ComboFix 14-04-30.01 - roxio 05/01/2014 1:23.1.2 - x86 Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.2939.1958 [GMT 8:00] Running from: c:\users\roxio\Desktop\ComboFix.exe AV: Microsoft Security Essentials *Enabled/Updated* {641105E6-77ED-3F35-A304-765193BCB75F} SP: Microsoft Security Essentials *Enabled/Updated* {DF70E402-51D7-30BB-99B4-4D23E83BFDE2} SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . . c:\programdata\Microsoft.com c:\users\Anjing\AppData\Local\assembly\tmp c:\windows\system32\pt c:\windows\system32\pt\smartfacevcp.dll.mui c:\windows\system32\pt\toscdspd.cpl.mui c:\windows\system32\Temp . . ((((((((((((((((((((((((( Files Created from 2014-03-28 to 2014-04-30 ))))))))))))))))))))))))))))))) . . 2014-04-30 17:33 . 2014-04-30 17:33 -------- dc----w- c:\users\Anjing\AppData\Local\temp 2014-04-30 16:42 . 2014-04-30 17:13 -------- dc----w- C:\FRST 2014-04-30 13:49 . 2014-04-30 17:12 -------- d-----w- c:\programdata\SecTaskMan 2014-04-30 13:49 . 2014-04-30 13:49 -------- d-----w- c:\program files\Security Task Manager 2014-04-30 12:54 . 2014-04-30 17:37 -------- d-----w- c:\users\roxio\AppData\Local\Temp 2014-04-30 12:51 . 2014-04-30 12:56 -------- d-----w- c:\program files\Unlocker 2014-04-30 10:25 . 2014-04-30 10:25 -------- d-----w- c:\programdata\LHService 2014-04-30 10:17 . 2014-04-30 10:17 -------- d-----w- c:\users\Anjing\AppData\Roaming\LockHunter 2014-04-30 09:32 . 2014-04-30 11:16 -------- d-sh--w- c:\program files\Windows Manager 2014-04-30 07:42 . 2014-04-30 07:42 2 --shatr- c:\windows\winstart.bat 2014-04-30 06:56 . 2014-04-30 06:56 -------- d-----w- c:\users\Anjing\AppData\Roaming\SUPERAntiSpyware.com 2014-04-30 06:37 . 2014-04-16 09:25 8050496 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{DE883F91-B297-46C2-8EBC-FD5C9369CBDF}\mpengine.dll 2014-04-30 05:58 . 2010-08-30 00:34 536576 ----a-w- c:\windows\system32\sqlite3.dll 2014-04-30 05:55 . 2014-04-29 14:18 452608 --sha-r- c:\windows\system32\Microsoft.com 2014-04-30 04:45 . 2014-04-30 12:16 -------- d-sh--w- c:\programdata\Windows Manager 2014-04-29 14:06 . 2013-11-20 19:10 5132656 ----a-w- c:\windows\system32\GameMon.des 2014-04-28 19:51 . 2014-04-30 05:19 -------- dc----w- c:\users\Anjing\AppData\Local\Razer 2014-04-28 15:48 . 2009-12-30 02:21 27192 ----a-w- c:\windows\system32\drivers\revoflt.sys 2014-04-28 15:48 . 2014-04-28 15:48 -------- d-----w- c:\program files\VS Revo Group 2014-04-28 15:37 . 2014-04-28 15:37 -------- d-----w- c:\program files\Folder Size 2014-04-28 15:34 . 2014-04-28 16:07 -------- d-----w- c:\program files\Recuva 2014-04-28 14:10 . 2014-04-16 09:25 8050496 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll 2014-04-22 01:55 . 2014-02-20 04:55 765968 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{D38172D2-BF02-4339-9ECD-4A6898D2CF45}\gapaengine.dll 2014-04-19 13:46 . 2014-04-19 13:46 -------- dc----w- C:\SBLauncher 2014-04-18 16:15 . 2014-04-28 14:03 -------- d-----w- c:\programdata\188F1432-103A-4ffb-80F1-36B633C5C9E1 2014-04-18 08:46 . 2014-04-18 08:46 94632 ----a-w- c:\windows\system32\WindowsAccessBridge.dll 2014-04-05 10:49 . 2009-10-10 08:41 105088 ----a-w- c:\windows\system32\drivers\ZTEusbvoice.sys 2014-04-05 10:49 . 2009-10-10 08:40 105088 ----a-w- c:\windows\system32\drivers\ZTEusbser6k.sys 2014-04-05 10:49 . 2009-10-10 08:40 105088 ----a-w- c:\windows\system32\drivers\ZTEusbnmeaext.sys 2014-04-05 10:49 . 2009-10-10 08:40 105088 ----a-w- c:\windows\system32\drivers\ZTEusbnmea.sys 2014-04-05 10:49 . 2009-10-10 08:40 114688 ----a-w- c:\windows\system32\drivers\ZTEusbnet.sys 2014-04-05 10:49 . 2009-10-10 08:39 105088 ----a-w- c:\windows\system32\drivers\ZTEusbmdm6k.sys 2014-04-05 10:49 . 2014-04-05 10:53 -------- d-----w- c:\windows\system32\SupportAppXL 2014-04-05 10:49 . 2014-04-23 13:01 -------- d-----w- c:\program files\SMART BRO . . . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2014-04-29 15:50 . 2012-07-09 08:22 692400 ----a-w- c:\windows\system32\FlashPlayerApp.exe 2014-04-29 15:50 . 