ComboFix 17-01-29.01 - OMAR 28/01/2017 21:52:50.1.2 - x86
Microsoft Windows 7 Edition Intégrale 6.1.7600.0.1256.212.1036.18.3326.2321 [GMT 0:00]
Running from: c:\users\OMAR\Desktop\ComboFix.exe
AV: ESET Smart Security 9.0.408.1 *Disabled/Updated* {EC1D6F37-E411-475A-DF50-12FF7FE4AC70}
FW: Pare-feu personnel d'ESET *Enabled* {D426EE12-AE7E-4602-F40F-BBCA8137EB0B}
SP: ESET Smart Security 9.0.408.1 *Disabled/Updated* {577C8ED3-C22B-48D4-E5E0-298D0463E6CD}
SP: Windows Defender *Enabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\Fonts\NSimar.exe
c:\windows\system32\drivers\SkyNetNXPBDA.sys
c:\windows\TEMP\VPN_6244\9218E5A4.dll
.
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Service_SkyNetNXPBDA
.
.
((((((((((((((((((((((((( Files Created from 2016-12-28 to 2017-01-28 )))))))))))))))))))))))))))))))
.
.
2017-01-28 15:43 . 2017-01-28 18:00 -------- d-----w- C:\FRST
2017-01-28 04:19 . 2017-01-28 04:19 -------- d-----w- c:\programdata\IDM
2017-01-27 21:51 . 2017-01-27 21:51 -------- d-----w- C:\zoek
2017-01-27 20:13 . 2017-01-27 20:45 -------- d-----w- C:\Pre_Scan
2017-01-27 07:27 . 2017-01-27 07:27 -------- d-----w- c:\users\OMAR\AppData\Local\IE Tab
2017-01-26 23:05 . 2017-01-26 23:09 -------- d-----w- C:\AdwCleaner
2017-01-26 22:28 . 2017-01-27 07:19 -------- d-----w- c:\users\OMAR\AppData\Roaming\ZHP
2017-01-26 19:11 . 2017-01-26 19:11 -------- d-----w- c:\program files\HDDGURU LLF Tool
2017-01-26 17:12 . 2017-01-26 17:12 -------- d-----w- c:\program files\SDA
2017-01-26 16:19 . 2017-01-26 16:20 -------- d-----w- c:\programdata\MobileBrServ
2017-01-26 06:29 . 2017-01-26 06:29 62576 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{2A7F8AB4-2C25-42A6-BAF5-06853D3C5D0E}\offreg.2768.dll
2017-01-24 16:39 . 2016-07-22 07:21 146048 ----a-w- c:\windows\system32\drivers\ssudmdm.sys
2017-01-24 16:39 . 2016-07-22 07:21 107648 ----a-w- c:\windows\system32\drivers\ssudbus.sys
2017-01-21 11:06 . 2017-01-21 11:06 -------- d-----w- c:\program files\Microsoft Silverlight
2017-01-21 10:55 . 2017-01-21 10:55 -------- d-----w- c:\users\OMAR\AppData\Roaming\Moonchild Productions
2017-01-21 10:55 . 2017-01-21 10:55 -------- d-----w- c:\users\OMAR\AppData\Local\Moonchild Productions
2017-01-21 10:55 . 2017-01-21 10:55 -------- d-----w- c:\program files\Pale Moon
2017-01-21 09:54 . 2017-01-21 10:05 -------- d-----w- c:\users\OMAR\AppData\Local\IIIQF
2017-01-21 09:11 . 2017-01-21 09:11 -------- d-----w- c:\program files\PlayReady
2017-01-20 07:23 . 2017-01-20 07:36 -------- d--h--w- c:\program files\DrFoneAndroid_Temp
2017-01-20 07:07 . 2017-01-20 07:31 -------- d-----w- c:\programdata\Wondershare
2017-01-20 06:58 . 2017-01-20 06:58 -------- d-----w- c:\users\OMAR\AppData\Roaming\MyPhoneExplorer
2017-01-20 06:58 . 2017-01-20 06:58 -------- d-----w- c:\program files\MyPhoneExplorer
2017-01-04 09:17 . 2017-01-04 09:17 62576 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{2A7F8AB4-2C25-42A6-BAF5-06853D3C5D0E}\offreg.2440.dll
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2017-01-26 19:42 . 2016-02-22 08:25 170200 ----a-w- c:\windows\system32\drivers\MBAMSwissArmy.sys
