ComboFix 13-05-21.01 - Dell D531 21/05/2013 17:57:18.1.2 - x64
Microsoft Windows 7 Ultimate 6.1.7601.1.1252.44.1033.18.1918.821 [GMT 1:00]
Running from: c:\users\Dell D531\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PYVVOWPB\ComboFix.exe
AV: avast! Antivirus *Disabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}
SP: avast! Antivirus *Disabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681}
SP: Windows Defender *Enabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\program files (x86)\Common Files\337
c:\program files (x86)\Common Files\337\libcef\1.1364.1123\icudt.dll
c:\program files (x86)\Common Files\337\libcef\1.1364.1123\libcef.dll
c:\program files (x86)\Common Files\337\libcef\1.1364.1123\locales\en-US.pak
c:\programdata\1361625835.bdinstall.bin
c:\users\Dell D531\AppData\Roaming\337
c:\users\Dell D531\AppData\Roaming\337\337 Wallpaper\ebase.dll
c:\users\Dell D531\AppData\Roaming\337\337 Wallpaper\image\default\app_close.png
c:\users\Dell D531\AppData\Roaming\337\337 Wallpaper\image\default\app_max.png
c:\users\Dell D531\AppData\Roaming\337\337 Wallpaper\image\default\app_min.png
c:\users\Dell D531\AppData\Roaming\337\337 Wallpaper\image\default\app_restore.png
c:\users\Dell D531\AppData\Roaming\337\337 Wallpaper\image\default\wallpaper_resource.xml
c:\users\Dell D531\AppData\Roaming\337\337 Wallpaper\image\default\window.png
c:\users\Dell D531\AppData\Roaming\337\337 Wallpaper\language\en_us\wallpaper_lang.ini
c:\users\Dell D531\AppData\Roaming\337\337 Wallpaper\language\es_es\wallpaper_lang.ini
c:\users\Dell D531\AppData\Roaming\337\337 Wallpaper\language\pt_br\wallpaper_lang.ini
c:\users\Dell D531\AppData\Roaming\337\337 Wallpaper\language\tr_tr\wallpaper_lang.ini
c:\users\Dell D531\AppData\Roaming\337\337 Wallpaper\language\zh_tw\wallpaper_lang.ini
c:\users\Dell D531\AppData\Roaming\337\337 Wallpaper\layout\default\dp_appwnd.xml
c:\users\Dell D531\AppData\Roaming\337\337 Wallpaper\layout\default\msgbox.xml
c:\users\Dell D531\AppData\Roaming\337\337 Wallpaper\libpng.dll
c:\users\Dell D531\AppData\Roaming\337\337 Wallpaper\main
c:\users\Dell D531\AppData\Roaming\337\337 Wallpaper\msvcp100.dll
c:\users\Dell D531\AppData\Roaming\337\337 Wallpaper\msvcr100.dll
c:\users\Dell D531\AppData\Roaming\337\337 Wallpaper\ouilibnl.dll
c:\users\Dell D531\AppData\Roaming\337\337 Wallpaper\plusapp.exe
c:\users\Dell D531\AppData\Roaming\337\337 Wallpaper\style\wallpaper_style.xml
c:\users\Dell D531\AppData\Roaming\337\337 Wallpaper\TrayDownloader.exe
.
.
((((((((((((((((((((((((( Files Created from 2013-04-21 to 2013-05-21 )))))))))))))))))))))))))))))))
.
.
