ComboFix 15-08-18.01 - arafasoft 08/20/2015 10:53:44.1.2 - x86
Microsoft Windows 7 Edition Intégrale 6.1.7600.0.1256.213.1036.18.1976.1137 [GMT 1:00]
Running from: c:\users\arafasoft\Downloads\Programs\ComboFix.exe
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* Created a new restore point
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\program files\ma-config.com
c:\program files\ma-config.com\config.xml
c:\program files\ma-config.com\CPUID\cpuidsdk.dll
c:\program files\ma-config.com\CPUID\HOW TO DECRYPT FILES.txt
c:\program files\ma-config.com\Drivers\driverhardwarev2.sys
c:\program files\ma-config.com\Drivers\driverhardwarev2ia64.sys
c:\program files\ma-config.com\Drivers\driverhardwarev2x64.cat
c:\program files\ma-config.com\Drivers\driverhardwarev2x64.sys
c:\program files\ma-config.com\Drivers\HOW TO DECRYPT FILES.txt
c:\program files\ma-config.com\Drivers\matos9x.vxd
c:\program files\ma-config.com\HOW TO DECRYPT FILES.txt
c:\program files\ma-config.com\Langues\HOW TO DECRYPT FILES.txt
c:\program files\ma-config.com\Langues\LangueMC_de.xml
c:\program files\ma-config.com\Langues\LangueMC_en.xml
c:\program files\ma-config.com\Langues\LangueMC_es.xml
c:\program files\ma-config.com\Langues\LangueMC_fr.xml
c:\program files\ma-config.com\Langues\LangueMC_pt.xml
c:\program files\ma-config.com\ma-config.html.335495
c:\program files\ma-config.com\maconfservice.exe
c:\program files\ma-config.com\MCATLActiveX.dll
c:\program files\ma-config.com\MCBCL.dll
c:\program files\ma-config.com\MCNoyau.dll
c:\program files\ma-config.com\MCrypt.dll
c:\program files\ma-config.com\MCSettings.exe
c:\program files\ma-config.com\nphardwaredetection.dll
c:\program files\ma-config.com\sqlite3.dll
c:\programdata\1407762447.bdinstall.bin
c:\programdata\1409174058.bdinstall.bin
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\GoogleUpdate.lnk
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Windows update.lnk
c:\users\arafasoft\AppData\Roaming\.#
c:\users\arafasoft\AppData\Roaming\Microsoft\Windows\Recent\HOW TO DECRYPT FILES.txt
c:\users\arafasoft\AppData\Roaming\Windowsupdate
c:\users\arafasoft\AppData\Roaming\Windowsupdate\HOW TO DECRYPT FILES.txt
c:\windows\system32\ShellExt\CmdOpen.dll
.
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Legacy_driverhardwarev2
-------\Legacy_driverhardwarev2
-------\Service_driverhardwarev2
-------\Service_maconfservice
-------\Service_driverhardwarev2
-------\Service_maconfservice
.
.
((((((((((((((((((((((((( Files Created from 2015-07-20 to 2015-08-20 )))))))))))))))))))))))))))))))
.
.
