ComboFix 15-10-21.01 - reinel cuenca 22/10/2015 17:13:50.1.8 - x64 Microsoft Windows 7 Ultimate 6.1.7601.1.1252.57.3082.18.5539.3276 [GMT -5:00] Running from: d:\confidencial\COMBOFIX\ComboFix.exe AV: Kaspersky Anti-Virus *Disabled/Updated* {B41C7598-35F6-4D89-7D0E-7ADE69B4047B} SP: Kaspersky Anti-Virus *Disabled/Updated* {0F7D947C-13CC-4207-47BE-41AC12334EC6} SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . . c:\program files (x86)\WinPCap c:\program files (x86)\WinPCap\LICENSE c:\programdata\ntuser.pol c:\users\reinel cuenca\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpeanhji.dll c:\users\REINEL~1\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpeanhji.dll . . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . . -------\Service_Service KMSELDI . . ((((((((((((((((((((((((( Files Created from 2015-09-22 to 2015-10-22 ))))))))))))))))))))))))))))))) . . 2015-10-22 04:27 . 2015-10-13 09:47 11140960 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{C2C3FA7A-806A-4961-BE8C-591C105FA538}\mpengine.dll 2015-10-22 02:47 . 2015-10-22 02:47 -------- d-----w- c:\program files (x86)\ITE 2015-10-21 21:23 . 2015-10-21 21:23 -------- d-----w- C:\$WINDOWS.~BT 2015-10-21 18:13 . 2015-10-21 18:13 -------- d-----w- c:\users\reinel cuenca\AppData\Roaming\simplitec 2015-10-21 18:10 . 2015-10-21 18:13 -------- d-----w- c:\programdata\simplitec 2015-10-21 18:10 . 2015-10-21 18:10 -------- d-----w- c:\program files (x86)\simplitec 2015-10-21 18:02 . 2001-09-05 09:18 77824 ----a-w- c:\program files (x86)\Common Files\InstallShield\engine\6\Intel 32\ctor.dll 2015-10-21 18:02 . 2001-09-05 09:18 225280 ----a-w- c:\program files (x86)\Common Files\InstallShield\IScript\IScript.dll 2015-10-21 18:02 . 2001-09-05 09:14 176128 ----a-w- c:\program files (x86)\Common Files\InstallShield\engine\6\Intel 32\iuser.dll 2015-10-21 18:02 . 2001-09-05 09:13 32768 ----a-w- c:\program files (x86)\Common Files\InstallShield\engine\6\Intel 32\objectps.dll 2015-10-21 17:37 . 2015-10-21 17:38 -------- d-----w- c:\programdata\Zbshareware Lab 2015-10-21 17:37 . 2015-10-21 17:37 -------- d-----w- c:\users\reinel cuenca\AppData\Roaming\Zbshareware Lab 2015-10-21 17:37 . 2015-10-22 02:25 -------- d-----w- c:\program files (x86)\USB Disk Security 2015-10-21 17:02 . 2015-10-21 17:02 -------- d-----w- C:\$Windows.~WS 2015-10-21 16:14 . 2015-10-21 16:14 192216 ----a-w- c:\windows\system32\drivers\5F123921.sys 2015-10-21 15:54 . 2015-10-21 15:54 192216 ----a-w- c:\windows\system32\drivers\48322991.sys 2015-10-21 04:00 . 2015-10-01 18:06 692672 ----a-w- c:\windows\system32\winload.efi 2015-10-21 03:59 . 2015-09-18 19:22 25432 ----a-w- c:\windows\system32\CompatTelRunner.exe 2015-10-21 03:59 . 2015-09-18 19:19 700416 ----a-w- c:\windows\system32\invagent.dll 2015-10-21 03:59 . 2015-09-18 19:19 766464 ----a-w- c:\windows\system32\generaltel.dll 2015-10-21 03:59 . 2015-09-18 19:19 503808 ----a-w- c:\windows\system32\devinv.dll 2015-10-21 03:59 . 2015-09-18 19:19 73216 ----a-w- c:\windows\system32\acmigration.dll 2015-10-21 03:59 . 2015-09-18 19:19 1291264 ----a-w- c:\windows\system32\appraiser.dll 2015-10-21 03:59 . 2015-09-18 19:09 1163776 ----a-w- c:\windows\system32\aeinv.dll 2015-10-21 03:59 . 2015-06-03 20:16 193536 ----a-w- c:\windows\system32\aepic.dll 2015-10-21 03:52 . 2015-09-01 18:14 503296 ----a-w- c:\program files\Common Files\Microsoft Shared\ink\tiptsf.dll 2015-10-21 03:52 . 2015-09-01 18:14 1247232 ----a-w- c:\program files\Common Files\Microsoft Shared\ink\tipskins.dll 2015-10-21 03:52 . 2015-09-01 18:14 110592 ----a-w- c:\program files\Common Files\Microsoft Shared\ink\TipBand.dll 2015-10-21 03:52 . 