Inactive-A ISeekDeal.dll paranoia

FNj · 2012/12/18

[Inactive-A] ISeekDeal.dll paranoia

I have the same problem Harpo had in this thread.

I. e. ISeekDeal.dll in /ProgramData/Plugin - deleted the folder and some obvious registry keys, but I ain't sure if it's all over yet like Harpo.

Here are the logs:

MBAM didn't find **** (I have the Czech localization, don't freak out ):
Malwarebytes Anti-Malware (ZkušebnÃ verze Malwarebytes Anti-Malware) 1.65.1.1000
www.malwarebytes.org

Verze databÃ¡ze: v2012.12.17.04

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 9.0.8112.16421
FNj :: FNJ-DENEB [administrÃ¡tor]

Ochrana: Povolena

18.12.2012 14:00:32
mbam-log-2012-12-18 (14-00-32).txt

Typ: RychlÃ¡ kontrola
NastavenÃ kontroly povoleno: Paměť | Po spuštěnÃ | Registr | SystÃ©movÃ© soubory | HeuristickÃ¡ analÃ½za Extra | HeuristickÃ¡ analÃ½za Shuriken | PUP | PUM
NastavenÃ kontroly zakÃ¡zÃ¡no: P2P
KontrolovanÃ© objekty: 201174
UplynulÃ½ čas: 1 minut, 6 sekund

NalezenÃ© procesy v paměti: 0
(ŽÃ¡dnÃ© škodlivÃ© položky nebyly zjištěny)

NalezenÃ© moduly v paměti: 0
(ŽÃ¡dnÃ© škodlivÃ© položky nebyly zjištěny)

NalezenÃ© klÃče v registru: 0
(ŽÃ¡dnÃ© škodlivÃ© položky nebyly zjištěny)

NalezenÃ© hodnoty v registru: 0
(ŽÃ¡dnÃ© škodlivÃ© položky nebyly zjištěny)

NalezenÃ© datovÃ© položky v registru: 0
(ŽÃ¡dnÃ© škodlivÃ© položky nebyly zjištěny)

NalezenÃ© složky: 0
(ŽÃ¡dnÃ© škodlivÃ© položky nebyly zjištěny)

NalezenÃ© soubory: 0
(ŽÃ¡dnÃ© škodlivÃ© položky nebyly zjištěny)

(konec)

aswMBR:
aswMBR version 0.9.9.1707 Copyright(c) 2011 AVAST Software
Run date: 2012-12-18 13:58:54
-----------------------------
13:58:54.452 OS Version: Windows x64 6.1.7601 Service Pack 1
13:58:54.452 Number of processors: 4 586 0x403
13:58:54.452 ComputerName: FNJ-DENEB UserName: FNj
13:58:55.207 Initialize success
13:59:07.377 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0
13:59:07.378 Disk 0 Vendor: WDC_WD1002FAEX-00Z3A0 05.01D05 Size: 953869MB BusType: 3
13:59:07.384 Disk 0 MBR read successfully
13:59:07.385 Disk 0 MBR scan
13:59:07.386 Disk 0 Windows 7 default MBR code
13:59:07.399 Disk 0 Partition 1 80 (A) 07 HPFS/NTFS NTFS 100 MB offset 2048
13:59:07.420 Disk 0 Partition 2 00 07 HPFS/NTFS NTFS 199895 MB offset 206848
13:59:07.445 Disk 0 Partition 3 00 07 HPFS/NTFS NTFS 753870 MB offset 409593240
13:59:07.467 Disk 0 scanning C:\Windows\system32\drivers
13:59:12.441 Service scanning
13:59:21.645 Modules scanning
13:59:21.649 Disk 0 trace - called modules:
13:59:21.659 ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys >>UNKNOWN [0xfffffa80039a72c0]<<sptd.sys ataport.SYS pciide.sys PCIIDEX.SYS hal.dll atapi.sys
13:59:21.661 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa8003af4790]
13:59:21.663 3 CLASSPNP.SYS[fffff8800185143f] -> nt!IofCallDriver -> [0xfffffa80049308a0]
13:59:21.666 5 ACPI.sys[fffff880011877a1] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-0[0xfffffa80049e3060]
13:59:21.669 \Driver\atapi[0xfffffa8003abb2c0] -> IRP_MJ_CREATE -> 0xfffffa80039a72c0
13:59:21.672 Scan finished successfully
13:59:51.038 Disk 0 MBR has been saved successfully to "C:\Users\FNj\Desktop\logs\MBR.dat "
13:59:51.041 The log file has been saved successfully to "C:\Users\FNj\Desktop\logs\aswMBR.txt "

Admin. · 2012/12/18

Please do not put your logs in
Code:
 (or any other) tags.

FNj · 2012/12/18

Sorry about that. Anyhow, here are THE LOGS:
DDS: http://pastebin.com/YBrMxSNw
RSIT (if you are interested): http://pastebin.com/vcYwYazF

Seems neater to post it through pastebin than to divide in into several posts.

Admin. · 2012/12/18

Sorry, but you have to post them here. Those are our rules.

PeteC · 2012/12/18

Seems neater to post it through pastebin than to divide in into several posts
Click to expand...

Please just follow the Instructions here .....

Don't attach logs, copy & paste logs in your post & reply(s). You'll most likely need multiple replies to post all your logs. You can post around 55,000 characters in a single post.
Click to expand...

FNj · 2012/12/18

Alright guys...

