Hi Broni here is the COMBOFIX Log
ComboFix 14-03-24.01 - asus 03/26/2014 14:04:17.1.8 - x64
Microsoft Windows 7 Ultimate 6.1.7601.1.1252.1.1033.18.8116.6213 [GMT 7:00]
Running from: c:\users\asus\Downloads\ComboFix.exe
AV: avast! Antivirus *Disabled/Updated* {17AD7D40-BA12-9C46-7131-94903A54AD8B}
SP: avast! Antivirus *Disabled/Updated* {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\programdata\DownloAD Keeper
c:\programdata\DownloAD Keeper\hs8snxb.dat
c:\programdata\DownloAD Keeper\hs8snxb.tlb
c:\programdata\DownloAD Keeper\Pu_kUT9E.dat
c:\programdata\savenisHHare
c:\programdata\savenisHHare\522378493597d.tlb
c:\programdata\savenisHHare\data\savenishhAre .dat
c:\programdata\savenisHHare\settings.ini
c:\users\asus\AppData\Local\Google\Chrome\User Data\Default\Extensions\acnjecicodhjjnfhndiedlijdmfcbjah
c:\users\asus\AppData\Local\Google\Chrome\User Data\Default\Extensions\acnjecicodhjjnfhndiedlijdmfcbjah\1\52237849357306.78688319.js
c:\users\asus\AppData\Local\Google\Chrome\User Data\Default\Extensions\acnjecicodhjjnfhndiedlijdmfcbjah\1\background.html
c:\users\asus\AppData\Local\Google\Chrome\User Data\Default\Extensions\acnjecicodhjjnfhndiedlijdmfcbjah\1\content.js
c:\users\asus\AppData\Local\Google\Chrome\User Data\Default\Extensions\acnjecicodhjjnfhndiedlijdmfcbjah\1\lsdb.js
c:\users\asus\AppData\Local\Google\Chrome\User Data\Default\Extensions\acnjecicodhjjnfhndiedlijdmfcbjah\1\manifest.json
c:\users\asus\AppData\Local\Google\Chrome\User Data\Default\Extensions\acnjecicodhjjnfhndiedlijdmfcbjah\1\sqlite.js
c:\users\asus\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acnjecicodhjjnfhndiedlijdmfcbjah
c:\users\asus\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acnjecicodhjjnfhndiedlijdmfcbjah\000005.ldb
c:\users\asus\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acnjecicodhjjnfhndiedlijdmfcbjah\000008.ldb
c:\users\asus\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acnjecicodhjjnfhndiedlijdmfcbjah\000011.ldb
c:\users\asus\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acnjecicodhjjnfhndiedlijdmfcbjah\000012.log
c:\users\asus\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acnjecicodhjjnfhndiedlijdmfcbjah\CURRENT
c:\users\asus\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acnjecicodhjjnfhndiedlijdmfcbjah\LOCK
c:\users\asus\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acnjecicodhjjnfhndiedlijdmfcbjah\LOG
c:\users\asus\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acnjecicodhjjnfhndiedlijdmfcbjah\LOG.old
c:\users\asus\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acnjecicodhjjnfhndiedlijdmfcbjah\MANIFEST-000010
c:\users\asus\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_acnjecicodhjjnfhndiedlijdmfcbjah_0.localstorage-journal
c:\users\asus\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_acnjecicodhjjnfhndiedlijdmfcbjah_0.localstorage
c:\users\asus\AppData\Local\Google\Chrome\User Data\Default\Preferences
c:\users\asus\AppData\Local\TempDIR
c:\users\asus\AppData\Local\TempDIR\Offercast2810_NDV_.exe
c:\users\asus\AppData\Roaming\Mozilla\Firefox\Profiles\1dl1g3uh.default\extensions\
hopaeyi@plxyuio.edu
c:\users\asus\AppData\Roaming\Mozilla\Firefox\Profiles\1dl1g3uh.default\extensions\
hopaeyi@plxyuio.edu\bootstrap.js
c:\users\asus\AppData\Roaming\Mozilla\Firefox\Profiles\1dl1g3uh.default\extensions\
hopaeyi@plxyuio.edu\chrome.manifest
c:\users\asus\AppData\Roaming\Mozilla\Firefox\Profiles\1dl1g3uh.default\extensions\
hopaeyi@plxyuio.edu\content\bg.js
c:\users\asus\AppData\Roaming\Mozilla\Firefox\Profiles\1dl1g3uh.default\extensions\
hopaeyi@plxyuio.edu\install.rdf
c:\users\asus\AppData\Roaming\Mozilla\Firefox\Profiles\1dl1g3uh.default\extensions\