2015-09-01 18:13 224768 ----a-w- c:\program files\Common Files\Microsoft Shared\ink\TabTip.exe 2015-10-21 03:52 . 2015-09-01 18:12 544768 ----a-w- c:\program files\Common Files\Microsoft Shared\ink\TipRes.dll 2015-10-21 03:52 . 2015-09-01 17:52 348672 ----a-w- c:\program files (x86)\Common Files\Microsoft Shared\ink\tiptsf.dll 2015-10-21 03:52 . 2015-09-01 17:52 10240 ----a-w- c:\program files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe 2015-10-21 03:47 . 2015-04-29 18:22 14635008 ----a-w- c:\windows\system32\wmp.dll 2015-10-21 03:44 . 2015-08-05 17:56 1110016 ----a-w- c:\windows\system32\schedsvc.dll 2015-10-21 03:44 . 2015-07-15 03:19 52736 ----a-w- c:\windows\system32\basesrv.dll 2015-10-21 03:43 . 2015-05-25 18:18 404992 ----a-w- c:\windows\system32\tracerpt.exe 2015-10-21 03:43 . 2015-05-25 18:00 364544 ----a-w- c:\windows\SysWow64\tracerpt.exe 2015-10-21 03:43 . 2015-05-25 18:19 113664 ----a-w- c:\windows\system32\sechost.dll 2015-10-21 03:43 . 2015-05-25 18:18 47104 ----a-w- c:\windows\system32\typeperf.exe 2015-10-21 03:43 . 2015-05-25 18:18 43008 ----a-w- c:\windows\system32\relog.exe 2015-10-21 03:43 . 2015-05-25 18:18 104448 ----a-w- c:\windows\system32\logman.exe 2015-10-21 03:43 . 2015-05-25 18:18 19456 ----a-w- c:\windows\system32\diskperf.exe 2015-10-21 03:43 . 2015-05-25 18:01 92160 ----a-w- c:\windows\SysWow64\sechost.dll 2015-10-21 03:43 . 2015-05-25 18:00 40448 ----a-w- c:\windows\SysWow64\typeperf.exe 2015-10-21 03:43 . 2015-05-25 18:00 37888 ----a-w- c:\windows\SysWow64\relog.exe 2015-10-21 03:43 . 2015-05-25 18:00 82944 ----a-w- c:\windows\SysWow64\logman.exe 2015-10-21 03:43 . 2015-05-25 18:00 17408 ----a-w- c:\windows\SysWow64\diskperf.exe 2015-10-21 03:42 . 2015-07-15 03:17 2048 ----a-w- c:\windows\system32\tzres.dll 2015-10-21 03:42 . 2015-07-15 02:54 2048 ----a-w- c:\windows\SysWow64\tzres.dll 2015-10-21 03:39 . 2015-07-01 20:49 260096 ----a-w- c:\windows\system32\WebClnt.dll 2015-10-21 03:38 . 2015-07-23 00:02 1390592 ----a-w- c:\windows\system32\diagtrack.dll 2015-10-21 03:38 . 2015-07-22 16:48 41984 ----a-w- c:\windows\system32\UtcResources.dll 2015-10-21 03:38 . 2015-07-23 00:02 879104 ----a-w- c:\windows\system32\tdh.dll 2015-10-21 03:38 . 2015-07-23 00:02 879104 ----a-w- c:\windows\system32\advapi32.dll 2015-10-21 03:38 . 2015-07-22 17:53 635392 ----a-w- c:\windows\SysWow64\tdh.dll 2015-10-21 03:38 . 2015-07-22 17:53 641536 ----a-w- c:\windows\SysWow64\advapi32.dll 2015-10-21 02:10 . 2015-10-21 02:10 -------- d-----w- c:\users\Invitado\AppData\Local\Dropbox 2015-10-21 02:10 . 2015-10-21 02:10 -------- d-----w- c:\users\Invitado\AppData\Local\Skype 2015-10-21 02:10 . 2015-10-21 02:10 -------- d-----w- c:\users\Invitado\AppData\Roaming\Skype 2015-10-20 21:17 . 2015-10-20 21:17 -------- d-----w- c:\users\reinel cuenca\AppData\Roaming\InstallShield 2015-10-20 21:16 . 2012-06-21 22:13 15168 ----a-w- c:\windows\system32\drivers\IntelMEFWVer.dll 2015-10-20 21:15 . 2015-10-20 21:15 -------- d-----w- c:\program files (x86)\Common Files\postureAgent 2015-10-20 21:03 . 2015-10-22 19:12 -------- d-----r- c:\users\reinel cuenca\Dropbox 2015-10-20 19:07 . 2015-10-20 19:07 -------- d-----w- c:\users\reinel cuenca\AppData\Roaming\Dropbox 2015-10-20 18:59 . 2015-10-20 19:07 -------- d-----w- c:\program files (x86)\Dropbox 2015-10-20 18:59 . 2015-10-22 19:12 -------- d-----w- c:\users\reinel cuenca\AppData\Local\Dropbox 2015-10-20 18:59 . 2015-10-20 18:59 -------- d-----w- c:\programdata\Dropbox 2015-10-19 02:13 . 2015-10-19 15:56 192216 ----a-w- c:\windows\system32\drivers\7FDD187C.sys 2015-10-16 17:57 . 2015-10-16 17:57 -------- d-----w- c:\users\reinel cuenca\AppData\Local\Macromedia 2015-10-14 16:25 . 