Small hangs, conhost.exe and cmd.exe running when not used and Chrome running with 10-15 lines of arguments

guustalu · September 22, 2014

Hi!

I've spent the last two days looking for malware on my computer after i started noticing weird small hangs in the system, especially when using heavy programs. I also noticed when restarting Windows 7 (sp 1) that there is two "minimized" windows on the bottom left during startup that i havent noticed before. Like two small bars, approx 50x10pixels side by side just above the taskbar. I ran ComboFix and it quarantined one file C:\installer.exe and some registry values. After running combofix i noticed conhost.exe and cmd.exe in process manager running when i had no console window open and no programs running.

Using process explorer i didnt realy find anything suspicious, except for chrome having a million launch options. After some googling it is obvious that google doesnt have easily available documentation on many of the arguments and that got me suspicious. The following are the launch options for the chrome process:

"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=renderer --lang=nb --force-fieldtrials="AutoReloadExperiment/Enabled/AutoReloadVisibleOnlyExperiment/Enabled/BrowserBlacklist/Enabled/ChromeSuggestions/Most Likely with Kodachrome/EmbeddedSearch/Group2 pct:10b stable:pp2 prefetch_results:1 reuse_instant_search_base_page:1/ExtensionInstallVerification/Enforce/OmniboxBundledExperimentV1/Preperiod_A4_StableBookmarksIndexURLs/Prerender/PrerenderEnabled/PrerenderLocalPredictorSpec/LocalPredictor=Disabled/QUIC/Disabled/RapporRollout/Enabled/SafeBrowsingIncidentReportingService/Default/SettingsEnforcement/enforce_always_with_extensions_and_dse/ShowAppLauncherPromo/ShowPromoUntilDismissed/Test0PercentDefault/group_01/UMA-Dynamic-Binary-Uniformity-Trial/default/UMA-Dynamic-Uniformity-Trial/Group6/UMA-New-Install-Uniformity-Trial/Control/UMA-Population-Restrict/normal/UMA-Session-Randomized-Uniformity-Trial-5-Percent/group_02/UMA-Uniformity-Trial-1-Percent/group_03/UMA-Uniformity-Trial-10-Percent/group_09/UMA-Uniformity-Trial-100-Percent/group_01/UMA-Uniformity-Trial-20-Percent/group_01/UMA-Uniformity-Trial-5-Percent/group_07/UMA-Uniformity-Trial-50-Percent/group_01/VoiceTrigger/Install/" --renderer-print-preview --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --enable-threaded-compositing --enable-delegated-renderer --disable-gpu-compositing --channel="4548.5.153933756\275851290" /prefetch:673131151

Here are the two logs for my two ComboFix runs:

ComboFix 14-09-18.01 - user 21.09.2014 16:17:27.1.4 - x64

Microsoft Windows 7 Home Premium 6.1.7601.1.1252.47.1044.18.4008.2312 [GMT 2:00]

Kjører fra: c:\users\user\Downloads\ComboFix.exe

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

((((((((((((((((((((((((((((((((((((((( Andre slettinger )))))))))))))))))))))))))))))))))))))))))))))))))

.

C:\Install.exe

c:\users\user\AppData\Roaming\Microsoft\Windows\Recent\GitHub.appref-ms

.

Infisert kopi av c:\windows\SysWow64\ntdll.dll ble funnet og desinfisert

Gjenopprettet kopi fra - c:\combofix\HarddiskVolumeShadowCopy3_!Windows!SysWOW64!ntdll.dll

.

((((((((((((((((((((((((((( Filer Opprettet Fra 2014-08-21 til 2014-09-21 )))))))))))))))))))))))))))))))))

.

