02:11 . 2014-10-15 00:42 6584320 ----a-w- c:\windows\system32\mstscax.dll
2014-09-05 01:52 . 2014-10-15 00:42 5703168 ----a-w- c:\windows\SysWow64\mstscax.dll
2014-09-04 05:23 . 2014-10-15 00:42 424448 ----a-w- c:\windows\system32\rastls.dll
2014-09-04 05:04 . 2014-10-15 00:42 372736 ----a-w- c:\windows\SysWow64\rastls.dll
2014-08-24 09:02 . 2013-09-25 04:36 15000576 ----a-w- c:\program files (x86)\Common Files\lpuninstall.exe
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt1"]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2014-08-17 04:09 131480 ----a-w- c:\users\ghurka\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt2"]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2014-08-17 04:09 131480 ----a-w- c:\users\ghurka\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt3"]
@="{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}]
2014-08-17 04:09 131480 ----a-w- c:\users\ghurka\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt4"]
@="{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}]
2014-08-17 04:09 131480 ----a-w- c:\users\ghurka\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt5"]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2014-08-17 04:09 131480 ----a-w- c:\users\ghurka\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt6"]
@="{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}]
2014-08-17 04:09 131480 ----a-w- c:\users\ghurka\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt7"]
@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
2014-08-17 04:09 131480 ----a-w- c:\users\ghurka\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt8"]
@="{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}]
2014-08-17 04:09 131480 ----a-w- c:\users\ghurka\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DAEMON Tools Pro Agent"="d:\program files (x86)\DAEMON Tools Pro\DTAgent.exe" [2012-10-23 3108480]
"WindowSpace"="d:\program files\WindowSpace\wspace64.exe" [2014-10-04 349312]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"VolPanel"="c:\program files (x86)\Creative\Volume Panel\VolPanlu.exe" [2009-07-07 241789]
"CTxfiHlp"="CTXFIHLP.EXE" [2012-12-20 25088]
"AvastUI.exe"="c:\program files\AVAST Software\Avast\AvastUI.exe" [2014-11-26 5226600]
"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\amd64\CLIStart.exe" [2014-11-17 767176]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CtxfiReg"="CTXFIREG.exe" [2012-12-20 47616]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Install LastPass FF RunOnce.lnk - c:\program files (x86)\Common Files\lpuninstall.exe -q -name=LastPass -ffuuid
support@lastpass.com [2013-9-24 15000576]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
"SoftwareSASGeneration"= 1 (0x1)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=1 (0x1)
.
R1 EIO64;EIO Driver;c:\windows\system32\DRIVERS\EIO64.sys;c:\windows\SYSNATIVE\DRIVERS\EIO64.sys [x]
R2 aswStm;aswStm;c:\windows\system32\drivers\aswStm.sys;c:\windows\SYSNATIVE\drivers\aswStm.sys [x]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 MBAMScheduler;MBAMScheduler;d:\program files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe;d:\program files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [x]
R2 MBAMService;MBAMService;d:\program files (x86)\Malwarebytes Anti-Malware\mbamservice.exe;d:\program files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [x]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]
R3 ALSysIO;ALSysIO;c:\users\ghurka\AppData\Local\Temp\ALSysIO64.sys;c:\users\ghurka\AppData\Local\Temp\ALSysIO64.sys [x]
R3 Apowersoft_AudioDevice;Apowersoft_AudioDevice;c:\windows\system32\drivers\Apowersoft_AudioDevice.sys;c:\windows\SYSNATIVE\drivers\Apowersoft_AudioDevice.sys [x]