DDS (Ver_2012-11-20.01) - NTFS_AMD64
Internet Explorer: 9.0.8112.16457 BrowserJavaVersion: 10.9.2
Run by FNj at 14:23:28 on 2012-12-18
#Option Extended Search is enabled.
Microsoft Windows 7 Home Premium 6.1.7601.1.1250.420.1029.18.4094.2175 [GMT 1:00]
.
AV: Microsoft Security Essentials *Enabled/Updated* {B140BF4E-23BB-4198-90AB-A51A4C60A69C}
SP: Microsoft Security Essentials *Enabled/Updated* {0A215EAA-0581-4E16-AA1B-9E6837E7EC21}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
============== Running Processes ===============
.
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Program Files (x86)\IObit\Advanced SystemCare 6\ASCService.exe
C:\Windows\system32\svchost.exe -k RPCSS
C:\Program Files\Microsoft Security Client\MsMpEng.exe
C:\Windows\system32\atiesrxx.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k GPSvcGroup
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\atieclxx.exe
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe
C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
C:\Windows\system32\taskhost.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
C:\Windows\SysWOW64\PnkBstrA.exe
C:\Windows\SysWOW64\PnkBstrB.exe
C:\Program Files (x86)\Alcohol Soft\Alcohol 52\StarWind\StarWindServiceAE.exe
C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
C:\Program Files\Microsoft Security Client\msseces.exe
C:\Users\FNj\Local Settings\Apps\F.lux\flux.exe
C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files\Microsoft Security Client\NisSrv.exe
C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Windows\System32\svchost.exe -k LocalServicePeerNet
C:\Windows\system32\svchost.exe -k SDRSVC
C:\Windows\System32\spoolsv.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\NOTEPAD.EXE
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\System32\cscript.exe
.
============== Pseudo HJT Report ===============
.
mWinlogon: Userinit = userinit.exe
BHO: Java(tm) Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll
uRun: [F.lux] "C:\Users\FNj\Local Settings\Apps\F.lux\flux.exe" /noshow
mRun: [StartCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
mRun: [NUSB3MON] "C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe "
mRun: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe "
mPolicies-Explorer: NoActiveDesktop = dword:1
mPolicies-Explorer: NoActiveDesktopChanges = dword:1
mPolicies-System: ConsentPromptBehaviorUser = dword:3
mPolicies-System: EnableUIADesktopToggle = dword:0
TCP: NameServer = 10.0.0.138
TCP: Interfaces\{FED50FD9-189B-4094-B6FD-28D7FFCEDA0E} : DHCPNameServer = 10.0.0.138
SSODL: WebCheck - <orphaned>
x64-BHO: Java(tm) Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll
x64-BHO: Java(tm) Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll
x64-Run: [MSC] "C:\Program Files\Microsoft Security Client\msseces.exe" -hide -runkey
x64-DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
x64-SSODL: WebCheck - <orphaned>
.
============= SERVICES / DRIVERS ===============
.
R0 MpFilter;Microsoft Malware Protection Driver;C:\Windows\System32\drivers\MpFilter.sys [2012-8-30 228768]
R2 AdvancedSystemCareService6;Advanced SystemCare Service 6;C:\Program Files (x86)\IObit\Advanced SystemCare 6\ASCService.exe [2012-12-17 464256]
R2 AMD External Events Utility;AMD External Events Utility;C:\Windows\System32\atiesrxx.exe [2012-9-28 239616]
R2 AMD FUEL Service;AMD FUEL Service;C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [2012-9-28 361984]
R2 AODDriver4.2;AODDriver4.2;C:\Program Files\ATI Technologies\ATI.ACE\Fuel\amd64\aoddriver2.sys [2012-4-9 57472]
R2 MBAMService;MBAMService;C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2012-12-9 676936]
R2 MBAMScheduler;MBAMScheduler;C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [2012-12-9 399432]
R2 NisDrv;Microsoft Network Inspection System;C:\Windows\System32\drivers\NisDrvWFP.sys [2012-8-30 128456]
R2 StarWindServiceAE;StarWind AE Service;C:\Program Files (x86)\Alcohol Soft\Alcohol 52\StarWind\StarWindServiceAE.exe [2009-12-23 370688]
R3 AtiHDAudioService;AMD Function Driver for HD Audio Service;C:\Windows\System32\drivers\AtihdW76.sys [2012-5-14 96896]
R3 MBAMProtector;MBAMProtector;C:\Windows\System32\drivers\mbam.sys [2012-12-9 25928]
R3 NisSrv;Kontrola sÃtě Microsoft;C:\Program Files\Microsoft Security Client\NisSrv.exe [2012-9-12 368896]
R3 nusb3hub;Renesas Electronics USB 3.0 Hub Driver;C:\Windows\System32\drivers\nusb3hub.sys [2010-11-19 80384]
R3 nusb3xhc;Renesas Electronics USB 3.0 Host Controller Driver;C:\Windows\System32\drivers\nusb3xhc.sys [2010-11-19 181248]
R3 RTL8167;Realtek 8167 NT Driver;C:\Windows\System32\drivers\Rt64win7.sys [2009-3-1 187392]
R3 usbfilter;AMD USB Filter Driver;C:\Windows\System32\drivers\usbfilter.sys [2012-12-9 38456]
R3 WinRing0_1_2_0;WinRing0_1_2_0;C:\Program Files (x86)\Razer\Razer Game Booster\Driver\WinRing0x64.sys [2012-9-17 14544]
S2 AxAutoMntSrv;Alcohol Virtual Drive Auto-mount Service;C:\Program Files (x86)\Alcohol Soft\Alcohol 52\AxAutoMntSrv.exe [2012-1-5 75624]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]
S3 PSI;PSI;C:\Windows\System32\drivers\psi_mf.sys [2010-9-1 17976]
S3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;C:\Windows\System32\drivers\rdpvideominiport.sys [2012-12-10 19456]
S3 Secunia PSI Agent;Secunia PSI Agent;C:\Program Files (x86)\Secunia\PSI\psia.exe [2012-11-26 1225312]
S3 TsUsbFlt;TsUsbFlt;C:\Windows\System32\drivers\TsUsbFlt.sys [2012-12-10 57856]
S3 WatAdminSvc;SluÅ¾ba Technologie aktivace Windows;C:\Windows\System32\Wat\WatAdminSvc.exe [2012-12-10 1255736]
.
=============== Created Last 60 ================
.
2012-12-18 13:10:04 -------- d-----w- C:\Program Files\trend micro
2012-12-18 12:24:32 -------- d-----w- C:\Users\FNj\AppData\Local\Secunia PSI
2012-12-18 12:24:27 -------- d-----w- C:\Program Files (x86)\Secunia
2012-12-18 11:59:35 9125352 ----a-w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{8C973F99-4489-4D76-83FF-F2BB71A4D3E7}\mpengine.dll
2012-12-17 18:42:31 -------- d-----w- C:\ProgramData\IObit
2012-12-17 18:42:24 -------- d-----w- C:\Program Files (x86)\IObit
2012-12-17 18:27:40 -------- d-----w- C:\Users\FNj\AppData\Roaming\IObit
2012-12-17 15:33:23 -------- d-----w- C:\ProgramData\Digipen
2012-12-17 15:08:34 -------- d-----w- C:\Users\FNj\AppData\Roaming\Unity
2012-12-17 15:06:28 -------- d-----w- C:\Users\FNj\AppData\Local\Unity
2012-12-17 14:13:30 -------- d-----w- C:\Users\FNj\AppData\Roaming\deluge
2012-12-16 20:03:24 -------- d-----w- C:\Users\FNj\AppData\Roaming\LibreOffice
2012-12-16 18:29:12 -------- d-----w- C:\Program Files (x86)\LibreOffice 3.6
2012-12-16 10:23:40 9125352 ----a-w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2012-12-15 12:29:45 -------- d-----w- C:\Program Files (x86)\Alcohol Soft
2012-12-15 12:27:41 564824 ----a-w- C:\Windows\System32\drivers\sptd.sys
2012-12-13 18:13:18 -------- d-----w- C:\Users\FNj\AppData\Local\Solid State Networks
2012-12-12 21:34:20 -------- d-----w- C:\Users\FNj\AppData\Local\Apps
2012-12-12 09:26:00 2382848 ----a-w- C:\Windows\SysWow64\mshtml.tlb
2012-12-12 09:26:00 2382848 ----a-w- C:\Windows\System32\mshtml.tlb
2012-12-11 18:52:19 -------- d--h--w- C:\Program Files (x86)\Common Files\EAInstaller
2012-12-11 18:51:50 189248 ----a-w- C:\Windows\SysWow64\PnkBstrB.exe
2012-12-11 18:51:50 189248 ----a-w- C:\Windows\SysWow64\PnkBstrB.ex0
2012-12-11 18:51:49 75136 ----a-w- C:\Windows\SysWow64\PnkBstrA.exe
2012-12-11 18:51:10 519000 ----a-w- C:\Windows\System32\d3dx10_40.dll
2012-12-11 18:51:10 452440 ----a-w- C:\Windows\SysWow64\d3dx10_40.dll
2012-12-11 18:51:10 2605920 ----a-w- C:\Windows\System32\D3DCompiler_40.dll
2012-12-11 18:51:10 2036576 ----a-w- C:\Windows\SysWow64\D3DCompiler_40.dll
2012-12-11 18:51:08 5631312 ----a-w- C:\Windows\System32\D3DX9_40.dll
2012-12-11 18:51:08 4379984 ----a-w- C:\Windows\SysWow64\D3DX9_40.dll
2012-12-11 18:41:57 -------- d-----w- C:\Users\FNj\AppData\Roaming\Origin
2012-12-11 18:41:56 -------- d-----w- C:\Program Files (x86)\Origin Games
2012-12-11 18:41:51 -------- d-----w- C:\Users\FNj\AppData\Local\Origin
2012-12-11 18:29:30 -------- d-----w- C:\ProgramData\Origin
2012-12-11 18:29:30 -------- d-----w- C:\ProgramData\Electronic Arts
2012-12-11 17:31:57 -------- d-----w- C:\Program Files (x86)\Common Files\Steam
2012-12-11 14:03:35 746984 ----a-w- C:\Windows\SysWow64\deployJava1.dll
2012-12-11 14:03:34 821736 ----a-w- C:\Windows\SysWow64\npDeployJava1.dll
2012-12-11 14:03:23 95208 ----a-w- C:\Windows\SysWow64\WindowsAccessBridge-32.dll
2012-12-10 20:42:40 -------- d-----w- C:\Program Files\CCleaner
2012-12-10 13:28:28 -------- d-----w- C:\Users\FNj\AppData\Local\PunkBuster
2012-12-10 13:26:59 5073256 ----a-w- C:\Windows\System32\d3dx9_35.dll
2012-12-10 13:24:19 -------- d-----w- C:\Windows\SysWow64\directx
2012-12-10 13:18:17 -------- d-----w- C:\Users\FNj\AppData\Local\Razer
2012-12-10 13:01:56 972264 ------w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\NISBackup\gapaengine.dll
2012-12-10 13:01:56 972264 ------w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{A26135D7-3EB3-440C-ACB1-AF99DDA5E2CC}\gapaengine.dll
2012-12-10 12:50:35 245760 ----a-w- C:\Windows\System32\OxpsConverter.exe
2012-12-10 12:24:18 -------- d-----w- C:\Windows\System32\SPReview
2012-12-10 12:24:01 -------- d-----w- C:\Windows\System32\EventProviders
2012-12-10 12:22:02 48976 ----a-w- C:\Windows\System32\netfxperf.dll
2012-12-10 12:22:02 1942856 ----a-w- C:\Windows\System32\dfshim.dll
2012-12-10 12:19:59 3584 ----a-w- C:\Windows\System32\drivers\cs-CZ\tsusbflt.sys.mui
2012-12-10 12:19:59 2560 ----a-w- C:\Windows\System32\drivers\cs-CZ\rdpwd.sys.mui
2012-12-10 12:19:56 4608 ----a-w- C:\Windows\System32\drivers\cs-CZ\kbdclass.sys.mui
2012-12-10 12:19:56 3072 ----a-w- C:\Windows\System32\drivers\cs-CZ\GAGP30KX.SYS.mui
2012-12-10 12:19:55 399872 ----a-w- C:\Windows\System32\dpx.dll
2012-12-10 12:19:55 189952 ----a-w- C:\Windows\SysWow64\wdscore.dll
2012-12-10 12:19:52 189952 ----a-w- C:\Windows\SysWow64\sqmapi.dll
2012-12-10 12:19:49 606208 ----a-w- C:\Windows\SysWow64\wbem\fastprox.dll
2012-12-10 12:19:49 363008 ----a-w- C:\Windows\SysWow64\wbemcomn.dll
2012-12-10 12:19:49 189952 ----a-w- C:\Program Files (x86)\Windows Portable Devices\sqmapi.dll
2012-12-10 12:19:01 529408 ----a-w- C:\Windows\System32\wbemcomn.dll
2012-12-10 12:19:01 244736 ----a-w- C:\Program Files\Windows Portable Devices\sqmapi.dll
2012-12-10 12:18:56 244736 ----a-w- C:\Windows\System32\sqmapi.dll
2012-12-10 11:52:28 -------- d-----w- C:\Windows\SysWow64\Wat
2012-12-10 11:52:28 -------- d-----w- C:\Windows\System32\Wat
2012-12-10 11:13:55 2560 ----a-w- C:\Windows\System32\drivers\cs-CZ\wdf01000.sys.mui
2012-12-10 11:13:54 9728 ----a-w- C:\Windows\System32\Wdfres.dll
2012-12-10 11:13:54 785512 ----a-w- C:\Windows\System32\drivers\Wdf01000.sys
2012-12-10 11:13:54 54376 ----a-w- C:\Windows\System32\drivers\WdfLdr.sys
2012-12-10 11:12:57 916456 ----a-w- C:\Windows\System32\deployJava1.dll
2012-12-10 11:12:57 1034216 ----a-w- C:\Windows\System32\npDeployJava1.dll
2012-12-10 11:12:49 108008 ----a-w- C:\Windows\System32\WindowsAccessBridge-64.dll
2012-12-10 10:44:33 87040 ----a-w- C:\Windows\System32\drivers\WUDFPf.sys
2012-12-10 10:44:33 84992 ----a-w- C:\Windows\System32\WUDFSvc.dll
2012-12-10 10:44:33 45056 ----a-w- C:\Windows\System32\WUDFCoinstaller.dll
2012-12-10 10:44:33 198656 ----a-w- C:\Windows\System32\drivers\WUDFRd.sys
2012-12-10 10:44:33 194048 ----a-w- C:\Windows\System32\WUDFPlatform.dll
2012-12-10 10:44:32 744448 ----a-w- C:\Windows\System32\WUDFx.dll
2012-12-10 10:44:32 229888 ----a-w- C:\Windows\System32\WUDFHost.exe
2012-12-10 10:41:35 81408 ----a-w- C:\Windows\System32\imagehlp.dll
2012-12-10 10:41:35 5120 ----a-w- C:\Windows\SysWow64\wmi.dll
2012-12-10 10:41:35 5120 ----a-w- C:\Windows\System32\wmi.dll
2012-12-10 10:41:35 23408 ----a-w- C:\Windows\System32\drivers\fs_rec.sys
2012-12-10 10:41:35 159232 ----a-w- C:\Windows\SysWow64\imagehlp.dll
2012-12-10 10:26:18 1544704 ----a-w- C:\Windows\System32\DWrite.dll
2012-12-10 10:26:18 1077248 ----a-w- C:\Windows\SysWow64\DWrite.dll
2012-12-10 10:26:06 2871808 ----a-w- C:\Windows\explorer.exe
2012-12-10 10:26:06 2616320 ----a-w- C:\Windows\SysWow64\explorer.exe
2012-12-10 10:26:02 961024 ----a-w- C:\Windows\System32\CPFilters.dll
2012-12-10 10:26:02 642048 ----a-w- C:\Windows\SysWow64\CPFilters.dll
2012-12-10 10:26:01 850944 ----a-w- C:\Windows\SysWow64\sbe.dll
2012-12-10 10:26:01 259072 ----a-w- C:\Windows\System32\mpg2splt.ax
2012-12-10 10:26:01 199680 ----a-w- C:\Windows\SysWow64\mpg2splt.ax
2012-12-10 10:26:01 1118720 ----a-w- C:\Windows\System32\sbe.dll
2012-12-10 10:24:59 220160 ----a-w- C:\Windows\System32\wintrust.dll
2012-12-10 10:23:42 1731920 ----a-w- C:\Windows\System32\ntdll.dll
2012-12-10 10:23:42 1292080 ----a-w- C:\Windows\SysWow64\ntdll.dll
2012-12-10 10:02:25 1659760 ----a-w- C:\Windows\System32\drivers\ntfs.sys
2012-12-10 10:02:24 319488 ----a-w- C:\Windows\SysWow64\odbcjt32.dll
2012-12-10 10:02:24 212992 ----a-w- C:\Windows\System32\odbctrac.dll
2012-12-10 10:02:24 163840 ----a-w- C:\Windows\System32\odbccp32.dll
2012-12-10 10:02:24 126976 ----a-w- C:\Program Files\Common Files\System\Ole DB\msdaosp.dll
2012-12-10 10:02:24 106496 ----a-w- C:\Windows\System32\odbccu32.dll
2012-12-10 10:02:24 106496 ----a-w- C:\Windows\System32\odbccr32.dll
2012-12-10 10:02:23 94208 ----a-w- C:\Program Files (x86)\Common Files\System\Ole DB\msdaosp.dll
2012-12-10 10:02:23 86016 ----a-w- C:\Windows\SysWow64\odbccu32.dll
2012-12-10 10:02:23 81920 ----a-w- C:\Windows\SysWow64\odbccr32.dll
2012-12-10 10:02:23 163840 ----a-w- C:\Windows\SysWow64\odbctrac.dll
2012-12-10 10:02:23 122880 ----a-w- C:\Windows\SysWow64\odbccp32.dll
2012-12-10 10:00:49 902656 ----a-w- C:\Windows\System32\d2d1.dll
2012-12-10 09:59:57 70656 ----a-w- C:\Windows\SysWow64\fontsub.dll
2012-12-10 09:55:15 321024 ----a-w- C:\Windows\System32\d3d10_1core.dll
2012-12-10 09:55:15 219136 ----a-w- C:\Windows\SysWow64\d3d10_1core.dll
2012-12-10 09:55:15 197120 ----a-w- C:\Windows\System32\d3d10_1.dll
2012-12-10 09:55:15 161792 ----a-w- C:\Windows\SysWow64\d3d10_1.dll
2012-12-10 09:53:18 974336 ----a-w- C:\Windows\System32\WFS.exe
2012-12-10 09:53:18 267776 ----a-w- C:\Windows\System32\FXSCOVER.exe
2012-12-10 09:52:15 294912 ----a-w- C:\Windows\System32\browserchoice.exe
2012-12-09 22:33:43 1464320 ----a-w- C:\Windows\System32\crypt32.dll
2012-12-09 22:33:42 184320 ----a-w- C:\Windows\System32\cryptsvc.dll
2012-12-09 22:33:42 140288 ----a-w- C:\Windows\SysWow64\cryptsvc.dll
2012-12-09 22:33:42 140288 ----a-w- C:\Windows\System32\cryptnet.dll
2012-12-09 22:33:42 1159680 ----a-w- C:\Windows\SysWow64\crypt32.dll
2012-12-09 22:33:42 103936 ----a-w- C:\Windows\SysWow64\cryptnet.dll
2012-12-09 22:32:26 77312 ----a-w- C:\Windows\System32\packager.dll
2012-12-09 22:32:26 67072 ----a-w- C:\Windows\SysWow64\packager.dll
2012-12-09 22:19:10 -------- d-----w- C:\Program Files (x86)\Renesas Electronics
2012-12-09 22:17:41 -------- d-----w- C:\Users\FNj\AppData\Local\Google
2012-12-09 22:15:15 -------- d-----w- C:\Program Files\PeerBlock
2012-12-09 22:14:47 -------- d-----w- C:\Users\FNj\AppData\Roaming\SumatraPDF
2012-12-09 22:14:45 -------- d-----w- C:\Program Files (x86)\SumatraPDF
2012-12-09 22:14:37 -------- d-----w- C:\Program Files\CPUID
2012-12-09 22:13:05 -------- d-----w- C:\Users\FNj\AppData\Roaming\Malwarebytes
2012-12-09 22:12:55 -------- d-----w- C:\ProgramData\Malwarebytes
2012-12-09 22:12:54 25928 ----a-w- C:\Windows\System32\drivers\mbam.sys
2012-12-09 22:12:54 -------- d-----w- C:\Program Files (x86)\Malwarebytes' Anti-Malware
2012-12-09 22:11:47 73656 ----a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
2012-12-09 22:11:47 697272 ----a-w- C:\Windows\SysWow64\FlashPlayerApp.exe
2012-12-09 22:08:39 -------- d-----w- C:\Users\FNj\AppData\Local\AMD
2012-12-09 22:08:30 -------- d-----w- C:\Users\FNj\AppData\Local\ATI
2012-12-09 22:08:09 0 ----a-w- C:\Windows\ativpsrm.bin
2012-12-09 22:05:03 826880 ----a-w- C:\Windows\SysWow64\rdpcore.dll
2012-12-09 22:05:03 23552 ----a-w- C:\Windows\System32\drivers\tdtcp.sys
2012-12-09 22:05:03 1031680 ----a-w- C:\Windows\System32\rdpcore.dll
2012-12-09 22:03:05 -------- d-----w- C:\Program Files (x86)\AMD AVT
2012-12-09 22:03:02 -------- d-----w- C:\Program Files (x86)\AMD APP
2012-12-09 22:02:56 -------- d-----w- C:\Program Files\Common Files\ATI Technologies
2012-12-09 22:02:56 -------- d-----w- C:\Program Files (x86)\Common Files\ATI Technologies
2012-12-09 22:02:22 -------- d-----w- C:\ProgramData\AMD
2012-12-09 22:01:53 -------- d-----w- C:\Program Files (x86)\ATI Technologies
2012-12-09 21:54:56 -------- d-----w- C:\AMD
2012-12-09 21:54:13 279656 ------w- C:\Windows\System32\MpSigStub.exe
2012-12-09 21:53:49 38456 ----a-w- C:\Windows\System32\drivers\usbfilter.sys
2012-12-09 21:53:49 -------- d-----w- C:\Program Files (x86)\AMD
2012-12-09 21:53:45 -------- d-----w- C:\Program Files\ATI
2012-12-09 21:53:35 -------- d-----w- C:\Program Files\ATI Technologies
2012-12-09 21:52:56 -------- d-----w- C:\Program Files (x86)\Microsoft Security Client
2012-12-09 21:52:43 -------- d-sh--w- C:\Windows\Installer
2012-12-09 21:52:43 -------- d-----w- C:\Program Files\Microsoft Security Client
2012-12-09 21:52:03 2622464 ----a-w- C:\Windows\System32\wucltux.dll
2012-12-09 21:51:58 99840 ----a-w- C:\Windows\System32\wudriver.dll
2012-12-09 21:51:53 36864 ----a-w- C:\Windows\System32\wuapp.exe
2012-12-09 21:51:53 186752 ----a-w- C:\Windows\System32\wuwebv.dll
2012-12-09 21:50:00 -------- d-----w- C:\Users\FNj\AppData\Local\VirtualStore
2012-12-09 21:43:40 -------- d-----w- C:\Windows\Panther
.