2014-09-21 14:29 . 2014-09-21 14:29 -------- d-----w- c:\users\UpdatusUser\AppData\Local\temp

2014-09-21 14:29 . 2014-09-21 14:29 -------- d-----w- c:\users\Default\AppData\Local\temp

2014-09-21 02:23 . 2014-03-09 21:48 171160 ----a-w- c:\windows\system32\infocardapi.dll

2014-09-21 02:23 . 2014-03-09 21:48 1389208 ----a-w- c:\windows\system32\icardagt.exe

2014-09-21 02:23 . 2014-03-09 21:47 99480 ----a-w- c:\windows\SysWow64\infocardapi.dll

2014-09-21 02:23 . 2014-03-09 21:47 619672 ----a-w- c:\windows\SysWow64\icardagt.exe

2014-09-21 02:23 . 2014-06-30 22:24 8856 ----a-w- c:\windows\system32\icardres.dll

2014-09-21 02:23 . 2014-06-30 22:14 8856 ----a-w- c:\windows\SysWow64\icardres.dll

2014-09-21 02:23 . 2014-06-06 06:16 35480 ----a-w- c:\windows\SysWow64\TsWpfWrp.exe

2014-09-21 02:23 . 2014-06-06 06:12 35480 ----a-w- c:\windows\system32\TsWpfWrp.exe

2014-09-21 02:20 . 2014-06-03 10:02 1719296 ----a-w- c:\program files\Windows Journal\NBDoc.DLL

2014-09-21 02:20 . 2014-06-03 10:02 1380864 ----a-w- c:\program files\Windows Journal\JNTFiltr.dll

2014-09-21 02:20 . 2014-06-03 10:02 1389568 ----a-w- c:\program files\Windows Journal\JNWDRV.dll

2014-09-21 02:20 . 2014-06-03 10:02 1354240 ----a-w- c:\program files\Common Files\Microsoft Shared\ink\journal.dll

2014-09-21 02:20 . 2014-06-03 09:29 936960 ----a-w- c:\program files (x86)\Common Files\Microsoft Shared\ink\journal.dll

2014-09-21 02:18 . 2014-07-16 03:23 2048 ----a-w- c:\windows\system32\tzres.dll

2014-09-21 02:18 . 2014-07-16 02:46 2048 ----a-w- c:\windows\SysWow64\tzres.dll

2014-09-21 02:18 . 2014-04-25 02:34 801280 ----a-w- c:\windows\system32\usp10.dll

2014-09-21 02:18 . 2014-06-06 10:10 624128 ----a-w- c:\windows\system32\qedit.dll

2014-09-21 02:18 . 2014-06-06 09:44 509440 ----a-w- c:\windows\SysWow64\qedit.dll

2014-09-21 02:18 . 2014-04-25 02:06 626688 ----a-w- c:\windows\SysWow64\usp10.dll

2014-09-21 02:18 . 2014-07-07 02:06 728064 ----a-w- c:\windows\system32\kerberos.dll

2014-09-21 02:18 . 2014-07-07 02:06 1460736 ----a-w- c:\windows\system32\lsasrv.dll

2014-09-21 02:18 . 2014-07-07 01:40 550912 ----a-w- c:\windows\SysWow64\kerberos.dll

2014-09-21 02:18 . 2014-07-07 01:40 22016 ----a-w- c:\windows\SysWow64\secur32.dll

2014-09-21 02:18 . 2014-07-07 01:39 96768 ----a-w- c:\windows\SysWow64\sspicli.dll

2014-09-21 02:13 . 2014-07-14 02:02 1216000 ----a-w- c:\windows\system32\rpcrt4.dll

2014-09-21 02:13 . 2014-07-14 01:40 664064 ----a-w- c:\windows\SysWow64\rpcrt4.dll

2014-09-21 02:13 . 2014-08-23 02:07 404480 ----a-w- c:\windows\system32\gdi32.dll

2014-09-21 02:13 . 2014-08-23 00:59 3163648 ----a-w- c:\windows\system32\win32k.sys

2014-09-21 02:13 . 2014-08-23 01:45 311808 ----a-w- c:\windows\SysWow64\gdi32.dll

2014-09-20 19:21 . 2014-09-20 19:21 -------- d-----w- c:\programdata\Riot Games

2014-09-20 19:19 . 2014-09-20 19:19 -------- d-----w- C:\Riot Games

2014-09-14 20:07 . 2014-09-14 20:14 -------- d-----w- c:\program files (x86)\Strife