iuj3ybpq5@kjtpkazma.edu
c:\users\asus\AppData\Roaming\Mozilla\Firefox\Profiles\1dl1g3uh.default\extensions\
iuj3ybpq5@kjtpkazma.edu\bootstrap.js
c:\users\asus\AppData\Roaming\Mozilla\Firefox\Profiles\1dl1g3uh.default\extensions\
iuj3ybpq5@kjtpkazma.edu\chrome.manifest
c:\users\asus\AppData\Roaming\Mozilla\Firefox\Profiles\1dl1g3uh.default\extensions\
iuj3ybpq5@kjtpkazma.edu\content\bg.js
c:\users\asus\AppData\Roaming\Mozilla\Firefox\Profiles\1dl1g3uh.default\extensions\
iuj3ybpq5@kjtpkazma.edu\install.rdf
c:\users\asus\AppData\Roaming\Mozilla\Firefox\Profiles\1dl1g3uh.default\extensions\
lnts.aoo@ekjkrv.org
c:\users\asus\AppData\Roaming\Mozilla\Firefox\Profiles\1dl1g3uh.default\extensions\
lnts.aoo@ekjkrv.org\bootstrap.js
c:\users\asus\AppData\Roaming\Mozilla\Firefox\Profiles\1dl1g3uh.default\extensions\
lnts.aoo@ekjkrv.org\chrome.manifest
c:\users\asus\AppData\Roaming\Mozilla\Firefox\Profiles\1dl1g3uh.default\extensions\
lnts.aoo@ekjkrv.org\content\bg.js
c:\users\asus\AppData\Roaming\Mozilla\Firefox\Profiles\1dl1g3uh.default\extensions\
lnts.aoo@ekjkrv.org\install.rdf
c:\windows\SysWow64\tmpE945.tmp
c:\windows\SysWow64\tmpE946.tmp
.
.
((((((((((((((((((((((((( Files Created from 2014-02-26 to 2014-03-26 )))))))))))))))))))))))))))))))
.
.
2014-03-26 07:10 . 2014-03-26 07:10 -------- d-----w- c:\users\Default\AppData\Local\temp
2014-03-26 06:41 . 2014-03-26 06:41 -------- d-----w- c:\users\asus\AppData\Local\Avg2014
2014-03-25 19:37 . 2014-03-25 19:37 159744 ----a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin5.dll
2014-03-25 19:37 . 2014-03-25 19:37 159744 ----a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin4.dll
2014-03-25 19:37 . 2014-03-25 19:37 159744 ----a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin3.dll
2014-03-25 19:37 . 2014-03-25 19:37 159744 ----a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin2.dll
2014-03-25 19:37 . 2014-03-25 19:37 159744 ----a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin.dll
2014-03-25 19:36 . 2014-03-25 19:37 -------- d-----w- c:\program files (x86)\QuickTime
2014-03-25 05:51 . 2014-03-25 06:58 -------- d-----w- c:\programdata\Malwarebytes' Anti-Malware (portable)
2014-03-25 05:51 . 2014-03-25 06:39 119000 ----a-w- c:\windows\system32\drivers\MBAMSwissArmy.sys
2014-03-25 05:49 . 2014-03-25 06:39 91352 ----a-w- c:\windows\system32\drivers\mbamchameleon.sys
2014-03-24 23:16 . 2014-03-24 23:16 -------- d-----w- c:\program files\Microsoft Silverlight
2014-03-24 23:16 . 2014-03-24 23:16 -------- d-----w- c:\program files (x86)\Microsoft Silverlight
2014-03-24 20:52 . 2014-03-24 20:52 -------- d-----w- c:\users\asus\AppData\Local\Apple Computer
2014-03-24 20:52 . 2014-03-24 20:53 -------- d-----w- c:\users\asus\AppData\Roaming\Apple Computer
2014-03-24 20:52 . 2014-03-24 20:52 -------- dc----w- c:\windows\system32\DRVSTORE
2014-03-24 20:52 . 2012-08-21 06:01 33240 ----a-w- c:\windows\system32\drivers\GEARAspiWDM.sys
2014-03-24 20:51 . 2014-03-24 20:51 -------- d-----w- c:\program files\iPod
2014-03-24 20:51 . 2014-03-24 20:51 -------- d-----w- c:\programdata\34BE82C4-E596-4e99-A191-52C6199EBF69
2014-03-24 20:51 . 2014-03-24 20:51 -------- d-----w- c:\program files\iTunes
2014-03-24 20:51 . 2014-03-24 20:51 -------- d-----w- c:\program files (x86)\iTunes
2014-03-24 20:51 . 2014-03-24 20:51 -------- d-----w- c:\programdata\Apple Computer
2014-03-24 20:51 . 2014-03-24 20:51 -------- d-----w- c:\users\asus\AppData\Local\Apple
2014-03-24 20:51 . 2014-03-24 20:51 -------- d-----w- c:\program files (x86)\Apple Software Update
2014-03-24 20:50 . 2014-03-24 20:50 -------- d-----w- c:\program files\Common Files\Apple
