ComboFix 17-03-28.01 - ãäíÑ 03/28/2017 18:59:50.1.1 - x86
Microsoft Windows 7 Ultimate 6.1.7601.1.1256.218.1025.18.1014.399 [GMT 2:00]
Running from: d:\?Ø?Û?æØ??\ComboFix.exe
AV: Avira Desktop *Disabled/Outdated* {4D041356-F94D-285F-8768-AAE50FA36859}
SP: Avira Desktop *Disabled/Outdated* {F665F2B2-DF77-27D1-BDD8-9197742422E4}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((( Files Created from 2017-02-28 to 2017-03-28 )))))))))))))))))))))))))))))))
.
.
2017-03-28 17:08 . 2017-03-28 17:08 -------- d-----w- c:\users\Default\AppData\Local\temp
2017-03-28 09:30 . 2017-03-22 11:05 10167496 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{9152865A-0FB4-4B83-BA44-E39B74CB11EA}\mpengine.dll
2017-03-27 19:57 . 2017-03-27 19:57 -------- d-----w- c:\program files\EaseUS
2017-03-27 16:12 . 2017-03-27 16:23 -------- d-----w- c:\program files\Cela.C.M_HW
2017-03-26 11:07 . 2017-02-18 14:05 1331200 ----a-w- c:\windows\system32\appraiser.dll
2017-03-26 11:07 . 2017-02-22 23:24 971776 ----a-w- c:\windows\system32\aeinv.dll
2017-03-26 11:07 . 2017-02-18 14:05 505344 ----a-w- c:\windows\system32\generaltel.dll
2017-03-26 11:07 . 2016-12-31 15:36 442368 ----a-w- c:\windows\system32\devinv.dll
2017-03-26 11:07 . 2016-12-31 15:36 183808 ----a-w- c:\windows\system32\aepic.dll
2017-03-26 11:07 . 2017-02-22 23:29 71400 ----a-w- c:\windows\system32\CompatTelRunner.exe
2017-03-26 11:07 . 2016-12-31 15:36 270848 ----a-w- c:\windows\system32\invagent.dll
2017-03-26 11:07 . 2016-12-31 15:36 212480 ----a-w- c:\windows\system32\centel.dll
2017-03-26 11:07 . 2016-12-31 15:36 104960 ----a-w- c:\windows\system32\acmigration.dll
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2017-03-28 10:20 . 2017-01-09 18:06 170200 ----a-w- c:\windows\system32\drivers\MBAMSwissArmy.sys
2017-01-13 21:45 . 2017-01-13 21:45 194048 ----a-w- c:\windows\system32\elshyph.dll
2017-01-13 21:45 . 2017-01-13 21:45 71680 ----a-w- c:\windows\system32\RegisterIEPKEYs.exe
2017-01-13 21:45 . 2017-01-13 21:45 645120 ----a-w- c:\windows\system32\jsIntl.dll
2017-01-13 21:45 . 2017-01-13 21:45 182272 ----a-w- c:\windows\system32\msls31.dll
2017-01-13 21:45 . 2017-01-13 21:45 62464 ----a-w- c:\windows\system32\tdc.ocx
2017-01-13 21:45 . 2017-01-13 21:45 24576 ----a-w- c:\windows\system32\licmgr10.dll
2017-01-13 21:45 . 2017-01-13 21:45 151552 ----a-w- c:\windows\system32\iexpress.exe
2017-01-13 21:45 . 2017-01-13 21:45 139264 ----a-w- c:\windows\system32\wextract.exe
2017-01-13 21:45 . 2017-01-13 21:45 36352 ----a-w- c:\windows\system32\imgutil.dll
2017-01-13 21:45 . 2017-01-13 21:45 13312 ----a-w- c:\windows\system32\mshta.exe
2017-01-13 21:45 . 2017-01-13 21:45 86016 ----a-w- c:\windows\system32\iesysprep.dll
2017-01-13 21:45 . 2017-01-13 21:45 74240 ----a-w- c:\windows\system32\SetIEInstalledDate.exe
2017-01-13 21:45 . 2017-01-13 21:45 48640 ----a-w- c:\windows\system32\mshtmler.dll
2017-01-13 21:45 . 2017-01-13 21:45 111616 ----a-w- c:\windows\system32\IEAdvpack.dll
2017-01-13 21:44 . 2017-01-13 21:44 49152 ----a-w- c:\windows\system32\taskhost.exe
2017-01-13 21:43 . 2017-01-13 21:43 4096 ---ha-w- c:\windows\system32\api-ms-win-downlevel-user32-l1-1-0.dll
2017-01-13 21:43 . 2017-01-13 21:43 9728 ---ha-w- c:\windows\system32\api-ms-win-downlevel-shlwapi-l1-1-0.dll
2017-01-13 21:43 . 2017-01-13 21:43 5632 ---ha-w- c:\windows\system32\api-ms-win-downlevel-shlwapi-l2-1-0.dll
2017-01-13 21:43 . 2017-01-13 21:43 5632 ---ha-w- c:\windows\system32\api-ms-win-downlevel-ole32-l1-1-0.dll
2017-01-13 21:43 . 2017-01-13 21:43 364544 ----a-w- c:\windows\system32\XpsGdiConverter.dll
2017-01-13 21:43 . 2017-01-13 21:43 3584 ---ha-w- c:\windows\system32\api-ms-win-downlevel-advapi32-l2-1-0.dll
2017-01-13 21:43 . 2017-01-13 21:43 3072 ---ha-w- c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
2017-01-13 21:43 . 2017-01-13 21:43 3072 ---ha-w- c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
2017-01-13 21:43 . 2017-01-13 21:43 2560 ---ha-w- c:\windows\system32\api-ms-win-downlevel-normaliz-l1-1-0.dll
2017-01-13 21:43 . 2017-01-13 21:43 249856 ----a-w- c:\windows\system32\d3d10_1core.dll
2017-01-13 21:43 . 2017-01-13 21:43 220160 ----a-w- c:\windows\system32\d3d10core.dll
2017-01-13 21:43 . 2017-01-13 21:43 207872 ----a-w- c:\windows\system32\WindowsCodecsExt.dll