2013-05-21 17:04 . 2013-05-21 17:04 -------- d-----w- c:\users\Default\AppData\Local\temp
2013-05-21 17:01 . 2013-05-21 17:01 76232 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{2C0B168E-8A03-4283-94C8-5B55C9EF7D9D}\offreg.dll
2013-05-20 13:23 . 2013-05-20 13:23 12872 ----a-w- c:\windows\system32\bootdelete.exe
2013-05-20 13:15 . 2013-05-20 13:15 -------- d-----w- c:\program files\HitmanPro
2013-05-20 13:15 . 2013-05-20 13:25 -------- d-----w- c:\programdata\HitmanPro
2013-05-19 18:59 . 2013-05-19 18:59 388096 ----a-r- c:\users\Dell D531\AppData\Roaming\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2013-05-19 18:59 . 2013-05-19 18:59 -------- d-----w- c:\program files (x86)\Trend Micro
2013-05-19 18:21 . 2013-05-19 18:21 -------- d-----w- c:\users\Dell D531\AppData\Roaming\Malwarebytes
2013-05-19 18:20 . 2013-05-19 18:20 -------- d-----w- c:\programdata\Malwarebytes
2013-05-19 18:19 . 2013-05-19 18:19 -------- d-----w- c:\users\Dell D531\AppData\Local\Programs
2013-05-18 11:34 . 2013-05-18 11:34 -------- d-----w- c:\users\Dell D531\AppData\Roaming\LavasoftStatistics
2013-05-17 20:24 . 2013-05-17 20:30 -------- d-----w- c:\programdata\Ad-Aware Antivirus
2013-05-17 20:05 . 2013-05-17 20:05 -------- d-----w- c:\programdata\Lavasoft
2013-05-17 20:05 . 2013-05-21 16:22 -------- d-----w- c:\program files (x86)\Ad-Aware Antivirus
2013-05-17 20:05 . 2013-05-17 20:05 -------- d-----w- c:\programdata\Downloaded Installations
2013-05-17 20:05 . 2013-05-21 16:09 -------- d-----w- c:\programdata\Search Protection
2013-05-17 20:03 . 2013-05-18 11:34 14456 ----a-w- c:\windows\system32\drivers\gfibto.sys
2013-05-17 20:03 . 2013-05-17 21:01 -------- d-----w- c:\users\Dell D531\AppData\Roaming\Ad-Aware Antivirus
2013-05-17 19:11 . 2013-05-17 19:11 -------- d-----w- c:\users\Dell D531\AppData\Roaming\SparkTrust
2013-05-17 19:11 . 2013-05-17 19:11 -------- d-----w- c:\users\Dell D531\AppData\Roaming\DriverCure
2013-05-17 19:11 . 2013-05-19 18:44 -------- d-----w- c:\programdata\SparkTrust
2013-05-17 17:56 . 2013-05-17 17:56 -------- d-----w- c:\program files (x86)\Anvisoft
2013-05-17 17:47 . 2013-05-17 17:47 -------- d-----w- c:\windows\system32\appmgmt
2013-05-17 15:39 . 2013-05-17 15:39 27648 ----a-w- c:\windows\system32\licmgr10.dll
2013-05-17 14:27 . 2013-05-17 14:27 -------- d-----w- c:\program files\Enigma Software Group
2013-05-17 14:26 . 2013-05-17 17:48 -------- d-----w- c:\windows\BCD5545077AC4347B24F654B1189F8D4.TMP
2013-05-17 14:25 . 2013-05-17 14:25 -------- d-----w- c:\program files (x86)\Common Files\Wise Installation Wizard
2013-05-17 13:36 . 2013-04-10 06:01 265064 ----a-w- c:\windows\system32\drivers\dxgmms1.sys
2013-05-17 13:36 . 2013-04-10 06:01 983400 ----a-w- c:\windows\system32\drivers\dxgkrnl.sys
2013-05-17 13:36 . 2011-02-03 11:25 144384 ----a-w- c:\windows\system32\cdd.dll
2013-05-17 13:34 . 2013-01-24 06:01 223752 ----a-w- c:\windows\system32\drivers\fvevol.sys
2013-05-17 13:34 . 2013-03-19 06:04 5550424 ----a-w- c:\windows\system32\ntoskrnl.exe
