ComboFix 15-10-28.01 - Home 10/31/2015 1:50.1.2 - x86 Microsoft Windows 7 Edition Intégrale 6.1.7601.1.1256.212.1036.18.3543.2627 [GMT 0:00] Running from: c:\users\Home\Desktop\ComboFix.exe AV: ESET Smart Security 8.0 *Disabled/Updated* {19259FAE-8396-A113-46DB-15B0E7DFA289} FW: Pare-feu personnel d'ESET *Enabled* {211E1E8B-C9F9-A04B-6D84-BC85190CE5F2} SP: ESET Smart Security 8.0 *Disabled/Updated* {A2447E4A-A5AC-AE9D-7C6B-2EC29C58E834} SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . . c:\users\Home\AppData\Roaming\as c:\users\Home\AppData\Roaming\as\listen1.exe c:\users\Home\AppData\Roaming\as\listen2.exe c:\users\Home\AppData\Roaming\as\listen3.exe c:\users\Home\AppData\Roaming\as\listen4.exe c:\users\Home\AppData\Roaming\as\recorder1.exe c:\users\Home\AppData\Roaming\as\recorder2.exe c:\users\Home\AppData\Roaming\as\recorder3.exe c:\users\Home\AppData\Roaming\as\recorder4.exe c:\users\Home\AppData\Roaming\as\rtmpdump.exe c:\users\Home\AppData\Roaming\as\rtmpgw.exe c:\users\Home\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ati.EXE c:\users\Home\AppData\Roaming\mIRC\logs\status.log c:\windows\msdownld.tmp . . ((((((((((((((((((((((((( Files Created from 2015-09-28 to 2015-10-31 ))))))))))))))))))))))))))))))) . . 2015-10-31 01:56 . 2015-10-31 01:56 62576 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{EFD4BDF2-B960-4448-9EC9-4D529AE0B7A3}\offreg.6044.dll 2015-10-30 19:35 . 2015-10-30 20:45 119512 ----a-w- c:\windows\system32\drivers\MBAMSwissArmy.sys 2015-10-30 19:35 . 2015-10-30 19:53 -------- d-----w- c:\program files\Malwarebytes Anti-Malware 2015-10-30 19:35 . 2015-10-05 09:50 51928 ----a-w- c:\windows\system32\drivers\mwac.sys 2015-10-30 19:35 . 2015-10-05 09:50 94936 ----a-w- c:\windows\system32\drivers\mbamchameleon.sys 2015-10-30 19:35 . 2015-10-05 09:50 23256 ----a-w- c:\windows\system32\drivers\mbam.sys 2015-10-30 18:40 . 2015-10-30 18:40 62576 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{EFD4BDF2-B960-4448-9EC9-4D529AE0B7A3}\offreg.3888.dll 2015-10-30 18:32 . 2015-10-31 00:52 -------- d-----w- c:\users\Home\AppData\Roaming\ZHP 2015-10-30 16:18 . 2015-10-13 09:30 8985080 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{EFD4BDF2-B960-4448-9EC9-4D529AE0B7A3}\mpengine.dll 2015-10-28 20:33 . 2015-10-28 20:33 -------- d-----w- c:\program files\Vimicro 2015-10-28 20:33 . 2007-06-13 09:24 1469312 ----a-w- c:\windows\system32\drivers\ZS211.sys 2015-10-28 20:33 . 2007-04-06 14:21 77824 ----a-w- c:\windows\ZS211Cap.exe 2015-10-28 20:33 . 2007-04-06 11:06 57344 ----a-w- c:\windows\ZSSnp211.exe 2015-10-28 20:33 . 2006-08-18 16:58 49152 ----a-w- c:\windows\Domino.exe 2015-10-28 20:33 . 2006-08-09 17:37 81920 ----a-w- c:\windows\system32\ZS211STI.dll 2015-10-28 20:33 . 2006-07-14 14:36 172115 ----a-w- c:\windows\system32\ZS211Prp.Ax 2015-10-28 20:33 . 2006-03-14 14:28 172032 ----a-w- c:\windows\amcap.exe 2015-10-28 20:33 . 2015-10-28 20:33 -------- d-----w- c:\users\Home\AppData\Roaming\InstallShield 2015-10-25 21:14 . 2015-10-30 21:42 -------- d-----w- c:\program files\Reason 2015-10-21 14:11 . 2015-10-21 14:17 -------- d-----w- c:\users\Home\AppData\Local\FreeFixer 2015-10-21 14:11 . 2015-10-21 14:11 -------- d-----w- c:\users\Home\AppData\Roaming\FreeFixer 2015-10-15 07:33 . 