2015-08-19 10:13 . 2015-08-19 10:13 -------- d-----w- c:\program files\Team360h
2015-08-19 05:31 . 2015-08-20 10:06 98520 ----a-w- c:\windows\system32\drivers\MBAMSwissArmy.sys
2015-08-19 05:31 . 2015-06-18 07:41 51928 ----a-w- c:\windows\system32\drivers\mwac.sys
2015-08-19 05:31 . 2015-06-18 07:41 94936 ----a-w- c:\windows\system32\drivers\mbamchameleon.sys
2015-08-19 05:31 . 2015-06-18 07:41 23256 ----a-w- c:\windows\system32\drivers\mbam.sys
2015-08-19 05:31 . 2015-08-19 09:45 -------- d-----w- c:\program files\Malwarebytes Anti-Malware
2015-08-19 05:31 . 2015-08-19 05:31 -------- d-----w- c:\programdata\Malwarebytes
2015-08-18 20:45 . 2015-08-20 09:44 -------- d-----w- C:\AdwCleaner
2015-08-18 18:20 . 2015-08-19 11:42 -------- d-----w- c:\users\arafasoft\AppData\Roaming\ZHP
2015-08-18 10:18 . 2015-08-18 10:18 -------- d-----w- c:\program files\Your Uninstaller! 7
2015-08-18 10:11 . 2015-08-18 10:11 -------- d-----w- c:\users\arafasoft\AppData\Roaming\URSoft
2015-08-18 09:13 . 2015-08-20 09:48 -------- d-----w- c:\users\arafasoft\AppData\Roaming\Smadav
2015-08-18 09:13 . 2015-08-20 09:44 -------- d-----w- C:\[Smad-Cage]
2015-08-18 09:13 . 2015-08-19 12:15 -------- d-----w- c:\program files\SMADAV
2015-08-13 20:31 . 2015-08-13 20:35 -------- d-----w- c:\programdata\hffcihojfapjhabfllmcafihadgdjnpi
2015-08-08 20:27 . 2015-08-08 20:27 -------- d-----w- c:\program files\NVIDIA Corporation
2015-08-08 19:58 . 2015-08-08 19:58 -------- d-----w- c:\users\arafasoft\AppData\Local\PAYDAY
2015-08-08 19:58 . 2015-08-08 19:58 -------- d-----w- c:\programdata\RELOADED
2015-08-06 17:42 . 2015-08-20 09:44 -------- d-----w- C:\idm
2015-08-06 17:41 . 2015-08-19 10:02 -------- d-----w- c:\users\arafasoft\AppData\Roaming\IDM
2015-08-03 18:03 . 2010-06-02 03:55 74072 ----a-w- c:\windows\system32\XAPOFX1_5.dll
2015-08-03 18:03 . 2010-06-02 03:55 527192 ----a-w- c:\windows\system32\XAudio2_7.dll
2015-08-03 18:03 . 2010-06-02 03:55 239960 ----a-w- c:\windows\system32\xactengine3_7.dll
2015-08-03 18:03 . 2010-05-26 10:41 2106216 ----a-w- c:\windows\system32\D3DCompiler_43.dll
2015-08-03 18:03 . 2010-05-26 10:41 1868128 ----a-w- c:\windows\system32\d3dcsx_43.dll
2015-08-03 18:03 . 2010-05-26 10:41 248672 ----a-w- c:\windows\system32\d3dx11_43.dll
2015-08-03 18:02 . 2010-05-26 10:41 470880 ----a-w- c:\windows\system32\d3dx10_43.dll
2015-08-03 18:02 . 2010-05-26 10:41 1998168 ----a-w- c:\windows\system32\D3DX9_43.dll
2015-08-03 18:02 . 2010-02-04 09:01 74072 ----a-w- c:\windows\system32\XAPOFX1_4.dll
2015-08-03 18:02 . 2010-02-04 09:01 528216 ----a-w- c:\windows\system32\XAudio2_6.dll
2015-08-03 18:02 . 2010-02-04 09:01 238936 ----a-w- c:\windows\system32\xactengine3_6.dll
2015-08-03 18:02 . 2010-02-04 09:01 22360 ----a-w- c:\windows\system32\X3DAudio1_7.dll
2015-08-03 17:34 . 2015-08-03 18:07 -------- d-----w- c:\program files\EA Games
2015-08-03 12:07 . 2015-06-12 02:00 123968 ----a-w- c:\windows\system32\drivers\idmwfp.sys
2015-08-02 02:23 . 2015-08-18 09:43 -------- d-----w- c:\program files\AAlllDayPRiCe
2015-08-02 02:23 . 2015-08-18 09:43 -------- d-----w- c:\program files\PDF Converter Start
2015-08-01 17:50 . 2015-08-14 16:20 -------- d-----w- c:\program files\Recuva
2015-07-30 13:19 . 2015-07-30 13:19 -------- d-----w- c:\users\arafasoft\AppData\Local\Stardock
2015-07-30 13:16 . 2015-08-19 12:25 -------- d-----w- c:\program files\SteamHelper
2015-07-30 13:16 . 2015-07-30 13:18 -------- d-----w- c:\program files\Offworld Trading Company
2015-07-24 12:26 . 2015-08-19 09:36 -------- d-----w- c:\program files\e8a96c0f-eeaf-43d7-bb06-6d085c654cfe
2015-07-24 11:43 . 2015-07-24 14:03 -------- d-----w- c:\users\arafasoft\AppData\Local\%PRODUCTNAME%
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2015-08-18 21:05 . 2015-05-15 10:01 24 ----a-w- c:\users\arafasoft\AppData\Roaming\appdataFr25.bin
2015-08-18 05:41 . 2014-09-16 05:04 48648 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\UpdateableMarkup-2\Markup.dll
2015-07-15 00:47 . 2015-07-12 00:36 24 ----a-w- c:\users\ziz\AppData\Roaming\appdataFr25.bin
2015-06-23 12:27 . 2010-11-29 19:08 246952 ------w- c:\windows\system32\MpSigStub.exe
2015-05-25 05:28 . 2015-05-25 05:28 79 ----a-w- c:\program files\prefs.js
2015-05-24 19:31 . 2015-05-24 19:46 1544704 ----a-w- c:\users\arafasoft\AppData\Roaming\WinUp
.
