ComboFix 15-07-10.01 - Win7 07/10/2015 19:51:31.1.2 - x86 Microsoft Windows 7 Ultimate 6.1.7600.0.1256.20.1033.18.2012.988 [GMT 3:00] Running from: c:\users\Win7\Downloads\Programs\ComboFix.exe AV: ESET Smart Security 8.0 *Disabled/Updated* {19259FAE-8396-A113-46DB-15B0E7DFA289} FW: ESET Personal firewall *Enabled* {211E1E8B-C9F9-A04B-6D84-BC85190CE5F2} SP: ESET Smart Security 8.0 *Disabled/Updated* {A2447E4A-A5AC-AE9D-7C6B-2EC29C58E834} SP: Windows Defender *Enabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} * Created a new restore point . . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . . c:\users\Win7\AppData\Local\assembly\tmp c:\users\Win7\ZHPDiag3.exe . c:\windows\System32\colorcpl.exe . . . is infected!! . . ((((((((((((((((((((((((( Files Created from 2015-06-10 to 2015-07-10 ))))))))))))))))))))))))))))))) . . 2015-07-09 08:22 . 2015-07-09 08:22 35064 ----a-w- c:\windows\system32\drivers\TrueSight.sys 2015-07-09 08:22 . 2015-07-09 16:47 -------- d-----w- c:\programdata\RogueKiller 2015-07-06 02:15 . 2015-07-06 02:15 -------- d-----w- C:\RegBackup 2015-07-06 01:40 . 2015-07-06 01:50 -------- d-----w- c:\program files\ZHPFix 2015-07-04 12:45 . 2015-07-04 12:45 -------- d-----w- C:\found.002 2015-06-30 15:39 . 2015-06-30 15:42 -------- d-----w- c:\users\Win7\AppData\Local\LINE 2015-06-30 15:39 . 2015-06-30 15:39 -------- d-----w- c:\program files\LINE 2015-06-30 15:38 . 2015-07-01 08:45 -------- d-----w- c:\users\Win7\AppData\Roaming\imo.im 2015-06-18 09:38 . 2011-11-05 10:19 107776 ----a-w- c:\windows\system32\drivers\ZTEusbser6k.sys 2015-06-18 09:38 . 2011-11-05 10:19 107776 ----a-w- c:\windows\system32\drivers\ZTEusbnmea.sys 2015-06-18 09:38 . 2011-11-05 10:19 107776 ----a-w- c:\windows\system32\drivers\ZTEusbmdm6k.sys 2015-06-18 09:38 . 2011-07-12 07:44 9216 ----a-w- c:\windows\system32\drivers\massfilter.sys 2015-06-18 09:38 . 2015-06-20 13:17 -------- d-----w- c:\program files\Etisalat USB modem . . . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2015-07-09 01:30 . 2013-12-09 16:29 778416 ----a-w- c:\windows\system32\FlashPlayerApp.exe 2015-07-09 01:30 . 2013-12-09 16:29 142512 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl 2015-07-07 13:39 . 2014-04-05 14:02 98520 ----a-w- c:\windows\system32\drivers\MBAMSwissArmy.sys 2015-06-21 16:30 . 2014-02-08 11:16 48648 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\UpdateableMarkup-2\Markup.dll 2015-06-18 05:41 . 2014-04-05 14:01 51928 ----a-w- c:\windows\system32\drivers\mwac.sys 2015-06-18 05:41 . 2014-04-05 14:01 94936 ----a-w- c:\windows\system32\drivers\mbamchameleon.sys 2015-06-18 05:41 . 2014-04-05 14:01 23256 ----a-w- c:\windows\system32\drivers\mbam.sys 2015-06-17 12:47 . 2014-01-20 00:15 48648 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\UpdateableMarkup\Markup.dll 2015-04-20 12:48 . 2015-04-20 12:53 3898960 ----a-w- c:\program files\IDMan.bak 2015-04-18 01:06 . 2015-04-20 12:53 122432 ----a-w- c:\windows\system32\drivers\idmwfp.sys 2015-02-04 10:05 . 