ComboFix 13-07-14.01 - Owner 14/07/2013 21:54:31.1.4 - x64 Microsoft Windows 7 Home Premium 6.1.7601.1.1252.44.1033.18.4007.2256 [GMT 1:00] Running from: c:\users\Owner\Desktop\ComboFix.exe SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . . C:\Install.exe c:\program files (x86)\BBC iPlayer Desktop\BBC iPlayer Desktop.exe c:\users\Default\AppData\Roaming\DPInst.exe c:\users\Default\AppData\Roaming\gacutil.exe c:\users\Default\AppData\Roaming\PnPutil.exe c:\users\Eileen\AppData\Local\Microsoft\Windows\Temporary Internet Files\{1746024F-A91F-48F9-B9D7-53126B830013}.xps c:\users\Eileen\AppData\Local\Microsoft\Windows\Temporary Internet Files\{3BCD4774-F8B9-41B6-856C-7DACF4945DDF}.xps c:\users\Eileen\AppData\Local\Microsoft\Windows\Temporary Internet Files\{51D08563-7267-498C-AE87-7E81B763A095}.xps c:\users\Eileen\AppData\Local\Microsoft\Windows\Temporary Internet Files\{63FDDA5D-9419-4449-9A72-807F53CF3243}.xps c:\users\Eileen\AppData\Local\Microsoft\Windows\Temporary Internet Files\{9F7CE5AF-3C7D-4FE7-95E2-FEC10F1F58BF}.xps c:\users\Eileen\AppData\Local\Microsoft\Windows\Temporary Internet Files\{B286942B-EA31-4660-B6D9-1756FEDAC634}.xps c:\users\Owner\GoToAssistDownloadHelper.exe . . ((((((((((((((((((((((((( Files Created from 2013-06-14 to 2013-07-14 ))))))))))))))))))))))))))))))) . . 2013-07-14 20:57 . 2013-07-14 20:57 -------- d-----w- c:\users\Default\AppData\Local\temp 2013-07-14 20:57 . 2013-07-14 20:57 -------- d-----w- c:\users\Eileen\AppData\Local\temp 2013-07-14 20:10 . 2013-07-14 20:10 -------- d-----w- C:\_OTL 2013-07-13 11:06 . 2013-07-13 11:06 -------- d-----w- c:\windows\Temp52547E2A-D0BF-9FEA-3E64-0903279AAC05-Signatures 2013-07-11 22:12 . 2013-07-11 22:12 -------- d-----w- c:\users\Owner\AppData\Local\Avg2013 2013-07-10 18:35 . 2013-06-04 06:00 624128 ----a-w- c:\windows\system32\qedit.dll 2013-07-10 18:35 . 2013-06-04 04:53 509440 ----a-w- c:\windows\SysWow64\qedit.dll 2013-07-10 18:35 . 2013-05-06 06:03 1887744 ----a-w- c:\windows\system32\WMVDECOD.DLL 2013-07-10 18:35 . 2013-05-06 04:56 1620480 ----a-w- c:\windows\SysWow64\WMVDECOD.DLL 2013-07-10 18:28 . 2013-06-05 03:34 3153920 ----a-w- c:\windows\system32\win32k.sys 2013-07-10 18:28 . 2013-04-10 05:48 1732608 ----a-w- c:\program files\Windows Journal\NBDoc.DLL 2013-07-10 18:28 . 2013-04-10 05:46 1367040 ----a-w- c:\program files\Common Files\Microsoft Shared\ink\journal.dll 2013-07-10 18:28 . 2013-04-10 05:46 1402880 ----a-w- c:\program files\Windows Journal\JNWDRV.dll 2013-07-10 18:28 . 2013-04-10 05:46 1393152 ----a-w- c:\program files\Windows Journal\JNTFiltr.dll 2013-07-10 18:28 . 2013-04-10 05:03 936448 ----a-w- c:\program files (x86)\Common Files\Microsoft Shared\ink\journal.dll 2013-07-10 18:27 . 2013-04-09 23:34 1247744 ----a-w- c:\windows\SysWow64\DWrite.dll 2013-07-10 18:27 . 2013-04-02 22:51 1643520 ----a-w- c:\windows\system32\DWrite.dll 2013-06-25 16:31 . 2013-06-25 16:31 -------- d-----w- c:\users\Owner\AppData\Local\Macromedia 2013-06-25 11:48 . 2013-06-25 11:48 -------- d-----w- c:\windows\SysWow64\kodak 2013-06-25 11:44 . 2013-06-25 11:44 -------- d-----w- c:\users\Default\AppData\Roaming\KODAK AiO Home Center1290911192 2013-06-21 20:50 . 2013-06-21 20:50 159744 ----a-w- c:\program files\Internet Explorer\Plugins\npqtplugin6.dll 2013-06-21 20:50 . 