In Need of Quick FRST64 Script to get a Zero access victim in BSOD Booting

In Need of Quick FRST64 Script to get a Zero access victim in BSOD Booting
I think the problem is in "SubSystems: [Windows] ATTENTION! ====> ZeroAccess"
Thanks in advance!

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 25-09-2012
Ran by SYSTEM at 28-09-2012 09:14:01
Running from F:\
Windows 7 Home Premium (X64) OS Language: English(US)
The current controlset is ControlSet001

==================== Registry (Whitelisted) ===================

HKLM\...\Run: [ASUS WebStorage] C:\Program Files (x86)\ASUS\ASUS WebStorage\SERVICE\AsusWSService.exe [1754448 2010-03-15] ()
HKLM\...\Run: [SynTPEnh] %ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe [2283816 2010-08-12] (Synaptics Incorporated)
HKLM\...\Run: [SynAsusAcpi] %ProgramFiles%\Synaptics\SynTP\SynAsusAcpi.exe [92456 2010-08-12] (Synaptics Incorporated)
HKLM\...\Run: [AtherosBtStack] "C:\Program Files (x86)\Atheros\Bluetooth Suite\BtvStack.exe" [613536 2010-11-25] (Atheros Commnucations)
HKLM\...\Run: [AthBtTray] "C:\Program Files (x86)\Atheros\Bluetooth Suite\AthBtTray.exe" [379040 2010-11-25] (Atheros Commnucations)
HKLM\...\Run: [THXCfg64] C:\Windows\system32\RunDLL32.exe C:\Windows\system32\THXCfg64.dll,RunDLLEntry THXCfg64 [17920 2009-10-15] (Creative Technology Ltd.)
HKLM\...\Run: [Setwallpaper] c:\programdata\SetWallpaper.cmd [x]
HKLM\...\Run: [Logitech Download Assistant] C:\Windows\system32\rundll32.exe C:\Windows\System32\LogiLDA.dll,LogiFetch [1580368 2010-11-03] (Logitech, Inc.)
HKLM\...\Run: [AdobeAAMUpdater-1.0] "C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [500208 2010-03-06] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [UpdateLBPShortCut] "C:\Program Files (x86)\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe" "C:\Program Files (x86)\CyberLink\LabelPrint" UpdateWithCreateOnce "Software\CyberLink\LabelPrint\2.5" [222504 2009-05-19] (CyberLink Corp.)
HKLM-x32\...\Run: [UpdateP2GoShortCut] "C:\Program Files (x86)\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe" "C:\Program Files (x86)\CyberLink\Power2Go" UpdateWithCreateOnce "SOFTWARE\CyberLink\Power2Go\6.0" [222504 2009-05-19] (CyberLink Corp.)
HKLM-x32\...\Run: [ATKMEDIA] C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe [170624 2010-10-07] (ASUS)
HKLM-x32\...\Run: [HControlUser] C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe [105016 2009-06-19] (ASUS)
HKLM-x32\...\Run: [Wireless Console 3] C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe [1601536 2010-09-23] ()
HKLM-x32\...\Run: [CPMonitor] "C:\Program Files (x86)\Roxio\CinePlayer\5.0\CPMonitor.exe" [84464 2010-12-26] ()
HKLM-x32\...\Run: [THX TruStudio NB Settings] "C:\Program Files (x86)\Creative\THX TruStudio\THXNBSet\THXAudNB.exe" /r [907776 2011-01-28] (Creative Technology Ltd)
HKLM-x32\...\Run: [UpdReg] C:\Windows\UpdReg.EXE [90112 2000-05-11] (Creative Technology Ltd.)
HKLM-x32\...\Run: [VAWinAgent] C:\ExpressGateUtil\VAWinAgent.exe [21504 2010-08-12] ()
HKLM-x32\...\Run: [Adobe Acrobat Speed Launcher] "C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\Acrobat_sl.exe" [46200 2007-05-11] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [FLxHCIm] "C:\Program Files\Fresco Logic Inc\Fresco Logic USB3.0 Host Controller\host\FLxHCIm.exe" [40448 2011-02-24] (Windows ® Win 7 DDK provider)
HKLM-x32\...\Run: [Adobe_ID0EYTHM] C:\PROGRA~2\COMMON~1\Adobe\ADOBEV~1\Server\bin\VERSIO~2.EXE [1884160 2007-03-20] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [BCSSync] "C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe" /DelayServices [91520 2010-01-21] (Microsoft Corporation)
HKLM-x32\...\Run: [Acrobat Assistant 8.0] "C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe" [624248 2007-05-10] (Adobe Systems Inc.)
HKLM-x32\...\Run: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [59240 2011-09-27] (Apple Inc.)
HKLM-x32\...\Run: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime [421888 2011-10-24] (Apple Inc.)
HKLM-x32\...\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe" [252296 2012-01-17] (Sun Microsystems, Inc.)
HKLM-x32\...\Run: [TkBellExe] "c:\program files (x86)\real\realplayer\Update\realsched.exe" -osboot [296096 2012-07-31] (RealNetworks, Inc.)
HKLM-x32\...\Run: [AdobeCS5ServiceManager] "C:\Program Files (x86)\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe" -launchedbylogin [406992 2010-02-22] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [SwitchBoard] C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [] [x]
HKLM-x32\...\Run: [COMODO] C:\Program Files\COMODO\COMODO GeekBuddy\CLPSLA.exe [213304 2011-05-25] (COMODO)
HKLM-x32\...\Run: [CPA] C:\Program Files\COMODO\COMODO GeekBuddy\VALA.exe [184120 2011-05-25] (COMODO)
HKU\Maxraven\...\Run: [Syncables] C:\Program Files (x86)\syncables\syncables desktop\Syncables.exe [370480 2010-07-19] (syncables, LLC)
HKU\Maxraven\...\Run: [Akamai NetSession Interface] "C:\Users\Maxraven\AppData\Local\Akamai\netsession_win.exe" [x]
HKU\Maxraven\...\Run: [] C:\Users\Maxraven\AppData\Local\Temp\fvJcrgR.exe [x]
HKU\Maxraven\...\Run: [WinSyncProviders] C:\Users\Maxraven\AppData\Local\Microsoft\Windows\3023\WinSyncProviders.exe [x]
HKU\Maxraven\...\Run: [mgrec] rundll32.exe "C:\Users\Maxraven\AppData\Roaming\mgrec.dll",SyntaxLocation [x]
Tcpip\Parameters: [DhcpNameServer] 192.168.0.1
AppInit_DLLs: acaptuser64.dll
SubSystems: [Windows] ATTENTION! ====> ZeroAccess
Startup: C:\Users\All Users\Start Menu\Programs\Startup\AsusVibeLauncher.lnk
ShortcutTarget: AsusVibeLauncher.lnk -> C:\Program Files (x86)\ASUS\AsusVibe\AsusVibeLauncher.exe ()
Startup: C:\Users\Maxraven\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> (No File)