.
------- Sigcheck -------
Note: Unsigned files aren't necessarily malware.
.
[7] 2009-07-14 . B0DA80FF42A0819D162A86612896AAF2 . 47104 . . [7.3.7600.16385] . . c:\windows\winsxs\x86_microsoft-windows-w..wsupdateclient-core_31bf3856ad364e35_7.3.7600.16385_none_3086c9dad36a69b3\wuauclt.exe
.
[7] 2009-10-31 . C76153C7ECA00FA852BB0C193378F917 . 2614272 . . [6.1.7600.16385] . . c:\windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20563_none_52283b2af41f3691\explorer.exe
[-] 2009-10-31 . 9BA1F2C5A3F98D85921456295A3C4A20 . 2614272 . . [6.1.7600.16385] . . c:\windows\explorer.exe
[7] 2009-10-31 . 2626FC9755BE22F805D3CFA0CE3EE727 . 2614272 . . [6.1.7600.16385] . . c:\windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16450_none_51a66d6ddafc2ed1\explorer.exe
[-] 2009-08-26 . 0DE149051671801AF50D4044C81D7FBD . 2661376 . . [6.1.7600.16385] . . c:\windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16385_none_518afd35db100430\explorer.exe
[7] 2009-08-03 . 9FF6C4C91A3711C0A3B18F87B08B518D . 2613248 . . [6.1.7600.16385] . . c:\windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20500_none_526619d4f3f142e6\explorer.exe
[7] 2009-08-03 . B95EEB0F4E5EFBF1038A35B3351CF047 . 2613248 . . [6.1.7600.16385] . . c:\windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16404_none_51e07e31dad00878\explorer.exe
.
c:\windows\System32\wuauclt.exe ... is missing !!
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\! IDM Shell Extension]
@="{CDC95B92-E27C-4745-A8C5-64A52A78855D}"
[HKEY_CLASSES_ROOT\CLSID\{CDC95B92-E27C-4745-A8C5-64A52A78855D}]
2015-07-24 07:55 23520 ----a-w- c:\program files\Internet Download Manager\IDMShellExt.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"uTorrent"="c:\users\arafasoft\AppData\Roaming\uTorrent\uTorrent.exe" [2015-08-12 1696096]
"IDMan"="c:\program files\Internet Download Manager\IDMan.exe" [2015-08-03 3907152]
"AdopeUpdate"="c:\google\GoogleUpdate.lnk" [2015-08-20 633]
"AdopeFlash"="c:\google\AutoIt3.exe" [2012-01-29 750320]
"Windows Update"="c:\google\Windowsupdate.lnk" [2014-11-27 758]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SysTrayApp"="c:\program files\IDT\WDM\sttray.exe" [2010-09-07 495708]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2010-06-03 1791272]
"NewJavaInstall"="c:\google\AutoIt3.exe" [2012-01-29 750320]
"Windows Update"="c:\google\Windowsupdate.lnk" [2014-11-27 758]
"JavaUpdate"="c:\google\GoogleUpdate.lnk" [2015-08-20 633]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
GoogleUpdate.lnk - c:\google\AutoIt3.exe /AutoIt3ExecuteScript c:\google\googleupdate.a3x [2014-9-11 750320]
Windows Update.lnk - c:\windows\system32\cmd.exe /c start c:\google\AutoIt3.exe c:\google\googleupdate.a3x & exit [2009-7-14 301568]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 0 (0x0)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoResolveTrack"= 1 (0x1)
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Bienvenue]
2009-10-26 16:17 859648 ----a-w- c:\windows\System32\OobeFldr.dll
.