2013-06-21 20:50 159744 ----a-w- c:\program files\Internet Explorer\Plugins\npqtplugin5.dll 2013-06-21 20:50 . 2013-06-21 20:50 159744 ----a-w- c:\program files\Internet Explorer\Plugins\npqtplugin4.dll 2013-06-21 20:50 . 2013-06-21 20:50 159744 ----a-w- c:\program files\Internet Explorer\Plugins\npqtplugin3.dll 2013-06-21 20:50 . 2013-06-21 20:50 159744 ----a-w- c:\program files\Internet Explorer\Plugins\npqtplugin2.dll 2013-06-21 20:50 . 2013-06-21 20:50 159744 ----a-w- c:\program files\Internet Explorer\Plugins\npqtplugin.dll . . . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2013-07-10 23:31 . 2011-07-08 15:53 78185248 ----a-w- c:\windows\system32\MRT.exe 2013-07-10 19:36 . 2012-04-06 12:10 692104 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe 2013-07-10 19:36 . 2011-08-16 09:37 71048 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl 2013-07-09 20:03 . 2009-07-13 23:19 328704 ----a-w- c:\windows\system32\services.exe 2013-06-12 21:30 . 2013-06-12 21:30 9089416 ----a-w- c:\windows\SysWow64\FlashPlayerInstaller.exe 2013-05-13 05:51 . 2013-06-12 20:43 184320 ----a-w- c:\windows\system32\cryptsvc.dll 2013-05-13 05:51 . 2013-06-12 20:43 1464320 ----a-w- c:\windows\system32\crypt32.dll 2013-05-13 05:51 . 2013-06-12 20:43 139776 ----a-w- c:\windows\system32\cryptnet.dll 2013-05-13 05:50 . 2013-06-12 20:43 52224 ----a-w- c:\windows\system32\certenc.dll 2013-05-13 04:45 . 2013-06-12 20:43 140288 ----a-w- c:\windows\SysWow64\cryptsvc.dll 2013-05-13 04:45 . 2013-06-12 20:43 1160192 ----a-w- c:\windows\SysWow64\crypt32.dll 2013-05-13 04:45 . 2013-06-12 20:43 103936 ----a-w- c:\windows\SysWow64\cryptnet.dll 2013-05-13 03:43 . 2013-06-12 20:43 1192448 ----a-w- c:\windows\system32\certutil.exe 2013-05-13 03:08 . 2013-06-12 20:43 903168 ----a-w- c:\windows\SysWow64\certutil.exe 2013-05-13 03:08 . 2013-06-12 20:43 43008 ----a-w- c:\windows\SysWow64\certenc.dll 2013-05-10 05:49 . 2013-06-12 20:43 30720 ----a-w- c:\windows\system32\cryptdlg.dll 2013-05-10 03:20 . 2013-06-12 20:43 24576 ----a-w- c:\windows\SysWow64\cryptdlg.dll 2013-05-08 06:39 . 2013-06-12 20:45 1910632 ----a-w- c:\windows\system32\drivers\tcpip.sys 2013-05-02 01:06 . 2010-11-21 03:27 278800 ------w- c:\windows\system32\MpSigStub.exe 2013-05-01 02:59 . 2013-05-01 02:59 94208 ----a-w- c:\windows\SysWow64\QuickTimeVR.qtx 2013-05-01 02:59 . 2013-05-01 02:59 69632 ----a-w- c:\windows\SysWow64\QuickTime.qts 2013-04-30 21:44 . 2013-04-30 21:44 1054720 ----a-w- c:\windows\system32\MsSpellCheckingFacility.exe 2013-04-30 21:44 . 2013-04-30 21:44 73728 ----a-w- c:\windows\SysWow64\SetIEInstalledDate.exe 2013-04-30 21:44 . 2013-04-30 21:44 719360 ----a-w- c:\windows\SysWow64\mshtmlmedia.dll 2013-04-30 21:44 . 2013-04-30 21:44 523264 ----a-w- c:\windows\SysWow64\vbscript.dll 2013-04-30 21:44 . 2013-04-30 21:44 48640 ----a-w- c:\windows\SysWow64\mshtmler.dll 2013-04-30 21:44 . 2013-04-30 21:44 38400 ----a-w- c:\windows\SysWow64\imgutil.dll 2013-04-30 21:44 . 2013-04-30 21:44 226304 ----a-w- c:\windows\system32\elshyph.dll 2013-04-30 21:44 . 2013-04-30 21:44 185344 ----a-w- c:\windows\SysWow64\elshyph.dll 2013-04-30 21:44 . 2013-04-30 21:44 158720 ----a-w- c:\windows\SysWow64\msls31.dll 2013-04-30 21:44 . 2013-04-30 21:44 150528 ----a-w- c:\windows\SysWow64\iexpress.exe 2013-04-30 21:44 . 2013-04-30 21:44 138752 ----a-w- c:\windows\SysWow64\wextract.exe 2013-04-30 21:44 . 