Solved Google redirect virus

[Resolved] Google redirect virus

Hi.

My computer has been infected with the infamous "goingonearth" Google redirect virus. Firefox was the first one to get hit. I tried to get rid of the virus, failed and switched to Chrome. Now it's totally screwing up the Chrome searches as well.

I have done scans with (at least) the following programs: Malwarebytes Anti-Malware, Ad-Aware, Spybot, TDSSKIller, StopZillam, UnHackMe. In addition, I have F-Secure running constantly. These programs detected and removed other types of malware, but the redirect virus is still there.

The virus probably originated when I tried installing a program that was, in retrospect, somewhat dubious. Still, I had no idea that something could infect my computer this bad.

I would greatly appreciate some expert help on this, and I'm willing to do a coordinated step-by-step clean up of my system.

I'm running Windows 7.

Thanks!

 

Hello and thanks for the reply.

Firewall is on. Avast did not find anything unusual.

Here are the logs.

Malwarebytes

Malwarebytes' Anti-Malware 1.51.1.1800
www.malwarebytes.org

Database version: 7506

Windows 6.1.7601 Service Pack 1
Internet Explorer 9.0.8112.16421

19.8.2011 15:13:24
mbam-log-2011-08-19 (15-13-24).txt

Scan type: Quick scan
Objects scanned: 174091
Time elapsed: 6 minute(s), 15 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)





GMER


GMER 1.0.15.15641 - http://www.gmer.net
Rootkit scan 2011-08-19 15:45:09
Windows 6.1.7601 Service Pack 1
Running: 1h6qyp3e.exe


---- Services - GMER 1.0.15 ----

Service C:\Program (*** hidden *** ) [AUTO] DigiRefresh <-- ROOTKIT !!!
Service C:\Program (*** hidden *** ) [AUTO] gupdate <-- ROOTKIT !!!
Service C:\Program (*** hidden *** ) [MANUAL] gupdatem <-- ROOTKIT !!!
Service C:\Program (*** hidden *** ) [MANUAL] Steam Client Service <-- ROOTKIT !!!

---- EOF - GMER 1.0.15 ----

 

More logs:


MBRCheck


aswMBR version 0.9.8.978 Copyright(c) 2011 AVAST Software
Run date: 2011-08-19 15:48:41
-----------------------------
15:48:41.648 OS Version: Windows x64 6.1.7601 Service Pack 1
15:48:41.649 Number of processors: 2 586 0x170A
15:48:41.650 ComputerName: TUURE-PC UserName: Tuure
15:48:48.644 Initialize success
15:48:49.280 AVAST engine defs: 11081801
15:48:53.696 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP2T0L0-2
15:48:53.698 Disk 0 Vendor: ST3500418AS HP34 Size: 476940MB BusType: 3
15:48:55.725 Disk 0 MBR read successfully
15:48:55.729 Disk 0 MBR scan
15:48:55.750 Disk 0 unknown MBR code
15:48:55.755 Service scanning
15:48:58.491 Modules scanning
15:48:58.497 Disk 0 trace - called modules:
15:48:58.524 ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys ataport.SYS intelide.sys PCIIDEX.SYS hal.dll atapi.sys
15:48:58.529 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa80027c5060]
15:48:58.534 3 CLASSPNP.SYS[fffff8800199c43f] -> nt!IofCallDriver -> [0xfffffa800267e520]
15:48:58.542 5 ACPI.sys[fffff88000e1a7a1] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP2T0L0-2[0xfffffa800266f060]
15:49:01.222 AVAST engine scan C:\Windows
15:49:04.869 AVAST engine scan C:\Windows\system32
15:51:46.609 AVAST engine scan C:\Windows\system32\drivers
15:52:10.017 AVAST engine scan C:\Users\Tuure
16:08:52.498 AVAST engine scan C:\ProgramData
16:11:18.987 Scan finished successfully
17:28:35.851 Disk 0 MBR has been saved successfully to "C:\Users\Tuure\Documents\MBR.dat "
17:28:35.859 The log file has been saved successfully to "C:\Users\Tuure\Documents\aswMBR.txt "