2014-03-24 20:50 . 2014-03-24 20:50 -------- d-----w- c:\program files\Bonjour
2014-03-24 20:50 . 2014-03-24 20:50 -------- d-----w- c:\program files (x86)\Bonjour
2014-03-24 20:50 . 2014-03-24 20:51 -------- d-----w- c:\program files (x86)\Common Files\Apple
2014-03-24 20:50 . 2014-03-24 20:51 -------- d-----w- c:\programdata\Apple
2014-03-21 06:17 . 2014-03-21 06:17 -------- d-----w- c:\users\asus\AppData\Roaming\Malwarebytes
2014-03-21 06:17 . 2014-03-21 06:17 -------- d-----w- c:\programdata\Malwarebytes
2014-03-21 06:17 . 2014-03-21 06:17 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware
2014-03-21 06:17 . 2013-04-04 07:50 25928 ----a-w- c:\windows\system32\drivers\mbam.sys
2014-03-21 06:10 . 2014-03-21 06:10 -------- d-----w- c:\users\asus\AppData\Roaming\AVAST Software
2014-03-21 06:07 . 2014-03-21 06:07 84816 ----a-w- c:\windows\system32\drivers\aswStm.sys
2014-03-21 06:07 . 2014-03-21 06:07 423240 ----a-w- c:\windows\system32\drivers\aswSP.sys
2014-03-21 06:07 . 2014-03-21 06:07 208928 ----a-w- c:\windows\system32\drivers\aswVmm.sys
2014-03-21 06:07 . 2014-03-21 06:07 1039096 ----a-w- c:\windows\system32\drivers\aswSnx.sys
2014-03-21 06:07 . 2014-03-21 06:07 65776 ----a-w- c:\windows\system32\drivers\aswRvrt.sys
2014-03-21 06:07 . 2014-03-21 06:07 79184 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys
2014-03-21 06:07 . 2014-03-21 06:07 93568 ----a-w- c:\windows\system32\drivers\aswRdr2.sys
2014-03-21 06:07 . 2014-03-21 06:07 334648 ----a-w- c:\windows\system32\aswBoot.exe
2014-03-21 06:07 . 2014-03-21 06:07 43152 ----a-w- c:\windows\avastSS.scr
2014-03-21 06:07 . 2014-03-21 06:07 -------- d-----w- c:\program files\AVAST Software
2014-03-21 06:06 . 2014-03-21 06:06 -------- d-----w- c:\programdata\AVAST Software
2014-03-18 19:02 . 2014-03-21 06:53 -------- d-----w- c:\programdata\Search Protection
2014-03-18 19:02 . 2014-03-18 19:02 -------- d-----w- c:\programdata\EmailNotifier
2014-03-18 19:01 . 2014-03-18 19:02 -------- d-----w- c:\program files (x86)\dlsecuretb
2014-02-24 07:26 . 2014-02-24 07:26 -------- d-----w- c:\users\asus\.android
2014-02-24 07:26 . 2014-03-21 06:48 -------- d-----w- c:\users\asus\AppData\Local\genienext
2014-02-24 07:26 . 2014-02-25 18:40 -------- d-----w- c:\users\asus\AppData\Local\Mobogenie
2014-02-24 07:26 . 2014-02-24 16:38 -------- d-----w- c:\users\asus\AppData\Local\cache
2014-02-24 07:25 . 2014-02-25 18:40 -------- d-----w- c:\program files (x86)\Mobogenie
2014-02-24 07:13 . 2014-02-24 07:13 -------- d-----w- c:\programdata\PlotSoft
2014-02-24 07:13 . 2014-02-24 07:13 -------- d-----w- c:\program files (x86)\PlotSoft
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2014-03-14 19:00 . 2013-08-30 09:50 71048 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2014-03-14 19:00 . 2013-08-30 09:50 692616 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2014-01-17 09:24 . 2014-01-17 09:24 94208 ----a-w- c:\windows\SysWow64\QuickTimeVR.qtx
2014-01-17 09:24 . 2014-01-17 09:24 69632 ----a-w- c:\windows\SysWow64\QuickTime.qts
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\~\Browser Helper Objects\{573bf47c-2566-449d-ba1b-417d5d3fb9fd}]
2013-08-14 19:46 91712 ----a-w- c:\program files (x86)\zgametb\zgameDx.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\~\Browser Helper Objects\{7bcc228a-c730-4004-93f9-72cbb7033a62}]
2013-12-19 16:09 114752 ----a-w- c:\program files (x86)\dlsecuretb\dlsecureDx.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar]
"{573bf47c-2566-449d-ba1b-417d5d3fb9fd}"= "c:\program files (x86)\zgametb\zgameDx.dll" [2013-08-14 91712]
"{7bcc228a-c730-4004-93f9-72cbb7033a62}"= "c:\program files (x86)\dlsecuretb\dlsecureDx.dll" [2013-12-19 114752]
.
