ComboFix 16-01-31.01 - ÇÍãÏ ãÍãæÏ ãÍãÏãÍãæÏ 02/03/2016 14:24:29.3.2 - x86 Microsoft Windows 7 Ultimate 6.1.7601.1.1256.966.1025.18.3062.2246 [GMT 3:00] Running from: c:\users\??Ú? Ú?Úµ? Ú?Ú?Ú?Úµ?\Desktop\ComboFix.exe SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} * Created a new restore point . . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . . c:\users\ÇÍãÏ ãÍãæÏ ãÍãÏãÍãæÏ\AppData\Roaming\e329d265 c:\users\ÇÍãÏ ãÍãæÏ ãÍãÏãÍãæÏ\AppData\Roaming\e329d265\e329d265.exe . . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . . -------\Legacy_NPF -------\Service_NPF . . ((((((((((((((((((((((((( Files Created from 2016-01-03 to 2016-02-03 ))))))))))))))))))))))))))))))) . . 2016-02-03 11:29 . 2016-02-03 11:29 -------- d-----w- c:\users\Default\AppData\Local\temp 2016-02-03 03:30 . 2016-02-03 03:30 -------- d-----w- c:\program files\Microsoft Synchronization Services 2016-02-03 03:29 . 2016-02-03 03:29 -------- d-----w- c:\windows\PCHEALTH 2016-02-03 03:29 . 2016-02-03 03:29 -------- d-----w- c:\program files\Microsoft Sync Framework 2016-02-03 03:29 . 2016-02-03 03:29 -------- d-----w- c:\program files\Microsoft SQL Server Compact Edition 2016-02-03 03:29 . 2016-02-03 03:29 -------- d-----w- c:\program files\Microsoft Visual Studio 8 2016-02-03 03:28 . 2016-02-03 03:28 -------- d-----w- c:\program files\Microsoft Analysis Services 2016-02-03 03:27 . 2016-02-03 03:33 -------- d-----w- c:\programdata\Microsoft Help 2016-02-03 03:27 . 2016-02-03 03:27 -------- d-----r- C:\MSOCache 2016-02-03 02:57 . 2015-12-16 07:15 9014120 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{61EAD56D-DDDE-48DA-A80A-DBD43184D459}\mpengine.dll 2016-02-01 11:08 . 2016-02-01 11:08 -------- d-----w- c:\programdata\hik 2016-02-01 11:08 . 2016-02-01 11:08 -------- d-----w- c:\program files\hicloud 2016-01-28 15:19 . 2016-01-28 15:19 -------- d-----w- c:\program files\Common Files\InstallShield 2016-01-28 14:38 . 2015-12-11 18:35 951808 ----a-w- c:\windows\system32\aeinv.dll 2016-01-27 19:29 . 2016-01-27 19:29 -------- d-s---w- c:\windows\system32\CompatTel 2016-01-27 19:29 . 2016-01-27 19:29 -------- d-----w- c:\windows\system32\appraiser 2016-01-26 15:53 . 2016-01-26 15:56 -------- d-s---w- c:\windows\system32\GWX 2016-01-26 11:50 . 2016-01-26 11:50 -------- d-----w- c:\windows\Migration 2016-01-26 08:55 . 2015-01-09 02:48 76800 ----a-w- c:\windows\system32\wdi.dll 2016-01-26 08:55 . 2015-01-09 02:48 635904 ----a-w- c:\windows\system32\perftrack.dll 2016-01-26 08:55 . 2015-01-09 02:48 27136 ----a-w- c:\windows\system32\powertracker.dll 2016-01-26 08:47 . 2012-07-26 03:39 47720 ----a-w- c:\windows\system32\drivers\WdfLdr.sys 2016-01-26 08:47 . 2012-07-26 02:46 9728 ----a-w- c:\windows\system32\Wdfres.dll 2016-01-26 08:47 . 2012-07-26 02:32 155136 ----a-w- c:\windows\system32\drivers\WUDFRd.sys 2016-01-26 08:47 . 