DDS

.
DDS (Ver_2011-06-23.01) - NTFSAMD64
Internet Explorer: 9.0.8112.16421 BrowserJavaVersion: 1.6.0_26
Run by Tuure at 17:39:34 on 2011-08-19
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.358.1033.18.2047.537 [GMT 3:00]
.
AV: F-Secure Client Security 9.01 *Enabled/Updated* {15414183-282E-D62C-CA37-EF24860A2F17}
SP: F-Secure Client Security 9.01 *Enabled/Updated* {AE20A067-0E14-D9A2-F087-D456FD8D65AA}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
FW: F-Secure Client Security 9.01 *Enabled* {2D7AC0A6-6241-D774-E168-461178D9686C}
.
============== Running Processes ===============
.
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Program Files (x86)\Emsisoft Anti-Malware\a2service.exe
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\system32\atiesrxx.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\atieclxx.exe
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\system32\Dwm.exe
C:\Program Files (x86)\Lavasoft\Ad-Aware\AAWService.exe
C:\Windows\Explorer.EXE
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\system32\taskhost.exe
C:\Windows\system32\rundll32.exe
C:\Windows\SysWOW64\rundll32.exe
C:\Windows\SysWOW64\svchost.exe -k Akamai
C:\xampp\apache\bin\httpd.exe
C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files (x86)\Bonjour\mDNSResponder.exe
C:\Program Files (x86)\Digidesign\Drivers\MMERefresh.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs
C:\Program Files (x86)\F-Secure\Anti-Virus\fsgk32st.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Program Files (x86)\F-Secure\Anti-Virus\FSGK32.EXE
C:\Program Files (x86)\F-Secure\Common\FSMA32.EXE
c:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe
C:\Program Files (x86)\F-Secure\Common\FSHDLL32.EXE
C:\Program Files (x86)\F-Secure\Common\FSHDLL64.EXE
C:\xampp\apache\bin\httpd.exe
C:\xampp\mysql\bin\mysqld.exe
C:\Program Files\CyberLink\Shared files\RichVideo64.exe
C:\Windows\system32\svchost.exe -k imgsvc
C:\Program Files (x86)\Voddler\service\voddler.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files (x86)\F-Secure\FWES\Program\fsdfwd.exe
C:\Program Files (x86)\F-Secure\ORSP Client\fsorsp.exe
C:\Program Files (x86)\F-Secure\Common\FNRB32.EXE
C:\Windows\system32\wbem\wmiprvse.exe
C:\Program Files (x86)\F-Secure\Common\FIH32.EXE
C:\Windows\System32\rundll32.exe
C:\Windows\System32\M-AudioTaskBarIcon.exe
C:\Users\Tuure\AppData\Roaming\Google\Google Talk\googletalk.exe
C:\Program Files (x86)\Hewlett-Packard\HP Odometer\hpsysdrv.exe
C:\Program Files (x86)\hp\HP Software Update\hpwuschd2.exe
C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe
C:\Program Files (x86)\F-Secure\common\FSM32.EXE
C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin
C:\Program Files (x86)\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files (x86)\Voddler\service\VNetManager.exe
C:\Program Files (x86)\F-Secure\Anti-Virus\fssm32.exe
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
C:\Program Files (x86)\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files (x86)\iTunes\iTunesHelper.exe
C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe
C:\Program Files (x86)\Lavasoft\Ad-Aware\AAWTray.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\WUDFHost.exe
C:\Program Files (x86)\F-Secure\Anti-Virus\fsav32.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Windows\System32\svchost.exe -k LocalServicePeerNet
C:\Program Files (x86)\Lavasoft\Ad-Aware\AWSC.exe
C:\Program Files (x86)\Lavasoft\Ad-Aware\AWSC.exe
C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
C:\Program Files\AVAST Software\Avast\AvastSvc.exe
C:\Program Files\AVAST Software\Avast\AvastUI.exe
C:\Program Files (x86)\Lavasoft\Ad-Aware\AWSC.exe
C:\Program Files (x86)\Lavasoft\Ad-Aware\AWSC.exe
C:\Program Files (x86)\Lavasoft\Ad-Aware\AWSC.exe
C:\Program Files (x86)\Lavasoft\Ad-Aware\AWSC.exe
C:\Users\Tuure\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Tuure\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Tuure\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Tuure\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Tuure\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Tuure\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Windows\system32\notepad.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\conhost.exe
C:\Windows\SysWOW64\cscript.exe
C:\Windows\system32\wbem\wmiprvse.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = https://plus.google.com/up/start/?continue=https://plus.google.com/&type=st&gpcaz=9ee2dfee&hl=en
mDefault_Page_URL = hxxp://www.bing.com
mStart Page = hxxp://www.bing.com
uInternet Settings,ProxyOverride = *.local
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - C:\Program Files (x86)\Spybot - Search & Destroy\SDHelper.dll
BHO: avast! WebRep: {8e5e2654-ad2d-48bf-ac2d-d17f00898d06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
BHO: Skype Browser Helper: {ae805869-2e5c-4ed4-8f7b-f1f7851a4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
BHO: Browsing Protection Class: {c6867eb7-8350-4856-877f-93cf8ae3dc9c} - C:\Program Files (x86)\F-Secure\NRS\iescript\baselitmus.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
TB: Browsing Protection Toolbar: {265eee8e-3228-44d3-aea5-f7fdf5860049} - C:\Program Files (x86)\F-Secure\NRS\iescript\baselitmus.dll
TB: avast! WebRep: {8e5e2654-ad2d-48bf-ac2d-d17f00898d06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
uRun: [googletalk] C:\Users\Tuure\AppData\Roaming\Google\Google Talk\googletalk.exe /autostart
uRun: [SpybotSD TeaTimer] C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe
uRun: [Google Update] "C:\Users\Tuure\AppData\Local\Google\Update\GoogleUpdate.exe" /c
uRun: [Steam] "C:\Program Files (x86)\Steam\Steam.exe" -silent
mRun: [hpsysdrv] c:\program files (x86)\hewlett-packard\HP odometer\hpsysdrv.exe
mRun: [HP Software Update] c:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe
mRun: [<NO NAME>]
mRun: [NortonOnlineBackupReminder] "C:\Program Files (x86)\Symantec\Norton Online Backup\Activation\NobuActivation.exe" UNATTENDED
mRun: [Easybits Recovery] C:\Program Files (x86)\EasyBits For Kids\ezRecover.exe
mRun: [F-Secure Manager] "C:\Program Files (x86)\F-Secure\Common\FSM32.EXE" /splash
mRun: [F-Secure TNB] "C:\Program Files (x86)\F-Secure\FSGUI\TNBUtil.exe" /CHECKALL /WAITFORSW
mRun: [DigidesignMMERefresh] C:\Program Files (x86)\Digidesign\Drivers\MMERefresh.exe
mRun: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
mRun: [Google Desktop Search] "C:\Program Files (x86)\Google\Google Desktop Search\GoogleDesktop.exe" /startup
mRun: [VoddlerNet Manager] C:\Program Files (x86)\Voddler\service\VNetManager.exe
mRun: [AdobeCS5ServiceManager] "C:\Program Files (x86)\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe" -launchedbylogin