2017-01-12 06:45 . 2016-03-12 17:23 802904 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2017-01-12 06:45 . 2016-03-12 17:23 144472 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2016-12-16 08:12 . 2016-12-16 08:12 11936 ----a-w- c:\windows\system32\drivers\inpout32.sys
2016-11-22 06:15 . 2016-11-22 06:15 122496 ----a-w- c:\windows\system32\drivers\ekbdflt.sys
2016-11-22 06:15 . 2016-10-09 16:42 52872 ----a-w- c:\windows\system32\drivers\EpfwLWF.sys
2016-11-22 06:15 . 2015-12-08 15:25 206472 ----a-w- c:\windows\system32\drivers\eamonm.sys
2016-11-22 06:15 . 2015-11-27 13:03 71304 ----a-w- c:\windows\system32\drivers\epfwwfp.sys
2016-11-22 06:15 . 2015-11-27 13:03 162952 ----a-w- c:\windows\system32\drivers\epfw.sys
2016-11-22 06:15 . 2015-11-27 13:03 156288 ----a-w- c:\windows\system32\drivers\ehdrv.sys
2016-11-14 08:15 . 2016-11-14 08:15 62576 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{2A7F8AB4-2C25-42A6-BAF5-06853D3C5D0E}\offreg.2140.dll
2016-11-12 04:37 . 2016-11-12 04:37 62576 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{2A7F8AB4-2C25-42A6-BAF5-06853D3C5D0E}\offreg.2672.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ IDM Shell Extension]
@="{CDC95B92-E27C-4745-A8C5-64A52A78855D}"
[HKEY_CLASSES_ROOT\CLSID\{CDC95B92-E27C-4745-A8C5-64A52A78855D}]
2015-08-14 14:52 23520 ----a-w- c:\program files\Internet Download Manager\IDMShellExt.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IDMan"="c:\program files\Internet Download Manager\IDMan.exe" [2016-12-15 4001848]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^SoftEther VPN Client Manager Startup.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\SoftEther VPN Client Manager Startup.lnk
backup=c:\windows\pss\SoftEther VPN Client Manager Startup.lnk.CommonStartup
backupExtension=.CommonStartup
.
[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Who Is On My Wifi.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Who Is On My Wifi.lnk
backup=c:\windows\pss\Who Is On My Wifi.lnk.CommonStartup
backupExtension=.CommonStartup
.
[HKLM\~\startupfolder\C:^Users^OMAR^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Facebook Games Arcade (BETA).lnk]
path=c:\users\OMAR\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Facebook Games Arcade (BETA).lnk
backup=c:\windows\pss\Facebook Games Arcade (BETA).lnk.Startup
backupExtension=.Startup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KiesPDLR.exe]
2016-06-02 12:09 1023664 ----a-w- c:\program files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KiesTrayAgent]
2016-06-02 12:01 318128 ----a-w- c:\program files\Samsung\Kies\KiesTrayAgent.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PWRISOVM.EXE]
2015-10-08 07:00 366904 ----a-w- c:\program files\PowerISO\PWRISOVM.EXE
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoftEther VPN Client UI Helper]
2016-06-27 04:45 3957704 ----a-w- c:\program files\SoftEther VPN Client\vpnclient.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMAXPnP]
2010-06-14 23:33 1314816 ----a-w- c:\program files\Analog Devices\Core\smax4pnp.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\uTorrent]
2016-10-05 21:43 1977536 ----a-w- c:\users\OMAR\AppData\Roaming\uTorrent\uTorrent.exe
.
