TR/ATRAPS.Gen2 Virus Removal?

Hi!

I'm a complete novice when it comes to virus/malware removal so please bare with me as I explain my situation.
I recently decided to help my friend out with his computer problems as I've worked on simple virus problems before, however, I have no idea how to remove this TR/ATRAPS.Gen2 virus. Having had no previous anti-virus installed on his computer, I decided to install Avira (after said computer had already been infected). I then ran multiple scans of Malwarebytes, SUPERAntispyware, Spybot Search and Destroy, and Avira's complete system scanner. After detecting several lesser viruses, I was able to delete the bulk of the problem. However, the TR/ATRAPS.Gen2 still pops up in Avira's security alert whenever I restart the computer. I have no clue how to get rid of this virus. Any help would be appreciated. Thanks!!!!

On a side note, could it be that the difficulty of eradicating this virus stems from the fact that his computer was also affected by the BOO/Alureon.D virus? Again I have very little knowledge when it comes to these viruses, but I was able to get rid of the boot sector virus, for the most part. I used a program called TDSSKiller. Again, any help would be very much appreciated!

His computer is running Windows 7 64bit

Greetings and Welcome to The Forums!!

My name is Gringo and I'll be glad to help you with your computer problems.

I have put together somethings for you to keep in mind while I am helping you to make things go easier and faster for both of us

• Please do not run any tools unless instructed to do so.
  
  • We ask you to run different tools in a specific order to ensure the malware is completely removed from your machine, and running any additional tools may detect false positives, interfere with our tools, or cause unforeseen damage or system instability.
• Please do not attach logs or use code boxes, just copy and paste the text.
  
  • Due to the high volume of logs we receive it helps to receive everything in the same format, and code boxes make the logs very difficult to read. Also, attachments require us to download and open the reports when it is easier to just read the reports in your post.
• Please read every post completely before doing anything.
  
  • Pay special attention to the NOTE: lines, these entries identify an individual issue or important step in the cleanup process.
• Please provide feedback about your experience as we go.
  
  • A short statement describing how the computer is working helps us understand where to go next, for example: I am still getting redirected, the computer is running normally, etc. Please do not describe the computer as "the same", this requires the extra step of looking back at your previous post.

NOTE: At the top of your post, click on the Watch Topic Button, select Immediate Notification, and click on Proceed. This will send you an e-mail as soon as I reply to your topic, allowing us to resolve the issue faster.

NOTE: Backup any files that cannot be replaced. Removing malware can be unpredictable and this step can save a lot of hartaches if things don't go as planed. You can put them on a CD/DVD, external drive or a pen drive, anywhere except on the computer.

NOTE: It is good practice to copy and paste the instructions into notepad and print them in case it is necessary for you to go offline during the cleanup process. To open notepad, navigate to Start Menu > All Programs > Accessories > Notepad. Please remember to copy the entire post so you do not miss any instructions.


DeFogger:

• Please download DeFogger to your desktop.
  
  Double click DeFogger to run the tool.
  
• The application window will appear
• Click the Disable button to disable your CD Emulation drivers
• Click Yes to continue
• A 'Finished!' message will appear
• Click OK
• DeFogger may ask you to reboot the machine, if it does - click OK

Do not re-enable these drivers until otherwise instructed.


Security Check

• Download Security Check by screen317 from here.
• Save it to your Desktop.
• Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
• A Notepad document should open automatically called checkup.txt; please post the contents of that document.

Download DDS:

• Please download DDS by sUBs from one of the links below and save it to your desktop:
  
  
  Download DDS and save it to your desktop
  
  Link1
  Link2
  Link3
  
  Please disable any anti-malware program that will block scripts from running before running DDS.
  
  
  • Double-Click on dds.scr and a command window will appear. This is normal.
  • Shortly after two logs will appear:
    
  • DDS.txt
  • Attach.txt
• A window will open instructing you save & post the logs
• Save the logs to a convenient place such as your desktop
• Copy the contents of both logs & post in your next reply

information and logs:

• In your next post I need the following
  
  
• .logs from DDS
• let me know of any problems you may have had

Gringo

Hi Gringo! Thanks for the reply. Here are the logs that you requested:


Security Check:

Results of screen317's Security Check version 0.99.43
Windows 7 Service Pack 1 x64 (UAC is disabled!)
Internet Explorer 9
``````````````Antivirus/Firewall Check:``````````````
Windows Security Center service is not running! This report may not be accurate!
Norton Internet Security
WMI entry may not exist for antivirus; attempting automatic update.
Avira successfully updated!
`````````Anti-malware/Other Utilities Check:`````````
Malwarebytes Anti-Malware version 1.62.0.1300
Java™ 6 Update 24
Java version out of Date!
Mozilla Firefox 10.0.1 Firefox out of Date!
Google Chrome 20.0.1132.57
````````Process Check: objlist.exe by Laurent````````
Avira Antivir avgnt.exe
Avira Antivir avguard.exe
`````````````````System Health check`````````````````
Total Fragmentation on Drive C: 6%
````````````````````End of Log``````````````````````


DDS

.
DDS (Ver_2011-08-26.01) - NTFSAMD64
Internet Explorer: 9.0.8112.16421
Run by AD at 0:27:24 on 2012-07-19
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.4044.2229 [GMT -7:00]
.
AV: Norton Internet Security *Disabled/Outdated* {63DF5164-9100-186D-2187-8DC619EFD8BF}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
SP: Norton Internet Security *Disabled/Outdated* {D8BEB080-B73A-17E3-1B37-B6B462689202}
FW: Norton Internet Security *Disabled* {5BE4D041-DB6F-1935-0AD8-24F3E73C9FC4}
.
============== Running Processes ===============
.
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Program Files (x86)\HP SimplePass 2011\TrueSuiteService.exe
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Program Files\IDT\WDM\STacSV64.exe
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\Hpservice.exe
C:\Windows\system32\WUDFHost.exe
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\system32\WLANExt.exe
C:\Windows\system32\conhost.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k WbioSvcGroup
C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE
C:\Program Files\IDT\WDM\AESTSr64.exe
C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Windows\System32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\SysWOW64\ezSharedSvcHost.exe
C:\Program Files\Hewlett-Packard\HP Client Services\HPClientServices.exe
C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe
C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe
C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe
C:\Program Files (x86)\Roxio\RoxioNow Player\RNowSvc.exe
C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE
C:\Windows\system32\svchost.exe -k imgsvc
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
C:\Windows\system32\taskhost.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files (x86)\HP SimplePass 2011\TouchControl.exe
C:\Program Files (x86)\HP SimplePass 2011\BioMonitor.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\IDT\WDM\sttray64.exe
C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
C:\Windows\system32\conhost.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Windows\System32\hkcmd.exe
C:\Windows\System32\igfxpers.exe
C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files (x86)\McAfee Security Scan\2.0.181\SSScheduler.exe
C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe
C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
C:\Program Files (x86)\iTunes\iTunesHelper.exe
C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe
C:\Program Files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe
C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe
C:\Program Files (x86)\CyberLink\Shared files\brs.exe
C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
C:\Windows\system32\SearchIndexer.exe
C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Windows\system32\taskeng.exe
C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Program Files (x86)\Hewlett-Packard\HP Health Check\hphc_service.exe
C:\Program Files (x86)\Hewlett-Packard\HP Connection Manager\hpConnectionManager.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Program Files (x86)\Hewlett-Packard\HP Connection Manager\hpCMSrv.exe
C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe
C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe
C:\Windows\system32\WUDFHost.exe
C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe
C:\Program Files (x86)\Mozilla Firefox\firefox.exe
C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe
C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_3_300_265.exe
C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_3_300_265.exe
C:\Windows\servicing\TrustedInstaller.exe
C:\Windows\system32\svchost.exe -k defragsvc
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\conhost.exe
C:\Windows\SysWOW64\cscript.exe
C:\Windows\system32\wbem\wmiprvse.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://www.yahoo.com/?ilc=16
uInternet Settings,ProxyOverride = *.local
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll
BHO: TrueSuite Website Log On: {8590886e-ec8c-43c1-a32c-e4c2b0b6395b} - C:\Program Files (x86)\HP SimplePass 2011\IEBHO.dll
BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
BHO: Bing Bar Helper: {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - "C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll"
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
TB: Bing Bar: {8dcb7100-df86-4384-8842-8fa844297b3f} - "C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll"
TB: {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No File
uRun: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
mRun: [IAStorIcon] C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe
mRun: [NUSB3MON] "C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe"
mRun: [<NO NAME>]
mRun: [HPConnectionManager] C:\Program Files (x86)\Hewlett-Packard\HP Connection Manager\HPCMDelayStart.exe
mRun: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe"
mRun: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
mRun: [Easybits Recovery] C:\Program Files (x86)\EasyBits For Kids\ezRecover.exe
mRun: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
mRun: [GrooveMonitor] "C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe"
mRun: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
mRun: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe"
mRun: [HP Quick Launch] C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe
mRun: [HPOSD] C:\Program Files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe
mRun: [RemoteControl10] "C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe"
mRun: [BDRegion] C:\Program Files (x86)\Cyberlink\Shared files\brs.exe
mRun: [avgnt] "C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe" /min
StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\MCAFEE~1.LNK - C:\Program Files (x86)\McAfee Security Scan\2.0.181\SSScheduler.exe
mPolicies-explorer: NoActiveDesktop = 1 (0x1)
mPolicies-explorer: NoActiveDesktopChanges = 1 (0x1)
mPolicies-explorer: EnableShellExecuteHooks = 1 (0x1)
mPolicies-system: ConsentPromptBehaviorAdmin = 0 (0x0)
mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)
mPolicies-system: EnableLUA = 0 (0x0)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
mPolicies-system: PromptOnSecureDesktop = 0 (0x0)
IE: E&xport to Microsoft Excel - C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000
IE: Free YouTube Download - C:\Users\AD\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubedownload.htm
IE: Free YouTube to MP3 Converter - C:\Users\AD\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm
IE: {A95fe080-8f5d-11d2-a20b-00aa003c157a} - res://C:\Program Files (x86)\Evernote\Evernote\EvernoteIE.dll/204
IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - C:\PROGRA~2\MICROS~1\Office12\REFIEBAR.DLL
LSP: mswsock.dll
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab
TCP: DhcpNameServer = 75.75.75.75 75.75.76.76
TCP: Interfaces\{0F4DB494-0231-46BE-BA18-3E9772A86556} : DhcpNameServer = 192.168.1.1
TCP: Interfaces\{0F4DB494-0231-46BE-BA18-3E9772A86556}\2656C6B696E6E253662643 : DhcpNameServer = 192.168.2.1
TCP: Interfaces\{0F4DB494-0231-46BE-BA18-3E9772A86556}\3544 : DhcpNameServer = 192.168.254.254 192.168.254.254
TCP: Interfaces\{A73364D5-F762-4527-8347-1DD49CE7B811} : DhcpNameServer = 75.75.75.75 75.75.76.76
Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveSystemServices.dll
Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
SEH: EasyBits ShellExecute Hook: {e54729e8-bb3d-4270-9d49-7389ea579090} - C:\Windows\SysWow64\EZUPBH~1.DLL
SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll
BHO-X64: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
BHO-X64: AcroIEHelperStub - No File
BHO-X64: Groove GFS Browser Helper: {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll
BHO-X64: TrueSuite Website Log On: {8590886E-EC8C-43C1-A32C-E4C2B0B6395B} - C:\Program Files (x86)\HP SimplePass 2011\IEBHO.dll
BHO-X64: TSBHO Class - No File
BHO-X64: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
BHO-X64: Bing Bar Helper: {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - "C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll"
BHO-X64: Java™ Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
TB-X64: Bing Bar: {8dcb7100-df86-4384-8842-8fa844297b3f} - "C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll"
TB-X64: {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No File
mRun-x64: [IAStorIcon] C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe
mRun-x64: [NUSB3MON] "C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe"
mRun-x64: [(Default)]
mRun-x64: [HPConnectionManager] C:\Program Files (x86)\Hewlett-Packard\HP Connection Manager\HPCMDelayStart.exe
mRun-x64: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe"
mRun-x64: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
mRun-x64: [Easybits Recovery] C:\Program Files (x86)\EasyBits For Kids\ezRecover.exe
mRun-x64: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
mRun-x64: [GrooveMonitor] "C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe"
mRun-x64: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
mRun-x64: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe"
mRun-x64: [HP Quick Launch] C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe
mRun-x64: [HPOSD] C:\Program Files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe
mRun-x64: [RemoteControl10] "C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe"
mRun-x64: [BDRegion] C:\Program Files (x86)\Cyberlink\Shared files\brs.exe
mRun-x64: [avgnt] "C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe" /min
IE-X64: {A95fe080-8f5d-11d2-a20b-00aa003c157a} - res://C:\Program Files (x86)\Evernote\Evernote\EvernoteIE.dll/204
SEH-X64: EasyBits ShellExecute Hook: {E54729E8-BB3D-4270-9D49-7389EA579090} - C:\Windows\SysWow64\EZUPBH~1.DLL
SEH-X64: Groove GFS Stub Execution Hook: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll
.
================= FIREFOX ===================
.
FF - ProfilePath - C:\Users\AD\AppData\Roaming\Mozilla\Firefox\Profiles\qkdk8i86.default\
FF - prefs.js: browser.search.selectedEngine - Yahoo
FF - plugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: c:\Program Files (x86)\Microsoft Silverlight\4.0.50401.0\npctrlui.dll
FF - plugin: C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\0\NP_wtapp.dll
FF - plugin: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll
FF - plugin: C:\Users\AD\AppData\Roaming\Mozilla\Firefox\Profiles\qkdk8i86.default\extensions\{cce665dd-f6dd-4808-968e-eaec971f70ef}\plugins\np-mswmp.dll
FF - plugin: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_3_300_265.dll
.
============= SERVICES / DRIVERS ===============
.
R1 avkmgr;avkmgr;C:\Windows\system32\DRIVERS\avkmgr.sys --> C:\Windows\system32\DRIVERS\avkmgr.sys [?]
R1 SASDIFSV;SASDIFSV;C:\Program Files\SUPERAntiSpyware\sasdifsv64.sys [2011-7-22 14928]
R1 SASKUTIL;SASKUTIL;C:\Program Files\SUPERAntiSpyware\saskutil64.sys [2011-7-12 12368]
R1 vwififlt;Virtual WiFi Filter Driver;C:\Windows\system32\DRIVERS\vwififlt.sys --> C:\Windows\system32\DRIVERS\vwififlt.sys [?]
R2 !SASCORE;SAS Core Service;C:\Program Files\SUPERAntiSpyware\SASCore64.exe [2011-8-11 140672]
R2 AESTFilters;Andrea ST Filters Service;C:\Program Files\IDT\WDM\AESTSr64.exe [2011-10-20 89600]
R2 AntiVirSchedulerService;Avira Scheduler;C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [2012-7-17 86224]
R2 AntiVirService;Avira Realtime Protection;C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [2012-7-17 110032]
R2 avgntflt;avgntflt;C:\Windows\system32\DRIVERS\avgntflt.sys --> C:\Windows\system32\DRIVERS\avgntflt.sys [?]
R2 ezSharedSvc;Easybits Services for Windows;C:\Windows\System32\ezSharedSvcHost.exe [2011-8-24 514232]
R2 FPLService;TrueSuiteService;C:\Program Files (x86)\HP SimplePass 2011\TrueSuiteService.exe [2011-2-17 265544]
R2 HPClientSvc;HP Client Services;C:\Program Files\Hewlett-Packard\HP Client Services\HPClientServices.exe [2010-10-11 346168]
R2 hpsrv;HP Service;C:\Windows\system32\Hpservice.exe --> C:\Windows\system32\Hpservice.exe [?]
R2 HPWMISVC;HPWMISVC;C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe [2012-3-5 35200]
R2 IAStorDataMgrSvc;Intel® Rapid Storage Technology;C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe [2011-10-20 13592]
R2 IconMan_R;IconMan_R;C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe [2012-7-16 2413056]
R2 RoxioNow Service;RoxioNow Service;C:\Program Files (x86)\Roxio\RoxioNow Player\RNowSvc.exe [2010-11-26 399344]
R2 UNS;Intel® Management and Security Application User Notification Service;C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe [2011-10-20 2656280]
R3 clwvd;CyberLink WebCam Virtual Driver;C:\Windows\system32\DRIVERS\clwvd.sys --> C:\Windows\system32\DRIVERS\clwvd.sys [?]
R3 hpCMSrv;HP Connection Manager 4.0 Service;C:\Program Files (x86)\Hewlett-Packard\HP Connection Manager\hpCMSrv.exe [2011-2-15 1071160]
R3 IntcDAud;Intel® Display Audio;C:\Windows\system32\DRIVERS\IntcDAud.sys --> C:\Windows\system32\DRIVERS\IntcDAud.sys [?]
R3 MEIx64;Intel® Management Engine Interface;C:\Windows\system32\DRIVERS\HECIx64.sys --> C:\Windows\system32\DRIVERS\HECIx64.sys [?]
R3 nusb3hub;Renesas Electronics USB 3.0 Hub Driver;C:\Windows\system32\DRIVERS\nusb3hub.sys --> C:\Windows\system32\DRIVERS\nusb3hub.sys [?]
R3 nusb3xhc;Renesas Electronics USB 3.0 Host Controller Driver;C:\Windows\system32\DRIVERS\nusb3xhc.sys --> C:\Windows\system32\DRIVERS\nusb3xhc.sys [?]
R3 RSPCIESTOR;Realtek PCIE CardReader Driver;C:\Windows\system32\DRIVERS\RtsPStor.sys --> C:\Windows\system32\DRIVERS\RtsPStor.sys [?]
R3 RTL8167;Realtek 8167 NT Driver;C:\Windows\system32\DRIVERS\Rt64win7.sys --> C:\Windows\system32\DRIVERS\Rt64win7.sys [?]
S2 CLKMSVC10_38F51D56;CyberLink Product - 2012/07/16 02:01:28;C:\Program Files (x86)\CyberLink\PowerDVD10\NavFilter\kmsvc.exe [2012-2-8 244720]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-4-22 250056]
S3 BBSvc;Bing Bar Update Service;C:\Program Files (x86)\Microsoft\BingBar\BBSvc.EXE [2011-3-1 183560]
S3 GamesAppService;GamesAppService;C:\Program Files (x86)\WildTangent Games\App\GamesAppService.exe [2010-10-12 206072]
S3 McComponentHostService;McAfee Security Scan Component Host Service;C:\Program Files (x86)\McAfee Security Scan\2.0.181\McCHSvc.exe [2010-1-15 227232]
S3 SrvHsfHDA;SrvHsfHDA;C:\Windows\system32\DRIVERS\VSTAZL6.SYS --> C:\Windows\system32\DRIVERS\VSTAZL6.SYS [?]
S3 SrvHsfV92;SrvHsfV92;C:\Windows\system32\DRIVERS\VSTDPV6.SYS --> C:\Windows\system32\DRIVERS\VSTDPV6.SYS [?]
S3 SrvHsfWinac;SrvHsfWinac;C:\Windows\system32\DRIVERS\VSTCNXT6.SYS --> C:\Windows\system32\DRIVERS\VSTCNXT6.SYS [?]
S3 TsUsbFlt;TsUsbFlt;C:\Windows\system32\drivers\tsusbflt.sys --> C:\Windows\system32\drivers\tsusbflt.sys [?]
S3 TsUsbGD;Remote Desktop Generic USB Device;C:\Windows\system32\drivers\TsUsbGD.sys --> C:\Windows\system32\drivers\TsUsbGD.sys [?]
S3 USBAAPL64;Apple Mobile USB Driver;C:\Windows\system32\Drivers\usbaapl64.sys --> C:\Windows\system32\Drivers\usbaapl64.sys [?]
S3 WatAdminSvc;Windows Activation Technologies Service;C:\Windows\system32\Wat\WatAdminSvc.exe --> C:\Windows\system32\Wat\WatAdminSvc.exe [?]
S4 wlcrasvc;Windows Live Mesh remote connections service;C:\Program Files\Windows Live\Mesh\wlcrasvc.exe [2010-9-22 57184]
.
=============== Created Last 30 ================
.
2012-07-18 22:39:06 -------- d-----w- C:\Program Files (x86)\World of Warcraft
2012-07-18 22:39:06 -------- d-----w- C:\Program Files (x86)\Common Files\Blizzard Entertainment
2012-07-18 07:55:54 -------- d-----w- C:\Program Files (x86)\WhatsRunning
2012-07-18 04:59:01 -------- d-----w- C:\Users\AD\AppData\Roaming\SUPERAntiSpyware.com
2012-07-18 04:58:17 -------- d-----w- C:\ProgramData\SUPERAntiSpyware.com
2012-07-18 04:58:17 -------- d-----w- C:\Program Files\SUPERAntiSpyware
2012-07-18 04:48:15 -------- d-----w- C:\TDSSKiller_Quarantine
2012-07-17 23:33:26 -------- d-----w- C:\Users\AD\AppData\Roaming\Avira
2012-07-17 23:26:41 98848 ----a-w- C:\Windows\System32\drivers\avgntflt.sys
2012-07-17 23:26:41 27760 ----a-w- C:\Windows\System32\drivers\avkmgr.sys
2012-07-17 23:26:40 -------- d-----w- C:\ProgramData\Avira
2012-07-17 23:26:40 -------- d-----w- C:\Program Files (x86)\Avira
2012-07-17 23:14:43 -------- d-----w- C:\Users\AD\AppData\Roaming\Malwarebytes
2012-07-17 23:14:12 24904 ----a-w- C:\Windows\System32\drivers\mbam.sys
2012-07-17 23:14:12 -------- d-----w- C:\ProgramData\Malwarebytes
