ComboFix 14-01-01.01 - win7 01/01/2014 14:01:09.1.1 - x86
NETWORKMicrosoft Windows 7 Ultimate
6.1.7600.0.1252.51.3082.18.1643.1129 [GMT -5:00]Running from:
c:\users\win7\Desktop\ComboFix.exeAV: ESET NOD32 Antivirus 4.0
*Disabled/Updated* {CB0F8167-5331-BA19-698E-64816B6801A5}SP: ESET
NOD32 Antivirus 4.0 *Disabled/Updated*
{706E6083-750B-B597-533E-5FF310EF4B18}SP: Windows Defender
*Enabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} * Created
a new restore point.[i] ADS - Windows: deleted 24 bytes in 1
streams. [/i].((((((((((((((((((((((((((((((((((((((( Other
Deletions
)))))))))))))))))))))))))))))))))))))))))))))))))..c:\programdata\SearchNewTabc:\programdata\SearchNewTab\jlvPJCuP8.datc:\programdata\SearchNewTab\Wb6ypS.datc:\programdata\SearchNewTab\Wb6ypS.exec:\users\win7\AppData\Local\Minibarc:\users\win7\AppData\Local\Minibar\chrome.crxc:\users\win7\AppData\Local\Minibar\chrome.pemc:\users\win7\AppData\Local\Minibar\chrome\background.htmlc:\users\win7\AppData\Local\Minibar\chrome\cached_http_request.jsc:\users\win7\AppData\Local\Minibar\chrome\extension_info.jsonc:\users\win7\AppData\Local\Minibar\chrome\icons\icon128.pngc:\users\win7\AppData\Local\Minibar\chrome\icons\icon19.pngc:\users\win7\AppData\Local\Minibar\chrome\icons\icon32.pngc:\users\win7\AppData\Local\Minibar\chrome\icons\icon48.pngc:\users\win7\AppData\Local\Minibar\chrome\includes\content.jsc:\users\win7\AppData\Local\Minibar\chrome\includes\content_kango.jsc:\users\win7\AppData\Local\Minibar\chrome\includes\content_menu.jsc:\users\win7\AppData\Local\Minibar\chrome\includes\content_messaging.jsc:\users\win7\AppData\Local\Minibar\chrome\includes\content_pageutils.jsc:\users\win7\AppData\Local\Minibar\chrome\includes\content_popup.jsc:\users\win7\AppData\Local\Minibar\chrome\includes\content_toolbar.jsc:\users\win7\AppData\Local\Minibar\chrome\includes\content_toolbar_customfixes.jsc:\users\win7\AppData\Local\Minibar\chrome\includes\content_userscript.jsc:\users\win7\AppData\Local\Minibar\chrome\initial_config.jsonc:\users\win7\AppData\Local\Minibar\chrome\kango-ui\button.jsc:\users\win7\AppData\Local\Minibar\chrome\kango-ui\toolbar.jsc:\users\win7\AppData\Local\Minibar\chrome\kango-ui\ui.jsc:\users\win7\AppData\Local\Minibar\chrome\kango\browser.jsc:\users\win7\AppData\Local\Minibar\chrome\kango\console.jsc:\users\win7\AppData\Local\Minibar\chrome\kango\event_listener.jsc:\users\win7\AppData\Local\Minibar\chrome\kango\initialize.jsc:\users\win7\AppData\Local\Minibar\chrome\kango\io.jsc:\users\win7\AppData\Local\Minibar\chrome\kango\jsonstorage.jsc:\users\win7\AppData\Local\Minibar\chrome\kango\kango.jsc:\users\win7\AppData\Local\Minibar\chrome\kango\lang.jsc:\users\win7\AppData\Local\Minibar\chrome\kango\messaging.jsc:\users\win7\AppData\Local\Minibar\chrome\kango\userscript_engine.jsc:\users\win7\AppData\Local\Minibar\chrome\kango\xhr.jsc:\users\win7\AppData\Local\Minibar\chrome\main