2014-09-03 21:35 . 2014-09-21 12:38 -------- d-----r- c:\users\user\Dropbox

2014-09-03 21:31 . 2014-09-21 12:26 -------- d-----w- c:\users\user\AppData\Roaming\Dropbox

2014-08-30 18:09 . 2014-08-30 18:09 -------- d-----w- c:\users\user\AppData\Roaming\Awesomium

2014-08-30 18:08 . 2014-08-30 18:08 -------- d-----w- c:\programdata\Hi-Rez Studios

2014-08-30 18:07 . 2014-08-30 18:08 -------- d-----w- c:\program files (x86)\Hi-Rez Studios

.

(((((((((((((((((((((((((((((((((((((((( Find3M Rapport ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2014-09-21 12:23 . 2011-07-02 00:01 78848 ----a-w- c:\windows\KMSEmulator.exe

2014-08-29 11:01 . 2012-05-30 17:23 101694776 ----a-w- c:\windows\system32\MRT.exe

2014-07-25 00:35 . 2014-07-25 00:35 875688 ----a-w- c:\windows\SysWow64\msvcr120_clr0400.dll

2014-07-24 21:47 . 2014-07-24 21:47 869544 ----a-w- c:\windows\system32\msvcr120_clr0400.dll

.

(((((((((((((((((((((((((((((((( Oppstartspunkter I Registeret )))))))))))))))))))))))))))))))))))))))))))))

.

*Merk* tomme oppføringer & gyldige standardoppføringer vises ikke

REGEDIT4

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Steam"="c:\program files (x86)\Steam\steam.exe" [2014-08-28 1939136]

"Skype"="c:\program files (x86)\Skype\Phone\Skype.exe" [2014-07-24 21650016]

.

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\

Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2010-10-22 1133856]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"ConsentPromptBehaviorUser"= 3 (0x3)

"EnableUIADesktopToggle"= 0 (0x0)

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]

"LoadAppInit_DLLs"=1 (0x1)

"AppInit_DLLs"=c:\windows\SysWOW64\nvinit.dll

.

R3 clwvd;CyberLink WebCam Virtual Driver;c:\windows\system32\DRIVERS\clwvd.sys;c:\windows\SYSNATIVE\DRIVERS\clwvd.sys [x]

R3 LGVirHid;Logitech Gamepanel Virtual HID Device Driver;c:\windows\system32\drivers\LGVirHid.sys;c:\windows\SYSNATIVE\drivers\LGVirHid.sys [x]

R3 Netaapl;Apple Mobile Device Ethernet Service;c:\windows\system32\DRIVERS\netaapl64.sys;c:\windows\SYSNATIVE\DRIVERS\netaapl64.sys [x]

R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys;c:\windows\SYSNATIVE\drivers\rdpvideominiport.sys [x]

R3 Samsung UPD Service;Samsung UPD Service;c:\windows\System32\SUPDSvc.exe;c:\windows\SYSNATIVE\SUPDSvc.exe [x]

R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]

R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys;c:\windows\SYSNATIVE\Drivers\usbaapl64.sys [x]

R3 visctap0901;Viscosity Virtual Adapter V9.1;c:\windows\system32\DRIVERS\visctap0901.sys;c:\windows\SYSNATIVE\DRIVERS\visctap0901.sys [x]

R4 HiPatchService;Hi-Rez Studios Authenticate and Update Service;c:\program files (x86)\Hi-Rez Studios\HiPatchService.exe;c:\program files (x86)\Hi-Rez Studios\HiPatchService.exe [x]

R4 ICCS;Intel® Integrated Clock Controller Service - Intel® ICCS;c:\program files (x86)\Intel\Intel® Integrated Clock Controller Service\ICCProxy.exe;c:\program files (x86)\Intel\Intel® Integrated Clock Controller Service\ICCProxy.exe [x]

R4 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x]

R4 ViscosityService;Viscosity Service;c:\program files\Viscosity\ViscosityService.exe;c:\program files\Viscosity\ViscosityService.exe [x]

