هذا هو تقرير combo fix
ComboFix 13-08-22.01 - Ahmad 08/22/2013 23:23:28.1.2 - x86 MINIMAL
Microsoft Windows 7 Ultimate 6.1.7601.1.1256.966.1025.18.2815.2255 [GMT 3:00]
Running from: c:\users\Ahmad\Desktop\ComboFix.exe
AV: ESET Smart Security 6.0 *Enabled/Updated* {77DEAFED-8149-104B-25A1-21771CA47CD1}
FW: ESET Personal firewall *Enabled* {4FE52EC8-CB26-1113-0EFE-8842E2773BAA}
SP: ESET Smart Security 6.0 *Enabled/Updated* {CCBF4E09-A773-1FC5-1F11-1A056723366C}
SP: Windows Defender *Enabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* Created a new restore point
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\system32\frapsvid.dll
.
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Legacy_NEWDRIVER
-------\Legacy_NPF
-------\Service_NEWDRIVER
-------\Service_NPF
.
.
((((((((((((((((((((((((( Files Created from 2013-07-22 to 2013-08-22 )))))))))))))))))))))))))))))))
.
.
2013-08-22 20:34 . 2013-08-22 20:36--------d-----w-c:\users\Ahmad\AppData\Local\temp
2013-08-22 19:40 . 2013-08-22 19:40388096----a-r-c:\users\Ahmad\AppData\Roaming\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2013-08-22 19:28 . 2013-08-22 19:28--------d-----w-c:\programdata\regid.1991-06.com.microsoft
2013-08-22 19:28 . 2013-08-22 19:28--------d-----w-c:\program files\Microsoft Analysis Services
2013-08-22 19:28 . 2013-08-22 19:28--------d-----w-c:\windows\PCHEALTH
2013-08-22 19:28 . 2012-10-01 17:311619568----a-w-c:\program files\Common Files\Microsoft Shared\OFFICE15\RICHED20.DLL
2013-08-22 19:28 . 2012-10-01 17:311135240----a-w-c:\program files\Common Files\Microsoft Shared\OFFICE15\MSPTLS.DLL
2013-08-22 19:28 . 2012-10-01 17:31829064----a-w-c:\program files\Common Files\Microsoft Shared\OFFICE15\Office Setup Controller\Setup.exe
2013-08-22 19:28 . 2012-10-01 17:30179800----a-w-c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPC.DLL
2013-08-21 16:53 . 2013-08-22 20:14--------d-----w-c:\users\Ahmad\AppData\Roaming\IDM
2013-08-21 16:53 . 2013-08-21 16:53--------d-----w-c:\windows\system32\dllcache
2013-08-21 16:39 . 2013-08-21 16:41--------d-----w-C:\AdwCleaner
2013-08-21 10:07 . 2013-08-21 10:07--------d-----w-c:\users\Ahmad\AppData\Roaming\Boost Windows
2013-08-21 10:06 . 2013-08-21 10:11--------d-----w-c:\program files\Boost Windows
2013-08-21 09:32 . 2013-08-21 09:41--------d-----w-c:\users\Ahmad\AppData\Roaming\BSplayer
2013-08-21 09:32 . 2013-08-21 09:32--------d-----w-c:\users\Ahmad\AppData\Roaming\BSplayer Pro
2013-08-21 09:08 . 2013-08-21 09:08--------d-----w-c:\programdata\CyberLink
2013-08-21 08:58 . 2013-08-21 09:51--------d-----w-c:\program files\DCoder Image Source
2013-08-21 08:58 . 2013-08-21 09:54--------d-----w-c:\program files\FFMPEG Core Files
2013-08-21 08:58 . 2013-08-21 09:51--------d-----w-c:\program files\CD Audio Reader Filter
2013-08-21 08:58 . 2013-08-21 09:59--------d-----w-c:\program files\OpenSource AVI Splitter
2013-08-21 08:58 . 2013-08-21 09:55--------d-----w-c:\program files\Gabest MPEG Splitter
2013-08-21 08:58 . 2013-08-21 09:59--------d-----w-c:\program files\OpenSource DTSAC3DD+ Source Filter
2013-08-21 08:58 . 2013-08-21 09:54--------d-----w-c:\program files\DScaler5
2013-08-21 08:58 . 2013-08-21 09:49--------d-----w-c:\program files\AC3Filter