FNj · 2012/12/18

==================== Find6M ====================
.
2012-12-10 12:33:58 175616 ----a-w- C:\Windows\System32\msclmd.dll
2012-12-10 12:33:58 152576 ----a-w- C:\Windows\SysWow64\msclmd.dll
2012-11-22 03:26:40 3149824 ----a-w- C:\Windows\System32\win32k.sys
2012-11-14 06:11:44 2312704 ----a-w- C:\Windows\System32\jscript9.dll
2012-11-14 06:04:11 1392128 ----a-w- C:\Windows\System32\wininet.dll
2012-11-14 06:02:49 1494528 ----a-w- C:\Windows\System32\inetcpl.cpl
2012-11-14 05:57:46 599040 ----a-w- C:\Windows\System32\vbscript.dll
2012-11-14 05:57:35 173056 ----a-w- C:\Windows\System32\ieUnatt.exe
2012-11-14 02:09:22 1800704 ----a-w- C:\Windows\SysWow64\jscript9.dll
2012-11-14 01:58:15 1427968 ----a-w- C:\Windows\SysWow64\inetcpl.cpl
2012-11-14 01:57:37 1129472 ----a-w- C:\Windows\SysWow64\wininet.dll
2012-11-14 01:49:25 142848 ----a-w- C:\Windows\SysWow64\ieUnatt.exe
2012-11-14 01:48:27 420864 ----a-w- C:\Windows\SysWow64\vbscript.dll
2012-11-09 05:45:09 2048 ----a-w- C:\Windows\System32\tzres.dll
2012-11-09 04:42:49 2048 ----a-w- C:\Windows\SysWow64\tzres.dll
2012-11-05 21:35:16 46080 ----a-w- C:\Windows\System32\atmlib.dll
2012-11-05 20:41:32 367616 ----a-w- C:\Windows\System32\atmfd.dll
2012-11-05 20:32:16 295424 ----a-w- C:\Windows\SysWow64\atmfd.dll
2012-11-05 20:32:09 34304 ----a-w- C:\Windows\SysWow64\atmlib.dll
2012-11-02 05:59:11 478208 ----a-w- C:\Windows\System32\dpnet.dll
2012-11-02 05:11:31 376832 ----a-w- C:\Windows\SysWow64\dpnet.dll
2012-10-16 08:38:37 135168 ----a-w- C:\Windows\apppatch\AppPatch64\AcXtrnal.dll
2012-10-16 08:38:34 350208 ----a-w- C:\Windows\apppatch\AppPatch64\AcLayers.dll
2012-10-16 07:39:52 561664 ----a-w- C:\Windows\apppatch\AcLayers.dll
2012-10-09 18:17:13 55296 ----a-w- C:\Windows\System32\dhcpcsvc6.dll
2012-10-09 18:17:13 226816 ----a-w- C:\Windows\System32\dhcpcore6.dll
2012-10-09 17:40:31 44032 ----a-w- C:\Windows\SysWow64\dhcpcsvc6.dll
2012-10-09 17:40:31 193536 ----a-w- C:\Windows\SysWow64\dhcpcore6.dll
2012-10-04 17:46:16 362496 ----a-w- C:\Windows\System32\wow64win.dll
2012-10-04 17:46:15 243200 ----a-w- C:\Windows\System32\wow64.dll
2012-10-04 17:46:15 13312 ----a-w- C:\Windows\System32\wow64cpu.dll
2012-10-04 17:45:55 215040 ----a-w- C:\Windows\System32\winsrv.dll
2012-10-04 17:43:28 16384 ----a-w- C:\Windows\System32\ntvdm64.dll
2012-10-04 17:41:16 424960 ----a-w- C:\Windows\System32\KernelBase.dll
2012-10-04 16:47:41 5120 ----a-w- C:\Windows\SysWow64\wow32.dll
2012-10-04 16:47:41 274944 ----a-w- C:\Windows\SysWow64\KernelBase.dll
2012-10-04 15:21:55 338432 ----a-w- C:\Windows\System32\conhost.exe
2012-10-04 14:46:46 7680 ----a-w- C:\Windows\SysWow64\instnm.exe
2012-10-04 14:46:46 25600 ----a-w- C:\Windows\SysWow64\setup16.exe
2012-10-04 14:46:44 14336 ----a-w- C:\Windows\SysWow64\ntvdm64.dll
2012-10-04 14:46:43 2048 ----a-w- C:\Windows\SysWow64\user.exe
2012-10-04 14:41:50 6144 ---ha-w- C:\Windows\SysWow64\api-ms-win-security-base-l1-1-0.dll
2012-10-04 14:41:50 4608 ---ha-w- C:\Windows\SysWow64\api-ms-win-core-threadpool-l1-1-0.dll
2012-10-04 14:41:50 3584 ---ha-w- C:\Windows\SysWow64\api-ms-win-core-xstate-l1-1-0.dll
2012-10-04 14:41:50 3072 ---ha-w- C:\Windows\SysWow64\api-ms-win-core-util-l1-1-0.dll
2012-10-03 17:56:54 1914248 ----a-w- C:\Windows\System32\drivers\tcpip.sys
2012-10-03 17:44:21 70656 ----a-w- C:\Windows\System32\nlaapi.dll
2012-10-03 17:44:21 303104 ----a-w- C:\Windows\System32\nlasvc.dll
2012-10-03 17:44:17 246272 ----a-w- C:\Windows\System32\netcorehc.dll
2012-10-03 17:44:17 18944 ----a-w- C:\Windows\System32\netevent.dll
2012-10-03 17:44:16 216576 ----a-w- C:\Windows\System32\ncsi.dll
2012-10-03 17:42:16 569344 ----a-w- C:\Windows\System32\iphlpsvc.dll
2012-10-03 16:42:24 18944 ----a-w- C:\Windows\SysWow64\netevent.dll
2012-10-03 16:42:24 175104 ----a-w- C:\Windows\SysWow64\netcorehc.dll
2012-10-03 16:42:23 156672 ----a-w- C:\Windows\SysWow64\ncsi.dll
2012-10-03 16:07:26 45568 ----a-w- C:\Windows\System32\drivers\tcpipreg.sys
2012-09-28 14:37:02 221696 ----a-w- C:\Windows\System32\clinfo.exe
2012-09-28 14:36:44 75776 ----a-w- C:\Windows\System32\OpenVideo64.dll
2012-09-28 14:36:40 65536 ----a-w- C:\Windows\SysWow64\OpenVideo.dll
2012-09-28 14:36:36 63488 ----a-w- C:\Windows\System32\OVDecode64.dll
2012-09-28 14:36:34 56320 ----a-w- C:\Windows\SysWow64\OVDecode.dll
2012-09-28 14:36:24 32635904 ----a-w- C:\Windows\System32\amdocl64.dll
2012-09-28 14:32:16 27341824 ----a-w- C:\Windows\SysWow64\amdocl.dll
2012-09-28 14:28:46 54784 ----a-w- C:\Windows\System32\OpenCL.dll
2012-09-28 14:28:42 50176 ----a-w- C:\Windows\SysWow64\OpenCL.dll
2012-09-28 02:23:00 5557928 ----a-w- C:\Windows\SysWow64\atiumdag.dll
2012-09-28 02:21:20 10697216 ----a-w- C:\Windows\System32\drivers\atikmdag.sys
2012-09-28 02:05:38 70144 ----a-w- C:\Windows\System32\coinst_9.002.dll
2012-09-28 02:03:52 163840 ----a-w- C:\Windows\System32\atiapfxx.exe
2012-09-28 02:02:30 51200 ----a-w- C:\Windows\System32\aticalrt64.dll
2012-09-28 02:02:28 46080 ----a-w- C:\Windows\SysWow64\aticalrt.dll
2012-09-28 02:02:22 44544 ----a-w- C:\Windows\System32\aticalcl64.dll
2012-09-28 02:02:20 44032 ----a-w- C:\Windows\SysWow64\aticalcl.dll
2012-09-28 02:02:08 16082432 ----a-w- C:\Windows\System32\aticaldd64.dll
2012-09-28 01:59:56 23825920 ----a-w- C:\Windows\System32\atio6axx.dll
2012-09-28 01:57:20 13703168 ----a-w- C:\Windows\SysWow64\aticaldd.dll
2012-09-28 01:43:28 935424 ----a-w- C:\Windows\SysWow64\aticfx32.dll
2012-09-28 01:41:40 1120768 ----a-w- C:\Windows\System32\aticfx64.dll
2012-09-28 01:41:14 19624960 ----a-w- C:\Windows\SysWow64\atioglxx.dll
2012-09-28 01:39:36 6536192 ----a-w- C:\Windows\SysWow64\atidxx32.dll
2012-09-28 01:39:14 442368 ----a-w- C:\Windows\System32\atidemgy.dll
2012-09-28 01:39:08 538112 ----a-w- C:\Windows\System32\atieclxx.exe
2012-09-28 01:38:16 239616 ----a-w- C:\Windows\System32\atiesrxx.exe
2012-09-28 01:36:50 120320 ----a-w- C:\Windows\System32\atitmm64.dll
2012-09-28 01:36:36 21504 ----a-w- C:\Windows\System32\atimuixx.dll
2012-09-28 01:36:30 59392 ----a-w- C:\Windows\System32\atiedu64.dll
2012-09-28 01:36:26 43520 ----a-w- C:\Windows\SysWow64\ati2edxx.dll
2012-09-28 01:31:26 3127296 ----a-w- C:\Windows\System32\atiumd6a.dll
2012-09-28 01:25:24 6704640 ----a-w- C:\Windows\System32\atiumd64.dll
2012-09-28 01:22:42 7167488 ----a-w- C:\Windows\System32\atidxx64.dll
2012-09-28 01:22:30 2691584 ----a-w- C:\Windows\SysWow64\atiumdva.dll
2012-09-28 01:13:40 595456 ----a-w- C:\Windows\System32\atiadlxx.dll
2012-09-28 01:13:30 405504 ----a-w- C:\Windows\SysWow64\atiadlxy.dll
2012-09-28 01:13:16 17920 ----a-w- C:\Windows\System32\atig6pxx.dll
2012-09-28 01:13:12 14848 ----a-w- C:\Windows\SysWow64\atiglpxx.dll
2012-09-28 01:13:12 14848 ----a-w- C:\Windows\System32\atiglpxx.dll
2012-09-28 01:13:08 41984 ----a-w- C:\Windows\System32\atig6txx.dll
2012-09-28 01:13:00 33280 ----a-w- C:\Windows\SysWow64\atigktxx.dll
2012-09-28 01:12:58 56320 ----a-w- C:\Windows\System32\atimpc64.dll
2012-09-28 01:12:58 56320 ----a-w- C:\Windows\System32\amdpcom64.dll
.
============= FINISH: 14:24:16,05 ===============

attach:
.
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
.
DDS (Ver_2012-11-20.01)
.
Microsoft Windows 7 Home Premium
Boot Device: \Device\HarddiskVolume1
Install Date: 9.12.2012 22:49:49
System Uptime: 18.12.2012 13:08:44 (0 hours ago)
.
Motherboard: Gigabyte Technology Co., Ltd. | | GA-870A-UD3
Processor: AMD Phenom(tm) II X4 955 Processor | Socket M2 | 3700/200mhz
.
==== Disk Partitions =========================
.
C: is FIXED (NTFS) - 195 GiB total, 160,015 GiB free.
D: is FIXED (NTFS) - 736 GiB total, 192,884 GiB free.
E: is CDROM ()
F: is CDROM ()
.
==== Disabled Device Manager Items =============
.
==== System Restore Points ===================
.
RP18: 11.12.2012 15:02:51 - Installed Java 7 Update 9
RP19: 11.12.2012 19:49:21 - NainstalovÃ¡no rozhranÃ DirectX
RP20: 12.12.2012 10:25:31 - Windows Update
RP21: 12.12.2012 10:48:14 - Windows Update
RP22: 12.12.2012 22:45:12 - Windows Update
RP23: 15.12.2012 0:25:29 - Windows Update
RP25: 15.12.2012 13:27:26 - SPTD setup V1.83
RP26: 16.12.2012 19:28:27 - Installed LibreOffice 3.6
RP27: 17.12.2012 16:29:58 - NainstalovÃ¡no rozhranÃ DirectX
RP28: 17.12.2012 19:34:27 - IObit Uninstaller restore point
RP29: 17.12.2012 19:35:11 - IObit Uninstaller restore point
RP30: 17.12.2012 19:38:12 - IObit Uninstaller restore point
RP31: 18.12.2012 12:58:46 - Windows Update
.
==== Installed Programs ======================
.
Adobe Flash Player 11 ActiveX
Advanced SystemCare 6
AMD Accelerated Video Transcoding
AMD APP SDK Runtime
AMD Catalyst Install Manager
AMD Drag and Drop Transcoding
AMD Fuel
AMD Media Foundation Decoders
AMD USB Filter Driver
AMD VISION Engine Control Center
Battlefield 3™
Catalyst Control Center - Branding
Catalyst Control Center Graphics Previews Common
Catalyst Control Center InstallProxy
Catalyst Control Center Localization All
ccc-utility64
CCC Help Czech
CCC Help Danish
CCC Help Dutch
CCC Help English
CCC Help Finnish
CCC Help French
CCC Help German
CCC Help Greek
CCC Help Hungarian
CCC Help Chinese Standard
CCC Help Chinese Traditional
CCC Help Italian
CCC Help Japanese
CCC Help Korean
CCC Help Norwegian
CCC Help Polish
CCC Help Portuguese
CCC Help Russian
CCC Help Spanish
CCC Help Swedish
CCC Help Thai
CCC Help Turkish
CCleaner
CPUID CPU-Z 1.62
Deluge 1.3.5
F.lux
Google Chrome
Google Update Helper
Hawken
Java 7 Update 9
Java 7 Update 9 (64-bit)
Java Auto Updater
Java SE Development Kit 7 Update 9 (64-bit)
LibreOffice 3.6
Malwarebytes Anti-Malware verze 1.65.1.1000
Microsoft .NET Framework 4 Client Profile
Microsoft .NET Framework 4 Client Profile CSY Language Pack
Microsoft .NET Framework 4 Extended
Microsoft .NET Framework 4 Extended CSY Language Pack
Microsoft Security Client
Microsoft Security Essentials
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
Notepad++
Origin
PeerBlock 1.1 (r518)
Perspective 1.0
PunkBuster Services
Razer Game Booster
Renesas Electronics USB 3.0 Host Controller Driver
Secunia PSI (3.0.0.6001)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2604121)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368v2)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2686827)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2729449)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2737019)
Security Update for Microsoft .NET Framework 4 Extended (KB2487367)
Security Update for Microsoft .NET Framework 4 Extended (KB2656351)
SumatraPDF
TeamSpeak 3 Client
Unity Web Player
Update for Microsoft .NET Framework 4 Client Profile (KB2468871)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217)
Update for Microsoft .NET Framework 4 Extended (KB2468871)
Update for Microsoft .NET Framework 4 Extended (KB2533523)
Update for Microsoft .NET Framework 4 Extended (KB2600217)
VLC media player 2.0.4
.
==== End Of File ===========================

FNj · 2012/12/18

I think I've found what cause the whole ordeal for me and for the other person as well.

It is the downloader miniapp **** this site uses. I tried to install And the downloader installed some crapware.

I hope that will help.

broni · 2012/12/18

Welcome aboard

Please, observe following rules:

Read all of my instructions very carefully. Your mistakes during cleaning process may have very serious consequences, like unbootable computer.

If you're stuck, or you're not sure about certain step, always ask before doing anything else.

Please refrain from running any tools, fixes or applying any changes to your computer other than those I suggest.

Never run more than one scan at a time.

Keep updating me regarding your computer behavior, good, or bad.

The cleaning process, once started, has to be completed. Even if your computer appears to act better, it may still be infected. Once the computer is totally clean, I'll certainly let you know.

If you leave the topic without explanation in the middle of a cleaning process, you may not be eligible to receive any more help in malware removal forum.

I close my topics if you have not replied in 5 days. If you need more time, simply let me know. If I closed your topic and you need it to be reopened, simply PM me.

=============================

Download RogueKiller on the desktop

Close all the running programs

Windows Vista/7 users: right click on RogueKiller.exe, click Run as Administrator

Otherwise just double-click on RogueKiller.exe

Pre-scan will start. Let it finish.

Click on SCAN button.

Wait until the Status box shows Scan Finished

Click on Delete.

Wait until the Status box shows Deleting Finished.

Click on Report and copy/paste the content of the Notepad into your next reply.

RKreport.txt could also be found on your desktop.

If more than one log is produced post all logs.

If RogueKiller has been blocked, do not hesitate to try a few times more. If really won't run, rename it to winlogon.exe (or winlogon.com) and try again

FNj · 2012/12/19

It automatically used Czech as language so I ran the output through google translator, seems pretty legible.

RogueKiller V8.4.0 [Dec 18 2012] by Tigzy
mail: tigzyRK <at> <dot> gmail com
Support http://www.geekstogo.com/forum/files/file/413-roguekiller/
Website: http://tigzy.geekstogo.com/roguekiller.php
* : http://tigzyrk.blogspot.com/

Operating System: Windows 7 (6.1.7601 Service Pack 1) 64 bits version
Started in: Normal mode
User: FNJ [Administrator rights]
Mode: Remove - Date: 12/19/2012 11:45:50

¤ ¤ ¤ Harmful processes :: 0 ¤ ¤ ¤

¤ ¤ ¤ ¤ ¤ ¤ Records Registers :: 4 ¤ ¤ ¤
[DESK HJ] HKCU \ [...] \ ClassicStartMenu: {59031A47-3F72-44A7-89C5-5595FE6B30EE} (1) -> REPLACED (0)
[DESK HJ] HKCU \ [...] \ NewStartPanel: {59031A47-3F72-44A7-89C5-5595FE6B30EE} (1) -> REPLACED (0)
[DESK HJ] HKCU \ [...] \ ClassicStartMenu: {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> REPLACED (0)
[DESK HJ] HKCU \ [...] \ NewStartPanel: {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> REPLACED (0)

¤ ¤ ¤ Particular Files / Folders: ¤ ¤ ¤

¤ ¤ ¤ Driver: [unrecorded] ¤ ¤ ¤

¤ ¤ ¤ HOSTS File: ¤ ¤ ¤
-> C: \ Windows \ system32 \ drivers \ etc \ hosts

¤ ¤ ¤ MBR Check: ¤ ¤ ¤

+ + + + + PhysicalDrive0: WDC WD1002FAEX-00Z3A0 ATA Device + + + + +
--- User ---
[MBR] d621500ad0ba91ab7b2a16e73baf1867
[BSP] 0f20611b0c4af80ff03bed2e506b2ba9: Windows 7/8 MBR Code
Partition table:
0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (segments): 2048 | Size: 100 Mo
1 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (segments): 206848 | Size: 199895 Mo
2 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (segments): 409593240 | Size: 753870 Mo
User = LL1 ... OK!
User = LL2 ... OK!

Finished: << RKreport [3] _D_12192012_02d1145.txt >>
RKreport [1] _S_12192012_02d1144.txt; RKreport [2] _S_12192012_02d1145.txt; RKreport [3] _D_12192012_02d1145.txt

FNj · 2012/12/19

Here is the scan-only output (run through google translator). I think it is redundant, but you told me to post all the logs.

RogueKiller V8.4.0 [Dec 18 2012] by Tigzy
mail: tigzyRK <at> <dot> gmail com
Support http://www.geekstogo.com/forum/files/file/413-roguekiller/
Website: http://tigzy.geekstogo.com/roguekiller.php
* : http://tigzyrk.blogspot.com/

Operating System: Windows 7 (6.1.7601 Service Pack 1) 64 bits version
Started in: Normal mode
User: FNJ [Administrator rights]
Mode: Scan - Date: 12/19/2012 11:45:44

¤ ¤ ¤ Harmful processes :: 0 ¤ ¤ ¤

¤ ¤ ¤ ¤ ¤ ¤ Records Registers :: 4 ¤ ¤ ¤
[DESK HJ] HKCU \ [...] \ ClassicStartMenu: {59031A47-3F72-44A7-89C5-5595FE6B30EE} (1) -> FOUND
[DESK HJ] HKCU \ [...] \ NewStartPanel: {59031A47-3F72-44A7-89C5-5595FE6B30EE} (1) -> FOUND
[DESK HJ] HKCU \ [...] \ ClassicStartMenu: {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND
[DESK HJ] HKCU \ [...] \ NewStartPanel: {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND

¤ ¤ ¤ Particular Files / Folders: ¤ ¤ ¤

¤ ¤ ¤ Driver: [unrecorded] ¤ ¤ ¤

¤ ¤ ¤ HOSTS File: ¤ ¤ ¤
-> C: \ Windows \ system32 \ drivers \ etc \ hosts

¤ ¤ ¤ MBR Check: ¤ ¤ ¤

+ + + + + PhysicalDrive0: WDC WD1002FAEX-00Z3A0 ATA Device + + + + +
--- User ---
[MBR] d621500ad0ba91ab7b2a16e73baf1867
[BSP] 0f20611b0c4af80ff03bed2e506b2ba9: Windows 7/8 MBR Code
Partition table:
0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (segments): 2048 | Size: 100 Mo
1 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (segments): 206848 | Size: 199895 Mo
2 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (segments): 409593240 | Size: 753870 Mo
User = LL1 ... OK!
User = LL2 ... OK!