2015-10-15 20:36 192216 ----a-w- c:\windows\system32\drivers\363C1E25.sys 2015-10-14 01:35 . 2015-10-14 01:35 -------- d-----w- c:\users\Invitado\fancy 2015-10-13 03:12 . 2015-10-13 18:22 113880 ----a-w- c:\windows\system32\drivers\46DF712D.sys 2015-10-11 21:08 . 2015-10-11 21:08 -------- d-----w- c:\users\reinel cuenca\Tracing 2015-10-11 20:46 . 2015-10-14 02:30 -------- d-----r- c:\program files (x86)\Skype 2015-10-11 20:46 . 2015-10-11 20:46 -------- d-----w- c:\program files (x86)\Common Files\Skype 2015-10-11 19:14 . 2015-10-11 19:14 113880 ----a-w- c:\windows\system32\drivers\121E3560.sys 2015-10-08 20:24 . 2015-07-30 13:13 103120 ----a-w- c:\windows\SysWow64\PresentationCFFRasterizerNative_v0300.dll 2015-10-08 20:24 . 2015-07-30 13:13 124624 ----a-w- c:\windows\system32\PresentationCFFRasterizerNative_v0300.dll 2015-10-08 17:07 . 2015-04-24 18:17 633856 ----a-w- c:\windows\system32\comctl32.dll 2015-10-08 17:07 . 2015-04-24 17:56 530432 ----a-w- c:\windows\SysWow64\comctl32.dll 2015-10-08 17:06 . 2015-06-25 10:06 115136 ----a-w- c:\windows\system32\consent.exe 2015-10-08 17:06 . 2015-06-25 10:01 1941504 ----a-w- c:\windows\system32\authui.dll 2015-10-08 17:06 . 2015-06-25 10:01 70656 ----a-w- c:\windows\system32\appinfo.dll 2015-10-08 17:06 . 2015-06-25 09:44 1805824 ----a-w- c:\windows\SysWow64\authui.dll 2015-10-08 17:01 . 2015-08-27 18:18 1887232 ----a-w- c:\windows\system32\msxml3.dll 2015-10-08 17:01 . 2015-08-27 18:18 2004480 ----a-w- c:\windows\system32\msxml6.dll 2015-10-08 17:01 . 2015-08-27 18:13 2048 ----a-w- c:\windows\system32\msxml6r.dll 2015-10-08 17:01 . 2015-08-27 18:13 2048 ----a-w- c:\windows\system32\msxml3r.dll 2015-10-08 17:01 . 2015-08-27 17:58 1391104 ----a-w- c:\windows\SysWow64\msxml6.dll 2015-10-08 17:01 . 2015-08-27 17:58 1241088 ----a-w- c:\windows\SysWow64\msxml3.dll 2015-10-08 17:01 . 2015-08-27 17:51 2048 ----a-w- c:\windows\SysWow64\msxml6r.dll 2015-10-08 17:01 . 2015-08-27 17:51 2048 ----a-w- c:\windows\SysWow64\msxml3r.dll 2015-10-08 16:52 . 2015-06-17 17:47 404992 ----a-w- c:\windows\system32\gdi32.dll 2015-10-08 16:52 . 2015-06-17 17:37 312320 ----a-w- c:\windows\SysWow64\gdi32.dll 2015-10-08 16:52 . 2015-04-11 03:19 69888 ----a-w- c:\windows\system32\drivers\stream.sys 2015-10-07 03:27 . 2015-10-08 16:24 -------- d-----w- c:\users\reinel cuenca\AppData\Local\Mozilla 2015-10-07 03:26 . 2015-10-07 03:27 -------- d-----w- c:\program files (x86)\Mozilla Maintenance Service 2015-10-07 03:05 . 2015-10-07 03:05 -------- d-----w- c:\users\reinel cuenca\.android 2015-10-07 01:56 . 2015-10-07 01:56 228408 ----a-w- c:\windows\system32\drivers\droidcamvideo.sys 2015-10-07 01:56 . 2015-10-07 01:56 33080 ----a-w- c:\windows\system32\drivers\droidcam.sys 2015-10-02 21:58 . 2015-10-07 01:58 -------- d-----w- c:\program files (x86)\DroidCam 2015-10-02 19:12 . 2015-10-02 19:12 113880 ----a-w- c:\windows\system32\drivers\45CF7447.sys 2015-10-01 15:13 . 2015-10-01 15:13 113880 ----a-w- c:\windows\system32\drivers\28096F25.sys 2015-10-01 00:48 . 2015-10-01 00:48 -------- d-----w- c:\users\reinel cuenca\AppData\Local\YSearchUtil 2015-10-01 00:46 . 2015-10-01 00:46 -------- d-----w- c:\program files (x86)\Common Files\Java 2015-10-01 00:45 . 2015-10-01 00:45 97888 ----a-w- c:\windows\SysWow64\WindowsAccessBridge-32.dll 2015-10-01 00:44 . 2015-10-01 00:44 -------- d-----w- c:\program files (x86)\Java 2015-09-30 18:12 . 2015-09-30 23:50 113880 ----a-w- c:\windows\system32\drivers\001A2A06.sys 2015-09-30 00:12 . 2015-09-30 00:12 113880 ----a-w- c:\windows\system32\drivers\75AE6F7A.sys 2015-09-28 15:12 . 2015-09-29 00:16 113880 ----a-w- c:\windows\system32\drivers\378603E0.sys . . . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2015-10-22 22:25 . 