2012-03-08 02:24 70832 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl 2014-03-11 01:52 . 2012-03-20 12:44 104264 ----a-w- c:\windows\system32\drivers\NisDrvWFP.sys 2014-03-08 04:33 . 2014-03-08 04:33 45056 ----a-r- c:\users\Anjing\AppData\Roaming\Microsoft\Installer\{885A63EA-382B-4DD4-A755-14809B8557D6}\ARPPRODUCTICON.exe 2014-02-20 04:55 . 2014-01-19 01:54 765968 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\NISBackup\gapaengine.dll 2014-02-07 10:38 . 2014-03-12 02:25 2050560 ----a-w- c:\windows\system32\win32k.sys 2014-02-03 10:37 . 2014-03-12 02:25 505344 ----a-w- c:\windows\system32\qedit.dll . . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "TOSCDSPD"="c:\program files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe" [2008-04-24 430080] "uTorrent"="c:\users\Guest\AppData\Roaming\uTorrent\uTorrent.exe" [2013-10-26 1077584] . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "UnlockerAssistant"="c:\program files\Unlocker\UnlockerAssistant.exe" [2010-07-04 17408] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "EnableUIADesktopToggle"= 0 (0x0) . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\!SASCORE] @="" . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc] @="Service" . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfSvc] @="Service" . [HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^McAfee Security Scan Plus.lnk] backup=c:\windows\pss\McAfee Security Scan Plus.lnk.CommonStartup backupExtension=.CommonStartup . [HKLM\~\startupfolder\C:^Users^Anjing^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OneNote 2007 Screen Clipper and Launcher.lnk] backup=c:\windows\pss\OneNote 2007 Screen Clipper and Launcher.lnk.Startup backupExtension=.Startup . [HKLM\~\startupfolder\C:^Users^Anjing^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OpenOffice.org 3.1.lnk] backup=c:\windows\pss\OpenOffice.org 3.1.lnk.Startup backupExtension=.Startup . [HKLM\~\startupfolder\C:^Users^Guest^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OpenOffice.org 3.4.1.lnk] path=c:\users\Guest\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.4.1.lnk backup=c:\windows\pss\OpenOffice.org 3.4.1.lnk.Startup backupExtension=.Startup . [HKLM\~\startupfolder\C:^Users^roxio^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OpenOffice.org 3.4.1.lnk] path=c:\users\roxio\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.4.1.lnk backup=c:\windows\pss\OpenOffice.org 3.4.1.lnk.Startup backupExtension=.Startup . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\00TCrdMain] 2008-05-09 18:49 716800 ----a-w- c:\program files\Toshiba\FlashCards\TCrdMain.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM] 2013-11-21 16:57 959904 ----a-w- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdobeAAMUpdater-1.0] 2012-04-03 22:09 446392 ------w- c:\program files\Common Files\Adobe\OOBE\PDApp\UWA\updaterstartuputility.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdobeCS6ServiceManager] 2012-03-09 08:26 1073312 ----a-w- c:\program files\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Camera Assistant Software] 2008-04-29 17:33 417792 ----a-w- c:\program files\Camera Assistant Software for Toshiba\traybar.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CCleaner] 2013-12-17 14:14 4370712 ----a-w- c:\program files\CCleaner\CCleaner.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CCleaner Monitoring] 2013-12-17 14:14 4370712 ----a-w- c:\program files\CCleaner\CCleaner.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DivXUpdate] 2011-07-28 23:08 1259376 ----a-w- c:\program files\DivX\DivX Update\DivXUpdate.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ehTray.exe] 2008-01-21 02:25 125952 ----a-w- c:\windows\ehome\ehtray.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds] 2013-12-14 09:11 172088 ----a-w- c:\windows\System32\hkcmd.