mRun: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe "
mRun: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe "
mRun: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe "
mRun: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe "
mRun: [Malwarebytes' Anti-Malware] "C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray
mRun: [DivXUpdate] "C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW
mRun: [avast] "C:\Program Files\AVAST Software\Avast\avastUI.exe" /nogui
StartupFolder: C:\Users\Tuure\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\OPENOF~1.LNK - C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe
mPolicies-system: ConsentPromptBehaviorAdmin = 5 (0x5)
mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files (x86)\Spybot - Search & Destroy\SDHelper.dll
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab
TCP: DhcpNameServer = 192.89.123.231 193.210.19.190
TCP: Interfaces\{3AD79ADB-4FD5-431E-AFEA-D2AB7646BFB8} : DhcpNameServer = 192.89.123.231 193.210.19.190
TCP: Interfaces\{3AD79ADB-4FD5-431E-AFEA-D2AB7646BFB8}\14355535 : DhcpNameServer = 192.168.1.1
TCP: Interfaces\{3AD79ADB-4FD5-431E-AFEA-D2AB7646BFB8}\4505D2C494E4B4F5441313247324 : DhcpNameServer = 192.89.123.231 193.210.19.190
TCP: Interfaces\{3AD79ADB-4FD5-431E-AFEA-D2AB7646BFB8}\75C414E4D21405 : DhcpNameServer = 192.168.0.254
TCP: Interfaces\{3AD79ADB-4FD5-431E-AFEA-D2AB7646BFB8}\A5978554C4 : DhcpNameServer = 192.168.1.1
TCP: Interfaces\{3AD79ADB-4FD5-431E-AFEA-D2AB7646BFB8}\B4161647F6071696B6B616 : DhcpNameServer = 192.168.1.1
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
AppInit_DLLs: C:\PROGRA~2\Google\GOOGLE~2\GO36F4~1.DLL
SEH: EasyBits ShellExecute Hook: {e54729e8-bb3d-4270-9d49-7389ea579090} - C:\Windows\SysWow64\EZUPBH~1.DLL
BHO-X64: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
BHO-X64: AcroIEHelperStub - No File
BHO-X64: Spybot-S&D IE Protection: {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files (x86)\Spybot - Search & Destroy\SDHelper.dll
BHO-X64: avast! WebRep: {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
BHO-X64: Windows Live Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
BHO-X64: Skype Browser Helper: {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
BHO-X64: SkypeIEPluginBHO - No File
BHO-X64: Browsing Protection Class: {C6867EB7-8350-4856-877F-93CF8AE3DC9C} - C:\Program Files (x86)\F-Secure\NRS\iescript\baselitmus.dll
BHO-X64: LitmusBHO - No File
BHO-X64: Java(tm) Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
TB-X64: Browsing Protection Toolbar: {265EEE8E-3228-44D3-AEA5-F7FDF5860049} - C:\Program Files (x86)\F-Secure\NRS\iescript\baselitmus.dll
TB-X64: avast! WebRep: {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
mRun-x64: [hpsysdrv] c:\program files (x86)\hewlett-packard\HP odometer\hpsysdrv.exe
mRun-x64: [HP Software Update] c:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe
mRun-x64: [(Default)]
mRun-x64: [NortonOnlineBackupReminder] "C:\Program Files (x86)\Symantec\Norton Online Backup\Activation\NobuActivation.exe" UNATTENDED
mRun-x64: [Easybits Recovery] C:\Program Files (x86)\EasyBits For Kids\ezRecover.exe
mRun-x64: [F-Secure Manager] "C:\Program Files (x86)\F-Secure\Common\FSM32.EXE" /splash
mRun-x64: [F-Secure TNB] "C:\Program Files (x86)\F-Secure\FSGUI\TNBUtil.exe" /CHECKALL /WAITFORSW
mRun-x64: [DigidesignMMERefresh] C:\Program Files (x86)\Digidesign\Drivers\MMERefresh.exe
mRun-x64: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
mRun-x64: [Google Desktop Search] "C:\Program Files (x86)\Google\Google Desktop Search\GoogleDesktop.exe" /startup
mRun-x64: [VoddlerNet Manager] C:\Program Files (x86)\Voddler\service\VNetManager.exe
mRun-x64: [AdobeCS5ServiceManager] "C:\Program Files (x86)\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe" -launchedbylogin
mRun-x64: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe "
mRun-x64: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe "
mRun-x64: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe "
mRun-x64: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe "
mRun-x64: [Malwarebytes' Anti-Malware] "C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray
mRun-x64: [DivXUpdate] "C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW
mRun-x64: [avast] "C:\Program Files\AVAST Software\Avast\avastUI.exe" /nogui
AppInit_DLLs-X64: C:\PROGRA~2\Google\GOOGLE~2\GO36F4~1.DLL
SEH-X64: EasyBits ShellExecute Hook: {E54729E8-BB3D-4270-9D49-7389EA579090} - C:\Windows\SysWow64\EZUPBH~1.DLL
.
================= FIREFOX ===================
.
FF - ProfilePath - C:\Users\Tuure\AppData\Roaming\Mozilla\Firefox\Profiles\nehk9mos.default\
FF - prefs.js: browser.startup.homepage - hxxps://plus.google.com/?hl=en
FF - prefs.js: network.proxy.ftp - 209.159.147.196
FF - prefs.js: network.proxy.ftp_port - 80
FF - prefs.js: network.proxy.gopher - 209.159.147.196
FF - prefs.js: network.proxy.gopher_port - 80
FF - prefs.js: network.proxy.http - 209.159.147.196
FF - prefs.js: network.proxy.http_port - 80
FF - prefs.js: network.proxy.socks - 209.159.147.196
FF - prefs.js: network.proxy.socks_port - 80
FF - prefs.js: network.proxy.ssl - 209.159.147.196
FF - prefs.js: network.proxy.ssl_port - 80
FF - prefs.js: network.proxy.type - 0
FF - component: C:\Program Files (x86)\F-Secure\NRS\litmus-ff@f-secure.com\components\litmus-ff.dll
FF - plugin: C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll
FF - plugin: C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll
FF - plugin: C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll
FF - plugin: C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll
FF - plugin: C:\Program Files (x86)\Google\Update\1.3.21.65\npGoogleUpdate3.dll
FF - plugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: c:\Program Files (x86)\Microsoft Silverlight\4.0.60531.0\npctrlui.dll
FF - plugin: C:\Program Files (x86)\Mozilla Firefox\plugins\npdeployJava1.dll
FF - plugin: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll
FF - plugin: C:\Program Files (x86)\Voddler\plugin\npvoddler.dll
FF - plugin: C:\Program Files\Microsoft\Web Platform Installer\NPWPIDetector.dll
FF - plugin: C:\Users\Tuure\AppData\Local\Google\Update\1.3.21.65\npGoogleUpdate3.dll
FF - plugin: C:\Users\Tuure\AppData\Roaming\Mozilla\Firefox\Profiles\nehk9mos.default\extensions\{140af0fa-680f-45fc-8a25-8fde5f5e0844}\plugins\npGSRemotePlugin.dll
FF - plugin: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll
.
============= SERVICES / DRIVERS ===============
.
R0 FixTDSS;TDSS Fixtool driver;C:\Windows\system32\drivers\FixTDSS.sys --> C:\Windows\system32\drivers\FixTDSS.sys [?]
R0 Lbd;Lbd;C:\Windows\system32\DRIVERS\Lbd.sys --> C:\Windows\system32\DRIVERS\Lbd.sys [?]