R3 ATHDFU;Atheros Valkyrie USB BootROM;c:\windows\system32\Drivers\AthDfu.sys;c:\windows\SYSNATIVE\Drivers\AthDfu.sys [x]
R3 BTATH_A2DP;Bluetooth A2DP Audio Driver;c:\windows\system32\drivers\btath_a2dp.sys;c:\windows\SYSNATIVE\drivers\btath_a2dp.sys [x]
R3 btath_avdt;Qualcomm Atheros Bluetooth AVDT Service;c:\windows\system32\drivers\btath_avdt.sys;c:\windows\SYSNATIVE\drivers\btath_avdt.sys [x]
R3 busenum;SteelBusSvc;c:\windows\system32\DRIVERS\SteelBus64.sys;c:\windows\SYSNATIVE\DRIVERS\SteelBus64.sys [x]
R3 cpuz136;cpuz136;c:\windows\TEMP\cpuz136\cpuz136_x64.sys;c:\windows\TEMP\cpuz136\cpuz136_x64.sys [x]
R3 Creative ALchemy AL6 Licensing Service;Creative ALchemy AL6 Licensing Service;c:\program files (x86)\Common Files\Creative Labs Shared\Service\AL6Licensing.exe;c:\program files (x86)\Common Files\Creative Labs Shared\Service\AL6Licensing.exe [x]
R3 CT20XUT;CT20XUT;c:\windows\system32\drivers\CT20XUT.SYS;c:\windows\SYSNATIVE\drivers\CT20XUT.SYS [x]
R3 CTEXFIFX;CTEXFIFX;c:\windows\system32\drivers\CTEXFIFX.SYS;c:\windows\SYSNATIVE\drivers\CTEXFIFX.SYS [x]
R3 CTHWIUT;CTHWIUT;c:\windows\system32\drivers\CTHWIUT.SYS;c:\windows\SYSNATIVE\drivers\CTHWIUT.SYS [x]
R3 Desura Install Service;Desura Install Service;c:\program files (x86)\Common Files\Desura\desura_service.exe;c:\program files (x86)\Common Files\Desura\desura_service.exe [x]
R3 EagleX64;EagleX64;c:\windows\system32\drivers\EagleX64.sys;c:\windows\SYSNATIVE\drivers\EagleX64.sys [x]
R3 GPUZ;GPUZ;c:\windows\TEMP\GPUZ.sys;c:\windows\TEMP\GPUZ.sys [x]
R3 HTCAND64;HTC Device Driver;c:\windows\system32\Drivers\ANDROIDUSB.sys;c:\windows\SYSNATIVE\Drivers\ANDROIDUSB.sys [x]
R3 htcnprot;HTC NDIS Protocol Driver;c:\windows\system32\DRIVERS\htcnprot.sys;c:\windows\SYSNATIVE\DRIVERS\htcnprot.sys [x]
R3 HtcVCom32;HTC Diagnostic Port;c:\windows\system32\DRIVERS\HtcVComV64.sys;c:\windows\SYSNATIVE\DRIVERS\HtcVComV64.sys [x]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x]
R3 LGSHidFilt;Logitech Gaming KMDF HID Filter Driver;c:\windows\system32\DRIVERS\LGSHidFilt.Sys;c:\windows\SYSNATIVE\DRIVERS\LGSHidFilt.Sys [x]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys;c:\windows\SYSNATIVE\drivers\mbam.sys [x]
R3 MBAMWebAccessControl;MBAMWebAccessControl;c:\windows\system32\drivers\mwac.sys;c:\windows\SYSNATIVE\drivers\mwac.sys [x]
R3 Neo_VPN;VPN Client Device Driver - VPN;c:\windows\system32\DRIVERS\Neo_0013.sys;c:\windows\SYSNATIVE\DRIVERS\Neo_0013.sys [x]
R3 Origin Client Service;Origin Client Service;c:\program files (x86)\Origin\OriginClientService.exe;c:\program files (x86)\Origin\OriginClientService.exe [x]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys;c:\windows\SYSNATIVE\drivers\rdpvideominiport.sys [x]
R3 SAlphamHid;SteelHIDSvc;c:\windows\system32\DRIVERS\SAlpham64.sys;c:\windows\SYSNATIVE\DRIVERS\SAlpham64.sys [x]
R3 Synth3dVsc;Synth3dVsc;c:\windows\system32\drivers\synth3dvsc.sys;c:\windows\SYSNATIVE\drivers\synth3dvsc.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 tsusbhub;tsusbhub;c:\windows\system32\drivers\tsusbhub.sys;c:\windows\SYSNATIVE\drivers\tsusbhub.sys [x]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys;c:\windows\SYSNATIVE\Drivers\usbaapl64.sys [x]
R3 VGPU;VGPU;c:\windows\system32\drivers\rdvgkmd.sys;c:\windows\SYSNATIVE\drivers\rdvgkmd.sys [x]
R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe;c:\windows\SYSNATIVE\Wat\WatAdminSvc.exe [x]
R3 wovad_micarray;WO Mic Device;c:\windows\system32\drivers\womic.sys;c:\windows\SYSNATIVE\drivers\womic.sys [x]
R3 WSDScan;WSD Scan Support via UMB;c:\windows\system32\DRIVERS\WSDScan.sys;c:\windows\SYSNATIVE\DRIVERS\WSDScan.sys [x]
R3 X6va008;X6va008;c:\windows\SysWOW64\Drivers\X6va008;c:\windows\SysWOW64\Drivers\X6va008 [x]