2015-09-18 17:47 23384 ----a-w- c:\windows\system32\CompatTelRunner.exe 2015-10-15 07:33 . 2015-09-18 17:44 587776 ----a-w- c:\windows\system32\invagent.dll 2015-10-15 07:33 . 2015-09-18 17:44 615936 ----a-w- c:\windows\system32\generaltel.dll 2015-10-15 07:33 . 2015-09-18 17:44 423936 ----a-w- c:\windows\system32\devinv.dll 2015-10-15 07:33 . 2015-09-18 17:44 1120768 ----a-w- c:\windows\system32\appraiser.dll 2015-10-15 07:33 . 2015-09-18 17:44 62976 ----a-w- c:\windows\system32\acmigration.dll 2015-10-15 07:33 . 2015-09-18 17:35 999936 ----a-w- c:\windows\system32\aeinv.dll 2015-10-12 12:50 . 2015-10-24 21:40 -------- d-----w- c:\program files\CCleaner 2015-10-11 00:54 . 2015-10-11 00:54 -------- d-----w- c:\users\Home\AppData\Roaming\PotPlayerMini 2015-10-06 00:37 . 2015-10-06 00:37 -------- d-----w- c:\users\Home\AppData\Local\Mega Limited 2015-10-06 00:37 . 2015-10-24 21:54 -------- d-----w- c:\users\Home\AppData\Local\MEGAsync 2015-10-05 19:43 . 2015-10-05 19:43 -------- d-----w- c:\users\Home\AppData\Roaming\RPEng 2015-10-02 08:34 . 2015-10-02 08:34 -------- d-----w- c:\users\Home\REACHit 2015-10-02 08:34 . 2015-10-02 08:34 -------- d-----w- c:\users\Home\AppData\Local\Lenovo 2015-10-02 08:33 . 2015-10-05 14:52 -------- d-----w- c:\program files\Lenovo 2015-10-02 08:33 . 2015-10-02 08:33 -------- d-----w- c:\windows\Downloaded Installations . . . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2015-10-30 20:39 . 2015-09-03 20:01 780488 ----a-w- c:\windows\system32\FlashPlayerApp.exe 2015-10-30 20:39 . 2015-09-03 20:01 142536 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl 2015-09-26 07:52 . 2015-09-26 07:52 345360 ----a-w- c:\windows\system32\LavasoftTcpService.dll 2015-09-02 02:48 . 2015-09-09 21:26 26624 ----a-w- c:\windows\system32\lpk.dll 2015-09-02 02:48 . 2015-09-09 21:26 70656 ----a-w- c:\windows\system32\fontsub.dll 2015-09-02 02:48 . 2015-09-09 21:26 10240 ----a-w- c:\windows\system32\dciman32.dll 2015-09-02 02:48 . 2015-09-09 21:26 34304 ----a-w- c:\windows\system32\atmlib.dll 2015-09-02 01:35 . 2015-09-09 21:26 2393600 ----a-w- c:\windows\system32\win32k.sys 2015-09-02 01:33 . 2015-09-09 21:26 299520 ----a-w- c:\windows\system32\atmfd.dll 2015-08-27 17:58 . 2015-09-09 21:28 1391104 ----a-w- c:\windows\system32\msxml6.dll 2015-08-27 17:58 . 2015-09-09 21:28 1241088 ----a-w- c:\windows\system32\msxml3.dll 2015-08-27 17:51 . 2015-09-09 21:28 2048 ----a-w- c:\windows\system32\msxml6r.dll 2015-08-27 17:51 . 2015-09-09 21:28 2048 ----a-w- c:\windows\system32\msxml3r.dll 2015-08-11 11:22 . 2015-07-15 13:34 2895360 ----a-w- c:\windows\system32\pwNative.exe 2015-08-05 17:41 . 2015-09-09 21:28 751104 ----a-w- c:\windows\system32\schedsvc.dll 2015-08-05 17:40 . 2015-09-09 21:28 216064 ----a-w- c:\windows\system32\InkEd.dll 2015-08-05 17:40 . 2015-09-09 21:28 22528 ----a-w- c:\windows\system32\Spool\prtprocs\w32x86\jnwppr.dll 2015-08-05 17:40 . 2015-09-09 21:28 19968 ----a-w- c:\windows\system32\jnwmon.dll . . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\IDM Shell Extension] @="{CDC95B92-E27C-4745-A8C5-64A52A78855D}" [HKEY_CLASSES_ROOT\CLSID\{CDC95B92-E27C-4745-A8C5-64A52A78855D}] 2014-04-21 08:02 23008 ----a-w- c:\program files\Internet Download Manager\IDMShellExt.dll . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "IDMan"="c:\program files\Internet Download Manager\IDMan.exe" [2015-05-20 3903056] "Skype"="c:\program files\Skype\Phone\Skype.exe" [2015-09-28 57987712] "CCleaner Monitoring"="c:\program files\CCleaner\CCleaner.exe" [2015-09-16 6495144] . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "egui"="c:\program files\ESET\ESET Smart Security\egui.exe" [2015-01-28 5088456] "AdobeAAMUpdater-1.0"="c:\program files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2013-03-21 472992] "AdobeCEPServiceManager"="c:\program files\Common Files\Adobe\CEPServiceManager4\CEPServiceManager.exe" [2013-03-13 1039248] "QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-09-05 417792] "Syncios device service"="c:\program files\Syncios\SynciosDeviceService.exe" [2015-07-21 851968] "SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2009-07-01 1314816] "IgfxTray"="c:\windows\system32\igfxtray.exe" [2011-02-11 137752] "HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2011-02-11 171032] "Persistence"="c:\windows\system32\igfxpers.exe" [2011-02-11 172568] "ZSSnp211"="c:\windows\ZSSnp211.exe" [2007-04-06 57344] "Domino"="c:\windows\Domino.exe" [2006-08-18 49152] . c:\users\Home\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ bin [2015-10-25 0] GTProtector.asi.upk [2015-10-25 32768] GTProtector.dll.upk [2015-10-25 135168] GTProtector.ini.upk [2015-10-25 175] motd_temp.html [2015-10-25 0] Nexon.upk [2015-10-25 129] NexonGameMenu.upk [2015-10-25 781] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorAdmin"= 5 (0x5) "ConsentPromptBehaviorUser"= 3 (0x3) "EnableUIADesktopToggle"= 0 (0x0) . [COLOR=RED] SafeBoot registry key needs repairs. This machine cannot enter Safe Mode. [/COLOR] . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\File system] @="Driver Group" . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\vgasave.sys] @="Driver" . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E967-E325-11CE-BFC1-08002BE10318}] @="DiskDrive" . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E96A-E325-11CE-BFC1-08002BE10318}] @="Hdc" . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E96B-E325-11CE-BFC1-08002BE10318}] @="Keyboard" . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E96F-E325-11CE-BFC1-08002BE10318}] @="Mouse" . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E97D-E325-11CE-BFC1-08002BE10318}] @="System" . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{71A27CDD-812A-11D0-BEC7-08002BE2092F}] @="Volume" . [HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc] "AntiVirusOverride"=dword:00000001 "FirewallOverride"=dword:00000001 "AntiVirusDisableNotify"=dword:00000001 "FirewallDisableNotify"=dword:00000001 "UpdatesDisableNotify"=dword:00000001 "UacDisableNotify"=dword:00000001 . R2 MBAMService;MBAMService;c:\program files\Malwarebytes Anti-Malware\mbamservice.exe [2015-03-17 1080120] R2 SkypeUpdate;Skype Updater;c:\program files\Skype\Updater\Updater.exe [2015-07-09 327296] R3 cpuz134;cpuz134;c:\users\Home\AppData\Local\Temp\cpuz134\cpuz134_x32.sys [x] R3 dmvsc;dmvsc;c:\windows\system32\drivers\dmvsc.sys [2010-11-20 62464] R3 dtlitescsibus;DAEMON Tools Lite Virtual SCSI