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IAAnotif] 2008-04-16 00:54 178712 ----a-w- c:\program files\Intel\Intel Matrix Storage Manager\IAAnotif.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray] 2013-12-14 09:11 138808 ----a-w- c:\windows\System32\igfxtray.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Messenger (Yahoo!)] 2010-06-01 02:17 5252408 ----a-w- c:\program files\Yahoo!\Messenger\YahooMessenger.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSC] 2014-03-11 02:13 951576 ----a-w- c:\program files\Microsoft Security Client\msseces.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Persistence] 2013-12-14 09:11 173624 ----a-w- c:\windows\System32\igfxpers.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RtHDVCpl] 2008-04-08 22:14 6037504 ----a-w- c:\windows\RtHDVCpl.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Search Protection] 2009-02-23 13:05 111856 ----a-w- c:\program files\Yahoo!\Search Protection\SearchProtection.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Sidebar] 2009-04-11 06:28 1233920 ----a-w- c:\program files\Windows Sidebar\sidebar.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skytel] 2007-11-21 01:15 1826816 ----a-w- c:\windows\SkyTel.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SmoothView] 2008-06-02 20:26 505720 ----a-w- c:\program files\Toshiba\SmoothView\SmoothView.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam] 2014-02-25 21:57 1821888 ----a-w- c:\users\Anjing\Saved Games\Steam\Steam.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched] 2013-07-02 01:16 254336 ----a-w- c:\program files\Common Files\Java\Java Update\jusched.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SwitchBoard] 2010-02-19 05:37 517096 ----a-w- c:\program files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TPwrMain] 2008-02-06 20:52 431456 ----a-w- c:\program files\Toshiba\Power Saver\TPwrMain.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\uTorrent] 2013-01-11 22:13 1077584 ----a-w- c:\program files\uTorrent\uTorrent.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows Defender] 2008-01-21 02:23 1008184 ----a-w- c:\program files\Windows Defender\MSASCui.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WMPNSCFG] 2008-01-21 02:25 202240 ----a-w- c:\program files\Windows Media Player\wmpnscfg.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\YSearchProtection] 2009-02-23 13:05 111856 ----a-w- c:\program files\Yahoo!\Search Protection\SearchProtection.exe . [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring] "DisableMonitoring"=dword:00000001 . [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus] "DisableMonitoring"=dword:00000001 . [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall] "DisableMonitoring"=dword:00000001 . R3 1394hub;1394 Enabled Hub;c:\windows\System32\svchost.exe [2008-01-21 21504] . . --- Other Services/Drivers In Memory --- . *NewlyCreated* - WS2IFSL . [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache . [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}] 2014-04-27 13:03 1078088 ----a-w- c:\program files\Google\Chrome\Application\34.0.1847.131\Installer\chrmstp.exe . Contents of the 'Scheduled Tasks' folder . 2014-04-30 c:\windows\Tasks\Adobe Flash Player Updater.job - c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-07-09 15:50] . 2014-04-30 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job - c:\program files\Google\Update\GoogleUpdate.exe [2012-02-25 23:40] . 2014-04-30 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job - c:\program files\Google\Update\GoogleUpdate.exe [2012-02-25 23:40] . 