Finished: << RKreport [2] _S_12192012_02d1145.txt >>
RKreport [1] _S_12192012_02d1144.txt; RKreport [2] _S_12192012_02d1145.txt

broni · 2012/12/19

Create new restore point before proceeding with the next step....
How to:
- Windows 8: http://www.vikitech.com/11302/system-restore-windows-8
- Windows 7: http://www.howtogeek.com/howto/3195/create-a-system-restore-point-in-windows-7/
- Vista: http://www.howtogeek.com/howto/wind...tore-point-for-windows-vistas-system-restore/
- XP: http://support.microsoft.com/kb/948247

=========================

Please download ComboFix from Here, Here or Here to your Desktop.

**Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**

Never rename Combofix unless instructed.

Close any open browsers.

Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results ".

Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.

Close any open browsers.

WARNING: Combofix will disconnect your machine from the Internet as soon as it starts

Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.

If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
If the connection is not there use restore point you created prior to running Combofix.

Double click on combofix.exe & follow the prompts.

NOTE1. If Combofix asks you to install Recovery Console, please allow it.
NOTE 2. If Combofix asks you to update the program, always do so.

When finished, it will produce a report for you.

Please post the "C:\ComboFix.txt"

**Note 1: Do not mouseclick combofix's window while it's running. That may cause it to stall
**Note 2 for AVG and CA Internet Security (Total Defense Internet Security) users: ComboFix will not run until AVG/CA Internet Security is uninstalled as a protective measure against the anti-virus. This is because AVG/CA Internet Security "falsely" detects ComboFix (or its embedded files) as a threat and may remove them resulting in the tool not working correctly which in turn can cause "unpredictable results ". Since AVG/CA Internet Security cannot be effectively disabled before running ComboFix, the author recommends you to uninstall AVG/CA Internet Security first.
Use AppRemover to uninstall it: http://www.appremover.com/
We can reinstall it when we're done with CF.
**Note 3: If you receive an error "Illegal operation attempted on a registery key that has been marked for deletion ", restart computer to fix the issue.
**Note 4: Some infections may take some significant time to be cured. As long as your computer clock is running Combofix is still working. Be patient.

Make sure, you re-enable your security programs, when you're done with Combofix.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

NOTE.
If, for some reason, Combofix refuses to run, try the following...

Delete Combofix file, download fresh one, but rename combofix.exe to your_name.exe BEFORE saving it to your desktop.
Do NOT run it yet.
Download Rkill (courtesy of BleepingComputer.com) to your desktop.
There are 2 different versions. If one of them won't run then download and try to run the other one.
You only need to get one of these to run, not all of them. You may get warnings from your antivirus about this tool, ignore them or shutdown your antivirus.

rKill.exe: http://www.bleepingcomputer.com/download/rkill/dl/10/
iExplore.exe (renamed rKill.exe): http://www.bleepingcomputer.com/download/rkill/dl/11/

Restart computer in safe mode

Double-click on the Rkill desktop icon to run the tool.

If using Vista or Windows 7 right-click on it and choose Run As Administrator.

A black DOS box will briefly flash and then disappear. This is normal and indicates the tool ran successfully.

If not, delete the file, then download and use the one provided in Link 2.

Do not reboot until instructed.

If the tool does not run from any of the links provided, please let me know.

When the scan is done Notepad will open with rKill.txt log.
NOTE. rKill.txt log will also be present on your desktop.

Once you've gotten one of them to run, immediately run your_name.exe by double clicking on it.

IF you had to run rKill post BOTH logs, rKill.txt and Combofix.txt.

FNj · 2012/12/20

Had to run it through google translator again (combofix ran in Czech, too).