R1 Falcaudio;IDS FALCON/EAGLE AUDIO;c:\windows\system32\DRIVERS\falcaud.sys [2011-02-11 15232]
R2 Falcon_WDM;IDS FALCON DirectShow (WDM) Video Capture;c:\windows\system32\DRIVERS\FalconWDM.sys [2011-08-15 304128]
R3 dg_ssudbus;SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudbus.sys [2016-07-22 107648]
R3 RTL8187;Realtek RTL8187 Wireless 802.11b/g 54Mbps USB 2.0 Network Adapter;c:\windows\system32\DRIVERS\rtl8187.sys [2010-01-06 375808]
R3 ssudmdm;SAMSUNG Mobile USB Modem Drivers (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudmdm.sys [2016-07-22 146048]
S0 epfwwfp;epfwwfp;c:\windows\system32\DRIVERS\epfwwfp.sys [2016-11-22 71304]
S1 eamonm;eamonm;c:\windows\system32\DRIVERS\eamonm.sys [2016-11-22 206472]
S1 ehdrv;ehdrv;c:\windows\system32\DRIVERS\ehdrv.sys [2016-11-22 156288]
S1 EpfwLWF;ESET Personal Firewall;c:\windows\system32\DRIVERS\EpfwLWF.sys [2016-11-22 52872]
S1 ndisrd;WinpkFilter LightWeight Filter;c:\windows\system32\DRIVERS\ndisrd.sys [2014-08-14 37408]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2013-04-30 217088]
S2 ekbdflt;ekbdflt;c:\windows\system32\DRIVERS\ekbdflt.sys [2016-11-22 122496]
S2 ekrn;ESET Service;c:\program files\ESET\ESET Smart Security\ekrn.exe [2016-11-22 2166040]
S2 FoxitReaderService;Foxit Reader Service;c:\program files\FOXIT SOFTWARE\FOXIT READER\FoxitConnectedPDFService.exe [2016-06-21 1647808]
S2 IDMWFP;IDMWFP;c:\windows\system32\DRIVERS\idmwfp.sys [2016-10-17 147120]
S2 inpout32;inpout32;c:\windows\system32\Drivers\inpout32.sys [2016-12-16 11936]
S2 Mobile Broadband HL Service;Mobile Broadband HL Service;c:\programdata\MobileBrServ\mbbservice.exe [2014-02-15 239184]
S2 SEVPNCLIENT;SoftEther VPN Client;c:\program files\SoftEther VPN Client\vpnclient.exe [2016-06-27 3957704]
S2 ss_conn_service;SAMSUNG Mobile Connectivity Service;c:\program files\Samsung\USB Drivers\27_ssconn\conn\ss_conn_service.exe [2016-07-22 754784]
S3 AtiHDAudioService;AMD Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW73.sys [2016-01-17 78848]
S3 dc3d;MS Hardware Device Detection Driver (USB);c:\windows\system32\DRIVERS\dc3d.sys [2016-08-15 83248]
S3 MTKSCVAD;Ralink Virtual Audio device;c:\windows\system32\drivers\mtkvad.sys [2012-07-16 37376]
S3 Neo_VPN;VPN Client Device Driver - VPN;c:\windows\system32\DRIVERS\Neo_0052.sys [2016-06-27 37920]
.
.
--- Other Services/Drivers In Memory ---
.
*NewlyCreated* - WS2IFSL
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2016-12-14 22:31 1384792 ----a-w- c:\program files\Google\Chrome\Application\55.0.2883.87\Installer\chrmstp.exe
.
Contents of the 'Scheduled Tasks' folder
.
2017-01-28 c:\windows\Tasks\Adobe Flash Player PPAPI Notifier.job
- c:\windows\system32\Macromed\Flash\FlashUtil32_24_0_0_194_pepper.exe [2017-01-12 06:45]
.
2017-01-28 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2016-03-12 06:45]
.
.
------- Supplementary Scan -------
.
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: Télécharger avec IDM - c:\program files\Internet Download Manager\IEExt.htm
IE: Télécharger tous les liens avec IDM - c:\program files\Internet Download Manager\IEGetAll.htm
Trusted Zone: eset.com\help
TCP: DhcpNameServer = 192.168.1.1
FF - ProfilePath -
.
- - - - ORPHANS REMOVED - - - -
.
