ComboFix 15-07-12.01 - wafa 07/16/2015 13:40:03.3.4 - x86
Microsoft Windows 7 Edition Intégrale 6.1.7600.0.1256.966.1036.18.2871.1864 [GMT 2:00]
Running from: c:\users\wafa\Desktop\ComboFix.exe
AV: avast! Internet Security *Disabled/Outdated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}
FW: avast! Internet Security *Disabled* {131692B0-0864-D491-4E21-3A3A1D8BBB47}
SP: avast! Internet Security *Disabled/Outdated* {904CF271-6431-DA47-5FCE-A87D98DFB681}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\programdata\ntuser.pol
c:\users\wafa\AppData\Local\Temp\Temp2_IDMan.zip\IDMNetMon.dll
c:\users\wafa\AppData\Local\Temp\Temp2_IDMan.zip\IDMShellExt.dll
.
.
((((((((((((((((((((((((( Files Created from 2015-06-16 to 2015-07-16 )))))))))))))))))))))))))))))))
.
.
2015-07-16 11:45 . 2015-07-16 11:45 -------- d-----w- c:\users\Default\AppData\Local\temp
2015-07-15 11:15 . 2015-06-12 07:54 9252600 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{BBF7811B-63B7-41CB-A06E-315054D6ECF7}\mpengine.dll
2015-07-14 13:30 . 2015-07-14 13:30 -------- d-----w- c:\program files\TerminusDefender
2015-07-14 13:29 . 2015-07-14 13:30 -------- d-----w- c:\programdata\fdfca3770000471b
2015-07-14 11:59 . 2015-07-14 13:12 -------- d-----w- C:\UsbFix
2015-07-14 09:29 . 2015-07-14 09:29 -------- d-----w- c:\users\wafa\AppData\Local\ESET
2015-07-14 09:27 . 2015-07-14 09:27 -------- d-----w- c:\program files\ESET
2015-07-14 09:00 . 2015-07-14 09:00 -------- d-----w- c:\programdata\IHProtectUpDate
2015-07-14 09:00 . 2015-07-14 11:08 -------- d-----w- c:\program files\MiuiTab
2015-07-14 09:00 . 2015-07-14 09:41 -------- d-----w- c:\programdata\WindowsMangerProtect
2015-07-14 08:58 . 2015-07-14 11:08 -------- d-----w- c:\users\wafa\AppData\Roaming\mystartsearch
2015-07-11 23:39 . 2015-07-14 10:29 -------- d-----w- c:\program files\SystemRaise
2015-07-11 15:02 . 2015-07-11 23:39 -------- d-----w- c:\programdata\2547bfdc00001fe8
2015-07-09 23:00 . 2015-07-09 23:00 -------- d-----w- C:\$AVG
2015-07-09 22:56 . 2015-07-09 23:04 -------- d-----w- c:\users\wafa\AppData\Local\Avg2015
2015-07-09 22:56 . 2015-07-09 22:56 -------- d-----w- c:\users\wafa\AppData\Local\MFAData
2015-07-09 22:15 . 2015-07-11 14:44 -------- d-----w- c:\programdata\{94cc6b0c-37c1-8e15-94cc-c6b0c37cac30}
2015-07-06 11:31 . 2015-07-11 23:39 -------- d-----w- c:\programdata\ea60695f00002953
2015-07-04 13:26 . 2015-07-04 13:26 -------- d-----w- c:\programdata\IDM
2015-07-03 18:09 . 2015-07-03 18:09 -------- d-----w- c:\users\wafa\AppData\Roaming\AVG2015
2015-07-03 18:08 . 2015-07-09 23:03 -------- d-----w- c:\program files\Common Files\AV
2015-07-03 18:08 . 2015-07-03 18:08 -------- d-----w- c:\users\wafa\AppData\Roaming\TuneUp Software
2015-07-03 18:07 . 2015-07-04 22:57 -------- d-----w- c:\programdata\AVG2015
2015-07-03 18:06 . 2015-07-11 14:42 -------- d-----w- c:\program files\AVG
2015-07-03 17:48 . 2015-07-03 17:48 -------- d--h--w- c:\programdata\Common Files
2015-07-03 17:48 . 2015-07-11 14:44 -------- d-----w- c:\programdata\MFAData