2012-07-26 03:21 196608 ----a-w- c:\windows\system32\WUDFHost.exe 2016-01-26 08:47 . 2012-07-26 03:20 73216 ----a-w- c:\windows\system32\WUDFSvc.dll 2016-01-26 08:47 . 2012-07-26 03:20 613888 ----a-w- c:\windows\system32\WUDFx.dll 2016-01-26 08:47 . 2012-07-26 03:20 38912 ----a-w- c:\windows\system32\WUDFCoinstaller.dll 2016-01-26 08:47 . 2012-07-26 03:20 172032 ----a-w- c:\windows\system32\WUDFPlatform.dll 2016-01-26 08:47 . 2012-07-26 02:33 66560 ----a-w- c:\windows\system32\drivers\WUDFPf.sys 2016-01-26 08:45 . 2015-12-08 21:53 641536 ----a-w- c:\windows\system32\advapi32.dll 2016-01-26 08:44 . 2015-07-10 17:34 36864 ----a-w- c:\windows\system32\tsgqec.dll 2016-01-26 08:44 . 2015-07-10 17:34 3221504 ----a-w- c:\windows\system32\mstscax.dll 2016-01-26 08:44 . 2015-07-10 17:33 131584 ----a-w- c:\windows\system32\aaclient.dll 2016-01-26 08:44 . 2011-04-29 02:46 311808 ----a-w- c:\windows\system32\drivers\srv.sys 2016-01-26 08:44 . 2011-04-29 02:46 310272 ----a-w- c:\windows\system32\drivers\srv2.sys 2016-01-26 08:44 . 2011-04-29 02:46 114688 ----a-w- c:\windows\system32\drivers\srvnet.sys 2016-01-26 08:44 . 2013-02-12 03:32 15872 ----a-w- c:\windows\system32\drivers\usb8023.sys 2016-01-26 08:43 . 2015-11-11 18:39 1242624 ----a-w- c:\windows\system32\comsvcs.dll 2016-01-26 08:43 . 2015-11-11 18:39 487936 ----a-w- c:\windows\system32\catsrvut.dll 2016-01-26 08:42 . 2015-07-01 20:30 206848 ----a-w- c:\windows\system32\WebClnt.dll 2016-01-26 08:42 . 2015-07-01 20:30 82432 ----a-w- c:\windows\system32\davclnt.dll 2016-01-26 08:42 . 2012-11-02 05:11 376832 ----a-w- c:\windows\system32\dpnet.dll 2016-01-26 08:42 . 2011-02-18 05:39 31232 ----a-w- c:\windows\system32\prevhost.exe 2016-01-26 08:42 . 2013-10-30 02:19 301568 ----a-w- c:\windows\system32\msieftp.dll 2016-01-26 08:42 . 2015-11-17 00:42 591872 ----a-w- c:\windows\system32\invagent.dll 2016-01-26 08:42 . 2015-11-17 00:42 633856 ----a-w- c:\windows\system32\generaltel.dll 2016-01-26 08:42 . 2015-11-17 00:42 425984 ----a-w- c:\windows\system32\devinv.dll 2016-01-26 08:42 . 2015-11-17 00:42 65536 ----a-w- c:\windows\system32\acmigration.dll 2016-01-26 08:42 . 2015-11-16 20:12 176128 ----a-w- c:\windows\system32\aepic.dll 2016-01-26 08:42 . 2015-06-03 20:17 1167520 ----a-w- c:\windows\system32\aitstatic.exe 2016-01-26 08:40 . 2015-08-27 17:58 1391104 ----a-w- c:\windows\system32\msxml6.dll 2016-01-26 08:40 . 2015-08-27 17:58 1241088 ----a-w- c:\windows\system32\msxml3.dll 2016-01-26 08:40 . 2015-08-27 17:51 2048 ----a-w- c:\windows\system32\msxml6r.dll 2016-01-26 08:40 . 2015-08-27 17:51 2048 ----a-w- c:\windows\system32\msxml3r.dll 2016-01-26 08:40 . 2013-01-24 04:47 196328 ----a-w- c:\windows\system32\drivers\fvevol.sys 2016-01-26 08:40 . 2015-08-05 17:41 751104 ----a-w- c:\windows\system32\schedsvc.dll 2016-01-26 08:39 . 2014-11-11 02:44 186880 ----a-w- c:\windows\system32\pku2u.dll 2016-01-26 08:39 . 