==================== Services (Whitelisted) ===================

2 Atheros Bt&Wlan Coex Agent; C:\Program Files (x86)\Atheros\Ath_CoexAgent.exe [151552 2010-05-24] (Atheros)
2 AtherosSvc; C:\Program Files (x86)\Atheros\Bluetooth Suite\adminservice.exe [52896 2010-11-25] (Atheros Commnucations)
2 ATKGFNEXSrv; C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe [96896 2009-12-15] (ASUS)
2 Autodesk Content Service; "C:\Program Files (x86)\Autodesk\Content Service\Connect.Service.ContentService.exe" [18656 2011-02-02] ()
2 CLPSLS; C:\Program Files\COMODO\COMODO GeekBuddy\CLPSLS.exe [161080 2011-05-25] (COMODO)
2 MBAMScheduler; "C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe" [399432 2012-09-07] (Malwarebytes Corporation)
2 MBAMService; "C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe" [676936 2012-09-07] (Malwarebytes Corporation)
2 mi-raysat_3dsmax2010_64; "C:\Program Files\Autodesk\3ds Max 2010\mentalray\satellite\raysat_3dsmax2010_64server.exe" [86016 2009-03-12] ()
2 mi-raysat_3dsmax2012_64; "C:\Program Files\Autodesk\3ds Max 2012\mentalimages\satellite\raysat_3dsmax2012_64server.exe" [86016 2011-02-22] ()
2 VideAceWindowsService; C:\ExpressGateUtil\VAWinService.exe [77312 2010-08-20] ()
2 Shockprf; C:\Windows\System32\bc_ngn.dll [x]

==================== Drivers (Whitelisted) =====================

1 ATKWMIACPIIO; \??\C:\Program Files (x86)\ASUS\ATK Package\ATK WMIACPI\atkwmiacpi64.sys [17024 2010-07-26] (ASUS)
3 FLxHCIh; C:\Windows\System32\Drivers\FLxHCIh.sys [81920 2011-02-24] (Fresco Logic)
3 kbfiltr; C:\Windows\System32\Drivers\kbfiltr.sys [15416 2009-07-20] ( )
3 MBAMProtector; \??\C:\Windows\system32\drivers\mbam.sys [25928 2012-09-07] (Malwarebytes Corporation)
0 sptd; C:\Windows\System32\Drivers\sptd.sys [862704 2012-01-21] (Duplex Secure Ltd.)
3 ALSysIO; \??\C:\Users\Maxraven\AppData\Local\Temp\ALSysIO64.sys [x]
4 NVHDA; C:\Windows\System32\drivers\nvhda64v.sys [x]

==================== NetSvcs (Whitelisted) ====================

NETSVC: Shockprf -> C:\Windows\system32\bc_ngn.dll ==> No File.