MSConfigStartUp-BlueStacks Agent - c:\program files\BlueStacks\HD-Agent.exe
AddRemove-01_Simmental - c:\program files\Samsung\USB Drivers\01_Simmental\Uninstall.exe
AddRemove-02_Siberian - c:\program files\Samsung\USB Drivers\02_Siberian\Uninstall.exe
AddRemove-03_Swallowtail - c:\program files\Samsung\USB Drivers\03_Swallowtail\Uninstall.exe
AddRemove-04_semseyite - c:\program files\Samsung\USB Drivers\04_semseyite\Uninstall.exe
AddRemove-05_Sloan - c:\program files\SAMSUNG\USB Drivers\05_Sloan\Uninstall.exe
AddRemove-06_Spencer - c:\program files\SAMSUNG\USB Drivers\06_Spencer\Uninstall.exe
AddRemove-07_Schorl - c:\program files\Samsung\USB Drivers\07_Schorl\Uninstall.exe
AddRemove-08_EMPChipset - c:\program files\SAMSUNG\USB Drivers\08_EMPChipset\Uninstall.exe
AddRemove-09_Hsp - c:\program files\Samsung\USB Drivers\09_Hsp\Uninstall.exe
AddRemove-11_HSP_Plus_Default - c:\program files\Samsung\USB Drivers\11_HSP_Plus_Default\Uninstall.exe
AddRemove-12_Symbian_USB_Download_Driver - c:\program files\SAMSUNG\USB Drivers\12_Symbian_USB_Download_Driver\Uninstall.exe
AddRemove-15_Symbian_Samsung_PC_DLC_Driver - c:\program files\SAMSUNG\USB Drivers\15_Symbian_Samsung_PC_DLC_Driver\Uninstall.exe
AddRemove-16_Shrewsbury - c:\program files\Samsung\USB Drivers\16_Shrewsbury\Uninstall.exe
AddRemove-17_EMP_Chipset2 - c:\program files\SAMSUNG\USB Drivers\17_EMP_Chipset2\Uninstall.exe
AddRemove-18_Zinia_Serial_Driver - c:\program files\SAMSUNG\USB Drivers\18_Zinia_Serial_Driver\Uninstall.exe
AddRemove-19_VIA_driver - c:\program files\SAMSUNG\USB Drivers\19_VIA_driver\Uninstall.exe
AddRemove-20_NXP_Driver - c:\program files\Samsung\USB Drivers\20_NXP_Driver\Uninstall.exe
AddRemove-21_Searsburg - c:\program files\SAMSUNG\USB Drivers\21_Searsburg\Uninstall.exe
AddRemove-22_WiBro_WiMAX - c:\program files\SAMSUNG\USB Drivers\22_WiBro_WiMAX\Uninstall.exe
AddRemove-24_flashusbdriver - c:\program files\Samsung\USB Drivers\24_flashusbdriver\Uninstall.exe
AddRemove-25_escape - c:\program files\Samsung\USB Drivers\25_escape\Uninstall.exe
AddRemove-27_ssconn - c:\program files\Samsung\USB Drivers\27_ssconn\Uninstall.exe
.
.
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VideoLAN.VLCPlugin.*1*]
@="?????????????????? v1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VideoLAN.VLCPlugin.*1*\CLSID]
@="{E23FE9C6-778E-49D4-B537-38FCDE4887D8}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VideoLAN.VLCPlugin.*2*]
@="?????????????????? v2"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VideoLAN.VLCPlugin.*2*\CLSID]
@="{9BE31822-FDAD-461B-AD51-BE1D1C159921}"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0012\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0013\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\atieclxx.exe
c:\windows\system32\taskhost.exe
c:\windows\system32\conhost.exe
c:\program files\Kerish Doctor\KerishDoctor.exe
c:\program files\Microsoft Mouse and Keyboard Center\ipoint.exe
c:\program files\Microsoft Mouse and Keyboard Center\itype.exe
c:\windows\system32\sppsvc.exe
c:\program files\ESET\ESET Smart Security\egui.exe
c:\windows\system32\WUDFHost.exe
.
**************************************************************************
.
Completion time: 2017-01-28 22:03:03 - machine was rebooted
ComboFix-quarantined-files.txt 2017-01-28 22:03
.
Pre-Run: 59 074 691 072 octets libres
Post-Run: 58 830 299 136 octets libres
.
- - End Of File - - C5241B4E0DD0F76B8EA6A4B6425AFA7A
A36C5E4F47E84449FF07ED3517B43A31