2015-06-15 21:43 2364416 ----a-w- c:\windows\system32\msi.dll 2016-01-26 08:39 . 2015-06-15 21:43 337408 ----a-w- c:\windows\system32\msihnd.dll 2016-01-26 08:39 . 2015-06-15 21:42 73216 ----a-w- c:\windows\system32\msiexec.exe 2016-01-26 08:39 . 2015-06-15 21:37 25088 ----a-w- c:\windows\system32\msimsg.dll 2016-01-26 08:39 . 2011-03-03 05:38 132608 ----a-w- c:\windows\system32\dnsrslvr.dll 2016-01-26 08:39 . 2011-03-03 05:36 28672 ----a-w- c:\windows\system32\dnscacheugc.exe 2016-01-26 08:39 . 2011-10-01 04:37 708608 ----a-w- c:\program files\Common Files\System\wab32.dll 2016-01-26 08:37 . 2015-07-15 17:59 78784 ----a-w- c:\windows\system32\drivers\mountmgr.sys 2016-01-26 08:37 . 2015-07-15 17:55 1159168 ----a-w- c:\windows\system32\sysmain.dll 2016-01-26 08:37 . 2015-07-15 17:54 10752 ----a-w- c:\windows\system32\msmmsp.dll 2016-01-26 08:37 . 2011-08-17 04:24 465408 ----a-w- c:\windows\system32\psisdecd.dll 2016-01-26 08:37 . 2011-08-17 04:19 75776 ----a-w- c:\windows\system32\psisrndr.ax 2016-01-26 08:37 . 2011-12-30 05:27 478720 ----a-w- c:\windows\system32\timedate.cpl 2016-01-26 08:36 . 2015-11-05 19:00 2048 ----a-w- c:\windows\system32\tzres.dll 2016-01-26 08:34 . 2015-11-20 18:34 93696 ----a-w- c:\windows\system32\wudriver.dll 2016-01-26 08:33 . 2015-01-17 02:30 828928 ----a-w- c:\windows\system32\msctf.dll 2016-01-26 08:33 . 2014-02-04 02:07 149440 ----a-w- c:\windows\system32\drivers\storport.sys 2016-01-26 08:33 . 2014-02-04 02:07 234432 ----a-w- c:\windows\system32\drivers\msiscsi.sys 2016-01-26 08:33 . 2014-02-04 02:07 27072 ----a-w- c:\windows\system32\drivers\Diskdump.sys 2016-01-26 08:33 . 2014-02-04 02:00 2048 ----a-w- c:\windows\system32\iologmsg.dll 2016-01-26 08:33 . 2012-10-03 16:42 175104 ----a-w- c:\windows\system32\netcorehc.dll 2016-01-26 08:33 . 2012-10-03 16:40 499712 ----a-w- c:\windows\system32\iphlpsvc.dll 2016-01-26 08:33 . 2012-10-03 16:42 18944 ----a-w- c:\windows\system32\netevent.dll 2016-01-26 08:33 . 2012-10-03 15:21 35328 ----a-w- c:\windows\system32\drivers\tcpipreg.sys 2016-01-26 08:32 . 2015-07-22 17:53 937984 ----a-w- c:\windows\system32\diagtrack.dll 2016-01-26 08:32 . 2015-07-22 16:38 41984 ----a-w- c:\windows\system32\UtcResources.dll 2016-01-26 08:32 . 2015-07-22 17:53 635392 ----a-w- c:\windows\system32\tdh.dll 2016-01-26 08:30 . 2014-06-18 01:52 399360 ----a-w- c:\program files\Common Files\Microsoft Shared\ink\tabskb.dll 2016-01-26 08:30 . 2014-06-18 01:51 646144 ----a-w- c:\windows\system32\osk.exe 2016-01-26 08:30 . 2015-08-06 17:44 1498624 ----a-w- c:\windows\system32\ExplorerFrame.dll 2016-01-26 08:30 . 2011-02-12 05:35 191488 ----a-w- c:\windows\system32\FXSCOVER.exe 2016-01-26 08:30 . 2015-07-30 17:57 1987584 ----a-w- c:\windows\system32\d3d10warp.dll 2016-01-26 08:30 . 2011-10-15 05:38 534528 ----a-w- c:\windows\system32\EncDec.dll 2016-01-26 08:30 . 2012-07-04 21:14 41984 ----a-w- c:\windows\system32\browcli.dll 2016-01-26 08:30 . 