2015-03-18 03:21 192216 ----a-w- c:\windows\system32\drivers\MBAMSwissArmy.sys 2015-10-21 04:51 . 2015-03-22 03:07 143481208 ----a-w- c:\windows\system32\MRT.exe 2015-10-05 14:50 . 2015-03-18 03:21 63704 ----a-w- c:\windows\system32\drivers\mwac.sys 2015-10-05 14:50 . 2015-03-18 03:21 109272 ----a-w- c:\windows\system32\drivers\mbamchameleon.sys 2015-10-05 14:50 . 2015-03-18 03:21 25816 ----a-w- c:\windows\system32\drivers\mbam.sys 2015-09-29 02:58 . 2015-10-21 04:00 44032 ----a-w- c:\windows\apppatch\acwow64.dll 2015-09-07 13:34 . 2015-07-25 02:34 48648 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\UpdateableMarkup\Markup.dll 2015-09-06 05:06 . 2015-09-03 02:12 113880 ----a-w- c:\windows\system32\drivers\13760DAE.sys 2015-09-05 20:07 . 2015-08-07 23:53 48648 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\UpdateableMarkup-2\Markup.dll 2015-08-10 01:22 . 2015-08-10 01:22 163504 ----a-w- c:\programdata\Microsoft\Windows\Sqm\Manifest\Sqm10145.bin 2015-08-02 18:12 . 2015-08-02 18:12 113880 ----a-w- c:\windows\system32\drivers\57D8283E.sys . . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ DropboxExt1] @="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}] 2015-10-12 23:34 194824 ----a-w- c:\program files (x86)\Dropbox\Client\DropboxExt.28.dll . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ DropboxExt2] @="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}] 2015-10-12 23:34 194824 ----a-w- c:\program files (x86)\Dropbox\Client\DropboxExt.28.dll . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ DropboxExt3] @="{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}] 2015-10-12 23:34 194824 ----a-w- c:\program files (x86)\Dropbox\Client\DropboxExt.28.dll . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ DropboxExt4] @="{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}] 2015-10-12 23:34 194824 ----a-w- c:\program files (x86)\Dropbox\Client\DropboxExt.28.dll . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ DropboxExt5] @="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}] 2015-10-12 23:34 194824 ----a-w- c:\program files (x86)\Dropbox\Client\DropboxExt.28.dll . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ DropboxExt6] @="{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}] 2015-10-12 23:34 194824 ----a-w- c:\program files (x86)\Dropbox\Client\DropboxExt.28.dll . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ DropboxExt7] @="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}] 2015-10-12 23:34 194824 ----a-w- c:\program files (x86)\Dropbox\Client\DropboxExt.28.dll . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ DropboxExt8] @="{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}] 2015-10-12 23:34 194824 ----a-w- c:\program files (x86)\Dropbox\Client\DropboxExt.28.dll . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrivePro1 (ErrorConflict)] @="{8BA85C75-763B-4103-94EB-9470F12FE0F7}" [HKEY_CLASSES_ROOT\CLSID\{8BA85C75-763B-4103-94EB-9470F12FE0F7}] 2012-10-02 01:33 1720976 ----a-w- c:\progra~2\MICROS~1\Office15\GROOVEEX.DLL . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrivePro2 (SyncInProgress)] @="{CD55129A-B1A1-438E-A425-CEBC7DC684EE}" [HKEY_CLASSES_ROOT\CLSID\{CD55129A-B1A1-438E-A425-CEBC7DC684EE}] 2012-10-02 01:33 1720976 ----a-w- c:\progra~2\MICROS~1\Office15\GROOVEEX.DLL . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrivePro3 (InSync)] @="{E768CD3B-BDDC-436D-9C13-E1B39CA257B1}" [HKEY_CLASSES_ROOT\CLSID\{E768CD3B-BDDC-436D-9C13-E1B39CA257B1}] 2012-10-02 01:33 1720976 ----a-w- c:\progra~2\MICROS~1\Office15\GROOVEEX.DLL . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-21 1475584] . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] "AVP"="c:\program files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2013\avp.exe" [2015-03-16 356128] "AdobeCEPServiceManager"="c:\program files (x86)\Common Files\Adobe\CEPServiceManager4\CEPServiceManager.exe" [2013-03-13 1039248] "SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2015-08-04 597552] "Adobe Creative Cloud"="c:\program files (x86)\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe" [2015-09-17 2292912] "Dropbox"="c:\program files (x86)\Dropbox\Client\Dropbox.exe" [2015-10-12 36711472] "USB Security"="c:\program files (x86)\USB Disk Security\USBGuard.exe" [2011-11-04 2048928] . c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\ simplicheck.lnk - c:\program files (x86)\simplitec\simplicheck\simplicheck.exe -timer [2012-8-1 2936168] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorAdmin"= 5 (0x5) "ConsentPromptBehaviorUser"= 3 (0x3) "EnableUIADesktopToggle"= 0 (0x0) "EnableLinkedConnections"= 1 (0x1) . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows] "LoadAppInit_DLLs"=1 (0x1) "RequireSignedAppInit_DLLs"=0 (0x0) . [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus] "DisableMonitoring"=dword:00000001 . R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x] R2 dbupdate;Servicio de Actualización de Dropbox (dbupdate);c:\program files (x86)\Dropbox\Update\DropboxUpdate.exe;c:\program files (x86)\Dropbox\Update\DropboxUpdate.exe [x] R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x] R3 andnetadb;ADB Interface DriverNet;c:\windows\system32\Drivers\lgandnetadb.sys;c:\windows\SYSNATIVE\Drivers\lgandnetadb.sys [x] R3 AndNetDiag;LGE AndroidNet USB Serial Port;c:\windows\system32\DRIVERS\lgandnetdiag64.sys;c:\windows\SYSNATIVE\DRIVERS\lgandnetdiag64.sys [x] R3 ANDNetModem;LGE AndroidNet USB Modem;c:\windows\system32\DRIVERS\lgandnetmodem64.sys;c:\windows\SYSNATIVE\DRIVERS\lgandnetmodem64.sys [x] R3 dbupdatem;Servicio de Actualización de Dropbox (dbupdatem);c:\program files (x86)\Dropbox\Update\DropboxUpdate.exe;c:\program files (x86)\Dropbox\Update\DropboxUpdate.exe [x] R3 dmvsc;dmvsc;c:\windows\system32\drivers\dmvsc.sys;c:\windows\SYSNATIVE\drivers\dmvsc.sys [x] R3 ICCS;Intel(R) Integrated Clock Controller Service - Intel(R) ICCS;c:\program files (x86)\Intel\Intel(R) Integrated Clock Controller Service\ICCProxy.exe;c:\program files (x86)\Intel\Intel(R) Integrated Clock Controller Service\ICCProxy.exe [x] R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x] R3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files\McAfee Security Scan\3.11.163\McCHSvc.exe;c:\program files\McAfee Security Scan\3.11.163\McCHSvc.exe [x] R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys;c:\windows\SYSNATIVE\drivers\rdpvideominiport.sys [x] R3 Synth3dVsc;Synth3dVsc;c:\windows\system32\drivers\synth3dvsc.sys;c:\windows\SYSNATIVE\drivers\synth3dvsc.sys [x] R3 terminpt;Microsoft Remote Desktop Input Driver;c:\windows\system32\drivers\terminpt.sys;c:\windows\SYSNATIVE\drivers\terminpt.sys [x] R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x] R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys;c:\windows\SYSNATIVE\drivers\TsUsbGD.sys [x] R3 tsusbhub;tsusbhub;c:\windows\system32\drivers\tsusbhub.sys;c:\windows\SYSNATIVE\drivers\tsusbhub.sys [x] R3 usbUDisc;usbUDisc;c:\windows\system32\DRIVERS\USBDrv_AMD64.sys;c:\windows\SYSNATIVE\DRIVERS\USBDrv_AMD64.sys [x] R3 VGPU;VGPU;c:\windows\system32\drivers\rdvgkmd.sys;c:\windows\SYSNATIVE\drivers\rdvgkmd.sys [x] R3 WatAdminSvc;Servicio de tecnologías de activación de Windows;c:\windows\system32\Wat\WatAdminSvc.exe;c:\windows\SYSNATIVE\Wat\WatAdminSvc.exe [x] S0 