ComboFix 17-03-21.01 - ibrahim 03/22/2017 16:01:59.1.2 - x86
Microsoft Windows 7 Ultimate 6.1.7601.1.1256.213.1025.18.1984.1496 [GMT 1:00]
Running from: c:\users\ibrahim\Desktop\ComboFix.exe
AV: Avast Antivirus *Disabled/Updated* {8EA8924E-BC81-DC44-8BB0-8BAE75D86EBF}
SP: Avast Antivirus *Disabled/Updated* {35C973AA-9ABB-D3CA-B100-B0DC0E5F2402}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
C:\windows7.arc
.
.
((((((((((((((((((((((((( Files Created from 2017-02-22 to 2017-03-22 )))))))))))))))))))))))))))))))
.
.
2017-03-22 15:09 . 2017-03-22 15:09 -------- d-----w- c:\users\Default\AppData\Local\temp
2017-03-22 11:45 . 2017-03-22 11:45 -------- d-----w- c:\program files\CPUID
2017-03-21 17:22 . 2017-01-30 11:09 144416 ----a-w- c:\windows\system32\drivers\KeyCrypt32.sys
2017-03-21 17:22 . 2017-03-22 08:01 -------- d-----w- c:\program files\KeyCryptSDK
2017-03-21 17:22 . 2017-03-22 11:43 -------- d-----w- c:\program files\Zemana AntiLogger
2017-03-21 17:11 . 2017-03-21 17:11 -------- d-----w- c:\program files\FastStone Capture
2017-03-21 16:59 . 2010-06-02 03:55 74072 ----a-w- c:\windows\system32\XAPOFX1_5.dll
2017-03-21 16:59 . 2010-06-02 03:55 527192 ----a-w- c:\windows\system32\XAudio2_7.dll
2017-03-21 16:59 . 2010-05-26 10:41 2106216 ----a-w- c:\windows\system32\D3DCompiler_43.dll
2017-03-21 16:58 . 2010-05-26 10:41 248672 ----a-w- c:\windows\system32\d3dx11_43.dll
2017-03-21 16:55 . 2012-07-17 13:54 1178920 ----a-w- c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDRES.DLL
2017-03-21 16:55 . 2012-07-17 13:51 441592 ----a-w- c:\program files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
2017-03-21 16:55 . 2012-07-17 13:50 857352 ----a-w- c:\program files\Common Files\Microsoft Shared\Windows Live\wlidcli.dll
2017-03-21 16:55 . 2012-07-17 13:50 58136 ----a-w- c:\program files\Common Files\Microsoft Shared\Windows Live\msidcrl40.dll
2017-03-21 16:55 . 2012-07-17 13:49 333056 ----a-w- c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDCREDPROV.DLL
2017-03-21 16:55 . 2012-07-17 13:49 238848 ----a-w- c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDPROV.DLL
2017-03-21 16:55 . 2012-07-17 13:49 145648 ----a-w- c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL
2017-03-21 16:55 . 2017-03-21 16:56 -------- d-----w- c:\program files\Windows Live
2017-03-21 16:55 . 2017-03-21 16:55 -------- d-----w- c:\program files\Windows Movie Maker
2017-03-21 13:01 . 2017-03-21 13:01 -------- d-----w- c:\program files\MyPlayCity.com
2017-03-21 12:05 . 2017-03-21 12:05 -------- d-----w- c:\program files\Common Files\AV
2017-03-21 12:04 . 2017-03-21 17:09 465024 ----a-w- c:\windows\system32\drivers\aswsp.sys
2017-03-21 12:04 . 2017-03-21 12:05 278776 ----a-w- c:\windows\system32\drivers\aswvmm.sys
2017-03-21 12:04 . 2017-03-21 12:03 118288 ----a-w- c:\windows\system32\drivers\aswStm.sys
2017-03-21 12:04 . 2017-03-21 12:03 62152 ----a-w- c:\windows\system32\drivers\aswRvrt.sys
2017-03-21 12:04 . 2017-03-21 12:03 34136 ----a-w- c:\windows\system32\drivers\aswHwid.sys
2017-03-21 12:04 . 2017-03-21 12:03 106392 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys
2017-03-21 12:04 . 2017-03-21 12:03 90336 ----a-w- c:\windows\system32\drivers\aswRdr2.sys
2017-03-21 12:04 . 2017-03-21 12:03 756200 ----a-w- c:\windows\system32\drivers\aswSnx.sys
2017-03-21 12:03 . 2017-03-21 12:03 921280 ----a-w- c:\windows\ucrtbase.dll