==================== One Month Created Files and Folders ========

2012-09-27 21:54 - 2012-09-27 21:54 - 00001047 ____A C:\Users\Public\Desktop\COMODO GeekBuddy.lnk
2012-09-27 21:54 - 2012-09-27 21:54 - 00000000 ____D C:\Users\All Users\Comodo
2012-09-27 21:54 - 2012-09-27 21:54 - 00000000 ____D C:\Program Files\COMODO
2012-09-27 21:53 - 2012-09-27 21:53 - 00000000 ____D C:\Users\All Users\Comodo Downloader
2012-09-27 21:52 - 2012-09-27 21:52 - 00001205 ____A C:\Users\Maxraven\Downloads\FixNCR.reg
2012-09-27 21:32 - 2012-09-27 21:32 - 00540921 ____A C:\Users\Maxraven\Downloads\Autoruns.zip
2012-09-27 20:56 - 2012-09-27 20:56 - 00000000 ____D C:\Program Files (x86)\ESET
2012-09-27 20:07 - 2012-09-27 20:07 - 00144504 ____A C:\Users\Maxraven\AppData\Local\GDIPFONTCACHEV1.DAT
2012-09-27 17:58 - 2012-09-27 17:58 - 00000000 ____D C:\Users\Maxraven\AppData\Roaming\Malwarebytes
2012-09-27 17:57 - 2012-09-27 17:57 - 10524080 ____A (Malwarebytes Corporation ) C:\Users\Maxraven\Downloads\mbam-setup-1.65.0.1400.exe
2012-09-27 17:57 - 2012-09-27 17:57 - 00001111 ____A C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2012-09-27 17:57 - 2012-09-27 17:57 - 00000000 ____D C:\Users\All Users\Malwarebytes
2012-09-27 17:57 - 2012-09-27 17:57 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2012-09-27 17:57 - 2012-09-07 16:04 - 00025928 ____A (Malwarebytes Corporation) C:\Windows\System32\Drivers\mbam.sys
2012-09-27 17:08 - 2012-09-27 17:08 - 00000000 ____D C:\Users\Maxraven\AppData\Local\{ED3A7897-0908-11E2-8271-B8AC6F996F26}
2012-09-27 16:24 - 2012-09-27 16:24 - 00000000 ____D C:\Users\Default\AppData\Local\Power2Go
2012-09-27 16:24 - 2012-09-27 16:24 - 00000000 ____D C:\Users\Default User\AppData\Local\Power2Go
2012-09-27 15:45 - 2012-09-27 16:01 - 128151061 ____A C:\Users\Maxraven\Downloads\180_Sanura_Eternal_sunshine_femjoy_HD__________galitsin-new.clan.su.wmv
2012-09-26 22:44 - 2012-09-27 08:21 - 00001020 ____A C:\Users\Maxraven\Desktop\san benito shutters leads.txt
2012-09-26 16:55 - 2012-09-27 20:08 - 00000000 ___RD C:\Users\Maxraven\Dropbox
2012-09-26 16:55 - 2012-09-26 16:55 - 00001049 ____A C:\Users\Maxraven\Desktop\Dropbox.lnk
2012-09-26 16:53 - 2012-09-27 20:08 - 00000000 ____D C:\Users\Maxraven\AppData\Roaming\Dropbox
2012-09-26 15:56 - 2012-09-26 16:07 - 00000000 ____D C:\Users\Maxraven\Documents\Moyea
2012-09-26 15:56 - 2012-09-26 16:07 - 00000000 ____D C:\Users\Maxraven\AppData\Roaming\Moyea
2012-09-26 15:56 - 2012-09-26 15:56 - 00001016 ____A C:\Users\Public\Desktop\Moyea Free Flash Downloader.lnk
2012-09-26 15:56 - 2012-09-26 15:56 - 00000981 ____A C:\Users\Public\Desktop\Moyea SWF to Video Converter Pro.lnk
2012-09-26 15:56 - 2012-09-26 15:56 - 00000000 ____D C:\Program Files\Moyea
2012-09-26 15:56 - 2008-10-10 13:22 - 00606208 ____A (http://www.xvid.org) C:\Windows\SysWOW64\xvidcore.dll
2012-09-26 15:52 - 2012-09-26 15:55 - 24479184 ____A C:\Users\Maxraven\Downloads\Moyea.SWF.to.Video.Converter.Pro.v.3.12.0.0.incl.patch-iOTA.zip
2012-09-26 15:46 - 2012-09-26 15:48 - 00000000 ____D C:\Program Files (x86)\Flash-SWF to AVI-GIF
2012-09-26 15:30 - 2012-09-26 15:34 - 00000000 ____D C:\Program Files (x86)\Free FLV Converter
2012-09-26 15:30 - 2012-09-26 15:30 - 00000000 ____D C:\Users\Maxraven\AppData\Roaming\FreeFLVConverter
2012-09-26 15:30 - 2012-02-15 13:51 - 00360448 ____A (FLV.com) C:\Windows\SysWOW64\TubeFinder.exe
2012-09-26 15:30 - 2011-09-28 08:18 - 00364544 ____A C:\Windows\SysWOW64\PropertyGrid.ocx
2012-09-26 15:30 - 2011-09-28 08:18 - 00208500 ____A C:\Windows\SysWOW64\ReyXpBasics.tlb
2012-09-26 15:30 - 2011-09-28 08:18 - 00141312 ____A (Microsoft Corporation) C:\Windows\SysWOW64\MSCMCFR.DLL
2012-09-26 15:30 - 2011-09-28 08:18 - 00119568 ____A (Microsoft Corporation) C:\Windows\SysWOW64\VB6FR.DLL
2012-09-26 15:30 - 2011-09-28 08:18 - 00101888 ____A (Microsoft Corporation) C:\Windows\SysWOW64\VB6STKIT.DLL
2012-09-26 15:30 - 2011-09-28 08:18 - 00084512 ____A (Microsoft Corporation) C:\Windows\SysWOW64\PICCLP32.OCX
2012-09-26 15:30 - 2011-09-28 08:18 - 00032768 ____A (Microsoft Corporation) C:\Windows\SysWOW64\CMDLGFR.DLL
2012-09-26 15:30 - 2011-09-28 08:18 - 00024576 ____A C:\Windows\SysWOW64\ControlSubX.ocx
2012-09-26 15:30 - 2011-09-28 08:18 - 00009728 ____A (Microsoft Corporation) C:\Windows\SysWOW64\PCCLPFR.DLL
2012-09-26 15:06 - 2007-03-23 15:55 - 00035928 ___RA (Adobe Systems Incorporated.) C:\Windows\System32\AdobePDF64.dll
2012-09-26 07:29 - 2012-09-26 07:55 - 83023306 ___AT C:\Users\All Users\nogolniw.pad
2012-09-25 15:33 - 2012-09-25 15:37 - 54169532 ____A C:\Users\Maxraven\Downloads\ELCD.zip
2012-09-25 15:02 - 2012-08-21 13:01 - 00245760 ____A (Microsoft Corporation) C:\Windows\System32\OxpsConverter.exe
2012-09-25 07:29 - 2012-08-24 03:15 - 17810944 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2012-09-25 07:29 - 2012-08-24 02:39 - 10925568 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2012-09-25 07:29 - 2012-08-24 02:31 - 02312704 ____A (Microsoft Corporation) C:\Windows\System32\jscript9.dll
2012-09-25 07:29 - 2012-08-24 02:22 - 01346048 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2012-09-25 07:29 - 2012-08-24 02:21 - 01392128 ____A (Microsoft Corporation) C:\Windows\System32\wininet.dll
2012-09-25 07:29 - 2012-08-24 02:20 - 01494528 ____A (Microsoft Corporation) C:\Windows\System32\inetcpl.cpl
2012-09-25 07:29 - 2012-08-24 02:18 - 00237056 ____A (Microsoft Corporation) C:\Windows\System32\url.dll
2012-09-25 07:29 - 2012-08-24 02:17 - 00085504 ____A (Microsoft Corporation) C:\Windows\System32\jsproxy.dll
2012-09-25 07:29 - 2012-08-24 02:14 - 00816640 ____A (Microsoft Corporation) C:\Windows\System32\jscript.dll