2012-07-17 23:14:12 -------- d-----w- C:\Program Files (x86)\Malwarebytes' Anti-Malware
2012-07-17 23:10:58 -------- d-----w- C:\Program Files\CCleaner
2012-07-16 10:15:53 3148800 ----a-w- C:\Windows\System32\win32k.sys
2012-07-16 10:08:18 -------- d-----w- C:\Users\AD\temp
2012-07-16 10:08:10 -------- d-----w- C:\Users\AD\AppData\Roaming\TeamViewer
2012-07-16 10:05:46 -------- d-----w- C:\Program Files (x86)\Common Files\Intel Corporation
2012-07-16 08:46:16 557848 ----a-w- C:\Windows\System32\drivers\iaStor.sys
2012-07-16 08:45:26 9888360 ----a-w- C:\Windows\SysWow64\RtsPStorIcon.dll
2012-07-16 08:39:42 91648 ----a-w- C:\Windows\System32\drivers\nusb3hub.sys
2012-07-16 08:39:42 81920 ----a-w- C:\Windows\System32\nusb3co2.dll
2012-07-16 08:39:42 208896 ----a-w- C:\Windows\System32\drivers\nusb3xhc.sys
2012-07-16 08:38:15 66856 ----a-w- C:\Windows\SysWow64\SynTPEnhPS.dll
2012-07-16 08:38:15 226600 ----a-w- C:\Windows\System32\SET8EF0.tmp
2012-07-16 08:38:15 148264 ----a-w- C:\Windows\System32\SynTPCo9.dll
2012-07-16 08:38:15 1451056 ----a-w- C:\Windows\System32\drivers\SynTP.sys
2012-07-16 08:38:15 107816 ----a-w- C:\Windows\SysWow64\SynTPCOM.dll
2012-07-16 08:38:14 276264 ----a-w- C:\Windows\System32\SynCtrl.dll
2012-07-16 08:38:14 222504 ----a-w- C:\Windows\SysWow64\SynCtrl.dll
2012-07-16 08:38:13 177448 ----a-w- C:\Windows\SysWow64\SynCOM.dll
2012-07-15 10:42:00 -------- d-----w- C:\Users\AD\AppData\Local\Sunbelt Software
2012-07-15 10:40:30 -------- d-----w- C:\Users\AD\AppData\Local\Google
2012-07-15 10:39:42 -------- d-----w- C:\Program Files (x86)\Lavasoft
2012-07-15 10:37:44 -------- d-----w- C:\Users\AD\AppData\Roaming\Iminent
2012-07-15 10:37:31 -------- d-----w- C:\ProgramData\Iminent
2012-07-15 10:36:27 -------- d-----w- C:\Program Files (x86)\Iminent
2012-07-15 09:12:08 -------- d-----w- C:\Users\AD\AppData\Local\VS Revo Group
2012-07-15 09:11:58 -------- d-----w- C:\Program Files\VS Revo Group
2012-07-14 12:35:48 -------- dc-h--w- C:\ProgramData\{2162CCC0-3A5F-4887-B51F-CE5F195B3620}
2012-07-14 12:15:20 -------- d-----w- C:\Users\AD\AppData\Roaming\Uniblue
2012-07-14 12:15:15 -------- d-----w- C:\Program Files (x86)\Uniblue
2012-07-14 12:15:07 -------- d-----w- C:\Program Files (x86)\WhiteSmoke_US
2012-07-14 10:22:47 -------- d-----w- C:\ProgramData\Spybot - Search & Destroy
2012-07-14 10:22:47 -------- d-----w- C:\Program Files (x86)\Spybot - Search & Destroy
2012-07-08 08:13:32 -------- d-----w- C:\Users\AD\AppData\Roaming\Tific
2012-07-08 08:13:31 -------- d-----w- C:\Users\AD\AppData\Local\Symantec
2012-07-07 09:20:50 -------- d-sh--w- C:\Windows\SysWow64\%APPDATA%
2012-07-02 07:58:00 -------- d-----w- C:\Users\AD\AppData\Local\Macromedia
2012-06-20 07:36:58 2622464 ----a-w- C:\Windows\System32\wucltux.dll
2012-06-20 07:36:04 99840 ----a-w- C:\Windows\System32\wudriver.dll
2012-06-20 07:35:43 36864 ----a-w- C:\Windows\System32\wuapp.exe
2012-06-20 07:35:43 186752 ----a-w- C:\Windows\System32\wuwebv.dll
.
==================== Find3M ====================
.
2012-07-16 08:59:48 505128 ----a-w- C:\Windows\SysWow64\msvcp71.dll
2012-07-16 08:59:48 353576 ----a-w- C:\Windows\SysWow64\msvcr71.dll
2012-07-16 08:59:48 29480 ----a-w- C:\Windows\SysWow64\msxml3a.dll
2012-07-16 08:44:45 338536 ----a-w- C:\Windows\System32\drivers\RtsPStor.sys
2012-07-16 08:37:46 411944 ----a-w- C:\Windows\System32\SynCOM.dll
2012-07-16 08:08:32 70344 ----a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
2012-07-16 08:08:32 426184 ----a-w- C:\Windows\SysWow64\FlashPlayerApp.exe
2012-06-06 06:06:16 2004480 ----a-w- C:\Windows\System32\msxml6.dll
2012-06-06 06:06:16 1881600 ----a-w- C:\Windows\System32\msxml3.dll
2012-06-06 06:02:54 1133568 ----a-w- C:\Windows\System32\cdosys.dll
2012-06-06 05:05:52 1390080 ----a-w- C:\Windows\SysWow64\msxml6.dll
2012-06-06 05:05:52 1236992 ----a-w- C:\Windows\SysWow64\msxml3.dll
2012-06-06 05:03:06 805376 ----a-w- C:\Windows\SysWow64\cdosys.dll
2012-06-02 12:12:17 2311680 ----a-w- C:\Windows\System32\jscript9.dll
2012-06-02 12:05:28 1392128 ----a-w- C:\Windows\System32\wininet.dll
2012-06-02 12:04:50 1494528 ----a-w- C:\Windows\System32\inetcpl.cpl
2012-06-02 12:01:40 173056 ----a-w- C:\Windows\System32\ieUnatt.exe
2012-06-02 11:57:08 2382848 ----a-w- C:\Windows\System32\mshtml.tlb
2012-06-02 08:33:25 1800192 ----a-w- C:\Windows\SysWow64\jscript9.dll
2012-06-02 08:25:08 1129472 ----a-w- C:\Windows\SysWow64\wininet.dll
2012-06-02 08:25:03 1427968 ----a-w- C:\Windows\SysWow64\inetcpl.cpl
2012-06-02 08:20:33 142848 ----a-w- C:\Windows\SysWow64\ieUnatt.exe
2012-06-02 08:16:52 2382848 ----a-w- C:\Windows\SysWow64\mshtml.tlb
2012-06-02 05:50:10 458704 ----a-w- C:\Windows\System32\drivers\cng.sys
2012-06-02 05:48:16 95600 ----a-w- C:\Windows\System32\drivers\ksecdd.sys
2012-06-02 05:48:16 151920 ----a-w- C:\Windows\System32\drivers\ksecpkg.sys
2012-06-02 05:45:31 340992 ----a-w- C:\Windows\System32\schannel.dll
2012-06-02 05:44:21 307200 ----a-w- C:\Windows\System32\ncrypt.dll
2012-06-02 04:40:42 22016 ----a-w- C:\Windows\SysWow64\secur32.dll
2012-06-02 04:40:39 225280 ----a-w- C:\Windows\SysWow64\schannel.dll
2012-06-02 04:39:10 219136 ----a-w- C:\Windows\SysWow64\ncrypt.dll
2012-06-02 04:34:09 96768 ----a-w- C:\Windows\SysWow64\sspicli.dll
2012-05-04 11:06:22 5559664 ----a-w- C:\Windows\System32\ntoskrnl.exe
2012-05-04 10:03:53 3968368 ----a-w- C:\Windows\SysWow64\ntkrnlpa.exe
2012-05-04 10:03:50 3913072 ----a-w- C:\Windows\SysWow64\ntoskrnl.exe
2012-05-01 05:40:20 209920 ----a-w- C:\Windows\System32\profsvc.dll
2012-04-28 03:55:21 210944 ----a-w- C:\Windows\System32\drivers\rdpwd.sys
2012-04-26 05:41:56 77312 ----a-w- C:\Windows\System32\rdpwsx.dll
2012-04-26 05:41:55 149504 ----a-w- C:\Windows\System32\rdpcorekmts.dll
2012-04-26 05:34:27 9216 ----a-w- C:\Windows\System32\rdrmemptylst.exe
2012-04-25 21:02:52 43800 ----a-w- C:\Windows\System32\drivers\Accelerometer.sys
2012-04-25 21:02:52 31000 ----a-w- C:\Windows\System32\SETA732.tmp
2012-04-25 21:02:52 30488 ----a-w- C:\Windows\System32\drivers\hpdskflt.sys
2012-04-25 21:02:52 21272 ----a-w- C:\Windows\System32\SETA771.tmp
2012-04-25 21:02:52 18200 ----a-w- C:\Windows\System32\SETA7A1.tmp
2012-04-24 05:37:37 184320 ----a-w- C:\Windows\System32\cryptsvc.dll
2012-04-24 05:37:37 140288 ----a-w- C:\Windows\System32\cryptnet.dll
2012-04-24 05:37:36 1462272 ----a-w- C:\Windows\System32\crypt32.dll
2012-04-24 04:36:42 140288 ----a-w- C:\Windows\SysWow64\cryptsvc.dll
2012-04-24 04:36:42 1158656 ----a-w- C:\Windows\SysWow64\crypt32.dll
2012-04-24 04:36:42 103936 ----a-w- C:\Windows\SysWow64\cryptnet.dll
.
============= FINISH: 0:27:56.13 ===============


Attach:

.
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
.
DDS (Ver_2011-08-26.01)
.
Microsoft Windows 7 Home Premium
Boot Device: \Device\HarddiskVolume1
Install Date: 11/29/2011 5:23:33 PM
System Uptime: 7/19/2012 12:14:47 AM (0 hours ago)
.
Motherboard: Hewlett-Packard | | 1802
Processor: Intel® Core™ i7-2670QM CPU @ 2.20GHz | CPU1 | 2201/1333mhz
.
==== Disk Partitions =========================
.
C: is FIXED (NTFS) - 579 GiB total, 525.483 GiB free.
D: is FIXED (NTFS) - 17 GiB total, 1.844 GiB free.
E: is Removable
Z: is CDROM ()
.
==== Disabled Device Manager Items =============
.
==== System Restore Points ===================
.
RP102: 7/15/2012 3:00:23 AM - Windows Update
RP103: 7/15/2012 3:30:35 AM - Removed Evernote v. 4.2.2
RP104: 7/15/2012 5:30:37 PM - Windows Update
RP105: 7/15/2012 5:42:58 PM - HPSF Applying updates
RP106: 7/16/2012 1:39:54 AM - Configured Renesas Electronics USB 3.0 Host Controller Driver
RP107: 7/16/2012 1:44:52 AM - Installed Realtek PCIE Card Reader
RP108: 7/16/2012 1:49:23 AM - Removed HP Power Manager
RP109: 7/16/2012 1:49:53 AM - Installed HP Power Manager
RP110: 7/16/2012 1:51:44 AM - Removed HP Quick Launch
RP111: 7/16/2012 1:52:24 AM - Installed HP Quick Launch
RP112: 7/16/2012 1:54:06 AM - Removed HP On Screen Display
RP113: 7/16/2012 1:54:34 AM - Installed HP On Screen Display
RP114: 7/16/2012 1:57:36 AM - Configured PowerDVD
RP115: 7/16/2012 2:43:52 AM - Restore Operation
RP116: 7/16/2012 3:07:23 AM - Windows Update
RP117: 7/17/2012 3:55:41 PM - Windows Update
RP118: 7/18/2012 1:13:14 AM - Windows Update
.
==== Installed Programs ======================
.
2007 Microsoft Office Suite Service Pack 2 (SP2)
ActiveCheck component for HP Active Support Library
Adobe Flash Player 11 ActiveX
Adobe Flash Player 11 Plugin
Adobe Reader X MUI
Adobe Shockwave Player 11.5
Agatha Christie - Peril at End House
Apple Application Support
Apple Software Update
Avira Free Antivirus
Bejeweled 2 Deluxe
Bejeweled 3
Bing Bar
Blackhawk Striker 2
Blasterball 3
Blio
Bounce Symphony
Build-a-lot 2
Cake Mania
Chuzzle Deluxe
CyberLink PowerDVD
CyberLink YouCam
D3DX10
Diner Dash 2 Restaurant Rescue
Dora's World Adventure
Energy Star Digital Logo
ESU for Microsoft Windows 7
Evernote v. 4.2.2
Farm Frenzy
FATE - The Traitor Soul
Free Studio version 5.3.5
Free YouTube to MP3 Converter version 3.10.17.221
HP Connection Manager
HP Customer Experience Enhancements
HP Documentation
HP DVB-T TV Tuner 8.0.64.43
HP Games
HP MovieStore
HP On Screen Display
HP Power Manager
HP Quick Launch
HP Setup
HP Setup Manager
HP SimplePass 2011
HP Software Framework
HP Support Assistant
HPAsset component for HP Active Support Library
IDT Audio
Intel® Control Center
Intel® Management Engine Components
Intel® Processor Graphics
Intel® Rapid Storage Technology
Java Auto Updater
Java™ 6 Update 24
Junk Mail filter update
Magic Desktop
Mah Jong Medley
Malwarebytes Anti-Malware version 1.62.0.1300
McAfee Security Scan Plus
Mesh Runtime
Microsoft Office 2010
Microsoft Office Access MUI (English) 2007
Microsoft Office Access Setup Metadata MUI (English) 2007
Microsoft Office Enterprise 2007
Microsoft Office Excel MUI (English) 2007
Microsoft Office Groove MUI (English) 2007
Microsoft Office Groove Setup Metadata MUI (English) 2007
Microsoft Office InfoPath MUI (English) 2007
Microsoft Office OneNote MUI (English) 2007
Microsoft Office Outlook MUI (English) 2007
Microsoft Office PowerPoint MUI (English) 2007
Microsoft Office Project MUI (English) 2007
Microsoft Office Project Professional 2007
Microsoft Office Proof (English) 2007
Microsoft Office Proof (French) 2007
Microsoft Office Proof (Spanish) 2007
Microsoft Office Proofing (English) 2007
Microsoft Office Publisher MUI (English) 2007
Microsoft Office Shared MUI (English) 2007
Microsoft Office Shared Setup Metadata MUI (English) 2007
Microsoft Office Visio MUI (English) 2007
Microsoft Office Visio Professional 2007
Microsoft Office Word MUI (English) 2007
Microsoft Silverlight
Microsoft SQL Server 2005 Compact Edition [ENU]
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
Microsoft WSE 3.0 Runtime
Mozilla Firefox 10.0.1 (x86 en-US)
MSVCRT
MSVCRT_amd64
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
Mystery P.I. - Stolen in San Francisco
Namco All-Stars PAC-MAN
Penguins!
Plants vs. Zombies - Game of the Year
PlayReady PC Runtime x86
Poker Superstars III
Polar Bowler
Polar Golfer
Realtek Ethernet Controller Driver
Realtek PCIE Card Reader
Recovery Manager
Renesas Electronics USB 3.0 Host Controller Driver
RoxioNow Player
Security Update for Microsoft .NET Framework 4 Client Profile (KB2478663)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2539636)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2572078)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2604121)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2633870)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368v2)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656405)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2686827)
Slingo Supreme
Update for Microsoft .NET Framework 4 Client Profile (KB2468871)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217)
Update Installer for WildTangent Games App
Virtual Villagers 4 - The Tree of Life
What's Running 2.2
Wheel of Fortune 2
WildTangent Games App (HP Games)
Windows Live Communications Platform
Windows Live Essentials
Windows Live Installer
Windows Live Mail
Windows Live Mesh
Windows Live Mesh ActiveX Control for Remote Connections
Windows Live Messenger
Windows Live Movie Maker
Windows Live Photo Common
Windows Live Photo Gallery
Windows Live PIMT Platform
Windows Live SOXE
Windows Live SOXE Definitions
Windows Live UX Platform
Windows Live UX Platform Language Pack
Windows Live Writer
Windows Live Writer Resources
Zuma Deluxe
.
==== Event Viewer Messages From Past Week ========
.
7/19/2012 12:17:49 AM, Error: Service Control Manager [7023] - The Function Discovery Resource Publication service terminated with the following error: %%-2147024891
7/19/2012 12:17:49 AM, Error: Service Control Manager [7001] - The HomeGroup Provider service depends on the Function Discovery Resource Publication service which failed to start because of the following error: %%-2147024891
7/19/2012 12:15:11 AM, Error: Service Control Manager [7003] - The SBSD Security Center Service service depends the following service: wscsvc. This service might not be installed.
7/19/2012 12:15:11 AM, Error: Service Control Manager [7003] - The IPsec Policy Agent service depends the following service: BFE. This service might not be installed.
7/19/2012 12:15:11 AM, Error: Service Control Manager [7003] - The IKE and AuthIP IPsec Keying Modules service depends the following service: BFE. This service might not be installed.
7/19/2012 12:15:08 AM, Error: Service Control Manager [7023] - The Computer Browser service terminated with the following error: The specified service does not exist as an installed service.
7/18/2012 3:57:35 PM, Error: Microsoft-Windows-WLAN-AutoConfig [10000] - WLAN Extensibility Module has failed to start. Module Path: C:\Windows\System32\bcmihvsrv64.dll Error Code: 21
7/18/2012 3:57:20 PM, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: avipbb avkmgr discache SASDIFSV SASKUTIL spldr Wanarpv6
7/18/2012 3:57:17 PM, Error: Service Control Manager [7001] - The Computer Browser service depends on the Server service which failed to start because of the following error: The dependency service or group failed to start.
7/18/2012 3:50:56 PM, Error: Service Control Manager [7001] - The HomeGroup Provider service depends on the Function Discovery Provider Host service which failed to start because of the following error: The dependency service or group failed to start.
7/18/2012 3:49:13 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service WSearch with arguments "" in order to run the server: {9E175B6D-F52A-11D8-B9A5-505054503030}
7/18/2012 3:49:13 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service WSearch with arguments "" in order to run the server: {7D096C5F-AC08-4F1F-BEB7-5C22C517CE39}
7/18/2012 3:49:10 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}
7/18/2012 3:48:56 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service ShellHWDetection with arguments "" in order to run the server: {DD522ACC-F821-461A-A407-50B198B896DC}
7/18/2012 12:48:17 AM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the HPWMISVC service.
7/17/2012 9:57:23 PM, Error: Disk [11] - The driver detected a controller error on \Device\Harddisk1\DR2.
7/17/2012 9:47:02 PM, Error: Disk [11] - The driver detected a controller error on \Device\Harddisk1\DR1.
7/17/2012 9:45:16 PM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the Microsoft .NET Framework NGEN v4.0.30319_X64 service to connect.
7/17/2012 4:39:17 PM, Error: ACPI [13] - : The embedded controller (EC) did not respond within the specified timeout period. This may indicate that there is an error in the EC hardware or firmware or that the BIOS is accessing the EC incorrectly. You should check with your computer manufacturer for an upgraded BIOS. In some situations, this error may cause the computer to function incorrectly.
7/17/2012 4:03:34 PM, Error: Service Control Manager [7031] - The Norton Internet Security service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 120000 milliseconds: Restart the service.
7/17/2012 3:58:03 PM, Error: Microsoft-Windows-WindowsUpdateClient [20] - Installation Failure: Windows failed to install the following update with error 0x80070643: Update for Windows 7 for x64-based Systems (KB2679255).
7/17/2012 3:58:03 PM, Error: Microsoft-Windows-WindowsUpdateClient [20] - Installation Failure: Windows failed to install the following update with error 0x80070643: Security Update for Windows 7 for x64-based Systems (KB2709715).
7/17/2012 3:58:03 PM, Error: Microsoft-Windows-WindowsUpdateClient [20] - Installation Failure: Windows failed to install the following update with error 0x80070643: Security Update for Windows 7 for x64-based Systems (KB2676562).
7/16/2012 1:52:53 AM, Error: Service Control Manager [7030] - The HPWMISVC service is marked as an interactive service. However, the system is configured to not allow interactive services. This service may not function properly.
7/16/2012 1:07:33 AM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the hpqwmiex service.
7/15/2012 5:13:42 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service wuauserv with arguments "" in order to run the server: {E60687F7-01A1-40AA-86AC-DB1CBF673334}
7/15/2012 5:12:57 PM, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: BHDrvx64 discache eeCtrl IDSVia64 spldr SRTSPX SymIRON SymNetS Wanarpv6