2017-03-21 12:03 . 2017-03-21 12:03 328208 ----a-w- c:\windows\system32\aswBoot.exe
2017-03-21 11:26 . 2017-03-21 11:26 -------- d-----w- c:\program files\AVAST Software
2017-03-21 11:18 . 2017-03-21 11:18 -------- d-----w- c:\programdata\AVAST Software
2017-03-20 09:20 . 2017-03-20 09:20 -------- d-----w- c:\programdata\AVS4YOU
2017-03-20 09:16 . 2017-03-20 09:19 -------- d-----w- c:\program files\AVS4YOU
2017-03-20 09:16 . 2011-06-23 11:26 1700352 ----a-w- c:\windows\system32\GdiPlus.dll
2017-03-20 09:16 . 2011-06-23 11:25 24576 ----a-w- c:\windows\system32\msxml3a.dll
2017-03-19 16:27 . 2017-03-19 16:27 -------- d-----w- c:\programdata\TuneUp Software
2017-03-19 16:26 . 2017-03-19 16:26 -------- d-sh--w- c:\programdata\{55A29068-F2CE-456C-9148-C869879E2357}
2017-03-19 15:05 . 2014-05-14 16:23 45536 ----a-w- c:\windows\system32\wups2.dll
2017-03-19 15:05 . 2014-05-14 16:23 54240 ----a-w- c:\windows\system32\wuauclt.exe
2017-03-19 15:05 . 2014-05-14 16:23 1973728 ----a-w- c:\windows\system32\wuaueng.dll
2017-03-19 15:05 . 2014-05-14 16:17 2425856 ----a-w- c:\windows\system32\wucltux.dll
2017-03-19 15:05 . 2014-05-14 16:23 36320 ----a-w- c:\windows\system32\wups.dll
2017-03-19 15:05 . 2014-05-14 16:23 581600 ----a-w- c:\windows\system32\wuapi.dll
2017-03-19 15:05 . 2014-05-14 16:17 92672 ----a-w- c:\windows\system32\wudriver.dll
2017-03-19 15:05 . 2014-05-14 08:23 179656 ----a-w- c:\windows\system32\wuwebv.dll
2017-03-19 15:05 . 2014-05-14 08:17 33792 ----a-w- c:\windows\system32\wuapp.exe
2017-03-19 10:44 . 2017-02-22 11:48 9992952 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{0ACD6C10-ED81-476C-8A84-449488E539A1}\mpengine.dll
2017-03-19 10:44 . 2016-10-26 16:29 407720 ------w- c:\windows\system32\MpSigStub.exe
2017-03-19 09:56 . 2017-03-19 09:58 -------- d-----w- c:\program files\The KMPlayer
2017-03-18 18:41 . 2017-03-21 17:06 -------- d-----w- c:\program files\Bonjour
2017-03-18 18:41 . 2017-03-18 18:41 -------- d-----w- c:\programdata\Apple
2017-03-18 18:40 . 2017-03-18 18:40 -------- d-----w- c:\program files\DearMob
2017-03-18 18:40 . 2017-03-18 18:40 -------- d-----w- c:\program files\Foxit Software
2017-03-18 18:38 . 2017-03-19 06:32 -------- d-----w- c:\program files\CCleaner
2017-03-18 11:52 . 2017-03-18 11:52 -------- d-----w- c:\programdata\Package Cache
2017-03-18 11:50 . 2017-03-18 11:56 -------- d-----w- c:\program files\Kodi
2017-03-18 09:38 . 2017-03-18 11:54 -------- d-----w- c:\program files\MKV Player
2017-03-18 08:05 . 2017-03-18 08:04 6656 ----a-w- c:\windows\system32\SiSApi.dll
2017-03-18 08:05 . 2017-03-18 08:05 -------- d-----w- c:\program files\SiS VGA Utilities
2017-03-18 08:04 . 2017-03-18 08:04 6656 ----a-w- c:\windows\system32\SiSCo.dll
2017-03-18 08:04 . 2017-03-18 08:04 655360 ----a-w- c:\windows\system32\SiSClone.dll
2017-03-18 08:04 . 2017-03-18 08:04 5632 ----a-w- c:\windows\system32\SiSKrl.dll
2017-03-18 08:04 . 2017-03-18 08:04 466432 ----a-w- c:\windows\system32\drivers\SISGRKMD.sys
2017-03-18 08:04 . 2017-03-18 08:04 4080128 ----a-w- c:\windows\system32\SiSGlv.dll
2017-03-18 08:04 . 2017-03-18 08:04 3653632 ----a-w- c:\windows\system32\SISGRUMD.dll
2017-03-18 08:04 . 2017-03-18 08:04 212992 ----a-w- c:\windows\system32\SiSFunc.dll
2017-03-18 07:46 . 2017-03-18 07:46 -------- d-----w- c:\program files\Combined Community Codec Pack