2013-05-17 13:34 . 2013-03-19 05:04 3968856 ----a-w- c:\windows\SysWow64\ntkrnlpa.exe
2013-05-17 13:34 . 2013-03-19 05:04 3913560 ----a-w- c:\windows\SysWow64\ntoskrnl.exe
2013-05-17 13:34 . 2013-03-19 05:46 43520 ----a-w- c:\windows\system32\csrsrv.dll
2013-05-17 13:34 . 2013-03-19 03:06 112640 ----a-w- c:\windows\system32\smss.exe
2013-05-17 13:34 . 2013-03-19 04:47 6656 ----a-w- c:\windows\SysWow64\apisetschema.dll
2013-05-17 13:08 . 2013-05-17 13:10 -------- d-----w- c:\users\Dell D531\AppData\Roaming\337 Wallpaper
2013-05-17 12:49 . 2013-05-17 13:07 -------- d-----w- c:\programdata\eSafe
2013-05-17 12:49 . 2013-05-17 13:06 -------- d-----w- c:\program files (x86)\Desk 365
2013-05-17 12:49 . 2013-05-17 12:49 -------- d-----w- c:\users\Dell D531\AppData\Roaming\Desk 365
2013-05-17 12:48 . 2013-05-17 12:55 -------- d-----w- c:\users\Dell D531\AppData\Roaming\eIntaller
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-05-03 15:15 . 2013-02-21 21:30 75016696 ----a-w- c:\windows\system32\MRT.exe
2013-04-13 05:49 . 2013-05-17 13:35 135168 ----a-w- c:\windows\apppatch\AppPatch64\AcXtrnal.dll
2013-04-13 05:49 . 2013-05-17 13:35 308736 ----a-w- c:\windows\apppatch\AppPatch64\AcGenral.dll
2013-04-13 05:49 . 2013-05-17 13:35 350208 ----a-w- c:\windows\apppatch\AppPatch64\AcLayers.dll
2013-04-13 05:49 . 2013-05-17 13:35 111104 ----a-w- c:\windows\apppatch\AppPatch64\acspecfc.dll
2013-04-13 04:45 . 2013-05-17 13:35 474624 ----a-w- c:\windows\apppatch\AcSpecfc.dll
2013-04-13 04:45 . 2013-05-17 13:35 2176512 ----a-w- c:\windows\apppatch\AcGenral.dll
2013-03-01 13:24 . 2013-03-01 13:23 4368720 ----a-w- c:\windows\SysWow64\mfc100u.dll
2013-02-22 10:51 . 2009-07-14 02:36 175616 ----a-w- c:\windows\system32\msclmd.dll
2013-02-22 10:51 . 2009-07-14 02:36 152576 ----a-w- c:\windows\SysWow64\msclmd.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-20 1475584]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"BCSSync"="c:\program files (x86)\Microsoft Office\Office14\BCSSync.exe" [2010-01-21 91520]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-12-18 946352]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
R1 aswSnx;aswSnx; [x]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R3 esgiguard;esgiguard;c:\program files\Enigma Software Group\SpyHunter\esgiguard.sys [x]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [2012-08-23 19456]
R3 Synth3dVsc;Synth3dVsc;c:\windows\system32\drivers\synth3dvsc.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2012-08-23 57856]
R3 tsusbhub;tsusbhub;c:\windows\system32\drivers\tsusbhub.sys [x]
R3 VGPU;VGPU;c:\windows\system32\drivers\rdvgkmd.sys [x]
S0 gfibto;gfibto;c:\windows\system32\drivers\gfibto.sys [2013-05-18 14456]
S1 aswSP;aswSP; [x]
S2 aswFsBlk;aswFsBlk; [x]
S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [2012-10-30 71600]
S3 SrvHsfHDA;SrvHsfHDA;c:\windows\system32\DRIVERS\VSTAZL6.SYS [2009-06-10 292864]
S3 SrvHsfV92;SrvHsfV92;c:\windows\system32\DRIVERS\VSTDPV6.SYS [2009-06-10 1485312]
S3 SrvHsfWinac;SrvHsfWinac;c:\windows\system32\DRIVERS\VSTCNXT6.SYS [2009-06-10 740864]
.