2012-09-25 07:29 - 2012-08-24 02:14 - 00173056 ____A (Microsoft Corporation) C:\Windows\System32\ieUnatt.exe
2012-09-25 07:29 - 2012-08-24 02:13 - 00599040 ____A (Microsoft Corporation) C:\Windows\System32\vbscript.dll
2012-09-25 07:29 - 2012-08-24 02:12 - 02144768 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2012-09-25 07:29 - 2012-08-24 02:11 - 00729088 ____A (Microsoft Corporation) C:\Windows\System32\msfeeds.dll
2012-09-25 07:29 - 2012-08-24 02:10 - 00096768 ____A (Microsoft Corporation) C:\Windows\System32\mshtmled.dll
2012-09-25 07:29 - 2012-08-24 02:09 - 02382848 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2012-09-25 07:29 - 2012-08-24 02:04 - 00248320 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll
2012-09-25 07:29 - 2012-08-23 23:27 - 12319744 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2012-09-25 07:29 - 2012-08-23 23:03 - 09738240 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2012-09-25 07:29 - 2012-08-23 22:59 - 01800704 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2012-09-25 07:29 - 2012-08-23 22:51 - 01427968 ____A (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2012-09-25 07:29 - 2012-08-23 22:51 - 01129472 ____A (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2012-09-25 07:29 - 2012-08-23 22:51 - 01103872 ____A (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2012-09-25 07:29 - 2012-08-23 22:49 - 00231936 ____A (Microsoft Corporation) C:\Windows\SysWOW64\url.dll
2012-09-25 07:29 - 2012-08-23 22:48 - 00065024 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2012-09-25 07:29 - 2012-08-23 22:47 - 00717824 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2012-09-25 07:29 - 2012-08-23 22:47 - 00420864 ____A (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2012-09-25 07:29 - 2012-08-23 22:47 - 00142848 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2012-09-25 07:29 - 2012-08-23 22:45 - 00607744 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2012-09-25 07:29 - 2012-08-23 22:44 - 01793024 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2012-09-25 07:29 - 2012-08-23 22:44 - 00073216 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2012-09-25 07:29 - 2012-08-23 22:43 - 02382848 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2012-09-25 07:29 - 2012-08-23 22:40 - 00176640 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2012-09-19 11:16 - 2012-09-19 11:17 - 00014848 __ASH C:\Users\Maxraven\Downloads\Thumbs.db
2012-09-19 11:16 - 2012-09-19 11:16 - 00016896 __ASH C:\Users\Maxraven\Desktop\Thumbs.db
2012-09-12 06:51 - 2012-08-22 10:12 - 01913200 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\tcpip.sys
2012-09-12 06:51 - 2012-08-22 10:12 - 00950128 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\ndis.sys
2012-09-12 06:51 - 2012-08-22 10:12 - 00376688 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\netio.sys
2012-09-12 06:51 - 2012-08-22 10:12 - 00288624 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\FWPKCLNT.SYS
2012-09-12 06:51 - 2012-08-02 09:58 - 00574464 ____A (Microsoft Corporation) C:\Windows\System32\d3d10level9.dll
2012-09-12 06:51 - 2012-08-02 08:57 - 00490496 ____A (Microsoft Corporation) C:\Windows\SysWOW64\d3d10level9.dll
2012-09-12 06:51 - 2012-07-04 12:26 - 00041472 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\RNDISMP.sys
2012-09-06 16:17 - 2012-09-06 16:46 - 04602679 ____A C:\Users\Maxraven\Downloads\Incoterms.2010.tvdt
2012-09-03 19:11 - 2012-07-06 12:07 - 00552960 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\bthport.sys
2012-09-03 14:36 - 2012-07-18 10:15 - 03148800 ____A (Microsoft Corporation) C:\Windows\System32\win32k.sys
2012-09-03 14:36 - 2012-07-04 14:16 - 00073216 ____A (Microsoft Corporation) C:\Windows\System32\netapi32.dll
2012-09-03 14:36 - 2012-07-04 14:13 - 00136704 ____A (Microsoft Corporation) C:\Windows\System32\browser.dll
2012-09-03 14:36 - 2012-07-04 14:13 - 00059392 ____A (Microsoft Corporation) C:\Windows\System32\browcli.dll
2012-09-03 14:36 - 2012-07-04 13:16 - 00057344 ____A (Microsoft Corporation) C:\Windows\SysWOW64\netapi32.dll
2012-09-03 14:36 - 2012-07-04 13:14 - 00041984 ____A (Microsoft Corporation) C:\Windows\SysWOW64\browcli.dll
2012-09-03 14:36 - 2012-05-13 21:26 - 00956928 ____A (Microsoft Corporation) C:\Windows\System32\localspl.dll
2012-09-03 14:36 - 2012-05-05 00:36 - 00503808 ____A (Microsoft Corporation) C:\Windows\System32\srcore.dll
2012-09-03 14:36 - 2012-05-04 23:46 - 00043008 ____A (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll
2012-09-03 14:36 - 2012-02-10 22:43 - 00751104 ____A (Microsoft Corporation) C:\Windows\System32\win32spl.dll
2012-09-03 14:36 - 2012-02-10 22:36 - 00559104 ____A (Microsoft Corporation) C:\Windows\System32\spoolsv.exe
2012-09-03 14:36 - 2012-02-10 21:43 - 00492032 ____A (Microsoft Corporation) C:\Windows\SysWOW64\win32spl.dll
2012-09-03 10:46 - 2012-09-03 10:55 - 00000000 ____D C:\Users\All Users\225932FDE577017A5B57260AF875F002
2012-09-03 10:45 - 2012-09-03 10:46 - 00000464 ____A C:\Users\Maxraven\AppData\Roaming\lyjsb
2012-09-03 10:45 - 2012-09-03 10:45 - 00000000 ____A C:\Users\Maxraven\AppData\Local\¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ
2012-09-03 10:44 - 2012-09-03 10:44 - 00090176 ____A C:\Users\Maxraven\AppData\Roaming\lj1y6nb.dat
2012-09-03 10:44 - 2012-09-03 10:44 - 00086080 ____A C:\Users\Maxraven\AppData\Roaming\aftr4sb.dat
2012-08-31 12:43 - 2012-08-31 12:54 - 83023306 ___AT C:\Users\All Users\nud0repor.pad
2012-08-29 04:00 - 2012-08-29 04:00 - 00000000 ____D C:\Users\Maxraven\AppData\Roaming\ZTEMTUI