.jsc:\users\win7\AppData\Local\Minibar\chrome\manifest.jsonc:\users\win7\AppData\Local\Minibar\chrome\minibar\actions.jsc:\users\win7\AppData\Local\Minibar\chrome\minibar\cachedxhr.jsc:\users\win7\AppData\Local\Minibar\chrome\minibar\config.jsc:\users\win7\AppData\Local\Minibar\chrome\minibar\macros.jsc:\users\win7\AppData\Local\Minibar\chrome\minibar\minibar.jsc:\users\win7\AppData\Local\Minibar\chrome\MinibarPlugin.dllc:\users\win7\AppData\Local\Minibar\chrome\popup.htmlc:\users\win7\AppData\Local\Minibar\chrome\popup.jsc:\users\win7\AppData\Local\Minibar\chrome\tab.htmlc:\users\win7\AppData\Local\Minibar\chrome\tab.jsc:\users\win7\AppData\Local\Minibar\chrome_installer.jsc:\users\win7\AppData\Local\Minibar\common.jsc:\users\win7\AppData\Local\Minibar\firefox\chrome.manifestc:\users\win7\AppData\Local\Minibar\firefox\chrome\content\content.xulc:\users\win7\AppData\Local\Minibar\firefox\chrome\content\extension_info.jsonc:\users\win7\AppData\Local\Minibar\firefox\chrome\content\icons\icon128.pngc:\users\win7\AppData\Local\Minibar\firefox\chrome\content\icons\icon19.pngc:\users\win7\AppData\Local\Minibar\firefox\chrome\content\icons\icon32.pngc:\users\win7\AppData\Local\Minibar\firefox\chrome\content\icons\icon48.pngc:\users\win7\AppData\Local\Minibar\firefox\chrome\content\initial_config.jsonc:\users\win7\AppData\Local\Minibar\firefox\chrome\content\kango-ui\button.jsc:\users\win7\AppData\Local\Minibar\firefox\chrome\content\kango-ui\popup.jsc:\users\win7\AppData\Local\Minibar\firefox\chrome\content\kango-ui\popup_window.jsc:\users\win7\AppData\Local\Minibar\firefox\chrome\content\kango-ui\popup_window.xulc:\users\win7\AppData\Local\Minibar\firefox\chrome\content\kango-ui\theme\bubble\bottom-left.pngc:\users\win7\AppData\Local\Minibar\firefox\chrome\content\kango-ui\theme\bubble\bottom-middle.pngc:\users\win7\AppData\Local\Minibar\firefox\chrome\content\kango-ui\theme\bubble\bottom-right.pngc:\users\win7\AppData\Local\Minibar\firefox\chrome\content\kango-ui\theme\bubble\middle-left.pngc:\users\win7\AppData\Local\Minibar\firefox\chrome\content\kango-ui\theme\bubble\middle-right.pngc:\users\win7\AppData\Local\Minibar\firefox\chrome\content\kango-ui\theme\bubble\style.cssc:\users\win7\AppData\Local\Minibar\firefox\chrome\content\kango-ui\theme\bubble\tail-bottom.pngc:\users\win7\AppData\Local\Minibar\firefox\chrome\content\kango-ui\theme\bubble\tail-left.pngc:\users\win7\AppData\Local\Minibar\firefox\chrome\content\kango-ui\theme\bubble\tail-right.pngc:\users\win7\AppData\Local\Minibar\firefox\chrome\content\kango-ui\theme\bubble\tail-top.pngc:\users\win7\AppData\Local\Minibar\firefox\chrome\content\kango-ui\theme\bubble\top-left.pngc:\users\win7\AppData\Local\Minibar\firefox\chrome\content\kango-ui\theme\bubble\top-middle.pngc:\users\win7\AppData\Local\Minibar\firefox\chrome\content\kango-ui\theme\bubble\top-right.pngc:\users\win7\AppData\Local\Minibar\firefox