R4 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe;c:\windows\SYSNATIVE\Wat\WatAdminSvc.exe [x]

R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe;c:\program files\Windows Live\Mesh\wlcrasvc.exe [x]

S0 nvpciflt;nvpciflt;c:\windows\system32\DRIVERS\nvpciflt.sys;c:\windows\SYSNATIVE\DRIVERS\nvpciflt.sys [x]

S0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys;c:\windows\SYSNATIVE\Drivers\sptd.sys [x]

S1 SABI;SAMSUNG Kernel Driver For Windows 7;c:\windows\system32\Drivers\SABI.sys;c:\windows\SYSNATIVE\Drivers\SABI.sys [x]

S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]

S2 RzKLService;RzKLService;c:\program files (x86)\Razer\Razer Game Booster\RzKLService.exe;c:\program files (x86)\Razer\Razer Game Booster\RzKLService.exe [x]

S2 SSPORT;SSPORT;c:\windows\system32\Drivers\SSPORT.sys;c:\windows\SYSNATIVE\Drivers\SSPORT.sys [x]

S2 UNS;Intel® Management and Security Application User Notification Service;c:\program files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe;c:\program files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe [x]

S3 BTWAMPFL;BTWAMPFL;c:\windows\system32\DRIVERS\btwampfl.sys;c:\windows\SYSNATIVE\DRIVERS\btwampfl.sys [x]

S3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\DRIVERS\btwl2cap.sys;c:\windows\SYSNATIVE\DRIVERS\btwl2cap.sys [x]

S3 IntcDAud;Intel® Skjermlyd;c:\windows\system32\DRIVERS\IntcDAud.sys;c:\windows\SYSNATIVE\DRIVERS\IntcDAud.sys [x]

S3 LADF_CaptureOnly;LADF Capture Filter Driver;c:\windows\system32\DRIVERS\ladfGSCamd64.sys;c:\windows\SYSNATIVE\DRIVERS\ladfGSCamd64.sys [x]

S3 LADF_RenderOnly;LADF Render Filter Driver;c:\windows\system32\DRIVERS\ladfGSRamd64.sys;c:\windows\SYSNATIVE\DRIVERS\ladfGSRamd64.sys [x]

S3 LGBusEnum;Logitech GamePanel Virtual Bus Enumerator Driver;c:\windows\system32\drivers\LGBusEnum.sys;c:\windows\SYSNATIVE\drivers\LGBusEnum.sys [x]

S3 LGSHidFilt;Logitech Gaming KMDF HID Filter Driver;c:\windows\system32\DRIVERS\LGSHidFilt.Sys;c:\windows\SYSNATIVE\DRIVERS\LGSHidFilt.Sys [x]

S3 LGSUsbFilt;Logitech Gaming KMDF USB Filter Driver;c:\windows\system32\DRIVERS\LGSUsbFilt.Sys;c:\windows\SYSNATIVE\DRIVERS\LGSUsbFilt.Sys [x]

S3 nusb3hub;Renesas Electronics USB 3.0 Hub Driver;c:\windows\system32\DRIVERS\nusb3hub.sys;c:\windows\SYSNATIVE\DRIVERS\nusb3hub.sys [x]

S3 nusb3xhc;Renesas Electronics USB 3.0 Host Controller Driver;c:\windows\system32\DRIVERS\nusb3xhc.sys;c:\windows\SYSNATIVE\DRIVERS\nusb3xhc.sys [x]

S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x]

.

--- Andre tjenester/drivere lastet i minnet ---

.

*NewlyCreated* - WS2IFSL

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]

2014-09-12 17:33 1096520 ----a-w- c:\program files (x86)\Google\Chrome\Application\37.0.2062.120\Installer\chrmstp.exe

.

Innholdet i mappen 'Scheduled Tasks' (planlagte oppgaver)

.

2014-09-21 c:\windows\Tasks\AutoKMS.job

- c:\windows\AutoKMS.exe [2012-10-12 21:53]

.

2014-09-21 c:\windows\Tasks\AutoKMSDaily.job

- c:\windows\AutoKMS.exe [2012-10-12 21:53]

.