2013-04-30 21:44 137216 ----a-w- c:\windows\SysWow64\ieUnatt.exe 2013-04-30 21:44 . 2013-04-30 21:44 12800 ----a-w- c:\windows\SysWow64\mshta.exe 2013-04-30 21:44 . 2013-04-30 21:44 110592 ----a-w- c:\windows\SysWow64\IEAdvpack.dll 2013-04-30 21:44 . 2013-04-30 21:44 81408 ----a-w- c:\windows\system32\icardie.dll 2013-04-30 21:44 . 2013-04-30 21:44 762368 ----a-w- c:\windows\system32\ieapfltr.dll 2013-04-30 21:44 . 2013-04-30 21:44 61952 ----a-w- c:\windows\SysWow64\tdc.ocx 2013-04-30 21:44 . 2013-04-30 21:44 452096 ----a-w- c:\windows\system32\dxtmsft.dll 2013-04-30 21:44 . 2013-04-30 21:44 441856 ----a-w- c:\windows\system32\html.iec 2013-04-30 21:44 . 2013-04-30 21:44 361984 ----a-w- c:\windows\SysWow64\html.iec 2013-04-30 21:44 . 2013-04-30 21:44 281600 ----a-w- c:\windows\system32\dxtrans.dll 2013-04-30 21:44 . 2013-04-30 21:44 235008 ----a-w- c:\windows\system32\url.dll 2013-04-30 21:44 . 2013-04-30 21:44 23040 ----a-w- c:\windows\SysWow64\licmgr10.dll 2013-04-30 21:44 . 2013-04-30 21:44 216064 ----a-w- c:\windows\system32\msls31.dll 2013-04-30 21:44 . 2013-04-30 21:44 197120 ----a-w- c:\windows\system32\msrating.dll 2013-04-30 21:44 . 2013-04-30 21:44 1441280 ----a-w- c:\windows\SysWow64\inetcpl.cpl 2013-04-30 21:44 . 2013-04-30 21:44 1400416 ----a-w- c:\windows\system32\ieapfltr.dat 2013-04-30 21:44 . 2013-04-30 21:44 905728 ----a-w- c:\windows\system32\mshtmlmedia.dll 2013-04-30 21:44 . 2013-04-30 21:44 97280 ----a-w- c:\windows\system32\mshtmled.dll 2013-04-30 21:44 . 2013-04-30 21:44 92160 ----a-w- c:\windows\system32\SetIEInstalledDate.exe 2013-04-30 21:44 . 2013-04-30 21:44 77312 ----a-w- c:\windows\system32\tdc.ocx 2013-04-30 21:44 . 2013-04-30 21:44 62976 ----a-w- c:\windows\system32\pngfilt.dll 2013-04-30 21:44 . 2013-04-30 21:44 599552 ----a-w- c:\windows\system32\vbscript.dll 2013-04-30 21:44 . 2013-04-30 21:44 52224 ----a-w- c:\windows\system32\msfeedsbs.dll 2013-04-30 21:44 . 2013-04-30 21:44 51200 ----a-w- c:\windows\system32\imgutil.dll 2013-04-30 21:44 . 2013-04-30 21:44 48640 ----a-w- c:\windows\system32\mshtmler.dll 2013-04-30 21:44 . 2013-04-30 21:44 27648 ----a-w- c:\windows\system32\licmgr10.dll 2013-04-30 21:44 . 2013-04-30 21:44 270848 ----a-w- c:\windows\system32\iedkcs32.dll 2013-04-30 21:44 . 2013-04-30 21:44 247296 ----a-w- c:\windows\system32\webcheck.dll 2013-04-30 21:44 . 2013-04-30 21:44 173568 ----a-w- c:\windows\system32\ieUnatt.exe 2013-04-30 21:44 . 2013-04-30 21:44 167424 ----a-w- c:\windows\system32\iexpress.exe 2013-04-30 21:44 . 2013-04-30 21:44 1509376 ----a-w- c:\windows\system32\inetcpl.cpl 2013-04-30 21:44 . 2013-04-30 21:44 149504 ----a-w- c:\windows\system32\occache.dll 2013-04-30 21:44 . 2013-04-30 21:44 144896 ----a-w- c:\windows\system32\wextract.exe 2013-04-30 21:44 . 2013-04-30 21:44 13824 ----a-w- c:\windows\system32\mshta.exe 2013-04-30 21:44 . 2013-04-30 21:44 136192 ----a-w- c:\windows\system32\iepeers.dll 2013-04-30 21:44 . 2013-04-30 21:44 135680 ----a-w- c:\windows\system32\IEAdvpack.dll 2013-04-30 21:44 . 2013-04-30 21:44 12800 ----a-w- c:\windows\system32\msfeedssync.exe 2013-04-30 21:44 . 2013-04-30 21:44 102912 ----a-w- c:\windows\system32\inseng.dll 2013-04-26 05:51 . 2013-06-12 20:43 751104 ----a-w- c:\windows\system32\win32spl.dll 2013-04-26 04:55 . 2013-06-12 20:43 492544 ----a-w- c:\windows\SysWow64\win32spl.dll 2013-04-25 23:30 . 