2013-08-21 08:58 . 2013-08-21 09:57--------d-----w-c:\program files\OpenSource Flash Video Splitter
2013-08-21 08:58 . 2013-08-21 10:01--------d-----w-c:\program files\DirectVobSub
2013-08-21 08:57 . 2013-08-21 09:56--------d-----w-c:\program files\MadVR
2013-08-21 08:57 . 2013-08-21 09:57--------d-----w-c:\program files\LAV Filters
2013-08-21 08:57 . 2013-08-21 09:51--------d-----w-c:\program files\Bass Audio Decoder
2013-08-20 20:27 . 2013-08-20 20:301660----a-w-c:\windows\system32\ASOROSet.bin
2013-08-20 20:11 . 2013-08-20 20:11--------d-----w-c:\windows\Repair
2013-08-20 20:10 . 2013-08-21 11:05--------d-----w-c:\program files\Advanced System Optimizer 3
2013-08-20 17:41 . 2013-08-20 17:41--------d-----w-c:\users\Ahmad\AppData\Roaming\TuneUp Software
2013-08-20 17:41 . 2013-08-20 18:58--------d-----w-c:\program files\TuneUp Utilities 2013
2013-08-20 17:41 . 2013-08-20 18:58--------d-----w-c:\programdata\TuneUp Software
2013-08-20 17:41 . 2013-08-20 17:57--------d-sh--w-c:\programdata\{C4ABDBC8-1C81-42C9-BFFC-4A68511E9E4F}
2013-08-20 17:41 . 2013-08-20 17:41--------d--h--w-c:\programdata\Common Files
2013-08-19 17:01 . 2013-08-19 17:01--------d-----w-c:\users\Ahmad\AppData\Roaming\Stardock
2013-08-19 17:00 . 2013-08-19 17:00--------d-----w-c:\users\Ahmad\AppData\Local\Stardock
2013-08-19 14:40 . 2013-08-19 17:08--------d-----w-c:\program files\RocketDock
2013-08-18 20:47 . 2013-08-21 11:16--------d-----w-c:\users\Ahmad\AppData\Roaming\Wise Care 365
2013-08-18 20:47 . 2013-08-18 20:47--------d-----w-c:\program files\Wise
2013-08-17 12:41 . 2013-08-17 12:41--------d-----w-c:\programdata\Auslogics
2013-08-17 12:41 . 2013-08-17 12:41--------d-----w-c:\program files\Auslogics
2013-08-17 10:11 . 2013-08-17 10:112048----a-w-c:\windows\system32\tzres.dll
2013-08-17 10:11 . 2013-08-17 10:113968960----a-w-c:\windows\system32\ntkrnlpa.exe
2013-08-17 10:11 . 2013-08-17 10:111289096----a-w-c:\windows\system32\ntdll.dll
2013-08-17 10:11 . 2013-08-17 10:113913664----a-w-c:\windows\system32\ntoskrnl.exe
2013-08-17 10:11 . 2013-08-17 10:11652800----a-w-c:\windows\system32\rpcrt4.dll
2013-08-17 10:11 . 2013-08-17 10:111293760----a-w-c:\windows\system32\drivers\tcpip.sys
2013-08-17 10:11 . 2013-08-17 10:1131232----a-w-c:\windows\system32\drivers\tssecsrv.sys
2013-08-17 10:10 . 2013-08-17 10:10175104----a-w-c:\windows\system32\wintrust.dll
2013-08-17 10:10 . 2013-08-17 10:10140288----a-w-c:\windows\system32\cryptsvc.dll
2013-08-17 10:10 . 2013-08-17 10:101166848----a-w-c:\windows\system32\crypt32.dll
2013-08-17 10:10 . 2013-08-17 10:10103936----a-w-c:\windows\system32\cryptnet.dll
2013-08-13 11:49 . 2013-08-13 11:49--------d-----w-c:\program files\NiceCopier
2013-08-13 11:37 . 2013-08-13 18:50--------d-----w-c:\users\Ahmad\AppData\Roaming\FastCopy
2013-08-13 10:34 . 2013-08-13 10:34--------d-----w-c:\users\Ahmad\AppData\Local\Copy Handler
2013-08-12 22:28 . 2013-08-12 22:28--------d-----w-c:\users\Ahmad\ultracopier
2013-08-12 21:39 . 2013-08-12 21:39--------d-----w-c:\program files\WinMend
2013-08-11 11:05 . 2013-08-11 11:05--------d-----w-c:\program files\Easersoft
2013-08-10 07:37 . 2013-08-17 09:55--------d-----w-c:\users\Ahmad\ClipConverter