ComboFix 12-12-20.01 - FNJ 9:32.1.4 December 20, 2012 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1250.420.1029.18.4094.2758 [GMT 1:00]
Running from: c: \ users \ FNJ \ Desktop \ ComboFix.exe
AV: Microsoft Security Essentials * Disabled / Updated * {B140BF4E-23BB-4198-90AB-A51A4C60A69C}
SP: Microsoft Security Essentials * Disabled / Updated * {0A215EAA-0581-4E16-AA1B-9E6837E7EC21}
SP: Windows Defender * Disabled / Updated * {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
(((((((((((((((((((((((((Files Created from 20/11/2012 to 20/12/2012))))))))))) ))))))))))))))))))))
.
.
12/20/2012 8:35. 12/20/2012 8:35 -------- d ----- w-c: \ users \ Default \ AppData \ Local \ temp
19/12/2012 21:05. 19/12/2012 21:05 -------- d ----- w-c: \ program files \ FreeFixer
19/12/2012 20:57. 11/08/2012 8:24 9125352 ---- aw-c: \ programdata \ Microsoft \ Microsoft Antimalware \ Definition Updates \ {16BC7F2F-D15F-4BC7-97F4-753A3D06CC4E} \ mpengine.dll
19/12/2012 14:19. 11/08/2012 8:24 9125352 ---- aw-c: \ programdata \ Microsoft \ Microsoft Antimalware \ Definition Updates \ Backup \ mpengine.dll
18/12/2012 21:22. 18/12/2012 21:22 -------- d ----- w-c: \ program files (x86) \ VS Revo Group
18/12/2012 17:05. 19/12/2012 18:06 281520 ---- aw-c: \ windows \ SysWOW64 \ PnkBstrB.xtr
18/12/2012 17:04. 18/12/2012 17:04 -------- d ----- w-c: \ programdata \ EA Core
18/12/2012 16:56. 18/12/2012 16:56 -------- d ----- w-c: \ program files (x86) \ Battlelog Web Plugins
18/12/2012 16:48. 18/12/2012 19:33 -------- d ----- w-c: \ programdata \ EA Logs
18/12/2012 14:35. 18/12/2012 14:35 21132800 ---- aw-c: \ programdata \ Microsoft \ Microsoft Antimalware \ LocalCopy \ {CDB32C76-59FC-C153-066D-5540E234DB81}-12a4f0.msi
18/12/2012 13:10. 18/12/2012 13:28 -------- d ----- w-c: \ program files \ trend micro
18/12/2012 13:10. 18/12/2012 13:10 -------- d ----- w-C: \ rsit
18/12/2012 12:24. 18/12/2012 24:24 -------- d ----- w-c: \ program files (x86) \ Secunia
17/12/2012 15:33. 17/12/2012 15:33 -------- d ----- w-c: \ programdata \ DigiPen
16/12/2012 18:29. 16/12/2012 18:30 -------- d ----- w-c: \ program files (x86) \ LibreOffice 3.6
12/15/2012 12:29. 12/15/2012 12:29 -------- d ----- w-c: \ program files (x86) \ Alcohol Soft
12/15/2012 12:27. 12/15/2012 24:27 564824 ---- aw-c: \ windows \ system32 \ drivers \ sptd.sys
12/12/2012 9:26. 14/11/2012 5:53 96768 ---- aw-c: \ windows \ system32 \ mshtmled.dll
12/12/2012 9:26. 14/11/2012 5:52 2382848 ---- aw-c: \ windows \ system32 \ Mshtml.tlb
12/12/2012 9:26. 14/11/2012 1:44 2382848 ---- aw-c: \ windows \ SysWOW64 \ Mshtml.tlb
12/11/2012 18:52. 12/11/2012 18:52 -------- d - h - w-c: \ program files (x86) \ Common Files \ EAInstaller
12/11/2012 18:51. 19/12/2012 18:06 281520 ---- aw-c: \ windows \ SysWOW64 \ PnkBstrB.exe
12/11/2012 18:51. 19/12/2012 18:06 280904 ---- aw-c: \ windows \ SysWOW64 \ PnkBstrB.ex0
12/11/2012 18:51. 18/12/2012 17:09 76888 ---- aw-c: \ windows \ SysWOW64 \ PnkBstrA.exe
12/11/2012 18:51. 15.10.2008 5:22 519000 ---- aw-c: \ windows \ system32 \ d3dx10_40.dll
12/11/2012 18:51. 15.10.2008 5:22 452440 ---- aw-c: \ windows \ SysWOW64 \ d3dx10_40.dll
12/11/2012 18:51. 10/15/2008 5:22 2605920 ---- aw-c: \ windows \ system32 \ D3DCompiler_40.dll
12/11/2012 18:51. 10/15/2008 5:22 2036576 ---- aw-c: \ windows \ SysWOW64 \ D3DCompiler_40.dll
12/11/2012 18:51. 10/15/2008 5:22 5631312 ---- aw-c: \ windows \ system32 \ D3DX9_40.dll
12/11/2012 18:51. 10/15/2008 5:22 4379984 ---- aw-c: \ windows \ SysWOW64 \ D3DX9_40.dll
12/11/2012 18:41. 12/11/2012 18:41 -------- d ----- w-c: \ program files (x86) \ Origin Games
12/11/2012 18:29. 18/12/2012 17:04 -------- d ----- w-c: \ programdata \ Electronic Arts
12/11/2012 18:29. 12/11/2012 18:49 -------- d ----- w-c: \ ProgramData \ Origin
12/11/2012 17:31. 19/12/2012 19:32 -------- d ----- w-c: \ program files (x86) \ Common Files \ Steam
12/11/2012 14:03. 12/11/2012 14:03 -------- d ----- w-c: \ program files (x86) \ Common Files \ Java
12/11/2012 14:03. 12/11/2012 14:03 746984 ---- aw-c: \ windows \ SysWOW64 \ deployJava1.dll
12/11/2012 14:03. 12/11/2012 14:03 821736 ---- aw-c: \ windows \ SysWOW64 \ npDeployJava1.dll
12/11/2012 14:03. 12/11/2012 14:03 95208 ---- aw-c: \ windows \ SysWOW64 \ WindowsAccessBridge-32.dll
12/11/2012 14:03. 12/11/2012 14:03 -------- d ----- w-c: \ program files (x86) \ Java
10/12/2012 20:42. 10/12/2012 20:42 -------- d ----- w-c: \ program files \ CCleaner
10/12/2012 13:26. 07/19/2007 17:14 5073256 ---- aw-c: \ windows \ system32 \ d3dx9_35.dll
10/12/2012 13:17. 10/12/2012 13:19 -------- d ----- w-c: \ programdata \ Razer
10/12/2012 13:17. 10/12/2012 13:17 -------- d ----- w-c: \ program files (x86) \ Razer
10/12/2012 13:01. 23.10.2012 5:04 972264 ------ w-c: \ programdata \ Microsoft \ Microsoft Antimalware \ Definition Updates \ NISBackup \ gapaengine.dll
10/12/2012 13:01. 23.10.2012 5:04 972264 ------ w-c: \ programdata \ Microsoft \ Microsoft Antimalware \ Definition Updates \ {A26135D7-3EB3-440C-ACB1-AF99DDA5E2CC} \ gapaengine.dll
10/12/2012 12:50. 21/08/2012 21:01 245760 ---- aw-c: \ windows \ system32 \ OxpsConverter.exe
10/12/2012 12:24. 10/12/2012 24:24 -------- d ----- w-c: \ windows \ system32 \ SPReview
10/12/2012 12:24. 10/12/2012 24:24 -------- d ----- w-c: \ windows \ system32 \ EventProviders
10/12/2012 12:22. 11/05/2010 1:57 48976 ---- aw-c: \ windows \ system32 \ netfxperf.dll
10/12/2012 12:22. 11/05/2010 1:57 1942856 ---- aw-c: \ windows \ system32 \ dfshim.dll
10/12/2012 12:20. 20/11/2010 13:27 448000 ---- aw-c: \ program files \ Common Files \ Microsoft Shared \ ink \ tabskb.dll
10/12/2012 12:19. 20/11/2010 13:32 2560 ---- aw-c: \ windows \ system32 \ drivers \ en-US \ rdpwd.sys.mui
10/12/2012 12:19. 20/11/2010 13:26 3584 ---- aw-c: \ windows \ system32 \ drivers \ en-US \ tsusbflt.sys.mui
10/12/2012 12:19. 20/11/2010 13:32 4608 ---- aw-c: \ windows \ system32 \ drivers \ en-US \ kbdclass.sys.mui
10/12/2012 12:19. 20/11/2010 13:31 3072 ---- aw-c: \ windows \ system32 \ drivers \ en-US \ GAGP30KX.SYS.mui
10/12/2012 12:19. 20/11/2010 13:26 399872 ---- aw-c: \ windows \ system32 \ dpx.dll
10/12/2012 12:19. 20/11/2010 24:21 189952 ---- aw-c: \ windows \ SysWOW64 \ wdscore.dll
10/12/2012 12:19. 20/11/2010 24:21 189952 ---- aw-c: \ windows \ SysWOW64 \ sqmapi.dll
10/12/2012 12:19. 20/11/2010 24:21 363008 ---- aw-c: \ windows \ SysWOW64 \ wbemcomn.dll
10/12/2012 12:19. 20/11/2010 24:21 189952 ---- aw-c: \ program files (x86) \ Windows Portable Devices \ sqmapi.dll
10/12/2012 12:19. 20/11/2010 24:19 606208 ---- aw-c: \ windows \ SysWOW64 \ wbem \ fastprox.dll
10/12/2012 12:19. 20/11/2010 13:27 529408 ---- aw-c: \ windows \ system32 \ wbemcomn.dll
10/12/2012 12:19. 20/11/2010 13:27 244736 ---- aw-c: \ program files \ Windows Portable Devices \ sqmapi.dll
10/12/2012 12:18. 20/11/2010 13:27 244736 ---- aw-c: \ windows \ system32 \ sqmapi.dll
10/12/2012 11:52. 10/12/2012 11:52 -------- d ----- w-c: \ windows \ SysWOW64 \ Wat
10/12/2012 11:52. 10/12/2012 11:52 -------- d ----- w-c: \ windows \ system32 \ Wat
10/12/2012 11:13. 7/26/2012 7:40 2560 ---- aw-c: \ windows \ system32 \ drivers \ en-US \ wdf01000.sys.mui
10/12/2012 11:13. 26.07.2012 4:55 785512 ---- aw-c: \ windows \ system32 \ drivers \ Wdf01000.sys
10/12/2012 11:13. 26/07/2012 4:55 54376 ---- aw-c: \ windows \ system32 \ drivers \ WdfLdr.sys
10/12/2012 11:13. 7/26/2012 2:36 9728 ---- aw-c: \ windows \ system32 \ Wdfres.dll
10/12/2012 11:12. 10/12/2012 11:12 289768 ---- aw-c: \ windows \ system32 \ javaws.exe
10/12/2012 11:12. 10/12/2012 11:12 916456 ---- aw-c: \ windows \ system32 \ deployJava1.dll
10/12/2012 11:12. 10/12/2012 11:12 1034216 ---- aw-c: \ windows \ system32 \ npDeployJava1.dll
10/12/2012 11:12. 10/12/2012 11:12 189416 ---- aw-c: \ windows \ system32 \ javaw.exe
10/12/2012 11:12. 10/12/2012 11:12 108008 ---- aw-c: \ windows \ system32 \ WindowsAccessBridge-64.dll
10/12/2012 11:12. 10/12/2012 11:12 188904 ---- aw-c: \ windows \ system32 \ java.exe
10/12/2012 11:12. 10/12/2012 11:12 -------- d ----- w-c: \ program files \ Java
10/12/2012 10:45. 12/12/2012 9:27 67413224 ---- aw-c: \ windows \ system32 \ Mrt.exe
10/12/2012 10:44. 26/07/2012 3:08 84992 ---- aw-c: \ windows \ system32 \ WUDFSvc.dll
10/12/2012 10:44. 26/07/2012 3:08 45056 ---- aw-c: \ windows \ system32 \ WUDFCoinstaller.dll
10/12/2012 10:44. 26.07.2012 3:08 194048 ---- aw-c: \ windows \ system32 \ WUDFPlatform.dll
10/12/2012 10:44. 26/07/2012 2:26 87040 ---- aw-c: \ windows \ system32 \ drivers \ WUDFPf.sys
10/12/2012 10:44. 26.07.2012 2:26 198656 ---- aw-c: \ windows \ system32 \ drivers \ WUDFRd.sys
10/12/2012 10:44. 26.07.2012 3:08 229888 ---- aw-c: \ windows \ system32 \ WUDFHost.exe
10/12/2012 10:44. 26.07.2012 3:08 744448 ---- aw-c: \ windows \ system32 \ WUDFx.dll
10/12/2012 10:41. 03/01/2012 6:46 23408 ---- aw-c: \ windows \ system32 \ drivers \ fs_rec.sys
10/12/2012 10:41. 03/01/2012 6:33 81408 ---- aw-c: \ windows \ system32 \ IMAGEHLP.DLL
10/12/2012 10:41. 03/01/2012 6:28 5120 ---- aw-c: \ windows \ system32 \ wmi.dll
10/12/2012 10:41. 01.03.2012 5:33 159232 ---- aw-c: \ windows \ SysWOW64 \ IMAGEHLP.DLL
10/12/2012 10:41. 03/01/2012 5:29 5120 ---- aw-c: \ windows \ SysWOW64 \ wmi.dll
10/12/2012 10:26. 16.06.2011 5:49 199680 ---- aw-c: \ windows \ system32 \ xmllite.dll
10/12/2012 10:26. 03/03/2012 6:35 1544704 ---- aw-c: \ windows \ system32 \ DWrite.dll
10/12/2012 10:26. 03/03/2012 5:31 1077248 ---- aw-c: \ windows \ SysWOW64 \ DWrite.dll
10/12/2012 10:26. 02/25/2011 6:19 2871808 ---- aw-c: \ windows \ explorer.exe
10/12/2012 10:26. 02/25/2011 5:30 2616320 ---- aw-c: \ windows \ syswow64 \ explorer.exe
10/12/2012 10:26. 23/12/2010 10:42 961024 ---- aw-c: \ windows \ system32 \ CPFilters.dll
10/12/2012 10:26. 23.12.2010 5:54 642048 ---- aw-c: \ windows \ SysWOW64 \ CPFilters.dll
10/12/2012 10:26. 23/12/2010 10:42 1118720 ---- aw-c: \ windows \ system32 \ sbe.dll
10/12/2012 10:26. 23/12/2010 10:36 259072 ---- aw-c: \ windows \ system32 \ mpg2splt.ax
10/12/2012 10:26. 23.12.2010 5:54 850944 ---- aw-c: \ windows \ SysWOW64 \ sbe.dll
10/12/2012 10:26. 23.12.2010 5:50 199680 ---- aw-c: \ windows \ SysWOW64 \ mpg2splt.ax
10/12/2012 10:24. 24/08/2012 18:05 220160 ---- aw-c: \ windows \ system32 \ Wintrust.dll
10/12/2012 10:23. 17/11/2011 6:41 1731920 ---- aw-c: \ windows \ system32 \ ntdll.dll
10/12/2012 10:23. 17/11/2011 5:38 1292080 ---- aw-c: \ windows \ SysWOW64 \ ntdll.dll
10/12/2012 10:02. 08/31/2012 18:19 1659760 ---- aw-c: \ windows \ system32 \ drivers \ ntfs.sys
10/12/2012 10:02. 06/15/2011 10:02 212992 ---- aw-c: \ windows \ system32 \ odbctrac.dll
10/12/2012 10:02. 06/15/2011 10:02 163840 ---- aw-c: \ windows \ system32 \ ODBCCP32.DLL
10/12/2012 10:02. 06/15/2011 10:02 106496 ---- aw-c: \ windows \ system32 \ odbccu32.dll
10/12/2012 10:02. 06/15/2011 10:02 106496 ---- aw-c: \ windows \ system32 \ odbccr32.dll
10/12/2012 10:02. 06.15.2011 9:59 126976 ---- aw-c: \ program files \ Common Files \ System \ Ole DB \ msdaosp.dll
10/12/2012 10:02. 06.15.2011 8:55 319488 ---- aw-c: \ windows \ SysWOW64 \ Odbcjt32.dll
10/12/2012 10:02. 06/15/2011 8:55 86016 ---- aw-c: \ windows \ SysWOW64 \ odbccu32.dll
10/12/2012 10:02. 06/15/2011 8:55 81920 ---- aw-c: \ windows \ SysWOW64 \ odbccr32.dll
10/12/2012 10:02. 06.15.2011 8:55 163840 ---- aw-c: \ windows \ SysWOW64 \ odbctrac.dll
10/12/2012 10:02. 06.15.2011 8:55 122880 ---- aw-c: \ windows \ SysWOW64 \ ODBCCP32.DLL
10/12/2012 10:02. 06/15/2011 8:54 94208 ---- aw-c: \ program files (x86) \ Common Files \ System \ Ole DB \ msdaosp.dll
10/12/2012 10:00. 19/02/2011 24:05 1139200 ---- aw-c: \ windows \ system32 \ FntCache.dll
10/12/2012 9:59. 09/30/2010 10:41 100864 ---- aw-c: \ windows \ system32 \ fontsub.dll
10/12/2012 09:55. 01/17/2011 11:09 197120 ---- aw-c: \ windows \ system32 \ d3d10_1.dll
10/12/2012 09:55. 17.01.2011 5:47 161792 ---- aw-c: \ windows \ SysWOW64 \ d3d10_1.dll
10/12/2012 09:55. 20/11/2010 13:26 321024 ---- aw-c: \ windows \ system32 \ d3d10_1core.dll
10/12/2012 09:55. 20/11/2010 12:18 219136 ---- aw-c: \ windows \ SysWOW64 \ d3d10_1core.dll
10/12/2012 09:53. 02/12/2011 11:34 267776 ---- aw-c: \ windows \ system32 \ FXSCOVER.exe
10/12/2012 09:53. 20/11/2010 13:25 974336 ---- aw-c: \ windows \ system32 \ WFS.exe
10/12/2012 9:52. 02.23.2010 8:16 294912 ---- aw-c: \ windows \ system32 \ browserchoice.exe
.
.
((((((((((((((((((((((((((((((((((((((((Find3M statement)))))))) ))))))))))))))))))))))))))))))))))))))))))))
.
10/12/2012 24:33. 14.07.2009 2:36 175616 ---- aw-c: \ windows \ system32 \ msclmd.dll
10/12/2012 24:33. 14.07.2009 2:36 152576 ---- aw-c: \ windows \ SysWOW64 \ msclmd.dll
10/12/2012 10:57. 10/12/2012 10:57 203776 ---- aw-c: \ windows \ SysWOW64 \ Webcheck.dll
10/12/2012 10:57. 10/12/2012 10:57 249344 ---- aw-c: \ windows \ system32 \ Webcheck.dll
16/10/2012 8:38. 10/12/2012 10:01 135168 ---- aw-c: \ windows \ AppPatch \ AppPatch64 \ AcXtrnal.dll
16/10/2012 8:38. 10/12/2012 10:01 350208 ---- aw-c: \ windows \ AppPatch \ AppPatch64 \ AcLayers.dll
16/10/2012 07:39. 10/12/2012 10:01 561664 ---- aw-c: \ windows \ AppPatch \ AcLayers.dll
10/04/2012 16:40. 12/12/2012 9:25 44032 ---- aw-c: \ windows \ AppPatch \ acwow64.dll
09/28/2012 14:37. 09/28/2012 14:37 221696 ---- aw-c: \ windows \ system32 \ clinfo.exe
09/28/2012 14:36. 09/28/2012 14:36 75776 ---- aw-c: \ windows \ system32 \ OpenVideo64.dll
09/28/2012 14:36. 09/28/2012 14:36 65536 ---- aw-c: \ windows \ SysWOW64 \ OpenVideo.dll
09/28/2012 14:36. 09/28/2012 14:36 63488 ---- aw-c: \ windows \ system32 \ OVDecode64.dll
09/28/2012 14:36. 09/28/2012 14:36 56320 ---- aw-c: \ windows \ SysWOW64 \ OVDecode.dll
09/28/2012 14:36. 09/28/2012 14:36 32635904 ---- aw-c: \ windows \ system32 \ amdocl64.dll
09/28/2012 14:32. 09/28/2012 14:32 27341824 ---- aw-c: \ windows \ SysWOW64 \ amdocl.dll
09/28/2012 14:28. 09/28/2012 14:28 54784 ---- aw-c: \ windows \ system32 \ OpenCL.dll
09/28/2012 14:28. 09/28/2012 14:28 50176 ---- aw-c: \ windows \ SysWOW64 \ OpenCL.dll
09/28/2012 2:23. 09/28/2012 2:23 5557928 ---- aw-c: \ windows \ SysWOW64 \ atiumdag.dll
09/28/2012 2:21. 09/28/2012 2:21 10697216 ---- aw-c: \ windows \ system32 \ drivers \ atikmdag.sys
09/28/2012 2:05. 09/28/2012 2:05 70144 ---- aw-c: \ windows \ system32 \ coinst_9.002.dll
09/28/2012 2:03. 28.09.2012 2:03 163840 ---- aw-c: \ windows \ system32 \ atiapfxx.exe
09/28/2012 2:02. 09/28/2012 2:02 51200 ---- aw-c: \ windows \ system32 \ aticalrt64.dll
09/28/2012 2:02. 09/28/2012 2:02 46080 ---- aw-c: \ windows \ SysWOW64 \ aticalrt.dll
09/28/2012 2:02. 09/28/2012 2:02 44544 ---- aw-c: \ windows \ system32 \ aticalcl64.dll
09/28/2012 2:02. 09/28/2012 2:02 44032 ---- aw-c: \ windows \ SysWOW64 \ aticalcl.dll
09/28/2012 2:02. 09/28/2012 2:02 16082432 ---- aw-c: \ windows \ system32 \ aticaldd64.dll
09/28/2012 1:59. 09/28/2012 1:59 23825920 ---- aw-c: \ windows \ system32 \ atio6axx.dll
09/28/2012 1:57. 09/28/2012 1:57 13703168 ---- aw-c: \ windows \ SysWOW64 \ aticaldd.dll
09/28/2012 1:43. 28.09.2012 1:43 935424 ---- aw-c: \ windows \ SysWOW64 \ aticfx32.dll
09/28/2012 1:41. 09/28/2012 1:41 1120768 ---- aw-c: \ windows \ system32 \ aticfx64.dll
09/28/2012 1:41. 09/28/2012 1:41 19624960 ---- aw-c: \ windows \ SysWOW64 \ atioglxx.dll
09/28/2012 1:39. 09/28/2012 1:39 6536192 ---- aw-c: \ windows \ SysWOW64 \ atidxx32.dll
09/28/2012 1:39. 28.09.2012 1:39 442368 ---- aw-c: \ windows \ system32 \ atidemgy.dll
09/28/2012 1:39. 28.09.2012 1:39 538112 ---- aw-c: \ windows \ system32 \ atieclxx.exe
09/28/2012 1:38. 28.09.2012 1:38 239616 ---- aw-c: \ windows \ system32 \ atiesrxx.exe
09/28/2012 1:36. 28.09.2012 1:36 120320 ---- aw-c: \ windows \ system32 \ atitmm64.dll
09/28/2012 1:36. 09/28/2012 1:36 21504 ---- aw-c: \ windows \ system32 \ atimuixx.dll
09/28/2012 1:36. 09/28/2012 1:36 59392 ---- aw-c: \ windows \ system32 \ atiedu64.dll
09/28/2012 1:36. 09/28/2012 1:36 43520 ---- aw-c: \ windows \ SysWOW64 \ ati2edxx.dll
09/28/2012 01:31. 09/28/2012 1:31 3127296 ---- aw-c: \ windows \ system32 \ atiumd6a.dll
09/28/2012 01:25. 09/28/2012 1:25 6704640 ---- aw-c: \ windows \ system32 \ atiumd64.dll
09/28/2012 1:22. 09/28/2012 1:22 7167488 ---- aw-c: \ windows \ system32 \ atidxx64.dll
09/28/2012 1:22. 09/28/2012 1:22 2691584 ---- aw-c: \ windows \ SysWOW64 \ atiumdva.dll
09/28/2012 1:13. 28.09.2012 1:13 595456 ---- aw-c: \ windows \ system32 \ atiadlxx.dll
09/28/2012 1:13. 28.09.2012 1:13 405504 ---- aw-c: \ windows \ SysWOW64 \ atiadlxy.dll
09/28/2012 1:13. 09/28/2012 1:13 17920 ---- aw-c: \ windows \ system32 \ atig6pxx.dll
09/28/2012 1:13. 09/28/2012 1:13 14848 ---- aw-c: \ windows \ SysWOW64 \ atiglpxx.dll
09/28/2012 1:13. 09/28/2012 1:13 14848 ---- aw-c: \ windows \ system32 \ atiglpxx.dll
09/28/2012 1:13. 09/28/2012 1:13 41984 ---- aw-c: \ windows \ system32 \ atig6txx.dll
09/28/2012 1:13. 09/28/2012 1:13 33280 ---- aw-c: \ windows \ SysWOW64 \ atigktxx.dll
09/28/2012 1:12. 09/28/2012 1:12 56320 ---- aw-c: \ windows \ system32 \ atimpc64.dll
09/28/2012 1:12. 09/28/2012 1:12 56320 ---- aw-c: \ windows \ system32 \ amdpcom64.dll
09/28/2012 1:12. 28.09.2012 1:12 460288 ---- aw-c: \ windows \ system32 \ drivers \ atikmpag.sys
09/28/2012 1:12. 09/28/2012 1:12 56832 ---- aw-c: \ windows \ SysWOW64 \ atimpc32.dll
09/28/2012 1:12. 09/28/2012 1:12 56832 ---- aw-c: \ windows \ SysWOW64 \ amdpcom32.dll
09/28/2012 01:11. 28.09.2012 1:11 129536 ---- aw-c: \ windows \ system32 \ atiuxp64.dll
09/28/2012 01:11. 28.09.2012 1:11 109568 ---- aw-c: \ windows \ SysWOW64 \ atiuxpag.dll
09/28/2012 01:11. 28.09.2012 1:11 103424 ---- aw-c: \ windows \ system32 \ atiu9p64.dll
09/28/2012 01:10. 09/28/2012 1:10 82944 ---- aw-c: \ windows \ SysWOW64 \ atiu9pag.dll
09/28/2012 1:09. 09/28/2012 1:09 53248 ---- aw-c: \ windows \ system32 \ drivers \ ati2erec.dll
.
.
((((((((((((((((((((((((((((((((((Reg Loading Points)))))))))))) )))))))))))))))))))))))))))))))))
.
.
* Note * empty entries and legitimate underlying data are not displayed.
REGEDIT4
.
[HKEY_CURRENT_USER \ SOFTWARE \ Microsoft \ Windows \ CurrentVersion \ Run]
"F.lux" = "c: \ users \ FNJ \ Local Settings \ Apps \ F.lux \ flux.exe" [29/08/2009 966656]
.
[HKEY_LOCAL_MACHINE \ SOFTWARE \ Wow6432Node \ Microsoft \ Windows \ CurrentVersion \ Run]
"StartCCC" = "c: \ program files (x86) \ ATI Technologies \ ATI.ACE \ Core-Static \ CLIStart.exe" [09/28/2012 642728]
"NUSB3MON" = "c: \ program files (x86) \ Renesas Electronics \ USB 3.0 Host Controller Driver \ Application \ nusb3mon.exe" [11/17/2010 113288]
"SunJavaUpdateSched" = "c: \ program files (x86) \ Common Files \ Java \ Java Update \ jusched.exe" [07/03/2012 252848]
.
[HKEY_LOCAL_MACHINE \ software \ microsoft \ windows \ CurrentVersion \ policies \ system]
"ConsentPromptBehaviorUser" = 3 (0x3)
"EnableUIADesktopToggle" = 0 (0x0)
.
[HKEY_LOCAL_MACHINE \ SYSTEM \ CurrentControlSet \ Control \ SafeBoot \ Minimal \ MsMpSvc]
@ = "Service "
.
R2 AxAutoMntSrv; Alcohol Virtual Drive Auto-mount Service c: \ program files (x86) \ Alcohol Soft \ Alcohol 52 \ AxAutoMntSrv.exe [01/05/2012 75624]
Clr_optimization_v4.0.30319_64 R2, Microsoft. NET Framework NGEN v4.0.30319_X64 c: \ windows \ Microsoft.NET \ Framework64 \ v4.0.30319 \ mscorsvw.exe [18/03/2010 138576]
R3 NisDrv; Microsoft Network Inspection System; c: \ windows \ system32 \ DRIVERS \ NisDrvWFP.sys [08/30/2012 128456]
R3 NisSrv; Microsoft Network Inspection c: \ program files \ Microsoft Security Client \ NisSrv.exe [12/09/2012 368896]
R3 PSI; PSI c: \ windows \ system32 \ DRIVERS \ psi_mf.sys [09/01/2010 17976]
R3 RdpVideoMiniport; Remote Desktop Video Miniport Driver c: \ windows \ system32 \ drivers \ rdpvideominiport.sys [08/23/2012 19456]
R3 Secunia PSI Agent; Secunia PSI Agent c: \ program files (x86) \ Secunia \ PSI \ PSIA.exe [26/11/2012 1225312]
R3 TsUsbFlt; TsUsbFlt c: \ windows \ system32 \ drivers \ tsusbflt.sys [08/23/2012 57856]
WatAdminSvc R3, Windows Activation Technologies Service c: \ windows \ system32 \ Wat \ WatAdminSvc.exe [10/12/2012 1255736]
R3 WinRing0_1_2_0; WinRing0_1_2_0 c: \ program files (x86) \ Razer \ Razer Game Booster \ Driver \ WinRing0x64.sys [17/09/2012 14544]
S0 SPTD; SPTD c: \ windows \ \ SystemRoot \ System32 \ Drivers \ sptd.sys [x]
S2 AMD External Events Utility, AMD External Events Utility; c: \ windows \ system32 \ atiesrxx.exe [09/28/2012 239616]
S2 AMD FUEL Service; AMD FUEL Service; c: \ program files \ ATI Technologies \ ATI.ACE \ Fuel \ Fuel.Service.exe [28/09/2012 361984]
S2 AODDriver4.2; AODDriver4.2 c: \ program files \ ATI Technologies \ ATI.ACE \ Fuel \ amd64 \ AODDriver2.sys [04/09/2012 57472]
S2 MBAMService; MBAMService c: \ program files (x86) \ Malwarebytes' Anti-Malware \ mbamservice.exe [09/29/2012 676936]
AtiHDAudioService S3, AMD Function Driver for HD Audio Service c: \ windows \ system32 \ drivers \ AtihdW76.sys [05/14/2012 96896]
S3 MBAMProtector; MBAMProtector c: \ windows \ system32 \ drivers \ mbam.sys [09/29/2012 25928]
S3 nusb3hub; Renesas Electronics USB 3.0 Hub Driver c: \ windows \ system32 \ DRIVERS \ nusb3hub.sys [11/19/2010 80384]
S3 nusb3xhc; Renesas Electronics USB 3.0 Host Controller Driver c: \ windows \ system32 \ DRIVERS \ nusb3xhc.sys [11/19/2010 181248]
S3 RTL8167, Realtek 8167 NT Driver c: \ windows \ system32 \ DRIVERS \ Rt64win7.sys [01/03/2009 187392]
Usbfilter S3, AMD USB Filter Driver c: \ windows \ system32 \ DRIVERS \ usbfilter.sys [12/22/2009 38456]
.
.
.
Entries X64 --------- -----------
.
.
[HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows \ CurrentVersion \ Run]
"MSC" = "c: \ program files \ Microsoft Security Client \ msseces.exe" [12/09/2012 1289704]
.
------- Supplementary Scan -------
.
uLocal Page = c: \ windows \ system32 \ blank.htm
mLocal Page = c: \ windows \ SysWOW64 \ blank.htm
TCP: DhcpNameServer = 10.0.0.138
FF - ProfilePath - c: \ users \ FNJ \ AppData \ Roaming \ Mozilla \ Firefox \ Profiles \ up9494a3.default \
FF - ExtSQL: 12/19/2012 21:02; {a0d7ccb3-214D-498b-b4aa-0e8fda9a7bf7};
FF - ExtSQL: 12/19/2012 21:02; support@lastpass.com;
.
.
--------------------- Locked keys in the registry ---------------------
.
[HKEY_LOCAL_MACHINE \ SOFTWARE \ Classes \ CLSID \ {73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@ Denied: (A 2) (Everyone)
@ = "FlashBroker "