\chrome\content\kango-ui\toolbar.jsc:\users\win7\AppData\Local\Minibar\firefox\chrome\content\kango-ui\toolbar_stub.htmlc:\users\win7\AppData\Local\Minibar\firefox\chrome\content\kango-ui\ui.jsc:\users\win7\AppData\Local\Minibar\firefox\chrome\content\kango\browser.jsc:\users\win7\AppData\Local\Minibar\firefox\chrome\content\kango\console.jsc:\users\win7\AppData\Local\Minibar\firefox\chrome\content\kango\event_listener.jsc:\users\win7\AppData\Local\Minibar\firefox\chrome\content\kango\initialize.jsc:\users\win7\AppData\Local\Minibar\firefox\chrome\content\kango\io.jsc:\users\win7\AppData\Local\Minibar\firefox\chrome\content\kango\jsonstorage.jsc:\users\win7\AppData\Local\Minibar\firefox\chrome\content\kango\kango.jsc:\users\win7\AppData\Local\Minibar\firefox\chrome\content\kango\lang.jsc:\users\win7\AppData\Local\Minibar\firefox\chrome\content\kango\messaging.jsc:\users\win7\AppData\Local\Minibar\firefox\chrome\content\kango\storage.jsc:\users\win7\AppData\Local\Minibar\firefox\chrome\content\kango\uninstall_observer.jsc:\users\win7\AppData\Local\Minibar\firefox\chrome\content\kango\userscript_engine.jsc:\users\win7\AppData\Local\Minibar\firefox\chrome\content\kango\xhr.jsc:\users\win7\AppData\Local\Minibar\firefox\chrome\content\main.jsc:\users\win7\AppData\Local\Minibar\firefox\chrome\content\minibar\actions.jsc:\users\win7\AppData\Local\Minibar\firefox\chrome\content\minibar\cachedxhr.jsc:\users\win7\AppData\Local\Minibar\firefox\chrome\content\minibar\config.jsc:\users\win7\AppData\Local\Minibar\firefox\chrome\content\minibar\homepage_helper.jsc:\users\win7\AppData\Local\Minibar\firefox\chrome\content\minibar\macros.jsc:\users\win7\AppData\Local\Minibar\firefox\chrome\content\minibar\minibar.jsc:\users\win7\AppData\Local\Minibar\firefox\chrome\content\minibar\search_helper.jsc:\users\win7\AppData\Local\Minibar\firefox\chrome\content\minibar\search_hook.jsc:\users\win7\AppData\Local\Minibar\firefox\chrome\content\minibar\tabpage_helper.jsc:\users\win7\AppData\Local\Minibar\firefox\install.rdfc:\users\win7\AppData\Local\Minibar\firefox\plugins\npMinibarPlugin.dllc:\users\win7\AppData\Local\Minibar\firefox_installer.jsc:\users\win7\AppData\Local\Minibar\ie_installer.jsc:\users\win7\AppData\Local\Minibar\minibar.crxc:\users\win7\AppData\Local\Minibar\minibar.xpic:\users\win7\AppData\Local\Minibar\SettingsHelper.exec:\users\win7\AppData\Local\Minibar\Uninstall.exec:\users\win7\AppData\Local\Minibar\update_chrome.xmlc:\users\win7\AppData\Roaming\Mozilla\Firefox\Profiles\kfnaep91.default\extensions\[email protected]:\users\win7\AppData\Roaming\Mozilla\Firefox\Profiles\kfnaep91.default\extensions\[email protected]\bootstrap.jsc:\users\win7\AppData\Roaming\Mozilla\Firefox\Profiles\kfnaep91.default\extensions\[email protected]\chrome.manifestc:\users\win7\AppData\Roaming\Mozilla\Firefox\Profiles\kfnaep91.default\extensions\[email