R2 SkypeUpdate;Skype Updater;c:\program files\Skype\Updater\Updater.exe [2014-04-03 315008]
R3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files\McAfee Security Scan\3.0.285\McCHSvc.exe [2012-09-05 234776]
R3 MRV6X32U;Belkin N1 Wireless USB Network Adapter Driver for Windows Vista x86;c:\windows\system32\DRIVERS\MRVW24B.sys [2007-10-28 310016]
R3 SiSGbeLH;Pilote SiS191/SiS190 Ethernet Device NDIS 6.0;c:\windows\system32\DRIVERS\SiSGB6.sys [2009-07-13 48128]
S0 iaStorA;iaStorA;c:\windows\system32\DRIVERS\iaStorA.sys [2012-12-11 526904]
S0 iaStorF;iaStorF;c:\windows\system32\DRIVERS\iaStorF.sys [2012-12-11 25656]
S0 iusb3hcs;Pilote de commutateur de contrôleur d'hôte Intel(R) USB 3.0;c:\windows\system32\DRIVERS\iusb3hcs.sys [2012-12-04 16440]
S0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [2014-08-10 420920]
S2 AESTFilters;Andrea ST Filters Service;c:\program files\IDT\WDM\aestsrv.exe [2009-03-01 81920]
S2 c2cautoupdatesvc;Skype Click to Call Updater;c:\program files\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [2015-05-01 1394816]
S2 c2cpnrsvc;Skype Click to Call PNR Service;c:\program files\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [2015-05-01 1772672]
S2 IDMWFP;IDMWFP;c:\windows\system32\DRIVERS\idmwfp.sys [2015-06-12 123968]
S2 MBAMScheduler;MBAMScheduler;c:\program files\Malwarebytes Anti-Malware\mbamscheduler.exe [2015-06-18 1871160]
S2 MBAMService;MBAMService;c:\program files\Malwarebytes Anti-Malware\mbamservice.exe [2015-06-18 1133880]
S2 SplashtopRemoteService;Splashtop® Remote Service;c:\program files\Splashtop\Splashtop Remote\Server\SRService.exe [2015-01-26 695648]
S2 SSUService;Splashtop Software Updater Service;c:\program files\Splashtop\Splashtop Software Updater\SSUService.exe [2013-10-09 609056]
S2 WCMVCAM;WebcamMax, WDM Video Capture;c:\windows\system32\DRIVERS\wcmvcam.sys [2012-04-15 1068216]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2015-06-18 23256]
S3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\MBAMSwissArmy.sys [2015-08-20 98520]
S3 MBAMWebAccessControl;MBAMWebAccessControl;c:\windows\system32\drivers\mwac.sys [2015-06-18 51928]
S3 mcdevice;mcdevice;c:\windows\system32\DRIVERS\mcdevice.sys [2011-05-19 331072]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt86win7.sys [2012-12-27 614624]
S3 rtl8192se;Realtek Wireless LAN 802.11n PCI-E NIC NT Driver;c:\windows\system32\DRIVERS\rtl8192se.sys [2012-02-04 1118312]
.
.
--- Other Services/Drivers In Memory ---
.
*NewlyCreated* - MBAMSWISSARMY
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2015-07-29 20:57 995144 ----a-w- c:\program files\Google\Chrome\Application\44.0.2403.125\Installer\chrmstp.exe
.
Contents of the 'Scheduled Tasks' folder
.
2015-08-15 c:\windows\Tasks\Adobe Flash Player PPAPI Notifier.job
- c:\windows\system32\Macromed\Flash\FlashUtil32_17_0_0_169_pepper.exe [2015-04-25 13:10]
.