==================== 3 Months Modified Files ==================

2012-09-27 23:27 - 2011-04-28 14:52 - 00241428 ____A C:\Windows\PFRO.log
2012-09-27 21:54 - 2012-09-27 21:54 - 00001047 ____A C:\Users\Public\Desktop\COMODO GeekBuddy.lnk
2012-09-27 21:52 - 2012-09-27 21:52 - 00001205 ____A C:\Users\Maxraven\Downloads\FixNCR.reg
2012-09-27 21:32 - 2012-09-27 21:32 - 00540921 ____A C:\Users\Maxraven\Downloads\Autoruns.zip
2012-09-27 21:23 - 2009-07-13 21:13 - 00778660 ____A C:\Windows\System32\PerfStringBackup.INI
2012-09-27 20:07 - 2012-09-27 20:07 - 00144504 ____A C:\Users\Maxraven\AppData\Local\GDIPFONTCACHEV1.DAT
2012-09-27 20:07 - 2012-01-19 17:27 - 00045056 ____A C:\Windows\System32\acovcnt.exe
2012-09-27 20:07 - 2011-04-28 15:10 - 00000035 ____A C:\Users\Public\Documents\AtherosServiceConfig.ini
2012-09-27 20:07 - 2009-07-13 21:08 - 00000006 ___AH C:\Windows\Tasks\SA.DAT
2012-09-27 20:07 - 2009-07-13 20:51 - 00069745 ____A C:\Windows\setupact.log
2012-09-27 19:47 - 2009-07-13 20:45 - 00009920 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2012-09-27 19:47 - 2009-07-13 20:45 - 00009920 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2012-09-27 18:12 - 2011-04-28 15:12 - 00001584 ____A C:\Windows\System32\ServiceFilter.ini
2012-09-27 17:57 - 2012-09-27 17:57 - 10524080 ____A (Malwarebytes Corporation ) C:\Users\Maxraven\Downloads\mbam-setup-1.65.0.1400.exe
2012-09-27 17:57 - 2012-09-27 17:57 - 00001111 ____A C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2012-09-27 17:48 - 2011-04-28 14:00 - 01418785 ____A C:\Windows\WindowsUpdate.log
2012-09-27 16:24 - 2012-07-13 08:15 - 00000830 ____A C:\Windows\Tasks\Adobe Flash Player Updater.job
2012-09-27 16:24 - 2011-04-28 15:12 - 00002668 ____A C:\Windows\System32\AutoRunFilter.ini
2012-09-27 16:01 - 2012-09-27 15:45 - 128151061 ____A C:\Users\Maxraven\Downloads\180_Sanura_Eternal_sunshine_femjoy_HD__________galitsin-new.clan.su.wmv
2012-09-27 08:21 - 2012-09-26 22:44 - 00001020 ____A C:\Users\Maxraven\Desktop\san benito shutters leads.txt
2012-09-26 16:55 - 2012-09-26 16:55 - 00001049 ____A C:\Users\Maxraven\Desktop\Dropbox.lnk
2012-09-26 15:56 - 2012-09-26 15:56 - 00001016 ____A C:\Users\Public\Desktop\Moyea Free Flash Downloader.lnk
2012-09-26 15:56 - 2012-09-26 15:56 - 00000981 ____A C:\Users\Public\Desktop\Moyea SWF to Video Converter Pro.lnk
2012-09-26 15:55 - 2012-09-26 15:52 - 24479184 ____A C:\Users\Maxraven\Downloads\Moyea.SWF.to.Video.Converter.Pro.v.3.12.0.0.incl.patch-iOTA.zip
2012-09-26 15:08 - 2009-07-13 20:45 - 05070400 ____A C:\Windows\System32\FNTCACHE.DAT
2012-09-26 15:06 - 2012-03-11 09:13 - 00002029 ____A C:\Users\Public\Desktop\Adobe Acrobat 3D Version 8.lnk
2012-09-26 07:55 - 2012-09-26 07:29 - 83023306 ___AT C:\Users\All Users\nogolniw.pad
2012-09-25 15:37 - 2012-09-25 15:33 - 54169532 ____A C:\Users\Maxraven\Downloads\ELCD.zip
2012-09-21 08:22 - 2009-07-13 21:08 - 00032574 ____A C:\Windows\Tasks\SCHEDLGU.TXT
2012-09-20 13:24 - 2012-07-13 08:14 - 00696240 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2012-09-20 13:24 - 2012-02-02 13:11 - 00073136 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2012-09-19 11:17 - 2012-09-19 11:16 - 00014848 __ASH C:\Users\Maxraven\Downloads\Thumbs.db
2012-09-19 11:16 - 2012-09-19 11:16 - 00016896 __ASH C:\Users\Maxraven\Desktop\Thumbs.db
2012-09-18 09:23 - 2012-08-03 08:47 - 00001680 ____A C:\Users\Maxraven\Desktop\Obelisk Jobs.lnk
2012-09-12 17:13 - 2012-01-20 23:21 - 64462936 ____A (Microsoft Corporation) C:\Windows\System32\MRT.exe
2012-09-12 17:08 - 2012-02-02 18:10 - 00000170 ____A C:\Windows\AGSCDV3.INI
2012-09-07 16:04 - 2012-09-27 17:57 - 00025928 ____A (Malwarebytes Corporation) C:\Windows\System32\Drivers\mbam.sys
2012-09-06 16:46 - 2012-09-06 16:17 - 04602679 ____A C:\Users\Maxraven\Downloads\Incoterms.2010.tvdt
2012-09-03 10:46 - 2012-09-03 10:45 - 00000464 ____A C:\Users\Maxraven\AppData\Roaming\lyjsb
2012-09-03 10:45 - 2012-09-03 10:45 - 00000000 ____A C:\Users\Maxraven\AppData\Local\¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ
2012-09-03 10:44 - 2012-09-03 10:44 - 00090176 ____A C:\Users\Maxraven\AppData\Roaming\lj1y6nb.dat
2012-09-03 10:44 - 2012-09-03 10:44 - 00086080 ____A C:\Users\Maxraven\AppData\Roaming\aftr4sb.dat
2012-08-31 12:54 - 2012-08-31 12:43 - 83023306 ___AT C:\Users\All Users\nud0repor.pad
2012-08-24 03:15 - 2012-09-25 07:29 - 17810944 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2012-08-24 02:39 - 2012-09-25 07:29 - 10925568 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2012-08-24 02:31 - 2012-09-25 07:29 - 02312704 ____A (Microsoft Corporation) C:\Windows\System32\jscript9.dll
2012-08-24 02:22 - 2012-09-25 07:29 - 01346048 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2012-08-24 02:21 - 2012-09-25 07:29 - 01392128 ____A (Microsoft Corporation) C:\Windows\System32\wininet.dll
2012-08-24 02:20 - 2012-09-25 07:29 - 01494528 ____A (Microsoft Corporation) C:\Windows\System32\inetcpl.cpl
2012-08-24 02:18 - 2012-09-25 07:29 - 00237056 ____A (Microsoft Corporation) C:\Windows\System32\url.dll
2012-08-24 02:17 - 2012-09-25 07:29 - 00085504 ____A (Microsoft Corporation) C:\Windows\System32\jsproxy.dll
2012-08-24 02:14 - 2012-09-25 07:29 - 00816640 ____A (Microsoft Corporation) C:\Windows\System32\jscript.dll
2012-08-24 02:14 - 2012-09-25 07:29 - 00173056 ____A (Microsoft Corporation) C:\Windows\System32\ieUnatt.exe
2012-08-24 02:13 - 2012-09-25 07:29 - 00599040 ____A (Microsoft Corporation) C:\Windows\System32\vbscript.dll
2012-08-24 02:12 - 2012-09-25 07:29 - 02144768 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2012-08-24 02:11 - 2012-09-25 07:29 - 00729088 ____A (Microsoft Corporation) C:\Windows\System32\msfeeds.dll
2012-08-24 02:10 - 2012-09-25 07:29 - 00096768 ____A (Microsoft Corporation) C:\Windows\System32\mshtmled.dll