2013-08-10 07:36 . 2013-08-10 07:37--------d-----w-c:\users\Ahmad\AppData\Roaming\Lunaweb
2013-08-09 20:46 . 2013-08-09 23:00--------d-----w-c:\program files\The KMPlayer
2013-08-09 20:20 . 2013-08-09 20:20--------d-----w-c:\program files\AceLogix
2013-08-09 04:50 . 2013-08-09 04:50--------d-----w-c:\program files\PANDORA.TV
2013-08-09 04:09 . 2013-08-09 04:09--------d-----w-c:\program files\Daum
2013-08-08 06:34 . 2013-08-08 06:55--------d-----w-c:\program files\PDFZilla
2013-08-08 06:25 . 2013-08-08 06:25--------d-----w-c:\users\Ahmad\AppData\Roaming\Softland
2013-08-08 06:24 . 2011-02-15 13:2826960----a-w-c:\windows\system32\novamnk7.dll
2013-08-08 06:24 . 2011-02-15 13:2721328----a-w-c:\windows\system32\novamik7.dll
2013-08-08 06:24 . 2013-08-08 06:25--------d-----w-C:\PDFCoolVPrinterDrv
2013-08-08 06:24 . 2013-08-08 06:56--------d-----w-c:\program files\IconCool Software
2013-08-08 06:19 . 2013-08-21 11:23--------d-----w-c:\users\Ahmad\AppData\Local\CrashDumps
2013-08-08 06:18 . 2013-08-08 06:18--------d-----w-c:\users\Ahmad\AppData\Local\Spoon
2013-08-08 06:17 . 2011-12-09 05:56587768----a-w-c:\windows\system32\Codejock.SkinFramework.Unicode.v15.2.1.ocx
2013-08-08 06:17 . 2004-05-04 15:531645320----a-w-c:\windows\system32\gdiplus.dll
2013-08-08 06:17 . 2013-08-08 06:56--------d-----w-c:\program files\PDFArea
2013-08-08 06:17 . 2011-12-09 05:552775032----a-w-c:\windows\system32\Codejock.CommandBars.Unicode.v15.2.1.ocx
2013-08-07 17:09 . 2013-08-07 17:13--------d-----w-C:\Fraps
2013-08-07 00:55 . 2013-08-07 00:55--------d-----w-c:\users\Ahmad\AppData\Local\assembly
2013-08-07 00:54 . 2013-08-07 00:54--------d-----w-c:\programdata\regid.1995-08.com.techsmith
2013-08-07 00:54 . 2013-08-07 00:54--------d-----w-c:\programdata\TechSmith
2013-08-07 00:54 . 2013-08-07 00:54--------d-----w-c:\users\Ahmad\AppData\Local\TechSmith
2013-08-07 00:54 . 2013-08-07 00:54--------d-----w-c:\program files\TechSmith
2013-08-06 23:02 . 2013-08-06 23:02--------d-----w-c:\program files\Synei
2013-08-06 23:02 . 2013-08-06 23:02--------d-----w-c:\users\Ahmad\AppData\Local\Programs
2013-08-05 13:00 . 2013-08-05 13:00--------d-----w-c:\programdata\regid.1986-12.com.adobe
2013-08-01 15:19 . 2013-08-20 08:32--------d-----w-c:\users\Ahmad\AppData\Roaming\.minecraft
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-07-13 04:30 . 2013-07-13 04:3023456----a-w-c:\windows\system32\drivers\DrvAgent32.sys
2013-07-10 16:28 . 2013-07-10 16:282347520----a-w-c:\windows\system32\win32k.sys
2013-07-10 16:28 . 2013-07-10 16:28509440----a-w-c:\windows\system32\qedit.dll
2013-07-10 16:25 . 2013-07-10 16:251620480----a-w-c:\windows\system32\WMVDECOD.DLL
2013-07-10 16:25 . 2013-07-10 16:251077760----a-w-c:\windows\system32\DWrite.dll
2013-06-17 03:33 . 2013-06-17 03:33492544----a-w-c:\windows\system32\win32spl.dll
2013-06-17 03:33 . 2013-06-17 03:3324576----a-w-c:\windows\system32\cryptdlg.dll
2013-06-17 03:32 . 2013-06-17 03:32903168----a-w-c:\windows\system32\certutil.exe
2013-06-17 03:32 . 2013-06-17 03:3243008----a-w-c:\windows\system32\certenc.dll
2013-06-10 12:28 . 2013-05-17 13:0929184----a-w-c:\windows\system32\WinFLAdrv.sys