protected]\content\zy.xulc:\users\win7\AppData\Roaming\Mozilla\Firefox\Profiles\kfnaep91.default\extensions\[email protected]\install.rdfc:\users\win7\AppData\Roaming\Mozilla\Firefox\Profiles\kfnaep91.default\extensions\[email protected]:\users\win7\AppData\Roaming\Mozilla\Firefox\Profiles\kfnaep91.default\extensions\[email protected]\bootstrap.jsc:\users\win7\AppData\Roaming\Mozilla\Firefox\Profiles\kfnaep91.default\extensions\[email protected]\chrome.manifestc:\users\win7\AppData\Roaming\Mozilla\Firefox\Profiles\kfnaep91.default\extensions\[email protected]\install.rdfc:\users\win7\Documents\CyberLink.5.0.1523d.18978_YUC120326-06.tmpc:\windows\system32\sys..(((((((((((((((((((((((((
Files Created from 2013-12-01 to 2014-01-01
)))))))))))))))))))))))))))))))..2014-01-01 19:11 . 2014-01-01
19:11 -------- d-----w- c:\users\win7\AppData\Local\temp2014-01-01
19:11 . 2014-01-01 19:11 -------- d-----w-
c:\users\Default\AppData\Local\temp2013-12-25 12:16 . 1998-11-13
17:04 308224 ----a-w- c:\windows\IsUn040a.exe2013-12-15 22:28 .
2013-12-15 22:28 -------- d-----w-
c:\users\win7\AppData\Local\Macromedia2013-12-10 01:49 . 2013-12-10
01:49 -------- d-----w- c:\programdata\McAfee2013-12-09 13:21 .
2013-12-13 21:51 -------- d-----w- c:\program
files\WebSearch2013-12-09 13:19 . 2013-12-09 13:19 --------
d-----w- c:\programdata\surfo uaaNd keepp2013-12-09 13:19 .
2013-12-24 05:17 -------- d-----w- c:\program files\surfo uaaNd
keepp...(((((((((((((((((((((((((((((((((((((((( Find3M Report
)))))))))))))))))))))))))))))))))))))))))))))))))))).2013-12-12
02:56 . 2013-02-19 02:52 692616 ----a-w-
c:\windows\system32\FlashPlayerApp.exe2013-12-12 02:56 . 2012-02-15
12:39 71048 ----a-w-
c:\windows\system32\FlashPlayerCPLApp.cpl..(((((((((((((((((((((((((((((((((((((
Reg Loading Points
))))))))))))))))))))))))))))))))))))))))))))))))))..*Note* empty
entries & legit default entries are not shown
REGEDIT4.[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\
SkyDrive1]@="{F241C880-6982-4CE5-8CF7-7085BA96DA5A}"[HKEY_CLASSES_ROOT\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}]2012-11-29
15:05 220632 ----a-w-
c:\users\win7\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\SkyDriveShell.dll.[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\
SkyDrive2]@="{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}"[HKEY_CLASSES_ROOT\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}]2012-11-29
15:05 220632 ----a-w-
c:\users\win7\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\SkyDriveShell.dll.[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\
SkyDrive3]@="{BBACC218-34EA-4666-9D7A-C78F2274A524}"[HKEY_CLASSES_ROOT\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}]2012-11-29
15:05 220632 ----a-w-
c:\users\win7\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\SkyDriveShell.dll.[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]"RTHDVCPL"="c:\program
files\Realtek\Audio\HDA\RtHDVCpl.exe" [2009-10-21