2012-08-24 02:09 - 2012-09-25 07:29 - 02382848 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2012-08-24 02:04 - 2012-09-25 07:29 - 00248320 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll
2012-08-23 23:27 - 2012-09-25 07:29 - 12319744 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2012-08-23 23:03 - 2012-09-25 07:29 - 09738240 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2012-08-23 22:59 - 2012-09-25 07:29 - 01800704 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2012-08-23 22:51 - 2012-09-25 07:29 - 01427968 ____A (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2012-08-23 22:51 - 2012-09-25 07:29 - 01129472 ____A (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2012-08-23 22:51 - 2012-09-25 07:29 - 01103872 ____A (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2012-08-23 22:49 - 2012-09-25 07:29 - 00231936 ____A (Microsoft Corporation) C:\Windows\SysWOW64\url.dll
2012-08-23 22:48 - 2012-09-25 07:29 - 00065024 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2012-08-23 22:47 - 2012-09-25 07:29 - 00717824 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2012-08-23 22:47 - 2012-09-25 07:29 - 00420864 ____A (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2012-08-23 22:47 - 2012-09-25 07:29 - 00142848 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2012-08-23 22:45 - 2012-09-25 07:29 - 00607744 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2012-08-23 22:44 - 2012-09-25 07:29 - 01793024 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2012-08-23 22:44 - 2012-09-25 07:29 - 00073216 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2012-08-23 22:43 - 2012-09-25 07:29 - 02382848 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2012-08-23 22:40 - 2012-09-25 07:29 - 00176640 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2012-08-22 10:12 - 2012-09-12 06:51 - 01913200 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\tcpip.sys
2012-08-22 10:12 - 2012-09-12 06:51 - 00950128 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\ndis.sys
2012-08-22 10:12 - 2012-09-12 06:51 - 00376688 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\netio.sys
2012-08-22 10:12 - 2012-09-12 06:51 - 00288624 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\FWPKCLNT.SYS
2012-08-21 13:01 - 2012-09-25 15:02 - 00245760 ____A (Microsoft Corporation) C:\Windows\System32\OxpsConverter.exe
2012-08-07 13:42 - 2012-08-07 13:42 - 00238086 ____A C:\Users\Maxraven\Downloads\FP13.dwg
2012-08-07 13:19 - 2012-08-07 13:11 - 20136827 ____A C:\Users\Maxraven\Downloads\Google.Earth.Pro.v4.0.2737-FF.rar
2012-08-05 13:47 - 2012-08-05 13:47 - 00228448 ____A C:\Users\Maxraven\Downloads\new block.dwg
2012-08-05 13:46 - 2012-08-05 13:46 - 00407374 ____A C:\Users\Maxraven\Downloads\12-0804-tangshan-site.dwg
2012-08-02 09:58 - 2012-09-12 06:51 - 00574464 ____A (Microsoft Corporation) C:\Windows\System32\d3d10level9.dll
2012-08-02 08:57 - 2012-09-12 06:51 - 00490496 ____A (Microsoft Corporation) C:\Windows\SysWOW64\d3d10level9.dll
2012-07-31 14:04 - 2012-07-31 14:04 - 02139136 ____A C:\Users\Maxraven\Downloads\Jardines-Verticales-de-Patrick-Blanc.ppt
2012-07-31 10:50 - 2012-03-08 23:06 - 00272896 ____A (Progressive Networks) C:\Windows\SysWOW64\pncrt.dll
2012-07-31 10:50 - 2012-03-08 23:06 - 00198864 ____A (RealNetworks, Inc.) C:\Windows\SysWOW64\rmoc3260.dll
2012-07-31 10:50 - 2012-03-08 23:06 - 00006656 ____A (RealNetworks, Inc.) C:\Windows\SysWOW64\pndx5016.dll
2012-07-31 10:50 - 2012-03-08 23:06 - 00005632 ____A (RealNetworks, Inc.) C:\Windows\SysWOW64\pndx5032.dll
2012-07-31 10:50 - 2003-10-17 12:44 - 00499712 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msvcp71.dll
2012-07-31 10:50 - 2003-10-17 12:44 - 00348160 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msvcr71.dll
2012-07-22 09:29 - 2012-03-19 21:46 - 00194885 ____A C:\Users\Maxraven\Downloads\hjsplit.zip
2012-07-18 10:15 - 2012-09-03 14:36 - 03148800 ____A (Microsoft Corporation) C:\Windows\System32\win32k.sys
2012-07-17 10:51 - 2012-07-17 10:51 - 00304929 ____A C:\Users\Maxraven\Downloads\850-0001__Projected_Windows.dwg
2012-07-17 10:18 - 2012-07-17 10:18 - 00512842 ____A C:\Users\Maxraven\Downloads\3800-001.dwg
2012-07-17 10:17 - 2012-07-17 10:17 - 00348122 ____A C:\Users\Maxraven\Downloads\3800-C07-U-CORNER-DETAIL;U-Corner.dwg
2012-07-16 08:32 - 2012-07-16 08:31 - 00002954 ____A C:\Windows\SysWOW64\jupdate-1.7.0_05-b06.log
2012-07-10 18:22 - 2012-07-10 18:22 - 00264032 ____A C:\Windows\msxml4-KB2721691-enu.LOG
2012-07-10 17:10 - 2011-04-28 14:36 - 00247259 ____A C:\Windows\DirectX.log
2012-07-10 15:28 - 2012-07-10 15:28 - 01221288 ____A C:\Windows\Minidump\071012-20794-01.dmp
2012-07-06 12:07 - 2012-09-03 19:11 - 00552960 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\bthport.sys
2012-07-05 21:06 - 2012-07-16 08:32 - 00227760 ____A (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2012-07-05 21:06 - 2012-05-15 07:02 - 00772544 ____A (Oracle Corporation) C:\Windows\SysWOW64\npDeployJava1.dll
2012-07-05 21:06 - 2012-05-15 07:02 - 00687544 ____A (Oracle Corporation) C:\Windows\SysWOW64\deployJava1.dll
2012-07-04 14:16 - 2012-09-03 14:36 - 00073216 ____A (Microsoft Corporation) C:\Windows\System32\netapi32.dll
2012-07-04 14:13 - 2012-09-03 14:36 - 00136704 ____A (Microsoft Corporation) C:\Windows\System32\browser.dll
2012-07-04 14:13 - 2012-09-03 14:36 - 00059392 ____A (Microsoft Corporation) C:\Windows\System32\browcli.dll
2012-07-04 13:16 - 2012-09-03 14:36 - 00057344 ____A (Microsoft Corporation) C:\Windows\SysWOW64\netapi32.dll
2012-07-04 13:14 - 2012-09-03 14:36 - 00041984 ____A (Microsoft Corporation) C:\Windows\SysWOW64\browcli.dll
2012-07-04 12:26 - 2012-09-12 06:51 - 00041472 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\RNDISMP.sys