.
[HKEY_LOCAL_MACHINE \ SOFTWARE \ Classes \ CLSID \ {73C9DFA0-750D-11E1-B0C4-0800200C9A66} \ Elevation]
"Enabled" = dword: 00000001
.
[HKEY_LOCAL_MACHINE \ SOFTWARE \ Classes \ CLSID \ {73C9DFA0-750D-11E1-B0C4-0800200C9A66} \ LocalServer32]
@ = "C: \ \ Windows \ \ system32 \ \ Macromed \ \ Flash \ \ FlashUtil64_11_5_502_110_ActiveX.exe "
.
[HKEY_LOCAL_MACHINE \ SOFTWARE \ Classes \ CLSID \ {73C9DFA0-750D-11E1-B0C4-0800200C9A66} \ TypeLib]
@ = "{FAB3E735-69C7-453B-A446-B6823C6DF1C9} "
.
[HKEY_LOCAL_MACHINE \ SOFTWARE \ Classes \ Interface \ {6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@ Denied: (A 2) (Everyone)
@ = "IFlashBroker5 "
.

@ = "{00020424-0000-0000-C000-000000000046} "
.
[HKEY_LOCAL_MACHINE \ SOFTWARE \ Classes \ Interface \ {6AE38AE0-750C-11E1-B0C4-0800200C9A66} \ TypeLib]
@ = "{FAB3E735-69C7-453B-A446-B6823C6DF1C9} "
"Version" = "1.0 "
.
[HKEY_LOCAL_MACHINE \ SOFTWARE \ Classes \ Wow6432Node \ CLSID \ {73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@ Denied: (A 2) (Everyone)
@ = "FlashBroker "

.

"Enabled" = dword: 00000001
.

@ = "C: \ \ Windows \ \ SysWOW64 \ \ Macromed \ \ Flash \ \ FlashUtil32_11_5_502_110_ActiveX.exe "
.

@ = "{FAB3E735-69C7-453B-A446-B6823C6DF1C9} "
.
[HKEY_LOCAL_MACHINE \ SOFTWARE \ Classes \ Wow6432Node \ CLSID \ {D27CDB6E-AE6D-11cf-96B8-444553540000}]
@ Denied: (A 2) (Everyone)
@ = "Shockwave Flash Object "
.

@ = "C: \ \ Windows \ \ SysWOW64 \ \ Macromed \ \ Flash \ \ Flash32_11_5_502_110.ocx "
"ThreadingModel" = "Apartment "
.

@ = "0 "
.

@ = "ShockwaveFlash.ShockwaveFlash.11 "
.

@ = "C: \ \ Windows \ \ SysWOW64 \ \ Macromed \ \ Flash \ \ Flash32_11_5_502_110.ocx, 1 "
.

@ = "{D27CDB6B-AE6D-11cf-96B8-444553540000} "
.

@ = "1.0 "
.

@ = "ShockwaveFlash.ShockwaveFlash "
.
[HKEY_LOCAL_MACHINE \ SOFTWARE \ Classes \ Wow6432Node \ CLSID \ {D27CDB70-AE6D-11cf-96B8-444553540000}]
@ Denied: (A 2) (Everyone)
@ = "Macromedia Flash Factory Object "
.

@ = "C: \ \ Windows \ \ SysWOW64 \ \ Macromed \ \ Flash \ \ Flash32_11_5_502_110.ocx "
"ThreadingModel" = "Apartment "
.

@ = "FlashFactory.FlashFactory.1 "
.

@ = "C: \ \ Windows \ \ SysWOW64 \ \ Macromed \ \ Flash \ \ Flash32_11_5_502_110.ocx, 1 "
.

@ = "{D27CDB6B-AE6D-11cf-96B8-444553540000} "
.

@ = "1.0 "
.

@ = "FlashFactory.FlashFactory "
.
[HKEY_LOCAL_MACHINE \ SOFTWARE \ Classes \ Wow6432Node \ Interface \ {6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@ Denied: (A 2) (Everyone)
@ = "IFlashBroker5 "
.

@ = "{00020424-0000-0000-C000-000000000046} "
.

@ = "{FAB3E735-69C7-453B-A446-B6823C6DF1C9} "
"Version" = "1.0 "
.
[HKEY_LOCAL_MACHINE \ SYSTEM \ ControlSet001 \ Control \ PCW \ Security]
@ Denied: (Full) (Everyone)
.
Total time: 20/12/2012 9:36:11
ComboFix-quarantined-files.txt 20/12/2012 8:36
.
Before starting: free bytes: 171696226304
After running: free bytes: 171571834880
.
- End Of File - F70268C424E3E6B31B884668866D96C2