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2013-05-17 12:35 1642448 ----a-w- c:\program files (x86)\Google\Chrome\Application\26.0.1410.64\Installer\chrmstp.exe
.
Contents of the 'Scheduled Tasks' folder
.
2013-05-21 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2013-02-22 14:22]
.
2013-05-21 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2013-02-22 14:22]
.
.
--------- X64 Entries -----------
.
.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - LocalService
FontCache
.
------- Supplementary Scan -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://securesearch.lavasoft.com/?source=f439e2c0&tbp=homepage&toolbarid=adawaretb&v=2_5&u=E76EE8B7297682433480C951968D5B13
mLocal Page = c:\windows\SysWOW64\blank.htm
TCP: DhcpNameServer = 192.168.0.1
.
- - - - ORPHANS REMOVED - - - -
.
Wow6432Node-HKLM-Run-SearchProtection - c:\programdata\Search Protection\_run.bat
HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start
ShellIconOverlayIdentifiers-{152C96EB-288E-4EDC-B7C6-D21F8250ADF3} - c:\program files\Bitdefender\Bitdefender SafeBox\safeboxshell.dll
ShellIconOverlayIdentifiers-{342DAA0B-D796-460D-8566-901E08A1CCAD} - c:\program files\Bitdefender\Bitdefender SafeBox\safeboxshell.dll
ShellIconOverlayIdentifiers-{57595DAE-1AE1-4D97-A49E-67CBB53B52DF} - c:\program files\Bitdefender\Bitdefender SafeBox\safeboxshell.dll
ShellIconOverlayIdentifiers-{33816773-98AE-4723-ADE0-EBE54C8B5A67} - c:\program files\Bitdefender\Bitdefender SafeBox\safeboxshell.dll
HKLM-Run-BDAgent - c:\program files\Bitdefender\Bitdefender 2012\bdagent.exe
AddRemove-{8E34682C-8118-31F1-BC4C-98CD9675E1C2}.KB2468871 - c:\windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\Extended\setup.exe
AddRemove-{8E34682C-8118-31F1-BC4C-98CD9675E1C2}.KB2487367 - c:\windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\Extended\setup.exe
AddRemove-{8E34682C-8118-31F1-BC4C-98CD9675E1C2}.KB2533523 - c:\windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\Extended\setup.exe
AddRemove-{8E34682C-8118-31F1-BC4C-98CD9675E1C2}.KB2600217 - c:\windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\Extended\setup.exe
AddRemove-{8E34682C-8118-31F1-BC4C-98CD9675E1C2}.KB2656351 - c:\windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\Extended\setup.exe
AddRemove-{8E34682C-8118-31F1-BC4C-98CD9675E1C2}.KB2736428 - c:\windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\Extended\setup.exe
AddRemove-{8E34682C-8118-31F1-BC4C-98CD9675E1C2}.KB2742595 - c:\windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\Extended\setup.exe
.
.
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]
@Denied: (A) (Everyone)
"Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3]
@Denied: (A) (Everyone)
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0]
"Key"="ActionsPane3"
"Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Nico Mak Computing\WinZip]
"SymbolicLinkValue"=hex(6):5c,00,52,00,65,00,67,00,69,00,73,00,74,00,72,00,79,
00,5c,00,4d,00,41,00,43,00,48,00,49,00,4e,00,45,00,5c,00,53,00,6f,00,66,00,\
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Completion time: 2013-05-21 18:07:49
ComboFix-quarantined-files.txt 2013-05-21 17:07
.
Pre-Run: 49,465,724,928 bytes free
Post-Run: 49,920,872,448 bytes free
.