2013-06-12 20:42 1505280 ----a-w- c:\windows\SysWow64\d3d11.dll 2013-04-17 07:02 . 2013-06-12 20:43 1230336 ----a-w- c:\windows\SysWow64\WindowsCodecs.dll 2013-04-17 06:24 . 2013-06-12 20:43 1424384 ----a-w- c:\windows\system32\WindowsCodecs.dll . . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "OfficeSyncProcess"="c:\program files (x86)\Microsoft Office\Office14\MSOSYNC.EXE" [2012-01-20 719672] "Logitech Vid"="c:\program files (x86)\Logitech\Vid HD\Vid.exe" [2011-01-13 6129496] . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] "NUSB3MON"="c:\program files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe" [2010-11-17 113288] "BCSSync"="c:\program files (x86)\Microsoft Office\Office14\BCSSync.exe" [2010-03-13 91520] "LWS"="c:\program files (x86)\Logitech\LWS\Webcam Software\LWS.exe" [2011-08-12 205336] "Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-04-04 958576] "Family Tree Builder Update"="c:\program files (x86)\MyHeritage\Bin\FTBCheckUpdates.exe" [2011-12-21 229376] "APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2013-04-21 59720] "iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2011-11-13 421736] "QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2013-05-01 421888] "EKStatusMonitor"="c:\program files (x86)\Kodak\AiO\StatusMonitor\EKStatusMonitor.exe" [2013-01-15 2750840] . [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce] "KodakHomeCenter"="c:\program files (x86)\Kodak\AiO\Center\AiOHomeCenter.exe" [2013-03-15 2236792] . c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\ ComproRemote.lnk - c:\program files (x86)\Common Files\VideoMate\ComproRemote.exe [2011-7-4 13365248] ComproSchedulerDTV.lnk - c:\program files (x86)\Common Files\VideoMate\ComproSchedulerDTV.exe [2011-7-4 389120] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorAdmin"= 5 (0x5) "ConsentPromptBehaviorUser"= 3 (0x3) "EnableUIADesktopToggle"= 0 (0x0) . R1 gziusuup;gziusuup;c:\windows\system32\drivers\gziusuup.sys;c:\windows\SYSNATIVE\drivers\gziusuup.sys [x] R1 msokexes;msokexes;c:\windows\system32\drivers\msokexes.sys;c:\windows\SYSNATIVE\drivers\msokexes.sys [x] R1 oggdmvbp;oggdmvbp;c:\windows\system32\drivers\oggdmvbp.sys;c:\windows\SYSNATIVE\drivers\oggdmvbp.sys [x] R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x] R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x] R3 athrusb;Netgear WG111T modded device driver;c:\windows\system32\DRIVERS\athrxusb.sys;c:\windows\SYSNATIVE\DRIVERS\athrxusb.sys [x] R3 f5ipfw;F5 Networks StoneWall Filter;c:\windows\system32\drivers\urfltv64.sys;c:\windows\SYSNATIVE\drivers\urfltv64.sys [x] R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys;c:\windows\SYSNATIVE\DRIVERS\NisDrvWFP.sys [x] R3 RTL8192su;%RTL8192su.DeviceDesc.DispName%;c:\windows\system32\DRIVERS\RTL8192su.sys;c:\windows\SYSNATIVE\DRIVERS\RTL8192su.sys [x] R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x] R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys;c:\windows\SYSNATIVE\drivers\TsUsbGD.sys [x] R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys;c:\windows\SYSNATIVE\Drivers\usbaapl64.sys [x] R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe;c:\windows\SYSNATIVE\Wat\WatAdminSvc.exe [x] R4 MSSQLServerADHelper100;SQL Active Directory Helper Service;c:\program files\Microsoft SQL Server\100\Shared\SQLADHLP.EXE;c:\program files\Microsoft SQL