2015-04-20 12:53 16920 ----a-w- c:\program files\MediumILStart.exe 2013-10-08 11:37 . 2015-04-20 12:53 397336 ----a-w- c:\program files\idmindex.dll . . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive1] @="{F241C880-6982-4CE5-8CF7-7085BA96DA5A}" [HKEY_CLASSES_ROOT\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}] 2014-11-27 10:10 239272 ----a-w- c:\users\Win7\AppData\Local\Microsoft\SkyDrive\17.3.1229.0918\SkyDriveShell.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive2] @="{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}" [HKEY_CLASSES_ROOT\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}] 2014-11-27 10:10 239272 ----a-w- c:\users\Win7\AppData\Local\Microsoft\SkyDrive\17.3.1229.0918\SkyDriveShell.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive3] @="{BBACC218-34EA-4666-9D7A-C78F2274A524}" [HKEY_CLASSES_ROOT\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}] 2014-11-27 10:10 239272 ----a-w- c:\users\Win7\AppData\Local\Microsoft\SkyDrive\17.3.1229.0918\SkyDriveShell.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\IDM Shell Extension] @="{CDC95B92-E27C-4745-A8C5-64A52A78855D}" [HKEY_CLASSES_ROOT\CLSID\{CDC95B92-E27C-4745-A8C5-64A52A78855D}] 2014-04-21 08:02 23008 ----a-w- c:\program files\Internet Download Manager\IDMShellExt.dll . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CCleaner Monitoring"="c:\program files\CCleaner\CCleaner.exe" [2015-03-13 5529880] "IDMan"="c:\program files\Internet Download Manager\IDMan.exe" [2015-05-02 3898960] . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "USB Security"="c:\program files\USB Disk Security\USBGuard.exe" [2013-06-20 687336] "IgfxTray"="c:\windows\system32\igfxtray.exe" [2014-11-10 138784] "HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2014-11-10 172064] "Persistence"="c:\windows\system32\igfxpers.exe" [2014-11-10 173600] "BlueStacks Agent"="c:\program files\BlueStacks\HD-Agent.exe" [2013-09-19 606024] "egui"="c:\program files\ESET\ESET Smart Security\egui.exe" [2015-01-28 5088456] "UIExec"="c:\program files\Etisalat USB modem\UIExec.exe" [2011-04-02 139088] . c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\ PrivateTunnel.lnk - c:\program files\OpenVPN Technologies\PrivateTunnel\PrivateTunnel.exe [2014-10-2 310680] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorAdmin"= 0 (0x0) "ConsentPromptBehaviorUser"= 3 (0x3) "EnableUIADesktopToggle"= 0 (0x0) "PromptOnSecureDesktop"= 0 (0x0) . [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "aux"=wdmaud.drv . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\HomeGuard AMC] @="Service" . R2 BstHdAndroidSvc;BlueStacks Android Service;c:\program files\BlueStacks\HD-Service.exe BstHdAndroidSvc Android [x] R2 HomeGuard AMC;HomeGuard AMC;c:\program files\HomeGuard\vglset.exe [2014-08-23 861696] R2 MBAMService;MBAMService;c:\program files\Malwarebytes Anti-Malware\mbamservice.exe [2015-06-18 1133880] R2 SkypeUpdate;Skype Updater;c:\program files\Skype\Updater\Updater.exe [2015-06-03 327296] R3 