7/15/2012 5:12:57 PM, Error: Microsoft-Windows-WER-SystemErrorReporting [1001] - The computer has rebooted from a bugcheck. The bugcheck was: 0x00000096 (0xfffffa8004431b80, 0xfffff80002e312b8, 0xfffff80002e31260, 0xfffffa8004200cd8). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 071512-33462-01.
7/15/2012 5:09:03 PM, Error: Microsoft-Windows-WER-SystemErrorReporting [1001] - The computer has rebooted from a bugcheck. The bugcheck was: 0x0000000a (0x00000000000000de, 0x0000000000000002, 0x0000000000000001, 0xfffff80002d02ab5). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 071512-46145-01.
7/15/2012 3:56:45 AM, Error: Microsoft-Windows-WER-SystemErrorReporting [1001] - The computer has rebooted from a bugcheck. The bugcheck was: 0x0000001e (0xffffffffc0000005, 0xfffff80002c67f6b, 0x0000000000000000, 0x000000007efa0000). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 071512-48219-01.
7/15/2012 3:53:00 AM, Error: Microsoft-Windows-WER-SystemErrorReporting [1001] - The computer has rebooted from a bugcheck. The bugcheck was: 0x0000000a (0x0000000000072dfe, 0x0000000000000002, 0x0000000000000001, 0xfffff80002ccbab5). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 071512-46519-01.
7/15/2012 3:41:54 AM, Error: Service Control Manager [7030] - The Lavasoft Ad-Aware Service service is marked as an interactive service. However, the system is configured to not allow interactive services. This service may not function properly.
7/15/2012 1:48:42 AM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the Windows Error Reporting Service service to connect.
7/15/2012 1:44:58 AM, Error: Microsoft-Windows-Time-Service [34] - The time service has detected that the system time needs to be changed by -89957 seconds. The time service will not change the system time by more than 54000 seconds. Verify that your time and time zone are correct, and that the time source time.windows.com,0x9 (ntp.m|0x9|0.0.0.0:123->65.55.21.13:123) is working properly.
7/15/2012 1:42:32 AM, Error: Service Control Manager [7022] - The Windows Update service hung on starting.
7/15/2012 1:38:20 AM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the Microsoft .NET Framework NGEN v4.0.30319_X86 service to connect.
7/14/2012 3:24:32 AM, Error: Service Control Manager [7034] - The Windows Biometric Service service terminated unexpectedly. It has done this 1 time(s).
7/12/2012 12:50:27 AM, Error: Microsoft-Windows-WER-SystemErrorReporting [1001] - The computer has rebooted from a bugcheck. The bugcheck was: 0x0000001e (0xffffffffc0000005, 0xfffff80002cb2f6b, 0x0000000000000000, 0x000007fffffa0000). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 071212-47268-01.
7/12/2012 10:11:45 PM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the upnphost service.
7/12/2012 10:10:55 PM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the SSDPSRV service.
7/12/2012 10:10:55 PM, Error: Service Control Manager [7000] - The SSDP Discovery service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
7/12/2012 1:13:12 AM, Error: Service Control Manager [7032] - The Service Control Manager tried to take a corrective action (Restart the service) after the unexpected termination of the Windows Font Cache Service service, but this action failed with the following error: An instance of the service is already running.
7/12/2012 1:12:13 AM, Error: Service Control Manager [7032] - The Service Control Manager tried to take a corrective action (Restart the service) after the unexpected termination of the SSDP Discovery service, but this action failed with the following error: An instance of the service is already running.
7/12/2012 1:12:12 AM, Error: Service Control Manager [7031] - The Windows Font Cache Service service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.
7/12/2012 1:12:12 AM, Error: Service Control Manager [7031] - The UPnP Device Host service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 100 milliseconds: Restart the service.
7/12/2012 1:12:12 AM, Error: Service Control Manager [7031] - The SSDP Discovery service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 100 milliseconds: Restart the service.
.
==== End Of File ===========================


So far, I have not encountered any problems. Thanks again Gringo.

Hello

I Would like you to do the following.

Please print out or make a copy in notpad of any instructions given, as sometimes it is necessary to go offline and you will lose access to them.

Run Combofix:

You may be asked to install or update the Recovery Console (Win XP Only) if this happens please allow it to do so (you will need to be connected to the internet for this)

Before you run Combofix I will need you to turn off any security software you have running, If you do not know how to do this you can find out >here< or >here<

Combofix may need to reboot your computer more than once to do its job this is normal.

You can download Combofix from one of these links. I want you to save it to the desktop and run it from there.
Link 1
Link 2
Link 3
1. Close any open browsers or any other programs that are open.
2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

Double click on combofix.exe & follow the prompts.
When finished, it will produce a report for you.

Note 1: Do not mouseclick combofix's window while it's running. That may cause it to stall

Note 2: If you recieve an error "Illegal operation attempted on a registery key that has been marked for deletion." Please restart the computer

"information and logs"

• In your next post I need the following
  
• Log from Combofix
• let me know of any problems you may have had
  
• How is the computer doing now?

Gringo

Hi, I downloaded ComboFix and saved it to the desktop like you said. I then ran it from the desktop and a box popped up and I clicked "I Agree", and then a similar box popped up with green letters and a green "loading" bar. However, as soon as that finished, the box closed and I didn't receive any log. Should I try running ComboFix again?

Hello

lets try this first then

download Farbar Recovery Scan Tool x64 and save it to a flash drive.

Plug the flashdrive into the infected PC.

Enter System Recovery Options.

To enter System Recovery Options from the Advanced Boot Options:

• Restart the computer.
• As soon as the BIOS is loaded begin tapping the F8 key until Advanced Boot Options appears.
• Use the arrow keys to select the Repair your computer menu item.
• Select US as the keyboard language settings, and then click Next.
• Select the operating system you want to repair, and then click Next.
• Select your user account an click Next.

To enter System Recovery Options by using Windows installation disc:

• Insert the installation disc.
• Restart your computer.
• If prompted, press any key to start Windows from the installation disc. If your computer is not configured to start from a CD or DVD, check your BIOS settings.
• Click Repair your computer.
• Select US as the keyboard language settings, and then click Next.
• Select the operating system you want to repair, and then click Next.
• Select your user account and click Next.

On the System Recovery Options menu you will get the following options:
Startup Repair
System Restore
Windows Complete PC Restore
Windows Memory Diagnostic Tool
Command Prompt[*]Select Command Prompt
[*]In the command window type in notepad and press Enter.
[*]The notepad opens. Under File menu select Open.
[*]Select "Computer" and find your flash drive letter and close the notepad.
[*]In the command window type e:\frst.exe (for x64 bit version type e:\frst64) and press Enter
Note: Replace letter e with the drive letter of your flash drive.
[*]The tool will start to run.
[*]When the tool opens click Yes to disclaimer.
[*]Press Scan button.
[*]It will make a log (FRST.txt) on the flash drive. Please copy and paste it to your reply.[/list]
Gringo[/b]

Hi, here is the log:

Scan result of Farbar Recovery Scan Tool Version: 16-07-2012 02
Ran by SYSTEM at 19-07-2012 01:05:24
Running from H:\
Windows 7 Home Premium (X64) OS Language: English(US)
The current controlset is ControlSet001

========================== Registry (Whitelisted) =============

HKLM\...\Run: [SysTrayApp] C:\Program Files\IDT\WDM\sttray64.exe [1128448 2011-03-11] (IDT, Inc.)
HKLM\...\Run: [SynTPEnh] %ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe [2799912 2012-07-16] (Synaptics Incorporated)
HKLM\...\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe [168216 2011-04-15] (Intel Corporation)
HKLM\...\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe [392472 2011-04-15] (Intel Corporation)
HKLM\...\Run: [Persistence] C:\Windows\system32\igfxpers.exe [416024 2011-04-15] (Intel Corporation)
HKLM-x32\...\Run: [IAStorIcon] C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe [284440 2011-05-20] (Intel Corporation)
HKLM-x32\...\Run: [NUSB3MON] "C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe" [113288 2012-07-16] (Renesas Electronics Corporation)
HKLM-x32\...\Run: [] [x]
HKLM-x32\...\Run: [HPConnectionManager] C:\Program Files (x86)\Hewlett-Packard\HP Connection Manager\HPCMDelayStart.exe [94264 2011-02-15] (Hewlett-Packard Development Company L.P.)
HKLM-x32\...\Run: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe" [35736 2010-11-15] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [843712 2012-01-02] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Easybits Recovery] C:\Program Files (x86)\EasyBits For Kids\ezRecover.exe [61112 2011-03-16] (EasyBits Software AS)
HKLM-x32\...\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe" [249064 2010-10-29] (Sun Microsystems, Inc.)
HKLM-x32\...\Run: [GrooveMonitor] "C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe" [31072 2008-10-25] (Microsoft Corporation)
HKLM-x32\...\Run: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [59240 2011-11-01] (Apple Inc.)
HKLM-x32\...\Run: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe" [421736 2011-12-08] (Apple Inc.)
HKLM-x32\...\Run: [HP Quick Launch] C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe [578944 2012-03-05] (Hewlett-Packard Development Company, L.P.)
HKLM-x32\...\Run: [HPOSD] C:\Program Files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe [379960 2011-08-19] (Hewlett-Packard Development Company, L.P.)
HKLM-x32\...\Run: [RemoteControl10] "C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe" [87336 2011-03-30] (CyberLink Corp.)
HKLM-x32\...\Run: [BDRegion] C:\Program Files (x86)\Cyberlink\Shared files\brs.exe [75048 2012-07-16] (cyberlink)
HKLM-x32\...\Run: [avgnt] "C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe" /min [348624 2012-05-01] (Avira Operations GmbH & Co. KG)
HKU\AD\...\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe [5661056 2012-07-09] (SUPERAntiSpyware.com)
Winlogon\Notify\igfxcui: igfxdev.dll (Intel Corporation)
Tcpip\Parameters: [DhcpNameServer] 75.75.75.75 75.75.76.76
Startup: C:\Users\All Users\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk
ShortcutTarget: McAfee Security Scan Plus.lnk -> C:\Program Files (x86)\McAfee Security Scan\2.0.181\SSScheduler.exe (McAfee, Inc.)

==================== Services (Whitelisted) ======

2 !SASCORE; "C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE" [140672 2011-08-11] (SUPERAntiSpyware.com)
2 AntiVirSchedulerService; "C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe" [86224 2012-05-02] (Avira Operations GmbH & Co. KG)
2 AntiVirService; "C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe" [110032 2012-05-01] (Avira Operations GmbH & Co. KG)
2 CLKMSVC10_38F51D56; "C:\Program Files (x86)\CyberLink\PowerDVD10\NavFilter\kmsvc.exe" /svc [244720 2012-02-08] (CyberLink)
3 hpCMSrv; "C:\Program Files (x86)\Hewlett-Packard\HP Connection Manager\hpCMSrv.exe" [1071160 2011-02-15] (Hewlett-Packard Development Company L.P.)
3 McComponentHostService; "C:\Program Files (x86)\McAfee Security Scan\2.0.181\McCHSvc.exe" [227232 2010-01-15] (McAfee, Inc.)
2 UNS; "C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe" [2656280 2010-12-22] (Intel Corporation)

========================== Drivers (Whitelisted) =============

2 avgntflt; C:\Windows\System32\Drivers\avgntflt.sys [98848 2012-04-24] (Avira GmbH)
1 avipbb; C:\Windows\System32\Drivers\avipbb.sys [132832 2012-04-27] (Avira GmbH)
1 avkmgr; C:\Windows\System32\Drivers\avkmgr.sys [27760 2012-05-02] (Avira GmbH)
1 SASDIFSV; \??\C:\Program Files\SUPERAntiSpyware\SASDIFSV64.SYS [14928 2011-07-22] (SUPERAdBlocker.com and SUPERAntiSpyware.com)
1 SASKUTIL; \??\C:\Program Files\SUPERAntiSpyware\SASKUTIL64.SYS [12368 2011-07-12] (SUPERAdBlocker.com and SUPERAntiSpyware.com)

========================== NetSvcs (Whitelisted) ===========


============ One Month Created Files and Folders ==============

2012-07-18 23:46 - 2012-07-18 23:48 - 00000000 ___SD C:\32788R22FWJFW
2012-07-18 23:46 - 2012-07-18 23:48 - 00000000 ____D C:\Windows\erdnt
2012-07-18 23:46 - 2012-07-18 23:48 - 00000000 ____D C:\Qoobox
2012-07-18 23:44 - 2012-07-18 23:44 - 04579127 ____R (Swearware) C:\Users\AD\Desktop\ComboFix.exe
2012-07-18 23:28 - 2012-07-18 23:28 - 00027354 ____A C:\Users\AD\Desktop\DDS.txt
2012-07-18 23:28 - 2012-07-18 23:28 - 00016973 ____A C:\Users\AD\Desktop\Attach.txt
2012-07-18 23:26 - 2012-07-18 23:26 - 00001095 ____A C:\Users\AD\Desktop\checkup.txt
2012-07-18 23:23 - 2012-07-18 23:23 - 00000466 ____A C:\Users\AD\Desktop\defogger_disable.log
2012-07-18 23:23 - 2012-07-18 23:23 - 00000000 ____A C:\Users\AD\defogger_reenable
2012-07-18 23:20 - 2012-07-18 23:20 - 00607260 ____R (Swearware) C:\Users\AD\Desktop\dds.scr
2012-07-18 14:39 - 2012-07-18 14:39 - 00000000 ____D C:\Program Files (x86)\World of Warcraft
2012-07-18 00:06 - 2012-07-18 14:54 - 00001168 ____A C:\Windows\PFRO.log
2012-07-17 23:55 - 2012-07-18 00:03 - 00000000 ____D C:\Program Files (x86)\WhatsRunning
2012-07-17 23:55 - 2012-07-17 23:55 - 01156877 ____A (WhatsRunning.net ) C:\Users\AD\Downloads\WhatsRunning2_2_Setup.exe
2012-07-17 23:55 - 2012-07-17 23:55 - 00000983 ____A C:\Users\AD\Desktop\What's Running.lnk
2012-07-17 23:46 - 2012-07-18 23:18 - 00001354 ____A C:\Windows\setupact.log
2012-07-17 23:46 - 2012-07-17 23:46 - 00000000 ____A C:\Windows\setuperr.log
2012-07-17 22:18 - 2012-07-17 22:18 - 00000081 ____A C:\Users\AD\Desktop\TRATRAPS.Gen2 Virus Removal.URL
2012-07-17 22:16 - 2012-07-17 22:17 - 00881486 ____A C:\Users\AD\Desktop\SecurityCheck.exe
2012-07-17 22:16 - 2012-07-17 22:16 - 00050477 ____A C:\Users\AD\Desktop\Defogger.exe
2012-07-17 20:59 - 2012-07-17 20:59 - 00000000 ____D C:\Users\AD\AppData\Roaming\SUPERAntiSpyware.com
2012-07-17 20:58 - 2012-07-17 20:59 - 00000000 ____D C:\Program Files\SUPERAntiSpyware
2012-07-17 20:58 - 2012-07-17 20:58 - 00001808 ____A C:\Users\Public\Desktop\SUPERAntiSpyware Free Edition.lnk
2012-07-17 20:58 - 2012-07-17 20:58 - 00000000 ____D C:\Users\All Users\SUPERAntiSpyware.com
2012-07-17 20:48 - 2012-07-17 20:48 - 00000000 ____D C:\TDSSKiller_Quarantine
2012-07-17 15:33 - 2012-07-17 15:33 - 00000000 ____D C:\Users\AD\AppData\Roaming\Avira
2012-07-17 15:31 - 2012-07-17 15:31 - 03313664 ____A (Avira GmbH) C:\Users\AD\Downloads\bootwizard.exe
2012-07-17 15:26 - 2012-07-17 15:26 - 00002066 ____A C:\Users\Public\Desktop\Avira Control Center.lnk
2012-07-17 15:26 - 2012-07-17 15:26 - 00000000 ____D C:\Users\All Users\Avira
2012-07-17 15:26 - 2012-07-17 15:26 - 00000000 ____D C:\Program Files (x86)\Avira
2012-07-17 15:26 - 2012-05-02 14:24 - 00027760 ____A (Avira GmbH) C:\Windows\System32\Drivers\avkmgr.sys
2012-07-17 15:26 - 2012-04-27 09:20 - 00132832 ____A (Avira GmbH) C:\Windows\System32\Drivers\avipbb.sys
2012-07-17 15:26 - 2012-04-24 23:32 - 00098848 ____A (Avira GmbH) C:\Windows\System32\Drivers\avgntflt.sys
2012-07-17 15:19 - 2012-07-17 15:19 - 00920096 ____A C:\Users\AD\Downloads\Norton_Removal_Tool(1).exe
2012-07-17 15:15 - 2012-07-17 15:15 - 16409960 ____A (Safer Networking Limited ) C:\Users\AD\Downloads\spybotsd162.exe
2012-07-17 15:14 - 2012-07-17 15:14 - 00001109 ____A C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2012-07-17 15:14 - 2012-07-17 15:14 - 00000000 ____D C:\Users\All Users\Malwarebytes
2012-07-17 15:14 - 2012-07-17 15:14 - 00000000 ____D C:\Users\AD\AppData\Roaming\Malwarebytes
2012-07-17 15:14 - 2012-07-17 15:14 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2012-07-17 15:14 - 2012-07-03 12:46 - 00024904 ____A (Malwarebytes Corporation) C:\Windows\System32\Drivers\mbam.sys
2012-07-17 15:13 - 2012-07-17 15:13 - 10652120 ____A (Malwarebytes Corporation ) C:\Users\AD\Downloads\mbam-setup-1.62.0.1300.exe
2012-07-17 15:11 - 2012-07-17 15:11 - 00000822 ____A C:\Users\Public\Desktop\CCleaner.lnk
2012-07-17 15:10 - 2012-07-17 15:11 - 00000000 ____D C:\Program Files\CCleaner
2012-07-17 15:10 - 2012-07-17 15:10 - 03889704 ____A (Piriform Ltd) C:\Users\AD\Downloads\ccsetup320.exe
2012-07-17 15:02 - 2012-07-17 15:02 - 00920096 ____A C:\Users\AD\Downloads\Norton_Removal_Tool.exe
2012-07-17 14:54 - 2012-07-17 14:56 - 99218336 ____A C:\Users\AD\Downloads\avira_free_antivirus_en.exe
2012-07-16 02:15 - 2012-06-11 19:08 - 03148800 ____A (Microsoft Corporation) C:\Windows\System32\win32k.sys