2013-06-10 12:27 . 2013-05-17 13:0892360----a-w-c:\windows\system32\WinFLService.exe
2013-06-10 12:27 . 2013-05-17 13:0814024----a-w-c:\windows\system32\WinFLMsgService.exe
2013-06-10 12:27 . 2013-05-17 13:0840960----a-w-c:\windows\system32\nwsftUninstall.exe
2013-06-10 12:27 . 2013-05-17 13:08321736----a-w-c:\windows\system32\WinFLTray.exe
2013-06-10 12:27 . 2013-05-17 13:08321736----a-w-c:\windows\system32\WinFLTrayShred.exe
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrivePro1 (ErrorConflict)]
@="{8BA85C75-763B-4103-94EB-9470F12FE0F7}"
[HKEY_CLASSES_ROOT\CLSID\{8BA85C75-763B-4103-94EB-9470F12FE0F7}]
2012-10-01 17:331720976----a-w-c:\progra~1\MICROS~1\Office15\GROOVEEX.DLL
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrivePro2 (SyncInProgress)]
@="{CD55129A-B1A1-438E-A425-CEBC7DC684EE}"
[HKEY_CLASSES_ROOT\CLSID\{CD55129A-B1A1-438E-A425-CEBC7DC684EE}]
2012-10-01 17:331720976----a-w-c:\progra~1\MICROS~1\Office15\GROOVEEX.DLL
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrivePro3 (InSync)]
@="{E768CD3B-BDDC-436D-9C13-E1B39CA257B1}"
[HKEY_CLASSES_ROOT\CLSID\{E768CD3B-BDDC-436D-9C13-E1B39CA257B1}]
2012-10-01 17:331720976----a-w-c:\progra~1\MICROS~1\Office15\GROOVEEX.DLL
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\IDM Shell Extension]
@="{CDC95B92-E27C-4745-A8C5-64A52A78855D}"
[HKEY_CLASSES_ROOT\CLSID\{CDC95B92-E27C-4745-A8C5-64A52A78855D}]
2011-05-30 16:5021864----a-w-c:\program files\Internet Download Manager\IDMShellExt.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Advanced SystemCare 6"="c:\program files\IObit\Advanced SystemCare 6\ASCTray.exe" [2012-09-24 490880]
"IDMan"="c:\program files\Internet Download Manager\IDMan.exe" [2011-07-07 3392920]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2013-06-21 19875432]
"WinFLTray"="c:\windows\system32\WinFLTray.exe" [2013-06-10 321736]
"FLBackup"="c:\program files\NewSoftware's\Folder Lock\FLComServCtrl.exe" [2013-06-10 275656]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-06-06 13789728]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe" [2009-05-23 7514656]
"egui"="c:\program files\ESET\ESET Smart Security\egui.exe" [2013-03-21 5078504]
.
c:\users\Ahmad\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Wise Care 365.lnk - c:\program files\Wise\Wise Care 365\WiseCare365.exe [2013-8-18 7248008]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoResolveTrack"= 1 (0x1)
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinFLAdrv.sys]
@="Driver"
.
[HKLM\~\startupfolder\C:^Users^Ahmad^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Ela-Salaty.lnk]
backup=c:\windows\pss\Ela-Salaty.lnk.Startup
backupExtension=.Startup
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AshSnap
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdobeAAMUpdater-1.0]
2010-03-06 00:44500208----a-w-c:\program files\Common Files\Adobe\OOBE\PDApp\UWA\updaterstartuputility.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Clownfish]
2013-07-02 07:571276152----a-w-c:\program files\Clownfish\Clownfish.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2011-04-08 09:59254696----a-w-c:\program files\Common Files\Java\Java Update\jusched.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
.