2012-07-04 21:14 102912 ----a-w- c:\windows\system32\browser.dll 2016-01-26 08:29 . 2014-01-24 02:18 1212352 ----a-w- c:\windows\system32\drivers\ntfs.sys 2016-01-26 08:29 . 2015-05-25 18:01 92160 ----a-w- c:\windows\system32\sechost.dll 2016-01-26 08:29 . 2015-05-25 18:00 40448 ----a-w- c:\windows\system32\typeperf.exe 2016-01-26 08:29 . 2015-05-25 18:00 364544 ----a-w- c:\windows\system32\tracerpt.exe 2016-01-26 08:29 . 2015-05-25 18:00 37888 ----a-w- c:\windows\system32\relog.exe 2016-01-26 08:29 . 2015-05-25 18:00 82944 ----a-w- c:\windows\system32\logman.exe 2016-01-26 08:29 . 2015-05-25 18:00 17408 ----a-w- c:\windows\system32\diskperf.exe 2016-01-26 08:29 . 2015-04-18 02:56 342016 ----a-w- c:\windows\system32\certcli.dll 2016-01-26 08:29 . 2010-12-23 05:54 642048 ----a-w- c:\windows\system32\CPFilters.dll 2016-01-26 08:29 . 2010-12-23 05:54 850944 ----a-w- c:\windows\system32\sbe.dll 2016-01-26 08:29 . 2010-12-23 05:50 199680 ----a-w- c:\windows\system32\mpg2splt.ax 2016-01-26 08:28 . 2015-04-27 19:05 179200 ----a-w- c:\windows\system32\wintrust.dll 2016-01-26 08:28 . 2015-04-27 19:04 143872 ----a-w- c:\windows\system32\cryptsvc.dll 2016-01-26 08:28 . 2015-04-27 19:04 1174528 ----a-w- c:\windows\system32\crypt32.dll 2016-01-26 08:28 . 2015-04-27 19:04 103936 ----a-w- c:\windows\system32\cryptnet.dll 2016-01-26 08:28 . 2015-11-03 18:56 627712 ----a-w- c:\windows\system32\usp10.dll 2016-01-26 08:28 . 2015-04-13 03:19 259072 ----a-w- c:\windows\system32\services.exe 2016-01-26 08:28 . 2015-12-08 21:53 305664 ----a-w- c:\windows\system32\gdi32.dll 2016-01-26 08:28 . 2014-08-01 11:35 793600 ----a-w- c:\windows\system32\TSWorkspace.dll 2016-01-26 08:27 . 2014-04-05 02:25 1294272 ----a-w- c:\windows\system32\drivers\tcpip.sys 2016-01-26 08:27 . 2013-11-26 11:11 240576 ----a-w- c:\windows\system32\drivers\netio.sys 2016-01-26 08:27 . 2014-04-05 02:24 187840 ----a-w- c:\windows\system32\drivers\FWPKCLNT.SYS 2016-01-26 08:27 . 2015-10-01 17:50 96768 ----a-w- c:\windows\system32\appidpolicyconverter.exe 2016-01-26 08:27 . 2015-10-01 17:50 50176 ----a-w- c:\windows\system32\setbcdlocale.dll 2016-01-26 08:27 . 2015-10-01 17:50 50688 ----a-w- c:\windows\system32\appidapi.dll 2016-01-26 08:27 . 2015-10-01 17:50 28160 ----a-w- c:\windows\system32\appidsvc.dll 2016-01-26 08:27 . 2015-10-01 17:50 16896 ----a-w- c:\windows\system32\appidcertstorecheck.exe 2016-01-26 08:27 . 2015-10-01 16:53 50176 ----a-w- c:\windows\system32\drivers\appid.sys 2016-01-26 08:27 . 2015-12-08 21:53 509952 ----a-w- c:\windows\system32\qedit.dll 2016-01-26 08:25 . 2014-10-25 01:32 67584 ----a-w- c:\windows\system32\packager.dll 2016-01-26 08:25 . 2014-12-11 17:47 46592 ----a-w- c:\windows\system32\TSWbPrxy.exe 2016-01-26 08:25 . 2014-12-19 02:43 164864 ----a-w- c:\windows\system32\profsvc.dll . . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2015-11-05 17:36 . 