2014-09-21 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2013-06-09 22:04]

.

2014-09-21 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2013-06-09 22:04]

.

--------- X64 Entries -----------

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt1"]

@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]

2014-08-18 17:22 164760 ----a-w- c:\users\user\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt2"]

@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]

2014-08-18 17:22 164760 ----a-w- c:\users\user\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt3"]

@="{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}]

2014-08-18 17:22 164760 ----a-w- c:\users\user\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt4"]

@="{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}]

2014-08-18 17:22 164760 ----a-w- c:\users\user\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt5"]

@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]

2014-08-18 17:22 164760 ----a-w- c:\users\user\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt6"]

@="{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}]

2014-08-18 17:22 164760 ----a-w- c:\users\user\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt7"]

@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]

2014-08-18 17:22 164760 ----a-w- c:\users\user\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt8"]

@="{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}]

2014-08-18 17:22 164760 ----a-w- c:\users\user\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2010-11-17 11613288]

"Launch LCore"="c:\program files\Logitech Gaming Software\LCore.exe" [2013-08-01 8290584]

"IgfxTray"="c:\windows\system32\igfxtray.exe" [2013-11-15 172016]

"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2013-11-15 399856]

"Persistence"="c:\windows\system32\igfxpers.exe" [2013-11-15 442352]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]

"AppInit_DLLs"=c:\windows\System32\nvinitx.dll

.

------- Tilleggsskanning -------

.

uLocal Page = c:\windows\system32\blank.htm

uStart Page = hxxp://samsung.msn.com

mLocal Page = c:\windows\SysWOW64\blank.htm

uInternet Settings,ProxyOverride = *.local

IE: E&ksporter til Microsoft Excel - c:\progra~2\MICROS~1\Office14\EXCEL.EXE/3000

IE: Send bilde til &Bluetooth-enhet... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm

IE: Send side til &Bluetooth-enhet... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm

TCP: DhcpNameServer = 129.241.0.200 129.241.0.201

TCP: Interfaces\{7C056ADD-53CF-47FF-A382-3C74CD57E230}: NameServer = 95.211.10.3

TCP: Interfaces\{9BA38316-B75C-4BC4-816C-21E95C09F9B5}: NameServer = 95.211.10.3

TCP: Interfaces\{B45C5574-B98C-4A9A-A233-04487D1A485B}: NameServer = 95.211.10.3

TCP: Interfaces\{F7658796-41F0-4D77-B3B2-6AA07156490D}: NameServer = 95.211.10.3

FF - ProfilePath - c:\users\user\AppData\Roaming\Mozilla\Firefox\Profiles\w5pugpi3.default-1386753127278\

.

- - - - TOMME PEKERE FJERNET - - - -

.

Toolbar-Locked - (no file)

HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start

Toolbar-Locked - (no file)

.

--------------------- LÅSTE REGISTERNØKLER ---------------------

.

[HKEY_USERS\S-1-5-21-3048899886-2738334152-1200508958-1003\Software\SecuROM\License information*]

"datasecu"=hex:2e,df,f2,1f,74,6a,a9,7f,b3,14,c8,ef,bf,42,3f,6b,e0,d6,d0,a6,b3,

bc,7b,b0,2e,8d,f4,29,2b,c4,9e,c8,91,08,f2,87,75,ec,f4,9b,5f,13,f2,73,03,22,\

"rkeysecu"=hex:7b,5b,14,10,16,c3,6e,8c,43,9b,08,95,df,db,4c,fd

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]

@Denied: (A) (Everyone)

"Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3]

@Denied: (A) (Everyone)

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0]

"Key"="ActionsPane3"

"Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd"

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]

@Denied: (Full) (Everyone)

.