2017-01-13 21:43 . 2017-01-13 21:43 161792 ----a-w- c:\windows\system32\d3d10_1.dll
2017-01-13 21:43 . 2017-01-13 21:43 1158144 ----a-w- c:\windows\system32\XpsPrint.dll
2017-01-13 21:43 . 2017-01-13 21:43 1080832 ----a-w- c:\windows\system32\d3d10.dll
2017-01-13 21:43 . 2017-01-13 21:43 10752 ---ha-w- c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
2017-01-13 21:43 . 2017-01-13 21:43 293376 ----a-w- c:\windows\system32\dxgi.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CCleaner Monitoring"="c:\program files\CCleaner\CCleaner.exe" [2015-09-16 6495144]
"CCleaner"="c:\program files\CCleaner\CCleaner.exe" [2015-09-16 6495144]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2014-11-27 702768]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
R2 MBAMService;MBAMService;c:\program files\Malwarebytes Anti-Malware\mbamservice.exe [2016-03-10 1136608]
R3 dmvsc;dmvsc;c:\windows\system32\drivers\dmvsc.sys [2010-11-20 62464]
R3 hid8103;hid8103;c:\windows\system32\drivers\hid8103.sys [2006-10-25 31128]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe [2017-03-04 103936]
R3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\MBAMSwissArmy.sys [2017-03-28 170200]
R3 MBAMWebAccessControl;MBAMWebAccessControl;c:\windows\system32\drivers\mwac.sys [2016-03-10 53120]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [2012-08-23 14848]
R3 SrvHsfHDA;SrvHsfHDA;c:\windows\system32\DRIVERS\VSTAZL3.SYS [2009-07-13 207360]
R3 SrvHsfV92;SrvHsfV92;c:\windows\system32\DRIVERS\VSTDPV3.SYS [2009-07-13 980992]
R3 SrvHsfWinac;SrvHsfWinac;c:\windows\system32\DRIVERS\VSTCNXT3.SYS [2009-07-13 661504]
R3 Synth3dVsc;Synth3dVsc;c:\windows\system32\drivers\synth3dvsc.sys [2010-11-20 77184]
R3 terminpt;Microsoft Remote Desktop Input Driver;c:\windows\system32\drivers\terminpt.sys [2012-08-23 24064]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2013-10-02 49152]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [2010-11-20 27264]
R3 tsusbhub;tsusbhub;c:\windows\system32\drivers\tsusbhub.sys [2010-11-20 112640]
R3 VGPU;VGPU;c:\windows\system32\drivers\rdvgkmd.sys [x]
S1 avfwot;avfwot;c:\windows\system32\DRIVERS\avfwot.sys [2014-11-27 113024]
S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys [2014-11-27 37352]
S2 AntiVirFirewallService;Avira FireWall;c:\program files\Avira\AntiVir Desktop\avfwsvc.exe [2014-11-27 1044784]
S2 AntiVirMailService;Avira ÍãÇíÉ ÇáÈÑíÏ;c:\program files\Avira\AntiVir Desktop\avmailc7.exe [2014-11-27 807672]
S2 AntiVirSchedulerService;Avira Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [2014-11-27 431920]
S2 AntiVirWebService;Avira Web Protection;c:\program files\Avira\AntiVir Desktop\avwebg7.exe [2014-11-27 993584]
S2 avnetflt;avnetflt;c:\windows\system32\DRIVERS\avnetflt.sys [2014-11-27 37384]
S2 DiagTrack;Diagnostics Tracking Service;c:\windows\System32\svchost.exe [2009-07-14 20992]
S2 MaxthonUpdateSvc;Maxthon Core Update Service;c:\program files\Maxthon\Modules\Service\Update\MaxthonUpdateSvc.exe [2015-05-11 1872152]
S3 avfwim;AvFw Packet Filter Miniport;c:\windows\system32\DRIVERS\avfwim.sys [2014-11-27 92448]
S3 bcm;WiMAX Network Adapter;c:\windows\system32\DRIVERS\drxvi314.sys [2010-06-18 324096]
S3 bcmbusctr;WiMAX Bus Driver;c:\windows\system32\DRIVERS\BcmBusCtr.sys [2010-06-18 51072]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2016-03-10 24448]
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceAndNoImpersonation REG_MULTI_SZ SSDPSRV upnphost SCardSvr fdrespub AppIDSvc QWAVE wcncsvc Mcx2Svc SensrSvc
utcsvc REG_MULTI_SZ DiagTrack
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2017-03-13 10:08 1368920 ----a-w- c:\program files\Google\Chrome\Application\56.0.2924.87\Installer\chrmstp.exe
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/
TCP: DhcpNameServer = 62.240.32.5 62.68.42.2
TCP: Interfaces\{B37A73C7-CDBB-4D48-A4B5-BBF82E321FF4}: NameServer = 8.8.8.8,8.8.4.4
.
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Completion time: 2017-03-28 19:10:37
ComboFix-quarantined-files.txt 2017-03-28 17:10
.
Pre-Run: 107,177,664,512 bytes free
Post-Run: 106,958,532,608 bytes free
.
- - End Of File - - 6ED97EBB80372CE819A703262B45471D
A36C5E4F47E84449FF07ED3517B43A31