7858720]"egui"="c:\program files\ESET\ESET NOD32
Antivirus\egui.exe" [2009-09-29
2054360].[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]"ConsentPromptBehaviorAdmin"=
0 (0x0)"ConsentPromptBehaviorUser"= 3 (0x3)"EnableLUA"= 0
(0x0)"EnableUIADesktopToggle"= 0 (0x0)"PromptOnSecureDesktop"= 0
(0x0).[HKEY_LOCAL_MACHINE\software\microsoft\windows
nt\currentversion\drivers32]"aux"=wdmaud.drv.[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start
Menu^Programs^Startup^McAfee Security Scan
Plus.lnk]path=c:\programdata\Microsoft\Windows\Start
Menu\Programs\Startup\McAfee Security Scan
Plus.lnkbackup=c:\windows\pss\McAfee Security Scan
Plus.lnk.CommonStartupbackupExtension=.CommonStartup.[HKLM\~\startupfolder\C:^Users^win7^AppData^Roaming^Microsoft^Windows^Start
Menu^Programs^Startup^Recorte de pantalla y Selector de OneNote
2010.lnk]path=c:\users\win7\AppData\Roaming\Microsoft\Windows\Start
Menu\Programs\Startup\Recorte de pantalla y Selector de OneNote
2010.lnkbackup=c:\windows\pss\Recorte de pantalla y Selector de
OneNote
2010.lnk.StartupbackupExtension=.Startup.[HKEY_LOCAL_MACHINE\software\microsoft\shared
tools\msconfig\startupreg\Adobe Reader Speed Launcher]2007-05-11
07:06 40048 ----a-w- c:\program files\Adobe\Reader
8.0\Reader\reader_sl.exe.[HKEY_LOCAL_MACHINE\software\microsoft\shared
tools\msconfig\startupreg\Facebook Update]2013-03-15 16:52 138096
----atw-
c:\users\win7\AppData\Local\Facebook\Update\FacebookUpdate.exe.[HKEY_LOCAL_MACHINE\software\microsoft\shared
tools\msconfig\startupreg\Google Update]2012-05-19 01:25 116648
----atw-
c:\users\win7\AppData\Local\Google\Update\GoogleUpdate.exe.[HKEY_LOCAL_MACHINE\software\microsoft\shared
tools\msconfig\startupreg\SunJavaUpdateSched]2012-07-03 14:04
252848 ----a-w- c:\program files\Common Files\Java\Java
Update\jusched.exe.R1
ehdrv;ehdrv;c:\windows\system32\DRIVERS\ehdrv.sys [2009-09-29
108792]R2 AERTFilters;Andrea RT Filters Service;c:\program
files\Realtek\Audio\HDA\AERTSrv.exe [2009-03-31 81920]R2 AMD
External Events Utility;AMD External Events
Utility;c:\windows\system32\atiesrxx.exe [2011-10-12 176128]R2
BBSvc;BingBar Service;c:\program
files\Microsoft\BingBar\7.3.124.0\BBSvc.exe [2013-12-17 193696]R2
ekrn;ESET Service;c:\program files\ESET\ESET NOD32
Antivirus\ekrn.exe [2009-09-29 735960]R2
epfwwfpr;epfwwfpr;c:\windows\system32\DRIVERS\epfwwfpr.sys
[2009-09-29 95896]R2
FreemakeVideoCapture;FreemakeVideoCapture;c:\program
files\Freemake\CaptureLib\CaptureLibService.exe [2013-04-01 9216]R2
NAUpdate;Nero Update;c:\program files\Nero\Update\NASvc.exe
[2011-09-23 641832]R2 npf;NetGroup Packet Filter
Driver;c:\windows\system32\drivers\npf.sys [2011-02-11 35088]R2
TGCM_ImportWiFiSvc;TGCM_ImportWiFiSvc;c:\program
files\Movistar\Escritorio Movistar Latam\ImpWiFiSvc.exe [2010-09-29
200624]R3 BBUpdate;BBUpdate;c:\program
files\Microsoft\BingBar\7.3.124.0\SeaPort.exe [2013-12-17 247968]R3