2015-11-05 17:36 28352 ----a-w- c:\windows\system32\aspnet_counters.dll 2015-11-05 17:36 . 2015-11-05 17:36 18600 ----a-w- c:\windows\system32\msvcr110_clr0400.dll 2015-11-05 17:36 . 2015-11-05 17:36 18600 ----a-w- c:\windows\system32\msvcr100_clr0400.dll 2015-11-05 17:36 . 2015-11-05 17:36 18600 ----a-w- c:\windows\system32\msvcp110_clr0400.dll . . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\IDM Shell Extension] @="{CDC95B92-E27C-4745-A8C5-64A52A78855D}" [HKEY_CLASSES_ROOT\CLSID\{CDC95B92-E27C-4745-A8C5-64A52A78855D}] 2014-04-21 08:02 23008 ----a-w- c:\program files\Internet Download Manager\IDMShellExt.dll . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "IDMan"="c:\program files\Internet Download Manager\IDMan.exe" [2015-04-20 3898960] . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SPUpDateServerrun"="c:\program files\hicloud\update_server\startUp.exe" [2015-06-15 15232] "BCSSync"="c:\program files\Microsoft Office\Office14\BCSSync.exe" [2010-03-13 91520] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorAdmin"= 5 (0x5) "ConsentPromptBehaviorUser"= 3 (0x3) "EnableUIADesktopToggle"= 0 (0x0) . [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "aux"=wdmaud.drv . R1 bxxydofj;bxxydofj;c:\windows\system32\drivers\bxxydofj.sys [x] R1 wdagnved;wdagnved;c:\windows\system32\drivers\wdagnved.sys [x] R3 dmvsc;dmvsc;c:\windows\system32\drivers\dmvsc.sys [2010-11-20 62464] R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe [2015-12-12 102912] R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [2015-06-11 15872] R3 Synth3dVsc;Synth3dVsc;c:\windows\system32\drivers\synth3dvsc.sys [2010-11-20 77184] R3 terminpt;Microsoft Remote Desktop Input Driver;c:\windows\system32\drivers\terminpt.sys [2010-11-20 25600] R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 52224] R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [2010-11-20 27264] R3 tsusbhub;tsusbhub;c:\windows\system32\drivers\tsusbhub.sys [2010-11-20 112640] R3 VGPU;VGPU;c:\windows\system32\drivers\rdvgkmd.sys [x] S2 DiagTrack;Diagnostics Tracking Service;c:\windows\System32\svchost.exe [2009-07-14 20992] S2 IDMWFP;IDMWFP;c:\windows\system32\DRIVERS\idmwfp.sys [2015-04-18 122432] S3 yukonw7;ÈÑäÇãÌ ÊÔÛíá ÇáãäÝÐ ÇáãÕÛÑ NDIS6.2 áÜ Marvell Yukon Ethernet Controller;c:\windows\system32\DRIVERS\yk62x86.sys [2009-07-13 311296] . . [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] utcsvc REG_MULTI_SZ DiagTrack . [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}] 2016-01-29 10:32 1090376 ----a-w- c:\program files\Google\Chrome\Application\48.0.2564.97\Installer\chrmstp.exe . Contents of the 'Scheduled Tasks' folder . 2016-02-03 c:\windows\Tasks\Adobe Flash Player Updater.job - c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2016-01-21 17:21] . 2016-02-03 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job - c:\program files\Google\Update\GoogleUpdate.exe [2016-01-21 17:16] . 