epmntdrv;epmntdrv;c:\windows\system32\epmntdrv.sys [2013-03-07 14920] R3 EsgScanner;EsgScanner;c:\windows\system32\DRIVERS\EsgScanner.sys [2015-03-30 19984] R3 EuGdiDrv;EuGdiDrv;c:\windows\system32\EuGdiDrv.sys [2013-03-07 9160] R3 massfilter;MBB Mass Storage Filter Driver;c:\windows\system32\drivers\massfilter.sys [2011-07-12 9216] R3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\MBAMSwissArmy.sys [2015-07-07 98520] R3 MBAMWebAccessControl;MBAMWebAccessControl;c:\windows\system32\drivers\mwac.sys [2015-06-18 51928] R3 SAllBDA;TeVii DVB-S/S2 Receiver;c:\windows\system32\Drivers\TeViiS2.sys [2013-10-28 166480] R4 MBAMScheduler;MBAMScheduler;c:\program files\Malwarebytes Anti-Malware\mbamscheduler.exe [2015-06-18 1871160] S0 epfwwfp;epfwwfp;c:\windows\system32\DRIVERS\epfwwfp.sys [2015-01-30 51824] S0 EUBAKUP;EUBAKUP;c:\windows\system32\drivers\eubakup.sys [2014-08-13 51784] S0 EUBKMON;EUBKMON;c:\windows\system32\drivers\EUBKMON.sys [2014-08-13 41544] S1 eamonm;eamonm;c:\windows\system32\DRIVERS\eamonm.sys [2015-01-30 193464] S1 ehdrv;ehdrv;c:\windows\system32\DRIVERS\ehdrv.sys [2015-01-30 135808] S1 EpfwLWF;Epfw NDIS LightWeight Filter;c:\windows\system32\DRIVERS\EpfwLWF.sys [2015-01-30 37928] S1 EUDSKACS;EUDSKACS;c:\windows\system32\drivers\eudskacs.sys [2014-08-13 15944] S1 EUFDDISK;EUFDDISK;c:\windows\system32\drivers\EuFdDisk.sys [2014-08-13 186952] S1 HWiNFO32;HWiNFO32/64 Kernel Driver;c:\windows\system32\drivers\HWiNFO32.SYS [2014-12-29 23840] S2 BstHdDrv;BlueStacks Hypervisor;c:\program files\BlueStacks\HD-Hypervisor-x86.sys [2013-09-19 63816] S2 BstHdLogRotatorSvc;BlueStacks Log Rotator Service;c:\program files\BlueStacks\HD-LogRotatorService.exe [2013-09-19 384840] S2 c2cautoupdatesvc;Skype Click to Call Updater;c:\program files\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [2015-05-01 1394816] S2 c2cpnrsvc;Skype Click to Call PNR Service;c:\program files\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [2015-05-01 1772672] S2 ekrn;ESET Service;c:\program files\ESET\ESET Smart Security\ekrn.exe [2015-01-28 1349576] S2 IDMWFP;IDMWFP;c:\windows\system32\DRIVERS\idmwfp.sys [2015-04-18 122432] S2 ptservice;Private Tunnel Core Service;c:\program files\OpenVPN Technologies\PrivateTunnel\ptservice.exe [2014-10-02 17816] S2 UI Assistant Service;UI Assistant Service;c:\program files\Etisalat USB modem\AssistantServices.exe [2011-08-25 269648] S2 VIAKaraokeService;VIA Karaoke digital mixer Service;c:\windows\system32\viakaraokesrv.exe [2014-11-10 27768] S3 clwvd;CyberLink WebCam Virtual Driver;c:\windows\system32\DRIVERS\clwvd.sys [2011-04-14 27760] S3 L1C;NDIS Miniport Driver for Qualcomm Atheros AR81xx PCI-E Ethernet Controller;c:\windows\system32\DRIVERS\L1C62x86.sys [2014-11-10 109256] S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2015-06-18 23256] S3 ptun0901;TAP Adapter V9 for Private Tunnel;c:\windows\system32\DRIVERS\ptun0901.sys [2014-08-08 23552] S3 VIAHdAudAddService;VIA High Definition Audio Driver Service;c:\windows\system32\drivers\viahduaa.sys [2014-11-10 564912] . . [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}] 2015-07-08 00:55 991048 ----a-w- c:\program files\Google\Chrome\Application\43.0.2357.132\Installer\chrmstp.exe . Contents of the 'Scheduled Tasks' folder . 