R0 epfwwfp;epfwwfp;c:\windows\system32\DRIVERS\epfwwfp.sys [2013-02-20 47568]
R1 eamonm;eamonm;c:\windows\system32\DRIVERS\eamonm.sys [2013-02-20 171680]
R1 ehdrv;ehdrv;c:\windows\system32\DRIVERS\ehdrv.sys [2013-01-10 122240]
R1 EpfwLWF;Epfw NDIS LightWeight Filter;c:\windows\system32\DRIVERS\EpfwLWF.sys [2013-01-10 46056]
R2 AdvancedSystemCareService6;Advanced SystemCare Service 6;c:\program files\IObit\Advanced SystemCare 6\ASCService.exe [2012-10-31 464256]
R2 ekrn;ESET Service;c:\program files\ESET\ESET Smart Security\ekrn.exe [2013-03-21 1341664]
R2 FLService;FLService;c:\windows\system32\WinFLService.exe [2013-06-10 92360]
R2 IDMWFP;IDMWFP;c:\windows\system32\DRIVERS\idmwfp.sys [2011-07-06 89376]
R2 Skype C2C Service;Skype C2C Service;c:\programdata\Skype\Toolbars\Skype C2C Service\c2c_service.exe [2013-08-14 3291008]
R2 SkypeUpdate;Skype Updater;c:\program files\Skype\Updater\Updater.exe [2013-06-21 162408]
R2 WinVDEDrv;WinVDEDrv;c:\windows\system32\WinVDEdrv.sys [2013-05-17 228112]
R2 WiseBootAssistant;Wise Boot Assistant;c:\program files\Wise\Wise Care 365\BootTime.exe [2013-04-25 580232]
R3 DrvAgent32;DrvAgent32;c:\windows\system32\Drivers\DrvAgent32.sys [2013-07-13 23456]
R3 ftpsvc;Microsoft FTP Service;c:\windows\system32\svchost.exe [2009-07-14 20992]
R3 netr28;Ralink 802.11n Extensible Wireless Driver;c:\windows\system32\DRIVERS\netr28.sys [2009-09-11 626688]
R3 NTIOLib_1_0_4;NTIOLib_1_0_4; [x]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [2012-12-04 14848]
R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUStor.sys [2009-06-04 166912]
R3 RtsUIR;Realtek IR Driver;c:\windows\system32\DRIVERS\Rts516xIR.sys [x]
R3 Synth3dVsc;Synth3dVsc;c:\windows\system32\drivers\synth3dvsc.sys [x]
R3 taphss6;Anchorfree HSS VPN Adapter;c:\windows\system32\DRIVERS\taphss6.sys [2013-01-05 37208]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2012-12-04 49664]
R3 tsusbhub;tsusbhub;c:\windows\system32\drivers\tsusbhub.sys [x]
R3 VGPU;VGPU;c:\windows\system32\drivers\rdvgkmd.sys [x]
R3 WatAdminSvc;خدمة Windows Activation Technologies;c:\windows\system32\Wat\WatAdminSvc.exe [2012-11-29 1343400]
R3 XDva400;XDva400; [x]
R3 XDva401;XDva401; [x]
S1 WinFLAdrv;WinFLAdrv;c:\windows\system32\WinFLAdrv.sys [2013-06-10 29184]
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
ftpsvcREG_MULTI_SZ ftpsvc
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2013-08-21 17:201177552----a-w-c:\program files\Google\Chrome\Application\29.0.1547.57\Installer\chrmstp.exe
.
Contents of the 'Scheduled Tasks' folder
.
2013-08-22 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2013-08-11 02:15]
.
2013-08-22 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2013-08-11 02:15]
.
2013-08-18 c:\windows\Tasks\Wise Care 365.job
- c:\program files\Wise\Wise Care 365\WiseTray.exe [2013-08-18 11:57]
.
2013-08-22 c:\windows\Tasks\Wise Memory Optimizer Task.job
- c:\program files\Wise\Wise Care 365\WiseMemoryOptimzer.exe [2013-08-18 10:57]
.
2013-08-19 c:\windows\Tasks\Wise Turbo Checker.job
- c:\program files\Wise\Wise Care 365\WiseTurbo.exe [2013-08-18 07:06]
.
.
------- Supplementary Scan -------
.