2015-07-02 18:10 . 2015-07-02 18:10 -------- d-----w- c:\program files\BiitSaveR
2015-06-22 13:58 . 2015-06-22 13:58 -------- d-----w- c:\program files\Vimium
2015-06-22 13:57 . 2015-06-22 13:57 -------- d-----w- c:\program files\BiitSaveer
2015-06-16 17:42 . 2015-06-16 17:42 -------- d-----w- c:\program files\Shiny Display
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2015-07-15 23:44 . 2015-05-13 15:13 24 ----a-w- c:\users\wafa\AppData\Roaming\appdataFr25.bin
2015-06-23 11:27 . 2012-07-13 20:05 246952 ------w- c:\windows\system32\MpSigStub.exe
2015-06-07 20:21 . 2012-07-07 21:09 6656 ----a-w- c:\windows\system32\bcmwlrc.dll
2015-05-22 16:29 . 2015-06-11 07:16 571392 ----a-w- c:\windows\system32\generaltel.dll
2015-05-22 16:28 . 2015-06-11 07:16 621568 ----a-w- c:\windows\system32\invagent.dll
2015-05-22 16:28 . 2015-06-11 07:16 333824 ----a-w- c:\windows\system32\devinv.dll
2015-05-22 16:28 . 2015-06-11 07:16 879104 ----a-w- c:\windows\system32\appraiser.dll
2015-05-22 16:28 . 2015-06-11 07:16 37888 ----a-w- c:\windows\system32\acmigration.dll
2015-05-22 16:28 . 2015-06-11 07:16 202752 ----a-w- c:\windows\system32\aepdu.dll
2015-05-22 16:25 . 2015-06-11 07:16 901120 ----a-w- c:\windows\system32\aeinv.dll
2015-05-21 13:18 . 2015-06-11 07:16 163840 ----a-w- c:\windows\system32\aepic.dll
2015-05-12 18:17 . 2015-03-30 09:12 20 ----a-w- c:\users\wafa\AppData\Roaming\appdataFr3.bin
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2012-03-06 23:15 123536 ----a-w- c:\program files\AVAST Software\Avast\ashShell.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\IDM Shell Extension]
@="{CDC95B92-E27C-4745-A8C5-64A52A78855D}"
[HKEY_CLASSES_ROOT\CLSID\{CDC95B92-E27C-4745-A8C5-64A52A78855D}]
c:\users\wafa\AppData\Local\Temp\Temp2_IDMan.zip\IDMShellExt.dll [BU]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avast"="c:\program files\AVAST Software\Avast\avastUI.exe" [2012-03-06 4241512]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"Welcome Center"="c:\windows\system32\OobeFldr.dll" [2009-10-26 859648]
.
[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoResolveTrack"= 1 (0x1)
"NoSMBalloonTip"= 1 (0x1)
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\!SASCORE]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\IMFservice]
@="Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Little transparency.exe]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Little transparency.exe
backup=c:\windows\pss\Little transparency.exe.CommonStartup
backupExtension=.CommonStartup
.
[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^RocketDock.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\RocketDock.lnk
backup=c:\windows\pss\RocketDock.lnk.CommonStartup
backupExtension=.CommonStartup
.
[HKLM\~\startupfolder\C:^Users^wafa^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^ScreenUpdate.lnk]
path=c:\users\wafa\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ScreenUpdate.lnk
backup=c:\windows\pss\ScreenUpdate.lnk.Startup
backupExtension=.Startup
.