2014-04-30 c:\windows\Tasks\User_Feed_Synchronization-{14B97343-1BF9-4B21-A8B4-5B9C1DB42638}.job - c:\windows\system32\msfeedssync.exe [2013-05-15 06:40] . . ------- Supplementary Scan ------- . uStart Page = hxxp://www.bigseekpro.com/tempcleaner/{72ADF531-4C9B-4D9B-97BA-BE9D5AD97E7D} mStart Page = hxxp://www.google.com mSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr9/*http://www.yahoo.com/ext/search/search.html IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200 TCP: DhcpNameServer = 192.168.1.1 FF - ProfilePath - c:\users\roxio\AppData\Roaming\Mozilla\Firefox\Profiles\zdm7fgcc.default\ FF - prefs.js: browser.search.selectedEngine - Yahoo FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?fr=panda&type=panda2_0yatb&p= . - - - - ORPHANS REMOVED - - - - . URLSearchHooks-{7b13ec3e-999a-4b70-b9cb-2617b8323822} - (no file) BHO-{a4fe94c0-5c8c-a4af-3270-c5972680cc02} - (no file) WebBrowser-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file) WebBrowser-{E6570CD8-9978-4621-B1F9-6A62436F0466} - (no file) WebBrowser-{7B13EC3E-999A-4B70-B9CB-2617B8323822} - (no file) WebBrowser-{CD90BF73-20F6-44EF-993D-BB920303BD2E} - (no file) WebBrowser-{30F9B915-B755-4826-820B-08FBA6BD249D} - (no file) HKU-Default-Run-Advanced SystemCare 7 - c:\program files\IObit\Advanced SystemCare 7\ASCTray.exe SharedTaskScheduler-{73526E5A-FD53-4BE7-B5E2-D3C89D7413DC} - (no file) ShellExecuteHooks-{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - (no file) SafeBoot-WudfPf SafeBoot-WudfRd MSConfigStartUp-Akamai NetSession Interface - c:\users\Anjing\AppData\Local\Akamai\netsession_win.exe MSConfigStartUp-APSDaemon - c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe MSConfigStartUp-cfFncEnabler - cfFncEnabler.exe MSConfigStartUp-GarenaPlus - c:\users\Anjing\Saved Games\League of Legends\Garena Messenger\GarenaMessenger.exe MSConfigStartUp-iTunesHelper - c:\program files\iTunes\iTunesHelper.exe MSConfigStartUp-NDSTray - NDSTray.exe MSConfigStartUp-SpybotSD TeaTimer - c:\program files\Spybot - Search & Destroy\TeaTimer.exe MSConfigStartUp-TOSCDSPD - TOSCDSPD.EXE MSConfigStartUp-VDownloader - c:\program files\vdownloader\vdownloader.exe AddRemove-LiveUpdate - c:\program files\Symantec\LiveUpdate\LSETUP.EXE AddRemove-Torch - c:\users\roxio\AppData\Local\Torch\uninstall.exe AddRemove-Yahoo! BrowserPlus - c:\users\roxio\AppData\Local\Yahoo!\BrowserPlus\BrowserPlusUninstaller.exe . . . ************************************************************************** scanning hidden processes ... . scanning hidden autostart entries ... . HKCU\Software\Microsoft\Windows\CurrentVersion\Run TOSCDSPD = c:\program files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe?/i???????? ?m??h????????????????? . scanning hidden files ... . scan completed successfully hidden files: . ************************************************************************** . [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\npggsvc] "ImagePath"="c:\windows\system32\GameMon.des -service" . --------------------- LOCKED REGISTRY KEYS --------------------- . [HKEY_USERS\LocalService\Software\Microsoft\Windows\CurrentVersion\Run] @Denied: (A B C D 1 4 5) (Everyone) . [HKEY_USERS\LocalService\Software\Microsoft\Windows NT\CurrentVersion\Windows] @Denied: (A C D 2 3) (Everyone) "DebugOptions"="2048" "Documents"="" "DosPrint"="no" "NetMessage"="no" "NullPort"="None" "Programs"="com exe bat pif cmd" . [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 "MSCurrentCountry"=dword:000000b5 . [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . ------------------------ Other Running Processes ------------------------ . c:\windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe c:\program files\Microsoft Security Client\MsMpEng.exe c:\program files\Common Files\Adobe\ARM\1.0\armsvc.exe c:\users\Anjing\Saved Games\League of Legends\Garena Messenger\Garena Plus\ggdllhost.exe c:\program files\Microsoft Security Client\NisSrv.exe c:\windows\system32\igfxsrvc.exe c:\windows\servicing\TrustedInstaller.exe . ************************************************************************** . Completion time: 2014-05-01 01:43:58 - machine was rebooted ComboFix-quarantined-files.txt 2014-04-30 17:43 . Pre-Run: 102,878,822,400 bytes free Post-Run: 102,719,479,808 bytes free . - - End Of File - - 9153C122207530EB7F8F95F18862373C 5B5E648D12FCADC244C1EC30318E1EB9