[HKEY_CLASSES_ROOT\clsid\{573bf47c-2566-449d-ba1b-417d5d3fb9fd}]
.
[HKEY_CLASSES_ROOT\clsid\{7bcc228a-c730-4004-93f9-72cbb7033a62}]
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-20 1475584]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"ATKOSD2"="c:\program files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe" [2009-10-26 6998656]
"HControlUser"="c:\program files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe" [2009-06-19 105016]
"RIMBBLaunchAgent.exe"="c:\program files (x86)\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe" [2013-01-17 267792]
"ApnTBMon"="c:\program files (x86)\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe" [2014-03-18 1801168]
"AvastUI.exe"="c:\program files\AVAST Software\Avast\AvastUI.exe" [2014-03-21 3854640]
"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2014-01-17 421888]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
ImageBrowser EX Agent.lnk - c:\program files (x86)\Canon\ImageBrowser EX\MFManager.exe [2012-8-30 69120]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=1 (0x1)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\run-]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe"
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe"
"KiesTrayAgent"=c:\program files (x86)\Samsung\Kies\KiesTrayAgent.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AutoUpdateDisableNotify"=dword:00000001
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 TorchCrashHandler;Torch Crash Handler;c:\users\asus\AppData\Local\Torch\Update\TorchCrashHandler.exe;c:\users\asus\AppData\Local\Torch\Update\TorchCrashHandler.exe [x]
R3 aswStm;aswStm;c:\windows\system32\drivers\aswStm.sys;c:\windows\SYSNATIVE\drivers\aswStm.sys [x]
R3 BprotectEx;Baidu ProtectEx;c:\windows\System32\drivers\BprotectEx.sys;c:\windows\SYSNATIVE\drivers\BprotectEx.sys [x]
R3 cpuz135;cpuz135;c:\program files (x86)\CPUID\PC Wizard 2012\pcwiz_x64.sys;c:\program files (x86)\CPUID\PC Wizard 2012\pcwiz_x64.sys [x]
R3 cpuz136;cpuz136;c:\users\asus\AppData\Local\Temp\cpuz136\cpuz136_x64.sys;c:\users\asus\AppData\Local\Temp\cpuz136\cpuz136_x64.sys [x]
R3 dg_ssudbus;SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudbus.sys;c:\windows\SYSNATIVE\DRIVERS\ssudbus.sys [x]
R3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files\McAfee Security Scan\3.8.141\McCHSvc.exe;c:\program files\McAfee Security Scan\3.8.141\McCHSvc.exe [x]
R3 PCFApiUtil;PCFApiUtil;c:\program files (x86)\Baidu Security\PC Faster\3.7.0.0\PCFApiUtil64.sys;c:\program files (x86)\Baidu Security\PC Faster\3.7.0.0\PCFApiUtil64.sys [x]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys;c:\windows\SYSNATIVE\drivers\rdpvideominiport.sys [x]
R3 ssudmdm;SAMSUNG Mobile USB Modem Drivers (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudmdm.sys;c:\windows\SYSNATIVE\DRIVERS\ssudmdm.sys [x]
R3 ssudserd;SAMSUNG Mobile USB Diagnostic Serial Port(DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudserd.sys;c:\windows\SYSNATIVE\DRIVERS\ssudserd.sys [x]
R3 Synth3dVsc;Synth3dVsc;c:\windows\system32\drivers\synth3dvsc.sys;c:\windows\SYSNATIVE\drivers\synth3dvsc.sys [x]
R3 taphss6;Anchorfree HSS VPN Adapter;c:\windows\system32\DRIVERS\taphss6.sys;c:\windows\SYSNATIVE\DRIVERS\taphss6.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 tsusbhub;tsusbhub;c:\windows\system32\drivers\tsusbhub.sys;c:\windows\SYSNATIVE\drivers\tsusbhub.sys [x]