2017-03-18 07:01 . 2017-03-18 18:35 -------- d-----w- C:\KMPlayer
2017-03-18 06:55 . 2017-03-18 06:55 58400 ----a-w- c:\windows\system32\drivers\sisagpx.sys
2017-03-18 06:34 . 2017-03-18 06:34 -------- d-----w- c:\programdata\IDM
2017-03-18 06:34 . 2017-03-18 06:34 -------- d-----w- c:\program files\Internet Download Manager
2017-03-18 06:32 . 2017-03-18 06:32 -------- d-----w- c:\program files\Your Uninstaller 2010
2017-03-17 20:04 . 2017-03-18 18:39 -------- d-----w- c:\windows\Panther
2017-03-17 19:56 . 2017-03-17 19:56 -------- d-----w- C:\Windows.old
2017-03-17 19:35 . 2017-03-18 06:35 -------- d-----w- c:\program files\PdaNet for Android
2017-03-17 13:06 . 2017-03-17 13:06 -------- d-----w- c:\programdata\Ralink
2017-03-17 13:06 . 2011-09-08 04:51 237568 ----a-w- c:\windows\system32\ssleay32.dll
2017-03-17 13:06 . 2011-09-08 04:50 1100288 ----a-w- c:\windows\system32\libeay32.dll
2017-03-17 12:44 . 2017-03-17 12:44 -------- d-----w- c:\programdata\ProductData
2017-03-17 12:44 . 2017-03-17 12:44 -------- d-----w- c:\windows\IObit
2017-03-17 12:43 . 2017-03-17 12:43 -------- d-----w- c:\programdata\IObit
2017-03-17 12:43 . 2017-03-17 12:43 23840 ----a-w- c:\windows\system32\drivers\HWiNFO32.SYS
2017-03-17 12:43 . 2017-03-17 12:43 -------- d-----w- c:\program files\IObit
2017-03-17 12:32 . 2012-06-09 17:21 178688 ----a-w- c:\windows\system32\unrar.dll
2017-03-17 12:32 . 2017-03-17 12:32 -------- d-----w- c:\program files\K-Lite Codec Pack
2017-03-17 12:22 . 2017-03-21 12:22 796352 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2017-03-17 12:22 . 2017-03-21 12:22 142528 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2017-03-17 12:22 . 2017-03-21 12:21 -------- d-----w- c:\windows\system32\Macromed
2017-03-17 11:59 . 2017-03-17 12:11 -------- d-----w- c:\program files\Google
2017-03-17 11:25 . 2017-03-21 17:06 -------- d-sh--w- c:\windows\Installer
2017-03-17 11:23 . 2011-11-24 23:26 13440 ----a-w- c:\windows\system32\drivers\pneteth.sys
2017-03-17 11:16 . 2017-03-22 07:38 -------- d-----w- c:\users\ibrahim
2017-03-17 11:15 . 2017-03-17 11:15 -------- d-----w- C:\Recovery
2017-03-17 11:15 . 2017-03-17 11:15 -------- d-sh--we c:\users\Default\ÞÇÆãÉ ÇÈÏÃ
2017-03-17 11:15 . 2017-03-17 11:15 -------- d-sh--we c:\programdata\ÞÇÆãÉ ÇÈÏÃ
2017-03-17 11:15 . 2017-03-17 11:15 -------- d-sh--we c:\programdata\ÓØÍ ÇáãßÊÈ
2017-03-02 06:46 . 2017-03-05 08:55 32256 ---ha-w- C:\~WRL0092.tmp
2017-03-02 06:46 . 2017-03-04 14:42 31744 ---ha-w- C:\~WRL0003.tmp
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ IDM Shell Extension]
@="{CDC95B92-E27C-4745-A8C5-64A52A78855D}"
[HKEY_CLASSES_ROOT\CLSID\{CDC95B92-E27C-4745-A8C5-64A52A78855D}]
2015-08-14 14:52 23520 ----a-w- c:\program files\Internet Download Manager\IDMShellExt.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00asw]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2017-03-21 12:03 1165096 ----a-w- c:\program files\AVAST Software\Avast\ashShell.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-20 1174016]
"IDMan"="c:\program files\Internet Download Manager\IDMan.exe" [2017-02-14 4005944]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SiSTray"="c:\program files\SiS VGA Utilities\SiSTray.exe" [2017-03-18 557056]
"AvastUI.exe"="c:\program files\AVAST Software\Avast\AvLaunch.exe" [2017-03-21 205512]
.