iaStorA;iaStorA;c:\windows\system32\DRIVERS\iaStorA.sys;c:\windows\SYSNATIVE\DRIVERS\iaStorA.sys [x] S0 iaStorF;iaStorF;c:\windows\system32\DRIVERS\iaStorF.sys;c:\windows\SYSNATIVE\DRIVERS\iaStorF.sys [x] S1 KLIM6;Kaspersky Anti-Virus NDIS 6 Filter;c:\windows\system32\DRIVERS\klim6.sys;c:\windows\SYSNATIVE\DRIVERS\klim6.sys [x] S1 kltdi;kltdi;c:\windows\system32\DRIVERS\kltdi.sys;c:\windows\SYSNATIVE\DRIVERS\kltdi.sys [x] S1 kneps;kneps;c:\windows\system32\DRIVERS\kneps.sys;c:\windows\SYSNATIVE\DRIVERS\kneps.sys [x] S2 AGSService;Adobe Genuine Software Integrity Service;c:\program files (x86)\Common Files\Adobe\AdobeGCClient\AGSService.exe;c:\program files (x86)\Common Files\Adobe\AdobeGCClient\AGSService.exe [x] S2 c2cautoupdatesvc;Skype Click to Call Updater;c:\program files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe;c:\program files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [x] S2 c2cpnrsvc;Skype Click to Call PNR Service;c:\program files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe;c:\program files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [x] S2 DiagTrack;Diagnostics Tracking Service;c:\windows\System32\svchost.exe;c:\windows\SYSNATIVE\svchost.exe [x] S2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology;c:\program files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe;c:\program files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [x] S2 igfxCUIService1.0.0.0;Intel(R) HD Graphics Control Panel Service;c:\windows\system32\igfxCUIService.exe;c:\windows\SYSNATIVE\igfxCUIService.exe [x] S2 Intel(R) Capability Licensing Service Interface;Intel(R) Capability Licensing Service Interface;c:\program files\Intel\iCLS Client\HeciServer.exe;c:\program files\Intel\iCLS Client\HeciServer.exe [x] S2 jhi_service;Intel(R) Dynamic Application Loader Host Interface Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe;c:\program files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [x] S2 MBAMScheduler;MBAMScheduler;c:\program files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe;c:\program files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [x] S2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes Anti-Malware\mbamservice.exe;c:\program files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [x] S2 NAUpdate;Nero Update;c:\program files (x86)\Nero\Update\NASvc.exe;c:\program files (x86)\Nero\Update\NASvc.exe [x] S2 SkypeUpdateEx;SkypeUpdateEx;c:\program files (x86)\SkypeUpdateEx\SkypeUpdateEx.exe;c:\program files (x86)\SkypeUpdateEx\SkypeUpdateEx.exe [x] S2 UNS;Intel(R) Management and Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [x] S3 DroidCam;DroidCam Virtual Audio;c:\windows\system32\DRIVERS\droidcam.sys;c:\windows\SYSNATIVE\DRIVERS\droidcam.sys [x] S3 DroidCamVideo;DroidCam Source 3;c:\windows\system32\DRIVERS\droidcamvideo.sys;c:\windows\SYSNATIVE\DRIVERS\droidcamvideo.sys [x] S3 ICCWDT;Intel(R) Watchdog Timer Driver (Intel(R) WDT);c:\windows\system32\DRIVERS\ICCWDT.sys;c:\windows\SYSNATIVE\DRIVERS\ICCWDT.sys [x] S3 IntcDAud;Sonido Intel(R) para pantallas;c:\windows\system32\DRIVERS\IntcDAud.sys;c:\windows\SYSNATIVE\DRIVERS\IntcDAud.sys [x] S3 klkbdflt;Kaspersky Lab KLKBDFLT;c:\windows\system32\DRIVERS\klkbdflt.sys;c:\windows\SYSNATIVE\DRIVERS\klkbdflt.sys [x] S3 klmouflt;Kaspersky Lab KLMOUFLT;c:\windows\system32\DRIVERS\klmouflt.sys;c:\windows\SYSNATIVE\DRIVERS\klmouflt.sys [x] S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys;c:\windows\SYSNATIVE\drivers\mbam.sys [x] S3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\MBAMSwissArmy.sys;c:\windows\SYSNATIVE\drivers\MBAMSwissArmy.sys [x] S3 MBAMWebAccessControl;MBAMWebAccessControl;c:\windows\system32\drivers\mwac.sys;c:\windows\SYSNATIVE\drivers\mwac.sys [x] S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x] . . --- Other Services/Drivers In Memory --- . *NewlyCreated* - MBAMSWISSARMY *NewlyCreated* - WS2IFSL . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}] 2015-10-17 17:20 997704 ----a-w- c:\program files (x86)\Google\Chrome\Application\46.0.2490.71\Installer\chrmstp.exe . Contents of the 'Scheduled Tasks' folder . 2015-03-28 c:\windows\Tasks\DriverEasy Scheduled Scan.job - c:\program files\Easeware\DriverEasy\DriverEasy.exe [2015-03-29 06:09] . 2015-10-22 c:\windows\Tasks\DropboxUpdateTaskMachineCore.job - c:\program files (x86)\Dropbox\Update\DropboxUpdate.exe [2015-10-20 18:59] . 2015-10-22 c:\windows\Tasks\DropboxUpdateTaskMachineUA.job - c:\program files (x86)\Dropbox\Update\DropboxUpdate.exe [2015-10-20 18:59] . 2015-10-22 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2015-03-16 02:32] . 2015-10-22 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2015-03-16 02:32] . . --------- X64 Entries ----------- . . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ AccExtIco1] @="{AB9CF9F8-8A96-4F9D-BF21-CE85714C3A47}" [HKEY_CLASSES_ROOT\CLSID\{AB9CF9F8-8A96-4F9D-BF21-CE85714C3A47}] 2015-09-12 00:02 803488 ----a-w- c:\program files (x86)\Adobe\Adobe Creative Cloud\CoreSyncExtension\CoreSync_x64.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ AccExtIco2] @="{853B7E05-C47D-4985-909A-D0DC5C6D7303}" [HKEY_CLASSES_ROOT\CLSID\{853B7E05-C47D-4985-909A-D0DC5C6D7303}] 2015-09-12 00:02 803488 ----a-w- c:\program files (x86)\Adobe\Adobe Creative Cloud\CoreSyncExtension\CoreSync_x64.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ AccExtIco3] @="{42D38F2E-98E9-4382-B546-E24E4D6D04BB}" [HKEY_CLASSES_ROOT\CLSID\{42D38F2E-98E9-4382-B546-E24E4D6D04BB}] 2015-09-12 00:02 803488 ----a-w- c:\program files (x86)\Adobe\Adobe Creative Cloud\CoreSyncExtension\CoreSync_x64.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ DropboxExt1] @="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}] 2015-10-12 23:34 232712 ----a-w- c:\program files (x86)\Dropbox\Client\DropboxExt64.28.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ DropboxExt2] @="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}] 2015-10-12 23:34 232712 ----a-w- c:\program files (x86)\Dropbox\Client\DropboxExt64.28.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ DropboxExt3] @="{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}] 2015-10-12 23:34 232712 ----a-w- c:\program files (x86)\Dropbox\Client\DropboxExt64.28.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ DropboxExt4] @="{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}] 2015-10-12 23:34 232712 ----a-w- c:\program files (x86)\Dropbox\Client\DropboxExt64.28.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ DropboxExt5] @="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}] 2015-10-12 23:34 232712 ----a-w- c:\program files (x86)\Dropbox\Client\DropboxExt64.28.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ DropboxExt6] @="{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}] 2015-10-12 23:34 232712 ----a-w- c:\program files (x86)\Dropbox\Client\DropboxExt64.28.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ DropboxExt7] @="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}] 2015-10-12 23:34 232712 ----a-w- c:\program files (x86)\Dropbox\Client\DropboxExt64.28.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ DropboxExt8] @="{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}] 2015-10-12 23:34 232712 ----a-w- c:\program files (x86)\Dropbox\Client\DropboxExt64.28.