ZeroAccess:
C:\Windows\assembly\GAC_32\Desktop.ini

ZeroAccess:
C:\Windows\assembly\GAC_64\Desktop.ini

ZeroAccess:
C:\$Recycle.Bin\S-1-5-21-841272215-2678422463-1907801364-1001\$21e194afe2d41d030ce555d3bc513deb

==================== Known DLLs (Whitelisted) =================


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

==================== EXE ASSOCIATION =====================

HKLM\...\.exe: exefile => OK
HKLM\...\exefile\DefaultIcon: %1 => OK
HKLM\...\exefile\open\command: "%1" %* => OK

==================== Restore Points =========================


==================== Memory info ===========================

Percentage of memory in use: 10%
Total physical RAM: 8169.16 MB
Available physical RAM: 7304.81 MB
Total Pagefile: 8167.31 MB
Available Pagefile: 7341.98 MB
Total Virtual: 8192 MB
Available Virtual: 8191.9 MB

==================== Partitions =============================

1 Drive c: (OS) (Fixed) (Total:116.44 GB) (Free:35.79 GB) NTFS ==>[System with boot components (obtained from reading drive)]
2 Drive d: (DATA) (Fixed) (Total:327.83 GB) (Free:327.73 GB) NTFS
3 Drive e: (ASRDVD_1) (CDROM) (Total:3.79 GB) (Free:0 GB) CDFS
4 Drive f: () (Removable) (Total:3.84 GB) (Free:0.09 GB) NTFS
5 Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS

Disk ### Status Size Free Dyn Gpt
-------- ------------- ------- ------- --- ---
Disk 0 Online 465 GB 1024 KB
Disk 1 Online 3935 MB 0 B

Partitions of Disk 0:
===============

Partition ### Type Size Offset
------------- ---------------- ------- -------
Partition 1 Primary 21 GB 31 KB
Partition 2 Primary 116 GB 21 GB
Partition 0 Extended 327 GB 137 GB
Partition 3 Logical 327 GB 137 GB

==================================================================================

Disk: 0
Partition 1
Type : 1C
Hidden: Yes
Active: No

There is no volume associated with this partition.