R3 X6va009;X6va009;c:\windows\SysWOW64\Drivers\X6va009;c:\windows\SysWOW64\Drivers\X6va009 [x]
R3 X6va012;X6va012;c:\windows\SysWOW64\Drivers\X6va012;c:\windows\SysWOW64\Drivers\X6va012 [x]
R3 X6va013;X6va013;c:\windows\SysWOW64\Drivers\X6va013;c:\windows\SysWOW64\Drivers\X6va013 [x]
R3 X6va017;X6va017;c:\windows\SysWOW64\Drivers\X6va017;c:\windows\SysWOW64\Drivers\X6va017 [x]
R3 XENfiltv;XENfiltv;c:\windows\system32\drivers\XENfiltv.sys;c:\windows\SYSNATIVE\drivers\XENfiltv.sys [x]
R3 xsherlock;xsherlock;c:\windows\system32\xsherlock.xem;c:\windows\SYSNATIVE\xsherlock.xem [x]
R4 AtherosSvc;AtherosSvc;c:\program files (x86)\Bluetooth Suite\adminservice.exe;c:\program files (x86)\Bluetooth Suite\adminservice.exe [x]
R4 DTSAudioService;DTSAudioService;c:\program files\Realtek\Audio\HDA\DTSAudioService64.exe;c:\program files\Realtek\Audio\HDA\DTSAudioService64.exe [x]
R4 PassThru Service;Internet Pass-Through Service;c:\program files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe;c:\program files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe [x]
S0 aswRvrt;avast! Revert; [x]
S0 aswVmm;avast! VM Monitor; [x]
S0 iaStorA;iaStorA;c:\windows\system32\DRIVERS\iaStorA.sys;c:\windows\SYSNATIVE\DRIVERS\iaStorA.sys [x]
S0 iaStorF;iaStorF;c:\windows\system32\DRIVERS\iaStorF.sys;c:\windows\SYSNATIVE\DRIVERS\iaStorF.sys [x]
S0 sptd;sptd;c:\windows\\SystemRoot\System32\Drivers\sptd.sys;c:\windows\\SystemRoot\System32\Drivers\sptd.sys [x]
S1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys;c:\windows\SYSNATIVE\drivers\aswSnx.sys [x]
S1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys;c:\windows\SYSNATIVE\drivers\aswSP.sys [x]
S1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys;c:\windows\SYSNATIVE\DRIVERS\dtsoftbus01.sys [x]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe;c:\windows\SYSNATIVE\atiesrxx.exe [x]
S2 aswHwid;avast! HardwareID;c:\windows\system32\drivers\aswHwid.sys;c:\windows\SYSNATIVE\drivers\aswHwid.sys [x]
S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys;c:\windows\SYSNATIVE\drivers\aswMonFlt.sys [x]
S2 c2cautoupdatesvc;Skype Click to Call Updater;c:\program files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe;c:\program files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [x]
S2 c2cpnrsvc;Skype Click to Call PNR Service;c:\program files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe;c:\program files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [x]
S2 Intel® PROSet Monitoring Service;Intel® PROSet Monitoring Service;c:\windows\system32\IProsetMonitor.exe;c:\windows\SYSNATIVE\IProsetMonitor.exe [x]
S3 AthBTPort;Qualcomm Atheros Virtual Bluetooth Class;c:\windows\system32\DRIVERS\btath_flt.sys;c:\windows\SYSNATIVE\DRIVERS\btath_flt.sys [x]
S3 AtiHDAudioService;AMD Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW76.sys;c:\windows\SYSNATIVE\drivers\AtihdW76.sys [x]
S3 BTATH_BUS;Atheros Bluetooth Bus;c:\windows\system32\DRIVERS\btath_bus.sys;c:\windows\SYSNATIVE\DRIVERS\btath_bus.sys [x]
S3 BTATH_HCRP;Bluetooth HCRP Server driver;c:\windows\system32\DRIVERS\btath_hcrp.sys;c:\windows\SYSNATIVE\DRIVERS\btath_hcrp.sys [x]
S3 BTATH_LWFLT;Bluetooth LWFLT Device;c:\windows\system32\DRIVERS\btath_lwflt.sys;c:\windows\SYSNATIVE\DRIVERS\btath_lwflt.sys [x]
S3 BTATH_RCP;Bluetooth AVRCP Device;c:\windows\system32\DRIVERS\btath_rcp.sys;c:\windows\SYSNATIVE\DRIVERS\btath_rcp.sys [x]
S3 BtFilter;BtFilter;c:\windows\system32\DRIVERS\btfilter.sys;c:\windows\SYSNATIVE\DRIVERS\btfilter.sys [x]
S3 CT20XUT.SYS;CT20XUT.SYS;c:\windows\System32\drivers\CT20XUT.SYS;c:\windows\SYSNATIVE\drivers\CT20XUT.SYS [x]
S3 CTEXFIFX.SYS;CTEXFIFX.SYS;c:\windows\System32\drivers\CTEXFIFX.SYS;c:\windows\SYSNATIVE\drivers\CTEXFIFX.SYS [x]