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrivePro1 (ErrorConflict)] @="{8BA85C75-763B-4103-94EB-9470F12FE0F7}" [HKEY_CLASSES_ROOT\CLSID\{8BA85C75-763B-4103-94EB-9470F12FE0F7}] 2014-01-22 09:11 2333400 ----a-w- c:\progra~1\MICROS~2\Office15\GROOVEEX.DLL . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrivePro2 (SyncInProgress)] @="{CD55129A-B1A1-438E-A425-CEBC7DC684EE}" [HKEY_CLASSES_ROOT\CLSID\{CD55129A-B1A1-438E-A425-CEBC7DC684EE}] 2014-01-22 09:11 2333400 ----a-w- c:\progra~1\MICROS~2\Office15\GROOVEEX.DLL . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrivePro3 (InSync)] @="{E768CD3B-BDDC-436D-9C13-E1B39CA257B1}" [HKEY_CLASSES_ROOT\CLSID\{E768CD3B-BDDC-436D-9C13-E1B39CA257B1}] 2014-01-22 09:11 2333400 ----a-w- c:\progra~1\MICROS~2\Office15\GROOVEEX.DLL . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "IAStorIcon"="c:\program files\Intel\Intel(R) Rapid Storage Technology\IAStorIconLaunch.exe" [2013-08-07 36352] "UMonit64"="c:\windows\SysWOW64\UMonit64.exe" [2013-03-14 40960] "AdobeAAMUpdater-1.0"="c:\program files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2015-09-04 508104] "RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2012-07-13 12936848] . ------- Supplementary Scan ------- . uLocal Page = c:\windows\system32\blank.htm uStart Page = https://co.yahoo.com/?fr=yset_ie_syc_oracle&type=orcl_hpset mDefault_Search_URL = hxxp://search.searchult.com/?bd=ds&oem=testsinstcr&uid=HitachiXHDS721010KLA330_GTE000PAKB0NNEKB0NNEX&version=2.2.0.7859&pid=414031160&tid=311&q={searchTerms} mDefault_Page_URL = hxxp://www.searchult.com/?bd=hp&oem=testsinstcr&uid=HitachiXHDS721010KLA330_GTE000PAKB0NNEKB0NNEX&version=2.2.0.7859&pid=414031160&tid=311 mStart Page = hxxp://www.searchult.com/?bd=hp&oem=testsinstcr&uid=HitachiXHDS721010KLA330_GTE000PAKB0NNEKB0NNEX&version=2.2.0.7859&pid=414031160&tid=311 mLocal Page = c:\windows\SysWOW64\blank.htm mSearch Page = hxxp://search.searchult.com/?bd=ds&oem=testsinstcr&uid=HitachiXHDS721010KLA330_GTE000PAKB0NNEKB0NNEX&version=2.2.0.7859&pid=414031160&tid=311&q={searchTerms} IE: &Enviar a OneNote - c:\progra~2\MICROS~1\Office15\ONBttnIE.dll/105 IE: E&xportar a Microsoft Excel - c:\progra~2\MICROS~1\Office15\EXCEL.EXE/3000 TCP: DhcpNameServer = 192.168.1.1 Filter: text/xml - {807583E5-5146-11D5-A672-00B0D022E945} - c:\program files (x86)\Common Files\microsoft shared\OFFICE15\MSOXMLMF.DLL . - - - - ORPHANS REMOVED - - - - . AddRemove-Mozilla Firefox 41.0.1 (x86 es-ES) - c:\program files (x86)\Mozilla Firefox\uninstall\helper.exe . . . --------------------- LOCKED REGISTRY KEYS --------------------- . [HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}] @Denied: (A) (Everyone) "Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}" . [HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Schema Library\ActionsPane3] @Denied: (A) (Everyone) . [HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0] "Key"="ActionsPane3" "Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd" . [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security] @Denied: (Full) (Everyone) . ------------------------ Other Running Processes ------------------------ . c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe c:\program files (x86)\Google\Update\1.3.28.15\GoogleCrashHandler.exe c:\program files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe c:\program files (x86)\Malwarebytes Anti-Malware\mbam.exe . ************************************************************************** . Completion time: 2015-10-22 17:28:32 - machine was rebooted ComboFix-quarantined-files.txt 2015-10-22 22:28 . Pre-Run: 135.202.684.928 bytes libres Post-Run: 135.480.086.528 bytes libres . - - End Of File - - 2ACF560EBC0CF942A167F3DEE8D330BA A36C5E4F47E84449FF07ED3517B43A31