c:\users\ibrahim\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
PdaNet Desktop.lnk - c:\program files\PdaNet for Android\PdaNetPC.exe [2017-3-18 1029944]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Ralink Wireless Utility.lnk - c:\program files\Ralink\Common\RaUI.exe -s [2017-3-17 15661872]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
R1 ZAM;ZAM Helper Driver;c:\windows\System32\drivers\zam32.sys [x]
R1 ZAM_Guard;ZAM Guard Driver;c:\windows\System32\drivers\zamguard32.sys [x]
R2 aswStm;aswStm;c:\windows\system32\drivers\aswStm.sys [2017-03-21 118288]
R2 RaMediaServer;Ralink UPnP Media Server;c:\program files\Ralink\Common\RaMediaServer.exe [2012-07-06 1863680]
R3 aswHwid;aswHwid;c:\windows\system32\drivers\aswHwid.sys [2017-03-21 34136]
R3 dmvsc;dmvsc;c:\windows\system32\drivers\dmvsc.sys [2010-11-20 62464]
R3 keycrypt;keycrypt;c:\windows\system32\DRIVERS\KeyCrypt32.sys [2017-01-30 144416]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [2010-11-20 15872]
R3 Synth3dVsc;Synth3dVsc;c:\windows\system32\drivers\synth3dvsc.sys [2010-11-20 77184]
R3 terminpt;Microsoft Remote Desktop Input Driver;c:\windows\system32\drivers\terminpt.sys [2010-11-20 25600]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 52224]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [2010-11-20 27264]
R3 tsusbhub;tsusbhub;c:\windows\system32\drivers\tsusbhub.sys [2010-11-20 112640]
R3 VGPU;VGPU;c:\windows\system32\drivers\rdvgkmd.sys [x]
S0 aswRvrt;aswRvrt;c:\windows\\SystemRoot\system32\drivers\aswRvrt.sys [x]
S0 aswVmm;aswVmm;c:\windows\\SystemRoot\system32\drivers\aswVmm.sys [x]
S1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys [2017-03-21 756200]
S1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [2017-03-21 465024]
S1 HWiNFO32;HWiNFO32/64 Kernel Driver;c:\windows\system32\drivers\HWiNFO32.SYS [2017-03-17 23840]
S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [2017-03-21 106392]
S2 IDMWFP;IDMWFP;c:\windows\system32\DRIVERS\idmwfp.sys [2016-10-17 147120]
S3 netr28u;RT2870 USB Extensible Wireless LAN Card Driver;c:\windows\system32\DRIVERS\netr28u.sys [2013-09-06 1635632]
S3 pneteth;PdaNet Broadband;c:\windows\system32\DRIVERS\pneteth.sys [2011-11-24 13440]
S3 SiS6350;SiS6350;c:\windows\system32\DRIVERS\SISGRKMD.sys [2017-03-18 466432]
S3 SiSGbeLH;SiS191/SiS190 Ethernet Device NDIS 6.0 Driver;c:\windows\system32\DRIVERS\SiSGB6.sys [2009-07-13 48128]
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2017-03-17 12:11 1319256 ----a-w- c:\program files\Google\Chrome\Application\57.0.2987.110\Installer\chrmstp.exe
.
.
------- Supplementary Scan -------
.
IE: ÊÍãíá Çáßá ÈæÇÓØÉ Internet Download Manager - c:\program files\Internet Download Manager\IEGetAll.htm
IE: ÊÍãíá ÈæÇÓØÉ Internet Download Manager - c:\program files\Internet Download Manager\IEExt.htm
TCP: DhcpNameServer = 192.168.8.1 192.168.8.1
.
- - - - ORPHANS REMOVED - - - -
.
AddRemove-QQPlayer - c:\program files\Tencent\QQPlayer\uninst.exe
.
.
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil32_24_0_0_186_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil32_24_0_0_186_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}]
@Denied: (A 2) (Everyone)
@="IFlashBroker6"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Completion time: 2017-03-22 16:11:12
ComboFix-quarantined-files.txt 2017-03-22 15:11
.
Pre-Run: 57,410,002,944 bytes free
Post-Run: 57,250,471,936 bytes free
.
- - End Of File - - ED0480E67B544CC7B4FE58622230687A
A36C5E4F47E84449FF07ED3517B43A31