2012-07-16 02:10 - 2012-06-02 04:49 - 17807360 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2012-07-16 02:10 - 2012-06-02 04:17 - 10924032 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2012-07-16 02:10 - 2012-06-02 04:12 - 02311680 ____A (Microsoft Corporation) C:\Windows\System32\jscript9.dll
2012-07-16 02:10 - 2012-06-02 04:05 - 01392128 ____A (Microsoft Corporation) C:\Windows\System32\wininet.dll
2012-07-16 02:10 - 2012-06-02 04:05 - 01346048 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2012-07-16 02:10 - 2012-06-02 04:04 - 01494528 ____A (Microsoft Corporation) C:\Windows\System32\inetcpl.cpl
2012-07-16 02:10 - 2012-06-02 04:04 - 00237056 ____A (Microsoft Corporation) C:\Windows\System32\url.dll
2012-07-16 02:10 - 2012-06-02 04:03 - 00085504 ____A (Microsoft Corporation) C:\Windows\System32\jsproxy.dll
2012-07-16 02:10 - 2012-06-02 04:01 - 00173056 ____A (Microsoft Corporation) C:\Windows\System32\ieUnatt.exe
2012-07-16 02:10 - 2012-06-02 04:00 - 00818688 ____A (Microsoft Corporation) C:\Windows\System32\jscript.dll
2012-07-16 02:10 - 2012-06-02 03:59 - 02144768 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2012-07-16 02:10 - 2012-06-02 03:57 - 02382848 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2012-07-16 02:10 - 2012-06-02 03:57 - 00096768 ____A (Microsoft Corporation) C:\Windows\System32\mshtmled.dll
2012-07-16 02:10 - 2012-06-02 03:54 - 00248320 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll
2012-07-16 02:10 - 2012-06-02 01:07 - 12314624 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2012-07-16 02:10 - 2012-06-02 00:43 - 09737728 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2012-07-16 02:10 - 2012-06-02 00:33 - 01800192 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2012-07-16 02:10 - 2012-06-02 00:26 - 01103872 ____A (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2012-07-16 02:10 - 2012-06-02 00:25 - 01427968 ____A (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2012-07-16 02:10 - 2012-06-02 00:25 - 01129472 ____A (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2012-07-16 02:10 - 2012-06-02 00:23 - 00231936 ____A (Microsoft Corporation) C:\Windows\SysWOW64\url.dll
2012-07-16 02:10 - 2012-06-02 00:21 - 00065024 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2012-07-16 02:10 - 2012-06-02 00:20 - 00142848 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2012-07-16 02:10 - 2012-06-02 00:19 - 01793024 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2012-07-16 02:10 - 2012-06-02 00:19 - 00716800 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2012-07-16 02:10 - 2012-06-02 00:17 - 00073216 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2012-07-16 02:10 - 2012-06-02 00:16 - 02382848 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2012-07-16 02:10 - 2012-06-02 00:14 - 00176640 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2012-07-16 02:08 - 2012-07-16 02:08 - 00000000 ____D C:\Users\AD\AppData\Roaming\TeamViewer
2012-07-16 02:06 - 2012-07-16 02:06 - 03611000 ____A (TeamViewer GmbH) C:\Users\AD\Downloads\TeamViewer_Setup_en.exe
2012-07-16 00:46 - 2012-07-16 00:46 - 00000000 ____D C:\Users\AD\AppData\Roaming\InstallShield
2012-07-16 00:46 - 2011-05-20 08:53 - 00557848 ____A (Intel Corporation) C:\Windows\System32\Drivers\iaStor.sys
2012-07-16 00:45 - 2012-07-16 00:44 - 09888360 ____A (Realtek Semiconductor Corp.) C:\Windows\SysWOW64\RtsPStorIcon.dll
2012-07-16 00:39 - 2012-07-16 00:39 - 00208896 ____A (Renesas Electronics Corporation) C:\Windows\System32\Drivers\nusb3xhc.sys
2012-07-16 00:39 - 2012-07-16 00:39 - 00091648 ____A (Renesas Electronics Corporation) C:\Windows\System32\Drivers\nusb3hub.sys
2012-07-16 00:39 - 2012-07-16 00:39 - 00081920 ____A (Renesas Electronics Corporation) C:\Windows\System32\nusb3co2.dll
2012-07-16 00:38 - 2012-07-16 00:37 - 01451056 ____A (Synaptics Incorporated) C:\Windows\System32\Drivers\SynTP.sys
2012-07-16 00:38 - 2012-07-16 00:37 - 00276264 ____A (Synaptics Incorporated) C:\Windows\System32\SynCtrl.dll
2012-07-16 00:38 - 2012-07-16 00:37 - 00226600 ____A (Synaptics Incorporated) C:\Windows\System32\SET8EF0.tmp
2012-07-16 00:38 - 2012-07-16 00:37 - 00222504 ____A (Synaptics Incorporated) C:\Windows\SysWOW64\SynCtrl.dll
2012-07-16 00:38 - 2012-07-16 00:37 - 00177448 ____A (Synaptics Incorporated) C:\Windows\SysWOW64\SynCOM.dll
2012-07-16 00:38 - 2012-07-16 00:37 - 00148264 ____A (Synaptics Incorporated) C:\Windows\System32\SynTPCo9.dll
2012-07-16 00:38 - 2012-07-16 00:37 - 00107816 ____A (Synaptics Incorporated) C:\Windows\SysWOW64\SynTPCOM.dll
2012-07-16 00:38 - 2012-07-16 00:37 - 00066856 ____A C:\Windows\SysWOW64\SynTPEnhPS.dll
2012-07-15 16:36 - 2012-06-08 21:43 - 14172672 ____A (Microsoft Corporation) C:\Windows\System32\shell32.dll
2012-07-15 16:36 - 2012-06-08 20:41 - 12873728 ____A (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2012-07-15 16:36 - 2012-06-05 22:06 - 02004480 ____A (Microsoft Corporation) C:\Windows\System32\msxml6.dll
2012-07-15 16:36 - 2012-06-05 22:06 - 01881600 ____A (Microsoft Corporation) C:\Windows\System32\msxml3.dll
2012-07-15 16:36 - 2012-06-05 22:02 - 01133568 ____A (Microsoft Corporation) C:\Windows\System32\cdosys.dll
2012-07-15 16:36 - 2012-06-05 21:05 - 01390080 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msxml6.dll
2012-07-15 16:36 - 2012-06-05 21:05 - 01236992 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msxml3.dll
2012-07-15 16:36 - 2012-06-05 21:03 - 00805376 ____A (Microsoft Corporation) C:\Windows\SysWOW64\cdosys.dll
2012-07-15 16:36 - 2012-06-01 21:50 - 00458704 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\cng.sys
2012-07-15 16:36 - 2012-06-01 21:48 - 00151920 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\ksecpkg.sys
2012-07-15 16:36 - 2012-06-01 21:48 - 00095600 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\ksecdd.sys
2012-07-15 16:36 - 2012-06-01 21:45 - 00340992 ____A (Microsoft Corporation) C:\Windows\System32\schannel.dll
2012-07-15 16:36 - 2012-06-01 21:44 - 00307200 ____A (Microsoft Corporation) C:\Windows\System32\ncrypt.dll
2012-07-15 16:36 - 2012-06-01 20:40 - 00225280 ____A (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2012-07-15 16:36 - 2012-06-01 20:40 - 00022016 ____A (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2012-07-15 16:36 - 2012-06-01 20:39 - 00219136 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2012-07-15 16:36 - 2012-06-01 20:34 - 00096768 ____A (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2012-07-15 16:36 - 2010-06-25 19:55 - 00002048 ____A (Microsoft Corporation) C:\Windows\System32\msxml3r.dll
2012-07-15 16:36 - 2010-06-25 19:24 - 00002048 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msxml3r.dll
2012-07-15 02:42 - 2012-07-15 02:42 - 00000000 ____D C:\Users\AD\AppData\Local\Sunbelt Software
2012-07-15 02:40 - 2012-07-15 02:42 - 00000000 ____D C:\Users\AD\AppData\Local\Google
2012-07-15 02:40 - 2012-07-15 02:41 - 00000000 ____D C:\Program Files (x86)\Google
2012-07-15 02:39 - 2012-07-15 02:45 - 00000000 ____D C:\Users\All Users\Lavasoft
2012-07-15 02:39 - 2012-07-15 02:39 - 00000000 ____D C:\Program Files (x86)\Lavasoft
2012-07-15 02:37 - 2012-07-15 02:37 - 00000000 ____D C:\Users\All Users\Iminent
2012-07-15 02:37 - 2012-07-15 02:37 - 00000000 ____D C:\Users\AD\AppData\Roaming\Iminent
2012-07-15 02:36 - 2012-07-15 16:24 - 00000000 ____D C:\Program Files (x86)\Iminent
2012-07-15 01:12 - 2012-07-15 01:12 - 00000000 ____D C:\Users\AD\AppData\Local\VS Revo Group
2012-07-15 01:11 - 2012-07-15 01:11 - 00000000 ____D C:\Program Files\VS Revo Group
2012-07-14 04:35 - 2012-07-15 16:24 - 00000000 __HDC C:\Users\All Users\{2162CCC0-3A5F-4887-B51F-CE5F195B3620}
2012-07-14 04:15 - 2012-07-15 16:24 - 00000000 ____D C:\Program Files (x86)\WhiteSmoke_US
2012-07-14 04:15 - 2012-07-14 04:15 - 00000009 ____A C:\END
2012-07-14 04:15 - 2012-07-14 04:15 - 00000000 ____D C:\Users\AD\AppData\Roaming\Uniblue
2012-07-14 04:15 - 2012-07-14 04:15 - 00000000 ____D C:\Program Files (x86)\Uniblue
2012-07-14 04:12 - 2012-07-14 04:12 - 00370064 ____A C:\Users\AD\Downloads\ad-awareSetup.exe
2012-07-14 04:10 - 2012-07-14 04:10 - 00020689 ____N C:\Users\AD\Downloads\gsusp_E2F43793CBAD_071412_051056.zip
2012-07-14 04:07 - 2012-07-14 04:10 - 00004221 ____A C:\Users\AD\Downloads\GetSusp.xml
2012-07-14 04:06 - 2012-07-14 04:35 - 00000049 ___RH C:\Users\AD\Downloads\GetSusp.opt
2012-07-14 02:22 - 2012-07-18 23:22 - 00000000 ____D C:\Users\All Users\Spybot - Search & Destroy
2012-07-14 02:22 - 2012-07-18 23:22 - 00000000 ____D C:\Program Files (x86)\Spybot - Search & Destroy
2012-07-08 00:13 - 2012-07-08 00:13 - 00000000 ____D C:\Users\AD\AppData\Roaming\Tific
2012-07-08 00:13 - 2012-07-08 00:13 - 00000000 ____D C:\Users\AD\AppData\Local\Symantec
2012-07-07 01:20 - 2012-07-15 16:19 - 00000000 __SHD C:\Windows\SysWOW64\%APPDATA%
2012-07-01 23:58 - 2012-07-01 23:58 - 00000000 ____D C:\Users\AD\AppData\Local\Macromedia
2012-06-19 23:36 - 2012-06-02 14:19 - 02428952 ____A (Microsoft Corporation) C:\Windows\System32\wuaueng.dll
2012-06-19 23:36 - 2012-06-02 14:19 - 00701976 ____A (Microsoft Corporation) C:\Windows\System32\wuapi.dll
2012-06-19 23:36 - 2012-06-02 14:19 - 00057880 ____A (Microsoft Corporation) C:\Windows\System32\wuauclt.exe
2012-06-19 23:36 - 2012-06-02 14:19 - 00044056 ____A (Microsoft Corporation) C:\Windows\System32\wups2.dll
2012-06-19 23:36 - 2012-06-02 14:19 - 00038424 ____A (Microsoft Corporation) C:\Windows\System32\wups.dll
2012-06-19 23:36 - 2012-06-02 14:15 - 02622464 ____A (Microsoft Corporation) C:\Windows\System32\wucltux.dll
2012-06-19 23:36 - 2012-06-02 14:15 - 00099840 ____A (Microsoft Corporation) C:\Windows\System32\wudriver.dll
2012-06-19 23:35 - 2012-06-02 14:19 - 00186752 ____A (Microsoft Corporation) C:\Windows\System32\wuwebv.dll
2012-06-19 23:35 - 2012-06-02 14:15 - 00036864 ____A (Microsoft Corporation) C:\Windows\System32\wuapp.exe


============ 3 Months Modified Files ========================

2012-07-19 00:01 - 2011-10-20 15:25 - 01414415 ____A C:\Windows\WindowsUpdate.log
2012-07-18 23:55 - 2012-04-22 00:27 - 00000830 ____A C:\Windows\Tasks\Adobe Flash Player Updater.job
2012-07-18 23:44 - 2012-07-18 23:44 - 04579127 ____R (Swearware) C:\Users\AD\Desktop\ComboFix.exe
2012-07-18 23:28 - 2012-07-18 23:28 - 00027354 ____A C:\Users\AD\Desktop\DDS.txt
2012-07-18 23:28 - 2012-07-18 23:28 - 00016973 ____A C:\Users\AD\Desktop\Attach.txt
2012-07-18 23:26 - 2012-07-18 23:26 - 00001095 ____A C:\Users\AD\Desktop\checkup.txt
2012-07-18 23:24 - 2009-07-13 20:45 - 00032064 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2012-07-18 23:24 - 2009-07-13 20:45 - 00032064 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2012-07-18 23:23 - 2012-07-18 23:23 - 00000466 ____A C:\Users\AD\Desktop\defogger_disable.log
2012-07-18 23:23 - 2012-07-18 23:23 - 00000000 ____A C:\Users\AD\defogger_reenable
2012-07-18 23:20 - 2012-07-18 23:20 - 00607260 ____R (Swearware) C:\Users\AD\Desktop\dds.scr
2012-07-18 23:20 - 2009-07-13 21:13 - 00730448 ____A C:\Windows\System32\PerfStringBackup.INI
2012-07-18 23:18 - 2012-07-17 23:46 - 00001354 ____A C:\Windows\setupact.log
2012-07-18 23:15 - 2009-07-13 21:08 - 00000006 ___AH C:\Windows\Tasks\SA.DAT
2012-07-18 14:54 - 2012-07-18 00:06 - 00001168 ____A C:\Windows\PFRO.log
2012-07-17 23:55 - 2012-07-17 23:55 - 01156877 ____A (WhatsRunning.net ) C:\Users\AD\Downloads\WhatsRunning2_2_Setup.exe
2012-07-17 23:55 - 2012-07-17 23:55 - 00000983 ____A C:\Users\AD\Desktop\What's Running.lnk
2012-07-17 23:46 - 2012-07-17 23:46 - 00000000 ____A C:\Windows\setuperr.log
2012-07-17 22:18 - 2012-07-17 22:18 - 00000081 ____A C:\Users\AD\Desktop\TRATRAPS.Gen2 Virus Removal.URL
2012-07-17 22:17 - 2012-07-17 22:16 - 00881486 ____A C:\Users\AD\Desktop\SecurityCheck.exe
2012-07-17 22:16 - 2012-07-17 22:16 - 00050477 ____A C:\Users\AD\Desktop\Defogger.exe
2012-07-17 20:58 - 2012-07-17 20:58 - 00001808 ____A C:\Users\Public\Desktop\SUPERAntiSpyware Free Edition.lnk
2012-07-17 15:31 - 2012-07-17 15:31 - 03313664 ____A (Avira GmbH) C:\Users\AD\Downloads\bootwizard.exe
2012-07-17 15:26 - 2012-07-17 15:26 - 00002066 ____A C:\Users\Public\Desktop\Avira Control Center.lnk
2012-07-17 15:19 - 2012-07-17 15:19 - 00920096 ____A C:\Users\AD\Downloads\Norton_Removal_Tool(1).exe
2012-07-17 15:15 - 2012-07-17 15:15 - 16409960 ____A (Safer Networking Limited ) C:\Users\AD\Downloads\spybotsd162.exe
2012-07-17 15:14 - 2012-07-17 15:14 - 00001109 ____A C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2012-07-17 15:13 - 2012-07-17 15:13 - 10652120 ____A (Malwarebytes Corporation ) C:\Users\AD\Downloads\mbam-setup-1.62.0.1300.exe
2012-07-17 15:11 - 2012-07-17 15:11 - 00000822 ____A C:\Users\Public\Desktop\CCleaner.lnk
2012-07-17 15:10 - 2012-07-17 15:10 - 03889704 ____A (Piriform Ltd) C:\Users\AD\Downloads\ccsetup320.exe
2012-07-17 15:02 - 2012-07-17 15:02 - 00920096 ____A C:\Users\AD\Downloads\Norton_Removal_Tool.exe
2012-07-17 14:56 - 2012-07-17 14:54 - 99218336 ____A C:\Users\AD\Downloads\avira_free_antivirus_en.exe
2012-07-16 02:27 - 2009-07-13 20:45 - 00415072 ____A C:\Windows\System32\FNTCACHE.DAT
2012-07-16 02:14 - 2012-02-17 17:11 - 00000208 ____A C:\Windows\System32\MRT.INI
2012-07-16 02:11 - 2011-11-29 17:38 - 59701280 ____A (Microsoft Corporation) C:\Windows\System32\MRT.exe
2012-07-16 02:06 - 2012-07-16 02:06 - 03611000 ____A (TeamViewer GmbH) C:\Users\AD\Downloads\TeamViewer_Setup_en.exe
2012-07-16 02:06 - 2011-12-05 20:00 - 00000052 ____A C:\Windows\SysWOW64\DOErrors.log
2012-07-16 00:59 - 2011-10-20 15:37 - 00029480 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msxml3a.dll
2012-07-16 00:59 - 2003-03-18 19:14 - 00505128 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msvcp71.dll
2012-07-16 00:59 - 2003-02-21 03:42 - 00353576 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msvcr71.dll
2012-07-16 00:44 - 2012-07-16 00:45 - 09888360 ____A (Realtek Semiconductor Corp.) C:\Windows\SysWOW64\RtsPStorIcon.dll
2012-07-16 00:44 - 2011-10-20 15:23 - 00338536 ____A (Realtek Semiconductor Corp.) C:\Windows\System32\Drivers\RtsPStor.sys
2012-07-16 00:39 - 2012-07-16 00:39 - 00208896 ____A (Renesas Electronics Corporation) C:\Windows\System32\Drivers\nusb3xhc.sys
2012-07-16 00:39 - 2012-07-16 00:39 - 00091648 ____A (Renesas Electronics Corporation) C:\Windows\System32\Drivers\nusb3hub.sys
2012-07-16 00:39 - 2012-07-16 00:39 - 00081920 ____A (Renesas Electronics Corporation) C:\Windows\System32\nusb3co2.dll
2012-07-16 00:37 - 2012-07-16 00:38 - 01451056 ____A (Synaptics Incorporated) C:\Windows\System32\Drivers\SynTP.sys
2012-07-16 00:37 - 2012-07-16 00:38 - 00276264 ____A (Synaptics Incorporated) C:\Windows\System32\SynCtrl.dll
2012-07-16 00:37 - 2012-07-16 00:38 - 00226600 ____A (Synaptics Incorporated) C:\Windows\System32\SET8EF0.tmp
2012-07-16 00:37 - 2012-07-16 00:38 - 00222504 ____A (Synaptics Incorporated) C:\Windows\SysWOW64\SynCtrl.dll
2012-07-16 00:37 - 2012-07-16 00:38 - 00177448 ____A (Synaptics Incorporated) C:\Windows\SysWOW64\SynCOM.dll
2012-07-16 00:37 - 2012-07-16 00:38 - 00148264 ____A (Synaptics Incorporated) C:\Windows\System32\SynTPCo9.dll
2012-07-16 00:37 - 2012-07-16 00:38 - 00107816 ____A (Synaptics Incorporated) C:\Windows\SysWOW64\SynTPCOM.dll
2012-07-16 00:37 - 2012-07-16 00:38 - 00066856 ____A C:\Windows\SysWOW64\SynTPEnhPS.dll
2012-07-16 00:37 - 2010-12-16 18:26 - 00411944 ____A (Synaptics Incorporated) C:\Windows\System32\SynCOM.dll
2012-07-16 00:08 - 2012-04-22 00:27 - 00426184 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2012-07-16 00:08 - 2012-04-22 00:27 - 00070344 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2012-07-14 04:35 - 2012-07-14 04:06 - 00000049 ___RH C:\Users\AD\Downloads\GetSusp.opt
2012-07-14 04:15 - 2012-07-14 04:15 - 00000009 ____A C:\END
2012-07-14 04:12 - 2012-07-14 04:12 - 00370064 ____A C:\Users\AD\Downloads\ad-awareSetup.exe
2012-07-14 04:10 - 2012-07-14 04:10 - 00020689 ____N C:\Users\AD\Downloads\gsusp_E2F43793CBAD_071412_051056.zip
2012-07-14 04:10 - 2012-07-14 04:07 - 00004221 ____A C:\Users\AD\Downloads\GetSusp.xml
2012-07-05 23:10 - 2009-07-13 21:08 - 00032566 ____A C:\Windows\Tasks\SCHEDLGU.TXT
2012-07-03 12:46 - 2012-07-17 15:14 - 00024904 ____A (Malwarebytes Corporation) C:\Windows\System32\Drivers\mbam.sys
2012-06-26 04:34 - 2011-12-08 22:54 - 00000320 ____A C:\Windows\Tasks\HPCeeScheduleForAD.job
2012-06-11 19:08 - 2012-07-16 02:15 - 03148800 ____A (Microsoft Corporation) C:\Windows\System32\win32k.sys
2012-06-08 21:43 - 2012-07-15 16:36 - 14172672 ____A (Microsoft Corporation) C:\Windows\System32\shell32.dll
2012-06-08 20:41 - 2012-07-15 16:36 - 12873728 ____A (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2012-06-05 22:06 - 2012-07-15 16:36 - 02004480 ____A (Microsoft Corporation) C:\Windows\System32\msxml6.dll
2012-06-05 22:06 - 2012-07-15 16:36 - 01881600 ____A (Microsoft Corporation) C:\Windows\System32\msxml3.dll
2012-06-05 22:02 - 2012-07-15 16:36 - 01133568 ____A (Microsoft Corporation) C:\Windows\System32\cdosys.dll
2012-06-05 21:05 - 2012-07-15 16:36 - 01390080 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msxml6.dll
2012-06-05 21:05 - 2012-07-15 16:36 - 01236992 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msxml3.dll
2012-06-05 21:03 - 2012-07-15 16:36 - 00805376 ____A (Microsoft Corporation) C:\Windows\SysWOW64\cdosys.dll
2012-06-02 14:19 - 2012-06-19 23:36 - 02428952 ____A (Microsoft Corporation) C:\Windows\System32\wuaueng.dll