R1 a2injectiondriver;a2injectiondriver;C:\Program Files (x86)\Emsisoft Anti-Malware\a2dix64.sys [2011-8-4 48216]
R1 a2util;a-squared Malware-IDS utility driver;C:\Program Files (x86)\Emsisoft Anti-Malware\a2util64.sys [2011-8-4 14720]
R1 aswSP;aswSP;C:\Windows\system32\drivers\aswSP.sys --> C:\Windows\system32\drivers\aswSP.sys [?]
R1 F-Secure HIPS;F-Secure HIPS Driver;C:\Program Files (x86)\F-Secure\HIPS\drivers\fshs.sys [2010-5-26 58000]
R1 FSES;F-Secure Email Scanning Driver;C:\Windows\system32\drivers\fses.sys --> C:\Windows\system32\drivers\fses.sys [?]
R1 FSFW;F-Secure Firewall Driver;C:\Windows\system32\drivers\fsdfw.sys --> C:\Windows\system32\drivers\fsdfw.sys [?]
R1 fsvista;F-Secure Vista Support Driver;C:\Program Files (x86)\F-Secure\Anti-Virus\minifilter\fsvista.sys [2010-5-26 14904]
R1 vwififlt;Virtual WiFi Filter Driver;C:\Windows\system32\DRIVERS\vwififlt.sys --> C:\Windows\system32\DRIVERS\vwififlt.sys [?]
R2 a2AntiMalware;Emsisoft Anti-Malware 5.1 - Service;C:\Program Files (x86)\Emsisoft Anti-Malware\a2service.exe [2011-8-4 3029208]
R2 Akamai;Akamai NetSession Interface;C:\Windows\System32\svchost.exe -k Akamai [2009-7-14 20992]
R2 AMD External Events Utility;AMD External Events Utility;C:\Windows\system32\atiesrxx.exe --> C:\Windows\system32\atiesrxx.exe [?]
R2 Apache2.2;Apache2.2;C:\xampp\apache\bin\httpd.exe [2010-11-26 29416]
R2 aswFsBlk;aswFsBlk;C:\Windows\system32\drivers\aswFsBlk.sys --> C:\Windows\system32\drivers\aswFsBlk.sys [?]
R2 aswMonFlt;aswMonFlt;\??\C:\Windows\system32\drivers\aswMonFlt.sys --> C:\Windows\system32\drivers\aswMonFlt.sys [?]
R2 avast! Antivirus;avast! Antivirus;C:\Program Files\AVAST Software\Avast\AvastSvc.exe [2011-8-19 42184]
R2 ezSharedSvc;Easybits Shared Services for Windows;C:\Windows\system32\svchost.exe -k netsvcs [2009-7-14 20992]
R2 F-Secure Gatekeeper Handler Starter;FSGKHS;C:\Program Files (x86)\F-Secure\Anti-Virus\fsgk32st.exe [2010-5-26 219824]
R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;C:\Program Files (x86)\Lavasoft\Ad-Aware\AAWService.exe [2011-7-21 2151640]
R2 MBAMService;MBAMService;C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2011-8-6 366640]
R2 RichVideo64;Cyberlink RichVideo64 Service(CRVS);C:\Program Files\CyberLink\Shared files\RichVideo64.exe [2011-7-11 386344]
R2 VoddlerNet;VoddlerNet;C:\Program Files (x86)\Voddler\service\voddler.exe [2011-2-9 1039640]
R3 a2acc;a2acc;C:\Program Files (x86)\Emsisoft Anti-Malware\a2accx64.sys [2011-8-4 85800]
R3 F-Secure Gatekeeper;F-Secure Gatekeeper;C:\Program Files (x86)\F-Secure\Anti-Virus\minifilter\fsgk.sys [2010-5-26 198824]
R3 F-Secure Network Request Broker;F-Secure Network Request Broker;C:\Program Files (x86)\F-Secure\common\FNRB32.exe [2010-5-26 166576]
R3 FSORSPClient;F-Secure ORSP Client;C:\Program Files (x86)\F-Secure\ORSP Client\fsorsp.exe [2010-5-26 61088]
R3 Lavasoft Kernexplorer;Lavasoft helper driver;C:\Program Files (x86)\Lavasoft\Ad-Aware\kernexplorer64.sys [2011-7-31 17152]
R3 MBAMProtector;MBAMProtector;\??\C:\Windows\system32\drivers\mbam.sys --> C:\Windows\system32\drivers\mbam.sys [?]
R3 RTL8167;Realtek 8167 NT Driver;C:\Windows\system32\DRIVERS\Rt64win7.sys --> C:\Windows\system32\DRIVERS\Rt64win7.sys [?]
R3 vwifimp;Microsoft Virtual WiFi Miniport Service;C:\Windows\system32\DRIVERS\vwifimp.sys --> C:\Windows\system32\DRIVERS\vwifimp.sys [?]
R3 ysusb64;Yamaha Steinberg USB Audio;C:\Windows\system32\drivers\ysusb64.sys --> C:\Windows\system32\drivers\ysusb64.sys [?]
S1 aswSnx;aswSnx;C:\Windows\system32\drivers\aswSnx.sys --> C:\Windows\system32\drivers\aswSnx.sys [?]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]
S2 gupdate;Google-päivityspalvelu (gupdate);C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2010-10-17 136176]
S2 MsDepSvc;Web Deployment Agent Service;C:\Program Files\IIS\Microsoft Web Deploy\MsDepSvc.exe [2011-4-1 67400]
S3 androidusb;ADB Interface Driver;C:\Windows\system32\Drivers\androidusb.sys --> C:\Windows\system32\Drivers\androidusb.sys [?]
S3 GoogleDesktopManager-051210-111108;Google Desktop Manager 5.9.1005.12335;C:\Program Files (x86)\Google\Google Desktop Search\GoogleDesktop.exe [2011-1-28 30192]
S3 gupdatem;Google Päivitä-palvelu (gupdatem);C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2010-10-17 136176]
S3 MAUSBFASTTRACK;Service for M-Audio FastTrack;C:\Windows\system32\DRIVERS\MAudioFastTrack.sys --> C:\Windows\system32\DRIVERS\MAudioFastTrack.sys [?]
S3 SynUSB64;SynUSB64;C:\Windows\system32\DRIVERS\SynUSB64.sys --> C:\Windows\system32\DRIVERS\SynUSB64.sys [?]
S3 TsUsbFlt;TsUsbFlt;C:\Windows\system32\drivers\tsusbflt.sys --> C:\Windows\system32\drivers\tsusbflt.sys [?]
S3 USBAAPL64;Apple Mobile USB Driver;C:\Windows\system32\Drivers\usbaapl64.sys --> C:\Windows\system32\Drivers\usbaapl64.sys [?]
S3 WatAdminSvc;Windows Activation Technologies Service;C:\Windows\system32\Wat\WatAdminSvc.exe --> C:\Windows\system32\Wat\WatAdminSvc.exe [?]
S3 zgwhsmdm;ZTE WCDMA Handset USB Modem;C:\Windows\system32\DRIVERS\zgwhsmdm.sys --> C:\Windows\system32\DRIVERS\zgwhsmdm.sys [?]
S4 F-Secure Filter;F-Secure File System Filter;C:\Program Files (x86)\F-Secure\Anti-Virus\win2k\fsfilter.sys [2010-5-26 39856]
S4 F-Secure Recognizer;F-Secure File System Recognizer;C:\Program Files (x86)\F-Secure\Anti-Virus\win2k\fsrec.sys [2010-5-26 25264]
.
=============== File Associations ===============
.
inffile=%SystemRoot%\SysWow64\NOTEPAD.EXE %1
VBEFile=%SystemRoot%\SysWow64\WScript.exe "%1" %*
VBSFile=%SystemRoot%\SysWow64\WScript.exe "%1" %*
.
=============== Created Last 30 ================
.
2011-08-19 09:45:23 600920 ----a-w- C:\Windows\System32\drivers\aswSnx.sys
2011-08-19 09:45:21 64856 ----a-w- C:\Windows\System32\drivers\aswMonFlt.sys
2011-08-19 09:44:41 40112 ----a-w- C:\Windows\avastSS.scr
2011-08-19 09:44:02 -------- d-----w- C:\ProgramData\AVAST Software
2011-08-19 09:44:02 -------- d-----w- C:\Program Files\AVAST Software
2011-08-19 09:01:48 27256 ----a-w- C:\Windows\System32\drivers\FixTDSS.sys
2011-08-19 09:01:48 -------- d-----w- C:\Users\Tuure\AppData\Roaming\FixTDSS
2011-08-18 09:49:18 -------- d-----w- C:\Program Files (x86)\Steam
2011-08-17 06:58:32 -------- d-----w- C:\Users\Tuure\AppData\Roaming\Registry Mechanic
2011-08-16 11:59:55 -------- d-----w- C:\Program Files\CCleaner
2011-08-16 09:48:44 2 --shatr- C:\Windows\winstart.bat
2011-08-16 09:32:25 -------- d-----w- C:\ProgramData\STOPzilla!
2011-08-16 09:26:14 -------- d-----w- C:\Program Files (x86)\UnHackMe
2011-08-16 08:24:14 -------- d-----w- C:\Windows\System32\SPReview
2011-08-16 08:23:05 -------- d-----w- C:\Windows\System32\EventProviders
2011-08-16 06:21:16 518144 ----a-w- C:\Windows\SWREG.exe
2011-08-16 06:21:16 256000 ----a-w- C:\Windows\PEV.exe