FNj · 2012/12/20

Had to run it through google translator again - combofix ran in Czech

ComboFix 12-12-20.01 - FNJ 9:32.1.4 December 20, 2012 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1250.420.1029.18.4094.2758 [GMT 1:00]
Running from: c: \ users \ FNJ \ Desktop \ ComboFix.exe
AV: Microsoft Security Essentials * Disabled / Updated * {B140BF4E-23BB-4198-90AB-A51A4C60A69C}
SP: Microsoft Security Essentials * Disabled / Updated * {0A215EAA-0581-4E16-AA1B-9E6837E7EC21}
SP: Windows Defender * Disabled / Updated * {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
(((((((((((((((((((((((((Files Created from 20/11/2012 to 20/12/2012))))))))))) ))))))))))))))))))))
.
.
12/20/2012 8:35. 12/20/2012 8:35 -------- d ----- w-c: \ users \ Default \ AppData \ Local \ temp
19/12/2012 21:05. 19/12/2012 21:05 -------- d ----- w-c: \ program files \ FreeFixer
19/12/2012 20:57. 11/08/2012 8:24 9125352 ---- aw-c: \ programdata \ Microsoft \ Microsoft Antimalware \ Definition Updates \ {16BC7F2F-D15F-4BC7-97F4-753A3D06CC4E} \ mpengine.dll
19/12/2012 14:19. 11/08/2012 8:24 9125352 ---- aw-c: \ programdata \ Microsoft \ Microsoft Antimalware \ Definition Updates \ Backup \ mpengine.dll
18/12/2012 21:22. 18/12/2012 21:22 -------- d ----- w-c: \ program files (x86) \ VS Revo Group
18/12/2012 17:05. 19/12/2012 18:06 281520 ---- aw-c: \ windows \ SysWOW64 \ PnkBstrB.xtr
18/12/2012 17:04. 18/12/2012 17:04 -------- d ----- w-c: \ programdata \ EA Core
18/12/2012 16:56. 18/12/2012 16:56 -------- d ----- w-c: \ program files (x86) \ Battlelog Web Plugins
18/12/2012 16:48. 18/12/2012 19:33 -------- d ----- w-c: \ programdata \ EA Logs
18/12/2012 14:35. 18/12/2012 14:35 21132800 ---- aw-c: \ programdata \ Microsoft \ Microsoft Antimalware \ LocalCopy \ {CDB32C76-59FC-C153-066D-5540E234DB81}-12a4f0.msi
18/12/2012 13:10. 18/12/2012 13:28 -------- d ----- w-c: \ program files \ trend micro
18/12/2012 13:10. 18/12/2012 13:10 -------- d ----- w-C: \ rsit
18/12/2012 12:24. 18/12/2012 24:24 -------- d ----- w-c: \ program files (x86) \ Secunia
17/12/2012 15:33. 17/12/2012 15:33 -------- d ----- w-c: \ programdata \ DigiPen
16/12/2012 18:29. 16/12/2012 18:30 -------- d ----- w-c: \ program files (x86) \ LibreOffice 3.6
12/15/2012 12:29. 12/15/2012 12:29 -------- d ----- w-c: \ program files (x86) \ Alcohol Soft
12/15/2012 12:27. 12/15/2012 24:27 564824 ---- aw-c: \ windows \ system32 \ drivers \ sptd.sys
12/12/2012 9:26. 14/11/2012 5:53 96768 ---- aw-c: \ windows \ system32 \ mshtmled.dll
12/12/2012 9:26. 14/11/2012 5:52 2382848 ---- aw-c: \ windows \ system32 \ Mshtml.tlb
12/12/2012 9:26. 14/11/2012 1:44 2382848 ---- aw-c: \ windows \ SysWOW64 \ Mshtml.tlb
12/11/2012 18:52. 12/11/2012 18:52 -------- d - h - w-c: \ program files (x86) \ Common Files \ EAInstaller
12/11/2012 18:51. 19/12/2012 18:06 281520 ---- aw-c: \ windows \ SysWOW64 \ PnkBstrB.exe
12/11/2012 18:51. 19/12/2012 18:06 280904 ---- aw-c: \ windows \ SysWOW64 \ PnkBstrB.ex0
12/11/2012 18:51. 18/12/2012 17:09 76888 ---- aw-c: \ windows \ SysWOW64 \ PnkBstrA.exe
12/11/2012 18:51. 15.10.2008 5:22 519000 ---- aw-c: \ windows \ system32 \ d3dx10_40.dll
12/11/2012 18:51. 15.10.2008 5:22 452440 ---- aw-c: \ windows \ SysWOW64 \ d3dx10_40.dll
12/11/2012 18:51. 10/15/2008 5:22 2605920 ---- aw-c: \ windows \ system32 \ D3DCompiler_40.dll
12/11/2012 18:51. 10/15/2008 5:22 2036576 ---- aw-c: \ windows \ SysWOW64 \ D3DCompiler_40.dll
12/11/2012 18:51. 10/15/2008 5:22 5631312 ---- aw-c: \ windows \ system32 \ D3DX9_40.dll
12/11/2012 18:51. 10/15/2008 5:22 4379984 ---- aw-c: \ windows \ SysWOW64 \ D3DX9_40.dll
12/11/2012 18:41. 12/11/2012 18:41 -------- d ----- w-c: \ program files (x86) \ Origin Games
12/11/2012 18:29. 18/12/2012 17:04 -------- d ----- w-c: \ programdata \ Electronic Arts
12/11/2012 18:29. 12/11/2012 18:49 -------- d ----- w-c: \ ProgramData \ Origin
12/11/2012 17:31. 19/12/2012 19:32 -------- d ----- w-c: \ program files (x86) \ Common Files \ Steam
12/11/2012 14:03. 12/11/2012 14:03 -------- d ----- w-c: \ program files (x86) \ Common Files \ Java
12/11/2012 14:03. 12/11/2012 14:03 746984 ---- aw-c: \ windows \ SysWOW64 \ deployJava1.dll
12/11/2012 14:03. 12/11/2012 14:03 821736 ---- aw-c: \ windows \ SysWOW64 \ npDeployJava1.dll
12/11/2012 14:03. 12/11/2012 14:03 95208 ---- aw-c: \ windows \ SysWOW64 \ WindowsAccessBridge-32.dll
12/11/2012 14:03. 12/11/2012 14:03 -------- d ----- w-c: \ program files (x86) \ Java
10/12/2012 20:42. 10/12/2012 20:42 -------- d ----- w-c: \ program files \ CCleaner
10/12/2012 13:26. 07/19/2007 17:14 5073256 ---- aw-c: \ windows \ system32 \ d3dx9_35.dll
10/12/2012 13:17. 10/12/2012 13:19 -------- d ----- w-c: \ programdata \ Razer
10/12/2012 13:17. 10/12/2012 13:17 -------- d ----- w-c: \ program files (x86) \ Razer
10/12/2012 13:01. 23.10.2012 5:04 972264 ------ w-c: \ programdata \ Microsoft \ Microsoft Antimalware \ Definition Updates \ NISBackup \ gapaengine.dll
10/12/2012 13:01. 23.10.2012 5:04 972264 ------ w-c: \ programdata \ Microsoft \ Microsoft Antimalware \ Definition Updates \ {A26135D7-3EB3-440C-ACB1-AF99DDA5E2CC} \ gapaengine.dll
10/12/2012 12:50. 21/08/2012 21:01 245760 ---- aw-c: \ windows \ system32 \ OxpsConverter.exe
10/12/2012 12:24. 10/12/2012 24:24 -------- d ----- w-c: \ windows \ system32 \ SPReview
10/12/2012 12:24. 10/12/2012 24:24 -------- d ----- w-c: \ windows \ system32 \ EventProviders
10/12/2012 12:22. 11/05/2010 1:57 48976 ---- aw-c: \ windows \ system32 \ netfxperf.dll
10/12/2012 12:22. 11/05/2010 1:57 1942856 ---- aw-c: \ windows \ system32 \ dfshim.dll
10/12/2012 12:20. 20/11/2010 13:27 448000 ---- aw-c: \ program files \ Common Files \ Microsoft Shared \ ink \ tabskb.dll
10/12/2012 12:19. 20/11/2010 13:32 2560 ---- aw-c: \ windows \ system32 \ drivers \ en-US \ rdpwd.sys.mui
10/12/2012 12:19. 20/11/2010 13:26 3584 ---- aw-c: \ windows \ system32 \ drivers \ en-US \ tsusbflt.sys.mui
10/12/2012 12:19. 20/11/2010 13:32 4608 ---- aw-c: \ windows \ system32 \ drivers \ en-US \ kbdclass.sys.mui
10/12/2012 12:19. 20/11/2010 13:31 3072 ---- aw-c: \ windows \ system32 \ drivers \ en-US \ GAGP30KX.SYS.mui
10/12/2012 12:19. 20/11/2010 13:26 399872 ---- aw-c: \ windows \ system32 \ dpx.dll
10/12/2012 12:19. 20/11/2010 24:21 189952 ---- aw-c: \ windows \ SysWOW64 \ wdscore.dll
10/12/2012 12:19. 20/11/2010 24:21 189952 ---- aw-c: \ windows \ SysWOW64 \ sqmapi.dll
10/12/2012 12:19. 20/11/2010 24:21 363008 ---- aw-c: \ windows \ SysWOW64 \ wbemcomn.dll
10/12/2012 12:19. 20/11/2010 24:21 189952 ---- aw-c: \ program files (x86) \ Windows Portable Devices \ sqmapi.dll
10/12/2012 12:19. 20/11/2010 24:19 606208 ---- aw-c: \ windows \ SysWOW64 \ wbem \ fastprox.dll
10/12/2012 12:19. 20/11/2010 13:27 529408 ---- aw-c: \ windows \ system32 \ wbemcomn.dll
10/12/2012 12:19. 20/11/2010 13:27 244736 ---- aw-c: \ program files \ Windows Portable Devices \ sqmapi.dll
10/12/2012 12:18. 20/11/2010 13:27 244736 ---- aw-c: \ windows \ system32 \ sqmapi.dll
10/12/2012 11:52. 10/12/2012 11:52 -------- d ----- w-c: \ windows \ SysWOW64 \ Wat
10/12/2012 11:52. 10/12/2012 11:52 -------- d ----- w-c: \ windows \ system32 \ Wat
10/12/2012 11:13. 7/26/2012 7:40 2560 ---- aw-c: \ windows \ system32 \ drivers \ en-US \ wdf01000.sys.mui
10/12/2012 11:13. 26.07.2012 4:55 785512 ---- aw-c: \ windows \ system32 \ drivers \ Wdf01000.sys
10/12/2012 11:13. 26/07/2012 4:55 54376 ---- aw-c: \ windows \ system32 \ drivers \ WdfLdr.sys
10/12/2012 11:13. 7/26/2012 2:36 9728 ---- aw-c: \ windows \ system32 \ Wdfres.dll
10/12/2012 11:12. 10/12/2012 11:12 289768 ---- aw-c: \ windows \ system32 \ javaws.exe
10/12/2012 11:12. 10/12/2012 11:12 916456 ---- aw-c: \ windows \ system32 \ deployJava1.dll
10/12/2012 11:12. 10/12/2012 11:12 1034216 ---- aw-c: \ windows \ system32 \ npDeployJava1.dll
10/12/2012 11:12. 10/12/2012 11:12 189416 ---- aw-c: \ windows \ system32 \ javaw.exe
10/12/2012 11:12. 10/12/2012 11:12 108008 ---- aw-c: \ windows \ system32 \ WindowsAccessBridge-64.dll
10/12/2012 11:12. 10/12/2012 11:12 188904 ---- aw-c: \ windows \ system32 \ java.exe
10/12/2012 11:12. 10/12/2012 11:12 -------- d ----- w-c: \ program files \ Java
10/12/2012 10:45. 12/12/2012 9:27 67413224 ---- aw-c: \ windows \ system32 \ Mrt.exe
10/12/2012 10:44. 26/07/2012 3:08 84992 ---- aw-c: \ windows \ system32 \ WUDFSvc.dll
10/12/2012 10:44. 26/07/2012 3:08 45056 ---- aw-c: \ windows \ system32 \ WUDFCoinstaller.dll
10/12/2012 10:44. 26.07.2012 3:08 194048 ---- aw-c: \ windows \ system32 \ WUDFPlatform.dll
10/12/2012 10:44. 26/07/2012 2:26 87040 ---- aw-c: \ windows \ system32 \ drivers \ WUDFPf.sys
10/12/2012 10:44. 26.07.2012 2:26 198656 ---- aw-c: \ windows \ system32 \ drivers \ WUDFRd.sys
10/12/2012 10:44. 26.07.2012 3:08 229888 ---- aw-c: \ windows \ system32 \ WUDFHost.exe
10/12/2012 10:44. 26.07.2012 3:08 744448 ---- aw-c: \ windows \ system32 \ WUDFx.dll
10/12/2012 10:41. 03/01/2012 6:46 23408 ---- aw-c: \ windows \ system32 \ drivers \ fs_rec.sys
10/12/2012 10:41. 03/01/2012 6:33 81408 ---- aw-c: \ windows \ system32 \ IMAGEHLP.DLL
10/12/2012 10:41. 03/01/2012 6:28 5120 ---- aw-c: \ windows \ system32 \ wmi.dll
10/12/2012 10:41. 01.03.2012 5:33 159232 ---- aw-c: \ windows \ SysWOW64 \ IMAGEHLP.DLL
10/12/2012 10:41. 03/01/2012 5:29 5120 ---- aw-c: \ windows \ SysWOW64 \ wmi.dll
10/12/2012 10:26. 16.06.2011 5:49 199680 ---- aw-c: \ windows \ system32 \ xmllite.dll
10/12/2012 10:26. 03/03/2012 6:35 1544704 ---- aw-c: \ windows \ system32 \ DWrite.dll
10/12/2012 10:26. 03/03/2012 5:31 1077248 ---- aw-c: \ windows \ SysWOW64 \ DWrite.dll
10/12/2012 10:26. 02/25/2011 6:19 2871808 ---- aw-c: \ windows \ explorer.exe
10/12/2012 10:26. 02/25/2011 5:30 2616320 ---- aw-c: \ windows \ syswow64 \ explorer.exe
10/12/2012 10:26. 23/12/2010 10:42 961024 ---- aw-c: \ windows \ system32 \ CPFilters.dll
10/12/2012 10:26. 23.12.2010 5:54 642048 ---- aw-c: \ windows \ SysWOW64 \ CPFilters.dll
10/12/2012 10:26. 23/12/2010 10:42 1118720 ---- aw-c: \ windows \ system32 \ sbe.dll
10/12/2012 10:26. 23/12/2010 10:36 259072 ---- aw-c: \ windows \ system32 \ mpg2splt.ax
10/12/2012 10:26. 23.12.2010 5:54 850944 ---- aw-c: \ windows \ SysWOW64 \ sbe.dll
10/12/2012 10:26. 23.12.2010 5:50 199680 ---- aw-c: \ windows \ SysWOW64 \ mpg2splt.ax
10/12/2012 10:24. 24/08/2012 18:05 220160 ---- aw-c: \ windows \ system32 \ Wintrust.dll
10/12/2012 10:23. 17/11/2011 6:41 1731920 ---- aw-c: \ windows \ system32 \ ntdll.dll
10/12/2012 10:23. 17/11/2011 5:38 1292080 ---- aw-c: \ windows \ SysWOW64 \ ntdll.dll
10/12/2012 10:02. 08/31/2012 18:19 1659760 ---- aw-c: \ windows \ system32 \ drivers \ ntfs.sys
10/12/2012 10:02. 06/15/2011 10:02 212992 ---- aw-c: \ windows \ system32 \ odbctrac.dll
10/12/2012 10:02. 06/15/2011 10:02 163840 ---- aw-c: \ windows \ system32 \ ODBCCP32.DLL
10/12/2012 10:02. 06/15/2011 10:02 106496 ---- aw-c: \ windows \ system32 \ odbccu32.dll
10/12/2012 10:02. 06/15/2011 10:02 106496 ---- aw-c: \ windows \ system32 \ odbccr32.dll
10/12/2012 10:02. 06.15.2011 9:59 126976 ---- aw-c: \ program files \ Common Files \ System \ Ole DB \ msdaosp.dll
10/12/2012 10:02. 06.15.2011 8:55 319488 ---- aw-c: \ windows \ SysWOW64 \ Odbcjt32.dll
10/12/2012 10:02. 06/15/2011 8:55 86016 ---- aw-c: \ windows \ SysWOW64 \ odbccu32.dll
10/12/2012 10:02. 06/15/2011 8:55 81920 ---- aw-c: \ windows \ SysWOW64 \ odbccr32.dll
10/12/2012 10:02. 06.15.2011 8:55 163840 ---- aw-c: \ windows \ SysWOW64 \ odbctrac.dll
10/12/2012 10:02. 06.15.2011 8:55 122880 ---- aw-c: \ windows \ SysWOW64 \ ODBCCP32.DLL
10/12/2012 10:02. 06/15/2011 8:54 94208 ---- aw-c: \ program files (x86) \ Common Files \ System \ Ole DB \ msdaosp.dll
10/12/2012 10:00. 19/02/2011 24:05 1139200 ---- aw-c: \ windows \ system32 \ FntCache.dll
10/12/2012 9:59. 09/30/2010 10:41 100864 ---- aw-c: \ windows \ system32 \ fontsub.dll
10/12/2012 09:55. 01/17/2011 11:09 197120 ---- aw-c: \ windows \ system32 \ d3d10_1.dll
10/12/2012 09:55. 17.01.2011 5:47 161792 ---- aw-c: \ windows \ SysWOW64 \ d3d10_1.dll
10/12/2012 09:55. 20/11/2010 13:26 321024 ---- aw-c: \ windows \ system32 \ d3d10_1core.dll
10/12/2012 09:55. 20/11/2010 12:18 219136 ---- aw-c: \ windows \ SysWOW64 \ d3d10_1core.dll
10/12/2012 09:53. 02/12/2011 11:34 267776 ---- aw-c: \ windows \ system32 \ FXSCOVER.exe
10/12/2012 09:53. 20/11/2010 13:25 974336 ---- aw-c: \ windows \ system32 \ WFS.exe
10/12/2012 9:52. 02.23.2010 8:16 294912 ---- aw-c: \ windows \ system32 \ browserchoice.exe
.
.
((((((((((((((((((((((((((((((((((((((((Find3M statement)))))))) ))))))))))))))))))))))))))))))))))))))))))))
.
10/12/2012 24:33. 14.07.2009 2:36 175616 ---- aw-c: \ windows \ system32 \ msclmd.dll
10/12/2012 24:33. 14.07.2009 2:36 152576 ---- aw-c: \ windows \ SysWOW64 \ msclmd.dll
10/12/2012 10:57. 10/12/2012 10:57 203776 ---- aw-c: \ windows \ SysWOW64 \ Webcheck.dll
10/12/2012 10:57. 10/12/2012 10:57 249344 ---- aw-c: \ windows \ system32 \ Webcheck.dll
16/10/2012 8:38. 10/12/2012 10:01 135168 ---- aw-c: \ windows \ AppPatch \ AppPatch64 \ AcXtrnal.dll
16/10/2012 8:38. 10/12/2012 10:01 350208 ---- aw-c: \ windows \ AppPatch \ AppPatch64 \ AcLayers.dll
16/10/2012 07:39. 10/12/2012 10:01 561664 ---- aw-c: \ windows \ AppPatch \ AcLayers.dll
10/04/2012 16:40. 12/12/2012 9:25 44032 ---- aw-c: \ windows \ AppPatch \ acwow64.dll
09/28/2012 14:37. 09/28/2012 14:37 221696 ---- aw-c: \ windows \ system32 \ clinfo.exe
09/28/2012 14:36. 09/28/2012 14:36 75776 ---- aw-c: \ windows \ system32 \ OpenVideo64.dll
09/28/2012 14:36. 09/28/2012 14:36 65536 ---- aw-c: \ windows \ SysWOW64 \ OpenVideo.dll
09/28/2012 14:36. 09/28/2012 14:36 63488 ---- aw-c: \ windows \ system32 \ OVDecode64.dll
09/28/2012 14:36. 09/28/2012 14:36 56320 ---- aw-c: \ windows \ SysWOW64 \ OVDecode.dll
09/28/2012 14:36. 09/28/2012 14:36 32635904 ---- aw-c: \ windows \ system32 \ amdocl64.dll
09/28/2012 14:32. 09/28/2012 14:32 27341824 ---- aw-c: \ windows \ SysWOW64 \ amdocl.dll
09/28/2012 14:28. 09/28/2012 14:28 54784 ---- aw-c: \ windows \ system32 \ OpenCL.dll
09/28/2012 14:28. 09/28/2012 14:28 50176 ---- aw-c: \ windows \ SysWOW64 \ OpenCL.dll
09/28/2012 2:23. 09/28/2012 2:23 5557928 ---- aw-c: \ windows \ SysWOW64 \ atiumdag.dll
09/28/2012 2:21. 09/28/2012 2:21 10697216 ---- aw-c: \ windows \ system32 \ drivers \ atikmdag.sys
09/28/2012 2:05. 09/28/2012 2:05 70144 ---- aw-c: \ windows \ system32 \ coinst_9.002.dll
09/28/2012 2:03. 28.09.2012 2:03 163840 ---- aw-c: \ windows \ system32 \ atiapfxx.exe
09/28/2012 2:02. 09/28/2012 2:02 51200 ---- aw-c: \ windows \ system32 \ aticalrt64.dll
09/28/2012 2:02. 09/28/2012 2:02 46080 ---- aw-c: \ windows \ SysWOW64 \ aticalrt.dll
09/28/2012 2:02. 09/28/2012 2:02 44544 ---- aw-c: \ windows \ system32 \ aticalcl64.dll
09/28/2012 2:02. 09/28/2012 2:02 44032 ---- aw-c: \ windows \ SysWOW64 \ aticalcl.dll
09/28/2012 2:02. 09/28/2012 2:02 16082432 ---- aw-c: \ windows \ system32 \ aticaldd64.dll
09/28/2012 1:59. 09/28/2012 1:59 23825920 ---- aw-c: \ windows \ system32 \ atio6axx.dll
09/28/2012 1:57. 09/28/2012 1:57 13703168 ---- aw-c: \ windows \ SysWOW64 \ aticaldd.dll
09/28/2012 1:43. 28.09.2012 1:43 935424 ---- aw-c: \ windows \ SysWOW64 \ aticfx32.dll
09/28/2012 1:41. 09/28/2012 1:41 1120768 ---- aw-c: \ windows \ system32 \ aticfx64.dll
09/28/2012 1:41. 09/28/2012 1:41 19624960 ---- aw-c: \ windows \ SysWOW64 \ atioglxx.dll
09/28/2012 1:39. 09/28/2012 1:39 6536192 ---- aw-c: \ windows \ SysWOW64 \ atidxx32.dll
09/28/2012 1:39. 28.09.2012 1:39 442368 ---- aw-c: \ windows \ system32 \ atidemgy.dll
09/28/2012 1:39. 28.09.2012 1:39 538112 ---- aw-c: \ windows \ system32 \ atieclxx.exe
09/28/2012 1:38. 28.09.2012 1:38 239616 ---- aw-c: \ windows \ system32 \ atiesrxx.exe
09/28/2012 1:36. 28.09.2012 1:36 120320 ---- aw-c: \ windows \ system32 \ atitmm64.dll
09/28/2012 1:36. 09/28/2012 1:36 21504 ---- aw-c: \ windows \ system32 \ atimuixx.dll
09/28/2012 1:36. 09/28/2012 1:36 59392 ---- aw-c: \ windows \ system32 \ atiedu64.dll
09/28/2012 1:36. 09/28/2012 1:36 43520 ---- aw-c: \ windows \ SysWOW64 \ ati2edxx.dll
09/28/2012 01:31. 09/28/2012 1:31 3127296 ---- aw-c: \ windows \ system32 \ atiumd6a.dll
09/28/2012 01:25. 09/28/2012 1:25 6704640 ---- aw-c: \ windows \ system32 \ atiumd64.dll
09/28/2012 1:22. 09/28/2012 1:22 7167488 ---- aw-c: \ windows \ system32 \ atidxx64.dll
09/28/2012 1:22. 09/28/2012 1:22 2691584 ---- aw-c: \ windows \ SysWOW64 \ atiumdva.dll
09/28/2012 1:13. 28.09.2012 1:13 595456 ---- aw-c: \ windows \ system32 \ atiadlxx.dll
09/28/2012 1:13. 28.09.2012 1:13 405504 ---- aw-c: \ windows \ SysWOW64 \ atiadlxy.dll
09/28/2012 1:13. 09/28/2012 1:13 17920 ---- aw-c: \ windows \ system32 \ atig6pxx.dll
09/28/2012 1:13. 09/28/2012 1:13 14848 ---- aw-c: \ windows \ SysWOW64 \ atiglpxx.dll
09/28/2012 1:13. 09/28/2012 1:13 14848 ---- aw-c: \ windows \ system32 \ atiglpxx.dll
09/28/2012 1:13. 09/28/2012 1:13 41984 ---- aw-c: \ windows \ system32 \ atig6txx.dll
09/28/2012 1:13. 09/28/2012 1:13 33280 ---- aw-c: \ windows \ SysWOW64 \ atigktxx.dll
09/28/2012 1:12. 09/28/2012 1:12 56320 ---- aw-c: \ windows \ system32 \ atimpc64.dll
09/28/2012 1:12. 09/28/2012 1:12 56320 ---- aw-c: \ windows \ system32 \ amdpcom64.dll
09/28/2012 1:12. 28.09.2012 1:12 460288 ---- aw-c: \ windows \ system32 \ drivers \ atikmpag.sys
09/28/2012 1:12. 09/28/2012 1:12 56832 ---- aw-c: \ windows \ SysWOW64 \ atimpc32.dll
09/28/2012 1:12. 09/28/2012 1:12 56832 ---- aw-c: \ windows \ SysWOW64 \ amdpcom32.dll
09/28/2012 01:11. 28.09.2012 1:11 129536 ---- aw-c: \ windows \ system32 \ atiuxp64.dll
09/28/2012 01:11. 28.09.2012 1:11 109568 ---- aw-c: \ windows \ SysWOW64 \ atiuxpag.dll
09/28/2012 01:11. 28.09.2012 1:11 103424 ---- aw-c: \ windows \ system32 \ atiu9p64.dll
09/28/2012 01:10. 09/28/2012 1:10 82944 ---- aw-c: \ windows \ SysWOW64 \ atiu9pag.dll
09/28/2012 1:09. 09/28/2012 1:09 53248 ---- aw-c: \ windows \ system32 \ drivers \ ati2erec.dll
.
.
((((((((((((((((((((((((((((((((((Reg Loading Points)))))))))))) )))))))))))))))))))))))))))))))))
.
.
* Note * empty entries and legitimate underlying data are not displayed.
REGEDIT4
.
[HKEY_CURRENT_USER \ SOFTWARE \ Microsoft \ Windows \ CurrentVersion \ Run]
"F.lux" = "c: \ users \ FNJ \ Local Settings \ Apps \ F.lux \ flux.exe" [29/08/2009 966656]
.
[HKEY_LOCAL_MACHINE \ SOFTWARE \ Wow6432Node \ Microsoft \ Windows \ CurrentVersion \ Run]
"StartCCC" = "c: \ program files (x86) \ ATI Technologies \ ATI.ACE \ Core-Static \ CLIStart.exe" [09/28/2012 642728]
"NUSB3MON" = "c: \ program files (x86) \ Renesas Electronics \ USB 3.0 Host Controller Driver \ Application \ nusb3mon.exe" [11/17/2010 113288]
"SunJavaUpdateSched" = "c: \ program files (x86) \ Common Files \ Java \ Java Update \ jusched.exe" [07/03/2012 252848]
.
[HKEY_LOCAL_MACHINE \ software \ microsoft \ windows \ CurrentVersion \ policies \ system]
"ConsentPromptBehaviorUser" = 3 (0x3)
"EnableUIADesktopToggle" = 0 (0x0)
.
[HKEY_LOCAL_MACHINE \ SYSTEM \ CurrentControlSet \ Control \ SafeBoot \ Minimal \ MsMpSvc]
@ = "Service "
.
R2 AxAutoMntSrv; Alcohol Virtual Drive Auto-mount Service c: \ program files (x86) \ Alcohol Soft \ Alcohol 52 \ AxAutoMntSrv.exe [01/05/2012 75624]
Clr_optimization_v4.0.30319_64 R2, Microsoft. NET Framework NGEN v4.0.30319_X64 c: \ windows \ Microsoft.NET \ Framework64 \ v4.0.30319 \ mscorsvw.exe [18/03/2010 138576]
R3 NisDrv; Microsoft Network Inspection System; c: \ windows \ system32 \ DRIVERS \ NisDrvWFP.sys [08/30/2012 128456]
R3 NisSrv; Microsoft Network Inspection c: \ program files \ Microsoft Security Client \ NisSrv.exe [12/09/2012 368896]
R3 PSI; PSI c: \ windows \ system32 \ DRIVERS \ psi_mf.sys [09/01/2010 17976]
R3 RdpVideoMiniport; Remote Desktop Video Miniport Driver c: \ windows \ system32 \ drivers \ rdpvideominiport.sys [08/23/2012 19456]
R3 Secunia PSI Agent; Secunia PSI Agent c: \ program files (x86) \ Secunia \ PSI \ PSIA.exe [26/11/2012 1225312]
R3 TsUsbFlt; TsUsbFlt c: \ windows \ system32 \ drivers \ tsusbflt.sys [08/23/2012 57856]
WatAdminSvc R3, Windows Activation Technologies Service c: \ windows \ system32 \ Wat \ WatAdminSvc.exe [10/12/2012 1255736]
R3 WinRing0_1_2_0; WinRing0_1_2_0 c: \ program files (x86) \ Razer \ Razer Game Booster \ Driver \ WinRing0x64.sys [17/09/2012 14544]
S0 SPTD; SPTD c: \ windows \ \ SystemRoot \ System32 \ Drivers \ sptd.sys [x]
S2 AMD External Events Utility, AMD External Events Utility; c: \ windows \ system32 \ atiesrxx.exe [09/28/2012 239616]
S2 AMD FUEL Service; AMD FUEL Service; c: \ program files \ ATI Technologies \ ATI.ACE \ Fuel \ Fuel.Service.exe [28/09/2012 361984]
S2 AODDriver4.2; AODDriver4.2 c: \ program files \ ATI Technologies \ ATI.ACE \ Fuel \ amd64 \ AODDriver2.sys [04/09/2012 57472]
S2 MBAMService; MBAMService c: \ program files (x86) \ Malwarebytes' Anti-Malware \ mbamservice.exe [09/29/2012 676936]
AtiHDAudioService S3, AMD Function Driver for HD Audio Service c: \ windows \ system32 \ drivers \ AtihdW76.sys [05/14/2012 96896]
S3 MBAMProtector; MBAMProtector c: \ windows \ system32 \ drivers \ mbam.sys [09/29/2012 25928]
S3 nusb3hub; Renesas Electronics USB 3.0 Hub Driver c: \ windows \ system32 \ DRIVERS \ nusb3hub.sys [11/19/2010 80384]
S3 nusb3xhc; Renesas Electronics USB 3.0 Host Controller Driver c: \ windows \ system32 \ DRIVERS \ nusb3xhc.sys [11/19/2010 181248]
S3 RTL8167, Realtek 8167 NT Driver c: \ windows \ system32 \ DRIVERS \ Rt64win7.sys [01/03/2009 187392]
Usbfilter S3, AMD USB Filter Driver c: \ windows \ system32 \ DRIVERS \ usbfilter.sys [12/22/2009 38456]
.
.
.
Entries X64 --------- -----------
.
.
[HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows \ CurrentVersion \ Run]
"MSC" = "c: \ program files \ Microsoft Security Client \ msseces.exe" [12/09/2012 1289704]
.
------- Supplementary Scan -------
.
uLocal Page = c: \ windows \ system32 \ blank.htm
mLocal Page = c: \ windows \ SysWOW64 \ blank.htm
TCP: DhcpNameServer = 10.0.0.138
FF - ProfilePath - c: \ users \ FNJ \ AppData \ Roaming \ Mozilla \ Firefox \ Profiles \ up9494a3.default \
FF - ExtSQL: 12/19/2012 21:02; {a0d7ccb3-214D-498b-b4aa-0e8fda9a7bf7};
FF - ExtSQL: 12/19/2012 21:02; support@lastpass.com;
.
.
--------------------- Locked keys in the registry ---------------------
.
[HKEY_LOCAL_MACHINE \ SOFTWARE \ Classes \ CLSID \ {73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@ Denied: (A 2) (Everyone)
@ = "FlashBroker "