- - End Of File - - E93F1639D02C3EFA013C8B4130CABE1F
Microsoft Windows 7 Ultimate 6.1.7601.1.1252.44.1033.18.1918.821 [GMT 1:00]
Running from: c:\users\Dell D531\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PYVVOWPB\ComboFix.exe
AV: avast! Antivirus *Disabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}
SP: avast! Antivirus *Disabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681}
SP: Windows Defender *Enabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\program files (x86)\Common Files\337
c:\program files (x86)\Common Files\337\libcef\1.1364.1123\icudt.dll
c:\program files (x86)\Common Files\337\libcef\1.1364.1123\libcef.dll
c:\program files (x86)\Common Files\337\libcef\1.1364.1123\locales\en-US.pak
c:\programdata\1361625835.bdinstall.bin
c:\users\Dell D531\AppData\Roaming\337
c:\users\Dell D531\AppData\Roaming\337\337 Wallpaper\ebase.dll
c:\users\Dell D531\AppData\Roaming\337\337 Wallpaper\image\default\app_close.png
c:\users\Dell D531\AppData\Roaming\337\337 Wallpaper\image\default\app_max.png
c:\users\Dell D531\AppData\Roaming\337\337 Wallpaper\image\default\app_min.png
c:\users\Dell D531\AppData\Roaming\337\337 Wallpaper\image\default\app_restore.png
c:\users\Dell D531\AppData\Roaming\337\337 Wallpaper\image\default\wallpaper_resource.xml
c:\users\Dell D531\AppData\Roaming\337\337 Wallpaper\image\default\window.png
c:\users\Dell D531\AppData\Roaming\337\337 Wallpaper\language\en_us\wallpaper_lang.ini
c:\users\Dell D531\AppData\Roaming\337\337 Wallpaper\language\es_es\wallpaper_lang.ini
c:\users\Dell D531\AppData\Roaming\337\337 Wallpaper\language\pt_br\wallpaper_lang.ini
c:\users\Dell D531\AppData\Roaming\337\337 Wallpaper\language\tr_tr\wallpaper_lang.ini
c:\users\Dell D531\AppData\Roaming\337\337 Wallpaper\language\zh_tw\wallpaper_lang.ini
c:\users\Dell D531\AppData\Roaming\337\337 Wallpaper\layout\default\dp_appwnd.xml
c:\users\Dell D531\AppData\Roaming\337\337 Wallpaper\layout\default\msgbox.xml
c:\users\Dell D531\AppData\Roaming\337\337 Wallpaper\libpng.dll
c:\users\Dell D531\AppData\Roaming\337\337 Wallpaper\main
c:\users\Dell D531\AppData\Roaming\337\337 Wallpaper\msvcp100.dll
c:\users\Dell D531\AppData\Roaming\337\337 Wallpaper\msvcr100.dll
c:\users\Dell D531\AppData\Roaming\337\337 Wallpaper\ouilibnl.dll
c:\users\Dell D531\AppData\Roaming\337\337 Wallpaper\plusapp.exe
c:\users\Dell D531\AppData\Roaming\337\337 Wallpaper\style\wallpaper_style.xml
c:\users\Dell D531\AppData\Roaming\337\337 Wallpaper\TrayDownloader.exe
.
.
((((((((((((((((((((((((( Files Created from 2013-04-21 to 2013-05-21 )))))))))))))))))))))))))))))))
.
.