2011-08-16 06:21:16 208896 ----a-w- C:\Windows\MBR.exe
2011-08-16 06:21:15 98816 ----a-w- C:\Windows\sed.exe
2011-08-16 06:20:41 -------- d-s---w- C:\ComboFix
2011-08-16 06:20:31 -------- d-----w- C:\Users\Tuure\AppData\Roaming\F-Secure
2011-08-15 23:33:39 -------- d-----w- C:\Windows\pss
2011-08-15 12:07:45 31744 ----a-w- C:\Windows\System32\drivers\androidusb.sys
2011-08-15 12:07:45 122624 ----a-w- C:\Windows\System32\drivers\zgwhsnmea.sys
2011-08-15 12:07:45 122624 ----a-w- C:\Windows\System32\drivers\zgwhsmdm.sys
2011-08-15 12:07:45 122624 ----a-w- C:\Windows\System32\drivers\zgwhsdiag.sys
2011-08-15 12:07:41 -------- d---a-w- C:\Users\Tuure\.android
2011-08-15 12:07:32 -------- d-----w- C:\Program Files (x86)\ZTE Smartphone Driver
2011-08-12 08:31:48 96256 ----a-w- C:\Windows\AdbWinApi.dll
2011-08-11 06:50:39 338432 ----a-w- C:\Windows\System32\conhost.exe
2011-08-11 06:48:36 3912576 ----a-w- C:\Windows\SysWow64\ntoskrnl.exe
2011-08-11 06:48:33 5561216 ----a-w- C:\Windows\System32\ntoskrnl.exe
2011-08-11 06:48:32 3967872 ----a-w- C:\Windows\SysWow64\ntkrnlpa.exe
2011-08-06 17:30:40 -------- d-----w- C:\Users\Tuure\AppData\Roaming\Malwarebytes
2011-08-06 17:30:30 41272 ----a-w- C:\Windows\SysWow64\drivers\mbamswissarmy.sys
2011-08-06 17:30:26 -------- d-----w- C:\ProgramData\Malwarebytes
2011-08-06 17:30:22 25912 ----a-w- C:\Windows\System32\drivers\mbam.sys
2011-08-06 17:30:21 -------- d-----w- C:\Program Files (x86)\Malwarebytes' Anti-Malware
2011-08-05 07:29:55 -------- d-----w- C:\Program Files (x86)\Microsoft WebMatrix
2011-08-05 07:26:04 -------- d-----w- C:\Windows\SysWow64\1033
2011-08-05 07:26:04 -------- d-----w- C:\Windows\System32\1033
2011-08-05 07:26:04 -------- d-----w- C:\Program Files\Microsoft SQL Server
2011-08-05 07:24:58 -------- d-----w- C:\Program Files (x86)\Microsoft SQL Server
2011-08-05 07:23:18 -------- d-----w- C:\Program Files (x86)\IIS Express
2011-08-05 07:22:04 -------- d-----w- C:\Program Files\IIS
2011-08-05 07:22:03 -------- d-----w- C:\Program Files (x86)\IIS
2011-08-05 07:21:13 -------- d-----w- C:\Program Files\Microsoft SQL Server Compact Edition
2011-08-05 07:19:51 -------- d-----w- C:\Program Files (x86)\Microsoft ASP.NET
2011-08-05 07:10:30 -------- d-----w- C:\Program Files\Microsoft
2011-08-04 12:01:56 -------- d-----w- C:\Program Files (x86)\Emsisoft Anti-Malware
2011-07-31 17:01:12 -------- d-----w- C:\ProgramData\Spybot - Search & Destroy
2011-07-31 17:01:12 -------- d-----w- C:\Program Files (x86)\Spybot - Search & Destroy
2011-07-31 12:21:33 55384 ----a-w- C:\Windows\System32\drivers\SBREDrv.sys
2011-07-31 12:17:09 69376 ----a-w- C:\Windows\System32\drivers\Lbd.sys
2011-07-31 12:17:01 -------- d-----w- C:\Program Files (x86)\Lavasoft
2011-07-29 07:34:20 8578896 ----a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{EF8C2106-FAD5-44B9-A801-BDA8F4FD5AC7}\mpengine.dll
2011-07-27 15:26:37 69120 --sha-r- C:\Windows\SysWow64\dmrct.dll
2011-07-24 09:14:24 -------- d-----w- C:\Program Files\iTunes
2011-07-24 09:14:24 -------- d-----w- C:\Program Files\iPod
2011-07-24 09:11:22 -------- d-----w- C:\Program Files\Bonjour
2011-07-24 09:11:22 -------- d-----w- C:\Program Files (x86)\Bonjour
2011-07-23 18:44:16 -------- d-----w- C:\Program Files\Blender Foundation
2011-07-22 20:51:50 94208 ----a-w- C:\Windows\SysWow64\dpl100.dll
.
==================== Find3M ====================
.
2011-08-17 08:53:49 42672 ----a-w- C:\Windows\SysWow64\drivers\fsbts.sys
2011-08-16 08:43:12 152576 ----a-w- C:\Windows\SysWow64\msclmd.dll
2011-08-16 08:43:10 175616 ----a-w- C:\Windows\System32\msclmd.dll
2011-08-15 09:34:36 404640 ----a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
2011-07-16 05:41:50 362496 ----a-w- C:\Windows\System32\wow64win.dll
2011-07-16 05:41:49 243200 ----a-w- C:\Windows\System32\wow64.dll
2011-07-16 05:41:49 13312 ----a-w- C:\Windows\System32\wow64cpu.dll
2011-07-16 05:39:10 16384 ----a-w- C:\Windows\System32\ntvdm64.dll
2011-07-16 05:37:12 421888 ----a-w- C:\Windows\System32\KernelBase.dll
2011-07-16 04:29:19 14336 ----a-w- C:\Windows\SysWow64\ntvdm64.dll
2011-07-16 04:26:00 44032 ----a-w- C:\Windows\apppatch\acwow64.dll
2011-07-16 04:25:37 25600 ----a-w- C:\Windows\SysWow64\setup16.exe
2011-07-16 04:24:23 5120 ----a-w- C:\Windows\SysWow64\wow32.dll
2011-07-16 04:24:22 272384 ----a-w- C:\Windows\SysWow64\KernelBase.dll
2011-07-16 02:21:44 7680 ----a-w- C:\Windows\SysWow64\instnm.exe
2011-07-16 02:21:41 2048 ----a-w- C:\Windows\SysWow64\user.exe
2011-07-16 02:17:19 6144 ---ha-w- C:\Windows\SysWow64\api-ms-win-security-base-l1-1-0.dll
2011-07-16 02:17:19 4608 ---ha-w- C:\Windows\SysWow64\api-ms-win-core-threadpool-l1-1-0.dll
2011-07-16 02:17:19 3584 ---ha-w- C:\Windows\SysWow64\api-ms-win-core-xstate-l1-1-0.dll
2011-07-16 02:17:19 3072 ---ha-w- C:\Windows\SysWow64\api-ms-win-core-util-l1-1-0.dll
2011-07-12 08:34:00 96104 ----a-w- C:\Windows\System32\dns-sd.exe
2011-07-12 08:34:00 85864 ----a-w- C:\Windows\System32\dnssd.dll
2011-07-12 08:20:54 83816 ----a-w- C:\Windows\SysWow64\dns-sd.exe
2011-07-12 08:20:54 73064 ----a-w- C:\Windows\SysWow64\dnssd.dll
2011-07-09 02:46:28 288768 ----a-w- C:\Windows\System32\drivers\mrxsmb10.sys
2011-06-24 05:34:53 214528 ----a-w- C:\Windows\System32\winsrv.dll
2011-06-23 10:26:08 1700352 ----a-w- C:\Windows\SysWow64\GdiPlus.dll
2011-06-23 10:25:58 24576 ----a-w- C:\Windows\SysWow64\msxml3a.dll
2011-06-23 10:18:10 10915840 ----a-w- C:\Windows\SysWow64\libmfxhw32.dll
2011-06-23 10:18:06 10833920 ----a-w- C:\Windows\SysWow64\libmfxsw32.dll
2011-06-21 06:34:00 1923968 ----a-w- C:\Windows\System32\drivers\tcpip.sys
2011-06-15 10:02:23 212992 ----a-w- C:\Windows\System32\odbctrac.dll
2011-06-15 10:02:23 163840 ----a-w- C:\Windows\System32\odbccp32.dll
2011-06-15 10:02:23 106496 ----a-w- C:\Windows\System32\odbccu32.dll
2011-06-15 10:02:23 106496 ----a-w- C:\Windows\System32\odbccr32.dll
2011-06-15 08:55:19 86016 ----a-w- C:\Windows\SysWow64\odbccu32.dll
2011-06-15 08:55:19 81920 ----a-w- C:\Windows\SysWow64\odbccr32.dll
2011-06-15 08:55:19 319488 ----a-w- C:\Windows\SysWow64\odbcjt32.dll
2011-06-15 08:55:19 163840 ----a-w- C:\Windows\SysWow64\odbctrac.dll
2011-06-15 08:55:19 122880 ----a-w- C:\Windows\SysWow64\odbccp32.dll
2011-06-11 03:07:25 3137536 ----a-w- C:\Windows\System32\win32k.sys
2011-05-24 16:14:10 270720 ------w- C:\Windows\System32\MpSigStub.exe
2011-05-24 11:42:55 404480 ----a-w- C:\Windows\System32\umpnpmgr.dll
2011-05-24 10:40:05 64512 ----a-w- C:\Windows\SysWow64\devobj.dll
2011-05-24 10:40:05 44544 ----a-w- C:\Windows\SysWow64\devrtl.dll
2011-05-24 10:39:38 145920 ----a-w- C:\Windows\SysWow64\cfgmgr32.dll
2011-05-24 10:37:54 252928 ----a-w- C:\Windows\SysWow64\drvinst.exe
.
============= FINISH: 17:41:34,76 ===============