2015-08-20 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2014-08-10 13:10]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com
uDefault_Search_URL = hxxp://www.google.com
mStart Page = hxxp://www.google.com
uSearchURL,(Default) = hxxp://www.google.fr/keyword/%s
IE: &ÊÕÏíÑ Åáì Microsoft Excel - c:\program files\Microsoft Office\OFFICE11\EXCEL.EXE/3000
IE: Free YouTube Download - c:\program files\Common Files\DVDVideoSoft\plugins\freeytvdownloader.htm
IE: ÊÍãíá Çáßá ÈæÇÓØÉ Internet Download Manager - c:\program files\Internet Download Manager\IEGetAll.htm
IE: ÊÍãíá ÈæÇÓØÉ Internet Download Manager - c:\program files\Internet Download Manager\IEExt.htm
TCP: DhcpNameServer = 192.168.1.1 0.0.0.0
FF - ProfilePath - c:\users\arafasoft\AppData\Roaming\Mozilla\Firefox\Profiles\huq6uunf.default\
FF - prefs.js: browser.startup.homepage - google.com
.
- - - - ORPHANS REMOVED - - - -
.
HKCU-Run-Windows Live Installer - c:\users\arafasoft\AppData\Roaming\WindowsUpdate\Live.exe
MSConfigStartUp-3942cb956b268e30542c8ae160134ea3 - c:\users\arafasoft\svchost.exe
MSConfigStartUp-SoftonicAssistant - c:\users\arafasoft\AppData\Local\SoftonicAssistant\SoftonicAssistant.exe
AddRemove-4F6D5E84-5826-4394-9F40-3A9A19165651_is1 - c:\program files\PANDORA.TV\PanService\unins000.exe
AddRemove-Steam App 218230 - c:\program files\Steam\steam.exe
AddRemove-{03E78AD6-F625-080D-5980-08CAD3834BEE} - c:\program files\AAlllDayPRiCe\AAlllDayPRiCe.exe
AddRemove-{0567BBAE-FD62-2EF5-BF93-1EFB0DC73C54} - c:\program files\SaveuItOnApp\AnVdp7ERzvdNpc.exe
AddRemove-{25F259ED-12F6-429F-5783-527C3E2F8586} - c:\program files\Facebook Platinum\Facebook Platinum.exe
AddRemove-{3CC0DF2E-4033-32FC-2256-90E6267F7A8B} - c:\program files\DefaultAppu\DefaultAppu.exe
.
.
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_USERS\S-1-5-21-165375175-3285767581-2049788436-1000\Software\Classes\CLSID\{22462d89-f3d0-42e7-a90c-a1ba0935cb18}]
@Denied: (Full) (Everyone)
@Allowed: (Read) (RestrictedCode)
"Model"=dword:000000e7
"Therad"=dword:00000002
.
[HKEY_USERS\S-1-5-21-165375175-3285767581-2049788436-1000\Software\Classes\CLSID\{5ED60779-4DE2-4E07-B862-974CA4FF2E9C}]
@Denied: (Full) (Everyone)
@Allowed: (Read) (RestrictedCode)
"scansk"=hex(0):23,17,fd,89,25,37,12,d5,bb,70,c7,e7,8e,ae,e5,07,5a,c2,2d,4e,fe,
01,e5,26,8b,22,3a,1d,35,6c,b3,2d,f9,8e,10,25,1e,a7,41,3d,00,00,00,00,00,00,\
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil32_14_0_0_125_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil32_14_0_0_125_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:000000b5
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Other Running Processes ------------------------
.
c:\program files\IDT\WDM\STacSV.exe
c:\windows\system32\taskhost.exe
c:\program files\Malwarebytes Anti-Malware\mbam.exe
c:\windows\system32\conhost.exe
c:\program files\Smadav\SMc:\windows\system32\wbem\wmiprvse.exe
c:\program files\Splashtop\Splashtop Remote\Server\SRServer.exe
c:\windows\system32\WUDFHost.exe
c:\program files\Splashtop\Splashtop Remote\Server\SRFeature.exe
c:\program files\Synaptics\SynTP\SynTPHelper.exe
c:\program files\Internet Download Manager\IEMonitor.exe
c:\windows\system32\sppsvc.exe
.
**************************************************************************
.
Completion time: 2015-08-20 11:09:11 - machine was rebooted
ComboFix-quarantined-files.txt 2015-08-20 10:09
.
Pre-Run: 32,860,938,240 octets libres
Post-Run: 32,521,228,288 octets libres
.
- - End Of File - - B54A49DEF8839DC7C7359B2066C15678
A36C5E4F47E84449FF07ED3517B43A31