Bus;c:\windows\system32\DRIVERS\dtlitescsibus.sys [2015-07-29 25016] R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe [2015-09-16 102912] R3 MBAMWebAccessControl;MBAMWebAccessControl;c:\windows\system32\drivers\mwac.sys [2015-10-05 51928] R3 MDA_NTDRV;MDA_NTDRV;c:\windows\system32\MDA_NTDRV.sys [2013-02-25 18136] R3 netr28u;Pilote de carte réseau sans fil RT2870 USB pour Vista;c:\windows\system32\DRIVERS\netr28u.sys [2009-07-13 657408] R3 pwdrvio;pwdrvio;c:\windows\system32\pwdrvio.sys [2015-03-05 17160] R3 pwdspio;pwdspio;c:\windows\system32\pwdspio.sys [2015-03-05 13064] R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [2015-06-11 15872] R3 SEE;SoftEther Ethernet Layer Driver;c:\windows\system32\drivers\see.sys [2015-07-24 43104] R3 Synth3dVsc;Synth3dVsc;c:\windows\system32\drivers\synth3dvsc.sys [2010-11-20 77184] R3 tapstrong;StrongVPN Adapter;c:\windows\system32\DRIVERS\tapstrong.sys [2015-01-18 32872] R3 terminpt;Microsoft Remote Desktop Input Driver;c:\windows\system32\drivers\terminpt.sys [2010-11-20 25600] R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2014-08-04 49152] R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [2014-08-04 26880] R3 tsusbhub;tsusbhub;c:\windows\system32\drivers\tsusbhub.sys [2010-11-20 112640] R3 VGPU;VGPU;c:\windows\system32\drivers\rdvgkmd.sys [x] R3 WDC_SAM;WD SCSI Pass Thru driver;c:\windows\system32\DRIVERS\wdcsam.sys [2015-04-29 20256] R3 workfolderssvc;Dossiers de travail;c:\windows\System32\svchost.exe [2014-08-03 21504] R4 MBAMScheduler;MBAMScheduler;c:\program files\Malwarebytes Anti-Malware\mbamscheduler.exe [2015-03-17 1871160] S0 epfwwfp;epfwwfp;c:\windows\system32\DRIVERS\epfwwfp.sys [2015-03-10 51824] S1 eamonm;eamonm;c:\windows\system32\DRIVERS\eamonm.sys [2015-03-10 193464] S1 ehdrv;ehdrv;c:\windows\system32\DRIVERS\ehdrv.sys [2015-03-10 135808] S1 EpfwLWF;Epfw NDIS LightWeight Filter;c:\windows\system32\DRIVERS\EpfwLWF.sys [2015-03-10 37928] S2 c2cautoupdatesvc;Skype Click to Call Updater;c:\program files\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [2015-10-12 1433216] S2 c2cpnrsvc;Skype Click to Call PNR Service;c:\program files\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [2015-10-12 1773696] S2 DiagTrack;Diagnostics Tracking Service;c:\windows\System32\svchost.exe [2014-08-03 21504] S2 ekrn;ESET Service;c:\program files\ESET\ESET Smart Security\ekrn.exe [2015-01-28 1349576] S2 IDMWFP;IDMWFP;c:\windows\system32\DRIVERS\idmwfp.sys [2015-05-20 123968] S3 e1kexpress;Pilote K de la connexion réseau Intel(R) PRO/1000 PCI Express;c:\windows\system32\DRIVERS\e1k6032.sys [2009-07-13 164864] S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2015-10-05 23256] S3 Neo_VPN;VPN Client Device Driver - VPN;c:\windows\system32\DRIVERS\Neo_0022.sys [2015-07-24 26208] . . [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] WorkFoldersSvcGroup REG_MULTI_SZ workfolderssvc utcsvc REG_MULTI_SZ DiagTrack . [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}] 2015-10-24 21:45 997704 ----a-w- c:\program files\Google\Chrome\Application\46.0.2490.80\Installer\chrmstp.exe . Contents of the 'Scheduled Tasks' folder . 2015-10-31 c:\windows\Tasks\Adobe Flash Player Updater.job - c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2015-09-03 20:39] . 