IE: إر&سال إلى OneNote
IE: ت&صدير إلى Microsoft Excel
IE: تحميل الكل بواسطة Internet Download Manager - c:\program files\Internet Download Manager\IEGetAll.htm
IE: تحميل بواسطة Internet Download Manager - c:\program files\Internet Download Manager\IEExt.htm
LSP: c:\program files\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp.dll
TCP: DhcpNameServer = 192.168.100.1
.
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_USERS\S-1-5-21-2584424555-2287933366-1271012474-1000_Classes\CLSID\{7B8E9164-324D-4A2E-A46D-0165FB2000EC}]
@Denied: (Full) (Everyone)
"scansk"=hex(0):9a,0e,ce,b5,3f,0c,e8,c0,c3,8f,f4,28,58,a2,06,89,a1,6d,8b,2e,c2,
65,6f,c1,3b,2d,78,aa,82,2a,32,c7,b5,25,7f,83,8e,ac,d0,f9,00,00,00,00,00,00,\
.
[HKEY_USERS\S-1-5-21-2584424555-2287933366-1271012474-1000_Classes\CLSID\{df53afee-50c7-4054-9469-b05d3fb160f0}]
@Denied: (Full) (Everyone)
@Allowed: (Read) (RestrictedCode)
"Model"=dword:00000026
"Therad"=dword:0000000f
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\+ %13'D *%DI *O*n*e*N*o*t*e* *2*0*1*3*, \DsDriver]
"printBinNames"=multi:"\00\00"
"printCollate"=hex:00
"printColor"=hex:01
"printDuplexSupported"=hex:00
"printStaplingSupported"=hex:00
"printMaxXExtent"=dword:00000b9a
"printMaxYExtent"=dword:000010de
"printMinXExtent"=dword:000003d8
"printMinYExtent"=dword:00000771
"printMediaSupported"=multi:"Letter\00Tabloid\00Legal\00Executive\00A3\00A4\00B4 (JIS)\00B5 (JIS)\00Envelope #10\00Envelope Monarch\00\00"
"printMediaReady"=multi:"A4\00\00"
"printNumberUp"=dword:00000000
"printMemory"=dword:00008000
"printOrientationsSupported"=multi:"PORTRAIT\00LANDSCAPE\00\00"
"printMaxResolutionSupported"=dword:000004b0
"printLanguage"=multi:"\00\00"
"printRateUnit"=""
"driverVersion"=dword:00000401
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\+ %13'D *%DI *O*n*e*N*o*t*e* *2*0*1*3*, \DsSpooler]
"driverName"="Send to Microsoft OneNote 15 Driver"
"portName"=multi:"nul:\00\00"
"printStartTime"=dword:00000000
"printEndTime"=dword:00000000
"printerName"="?إرسال إلى OneNote 2013?"
"printKeepPrintedJobs"=hex:00
"printSpooling"="PrintAfterSpooled"
"priority"=dword:00000001
"uNCName"="\\\\Ahmad-PC\\?إرسال إلى OneNote 2013?"
"serverName"="Ahmad-PC"
"shortServerName"="AHMAD-PC"
"versionNumber"=dword:00000004
"flags"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\+ %13'D *%DI *O*n*e*N*o*t*e* *2*0*1*3*, \PrinterDriverData]
"InitDriverVersion"=dword:00000600
"Model"="Send To OneNote Driver"
"FreeMem"=hex:00,80,00,00
"PrinterDataSize"=dword:00000230
"PrinterData"=hex:00,06,30,02,81,08,00,00,00,f8,ba,01,00,00,00,00,00,00,00,00,
64,00,58,02,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,ac,13,d8,c0,01,\
"FeatureKeywordSize"=dword:00000012
"FeatureKeyword"=hex:4d,65,6d,6f,72,79,00,33,32,37,36,38,4b,42,00,0a,00,00
"Forms?"=dword:c0d813ac
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\conhost.exe
.
**************************************************************************
.
Completion time: 2013-08-22 23:41:07 - machine was rebooted
ComboFix-quarantined-files.txt 2013-08-22 20:41
.
Pre-Run: 33,502,236,672 bytes free
Post-Run: 33,607,913,472 bytes free
.
- - End Of File - - 7EF48981A6F694DA25568E0A3B45AD5A
A36C5E4F47E84449FF07ED3517B43A31