R3 USB_BusEnum_H;EVDO Telecom USB Bus Enumerator h;c:\windows\system32\DRIVERS\USB_BusEnum_H.sys;c:\windows\SYSNATIVE\DRIVERS\USB_BusEnum_H.sys [x]
R3 USB_ETS_H;EVDO Rev A Service USB port h;c:\windows\system32\DRIVERS\USB_ETS_H.sys;c:\windows\SYSNATIVE\DRIVERS\USB_ETS_H.sys [x]
R3 USB_WinMux_H;EVDO Telecom USB MUX Serial Port h;c:\windows\system32\DRIVERS\USB_WinMux_H.sys;c:\windows\SYSNATIVE\DRIVERS\USB_WinMux_H.sys [x]
R3 UsbModemDriver;EVDO Rev A USB Modem h;c:\windows\system32\DRIVERS\USB_MODEM_H.sys;c:\windows\SYSNATIVE\DRIVERS\USB_MODEM_H.sys [x]
R3 VGPU;VGPU;c:\windows\system32\drivers\rdvgkmd.sys;c:\windows\SYSNATIVE\drivers\rdvgkmd.sys [x]
R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe;c:\windows\SYSNATIVE\Wat\WatAdminSvc.exe [x]
R4 APNMCP;Ask Update Service;c:\program files (x86)\AskPartnerNetwork\Toolbar\apnmcp.exe;c:\program files (x86)\AskPartnerNetwork\Toolbar\apnmcp.exe [x]
R4 CDROM_Eject_H;CDROM_Eject_H;c:\program files\Smartfren Connex CE682 UI\HEject.exe;c:\program files\Smartfren Connex CE682 UI\HEject.exe [x]
S0 aswRvrt;avast! Revert; [x]
S0 aswVmm;avast! VM Monitor; [x]
S1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys;c:\windows\SYSNATIVE\drivers\aswSnx.sys [x]
S1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys;c:\windows\SYSNATIVE\drivers\aswSP.sys [x]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe;c:\windows\SYSNATIVE\atiesrxx.exe [x]
S2 ASMMAP64;ASMMAP64;c:\program files (x86)\ASUS\ATK Package\ATKGFNEX\ASMMAP64.sys;c:\program files (x86)\ASUS\ATK Package\ATKGFNEX\ASMMAP64.sys [x]
S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys;c:\windows\SYSNATIVE\drivers\aswMonFlt.sys [x]
S2 MBAMScheduler;MBAMScheduler;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [x]
S2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [x]
S2 TuneUp.UtilitiesSvc;TuneUp Utilities Service;c:\program files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesService64.exe;c:\program files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesService64.exe [x]
S2 UNS;Intel(R) Management & Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [x]
S3 AtiHDAudioService;ATI Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW76.sys;c:\windows\SYSNATIVE\drivers\AtihdW76.sys [x]
S3 Blackberry Device Manager;Blackberry Device Manager;c:\program files (x86)\Common Files\Research In Motion\USB Drivers\BbDevMgr.exe;c:\program files (x86)\Common Files\Research In Motion\USB Drivers\BbDevMgr.exe [x]
S3 ETD;ELAN PS/2 Port Input Device;c:\windows\system32\DRIVERS\ETD.sys;c:\windows\SYSNATIVE\DRIVERS\ETD.sys [x]
S3 HECIx64;Intel(R) Management Engine Interface;c:\windows\system32\DRIVERS\HECIx64.sys;c:\windows\SYSNATIVE\DRIVERS\HECIx64.sys [x]
S3 JMCR;JMCR;c:\windows\system32\DRIVERS\jmcr.sys;c:\windows\SYSNATIVE\DRIVERS\jmcr.sys [x]
S3 JME;JMicron Ethernet Adapter NDIS6 Driver (Amd64 Bits);c:\windows\system32\DRIVERS\JME.sys;c:\windows\SYSNATIVE\DRIVERS\JME.sys [x]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys;c:\windows\SYSNATIVE\drivers\mbam.sys [x]
S3 TuneUpUtilitiesDrv;TuneUpUtilitiesDrv;c:\program files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesDriver64.sys;c:\program files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesDriver64.sys [x]
.