2013-05-21 17:04 . 2013-05-21 17:04 -------- d-----w- c:\users\Default\AppData\Local\temp
2013-05-21 17:01 . 2013-05-21 17:01 76232 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{2C0B168E-8A03-4283-94C8-5B55C9EF7D9D}\offreg.dll
2013-05-20 13:23 . 2013-05-20 13:23 12872 ----a-w- c:\windows\system32\bootdelete.exe
2013-05-20 13:15 . 2013-05-20 13:15 -------- d-----w- c:\program files\HitmanPro
2013-05-20 13:15 . 2013-05-20 13:25 -------- d-----w- c:\programdata\HitmanPro
2013-05-19 18:59 . 2013-05-19 18:59 388096 ----a-r- c:\users\Dell D531\AppData\Roaming\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2013-05-19 18:59 . 2013-05-19 18:59 -------- d-----w- c:\program files (x86)\Trend Micro
2013-05-19 18:21 . 2013-05-19 18:21 -------- d-----w- c:\users\Dell D531\AppData\Roaming\Malwarebytes
2013-05-19 18:20 . 2013-05-19 18:20 -------- d-----w- c:\programdata\Malwarebytes
2013-05-19 18:19 . 2013-05-19 18:19 -------- d-----w- c:\users\Dell D531\AppData\Local\Programs
2013-05-18 11:34 . 2013-05-18 11:34 -------- d-----w- c:\users\Dell D531\AppData\Roaming\LavasoftStatistics
2013-05-17 20:24 . 2013-05-17 20:30 -------- d-----w- c:\programdata\Ad-Aware Antivirus
2013-05-17 20:05 . 2013-05-17 20:05 -------- d-----w- c:\programdata\Lavasoft
2013-05-17 20:05 . 2013-05-21 16:22 -------- d-----w- c:\program files (x86)\Ad-Aware Antivirus
2013-05-17 20:05 . 2013-05-17 20:05 -------- d-----w- c:\programdata\Downloaded Installations
2013-05-17 20:05 . 2013-05-21 16:09 -------- d-----w- c:\programdata\Search Protection
2013-05-17 20:03 . 2013-05-18 11:34 14456 ----a-w- c:\windows\system32\drivers\gfibto.sys
2013-05-17 20:03 . 2013-05-17 21:01 -------- d-----w- c:\users\Dell D531\AppData\Roaming\Ad-Aware Antivirus
2013-05-17 19:11 . 2013-05-17 19:11 -------- d-----w- c:\users\Dell D531\AppData\Roaming\SparkTrust
2013-05-17 19:11 . 2013-05-17 19:11 -------- d-----w- c:\users\Dell D531\AppData\Roaming\DriverCure
2013-05-17 19:11 . 2013-05-19 18:44 -------- d-----w- c:\programdata\SparkTrust
2013-05-17 17:56 . 2013-05-17 17:56 -------- d-----w- c:\program files (x86)\Anvisoft
2013-05-17 17:47 . 2013-05-17 17:47 -------- d-----w- c:\windows\system32\appmgmt
2013-05-17 15:39 . 2013-05-17 15:39 27648 ----a-w- c:\windows\system32\licmgr10.dll
2013-05-17 14:27 . 2013-05-17 14:27 -------- d-----w- c:\program files\Enigma Software Group
2013-05-17 14:26 . 2013-05-17 17:48 -------- d-----w- c:\windows\BCD5545077AC4347B24F654B1189F8D4.TMP
2013-05-17 14:25 . 2013-05-17 14:25 -------- d-----w- c:\program files (x86)\Common Files\Wise Installation Wizard
2013-05-17 13:36 . 2013-04-10 06:01 265064 ----a-w- c:\windows\system32\drivers\dxgmms1.sys
2013-05-17 13:36 . 2013-04-10 06:01 983400 ----a-w- c:\windows\system32\drivers\dxgkrnl.sys
2013-05-17 13:36 . 2011-02-03 11:25 144384 ----a-w- c:\windows\system32\cdd.dll
2013-05-17 13:34 . 2013-01-24 06:01 223752 ----a-w- c:\windows\system32\drivers\fvevol.sys
2013-05-17 13:34 . 2013-03-19 06:04 5550424 ----a-w- c:\windows\system32\ntoskrnl.exe