clwvd;CyberLink WebCam Virtual
Driver;c:\windows\system32\DRIVERS\clwvd.sys [x]R3
ew_hwusbdev;Huawei MobileBroadband USB PNP
Device;c:\windows\system32\DRIVERS\ew_hwusbdev.sys [2010-07-27
102784]R3
huawei_cdcacm;huawei_cdcacm;c:\windows\system32\DRIVERS\ew_jucdcacm.sys
[2010-11-11 85632]R3 RSPCIESTOR;Realtek PCIE CardReader
Driver;c:\windows\system32\DRIVERS\RtsPStor.sys [2011-02-15
251496]R3 SCREAMINGBDRIVER;Screaming Bee
Audio;c:\windows\system32\drivers\ScreamingBAudio.sys [2010-07-01
34896]R3 WatAdminSvc;Servicio de tecnologas de activacin de
Windows;c:\windows\system32\Wat\WatAdminSvc.exe [2012-11-30
1343400]S0
amd_sata;amd_sata;c:\windows\system32\DRIVERS\amd_sata.sys
[2011-03-04 65664]S0
amd_xata;amd_xata;c:\windows\system32\DRIVERS\amd_xata.sys
[2011-03-04 32896]S3
huawei_enumerator;huawei_enumerator;c:\windows\system32\DRIVERS\ew_jubusenum.sys
[2010-11-11 72832]S3 RTL8192Ce;Realtek Wireless LAN 802.11n PCI-E
NIC Driver;c:\windows\system32\DRIVERS\rtl8192Ce.sys [2011-01-05
1004136]..Contents of the 'Scheduled Tasks' folder.2014-01-01
c:\windows\Tasks\Adobe Flash Player Updater.job-
c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
[2013-02-19 02:56].2014-01-01
c:\windows\Tasks\GoogleUpdateTaskMachineCore.job- c:\program
files\Google\Update\GoogleUpdate.exe [2012-05-20 04:52].2014-01-01
c:\windows\Tasks\GoogleUpdateTaskMachineUA.job- c:\program
files\Google\Update\GoogleUpdate.exe [2012-05-20 04:52]..-------
Supplementary Scan -------.uStart Page =
hxxp://websearch.searchguru.info/?pid=298&r=2013/12/09&hid=5364258727625359106&lg=EN&cc=PE&unqvl=43mStart
Page =
hxxp://websearch.searchguru.info/?pid=298&r=2013/12/09&hid=5364258727625359106&lg=EN&cc=PE&unqvl=43uInternet
Settings,ProxyOverride = localIE: &Enviar a OneNote -
c:\progra~1\MICROS~2\Office14\ONBttnIE.dll/105IE: E&xportar a
Microsoft Excel - c:\progra~1\MICROS~2\Office14\EXCEL.EXE/3000TCP:
DhcpNameServer = 200.48.225.130 200.48.225.146FF - ProfilePath -
c:\users\win7\AppData\Roaming\Mozilla\Firefox\Profiles\y3cr6v30.default-1388601731531\.-
- - - ORPHANS REMOVED - - - -.MSConfigStartUp-FLV Player -
c:\users\win7\AppData\Local\WebPlayer\FLV
Player\WebPlayer.exeMSConfigStartUp-msnmsgr - c:\program
files\Windows Live\Messenger\msnmsgr.exe...---------------------
LOCKED REGISTRY KEYS
---------------------.[HKEY_USERS\S-1-5-21-3537194184-1248040006-1216214278-1000\Software\Microsoft\Internet
Explorer\Approved Extensions]@DACL=(02
0000)"{D4027C7F-154A-4066-A1AD-4243D8127440}"=hex:51,66,7a,6c,4c,1d,3b,1b,6f,61,15,
ce,7a,47,00,09,bc,ae,04,03,d9,53,35,54"{2318C2B1-4965-11D4-9B18-009027A5CD4F}"=hex:51,66,7a,6c,4c,1d,3b,1b,a1,df,0f,
39,55,1b,b2,58,86,1b,46,d0,26,e4,8c,5b"{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}"=hex:51,66,7a,6c,4c,1d,3b,1b,8f,83,93,
1c,e7,9a,3f,04,a5,7e,3e,0b,7c,2a,a1,a7"{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}"=hex:51,66,7a,6c,4c,1d,3b,1b,ab,8a,03,