------------------------ Andre Kjørende Prosesser ------------------------

.

c:\program files (x86)\Samsung\Easy Display Manager\dmhkcore.exe

c:\program files (x86)\Samsung\Easy Display Manager\WifiManager.exe

c:\program files (x86)\Samsung\Samsung Recovery Solution 5\WCScheduler.exe

c:\program files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe

c:\program files (x86)\Samsung\Movie Color Enhancer\MovieColorEnhancer.exe

c:\program files (x86)\Samsung\Samsung Support Center\SSCKbdHk.exe

c:\program files (x86)\Samsung\Samsung Update Plus\SUPBackground.exe

c:\program files (x86)\SAMSUNG\EasySpeedUpManager\EasySpeedUpManager.exe

.

**************************************************************************

.

Tidspunkt ferdig: 2014-09-21 16:39:57 - maskinen ble startet på nytt

ComboFix-quarantined-files.txt 2014-09-21 14:39

.

Pre-Run: 307 444 678 656 byte ledig

Post-Run: 309 699 084 288 byte ledig

.

- - End Of File - - E251540713FAB02C6BAFEE48E15099EB

2014-09-21 14:39:58 . 2014-09-21 14:39:58 0 ----a-w- C:\Qoobox\Quarantine\MBR_HardDisk0.mbr

2014-09-21 14:38:35 . 2014-09-21 14:38:35 92 ----a-w- C:\Qoobox\Quarantine\Registry_backups\Toolbar-Locked.reg.dat

2014-09-21 14:38:32 . 2014-09-21 14:38:32 377 ----a-w- C:\Qoobox\Quarantine\Registry_backups\HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47}.reg.dat

2014-09-21 14:38:19 . 2014-09-22 14:38:54 104 ----a-w- C:\Qoobox\Quarantine\Registry_backups\Wow6432Node-Toolbar-Locked.reg.dat

2014-09-21 14:24:33 . 2014-09-22 14:35:20 21,398 ----a-w- C:\Qoobox\Quarantine\Registry_backups\tcpip.reg

2014-09-21 14:15:16 . 2014-09-22 14:27:27 102 ----a-w- C:\Qoobox\Quarantine\catchme.log

And the second log:

ComboFix 14-09-22.01 - user 22.09.2014 16:28:33.2.4 - x64

Microsoft Windows 7 Home Premium 6.1.7601.1.1252.47.1044.18.4008.2768 [GMT 2:00]

Kjører fra: c:\users\user\Downloads\ComboFix.exe

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

((((((((((((((((((((((((((( Filer Opprettet Fra 2014-08-22 til 2014-09-22 )))))))))))))))))))))))))))))))))

.

2014-09-22 14:37 . 2014-09-22 14:37 -------- d-----w- c:\users\UpdatusUser\AppData\Local\temp

2014-09-22 14:37 . 2014-09-22 14:37 -------- d-----w- c:\users\TEMP\AppData\Local\temp

2014-09-22 14:37 . 2014-09-22 14:37 -------- d-----w- c:\users\Default\AppData\Local\temp

2014-09-22 12:37 . 2014-09-22 14:14 -------- d-----w- c:\users\user\AppData\Roaming\Wireshark

2014-09-22 12:21 . 2014-09-22 12:21 -------- d-----w- c:\program files (x86)\WinPcap

2014-09-22 12:21 . 2014-09-22 12:21 -------- d-----w- c:\program files\Wireshark

2014-09-22 12:07 . 2014-06-27 02:08 2777088 ----a-w- c:\windows\system32\msmpeg2vdec.dll

2014-09-22 12:07 . 2014-06-27 01:45 2285056 ----a-w- c:\windows\SysWow64\msmpeg2vdec.dll

2014-09-21 15:17 . 2014-09-21 15:17 -------- d-sh--w- c:\users\user\AppData\Local\EmieUserList

2014-09-21 15:17 . 2014-09-21 15:17 -------- d-sh--w- c:\users\user\AppData\Local\EmieSiteList

2014-09-21 14:54 . 2014-02-04 02:32 1424384 ----a-w- c:\windows\system32\WindowsCodecs.dll

2014-09-21 14:54 . 2014-02-04 02:04 1230336 ----a-w- c:\windows\SysWow64\WindowsCodecs.dll

2014-09-21 14:54 . 2014-01-24 02:37 1684928 ----a-w- c:\windows\system32\drivers\ntfs.sys