2012-06-02 14:19 - 2012-06-19 23:36 - 00701976 ____A (Microsoft Corporation) C:\Windows\System32\wuapi.dll
2012-06-02 14:19 - 2012-06-19 23:36 - 00057880 ____A (Microsoft Corporation) C:\Windows\System32\wuauclt.exe
2012-06-02 14:19 - 2012-06-19 23:36 - 00044056 ____A (Microsoft Corporation) C:\Windows\System32\wups2.dll
2012-06-02 14:19 - 2012-06-19 23:36 - 00038424 ____A (Microsoft Corporation) C:\Windows\System32\wups.dll
2012-06-02 14:19 - 2012-06-19 23:35 - 00186752 ____A (Microsoft Corporation) C:\Windows\System32\wuwebv.dll
2012-06-02 14:15 - 2012-06-19 23:36 - 02622464 ____A (Microsoft Corporation) C:\Windows\System32\wucltux.dll
2012-06-02 14:15 - 2012-06-19 23:36 - 00099840 ____A (Microsoft Corporation) C:\Windows\System32\wudriver.dll
2012-06-02 14:15 - 2012-06-19 23:35 - 00036864 ____A (Microsoft Corporation) C:\Windows\System32\wuapp.exe
2012-06-02 04:49 - 2012-07-16 02:10 - 17807360 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2012-06-02 04:17 - 2012-07-16 02:10 - 10924032 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2012-06-02 04:12 - 2012-07-16 02:10 - 02311680 ____A (Microsoft Corporation) C:\Windows\System32\jscript9.dll
2012-06-02 04:05 - 2012-07-16 02:10 - 01392128 ____A (Microsoft Corporation) C:\Windows\System32\wininet.dll
2012-06-02 04:05 - 2012-07-16 02:10 - 01346048 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2012-06-02 04:04 - 2012-07-16 02:10 - 01494528 ____A (Microsoft Corporation) C:\Windows\System32\inetcpl.cpl
2012-06-02 04:04 - 2012-07-16 02:10 - 00237056 ____A (Microsoft Corporation) C:\Windows\System32\url.dll
2012-06-02 04:03 - 2012-07-16 02:10 - 00085504 ____A (Microsoft Corporation) C:\Windows\System32\jsproxy.dll
2012-06-02 04:01 - 2012-07-16 02:10 - 00173056 ____A (Microsoft Corporation) C:\Windows\System32\ieUnatt.exe
2012-06-02 04:00 - 2012-07-16 02:10 - 00818688 ____A (Microsoft Corporation) C:\Windows\System32\jscript.dll
2012-06-02 03:59 - 2012-07-16 02:10 - 02144768 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2012-06-02 03:57 - 2012-07-16 02:10 - 02382848 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2012-06-02 03:57 - 2012-07-16 02:10 - 00096768 ____A (Microsoft Corporation) C:\Windows\System32\mshtmled.dll
2012-06-02 03:54 - 2012-07-16 02:10 - 00248320 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll
2012-06-02 01:07 - 2012-07-16 02:10 - 12314624 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2012-06-02 00:43 - 2012-07-16 02:10 - 09737728 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2012-06-02 00:33 - 2012-07-16 02:10 - 01800192 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2012-06-02 00:26 - 2012-07-16 02:10 - 01103872 ____A (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2012-06-02 00:25 - 2012-07-16 02:10 - 01427968 ____A (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2012-06-02 00:25 - 2012-07-16 02:10 - 01129472 ____A (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2012-06-02 00:23 - 2012-07-16 02:10 - 00231936 ____A (Microsoft Corporation) C:\Windows\SysWOW64\url.dll
2012-06-02 00:21 - 2012-07-16 02:10 - 00065024 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2012-06-02 00:20 - 2012-07-16 02:10 - 00142848 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2012-06-02 00:19 - 2012-07-16 02:10 - 01793024 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2012-06-02 00:19 - 2012-07-16 02:10 - 00716800 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2012-06-02 00:17 - 2012-07-16 02:10 - 00073216 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2012-06-02 00:16 - 2012-07-16 02:10 - 02382848 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2012-06-02 00:14 - 2012-07-16 02:10 - 00176640 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2012-06-01 21:50 - 2012-07-15 16:36 - 00458704 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\cng.sys
2012-06-01 21:48 - 2012-07-15 16:36 - 00151920 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\ksecpkg.sys
2012-06-01 21:48 - 2012-07-15 16:36 - 00095600 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\ksecdd.sys
2012-06-01 21:45 - 2012-07-15 16:36 - 00340992 ____A (Microsoft Corporation) C:\Windows\System32\schannel.dll
2012-06-01 21:44 - 2012-07-15 16:36 - 00307200 ____A (Microsoft Corporation) C:\Windows\System32\ncrypt.dll
2012-06-01 20:40 - 2012-07-15 16:36 - 00225280 ____A (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2012-06-01 20:40 - 2012-07-15 16:36 - 00022016 ____A (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2012-06-01 20:39 - 2012-07-15 16:36 - 00219136 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2012-06-01 20:34 - 2012-07-15 16:36 - 00096768 ____A (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2012-05-07 16:44 - 2012-05-07 16:41 - 00044544 ____A C:\Users\AD\Downloads\Chapter 19 (5)
2012-05-07 16:42 - 2012-05-07 16:42 - 00050688 ____A C:\Users\AD\Downloads\Chapter 19 (9)
2012-05-07 16:42 - 2012-05-07 16:42 - 00040960 ____A C:\Users\AD\Downloads\Chapter 19 (7)
2012-05-07 16:42 - 2012-05-07 16:42 - 00039424 ____A C:\Users\AD\Downloads\Chapter 19 (8)
2012-05-07 16:41 - 2012-05-07 16:41 - 00045568 ____A C:\Users\AD\Downloads\Chapter 19 (6)
2012-05-04 03:06 - 2012-06-13 22:58 - 05559664 ____A (Microsoft Corporation) C:\Windows\System32\ntoskrnl.exe
2012-05-04 02:03 - 2012-06-13 22:58 - 03968368 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2012-05-04 02:03 - 2012-06-13 22:58 - 03913072 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2012-05-02 14:24 - 2012-07-17 15:26 - 00027760 ____A (Avira GmbH) C:\Windows\System32\Drivers\avkmgr.sys
2012-04-30 21:40 - 2012-06-16 02:25 - 00209920 ____A (Microsoft Corporation) C:\Windows\System32\profsvc.dll
2012-04-27 19:55 - 2012-06-16 02:25 - 00210944 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\rdpwd.sys
2012-04-27 09:20 - 2012-07-17 15:26 - 00132832 ____A (Avira GmbH) C:\Windows\System32\Drivers\avipbb.sys
2012-04-25 21:41 - 2012-06-16 02:25 - 00149504 ____A (Microsoft Corporation) C:\Windows\System32\rdpcorekmts.dll
2012-04-25 21:41 - 2012-06-16 02:25 - 00077312 ____A (Microsoft Corporation) C:\Windows\System32\rdpwsx.dll
2012-04-25 21:34 - 2012-06-16 02:25 - 00009216 ____A (Microsoft Corporation) C:\Windows\System32\rdrmemptylst.exe
2012-04-25 13:02 - 2012-04-25 13:02 - 00043800 ____A (Hewlett-Packard Company) C:\Windows\System32\Drivers\Accelerometer.sys
2012-04-25 13:02 - 2012-04-25 13:02 - 00031000 ____A (Hewlett-Packard Company) C:\Windows\System32\SETA732.tmp
2012-04-25 13:02 - 2012-04-25 13:02 - 00021272 ____A (Hewlett-Packard Company) C:\Windows\System32\SETA771.tmp
2012-04-25 13:02 - 2012-04-25 13:02 - 00018200 ____A (Hewlett-Packard Company) C:\Windows\System32\SETA7A1.tmp
2012-04-25 13:02 - 2011-01-26 15:01 - 00030488 ____A (Hewlett-Packard Company) C:\Windows\System32\Drivers\hpdskflt.sys
2012-04-24 23:32 - 2012-07-17 15:26 - 00098848 ____A (Avira GmbH) C:\Windows\System32\Drivers\avgntflt.sys
2012-04-23 21:37 - 2012-06-16 02:24 - 01462272 ____A (Microsoft Corporation) C:\Windows\System32\crypt32.dll
2012-04-23 21:37 - 2012-06-16 02:24 - 00184320 ____A (Microsoft Corporation) C:\Windows\System32\cryptsvc.dll
2012-04-23 21:37 - 2012-06-16 02:24 - 00140288 ____A (Microsoft Corporation) C:\Windows\System32\cryptnet.dll
2012-04-23 20:36 - 2012-06-16 02:24 - 01158656 ____A (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2012-04-23 20:36 - 2012-06-16 02:24 - 00140288 ____A (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll
2012-04-23 20:36 - 2012-06-16 02:24 - 00103936 ____A (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll

ZeroAccess:
C:\Windows\Installer\{d0818f21-ca0c-6e85-b406-72e97df544a7}
C:\Windows\Installer\{d0818f21-ca0c-6e85-b406-72e97df544a7}\L
C:\Windows\Installer\{d0818f21-ca0c-6e85-b406-72e97df544a7}\U

ZeroAccess:
C:\Windows\assembly\GAC_32\Desktop.ini

ZeroAccess:
C:\Windows\assembly\GAC_64\Desktop.ini

========================= Known DLLs (Whitelisted) ============


========================= Bamital & volsnap Check ============

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe 50BEA589F7D7958BDD2528A8F69D05CC ZeroAccess <==== ATTENTION!.
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

==================== EXE ASSOCIATION =====================

HKLM\...\.exe: exefile => OK
HKLM\...\exefile\DefaultIcon: %1 => OK
HKLM\...\exefile\open\command: "%1" %* => OK

========================= Memory info ======================

Percentage of memory in use: 18%
Total physical RAM: 4043.86 MB
Available physical RAM: 3311.39 MB
Total Pagefile: 4042.01 MB
Available Pagefile: 3296.3 MB
Total Virtual: 8192 MB
Available Virtual: 8191.9 MB

======================= Partitions =========================

1 Drive c: () (Fixed) (Total:579.04 GB) (Free:525.57 GB) NTFS ==>[System with boot components (obtained from reading drive)]
2 Drive e: (RECOVERY) (Fixed) (Total:16.83 GB) (Free:1.84 GB) NTFS ==>[System with boot components (obtained from reading drive)]
3 Drive f: (HP_TOOLS) (Fixed) (Total:0.1 GB) (Free:0.09 GB) FAT32
5 Drive h: () (Removable) (Total:3.72 GB) (Free:3.72 GB) FAT32
6 Drive x: (Boot) (Fixed) (Total:0.25 GB) (Free:0.25 GB) NTFS
7 Drive y: (SYSTEM) (Fixed) (Total:0.19 GB) (Free:0.16 GB) NTFS ==>[System with boot components (obtained from reading drive)]

Disk ### Status Size Free Dyn Gpt
-------- ------------- ------- ------- --- ---
Disk 0 Online 596 GB 0 B
Disk 1 Online 3820 MB 0 B

Partitions of Disk 0:
===============

Partition ### Type Size Offset
------------- ---------------- ------- -------
Partition 1 Primary 199 MB 1024 KB
Partition 2 Primary 579 GB 200 MB
Partition 3 Primary 16 GB 579 GB
Partition 4 Primary 103 MB 596 GB

==================================================================================

Disk: 0
Partition 1
Type : 07
Hidden: No
Active: Yes

Volume ### Ltr Label Fs Type Size Status Info
---------- --- ----------- ----- ---------- ------- --------- --------
* Volume 1 Y SYSTEM NTFS Partition 199 MB Healthy

==================================================================================

Disk: 0
Partition 2
Type : 07
Hidden: No
Active: No

Volume ### Ltr Label Fs Type Size Status Info
---------- --- ----------- ----- ---------- ------- --------- --------
* Volume 2 C NTFS Partition 579 GB Healthy

==================================================================================

Disk: 0
Partition 3
Type : 07
Hidden: No
Active: No

Volume ### Ltr Label Fs Type Size Status Info
---------- --- ----------- ----- ---------- ------- --------- --------
* Volume 3 E RECOVERY NTFS Partition 16 GB Healthy

==================================================================================

Disk: 0
Partition 4
Type : 0C
Hidden: No
Active: No

Volume ### Ltr Label Fs Type Size Status Info
---------- --- ----------- ----- ---------- ------- --------- --------
* Volume 4 F HP_TOOLS FAT32 Partition 103 MB Healthy

==================================================================================

Partitions of Disk 1:
===============

Partition ### Type Size Offset
------------- ---------------- ------- -------
Partition 1 Primary 3819 MB 16 KB

==================================================================================

Disk: 1
Partition 1
Type : 0C
Hidden: No
Active: No

Volume ### Ltr Label Fs Type Size Status Info
---------- --- ----------- ----- ---------- ------- --------- --------
* Volume 5 H FAT32 Removable 3819 MB Healthy

==================================================================================

==========================================================

Last Boot: 2012-07-03 22:03

======================= End Of Log ==========================

Greetings

Ok lets see if we can find a replacement for the infected file

In Vista or Windows 7: Boot to System Recovery Options and run FRST.

Type the following in the edit box after "Search:".

services.exe

It then should look like:

Search: services.exe

Click Search button and post the log (Search.txt) it makes to your reply.


Gringo

Alright, here's the log:

Farbar Recovery Scan Tool Version: 16-07-2012 02
Ran by SYSTEM at 2012-07-19 01:13:33
Running from H:\

================== Search: "services.exe" ===================

C:\Windows\winsxs\amd64_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.1.7600.16385_none_2b54b20ee6fa07b1\services.exe
[2009-07-13 15:19] - [2009-07-13 17:39] - 0328704 ____A (Microsoft Corporation) 24ACB7E5BE595468E3B9AA488B9B4FCB

C:\Windows\System32\services.exe
[2009-07-13 15:19] - [2009-07-13 17:39] - 0329216 ____A (Microsoft Corporation) 50BEA589F7D7958BDD2528A8F69D05CC

C:\System Volume Information\SystemRestore\FRStaging\Windows\System32\services.exe
[2009-07-13 15:19] - [2012-07-17 23:41] - 0328704 ____A (Microsoft Corporation) 24ACB7E5BE595468E3B9AA488B9B4FCB

====== End Of Search ======

Hello

Open notepad. Please copy the contents of the code box below. To do this highlight the contents of the box and right click on it. Paste this into the open notepad. Save it on the flash drive as fixlist.txt

Replace: C:\Windows\winsxs\amd64_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.1.7600.16385_none_2b54b20ee6fa07b1\services.exe C:\Windows\System32\services.exe
C:\Windows\Installer\{d0818f21-ca0c-6e85-b406-72e97df544a7}
C:\Windows\assembly\GAC_32\Desktop.ini
C:\Windows\assembly\GAC_64\Desktop.ini 

NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

On Vista or Windows 7: Now please enter System Recovery Options.

Run FRST64 and press the Fix button just once and wait.
The tool will make a log on the flash drive (Fixlog.txt) please post it to your reply.

Gringo[/b]

Hi, here's the log:


Fix result of Farbar Recovery Tool (FRST written by Farbar) Version: 16-07-2012 02
Ran by SYSTEM at 2012-07-19 01:34:52 Run:1
Running from H:\

==============================================

C:\Windows\System32\services.exe moved successfully.
C:\Windows\winsxs\amd64_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.1.7600.16385_none_2b54b20ee6fa07b1\services.exe copied successfully to C:\Windows\System32\services.exe
C:\Windows\Installer\{d0818f21-ca0c-6e85-b406-72e97df544a7} moved successfully.
C:\Windows\assembly\GAC_32\Desktop.ini moved successfully.
C:\Windows\assembly\GAC_64\Desktop.ini moved successfully.

==== End of Fixlog ====

now I would like you to try to run combofix for me



gringo

Hey, it worked!

ComboFix 12-07-16.01 - AD 07/19/2012 1:52.1.8 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.4044.2409 [GMT -7:00]
Running from: c:\users\AD\Desktop\ComboFix.exe
AV: Norton Internet Security *Disabled/Outdated* {63DF5164-9100-186D-2187-8DC619EFD8BF}
FW: Norton Internet Security *Disabled* {5BE4D041-DB6F-1935-0AD8-24F3E73C9FC4}
SP: Norton Internet Security *Disabled/Outdated* {D8BEB080-B73A-17E3-1B37-B6B462689202}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\Installer\{d0818f21-ca0c-6e85-b406-72e97df544a7}\@
c:\windows\Installer\{d0818f21-ca0c-6e85-b406-72e97df544a7}\L\00000004.@
c:\windows\Installer\{d0818f21-ca0c-6e85-b406-72e97df544a7}\L\1afb2d56
c:\windows\Installer\{d0818f21-ca0c-6e85-b406-72e97df544a7}\L\201d3dde
c:\windows\Installer\{d0818f21-ca0c-6e85-b406-72e97df544a7}\U\00000004.@
c:\windows\Installer\{d0818f21-ca0c-6e85-b406-72e97df544a7}\U\00000008.@
c:\windows\Installer\{d0818f21-ca0c-6e85-b406-72e97df544a7}\U\000000cb.@
c:\windows\Installer\{d0818f21-ca0c-6e85-b406-72e97df544a7}\U\80000000.@
c:\windows\Installer\{d0818f21-ca0c-6e85-b406-72e97df544a7}\U\80000032.@
c:\windows\Installer\{d0818f21-ca0c-6e85-b406-72e97df544a7}\U\80000064.@
.
.
((((((((((((((((((((((((( Files Created from 2012-06-19 to 2012-07-19 )))))))))))))))))))))))))))))))
.
.
2012-07-19 09:05 . 2012-07-19 09:05 -------- d-----w- C:\FRST
2012-07-19 08:59 . 2012-07-19 08:59 -------- d-----w- c:\users\Default\AppData\Local\temp
2012-07-18 22:39 . 2012-07-18 22:39 -------- d-----w- c:\program files (x86)\World of Warcraft
2012-07-18 22:39 . 2012-07-18 22:39 -------- d-----w- c:\program files (x86)\Common Files\Blizzard Entertainment
2012-07-18 07:55 . 2012-07-18 08:03 -------- d-----w- c:\program files (x86)\WhatsRunning
2012-07-18 04:59 . 2012-07-18 04:59 -------- d-----w- c:\users\AD\AppData\Roaming\SUPERAntiSpyware.com
2012-07-18 04:58 . 2012-07-18 04:59 -------- d-----w- c:\program files\SUPERAntiSpyware
2012-07-18 04:58 . 2012-07-18 04:58 -------- d-----w- c:\programdata\SUPERAntiSpyware.com
2012-07-18 04:48 . 2012-07-18 04:48 -------- d-----w- C:\TDSSKiller_Quarantine
2012-07-17 23:33 . 2012-07-17 23:33 -------- d-----w- c:\users\AD\AppData\Roaming\Avira
2012-07-17 23:26 . 2012-05-02 22:24 27760 ----a-w- c:\windows\system32\drivers\avkmgr.sys
2012-07-17 23:26 . 2012-04-27 17:20 132832 ----a-w- c:\windows\system32\drivers\avipbb.sys
2012-07-17 23:26 . 2012-04-25 07:32 98848 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2012-07-17 23:26 . 2012-07-17 23:26 -------- d-----w- c:\programdata\Avira
2012-07-17 23:26 . 2012-07-17 23:26 -------- d-----w- c:\program files (x86)\Avira
2012-07-17 23:14 . 2012-07-17 23:14 -------- d-----w- c:\users\AD\AppData\Roaming\Malwarebytes
2012-07-17 23:14 . 2012-07-17 23:14 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware
2012-07-17 23:14 . 2012-07-17 23:14 -------- d-----w- c:\programdata\Malwarebytes
2012-07-17 23:14 . 2012-07-03 20:46 24904 ----a-w- c:\windows\system32\drivers\mbam.sys