Server\100\Shared\SQLADHLP.EXE [x] R4 RsFx0151;RsFx0151 Driver;c:\windows\system32\DRIVERS\RsFx0151.sys;c:\windows\SYSNATIVE\DRIVERS\RsFx0151.sys [x] R4 SQLAgent$QSRNVIVO9;SQL Server Agent (QSRNVIVO9);c:\program files\Microsoft SQL Server\MSSQL10_50.QSRNVIVO9\MSSQL\Binn\SQLAGENT.EXE;c:\program files\Microsoft SQL Server\MSSQL10_50.QSRNVIVO9\MSSQL\Binn\SQLAGENT.EXE [x] S2 BCUService;Browser Configuration Utility Service;c:\program files (x86)\DeviceVM\Browser Configuration Utility\BCUService.exe;c:\program files (x86)\DeviceVM\Browser Configuration Utility\BCUService.exe [x] S2 Kodak AiO Network Discovery Service;Kodak AiO Network Discovery Service;c:\program files (x86)\Kodak\AiO\Center\EKAiOHostService.exe;c:\program files (x86)\Kodak\AiO\Center\EKAiOHostService.exe [x] S2 Kodak AiO Status Monitor Service;Kodak AiO Status Monitor Service;c:\program files (x86)\Kodak\AiO\StatusMonitor\EKPrinterSDK.exe;c:\program files (x86)\Kodak\AiO\StatusMonitor\EKPrinterSDK.exe [x] S2 MSSQL$QSRNVIVO9;SQL Server (QSRNVIVO9);c:\program files\Microsoft SQL Server\MSSQL10_50.QSRNVIVO9\MSSQL\Binn\sqlservr.exe;c:\program files\Microsoft SQL Server\MSSQL10_50.QSRNVIVO9\MSSQL\Binn\sqlservr.exe [x] S2 UMVPFSrv;UMVPFSrv;c:\program files (x86)\Common Files\logishrd\LVMVFM\UMVPFSrv.exe;c:\program files (x86)\Common Files\logishrd\LVMVFM\UMVPFSrv.exe [x] S2 UNS;Intel(R) Management and Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [x] S3 ComproHID;VideoMate Root Enumerated Hid Device;c:\windows\system32\DRIVERS\ComproHID64.sys;c:\windows\SYSNATIVE\DRIVERS\ComproHID64.sys [x] S3 IntcDAud;Intel(R) Display Audio;c:\windows\system32\DRIVERS\IntcDAud.sys;c:\windows\SYSNATIVE\DRIVERS\IntcDAud.sys [x] S3 LVUVC64;Logitech Webcam 120(UVC);c:\windows\system32\DRIVERS\lvuvc64.sys;c:\windows\SYSNATIVE\DRIVERS\lvuvc64.sys [x] S3 nusb3hub;Renesas Electronics USB 3.0 Hub Driver;c:\windows\system32\DRIVERS\nusb3hub.sys;c:\windows\SYSNATIVE\DRIVERS\nusb3hub.sys [x] S3 nusb3xhc;Renesas Electronics USB 3.0 Host Controller Driver;c:\windows\system32\DRIVERS\nusb3xhc.sys;c:\windows\SYSNATIVE\DRIVERS\nusb3xhc.sys [x] S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x] S3 urvpndrv;F5 Networks VPN Adapter;c:\windows\system32\DRIVERS\covpnv64.sys;c:\windows\SYSNATIVE\DRIVERS\covpnv64.sys [x] S3 VMHybrid64;VMHybrid service;c:\windows\system32\DRIVERS\VMHybr64.sys;c:\windows\SYSNATIVE\DRIVERS\VMHybr64.sys [x] . . --- Other Services/Drivers In Memory --- . *NewlyCreated* - ASWMBR *Deregistered* - aswMBR . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}] 2013-07-14 20:09 1173456 ----a-w- c:\program files (x86)\Google\Chrome\Application\28.0.1500.72\Installer\chrmstp.exe . Contents of the 'Scheduled Tasks' folder . 2013-07-14 c:\windows\Tasks\Adobe Flash Player Updater.job - c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-06 19:36] . 2013-07-14 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-07-12 11:52] . 2013-07-14 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-07-12 11:52] . . --------- X64 Entries ----------- . . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2010-11-19 11613288] "IgfxTray"="c:\windows\system32\igfxtray.exe" [2011-02-04 167960] "HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2011-02-04 391704] "Persistence"="c:\windows\system32\igfxpers.exe" [2011-02-04 418328] . ------- Supplementary Scan ------- . uLocal Page = c:\windows\system32\blank.htm uStart Page = hxxp://search.splashtop.com/asusexpressgate/mb/searchAPI.php?SE=yahoo&QS=http%3A%2F%2Fuk.search.yahoo.com%2Fsearch%3Ffr%3Dfp-devicevm%26type%3DWEB01 mLocal Page = c:\windows\SysWOW64\blank.htm uInternet Settings,ProxyOverride = *.local IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~1\Office14\EXCEL.EXE/3000 IE: Se&nd to OneNote - c:\progra~2\MICROS~1\Office14\ONBttnIE.dll/105 TCP: DhcpNameServer = 192.168.0.1 FF - ProfilePath - c:\users\Owner\AppData\Roaming\Mozilla\Firefox\Profiles\em50e31h.default\ FF - prefs.js: browser.startup.homepage - hxxp://search.splashtop.com/asusexpressgate/mb/searchAPI.php?SE=yahoo&QS=http%3A%2F%2Fuk.search.yahoo.com%2Fsearch%3Ffr%3Dfp-devicevm%26type%3DWEB01 . - - - - ORPHANS REMOVED - - - - . Wow6432Node-HKLM-Run-BCU - c:\program files (x86)\DeviceVM\Browser Configuration Utility\BCU.exe c:\users\Eileen\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BBC iPlayer Desktop.lnk - c:\program files (x86)\BBC iPlayer Desktop\BBC iPlayer Desktop.exe HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start . . . --------------------- LOCKED REGISTRY KEYS --------------------- . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_8_800_94_ActiveX.exe,-101" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation] "Enabled"=dword:00000001 . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32] @="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_8_800_94_ActiveX.exe" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="IFlashBroker5" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_8_800_94_ActiveX.exe,-101" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation] "Enabled"=dword:00000001 . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_8_800_94_ActiveX.exe" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Shockwave Flash Object" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_8_800_94.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus] @="0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID] @="ShockwaveFlash.ShockwaveFlash.11" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_8_800_94.ocx, 1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="ShockwaveFlash.ShockwaveFlash" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Macromedia Flash Factory Object" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_8_800_94.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID] @="FlashFactory.FlashFactory.1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_8_800_94.ocx, 1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="FlashFactory.FlashFactory" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="IFlashBroker5" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}] @Denied: (A) (Everyone) "Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3] @Denied: (A) (Everyone) . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0] "Key"="ActionsPane3" "Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd" . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security] @Denied: (Full) (Everyone) . Completion time: 2013-07-14 21:59:57 ComboFix-quarantined-files.txt 2013-07-14 20:59 . Pre-Run: 935,369,900,032 bytes free Post-Run: 936,971,149,312 bytes free . - - End Of File - - 8787B8303703F07D37986139805D75F5 A36C5E4F47E84449FF07ED3517B43A31