S3 CTHWIUT.SYS;CTHWIUT.SYS;c:\windows\System32\drivers\CTHWIUT.SYS;c:\windows\SYSNATIVE\drivers\CTHWIUT.SYS [x]
S3 ha20x22k;Creative 20X2 HAL Driver;c:\windows\system32\drivers\ha20x22k.sys;c:\windows\SYSNATIVE\drivers\ha20x22k.sys [x]
S3 LGBusEnum;Logitech GamePanel Virtual Bus Enumerator Driver;c:\windows\system32\drivers\LGBusEnum.sys;c:\windows\SYSNATIVE\drivers\LGBusEnum.sys [x]
S3 LGVirHid;Logitech Gamepanel Virtual HID Device Driver;c:\windows\system32\drivers\LGVirHid.sys;c:\windows\SYSNATIVE\drivers\LGVirHid.sys [x]
S3 nusb3hub;Renesas Electronics USB 3.0 Hub Driver;c:\windows\system32\DRIVERS\nusb3hub.sys;c:\windows\SYSNATIVE\DRIVERS\nusb3hub.sys [x]
S3 nusb3xhc;Renesas Electronics USB 3.0 Host Controller Driver;c:\windows\system32\DRIVERS\nusb3xhc.sys;c:\windows\SYSNATIVE\DRIVERS\nusb3xhc.sys [x]
S3 ScpVBus;Scp Virtual Bus Driver;c:\windows\system32\DRIVERS\ScpVBus.sys;c:\windows\SYSNATIVE\DRIVERS\ScpVBus.sys [x]
S3 SmbDrvI;SmbDrvI;c:\windows\system32\DRIVERS\Smb_driver_Intel.sys;c:\windows\SYSNATIVE\DRIVERS\Smb_driver_Intel.sys [x]
.
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2014-11-25 04:41 1087304 ----a-w- c:\program files (x86)\Google\Chrome\Application\39.0.2171.65\Installer\chrmstp.exe
.
Contents of the 'Scheduled Tasks' folder
.
2014-11-28 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-07-06 14:08]
.
2014-11-28 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2014-11-25 04:41]
.
2014-11-28 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2014-11-25 04:41]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt1"]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2014-08-17 04:10 164760 ----a-w- c:\users\ghurka\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt2"]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2014-08-17 04:10 164760 ----a-w- c:\users\ghurka\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt3"]
@="{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}]
2014-08-17 04:10 164760 ----a-w- c:\users\ghurka\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt4"]
@="{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}]
2014-08-17 04:10 164760 ----a-w- c:\users\ghurka\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt5"]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2014-08-17 04:10 164760 ----a-w- c:\users\ghurka\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt6"]
@="{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}]
2014-08-17 04:10 164760 ----a-w- c:\users\ghurka\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt7"]
@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
2014-08-17 04:10 164760 ----a-w- c:\users\ghurka\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt8"]
@="{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}]
2014-08-17 04:10 164760 ----a-w- c:\users\ghurka\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2014-11-26 01:44 860984 ----a-w- c:\program files\AVAST Software\Avast\ashShA64.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Launch LCore"="c:\program files\Logitech Gaming Software\LCore.exe" [2014-10-14 12697368]
"XboxStat"="c:\program files\Microsoft Xbox 360 Accessories\XboxStat.exe" [2009-10-01 825184]
.
------- Supplementary Scan -------
.
uLocal Page = c:\windows\system32\blank.htm
mStart Page =
www.google.com
mLocal Page = c:\windows\SysWOW64\blank.htm
mDefault_Page_URL = hxxp://
www.google.com
uInternet Settings,ProxyOverride = *.local
Trusted Zone: clonewarsadventures.com
Trusted Zone: freerealms.com
Trusted Zone: soe.com
Trusted Zone: sony.com
TCP: DhcpNameServer = 192.168.10.1
TCP: Interfaces\{25E6C3A2-F9E9-49AC-B2E2-5EC3433DE1A8}: NameServer = 31.168.224.106,5.135.12.52
.