[HKLM\~\startupfolder\C:^Users^wafa^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Win_update.lnk]
path=c:\users\wafa\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Win_update.lnk
backup=c:\windows\pss\Win_update.lnk.Startup
backupExtension=.Startup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2008-06-12 00:38 34672 ----a-w- c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CommonToolkitTray]
2013-03-12 14:38 1425952 ----a-w- c:\program files\Fighters\Tray\FightersTray.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Facebook Update]
2015-05-08 10:58 138096 ----atw- c:\users\wafa\AppData\Local\Facebook\Update\FacebookUpdate.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HiMEDIA]
2014-02-21 04:32 1324456 ----a-w- c:\users\wafa\HiPlayer\1.143.0.0\HiPlayer.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds]
2012-01-10 21:44 177432 ----a-w- c:\windows\System32\hkcmd.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray]
2012-01-10 21:44 142616 ----a-w- c:\windows\System32\igfxtray.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IMSS]
2010-09-16 02:13 112152 ----a-r- c:\program files\Intel\Intel(R) Management Engine Components\IMSS\PIconStartup.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LManager]
2011-03-31 12:38 1092688 ----a-w- c:\program files\Launch Manager\LManager.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NextLive]
2014-01-06 03:15 1283584 ----a-w- c:\users\wafa\AppData\Roaming\newnext.me\nengine.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Persistence]
2012-01-10 21:44 177944 ----a-w- c:\windows\System32\igfxpers.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2014-10-07 14:39 507776 ----a-w- c:\program files\Common Files\Java\Java Update\jusched.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Wondershare Helper Compact.exe]
2014-09-11 16:10 2087264 ----a-w- c:\program files\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe
.
R1 BAPIDRV;BAPIDRV;c:\windows\system32\DRIVERS\BAPIDRV.sys [x]
R2 1938b941;TerminusDefender;c:\windows\system32\rundll32.exe [2009-07-14 44544]
R2 DatamngrCoordinator2;Datamngr Coordinator;c:\program files\Movies Toolbar\Datamngr\DatamngrCoordinator.exe [x]
R2 IMFservice;IMF Service;c:\program files\IObit\IObit Malware Fighter\IMFsrv.exe [x]
R2 LiveUpdateSvc;LiveUpdate;c:\program files\IObit\LiveUpdate\LiveUpdate.exe [x]
R2 MaintainerSvc2.68.0219210;MaintainerSvc2.68.0219210;c:\programdata\f7d523a7-723b-4679-8c70-0e90e3053cba\maintainer.exe [2015-07-16 128240]
R2 MaintainerSvc6.37.565328;MaintainerSvc6.37.565328;c:\programdata\7bb6df21-8ca8-4eec-965d-8cd2261544c7\maintainer.exe [2015-07-16 128240]
R2 Shiny Display;Shiny Display;c:\program files\Shiny Display\Shiny Display.exe [2015-06-16 8016568]
R3 BprotectEx;Baidu ProtectEx;c:\windows\System32\drivers\BprotectEx.sys [x]
R3 cmusbser;Mobile Connector USB Device for Legacy Serial Communication LCT2051;c:\windows\system32\DRIVERS\cmusbser.sys [2008-08-29 103552]
R3 FileMonitor;FileMonitor;c:\program files\IObit\IObit Malware Fighter\Drivers\win7_x86\FileMonitor.sys [x]
R3 Impcd;Impcd;c:\windows\system32\DRIVERS\Impcd.sys [2010-02-26 132480]
R3 MSICDSetup;MSICDSetup;F:\CDriver.sys [x]
