ComboFix 17-01-29.01 - windows 01/29/2017 14:33:26.1.2 - x86
Microsoft Windows 7 Ultimate 6.1.7601.1.1256.213.1025.18.2012.1210 [GMT 1:00]
Running from: c:\users\windows\Desktop\ComboFix.exe
AV: ESET Smart Security 9.0.408.1 *Disabled/Updated* {EC1D6F37-E411-475A-DF50-12FF7FE4AC70}
FW: ÌÏÇÑ ÇáÍãÇíÉ ÇáÔÎÕí ESET *Disabled* {D426EE12-AE7E-4602-F40F-BBCA8137EB0B}
SP: ESET Smart Security 9.0.408.1 *Disabled/Updated* {577C8ED3-C22B-48D4-E5E0-298D0463E6CD}
SP: Windows Defender *Enabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\windows\ZHPCleaner.exe
.
.
((((((((((((((((((((((((( Files Created from 2016-12-28 to 2017-01-29 )))))))))))))))))))))))))))))))
.
.
2017-02-23 13:15 . 2017-02-23 13:15 -------- d-----w- c:\users\windows\AppData\Local\ElevatedDiagnostics
2017-02-20 22:37 . 2017-02-21 20:25 -------- d-----w- c:\users\windows\AppData\Roaming\ZHP
2017-02-07 13:35 . 2016-12-30 22:26 9561744 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{A5F0F3BD-CE1B-44CD-8E42-2FA70F02B3A8}\mpengine.dll
2017-01-30 13:12 . 2017-01-30 13:13 6930376 ----a-w- C:\idmupdtf.exe
2017-01-26 14:41 . 2016-10-17 15:35 147120 ----a-w- c:\windows\system32\drivers\idmwfp.sys
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2017-02-23 12:53 . 2016-10-29 20:45 119512 ----a-w- c:\windows\system32\drivers\MBAMSwissArmy.sys
2017-02-14 22:46 . 2016-02-14 12:52 802904 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2017-02-14 22:46 . 2016-02-14 12:52 144472 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2016-11-29 13:55 . 2016-11-29 13:55 122496 ----a-w- c:\windows\system32\drivers\ekbdflt.sys
2016-11-29 13:55 . 2016-06-23 13:31 71304 ----a-w- c:\windows\system32\drivers\epfwwfp.sys
2016-11-29 13:55 . 2016-06-23 13:31 206472 ----a-w- c:\windows\system32\drivers\eamonm.sys
2016-11-29 13:55 . 2016-06-23 13:31 162952 ----a-w- c:\windows\system32\drivers\epfw.sys
2016-11-29 13:55 . 2016-06-23 13:31 156288 ----a-w- c:\windows\system32\drivers\ehdrv.sys
2016-11-29 13:55 . 2016-02-23 14:25 52872 ----a-w- c:\windows\system32\drivers\EpfwLWF.sys
2016-11-28 17:29 . 2016-08-24 21:12 24688 ----a-w- c:\windows\system32\drivers\TrueSight.sys
2016-11-11 19:49 . 2016-09-17 12:15 48648 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\UpdateableMarkup\Markup.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\~\Browser Helper Objects\{10921475-03CE-4E04-90CE-E2E7EF20C814}]
2016-05-23 20:49 759072 ----a-w- c:\program files\IObit\IObit Uninstaller\UninstallExplorer.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ IDM Shell Extension]
@="{CDC95B92-E27C-4745-A8C5-64A52A78855D}"
[HKEY_CLASSES_ROOT\CLSID\{CDC95B92-E27C-4745-A8C5-64A52A78855D}]
2015-08-14 14:52 23520 ----a-w- c:\program files\Internet Download Manager\IDMShellExt.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"f.lux"="c:\users\windows\AppData\Local\FluxSoftware\Flux\flux.exe" [2013-10-23 1017224]
"CCleaner Monitoring"="c:\program files\CCleaner\CCleaner.exe" [2017-02-08 7347928]
"IDMan"="c:\program files\Internet Download Manager\IDMan.exe" [2017-01-30 4015216]
"CCleaner"="c:\program files\CCleaner\CCleaner.exe" [2017-02-08 7347928]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-26 31016]
"USB Security"="c:\program files\USB Disk Security\USBGuard.exe" [2011-01-31 623520]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
"SoftwareSASGeneration"= 1 (0x1)
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\E617A003.sys]
@="Driver"
.