6c,c0,84,4a,0f,ab,e8,92,9a,f0,98,6c,57"{9030D464-4C02-4ABF-8ECC-5164760863C6}"=hex:51,66,7a,6c,4c,1d,3b,1b,74,c9,27,
8a,32,1e,d9,03,93,cf,17,24,77,49,22,d2"{AA58ED58-01DD-4D91-8333-CF10577473F7}"=hex:51,66,7a,6c,4c,1d,3b,1b,48,f0,4f,
b0,ed,53,f7,04,9e,30,89,50,56,35,32,e3"{B4F3A835-0E21-4959-BA22-42B3008E02FF}"=hex:51,66,7a,6c,4c,1d,3b,1b,25,b5,e4,
ae,11,5c,3f,00,a7,21,04,f3,01,cf,43,eb"{DBC80044-A445-435B-BC74-9C25C1C588A9}"=hex:51,66,7a,6c,4c,1d,3b,1b,54,1d,df,
c1,75,f6,3d,0a,a1,77,da,65,c0,84,c9,bd"{4D2D3B0F-69BE-477A-90F5-FDDB05357975}"=hex:51,66,7a,6c,4c,1d,3b,1b,1f,26,3a,
57,8e,3b,1c,0e,8d,f6,bb,9b,04,74,38,61"{98889811-442D-49DD-99D7-DC866BE87DBC}"=hex:51,66,7a,6c,4c,1d,3b,1b,01,85,9f,
82,1d,16,bb,00,84,d4,9a,c6,6a,a9,3c,a8.[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]@Denied:
(A 2)
(Everyone)@="FlashBroker""LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil32_11_9_900_170_ActiveX.exe,-101".[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]"Enabled"=dword:00000001.[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil32_11_9_900_170_ActiveX.exe".[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}".[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]@Denied:
(A 2)
(Everyone)@="IFlashBroker5".[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]@="{00020424-0000-0000-C000-000000000046}".[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}""Version"="1.0".[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]@Denied:
(A) (Users)@Denied: (A) (Everyone)@Allowed: (B 1 2 3 4 5)
(S-1-5-20)"BlindDial"=dword:00000000.[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]@Denied:
(A) (Users)@Denied: (A) (Everyone)@Allowed: (B 1 2 3 4 5)
(S-1-5-20)"BlindDial"=dword:00000000.[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]@Denied:
(A) (Users)@Denied: (A) (Everyone)@Allowed: (B 1 2 3 4 5)
(S-1-5-20)"BlindDial"=dword:00000000.[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]@Denied:
(A) (Users)@Denied: (A) (Everyone)@Allowed: (B 1 2 3 4 5)
(S-1-5-20)"BlindDial"=dword:00000000.[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0004\AllUserSettings]@Denied:
(A) (Users)@Denied: (A) (Everyone)@Allowed: (B 1 2 3 4 5)
(S-1-5-20)"BlindDial"=dword:00000000.[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0005\AllUserSettings]@Denied:
(A) (Users)@Denied: (A) (Everyone)@Allowed: (B 1 2 3 4 5)
(S-1-5-20)"BlindDial"=dword:00000000.[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0006\AllUserSettings]@Denied:
(A) (Users)@Denied: (A) (Everyone)@Allowed: (B 1 2 3 4 5)
(S-1-5-20)"BlindDial"=dword:00000000.[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]@Denied:
(Full) (Everyone).Completion time: 2014-01-01
14:15:06ComboFix-quarantined-files.txt 2014-01-01 19:15.Pre-Run:
88,118,595,584 bytes libresPost-Run: 87,887,126,528 bytes libres.-
- End Of File - -
DC88136D30CA2A2AC3AC0A93CD531581A36C5E4F47E84449FF07ED3517B43A31