R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys [2013-09-27 104768]
R3 NisSrv;NisSrv;c:\program files\Microsoft Security Client\NisSrv.exe [x]
R3 NTIOLib_1_0_C;NTIOLib_1_0_C;F:\NTIOLib.sys [x]
R3 RegFilter;RegFilter;c:\program files\IObit\IObit Malware Fighter\drivers\win7_x86\regfilter.sys [x]
R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUStor.sys [2010-09-22 190464]
R3 SparkUpdater;Baidu Spark Updater;c:\program files\Baidu\SparkUpdate\Sparkupdate.exe [2014-12-19 1359040]
R3 TurboBoost;TurboBoost;c:\program files\Intel\TurboBoost\TurboBoost.exe [2009-11-02 99728]
R3 UNS;Intel(R) Management & Security Application User Notification Service;c:\program files\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2010-09-16 2538520]
R3 UrlFilter;UrlFilter;c:\program files\IObit\IObit Malware Fighter\drivers\win7_x86\UrlFilter.sys [x]
R3 WatAdminSvc;Service Windows Activation Technologies;c:\windows\system32\Wat\WatAdminSvc.exe [2012-07-14 1343400]
S0 aswNdis;avast! Firewall NDIS Filter Service;c:\windows\system32\DRIVERS\aswNdis.sys [2012-03-06 12112]
S0 aswNdis2;avast! Firewall Core Firewall Service; [x]
S0 Bhbase;Baidu Hook Base;c:\windows\System32\drivers\Bhbase.sys [2014-03-11 47456]
S0 SDActMon;SDActMon;c:\windows\System32\drivers\SDActMon.sys [2013-07-25 123360]
S0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [2012-07-07 722416]
S1 {01531192-f7ef-415f-a549-cfdb11836731}w;{01531192-f7ef-415f-a549-cfdb11836731}w;c:\windows\system32\drivers\{01531192-f7ef-415f-a549-cfdb11836731}w.sys [2014-04-24 52928]
S1 {70ed362e-6c2f-4f13-9f05-a5b35ff4be55}w;{70ed362e-6c2f-4f13-9f05-a5b35ff4be55}w;c:\windows\system32\drivers\{70ed362e-6c2f-4f13-9f05-a5b35ff4be55}w.sys [2014-12-01 43152]
S1 {781c47fe-8e73-4938-873f-2850548c7fb4}w;{781c47fe-8e73-4938-873f-2850548c7fb4}w;c:\windows\system32\drivers\{781c47fe-8e73-4938-873f-2850548c7fb4}w.sys [2014-11-30 43152]
S1 {8ca7f150-5454-4b4c-9537-1b831c71d329}w;{8ca7f150-5454-4b4c-9537-1b831c71d329}w;c:\windows\system32\drivers\{8ca7f150-5454-4b4c-9537-1b831c71d329}w.sys [2014-11-19 43152]
S1 {93feeb25-9f23-4de1-b697-6a2c12816bac}w;{93feeb25-9f23-4de1-b697-6a2c12816bac}w;c:\windows\system32\drivers\{93feeb25-9f23-4de1-b697-6a2c12816bac}w.sys [2014-11-23 43152]
S1 {bf07813e-aac8-4cea-bf69-7178c16076ac}w;{bf07813e-aac8-4cea-bf69-7178c16076ac}w;c:\windows\system32\drivers\{bf07813e-aac8-4cea-bf69-7178c16076ac}w.sys [2014-11-21 43152]
S1 {cb0b6f3d-aa8b-4a68-acf6-6ff30e1d0243}w;{cb0b6f3d-aa8b-4a68-acf6-6ff30e1d0243}w;c:\windows\system32\drivers\{cb0b6f3d-aa8b-4a68-acf6-6ff30e1d0243}w.sys [2014-11-27 43152]
S1 {dbe9acb7-ca74-4c18-ad13-f0270d74c42d}w;{dbe9acb7-ca74-4c18-ad13-f0270d74c42d}w;c:\windows\system32\drivers\{dbe9acb7-ca74-4c18-ad13-f0270d74c42d}w.sys [2014-11-09 43152]
S1 {e761f54c-32c6-465c-ba31-504773457b77}w;{e761f54c-32c6-465c-ba31-504773457b77}w;c:\windows\system32\drivers\{e761f54c-32c6-465c-ba31-504773457b77}w.sys [2014-11-26 43152]
S1 {f0aab91b-f97e-4d3d-b745-53663865729c}w;{f0aab91b-f97e-4d3d-b745-53663865729c}w;c:\windows\system32\drivers\{f0aab91b-f97e-4d3d-b745-53663865729c}w.sys [2014-11-28 43152]
S1 aswFW;avast! TDI Firewall driver; [x]