DDS (Attach)


.
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
.
DDS (Ver_2011-06-23.01)
.
Microsoft Windows 7 Home Premium
Boot Device: \Device\HarddiskVolume1
Install Date: 26.5.2010 17:16:53
System Uptime: 19.8.2011 12:31:02 (5 hours ago)
.
Motherboard: FOXCONN | | ETON
Processor: Intel(R) Celeron(R) CPU E3300 @ 2.50GHz | CPU 1 | 2500/800mhz
.
==== Disk Partitions =========================
.
C: is FIXED (NTFS) - 454 GiB total, 322,656 GiB free.
D: is FIXED (NTFS) - 12 GiB total, 1,694 GiB free.
E: is CDROM ()
F: is Removable
.
==== Disabled Device Manager Items =============
.
==== System Restore Points ===================
.
No restore point in system.
.
==== Installed Programs ======================
.
2007 Office Systemin yhteensopivuuspaketti
Acoustica Beatcraft
Acoustica Effects Pack
ActiveState Komodo Edit 6.1.1
Ad-Aware
Adobe AIR
Adobe Community Help
Adobe Flash Player 10 ActiveX
Adobe Flash Player 10 Plugin
Adobe Illustrator CS5
Adobe Media Player
Adobe Reader 9.4.5
Adobe Shockwave Player 11.5
AIRInstallTest
Akamai NetSession Interface
Any Video Converter 3.2.5
Apple Application Support
Apple Software Update
avast! Free Antivirus
Avidemux 2.5
AVS Image Converter 2.0.2.160
AVS Update Manager 1.0
AVS4YOU Software Navigator 1.4
CyberLink DVD Suite Deluxe
CyberLink PowerDirector
daHornet Version 1.34
Digidesign Pro Tools M-Powered Essential 8.0.2
DirectX for Managed Code Update (Summer 2004)
DivX Setup
eLicenser Control
Emsisoft Anti-Malware 5.1
F-Secure Browsing Protection
F-Secure Client Security - DeepGuard
F-Secure Client Security - E-Mail Scanning
F-Secure Client Security - Internet Shield
F-Secure Client Security - Web Traffic Scanning
F-Secure Client Security - Virus & Spy Protection
FileZilla Client 3.5.0
Free Easy Burner V 4.4.1
GIMP 2.6.10
GoldWave v5.56
Google Chrome
Google Desktop
Google Earth Plug-in
Google Talk (remove only)
Google Update Helper
HammerHead Rhythm Station
HP Customer Experience Enhancements
HP Games
HP Odometer
HP Remote Solution
HP Setup
HP Support Information
HP Update
Hydrogen
IIS 7.5 Express
iMindMap 5
Inkscape 0.47
Java Auto Updater
Java(TM) 6 Update 26
JoinMe
LabelPrint
LightScribe System Software
Magic Desktop
Malwarebytes' Anti-Malware version 1.51.1.1800
Microsoft ASP.NET Web Pages
Microsoft Choice Guard
Microsoft Office PowerPoint Viewer 2007 (Finnish)
Microsoft Silverlight
Microsoft SQL Server 2005 Compact Edition [ENU]
Microsoft SQL Server 2008 R2 Management Objects
Microsoft SQL Server Compact 4.0 Web Tools ENU
Microsoft SQL Server System CLR Types
Microsoft WebMatrix
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
Microsoft Works
Microsoft_VC80_CRT_x86
Microsoft_VC80_MFC_x86
Microsoft_VC80_MFCLOC_x86
Microsoft_VC90_ATL_x86
Microsoft_VC90_CRT_x86
Microsoft_VC90_MFC_x86
Mozilla Firefox 5.0.1 (x86 en-US)
Mozilla Thunderbird (6.0)
MSVCRT
Nalsoft Subtitle Player v10200
Native Instruments Kore Player
Native Instruments Service Center
Norton Online Backup
Octoshape add-in for Adobe Flash Player
OpenOffice.org 3.2
ordrumbox-0.9.04
PDF Settings CS5
Power2Go
PStill PostScript to PDF Converter (remove only)
QuickTime
Realtek High Definition Audio Driver
Recovery Manager
Scribus 1.3.3.14
Security Update for Microsoft .NET Framework 4 Client Profile (KB2160841)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2446708)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2478663)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2539636)
Security Update for Microsoft .NET Framework 4 Extended (KB2416472)
Security Update for Microsoft .NET Framework 4 Extended (KB2487367)
Skype Toolbars
Skype™ 5.3
SmartFTP Client Setup Files 4.0 (x64) (remove only)
SmartSound Quicktracks 5
Spotify
Spybot - Search & Destroy
SSH Tectia Client 4.2.0
Steam
Steinberg CI2 Extension 64bit
Steinberg Cubase AI 5
Steinberg HALionOne
Steinberg HALionOne GM Drum Set
Steinberg HALionOne GM Set
System Requirements Lab
TuxGuitar 1.2
Update for Microsoft .NET Framework 4 Client Profile (KB2473228)
VC80CRTRedist - 8.0.50727.6195
Windows Live Communications Platform
Windows Live Essentials
Windows Live Movie Maker
Windows Live Photo Gallery
Windows Live Sign-in Assistant
Windows Live Sync
Windows Live Upload Tool
VLC media player 1.1.5
VoddlerNet
VoddlerPlayer
VoiceOver Kit
Xvid 1.2.2 final uninstall
ZTE Smartphone Driver 1.2066.1.3
.
==== Event Viewer Messages From Past Week ========
.
19.8.2011 17:22:36, Error: Schannel [36888] - The following fatal alert was generated: 10. The internal error state is 10.
19.8.2011 12:31:38, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: is3srv szkg5
19.8.2011 12:31:36, Error: Service Control Manager [7023] - The Web Deployment Agent Service service terminated with the following error: %%-2146233088
19.8.2011 12:31:33, Error: Microsoft-Windows-HttpEvent [15005] - Unable to bind to the underlying transport for [::]:80. The IP Listen-Only list may contain a reference to an interface which may not exist on this machine. The data field contains the error number.
19.8.2011 12:31:14, Error: atikmdag [52236] - CPLIB :: General - Invalid Parameter
19.8.2011 12:31:14, Error: atikmdag [43029] - Display is not active
19.8.2011 12:30:29, Error: Service Control Manager [7024] - The Apache2.2 service terminated with service-specific error Incorrect function..
19.8.2011 12:24:05, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: is3srv Partizan szkg5
19.8.2011 12:20:41, Error: Service Control Manager [7001] - The HomeGroup Provider service depends on the Function Discovery Provider Host service which failed to start because of the following error: The dependency service or group failed to start.
19.8.2011 12:20:31, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service WSearch with arguments " " in order to run the server: {9E175B6D-F52A-11D8-B9A5-505054503030}
19.8.2011 12:20:31, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service WSearch with arguments " " in order to run the server: {7D096C5F-AC08-4F1F-BEB7-5C22C517CE39}
19.8.2011 12:20:30, Error: Service Control Manager [7001] - The Computer Browser service depends on the Server service which failed to start because of the following error: The dependency service or group failed to start.
19.8.2011 12:20:25, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service EventSystem with arguments " " in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}
19.8.2011 12:20:18, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service ShellHWDetection with arguments " " in order to run the server: {DD522ACC-F821-461A-A407-50B198B896DC}
19.8.2011 12:20:16, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: a2injectiondriver discache FSES FSFW is3srv Partizan spldr szkg5 Wanarpv6
19.8.2011 12:17:01, Error: Service Control Manager [7001] - The Network List Service service depends on the Network Location Awareness service which failed to start because of the following error: The dependency service or group failed to start.
19.8.2011 12:16:52, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service netprofm with arguments " " in order to run the server: {A47979D2-C419-11D9-A5B4-001185AD2B89}
19.8.2011 12:16:52, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service netman with arguments " " in order to run the server: {BA126AD1-2166-11D1-B1D0-00805FC1270E}
19.8.2011 12:15:49, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: a2injectiondriver AFD DfsC discache FSES FSFW is3srv NetBIOS NetBT nsiproxy Partizan Psched rdbss spldr szkg5 tdx vwififlt Wanarpv6 WfpLwf