2016-02-03 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job - c:\program files\Google\Update\GoogleUpdate.exe [2016-01-21 17:16] . . ------- Supplementary Scan ------- . uStart Page = https://www.google.com.eg/ IE: ÅÑ&ÓÇá Åáì OneNote - c:\progra~1\MICROS~2\Office14\ONBttnIE.dll/105 IE: Ê&ÕÏíÑ Åáì Microsoft Excel - c:\progra~1\MICROS~2\Office14\EXCEL.EXE/3000 IE: ÊÍãíá Çáßá ÈæÇÓØÉ Internet Download Manager - c:\program files\Internet Download Manager\IEGetAll.htm IE: ÊÍãíá ÈæÇÓØÉ Internet Download Manager - c:\program files\Internet Download Manager\IEExt.htm TCP: DhcpNameServer = 192.168.1.1 192.168.1.1 FF - ProfilePath - c:\users\ÇÍãÏ ãÍãæÏ ãÍãÏãÍãæÏ\AppData\Roaming\Mozilla\Firefox\Profiles\kjqq8s3q.default\ . - - - - ORPHANS REMOVED - - - - . HKU-Default-Run-e329d265 - c:\users\ÇÍãÏ ãÍãæÏ ãÍãÏãÍãæÏ\AppData\Roaming\e329d265\e329d265.exe . . . --------------------- LOCKED REGISTRY KEYS --------------------- . [HKEY_USERS\S-1-5-21-1247624099-1115864786-4014763201-1001_Classes\CLSID\{7B8E9164-324D-4A2E-A46D-0165FB2000EC}] @Denied: (Full) (Everyone) "scansk"=hex(0):ac,fc,6d,c2,fb,39,ac,a2,ec,d4,0c,af,04,46,84,e2,b0,b6,bd,9e,e1, d1,62,ad,57,95,f9,02,e9,ce,52,85,e2,13,b0,1b,62,a5,03,b9,00,00,00,00,00,00,\ . [HKEY_USERS\S-1-5-21-1247624099-1115864786-4014763201-1001_Classes\CLSID\{eb5ac76a-f38e-48e5-bd47-1800e0e0b962}] @Denied: (Full) (Everyone) @Allowed: (Read) (RestrictedCode) "Model"=dword:0000011a "Therad"=dword:00000001 . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil32_20_0_0_286_ActiveX.exe,-101" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\Elevation] "Enabled"=dword:00000001 . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\LocalServer32] @="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil32_20_0_0_286_ActiveX.exe" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}] @Denied: (A 2) (Everyone) @="IFlashBroker6" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 "MSCurrentCountry"=dword:000000b5 . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security] @Denied: (Full) (Everyone) . ------------------------ Other Running Processes ------------------------ . c:\windows\system32\taskhost.exe c:\windows\System32\WUDFHost.exe c:\windows\system32\GWX\GWX.exe c:\windows\system32\sppsvc.exe c:\windows\system32\conhost.exe c:\program files\Internet Explorer\iexplore.exe c:\program files\Internet Explorer\iexplore.exe c:\\?\c:\windows\system32\wbem\WMIADAP.EXE . ************************************************************************** . Completion time: 2016-02-03 14:34:51 - machine was rebooted ComboFix-quarantined-files.txt 2016-02-03 11:34 ComboFix2.txt 2016-01-23 04:59 ComboFix3.txt 2016-01-21 20:38 . Pre-Run: 17,198,903,296 bytes free Post-Run: 16,841,482,240 bytes free . - - End Of File - - F1DACC7B55C29A4C705734DF04D85155 A36C5E4F47E84449FF07ED3517B43A31