=========================================================

Disk: 0
Partition 2
Type : 07
Hidden: No
Active: Yes

Volume ### Ltr Label Fs Type Size Status Info
---------- --- ----------- ----- ---------- ------- --------- --------
* Volume 1 C OS NTFS Partition 116 GB Healthy

=========================================================

Disk: 0
Partition 3
Type : 07
Hidden: No
Active: No

Volume ### Ltr Label Fs Type Size Status Info
---------- --- ----------- ----- ---------- ------- --------- --------
* Volume 2 D DATA NTFS Partition 327 GB Healthy

=========================================================

Partitions of Disk 1:
===============

Partition ### Type Size Offset
------------- ---------------- ------- -------
Partition 1 Primary 3934 MB 16 KB

==================================================================================

Disk: 1
Partition 1
Type : 07
Hidden: No
Active: Yes

Volume ### Ltr Label Fs Type Size Status Info
---------- --- ----------- ----- ---------- ------- --------- --------
* Volume 3 F NTFS Removable 3934 MB Healthy

=========================================================

Last Boot: 2012-09-26 10:21

==================== End Of Log =============================

Open notepad. Please copy and paste the entire contents of the code box below. (To do this highlight the contents of the box, right click on it and select copy. Right-click in the open notepad and select Paste). Save it next to FRST in the flashdrive as fixlist.txt

start
SubSystems: [Windows] ATTENTION! ====> ZeroAccess
C:\Windows\assembly\GAC_32\Desktop.ini
C:\Windows\assembly\GAC_64\Desktop.ini
C:\$Recycle.Bin\S-1-5-21-841272215-2678422463-1907801364-1001\$21e194afe2d41d030ce555d3bc513deb
NETSVC: Shockprf -> C:\Windows\system32\bc_ngn.dll ==> No File.
HKU\Maxraven\...\Run: [Akamai NetSession Interface] "C:\Users\Maxraven\AppData\Local\Akamai\netsession_win.exe" [x]
HKU\Maxraven\...\Run: [] C:\Users\Maxraven\AppData\Local\Temp\fvJcrgR.exe [x]
HKU\Maxraven\...\Run: [WinSyncProviders] C:\Users\Maxraven\AppData\Local\Microsoft\Windows\3023\WinSyncProviders.exe [x]
HKU\Maxraven\...\Run: [mgrec] rundll32.exe "C:\Users\Maxraven\AppData\Roaming\mgrec.dll",SyntaxLocation [x]
end

NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

If the fix could be applied you should be able to boot normally.

Now please enter System Recovery Options.

Run FRST and press the Fix button just once and wait.
The tool will make a log in the flashdrive (Fixlog.txt) please post it to your reply.


If successful, attempt to boot in Normal Mode and let me know the outcome.

Hello, just letting you know I moved this topic to Here in the Virus, Trojan, Spyware, and Malware Removal Logs forum where it will stay.

Please remember to click the Watch Topic button at the top right and select Immediate Notification so you do not miss any replies now that you were moved.


I also deleted the other two duplicate posts.

Hi JSntgRvr,
It worked! You're the MAN!
I notice there are two unknown applications appear on the desktop: GeekBuddy and AntiError. Is it harmful?

Here's my recovery log:

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 25-09-2012
Ran by SYSTEM at 2012-09-28 12:32:30 Run:1
Running from F:\

==============================================

HKEY_LOCAL_MACHINE\System\ControlSet001\Control\Session Manager\SubSystems\\Windows Value was restored successfully .
C:\Windows\assembly\GAC_32\Desktop.ini moved successfully.
C:\Windows\assembly\GAC_64\Desktop.ini moved successfully.
C:\$Recycle.Bin\S-1-5-21-841272215-2678422463-1907801364-1001\$21e194afe2d41d030ce555d3bc513deb moved successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost\\netsvcs Shockprf Deleted successfully.
HKEY_USERS\Maxraven\Software\Microsoft\Windows\CurrentVersion\Run\\Akamai NetSession Interface Value deleted successfully.
HKEY_USERS\Maxraven\Software\Microsoft\Windows\CurrentVersion\Run\\WinSyncProviders Value deleted successfully.
HKEY_USERS\Maxraven\Software\Microsoft\Windows\CurrentVersion\Run\\mgrec Value deleted successfully.

==== End of Fixlog ====

Lets perform a scan and find-out.

Please download Malwarebytes' Anti-Malware from Here. Never download Malwarebytes' Anti-Malware from other sources.

Double Click mbam-setup.exe to install the application.

• Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
• If an update is found, it will download and install the latest version.
• Once the program has loaded, select "Perform Quick Scan", then click Scan.
• The scan may take some time to finish,so please be patient.
• When the scan is complete, click OK, then Show Results to view the results.
• Make sure that everything is checked, and click Remove Selected.
• When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
• The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
• Copy&Paste the entire report in your next reply.

Extra Note:

If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process. If asked to restart the computer, please do so immediatly.


ESET online scannner

Note: You can use either Internet Explorer or Mozilla FireFox for this scan.

Note: If you are using Windows Vista or Windows 7, open your browser by right-clicking on its icon and select 'Run as administrator' to perform this scan.

• First please Disable any Antivirus you have active, as shown in This topic.
• Note: Don't forget to re-enable it after the scan.
• Next hold down Control then click on the following link to open a new window to ESET online scannner.
• Select the option YES, I accept the Terms of Use then click on Start.
  
  

  Note: If using Mozilla Firefox you will need to download esetsmartinstaller_enu.exe when prompted then double click on it to install.

• All of the below instructions are compatible with either Internet Explorer or Mozilla FireFox.
• When prompted allow the Add-On/Active X to install.
• Make sure that the option Remove found threats is NOT checked, and the option Scan archives is checked.
• Now click on Advanced Settings and select the following:
  
  

  Scan for potentially unwanted applications
  Scan for potentially unsafe applications
  Enable Anti-Stealth Technology

• Now click on Start.
• The virus signature database... will begin to download. Be patient this make take some time depending on the speed of your Internet Connection.
• When completed the Online Scan will begin automatically.
• Do not touch either the Mouse or keyboard during the scan otherwise it may stall.
• When completed select Uninstall application on close if you so wish, make sure you copy the logfile first!
• Now click on Finish.
• Use notepad to open the logfile located at C:\Program Files\ESET\EsetOnlineScanner\log.txt.
• Copy and paste that log as a reply to this topic.

Download OTL to your Desktop

• Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
• OTL should now start. Change the following settings
  
  • Change Drivers to All
  • Change Standard Registry to All
  • Under File Scans, change File age to 30
• Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
  
  • When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt (first run only). These are saved in the same location as OTL.
  • Please post the contents of the OTL.txt file and attach the Extras.Txt, if any, in your next reply.

Due to the lack of feedback this Topic is closed. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!