19.8.2011 12:15:49, Error: Service Control Manager [7001] - The SMB MiniRedirector Wrapper and Engine service depends on the Redirected Buffering Sub Sysytem service which failed to start because of the following error: A device attached to the system is not functioning.
19.8.2011 12:15:49, Error: Service Control Manager [7001] - The SMB 2.0 MiniRedirector service depends on the SMB MiniRedirector Wrapper and Engine service which failed to start because of the following error: The dependency service or group failed to start.
19.8.2011 12:15:49, Error: Service Control Manager [7001] - The SMB 1.x MiniRedirector service depends on the SMB MiniRedirector Wrapper and Engine service which failed to start because of the following error: The dependency service or group failed to start.
19.8.2011 12:15:49, Error: Service Control Manager [7001] - The Network Location Awareness service depends on the Network Store Interface Service service which failed to start because of the following error: The dependency service or group failed to start.
19.8.2011 12:15:49, Error: Service Control Manager [7001] - The Network Connections service depends on the Network Store Interface Service service which failed to start because of the following error: The dependency service or group failed to start.
19.8.2011 12:15:49, Error: Service Control Manager [7001] - The MySQL service depends on the Ancillary Function Driver for Winsock service which failed to start because of the following error: A device attached to the system is not functioning.
19.8.2011 12:15:49, Error: Service Control Manager [7001] - The IP Helper service depends on the Network Store Interface Service service which failed to start because of the following error: The dependency service or group failed to start.
19.8.2011 12:15:48, Error: Service Control Manager [7001] - The Workstation service depends on the Network Store Interface Service service which failed to start because of the following error: The dependency service or group failed to start.
19.8.2011 12:15:48, Error: Service Control Manager [7001] - The Apache2.2 service depends on the Ancillary Function Driver for Winsock service which failed to start because of the following error: A device attached to the system is not functioning.
19.8.2011 12:15:47, Error: Service Control Manager [7001] - The TCP/IP NetBIOS Helper service depends on the Ancillary Function Driver for Winsock service which failed to start because of the following error: A device attached to the system is not functioning.
19.8.2011 12:15:47, Error: Service Control Manager [7001] - The Network Store Interface Service service depends on the NSI proxy service driver. service which failed to start because of the following error: A device attached to the system is not functioning.
19.8.2011 12:15:47, Error: Service Control Manager [7001] - The DNS Client service depends on the NetIO Legacy TDI Support Driver service which failed to start because of the following error: A device attached to the system is not functioning.
19.8.2011 12:15:47, Error: Service Control Manager [7001] - The DHCP Client service depends on the Ancillary Function Driver for Winsock service which failed to start because of the following error: A device attached to the system is not functioning.
19.8.2011 12:12:58, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the szserver service.
19.8.2011 12:04:42, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: is3srv Partizan
19.8.2011 10:37:50, Error: Service Control Manager [7022] - The Windows Search service hung on starting.
18.8.2011 12:51:35, Error: Service Control Manager [7000] - The Steam Client Service service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
18.8.2011 12:51:34, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the Steam Client Service service to connect.
17.8.2011 22:24:29, Error: Service Control Manager [7022] - The Windows Update service hung on starting.
16.8.2011 9:49:24, Error: Service Control Manager [7030] - The PEVSystemStart service is marked as an interactive service. However, the system is configured to not allow interactive services. This service may not function properly.
16.8.2011 9:38:47, Error: Application Popup [1060] - \??\C:\ComboFix\catchme.sys has been blocked from loading due to incompatibility with this system. Please contact your software vendor for a compatible version of the driver.
16.8.2011 9:25:11, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the Akamai service.
16.8.2011 2:35:27, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: a2injectiondriver AFD DfsC discache FSES FSFW NetBIOS NetBT nsiproxy Psched rdbss spldr tdx vwififlt Wanarpv6 WfpLwf
16.8.2011 2:34:43, Error: Service Control Manager [7023] - The F-Secure Management Agent service terminated with the following error: The system cannot find the file specified.
16.8.2011 12:48:22, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: Partizan
16.8.2011 12:31:25, Error: Service Control Manager [7031] - The Akamai NetSession Interface service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 1000 milliseconds: Restart the service.
16.8.2011 12:30:25, Error: Service Control Manager [7034] - The Easybits Shared Services for Windows service terminated unexpectedly. It has done this 1 time(s).
16.8.2011 12:06:31, Error: Microsoft-Windows-WMPNSS-Service [14353] - A media delivery engine with ID '0' was not initialized due to error '0x80070005' when adding the URL 'http://+:10243/WMPNSSv4/2617674023/'. Restart your computer, and then restart the WMPNetworkSvc service. If the problem persists, reinstall Windows Media Player if possible.
16.8.2011 12:06:31, Error: Microsoft-Windows-WMPNSS-Service [14349] - A new media server was not initialized because the Windows Media Delivery Engine did not initialize due to error '0x80070005'. Restart your computer, and then restart the WMPNetworkSvc service. If the problem persists, reinstall Windows Media Player if possible.
16.8.2011 12:02:34, Error: Service Control Manager [7000] - The MBAMService service failed to start due to the following error: The pipe has been ended.
16.8.2011 11:11:13, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the Web Deployment Agent Service service to connect.
16.8.2011 11:11:13, Error: Service Control Manager [7000] - The Web Deployment Agent Service service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
16.8.2011 11:08:23, Error: F-Secure Gatekeeper [1] -
16.8.2011 11:06:48, Error: Service Control Manager [7022] - The Windows Font Cache Service service hung on starting.
16.8.2011 11:04:13, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the Windows Installer service to connect.
16.8.2011 11:04:13, Error: Service Control Manager [7000] - The Windows Installer service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
16.8.2011 11:04:13, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1053" attempting to start the service MSIServer with arguments " " in order to run the server: {000C101C-0000-0000-C000-000000000046}
16.8.2011 10:45:08, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the WerSvc service.
16.8.2011 0:31:49, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the F-Secure Gatekeeper Handler Starter service.
15.8.2011 20:02:12, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the Wlansvc service.
14.8.2011 9:20:13, Error: Server [2505] - The server could not bind to the transport \Device\NetBT_Tcpip_{3AD79ADB-4FD5-431E-AFEA-D2AB7646BFB8} because another computer on the network has the same name. The server could not start.
.
==== End Of File ===========================