2012-07-17 23:10 . 2012-07-17 23:11 -------- d-----w- c:\program files\CCleaner
2012-07-16 10:15 . 2012-06-12 03:08 3148800 ----a-w- c:\windows\system32\win32k.sys
2012-07-16 10:08 . 2012-07-16 10:08 -------- d-----w- c:\users\AD\temp
2012-07-16 10:08 . 2012-07-16 10:08 -------- d-----w- c:\users\AD\AppData\Roaming\TeamViewer
2012-07-16 10:05 . 2012-07-16 10:05 -------- d-----w- c:\program files (x86)\Common Files\Intel Corporation
2012-07-16 08:46 . 2011-05-20 16:53 557848 ----a-w- c:\windows\system32\drivers\iaStor.sys
2012-07-16 08:46 . 2012-07-16 08:46 -------- d-----w- c:\users\AD\AppData\Roaming\InstallShield
2012-07-16 08:45 . 2012-07-16 08:44 9888360 ----a-w- c:\windows\SysWow64\RtsPStorIcon.dll
2012-07-16 08:39 . 2012-07-16 08:39 91648 ----a-w- c:\windows\system32\drivers\nusb3hub.sys
2012-07-16 08:39 . 2012-07-16 08:39 81920 ----a-w- c:\windows\system32\nusb3co2.dll
2012-07-16 08:39 . 2012-07-16 08:39 208896 ----a-w- c:\windows\system32\drivers\nusb3xhc.sys
2012-07-16 08:38 . 2012-07-16 08:37 66856 ----a-w- c:\windows\SysWow64\SynTPEnhPS.dll
2012-07-16 08:38 . 2012-07-16 08:37 226600 ----a-w- c:\windows\system32\SET8EF0.tmp
2012-07-16 08:38 . 2012-07-16 08:37 148264 ----a-w- c:\windows\system32\SynTPCo9.dll
2012-07-16 08:38 . 2012-07-16 08:37 1451056 ----a-w- c:\windows\system32\drivers\SynTP.sys
2012-07-16 08:38 . 2012-07-16 08:37 107816 ----a-w- c:\windows\SysWow64\SynTPCOM.dll
2012-07-16 08:38 . 2012-07-16 08:37 276264 ----a-w- c:\windows\system32\SynCtrl.dll
2012-07-16 08:38 . 2012-07-16 08:37 222504 ----a-w- c:\windows\SysWow64\SynCtrl.dll
2012-07-16 08:38 . 2012-07-16 08:37 177448 ----a-w- c:\windows\SysWow64\SynCOM.dll
2012-07-15 10:42 . 2012-07-15 10:42 -------- d-----w- c:\users\AD\AppData\Local\Sunbelt Software
2012-07-15 10:40 . 2012-07-15 10:42 -------- d-----w- c:\users\AD\AppData\Local\Google
2012-07-15 10:40 . 2012-07-15 10:41 -------- d-----w- c:\program files (x86)\Google
2012-07-15 10:39 . 2012-07-15 10:45 -------- d-----w- c:\programdata\Lavasoft
2012-07-15 10:39 . 2012-07-15 10:39 -------- d-----w- c:\program files (x86)\Lavasoft
2012-07-15 10:37 . 2012-07-15 10:37 -------- d-----w- c:\users\AD\AppData\Roaming\Iminent
2012-07-15 10:37 . 2012-07-15 10:37 -------- d-----w- c:\programdata\Iminent
2012-07-15 10:36 . 2012-07-16 00:24 -------- d-----w- c:\program files (x86)\Iminent
2012-07-15 09:12 . 2012-07-15 09:12 -------- d-----w- c:\users\AD\AppData\Local\VS Revo Group
2012-07-15 09:11 . 2012-07-15 09:11 -------- d-----w- c:\program files\VS Revo Group
2012-07-14 12:35 . 2012-07-16 00:24 -------- dc-h--w- c:\programdata\{2162CCC0-3A5F-4887-B51F-CE5F195B3620}
2012-07-14 12:15 . 2012-07-14 12:15 -------- d-----w- c:\users\AD\AppData\Roaming\Uniblue
2012-07-14 12:15 . 2012-07-14 12:15 -------- d-----w- c:\program files (x86)\Uniblue
2012-07-14 12:15 . 2012-07-16 00:24 -------- d-----w- c:\program files (x86)\WhiteSmoke_US
2012-07-14 10:22 . 2012-07-19 07:22 -------- d-----w- c:\programdata\Spybot - Search & Destroy
2012-07-14 10:22 . 2012-07-19 07:22 -------- d-----w- c:\program files (x86)\Spybot - Search & Destroy
2012-07-08 08:13 . 2012-07-08 08:13 -------- d-----w- c:\users\AD\AppData\Roaming\Tific
2012-07-08 08:13 . 2012-07-08 08:13 -------- d-----w- c:\users\AD\AppData\Local\Symantec
2012-07-07 09:20 . 2012-07-16 00:19 -------- d-sh--w- c:\windows\SysWow64\%APPDATA%
2012-07-02 07:58 . 2012-07-02 07:58 -------- d-----w- c:\users\AD\AppData\Local\Macromedia
2012-06-20 07:36 . 2012-06-02 22:19 57880 ----a-w- c:\windows\system32\wuauclt.exe
2012-06-20 07:36 . 2012-06-02 22:19 44056 ----a-w- c:\windows\system32\wups2.dll
2012-06-20 07:36 . 2012-06-02 22:19 2428952 ----a-w- c:\windows\system32\wuaueng.dll
2012-06-20 07:36 . 2012-06-02 22:15 2622464 ----a-w- c:\windows\system32\wucltux.dll
2012-06-20 07:36 . 2012-06-02 22:19 38424 ----a-w- c:\windows\system32\wups.dll
2012-06-20 07:36 . 2012-06-02 22:19 701976 ----a-w- c:\windows\system32\wuapi.dll
2012-06-20 07:36 . 2012-06-02 22:15 99840 ----a-w- c:\windows\system32\wudriver.dll
2012-06-20 07:35 . 2012-06-02 22:19 186752 ----a-w- c:\windows\system32\wuwebv.dll
2012-06-20 07:35 . 2012-06-02 22:15 36864 ----a-w- c:\windows\system32\wuapp.exe
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-07-16 08:59 . 2011-10-20 23:37 29480 ----a-w- c:\windows\SysWow64\msxml3a.dll
2012-07-16 08:59 . 2003-03-19 03:14 505128 ----a-w- c:\windows\SysWow64\msvcp71.dll
2012-07-16 08:59 . 2003-02-21 11:42 353576 ----a-w- c:\windows\SysWow64\msvcr71.dll
2012-07-16 08:44 . 2011-10-20 23:23 338536 ----a-w- c:\windows\system32\drivers\RtsPStor.sys
2012-07-16 08:37 . 2010-12-17 02:26 411944 ----a-w- c:\windows\system32\SynCOM.dll
2012-07-16 08:08 . 2012-04-22 08:27 426184 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2012-07-16 08:08 . 2012-04-22 08:27 70344 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2012-05-04 11:06 . 2012-06-14 06:58 5559664 ----a-w- c:\windows\system32\ntoskrnl.exe
2012-05-04 10:03 . 2012-06-14 06:58 3968368 ----a-w- c:\windows\SysWow64\ntkrnlpa.exe
2012-05-04 10:03 . 2012-06-14 06:58 3913072 ----a-w- c:\windows\SysWow64\ntoskrnl.exe
2012-05-01 05:40 . 2012-06-16 10:25 209920 ----a-w- c:\windows\system32\profsvc.dll
2012-04-28 03:55 . 2012-06-16 10:25 210944 ----a-w- c:\windows\system32\drivers\rdpwd.sys
2012-04-26 05:41 . 2012-06-16 10:25 77312 ----a-w- c:\windows\system32\rdpwsx.dll
2012-04-26 05:41 . 2012-06-16 10:25 149504 ----a-w- c:\windows\system32\rdpcorekmts.dll
2012-04-26 05:34 . 2012-06-16 10:25 9216 ----a-w- c:\windows\system32\rdrmemptylst.exe
2012-04-25 21:02 . 2012-04-25 21:02 43800 ----a-w- c:\windows\system32\drivers\Accelerometer.sys
2012-04-25 21:02 . 2012-04-25 21:02 31000 ----a-w- c:\windows\system32\SETA732.tmp
2012-04-25 21:02 . 2012-04-25 21:02 21272 ----a-w- c:\windows\system32\SETA771.tmp
2012-04-25 21:02 . 2012-04-25 21:02 18200 ----a-w- c:\windows\system32\SETA7A1.tmp
2012-04-25 21:02 . 2011-01-26 23:01 30488 ----a-w- c:\windows\system32\drivers\hpdskflt.sys
2012-04-24 05:37 . 2012-06-16 10:24 184320 ----a-w- c:\windows\system32\cryptsvc.dll
2012-04-24 05:37 . 2012-06-16 10:24 140288 ----a-w- c:\windows\system32\cryptnet.dll
2012-04-24 05:37 . 2012-06-16 10:24 1462272 ----a-w- c:\windows\system32\crypt32.dll
2012-04-24 04:36 . 2012-06-16 10:24 140288 ----a-w- c:\windows\SysWow64\cryptsvc.dll
2012-04-24 04:36 . 2012-06-16 10:24 1158656 ----a-w- c:\windows\SysWow64\crypt32.dll
2012-04-24 04:36 . 2012-06-16 10:24 103936 ----a-w- c:\windows\SysWow64\cryptnet.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2012-07-09 5661056]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"IAStorIcon"="c:\program files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe" [2011-05-20 284440]
"NUSB3MON"="c:\program files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe" [2012-07-16 113288]
"HPConnectionManager"="c:\program files (x86)\Hewlett-Packard\HP Connection Manager\HPCMDelayStart.exe" [2011-02-15 94264]
"Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe" [2010-11-16 35736]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-03 843712]
"Easybits Recovery"="c:\program files (x86)\EasyBits For Kids\ezRecover.exe" [2011-03-16 61112]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2010-10-29 249064]
"GrooveMonitor"="c:\program files (x86)\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 31072]
"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2011-11-02 59240]
"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2011-12-08 421736]
"HP Quick Launch"="c:\program files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe" [2012-03-05 578944]
"HPOSD"="c:\program files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe" [2011-08-19 379960]
"RemoteControl10"="c:\program files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe" [2011-03-30 87336]
"BDRegion"="c:\program files (x86)\Cyberlink\Shared files\brs.exe" [2012-07-16 75048]
"avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2012-05-02 348624]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
McAfee Security Scan Plus.lnk - c:\program files (x86)\McAfee Security Scan\2.0.181\SSScheduler.exe [2010-1-15 255536]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"EnableShellExecuteHooks"= 1 (0x1)
.
[hkey_local_machine\software\Wow6432Node\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\!SASCORE]
@=""
.
2;2 UNS;Intel® Management and Security Application User Notification Service [x]
R2 CLKMSVC10_38F51D56;CyberLink Product - 2012/07/16 02:01;c:\program files (x86)\CyberLink\PowerDVD10\NavFilter\kmsvc.exe [2012-02-08 244720]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-07-16 250056]
R3 BBSvc;Bing Bar Update Service;c:\program files (x86)\Microsoft\BingBar\BBSvc.EXE [2011-03-02 183560]
R3 GamesAppService;GamesAppService;c:\program files (x86)\WildTangent Games\App\GamesAppService.exe [2010-10-12 206072]
R3 hpCMSrv;HP Connection Manager 4.0 Service;c:\program files (x86)\Hewlett-Packard\HP Connection Manager\hpCMSrv.exe [2011-02-15 1071160]
R3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files (x86)\McAfee Security Scan\2.0.181\McCHSvc.exe [2010-01-15 227232]
R3 SrvHsfHDA;SrvHsfHDA;c:\windows\system32\DRIVERS\VSTAZL6.SYS [2009-06-10 292864]
R3 SrvHsfV92;SrvHsfV92;c:\windows\system32\DRIVERS\VSTDPV6.SYS [2009-06-10 1485312]
R3 SrvHsfWinac;SrvHsfWinac;c:\windows\system32\DRIVERS\VSTCNXT6.SYS [2009-06-10 740864]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-21 59392]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [2010-11-21 31232]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [2011-08-03 51712]
R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2011-11-30 1255736]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-23 57184]
S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys [2012-05-02 27760]
S1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV64.SYS [2011-07-22 14928]
S1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL64.SYS [2011-07-12 12368]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-14 59904]
S2 !SASCORE;SAS Core Service;c:\program files\SUPERAntiSpyware\SASCORE64.EXE [2011-08-11 140672]
S2 AESTFilters;Andrea ST Filters Service;c:\program files\IDT\WDM\AESTSr64.exe [2009-03-03 89600]
S2 AntiVirSchedulerService;Avira Scheduler;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe [2012-05-02 86224]
S2 ezSharedSvc;Easybits Services for Windows;c:\windows\System32\ezSharedSvcHost.exe [x]
S2 FPLService;TrueSuiteService;c:\program files (x86)\HP SimplePass 2011\TrueSuiteService.exe [2011-02-18 265544]
S2 HPClientSvc;HP Client Services;c:\program files\Hewlett-Packard\HP Client Services\HPClientServices.exe [2010-10-11 346168]
S2 hpsrv;HP Service;c:\windows\system32\Hpservice.exe [2011-05-14 30520]
S2 HPWMISVC;HPWMISVC;c:\program files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe [2012-03-05 35200]
S2 IAStorDataMgrSvc;Intel® Rapid Storage Technology;c:\program files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe [2011-05-20 13592]
S2 IconMan_R;IconMan_R;c:\program files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe [2012-07-16 2413056]
S2 RoxioNow Service;RoxioNow Service;c:\program files (x86)\Roxio\RoxioNow Player\RNowSvc.exe [2010-11-26 399344]
S3 clwvd;CyberLink WebCam Virtual Driver;c:\windows\system32\DRIVERS\clwvd.sys [2010-07-28 31088]
S3 IntcDAud;Intel® Display Audio;c:\windows\system32\DRIVERS\IntcDAud.sys [2010-10-15 317440]
S3 MEIx64;Intel® Management Engine Interface;c:\windows\system32\DRIVERS\HECIx64.sys [2010-10-20 56344]
S3 nusb3hub;Renesas Electronics USB 3.0 Hub Driver;c:\windows\system32\DRIVERS\nusb3hub.sys [2012-07-16 91648]
S3 nusb3xhc;Renesas Electronics USB 3.0 Host Controller Driver;c:\windows\system32\DRIVERS\nusb3xhc.sys [2012-07-16 208896]
S3 RSPCIESTOR;Realtek PCIE CardReader Driver;c:\windows\system32\DRIVERS\RtsPStor.sys [2012-07-16 338536]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [2011-02-17 428136]
.
.
--- Other Services/Drivers In Memory ---
.
*Deregistered* - CLKMDRV10_38F51D56
.
Contents of the 'Scheduled Tasks' folder
.
2012-07-19 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-22 08:08]
.
2012-06-26 c:\windows\Tasks\HPCeeScheduleForAD.job
- c:\program files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2010-09-14 05:15]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SysTrayApp"="c:\program files\IDT\WDM\sttray64.exe" [2011-03-11 1128448]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2011-04-16 168216]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2011-04-16 392472]
"Persistence"="c:\windows\system32\igfxpers.exe" [2011-04-16 416024]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"LoadAppInit_DLLs"=0x0
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.yahoo.com/?ilc=16
uLocal Page = c:\windows\system32\blank.htm
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = *.local
IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~1\Office12\EXCEL.EXE/3000
IE: Free YouTube Download - c:\users\AD\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubedownload.htm
IE: Free YouTube to MP3 Converter - c:\users\AD\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm
TCP: DhcpNameServer = 75.75.75.75 75.75.76.76
FF - ProfilePath - c:\users\AD\AppData\Roaming\Mozilla\Firefox\Profiles\qkdk8i86.default\
FF - prefs.js: browser.search.selectedEngine - Yahoo
.
- - - - ORPHANS REMOVED - - - -
.
HKLM-Run-SynTPEnh - c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe
AddRemove-Adobe Shockwave Player - c:\windows\system32\Adobe\Shockwave 11\uninstaller.exe
AddRemove-EasyBits Magic Desktop - c:\windows\system32\ezMDUninstall.exe
AddRemove-{E92D47A1-D27D-430A-8368-0BAFD956507D} - c:\program files (x86)\InstallShield Installation Information\{E92D47A1-D27D-430A-8368-0BAFD956507D}\setup.exe
.
.
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_3_300_265_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_3_300_265_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_265.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_265.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_265.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_265.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Other Running Processes ------------------------
.
c:\program files (x86)\Avira\AntiVir Desktop\avguard.exe
c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\windows\SysWOW64\ezSharedSvcHost.exe
c:\program files (x86)\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe
c:\program files (x86)\Microsoft\BingBar\SeaPort.EXE
c:\program files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe
c:\program files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe
c:\program files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe
.
**************************************************************************
.
Completion time: 2012-07-19 02:08:25 - machine was rebooted
ComboFix-quarantined-files.txt 2012-07-19 09:08
.
Pre-Run: 563,863,515,136 bytes free
Post-Run: 563,498,848,256 bytes free
.
- - End Of File - - 184BFE960507B5AF325C95D62ACBAA2E

Greetings

I would like to know how the computer is doing now?

At this time I would like you to run this script for me and it is a good time to check out the computer to see if there is anything else that needs to be addressed.

:Run CFScript:

Open Notepad and copy/paste the text in the box into the window:

ClearJavaCache::

Folder::
c:\program files (x86)\WhiteSmoke_US

Save it to your desktop as CFScript.txt

Refering to the picture above, drag CFScript.txt into ComboFix.exe

This will let ComboFix run again.
Restart if you have to.
Save the produced logfile to your desktop.

Note: Do not mouseclick combofix's window whilst it's running. That may cause it to stall

Note 2: If you recieve an error "Illegal operation attempted on a registery key that has been marked for deletion." Please restart the computer

"information and logs"

• In your next post I need the following
  
  
• report from Combofix
• let me know of any problems you may have had
• How is the computer doing now after running the script?

Gringo

Hello, here is the new ComboFix log:

ComboFix 12-07-16.01 - AD 07/19/2012 2:31.2.8 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.4044.2610 [GMT -7:00]
Running from: c:\users\AD\Desktop\ComboFix.exe
Command switches used :: c:\users\AD\Desktop\CFScript.txt
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\program files (x86)\WhiteSmoke_US
c:\program files (x86)\WhiteSmoke_US\GottenAppsContextMenu.xml
c:\program files (x86)\WhiteSmoke_US\OtherAppsContextMenu.xml
c:\program files (x86)\WhiteSmoke_US\SharedAppsContextMenu.xml
c:\program files (x86)\WhiteSmoke_US\ToolbarContextMenu.xml
.
.
((((((((((((((((((((((((( Files Created from 2012-06-19 to 2012-07-19 )))))))))))))))))))))))))))))))
.
.
2012-07-19 09:36 . 2012-07-19 09:36 -------- d-----w- c:\users\Default\AppData\Local\temp
2012-07-19 09:36 . 2012-07-19 09:36 -------- d-----w- c:\users\Administrator\AppData\Local\temp
2012-07-19 09:05 . 2012-07-19 09:05 -------- d-----w- C:\FRST
2012-07-18 22:39 . 2012-07-18 22:39 -------- d-----w- c:\program files (x86)\World of Warcraft
2012-07-18 22:39 . 2012-07-18 22:39 -------- d-----w- c:\program files (x86)\Common Files\Blizzard Entertainment
2012-07-18 07:55 . 2012-07-18 08:03 -------- d-----w- c:\program files (x86)\WhatsRunning