.
Contents of the 'Scheduled Tasks' folder
.
2014-03-26 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-08-30 19:01]
.
2014-03-25 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2490425179-759466278-4202775785-1000Core.job
- c:\users\asus\AppData\Local\Google\Update\GoogleUpdate.exe [2013-09-07 17:28]
.
2014-03-26 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2490425179-759466278-4202775785-1000UA.job
- c:\users\asus\AppData\Local\Google\Update\GoogleUpdate.exe [2013-09-07 17:28]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{7bcc228a-c730-4004-93f9-72cbb7033a62}"= "c:\program files (x86)\dlsecuretb\dlsecureDx64.dll" [2013-12-19 127040]
.
[HKEY_CLASSES_ROOT\CLSID\{7bcc228a-c730-4004-93f9-72cbb7033a62}]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2014-03-21 06:07 290888 ----a-w- c:\program files\AVAST Software\Avast\ashShA64.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2011-07-12 12558440]
"ETDWare"="c:\program files\Elantech\ETDCtrl.exe" [2009-09-30 621440]
.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp
.
------- Supplementary Scan -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://
www.mystart.com/?pr=jomedia&id=dlsecuretb&v=1_0
mDefault_Page_URL = hxxp://
www.delta-homes.com/?utm_source=b&utm_medium=newgdp&utm_campaign=eXQ&utm_content=hp&from=newgdp&uid=ST9500325AS_6VEF2WERXXXX6VEF2WER&ts=1380315251
mStart Page = hxxp://
www.delta-homes.com/?utm_source=b&utm_medium=newgdp&utm_campaign=eXQ&utm_content=hp&from=newgdp&uid=ST9500325AS_6VEF2WERXXXX6VEF2WER&ts=1380315251
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = *.local
IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~1\Office12\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.0.1
FF - ProfilePath - c:\users\asus\AppData\Roaming\Mozilla\Firefox\Profiles\1dl1g3uh.default\
FF - prefs.js: browser.search.defaulturl - hxxp://websearch.oversearch.info/?pid=377&r=2013/09/27&hid=7999862110529698590&lg=EN&cc=ID&unqvl=36&l=1&q=
FF - prefs.js: browser.search.selectedEngine - Search The Web
FF - prefs.js: browser.startup.homepage - hxxp://
www.mystart.com/?pr=jomedia&id=dlsecuretb&v=1_0
FF - prefs.js: keyword.URL - hxxp://websearch.oversearch.info/?pid=377&r=2013/09/27&hid=7999862110529698590&lg=EN&cc=ID&unqvl=36&l=1&q=
FF - user.js: nglayout.initialpaint.delay - 600
FF - user.js: content.notify.interval - 600000
FF - user.js: content.max.tokenizing.time - 1800000
FF - user.js: content.switch.threshold - 600000
FF - user.js: network.http.max-persistent-connections-per-server - 4
.
- - - - ORPHANS REMOVED - - - -
.
BHO-{1A10710D-AEFD-278B-57B4-11C3CBC5A32A} - (no file)
Wow6432Node-HKU-Default-RunOnce-SPReview - c:\windows\System32\SPReview\SPReview.exe
.
.
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_USERS\S-1-5-21-2490425179-759466278-4202775785-1000\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{9CCDEE8A-C9F3-3F0F-9B6E-048A66B6B031}*]
"jaajepgbffkcgadomfgh"=hex:63,61,70,67,68,66,00,00
"paigdpkojdgniijjlnhllkonmkhkkmko"=hex:62,61,65,66,00,66
"haajepgbffkcgado"=hex:61,61,00,00
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0004\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0005\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0006\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0007\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0008\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0009\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0010\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0011\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Completion time: 2014-03-26 14:12:43
ComboFix-quarantined-files.txt 2014-03-26 07:12
.
Pre-Run: 89,683,578,880 bytes free
Post-Run: 89,583,300,608 bytes free
.
- - End Of File - - 22A8BCED227FC924431A0F3AF2A22A4F
A36C5E4F47E84449FF07ED3517B43A31