.
[HKEY_LOCAL_MACHINE \ SOFTWARE \ Classes \ CLSID \ {73C9DFA0-750D-11E1-B0C4-0800200C9A66} \ Elevation]
"Enabled" = dword: 00000001
.
[HKEY_LOCAL_MACHINE \ SOFTWARE \ Classes \ CLSID \ {73C9DFA0-750D-11E1-B0C4-0800200C9A66} \ LocalServer32]
@ = "C: \ \ Windows \ \ system32 \ \ Macromed \ \ Flash \ \ FlashUtil64_11_5_502_110_ActiveX.exe "
.
[HKEY_LOCAL_MACHINE \ SOFTWARE \ Classes \ CLSID \ {73C9DFA0-750D-11E1-B0C4-0800200C9A66} \ TypeLib]
@ = "{FAB3E735-69C7-453B-A446-B6823C6DF1C9} "
.
[HKEY_LOCAL_MACHINE \ SOFTWARE \ Classes \ Interface \ {6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@ Denied: (A 2) (Everyone)
@ = "IFlashBroker5 "
.

@ = "{00020424-0000-0000-C000-000000000046} "
.
[HKEY_LOCAL_MACHINE \ SOFTWARE \ Classes \ Interface \ {6AE38AE0-750C-11E1-B0C4-0800200C9A66} \ TypeLib]
@ = "{FAB3E735-69C7-453B-A446-B6823C6DF1C9} "
"Version" = "1.0 "
.
[HKEY_LOCAL_MACHINE \ SOFTWARE \ Classes \ Wow6432Node \ CLSID \ {73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@ Denied: (A 2) (Everyone)
@ = "FlashBroker "

.

"Enabled" = dword: 00000001
.

@ = "C: \ \ Windows \ \ SysWOW64 \ \ Macromed \ \ Flash \ \ FlashUtil32_11_5_502_110_ActiveX.exe "
.

@ = "{FAB3E735-69C7-453B-A446-B6823C6DF1C9} "
.
[HKEY_LOCAL_MACHINE \ SOFTWARE \ Classes \ Wow6432Node \ CLSID \ {D27CDB6E-AE6D-11cf-96B8-444553540000}]
@ Denied: (A 2) (Everyone)
@ = "Shockwave Flash Object "
.

@ = "C: \ \ Windows \ \ SysWOW64 \ \ Macromed \ \ Flash \ \ Flash32_11_5_502_110.ocx "
"ThreadingModel" = "Apartment "
.

@ = "0 "
.

@ = "ShockwaveFlash.ShockwaveFlash.11 "
.

@ = "C: \ \ Windows \ \ SysWOW64 \ \ Macromed \ \ Flash \ \ Flash32_11_5_502_110.ocx, 1 "
.

@ = "{D27CDB6B-AE6D-11cf-96B8-444553540000} "
.

@ = "1.0 "
.

@ = "ShockwaveFlash.ShockwaveFlash "
.
[HKEY_LOCAL_MACHINE \ SOFTWARE \ Classes \ Wow6432Node \ CLSID \ {D27CDB70-AE6D-11cf-96B8-444553540000}]
@ Denied: (A 2) (Everyone)
@ = "Macromedia Flash Factory Object "
.

@ = "C: \ \ Windows \ \ SysWOW64 \ \ Macromed \ \ Flash \ \ Flash32_11_5_502_110.ocx "
"ThreadingModel" = "Apartment "
.

@ = "FlashFactory.FlashFactory.1 "
.

@ = "C: \ \ Windows \ \ SysWOW64 \ \ Macromed \ \ Flash \ \ Flash32_11_5_502_110.ocx, 1 "
.

@ = "{D27CDB6B-AE6D-11cf-96B8-444553540000} "
.

@ = "1.0 "
.

@ = "FlashFactory.FlashFactory "
.
[HKEY_LOCAL_MACHINE \ SOFTWARE \ Classes \ Wow6432Node \ Interface \ {6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@ Denied: (A 2) (Everyone)
@ = "IFlashBroker5 "
.

@ = "{00020424-0000-0000-C000-000000000046} "
.

@ = "{FAB3E735-69C7-453B-A446-B6823C6DF1C9} "
"Version" = "1.0 "
.
[HKEY_LOCAL_MACHINE \ SYSTEM \ ControlSet001 \ Control \ PCW \ Security]
@ Denied: (Full) (Everyone)
.
Total time: 20/12/2012 9:36:11
ComboFix-quarantined-files.txt 20/12/2012 8:36
.
Before starting: free bytes: 171696226304
After running: free bytes: 171571834880
.
- End Of File - F70268C424E3E6B31B884668866D96C2

Can I uninstall the combofix now? As in running it with /uninstall.

FNj · 2012/12/20

Sorry for double post. I thought the first one didn't go through.

broni · 2012/12/20

Please don't translate anything.
Post original logs.

Combofix log looks fine.

Please download AdwCleaner by Xplode onto your desktop.

Close all open programs and internet browsers.

Double click on adwcleaner.exe to run the tool.

Click on Delete.

Confirm each time with Ok.

Your computer will be rebooted automatically. A text file will open after the restart.

Please post the contents of that logfile with your next reply.

You can find the logfile at C:\AdwCleaner[S1].txt as well.

Next...

Double click on adwcleaner.exe to run the tool.

Click on Uninstall.

Confirm with yes.

====================================

Download OTL to your Desktop.
Alternate download: http://www.itxassociates.com/OT-Tools/OTL.exe

Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.

Click the Scan All Users checkbox.

Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.

When the scan completes, it will open two notepad windows: OTL.txt and Extras.txt. These are saved in the same location as OTL.

Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post them back here.

broni · 2012/12/25

Still with me?

broni · 2012/12/30

This topic is marked as abandoned and closed due to inactivity.

This member will NOT be eligible to receive any more help in malware removal forum.

Log in or Sign up

Inactive-A ISeekDeal.dll paranoia

FNj Inactive Thread Starter

Admin. Administrator Administrator Staff

FNj Inactive Thread Starter

Admin. Administrator Administrator Staff

PeteC SuperGeek Staff

FNj Inactive Thread Starter

FNj Inactive Thread Starter

FNj Inactive Thread Starter

broni Moderator Malware Analyst

FNj Inactive Thread Starter

FNj Inactive Thread Starter

broni Moderator Malware Analyst

FNj Inactive Thread Starter

FNj Inactive Thread Starter

FNj Inactive Thread Starter

broni Moderator Malware Analyst

broni Moderator Malware Analyst

broni Moderator Malware Analyst

Share This Page

Log in or Sign up

Inactive-A ISeekDeal.dll paranoia

FNj Inactive Thread Starter

Admin. Administrator Administrator Staff

FNj Inactive Thread Starter

Admin. Administrator Administrator Staff

PeteC SuperGeek Staff

FNj Inactive Thread Starter

FNj Inactive Thread Starter

FNj Inactive Thread Starter

broni Moderator Malware Analyst

FNj Inactive Thread Starter

FNj Inactive Thread Starter

broni Moderator Malware Analyst

FNj Inactive Thread Starter

FNj Inactive Thread Starter

FNj Inactive Thread Starter

broni Moderator Malware Analyst

broni Moderator Malware Analyst

broni Moderator Malware Analyst

Share This Page

Useful Searches