2015-10-31 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job - c:\program files\Google\Update\GoogleUpdate.exe [2015-10-24 21:43] . 2015-10-31 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job - c:\program files\Google\Update\GoogleUpdate.exe [2015-10-24 21:43] . . ------- Supplementary Scan ------- . uStart Page = www.google.com uDefault_Search_URL = hxxp://go.microsoft.com mStart Page = about:blank IE: Download all links with IDM - c:\program files\Internet Download Manager\IEGetAll.htm IE: Download with IDM - c:\program files\Internet Download Manager\IEExt.htm LSP: c:\windows\system32\LavasoftTcpService.dll Trusted Zone: localhost Trusted Zone: webcompanion.com TCP: DhcpNameServer = 192.168.1.1 FF - ProfilePath - c:\users\Home\AppData\Roaming\Mozilla\Firefox\Profiles\88lrblnz.default\ FF - prefs.js: browser.startup.homepage - hxxps://www.malwarebytes.org/restorebrowser/ . - - - - ORPHANS REMOVED - - - - . ShellIconOverlayIdentifiers-{056D528D-CE28-4194-9BA3-BA2E9197FF8C} - (no file) ShellIconOverlayIdentifiers-{05B38830-F4E9-4329-978B-1DD28605D202} - (no file) ShellIconOverlayIdentifiers-{0596C850-7BDD-4C9D-AFDF-873BE6890637} - (no file) . . . --------------------- LOCKED REGISTRY KEYS --------------------- . [HKEY_USERS\S-1-5-21-2536906684-2532996388-3794283676-1001_Classes\CLSID\{7B8E9164-324D-4A2E-A46D-0165FB2000EC}] @Denied: (Full) (Everyone) "scansk"=hex(0):79,fc,02,45,d9,a9,1f,34,42,f9,dc,e2,6d,69,77,20,14,69,ce,65,cc, 60,c8,49,5d,ef,70,db,51,21,d9,71,2b,ff,9a,74,9a,db,f3,54,00,00,00,00,00,00,\ . [HKEY_USERS\S-1-5-21-2536906684-2532996388-3794283676-1001_Classes\CLSID\{a33a8c9f-1403-4985-88a1-a203beb3aea0}] @Denied: (Full) (Everyone) @Allowed: (Read) (RestrictedCode) "Model"=dword:000000ff "Therad"=dword:0000000f . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil32_19_0_0_226_ActiveX.exe,-101" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\Elevation] "Enabled"=dword:00000001 . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\LocalServer32] @="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil32_19_0_0_226_ActiveX.exe" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}] @Denied: (A 2) (Everyone) @="IFlashBroker6" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security] @Denied: (Full) (Everyone) . --------------------- DLLs Loaded Under Running Processes --------------------- . - - - - - - - > 'Explorer.exe'(4068) c:\windows\system32\LavasoftTcpService.dll . ------------------------ Other Running Processes ------------------------ . c:\windows\system32\AEADISRV.EXE c:\windows\system32\taskhost.exe c:\windows\system32\GWX\GWX.exe c:\windows\system32\sppsvc.exe c:\windows\system32\conhost.exe c:\windows\system32\wbem\unsecapp.exe c:\program files\Internet Download Manager\IEMonitor.exe c:\program files\Windows Media Player\wmpnetwk.exe c:\windows\system32\taskhost.exe . ************************************************************************** . Completion time: 2015-10-31 02:02:50 - machine was rebooted ComboFix-quarantined-files.txt 2015-10-31 02:02 . Pre-Run: 63,881,351,168 octets libres Post-Run: 63,964,594,176 octets libres . - - End Of File - - 3E471DB6CDA8EF4CC254D55848738EB2 A36C5E4F47E84449FF07ED3517B43A31