R2 IObitUnSvr;IObit Uninstaller Service;c:\program files\IObit\IObit Uninstaller\IUService.exe [2016-10-28 360736]
R2 MBAMScheduler;MBAMScheduler;c:\program files\Malwarebytes Anti-Malware\mbamscheduler.exe [2015-03-17 1871160]
R2 MBAMService;MBAMService;c:\program files\Malwarebytes Anti-Malware\mbamservice.exe [2015-03-17 1080120]
R3 dmvsc;dmvsc;c:\windows\system32\drivers\dmvsc.sys [2010-11-20 62464]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe [2016-04-24 102912]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2016-03-10 24448]
R3 MBAMWebAccessControl;MBAMWebAccessControl;c:\windows\system32\drivers\mwac.sys [2016-03-10 53120]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [2016-05-03 14848]
R3 Synth3dVsc;Synth3dVsc;c:\windows\system32\drivers\synth3dvsc.sys [2010-11-20 77184]
R3 terminpt;Microsoft Remote Desktop Input Driver;c:\windows\system32\drivers\terminpt.sys [2016-05-03 24064]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2016-05-03 49152]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [2016-05-03 27136]
R3 tsusbhub;tsusbhub;c:\windows\system32\drivers\tsusbhub.sys [2010-11-20 112640]
S0 E617A003;E617A003;c:\windows\system32\drivers\E617A003.sys [2016-04-08 153784]
S0 epfwwfp;epfwwfp;c:\windows\system32\DRIVERS\epfwwfp.sys [2016-11-29 71304]
S1 eamonm;eamonm;c:\windows\system32\DRIVERS\eamonm.sys [2016-11-29 206472]
S1 ehdrv;ehdrv;c:\windows\system32\DRIVERS\ehdrv.sys [2016-11-29 156288]
S1 EpfwLWF;ESET Personal Firewall;c:\windows\system32\DRIVERS\EpfwLWF.sys [2016-11-29 52872]
S2 ekbdflt;ekbdflt;c:\windows\system32\DRIVERS\ekbdflt.sys [2016-11-29 122496]
S2 ekrn;ESET Service;c:\program files\ESET\ESET Smart Security\ekrn.exe [2016-11-29 2166040]
S2 IDMWFP;IDMWFP;c:\windows\system32\DRIVERS\idmwfp.sys [2016-10-17 147120]
S3 solo;TerraTec Base2PCI (WDM);c:\windows\system32\drivers\solo.sys [2000-07-10 73873]
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2017-02-06 19:25 1368920 ----a-w- c:\program files\Google\Chrome\Application\56.0.2924.87\Installer\chrmstp.exe
.
Contents of the 'Scheduled Tasks' folder
.
2017-02-18 c:\windows\Tasks\Adobe Flash Player PPAPI Notifier.job
- c:\windows\system32\Macromed\Flash\FlashUtil32_24_0_0_221_pepper.exe [2017-02-14 22:46]
.
2017-01-29 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2016-02-14 22:46]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/
IE: Ê&ÕÏíÑ Åáì Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: ÊÍãíá Çáßá ÈæÇÓØÉ Internet Download Manager - c:\program files\Internet Download Manager\IEGetAll.htm
IE: ÊÍãíá ÈæÇÓØÉ Internet Download Manager - c:\program files\Internet Download Manager\IEExt.htm
Trusted Zone: eset.com\help
TCP: DhcpNameServer = 192.168.1.1 0.0.0.0
TCP: Interfaces\{07FC3D91-9359-4CB0-8788-95F211F6361E}: NameServer = 8.8.8.8,8.8.4.4
FF - ProfilePath - c:\users\windows\AppData\Roaming\Mozilla\Firefox\Profiles\p4f63ept.default\
.
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil32_24_0_0_221_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil32_24_0_0_221_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}]
@Denied: (A 2) (Everyone)
@="IFlashBroker6"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Completion time: 2017-01-29 14:49:28
ComboFix-quarantined-files.txt 2017-01-29 13:49
.
Pre-Run: 87,606,177,792 bytes free
Post-Run: 87,333,978,112 bytes free
.
- - End Of File - - 380308453537E71F6E79F9F247DA560A
A36C5E4F47E84449FF07ED3517B43A31