2012-07-18 04:59 . 2012-07-18 04:59 -------- d-----w- c:\users\AD\AppData\Roaming\SUPERAntiSpyware.com
2012-07-18 04:58 . 2012-07-18 04:59 -------- d-----w- c:\program files\SUPERAntiSpyware
2012-07-18 04:58 . 2012-07-18 04:58 -------- d-----w- c:\programdata\SUPERAntiSpyware.com
2012-07-18 04:48 . 2012-07-18 04:48 -------- d-----w- C:\TDSSKiller_Quarantine
2012-07-17 23:33 . 2012-07-17 23:33 -------- d-----w- c:\users\AD\AppData\Roaming\Avira
2012-07-17 23:26 . 2012-05-02 22:24 27760 ----a-w- c:\windows\system32\drivers\avkmgr.sys
2012-07-17 23:26 . 2012-04-27 17:20 132832 ----a-w- c:\windows\system32\drivers\avipbb.sys
2012-07-17 23:26 . 2012-04-25 07:32 98848 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2012-07-17 23:26 . 2012-07-17 23:26 -------- d-----w- c:\programdata\Avira
2012-07-17 23:26 . 2012-07-17 23:26 -------- d-----w- c:\program files (x86)\Avira
2012-07-17 23:14 . 2012-07-17 23:14 -------- d-----w- c:\users\AD\AppData\Roaming\Malwarebytes
2012-07-17 23:14 . 2012-07-17 23:14 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware
2012-07-17 23:14 . 2012-07-17 23:14 -------- d-----w- c:\programdata\Malwarebytes
2012-07-17 23:14 . 2012-07-03 20:46 24904 ----a-w- c:\windows\system32\drivers\mbam.sys
2012-07-17 23:10 . 2012-07-17 23:11 -------- d-----w- c:\program files\CCleaner
2012-07-16 10:15 . 2012-06-12 03:08 3148800 ----a-w- c:\windows\system32\win32k.sys
2012-07-16 10:08 . 2012-07-16 10:08 -------- d-----w- c:\users\AD\temp
2012-07-16 10:08 . 2012-07-16 10:08 -------- d-----w- c:\users\AD\AppData\Roaming\TeamViewer
2012-07-16 10:05 . 2012-07-16 10:05 -------- d-----w- c:\program files (x86)\Common Files\Intel Corporation
2012-07-16 08:46 . 2011-05-20 16:53 557848 ----a-w- c:\windows\system32\drivers\iaStor.sys
2012-07-16 08:46 . 2012-07-16 08:46 -------- d-----w- c:\users\AD\AppData\Roaming\InstallShield
2012-07-16 08:45 . 2012-07-16 08:44 9888360 ----a-w- c:\windows\SysWow64\RtsPStorIcon.dll
2012-07-16 08:39 . 2012-07-16 08:39 91648 ----a-w- c:\windows\system32\drivers\nusb3hub.sys
2012-07-16 08:39 . 2012-07-16 08:39 81920 ----a-w- c:\windows\system32\nusb3co2.dll
2012-07-16 08:39 . 2012-07-16 08:39 208896 ----a-w- c:\windows\system32\drivers\nusb3xhc.sys
2012-07-16 08:38 . 2012-07-16 08:37 66856 ----a-w- c:\windows\SysWow64\SynTPEnhPS.dll
2012-07-16 08:38 . 2012-07-16 08:37 226600 ----a-w- c:\windows\system32\SET8EF0.tmp
2012-07-16 08:38 . 2012-07-16 08:37 148264 ----a-w- c:\windows\system32\SynTPCo9.dll
2012-07-16 08:38 . 2012-07-16 08:37 1451056 ----a-w- c:\windows\system32\drivers\SynTP.sys
2012-07-16 08:38 . 2012-07-16 08:37 107816 ----a-w- c:\windows\SysWow64\SynTPCOM.dll
2012-07-16 08:38 . 2012-07-16 08:37 276264 ----a-w- c:\windows\system32\SynCtrl.dll
2012-07-16 08:38 . 2012-07-16 08:37 222504 ----a-w- c:\windows\SysWow64\SynCtrl.dll
2012-07-16 08:38 . 2012-07-16 08:37 177448 ----a-w- c:\windows\SysWow64\SynCOM.dll
2012-07-15 10:42 . 2012-07-15 10:42 -------- d-----w- c:\users\AD\AppData\Local\Sunbelt Software
2012-07-15 10:40 . 2012-07-15 10:42 -------- d-----w- c:\users\AD\AppData\Local\Google
2012-07-15 10:40 . 2012-07-15 10:41 -------- d-----w- c:\program files (x86)\Google
2012-07-15 10:39 . 2012-07-15 10:45 -------- d-----w- c:\programdata\Lavasoft
2012-07-15 10:39 . 2012-07-15 10:39 -------- d-----w- c:\program files (x86)\Lavasoft
2012-07-15 10:37 . 2012-07-15 10:37 -------- d-----w- c:\users\AD\AppData\Roaming\Iminent
2012-07-15 10:37 . 2012-07-15 10:37 -------- d-----w- c:\programdata\Iminent
2012-07-15 10:36 . 2012-07-16 00:24 -------- d-----w- c:\program files (x86)\Iminent
2012-07-15 09:12 . 2012-07-15 09:12 -------- d-----w- c:\users\AD\AppData\Local\VS Revo Group
2012-07-15 09:11 . 2012-07-15 09:11 -------- d-----w- c:\program files\VS Revo Group
2012-07-14 12:35 . 2012-07-16 00:24 -------- dc-h--w- c:\programdata\{2162CCC0-3A5F-4887-B51F-CE5F195B3620}
2012-07-14 12:15 . 2012-07-14 12:15 -------- d-----w- c:\users\AD\AppData\Roaming\Uniblue
2012-07-14 12:15 . 2012-07-14 12:15 -------- d-----w- c:\program files (x86)\Uniblue
2012-07-14 10:22 . 2012-07-19 07:22 -------- d-----w- c:\programdata\Spybot - Search & Destroy
2012-07-14 10:22 . 2012-07-19 07:22 -------- d-----w- c:\program files (x86)\Spybot - Search & Destroy
2012-07-08 08:13 . 2012-07-08 08:13 -------- d-----w- c:\users\AD\AppData\Roaming\Tific
2012-07-08 08:13 . 2012-07-08 08:13 -------- d-----w- c:\users\AD\AppData\Local\Symantec
2012-07-07 09:20 . 2012-07-16 00:19 -------- d-sh--w- c:\windows\SysWow64\%APPDATA%
2012-07-02 07:58 . 2012-07-02 07:58 -------- d-----w- c:\users\AD\AppData\Local\Macromedia
2012-06-20 07:36 . 2012-06-02 22:19 57880 ----a-w- c:\windows\system32\wuauclt.exe
2012-06-20 07:36 . 2012-06-02 22:19 44056 ----a-w- c:\windows\system32\wups2.dll
2012-06-20 07:36 . 2012-06-02 22:19 2428952 ----a-w- c:\windows\system32\wuaueng.dll
2012-06-20 07:36 . 2012-06-02 22:15 2622464 ----a-w- c:\windows\system32\wucltux.dll
2012-06-20 07:36 . 2012-06-02 22:19 38424 ----a-w- c:\windows\system32\wups.dll
2012-06-20 07:36 . 2012-06-02 22:19 701976 ----a-w- c:\windows\system32\wuapi.dll
2012-06-20 07:36 . 2012-06-02 22:15 99840 ----a-w- c:\windows\system32\wudriver.dll
2012-06-20 07:35 . 2012-06-02 22:19 186752 ----a-w- c:\windows\system32\wuwebv.dll
2012-06-20 07:35 . 2012-06-02 22:15 36864 ----a-w- c:\windows\system32\wuapp.exe
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-07-16 08:59 . 2011-10-20 23:37 29480 ----a-w- c:\windows\SysWow64\msxml3a.dll
2012-07-16 08:59 . 2003-03-19 03:14 505128 ----a-w- c:\windows\SysWow64\msvcp71.dll
2012-07-16 08:59 . 2003-02-21 11:42 353576 ----a-w- c:\windows\SysWow64\msvcr71.dll
2012-07-16 08:44 . 2011-10-20 23:23 338536 ----a-w- c:\windows\system32\drivers\RtsPStor.sys
2012-07-16 08:37 . 2010-12-17 02:26 411944 ----a-w- c:\windows\system32\SynCOM.dll
2012-07-16 08:08 . 2012-04-22 08:27 426184 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2012-07-16 08:08 . 2012-04-22 08:27 70344 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2012-05-04 11:06 . 2012-06-14 06:58 5559664 ----a-w- c:\windows\system32\ntoskrnl.exe
2012-05-04 10:03 . 2012-06-14 06:58 3968368 ----a-w- c:\windows\SysWow64\ntkrnlpa.exe
2012-05-04 10:03 . 2012-06-14 06:58 3913072 ----a-w- c:\windows\SysWow64\ntoskrnl.exe
2012-05-01 05:40 . 2012-06-16 10:25 209920 ----a-w- c:\windows\system32\profsvc.dll
2012-04-28 03:55 . 2012-06-16 10:25 210944 ----a-w- c:\windows\system32\drivers\rdpwd.sys
2012-04-26 05:41 . 2012-06-16 10:25 77312 ----a-w- c:\windows\system32\rdpwsx.dll
2012-04-26 05:41 . 2012-06-16 10:25 149504 ----a-w- c:\windows\system32\rdpcorekmts.dll
2012-04-26 05:34 . 2012-06-16 10:25 9216 ----a-w- c:\windows\system32\rdrmemptylst.exe
2012-04-25 21:02 . 2012-04-25 21:02 43800 ----a-w- c:\windows\system32\drivers\Accelerometer.sys
2012-04-25 21:02 . 2012-04-25 21:02 31000 ----a-w- c:\windows\system32\SETA732.tmp
2012-04-25 21:02 . 2012-04-25 21:02 21272 ----a-w- c:\windows\system32\SETA771.tmp
2012-04-25 21:02 . 2012-04-25 21:02 18200 ----a-w- c:\windows\system32\SETA7A1.tmp
2012-04-25 21:02 . 2011-01-26 23:01 30488 ----a-w- c:\windows\system32\drivers\hpdskflt.sys
2012-04-24 05:37 . 2012-06-16 10:24 184320 ----a-w- c:\windows\system32\cryptsvc.dll
2012-04-24 05:37 . 2012-06-16 10:24 140288 ----a-w- c:\windows\system32\cryptnet.dll
2012-04-24 05:37 . 2012-06-16 10:24 1462272 ----a-w- c:\windows\system32\crypt32.dll
2012-04-24 04:36 . 2012-06-16 10:24 140288 ----a-w- c:\windows\SysWow64\cryptsvc.dll
2012-04-24 04:36 . 2012-06-16 10:24 1158656 ----a-w- c:\windows\SysWow64\crypt32.dll
2012-04-24 04:36 . 2012-06-16 10:24 103936 ----a-w- c:\windows\SysWow64\cryptnet.dll
.
.
((((((((((((((((((((((((((((( SnapShot@2012-07-19_09.00.21 )))))))))))))))))))))))))))))))))))))))))
.
+ 2012-07-19 09:36 . 2012-07-19 09:36 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
- 2012-07-19 08:59 . 2012-07-19 08:59 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
+ 2012-07-19 09:36 . 2012-07-19 09:36 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
- 2012-07-19 08:59 . 2012-07-19 08:59 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
+ 2009-07-14 05:01 . 2012-07-19 09:36 390652 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat
- 2009-07-14 05:01 . 2012-07-19 08:59 390652 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat
+ 2011-11-30 02:05 . 2012-07-19 09:36 40332438 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-3095338204-3215127573-512180096-1000-12288.dat
- 2011-11-30 02:05 . 2012-07-19 08:01 40332438 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-3095338204-3215127573-512180096-1000-12288.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2012-07-09 5661056]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"IAStorIcon"="c:\program files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe" [2011-05-20 284440]
"NUSB3MON"="c:\program files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe" [2012-07-16 113288]
"HPConnectionManager"="c:\program files (x86)\Hewlett-Packard\HP Connection Manager\HPCMDelayStart.exe" [2011-02-15 94264]
"Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe" [2010-11-16 35736]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-03 843712]
"Easybits Recovery"="c:\program files (x86)\EasyBits For Kids\ezRecover.exe" [2011-03-16 61112]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2010-10-29 249064]
"GrooveMonitor"="c:\program files (x86)\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 31072]
"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2011-11-02 59240]
"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2011-12-08 421736]
"HP Quick Launch"="c:\program files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe" [2012-03-05 578944]
"HPOSD"="c:\program files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe" [2011-08-19 379960]
"RemoteControl10"="c:\program files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe" [2011-03-30 87336]
"BDRegion"="c:\program files (x86)\Cyberlink\Shared files\brs.exe" [2012-07-16 75048]
"avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2012-05-02 348624]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
McAfee Security Scan Plus.lnk - c:\program files (x86)\McAfee Security Scan\2.0.181\SSScheduler.exe [2010-1-15 255536]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"EnableShellExecuteHooks"= 1 (0x1)
.
[hkey_local_machine\software\Wow6432Node\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\!SASCORE]
@=""
.
2;2 UNS;Intel® Management and Security Application User Notification Service [x]
R2 CLKMSVC10_38F51D56;CyberLink Product - 2012/07/16 02:01;c:\program files (x86)\CyberLink\PowerDVD10\NavFilter\kmsvc.exe [2012-02-08 244720]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-07-16 250056]
R3 BBSvc;Bing Bar Update Service;c:\program files (x86)\Microsoft\BingBar\BBSvc.EXE [2011-03-02 183560]
R3 GamesAppService;GamesAppService;c:\program files (x86)\WildTangent Games\App\GamesAppService.exe [2010-10-12 206072]
R3 hpCMSrv;HP Connection Manager 4.0 Service;c:\program files (x86)\Hewlett-Packard\HP Connection Manager\hpCMSrv.exe [2011-02-15 1071160]
R3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files (x86)\McAfee Security Scan\2.0.181\McCHSvc.exe [2010-01-15 227232]
R3 SrvHsfHDA;SrvHsfHDA;c:\windows\system32\DRIVERS\VSTAZL6.SYS [2009-06-10 292864]
R3 SrvHsfV92;SrvHsfV92;c:\windows\system32\DRIVERS\VSTDPV6.SYS [2009-06-10 1485312]
R3 SrvHsfWinac;SrvHsfWinac;c:\windows\system32\DRIVERS\VSTCNXT6.SYS [2009-06-10 740864]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-21 59392]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [2010-11-21 31232]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [2011-08-03 51712]
R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2011-11-30 1255736]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-23 57184]
S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys [2012-05-02 27760]
S1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV64.SYS [2011-07-22 14928]
S1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL64.SYS [2011-07-12 12368]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-14 59904]
S2 !SASCORE;SAS Core Service;c:\program files\SUPERAntiSpyware\SASCORE64.EXE [2011-08-11 140672]
S2 AESTFilters;Andrea ST Filters Service;c:\program files\IDT\WDM\AESTSr64.exe [2009-03-03 89600]
S2 AntiVirSchedulerService;Avira Scheduler;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe [2012-05-02 86224]
S2 ezSharedSvc;Easybits Services for Windows;c:\windows\System32\ezSharedSvcHost.exe [x]
S2 FPLService;TrueSuiteService;c:\program files (x86)\HP SimplePass 2011\TrueSuiteService.exe [2011-02-18 265544]
S2 HPClientSvc;HP Client Services;c:\program files\Hewlett-Packard\HP Client Services\HPClientServices.exe [2010-10-11 346168]
S2 hpsrv;HP Service;c:\windows\system32\Hpservice.exe [2011-05-14 30520]
S2 HPWMISVC;HPWMISVC;c:\program files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe [2012-03-05 35200]
S2 IAStorDataMgrSvc;Intel® Rapid Storage Technology;c:\program files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe [2011-05-20 13592]
S2 IconMan_R;IconMan_R;c:\program files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe [2012-07-16 2413056]
S2 RoxioNow Service;RoxioNow Service;c:\program files (x86)\Roxio\RoxioNow Player\RNowSvc.exe [2010-11-26 399344]
S3 clwvd;CyberLink WebCam Virtual Driver;c:\windows\system32\DRIVERS\clwvd.sys [2010-07-28 31088]
S3 IntcDAud;Intel® Display Audio;c:\windows\system32\DRIVERS\IntcDAud.sys [2010-10-15 317440]
S3 MEIx64;Intel® Management Engine Interface;c:\windows\system32\DRIVERS\HECIx64.sys [2010-10-20 56344]
S3 nusb3hub;Renesas Electronics USB 3.0 Hub Driver;c:\windows\system32\DRIVERS\nusb3hub.sys [2012-07-16 91648]
S3 nusb3xhc;Renesas Electronics USB 3.0 Host Controller Driver;c:\windows\system32\DRIVERS\nusb3xhc.sys [2012-07-16 208896]
S3 RSPCIESTOR;Realtek PCIE CardReader Driver;c:\windows\system32\DRIVERS\RtsPStor.sys [2012-07-16 338536]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [2011-02-17 428136]
.
.
--- Other Services/Drivers In Memory ---
.
*Deregistered* - CLKMDRV10_38F51D56
.
Contents of the 'Scheduled Tasks' folder
.
2012-07-19 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-22 08:08]
.
2012-06-26 c:\windows\Tasks\HPCeeScheduleForAD.job
- c:\program files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2010-09-14 05:15]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SysTrayApp"="c:\program files\IDT\WDM\sttray64.exe" [2011-03-11 1128448]
"SynTPEnh"="c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe" [BU]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2011-04-16 168216]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2011-04-16 392472]
"Persistence"="c:\windows\system32\igfxpers.exe" [2011-04-16 416024]
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.yahoo.com/?ilc=16
uLocal Page = c:\windows\system32\blank.htm
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = *.local
IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~1\Office12\EXCEL.EXE/3000
IE: Free YouTube Download - c:\users\AD\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubedownload.htm
IE: Free YouTube to MP3 Converter - c:\users\AD\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm
TCP: DhcpNameServer = 75.75.75.75 75.75.76.76
FF - ProfilePath - c:\users\AD\AppData\Roaming\Mozilla\Firefox\Profiles\qkdk8i86.default\
FF - prefs.js: browser.search.selectedEngine - Yahoo
.
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_3_300_265_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_3_300_265_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_265.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_265.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_265.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_265.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Other Running Processes ------------------------
.
c:\program files (x86)\Avira\AntiVir Desktop\avguard.exe
c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\windows\SysWOW64\ezSharedSvcHost.exe
c:\program files (x86)\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe
c:\program files (x86)\Microsoft\BingBar\SeaPort.EXE
c:\program files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe
c:\program files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe
c:\program files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe
.
**************************************************************************
.
Completion time: 2012-07-19 02:44:41 - machine was rebooted
ComboFix-quarantined-files.txt 2012-07-19 09:44
ComboFix2.txt 2012-07-19 09:08
.
Pre-Run: 563,557,117,952 bytes free
Post-Run: 563,498,823,680 bytes free
.
- - End Of File - - 051AD3B74C7CE9F981ACBD42FAFD0424


The computer has been on for a while now and I have yet to get an alert from Avira regarding any viruses, so that must be a good sign. I am still wondering why there are over 75 processes running in the background on startup. Before I posted on this forum, the number of processes fluctuated between 72 and 85 and I assumed it must be some sort of virus. And also, there are about 12 svchost.exe running in the background. Is it common for that many to be running at a time? Besides that though, I'd say the computer is running just fine.