S1 aswKbd;aswKbd; [x]
S1 aswSnx;aswSnx; [x]
S1 aswSP;aswSP; [x]
S1 MaxProtector32;MaxProtector32;c:\windows\system32\drivers\MaxProtector32.sys [2013-07-25 85984]
S2 aswFsBlk;aswFsBlk; [x]
S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [2012-03-06 57688]
S2 avast! Firewall;avast! Firewall;c:\program files\AVAST Software\Avast\afwServ.exe [2012-03-06 134920]
S2 CodeMeter.exe;CodeMeter Runtime Server;c:\program files\CodeMeter\Runtime\bin\CodeMeter.exe [2012-07-19 2568120]
S2 DsiWMIService;Dritek WMI Service;c:\program files\Launch Manager\dsiwmis.exe [2011-03-31 352848]
S2 IDMWFP;IDMWFP;c:\windows\system32\DRIVERS\idmwfp.sys [2014-11-29 115752]
S2 TurboB;Turbo Boost UI Monitor driver;c:\windows\system32\DRIVERS\TurboB.sys [2009-11-02 14808]
S2 Update EnterDigital;Update EnterDigital;c:\program files\EnterDigital\updateEnterDigital.exe [2015-07-15 470256]
S2 Util EnterDigital;Util EnterDigital;c:\program files\EnterDigital\bin\utilEnterDigital.exe [2015-07-16 473840]
S2 WCMVCAM;WebcamMax, WDM Video Capture;c:\windows\system32\DRIVERS\wcmvcam.sys [2011-06-13 1066808]
S3 k57nd60x;Broadcom NetLink (TM) Gigabit Ethernet - NDIS 6.0;c:\windows\system32\DRIVERS\k57nd60x.sys [2011-01-17 350248]
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2014-10-30 21:39 1089352 ----a-w- c:\program files\Google\Chrome\Application\38.0.2125.111\Installer\chrmstp.exe
.
Contents of the 'Scheduled Tasks' folder
.
2014-11-02 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-08-11 20:00]
.
2015-07-15 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2559318703-2892093174-3465221388-1000Core.job
- c:\users\wafa\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-11-14 10:58]
.
2015-07-15 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2559318703-2892093174-3465221388-1000UA.job
- c:\users\wafa\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-11-14 10:58]
.
2014-11-02 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2014-02-04 20:14]
.
2014-11-02 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2014-02-04 20:14]
.
.
------- Supplementary Scan -------
.
IE: &Download with DAM - c:\program files\Tensons\Download Accelerator Manager\\addUrl.htm
IE: Download &All with DAM - c:\program files\Tensons\Download Accelerator Manager\\addAllUrls.htm
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
IE: Run DAM Media&Grabber - c:\program files\Tensons\Download Accelerator Manager\\runMg.htm
IE: ÊÍãíá ÇáÝíÏíæ ÈæÇÓØÉ Free Download Manager - file://c:\program files\Free Download Manager\dlfvideo.htm
IE: ÊÍãíá Çáßá ÈæÇÓØÉ Free Download Manager - file://c:\program files\Free Download Manager\dlall.htm
IE: ÊÍãíá Çáßá ÈæÇÓØÉ Internet Download Manager - c:\users\wafa\AppData\Local\Temp\Temp2_IDMan.zip\IEGetAll.htm
IE: ÊÍãíá ÇáãÍÏÏÉ ÈæÇÓØÉ Free Download Manager - file://c:\program files\Free Download Manager\dlselected.htm
IE: ÊÍãíá ÈæÇÓØÉ Free Download Manager - file://c:\program files\Free Download Manager\dllink.htm
IE: ÊÍãíá ÈæÇÓØÉ Internet Download Manager - c:\users\wafa\AppData\Local\Temp\Temp2_IDMan.zip\IEExt.htm
TCP: DhcpNameServer = 192.168.8.1 192.168.8.1
DPF: Microsoft XML Parser for Java - file:///C:/Windows/Java/classes/xmldso.cab
.