- - - - ORPHANS REMOVED - - - -
.
AddRemove-RmFyQ3J5NA==_is1 - d:\program files (x86)\R.G. Mechanics\Far Cry 4\Far Cry 4\unins000.exe
AddRemove-{15134cb0-b767-4960-a911-f2d16ae54797} - c:\programdata\Package Cache\{15134cb0-b767-4960-a911-f2d16ae54797}\vcredist_x64.exe
AddRemove-{22154f09-719a-4619-bb71-5b3356999fbf} - c:\programdata\Package Cache\{22154f09-719a-4619-bb71-5b3356999fbf}\vcredist_x86.exe
AddRemove-{51adbf11-493f-431c-a862-967a0fae2944} - c:\programdata\Package Cache\{51adbf11-493f-431c-a862-967a0fae2944}\vcredist_x64.exe
AddRemove-{7f51bdb9-ee21-49ee-94d6-90afc321780e} - c:\programdata\Package Cache\{7f51bdb9-ee21-49ee-94d6-90afc321780e}\vcredist_x64.exe
AddRemove-{95716cce-fc71-413f-8ad5-56c2892d4b3a} - c:\programdata\Package Cache\{95716cce-fc71-413f-8ad5-56c2892d4b3a}\vcredist_x86.exe
AddRemove-{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6} - c:\programdata\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
AddRemove-{ce085a78-074e-4823-8dc1-8a721b94b76d} - c:\programdata\Package Cache\{ce085a78-074e-4823-8dc1-8a721b94b76d}\vcredist_x86.exe
.
.
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\X6va008]
"ImagePath"="\??\c:\windows\SysWOW64\Drivers\X6va008"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\X6va009]
"ImagePath"="\??\c:\windows\SysWOW64\Drivers\X6va009"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\X6va012]
"ImagePath"="\??\c:\windows\SysWOW64\Drivers\X6va012"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\X6va013]
"ImagePath"="\??\c:\windows\SysWOW64\Drivers\X6va013"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\X6va017]
"ImagePath"="\??\c:\windows\SysWOW64\Drivers\X6va017"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\xsherlock]
"ImagePath"="c:\windows\system32\xsherlock.xem"
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\Approved Extensions]
@Denied: (2) (LocalSystem)
"{9030D464-4C02-4ABF-8ECC-5164760863C6}"=hex:51,66,7a,6c,4c,1d,38,12,0a,d7,23,
94,30,02,d1,0f,f1,da,12,24,73,56,27,d2
.
[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration]
@Denied: (2) (LocalSystem)
"Timestamp"=hex:ee,58,29,e5,24,63,cd,01
.
[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (LocalSystem)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,56,dd,fa,55,5b,8a,e7,42,b9,9e,9b,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,56,dd,fa,55,5b,8a,e7,42,b9,9e,9b,\
.
[HKEY_USERS\S-1-5-21-2067428755-2677243105-219487846-1000\Software\SecuROM\License information*]
"datasecu"=hex:08,f4,23,6e,1b,ac,43,a6,4d,7b,b3,7b,62,d4,66,59,1f,27,75,b8,a5,
1f,65,1d,3b,17,b8,41,3d,9c,a1,90,23,9e,48,44,3a,8d,19,7f,93,99,a3,90,b0,bd,\
"rkeysecu"=hex:c0,a7,c0,b8,f9,e7,7d,4a,2d,d3,5f,f0,91,dc,e3,c6
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_15_0_0_239_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_15_0_0_239_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}]
@Denied: (A 2) (Everyone)
@="IFlashBroker6"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_15_0_0_239_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_15_0_0_239_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_15_0_0_239.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.15"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_15_0_0_239.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_15_0_0_239.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_15_0_0_239.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}]
@Denied: (A 2) (Everyone)
@="IFlashBroker6"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Completion time: 2014-11-27 20:17:15
ComboFix-quarantined-files.txt 2014-11-28 04:17
ComboFix2.txt 2014-11-28 04:05
ComboFix3.txt 2014-11-27 07:35
ComboFix4.txt 2014-11-26 02:17
.
Pre-Run: 7,128,244,224 bytes free
Post-Run: 7,033,409,536 bytes free
.
- - End Of File - - D5BA10CF16A43D89E5610936D3CDA7DE
8F558EB6672622401DA993E1E865C861