2013-05-17 13:34 . 2013-03-19 05:04 3968856 ----a-w- c:\windows\SysWow64\ntkrnlpa.exe
2013-05-17 13:34 . 2013-03-19 05:04 3913560 ----a-w- c:\windows\SysWow64\ntoskrnl.exe
2013-05-17 13:34 . 2013-03-19 05:46 43520 ----a-w- c:\windows\system32\csrsrv.dll
2013-05-17 13:34 . 2013-03-19 03:06 112640 ----a-w- c:\windows\system32\smss.exe
2013-05-17 13:34 . 2013-03-19 04:47 6656 ----a-w- c:\windows\SysWow64\apisetschema.dll
2013-05-17 13:08 . 2013-05-17 13:10 -------- d-----w- c:\users\Dell D531\AppData\Roaming\337 Wallpaper
2013-05-17 12:49 . 2013-05-17 13:07 -------- d-----w- c:\programdata\eSafe
2013-05-17 12:49 . 2013-05-17 13:06 -------- d-----w- c:\program files (x86)\Desk 365
2013-05-17 12:49 . 2013-05-17 12:49 -------- d-----w- c:\users\Dell D531\AppData\Roaming\Desk 365
2013-05-17 12:48 . 2013-05-17 12:55 -------- d-----w- c:\users\Dell D531\AppData\Roaming\eIntaller
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-05-03 15:15 . 2013-02-21 21:30 75016696 ----a-w- c:\windows\system32\MRT.exe
2013-04-13 05:49 . 2013-05-17 13:35 135168 ----a-w- c:\windows\apppatch\AppPatch64\AcXtrnal.dll
2013-04-13 05:49 . 2013-05-17 13:35 308736 ----a-w- c:\windows\apppatch\AppPatch64\AcGenral.dll
2013-04-13 05:49 . 2013-05-17 13:35 350208 ----a-w- c:\windows\apppatch\AppPatch64\AcLayers.dll
2013-04-13 05:49 . 2013-05-17 13:35 111104 ----a-w- c:\windows\apppatch\AppPatch64\acspecfc.dll
2013-04-13 04:45 . 2013-05-17 13:35 474624 ----a-w- c:\windows\apppatch\AcSpecfc.dll
2013-04-13 04:45 . 2013-05-17 13:35 2176512 ----a-w- c:\windows\apppatch\AcGenral.dll
2013-03-01 13:24 . 2013-03-01 13:23 4368720 ----a-w- c:\windows\SysWow64\mfc100u.dll
2013-02-22 10:51 . 2009-07-14 02:36 175616 ----a-w- c:\windows\system32\msclmd.dll
2013-02-22 10:51 . 2009-07-14 02:36 152576 ----a-w- c:\windows\SysWow64\msclmd.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-20 1475584]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"BCSSync"="c:\program files (x86)\Microsoft Office\Office14\BCSSync.exe" [2010-01-21 91520]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-12-18 946352]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
R1 aswSnx;aswSnx; [x]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R3 esgiguard;esgiguard;c:\program files\Enigma Software Group\SpyHunter\esgiguard.sys [x]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [2012-08-23 19456]
R3 Synth3dVsc;Synth3dVsc;c:\windows\system32\drivers\synth3dvsc.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2012-08-23 57856]
R3 tsusbhub;tsusbhub;c:\windows\system32\drivers\tsusbhub.sys [x]
R3 VGPU;VGPU;c:\windows\system32\drivers\rdvgkmd.sys [x]
S0 gfibto;gfibto;c:\windows\system32\drivers\gfibto.sys [2013-05-18 14456]
S1 aswSP;aswSP; [x]
S2 aswFsBlk;aswFsBlk; [x]
S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [2012-10-30 71600]
S3 SrvHsfHDA;SrvHsfHDA;c:\windows\system32\DRIVERS\VSTAZL6.SYS [2009-06-10 292864]
S3 SrvHsfV92;SrvHsfV92;c:\windows\system32\DRIVERS\VSTDPV6.SYS [2009-06-10 1485312]
S3 SrvHsfWinac;SrvHsfWinac;c:\windows\system32\DRIVERS\VSTCNXT6.SYS [2009-06-10 740864]
.