- - - - ORPHANS REMOVED - - - -
.
HKLM-Run-IObit Malware Fighter - c:\program files\IObit\IObit Malware Fighter\IMF.exe
AddRemove-Internet Download Manager - c:\users\wafa\AppData\Local\Temp\Temp2_IDMan.zip\Uninstall.exe
.
.
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_USERS\S-1-5-21-2559318703-2892093174-3465221388-1000_Classes\CLSID\{5ED60779-4DE2-4E07-B862-974CA4FF2E9C}]
@Denied: (Full) (Everyone)
@Allowed: (Read) (RestrictedCode)
"scansk"=hex(0):4d,ff,5f,d2,05,d3,75,13,e6,34,a5,08,e5,53,20,a7,d8,db,0d,8d,e3,
d3,bd,d1,51,76,64,10,28,c4,1d,d4,ca,43,3f,d2,ca,ad,20,f2,00,00,00,00,00,00,\
.
[HKEY_USERS\S-1-5-21-2559318703-2892093174-3465221388-1000_Classes\CLSID\{7B8E9164-324D-4A2E-A46D-0165FB2000EC}]
@Denied: (Full) (Everyone)
"scansk"=hex(0):31,4e,9e,17,24,df,9f,92,8c,c7,49,51,fb,fb,f7,9d,e9,7d,dd,71,2b,
64,e4,bc,78,d3,69,64,88,d5,ca,9c,da,ed,86,2c,a4,d2,8a,09,00,00,00,00,00,00,\
.
[HKEY_USERS\S-1-5-21-2559318703-2892093174-3465221388-1000_Classes\CLSID\{7f20df79-6309-454e-9ade-0b9bed775c4d}]
@Denied: (Full) (Everyone)
@Allowed: (Read) (RestrictedCode)
"Model"=dword:0000014a
"Therad"=dword:0000001d
"MData"=hex(0):73,d5,cf,b8,a4,07,89,80,31,e4,35,6b,2a,ca,fe,43,b6,1f,81,1f,5a,
1b,4d,36,46,8f,3c,f2,5c,68,ee,21,46,8f,3c,f2,5c,68,ee,21,46,8f,3c,f2,5c,68,\
.
[HKEY_USERS\S-1-5-21-2559318703-2892093174-3465221388-1000_Classes\CLSID\{de46b4d2-8e71-4d7b-ac22-9f28d556abd3}]
@Denied: (Full) (Everyone)
@Allowed: (Read) (RestrictedCode)
"Model"=dword:000000bf
"Therad"=dword:00000024
"MData"=hex(0):2b,8f,78,29,5a,0c,ce,ec,48,d4,68,e5,9f,6a,96,3e,ab,de,c5,81,26,
38,95,44,fb,b7,f5,f8,f7,48,11,a9,0d,2f,01,6d,b3,c0,ae,b6,46,8f,3c,f2,5c,68,\
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Completion time: 2015-07-16 13:47:26
ComboFix-quarantined-files.txt 2015-07-16 11:47
ComboFix2.txt 2015-07-15 22:54
.
Pre-Run: 122,429,640,704 octets libres
Post-Run: 122,398,068,736 octets libres
.
- - End Of File - - 3F1E21DCEC92F8EFC877BC2BEB94EBAB
A36C5E4F47E84449FF07ED3517B43A31