2015-07-10 c:\windows\Tasks\Adobe Flash Player Updater.job - c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2013-12-09 01:31] . 2015-07-10 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job - c:\program files\Google\Update\GoogleUpdate.exe [2015-03-02 13:01] . 2015-07-10 c:\windows\Tasks\GoogleUpdateTaskMachineCore1d093cb697691ec.job - c:\program files\Google\Update\GoogleUpdate.exe [2015-03-02 13:01] . 2015-07-10 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job - c:\program files\Google\Update\GoogleUpdate.exe [2015-03-02 13:01] . 2015-07-10 c:\windows\Tasks\GoogleUpdateTaskMachineUA1d093cb6a3a59fa.job - c:\program files\Google\Update\GoogleUpdate.exe [2015-03-02 13:01] . . ------- Supplementary Scan ------- . uStart Page = hxxp://www.google.com uSearchMigratedDefaultURL = https://www.google.com/ mStart Page = hxxp://www.google.com mSearch Bar = https://www.google.com/ mSearchMigratedDefaultURL = https://www.google.com/ uInternet Settings,ProxyOverride = *.local uSearchAssistant = hxxp://www.google.com uCustomizeSearch = https://www.google.com/ IE: &ÊÕÏíÑ Åáì Microsoft Excel - c:\progra~1\MICROS~3\OFFICE11\EXCEL.EXE/3000 IE: ÊÍãíá Çáßá ÈæÇÓØÉ Internet Download Manager - c:\program files\Internet Download Manager\IEGetAll.htm IE: ÊÍãíá ÈæÇÓØÉ Internet Download Manager - c:\program files\Internet Download Manager\IEExt.htm TCP: DhcpNameServer = 192.168.1.1 . . --------------------- LOCKED REGISTRY KEYS --------------------- . [HKEY_USERS\S-1-5-21-1163517497-134154996-3967426762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.* 3*g*p*\OpenWithList] @Class="Shell" "a"="mpc-hc.exe" "MRUList"="ba" "b"="PotPlayerMini.exe" . [HKEY_USERS\S-1-5-21-1163517497-134154996-3967426762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.* 3*g*p*\UserChoice] @Denied: (2) (S-1-5-21-1163517497-134154996-3967426762-1000) "Progid"="PotPlayerMini.3GP" . [HKEY_USERS\S-1-5-21-1163517497-134154996-3967426762-1000_Classes\CLSID\{62702a16-4c82-4097-b561-047dc9fe61c9}] @Denied: (Full) (Everyone) @Allowed: (Read) (RestrictedCode) "Model"=dword:0000002b "Therad"=dword:0000000f . [HKEY_USERS\S-1-5-21-1163517497-134154996-3967426762-1000_Classes\CLSID\{7B8E9164-324D-4A2E-A46D-0165FB2000EC}] @Denied: (Full) (Everyone) @Allowed: (Read) (RestrictedCode) "scansk"=hex(0):7b,63,8b,35,68,ab,f6,39,df,2f,20,ab,80,a0,da,5b,9f,f1,e1,e9,b9, 5e,cf,c2,06,c5,27,53,16,e1,97,0a,3b,26,63,b1,2f,c8,ad,86,00,00,00,00,00,00,\ . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security] @Denied: (Full) (Everyone) . Completion time: 2015-07-10 19:58:53 ComboFix-quarantined-files.txt 2015-07-10 16:58 . Pre-Run: 44,408,442,880 bytes free Post-Run: 44,324,036,608 bytes free . - - End Of File - - B89E41DD6A46EC041C15F426F5278DF5 A36C5E4F47E84449FF07ED3517B43A31