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2013-05-17 12:35 1642448 ----a-w- c:\program files (x86)\Google\Chrome\Application\26.0.1410.64\Installer\chrmstp.exe
.
Contents of the 'Scheduled Tasks' folder
.
2013-05-21 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2013-02-22 14:22]
.
2013-05-21 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2013-02-22 14:22]
.
.
--------- X64 Entries -----------
.
.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - LocalService
FontCache
.
------- Supplementary Scan -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://securesearch.lavasoft.com/?source=f439e2c0&tbp=homepage&toolbarid=adawaretb&v=2_5&u=E76EE8B7297682433480C951968D5B13
mLocal Page = c:\windows\SysWOW64\blank.htm
TCP: DhcpNameServer = 192.168.0.1
.
- - - - ORPHANS REMOVED - - - -
.
Wow6432Node-HKLM-Run-SearchProtection - c:\programdata\Search Protection\_run.bat
HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start
ShellIconOverlayIdentifiers-{152C96EB-288E-4EDC-B7C6-D21F8250ADF3} - c:\program files\Bitdefender\Bitdefender SafeBox\safeboxshell.dll
ShellIconOverlayIdentifiers-{342DAA0B-D796-460D-8566-901E08A1CCAD} - c:\program files\Bitdefender\Bitdefender SafeBox\safeboxshell.dll
ShellIconOverlayIdentifiers-{57595DAE-1AE1-4D97-A49E-67CBB53B52DF} - c:\program files\Bitdefender\Bitdefender SafeBox\safeboxshell.dll
ShellIconOverlayIdentifiers-{33816773-98AE-4723-ADE0-EBE54C8B5A67} - c:\program files\Bitdefender\Bitdefender SafeBox\safeboxshell.dll
HKLM-Run-BDAgent - c:\program files\Bitdefender\Bitdefender 2012\bdagent.exe
AddRemove-{8E34682C-8118-31F1-BC4C-98CD9675E1C2}.KB2468871 - c:\windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\Extended\setup.exe
AddRemove-{8E34682C-8118-31F1-BC4C-98CD9675E1C2}.KB2487367 - c:\windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\Extended\setup.exe
AddRemove-{8E34682C-8118-31F1-BC4C-98CD9675E1C2}.KB2533523 - c:\windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\Extended\setup.exe
AddRemove-{8E34682C-8118-31F1-BC4C-98CD9675E1C2}.KB2600217 - c:\windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\Extended\setup.exe
AddRemove-{8E34682C-8118-31F1-BC4C-98CD9675E1C2}.KB2656351 - c:\windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\Extended\setup.exe
AddRemove-{8E34682C-8118-31F1-BC4C-98CD9675E1C2}.KB2736428 - c:\windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\Extended\setup.exe
AddRemove-{8E34682C-8118-31F1-BC4C-98CD9675E1C2}.KB2742595 - c:\windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\Extended\setup.exe
.
.
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]
@Denied: (A) (Everyone)
"Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3]
@Denied: (A) (Everyone)
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0]
"Key"="ActionsPane3"
"Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Nico Mak Computing\WinZip]
"SymbolicLinkValue"=hex(6):5c,00,52,00,65,00,67,00,69,00,73,00,74,00,72,00,79,
00,5c,00,4d,00,41,00,43,00,48,00,49,00,4e,00,45,00,5c,00,53,00,6f,00,66,00,\
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Completion time: 2013-05-21 18:07:49
ComboFix-quarantined-files.txt 2013-05-21 17:07
.
Pre-Run: 49,465,724,928 bytes free
Post-Run: 49,920,872,448 bytes free
.
- - End Of File - - E93F1639D02C3EFA013C8B4130CABE1F