A couple of things that I noticed, which might or might not help in figuring this out:

- I can't open Windows Defender anymore
- The redirecting doesn't seem to happen when in Safe Mode


Thank you for any help!

 

Here's the Combofix report. Because I live in Finland, the installation defaulted to the local language. The translations in the report are mine. I have denoted the translated bits with an asterisk.

After starting the scan Combofix said that I still have one virus scanner active (F-Secure). I did everything I could to disable it.







ComboFix 11-08-19.02 - Tuure 20.08.2011 12:39:39.2.2 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.358.1033.18.2047.700 [GMT 3:00]
Sijainti: c:\users\Tuure\Desktop\ComboFix.exe
AV: F-Secure Client Security 9.01 *Enabled/Updated* {15414183-282E-D62C-CA37-EF24860A2F17}
FW: F-Secure Client Security 9.01 *Enabled* {2D7AC0A6-6241-D774-E168-461178D9686C}
SP: F-Secure Client Security 9.01 *Enabled/Updated* {AE20A067-0E14-D9A2-F087-D456FD8D65AA}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* New recovery point created*
.
.
(((((((((((((((((((((((((((((((((((((( Other removals* ))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
---- Previous run* -------
.
C:\Install.exe
c:\program files (x86)\Steam\Steam.exe
.
.
((((( Files created within the following timeframe*: 2011-07-20 to 2011-08-20 )))))))))))))))))
.
.
2011-08-20 09:52 . 2011-08-20 09:52 -------- d-----w- c:\users\Default\AppData\Local\temp
2011-08-19 09:45 . 2011-07-04 11:36 288088 ----a-w- c:\windows\system32\drivers\aswSP.sys
2011-08-19 09:45 . 2011-07-04 11:32 22360 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2011-08-19 09:45 . 2011-07-04 11:32 31064 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2011-08-19 09:45 . 2011-07-04 11:35 45400 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2011-08-19 09:45 . 2011-07-04 11:36 600920 ----a-w- c:\windows\system32\drivers\aswSnx.sys
2011-08-19 09:45 . 2011-07-04 11:43 253888 ----a-w- c:\windows\system32\aswBoot.exe
2011-08-19 09:45 . 2011-07-04 11:32 64856 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys
2011-08-19 09:44 . 2011-07-04 11:43 40112 ----a-w- c:\windows\avastSS.scr
2011-08-19 09:44 . 2011-07-04 11:43 199304 ----a-w- c:\windows\SysWow64\aswBoot.exe
2011-08-19 09:44 . 2011-08-19 09:44 -------- d-----w- c:\programdata\AVAST Software
2011-08-19 09:44 . 2011-08-19 09:44 -------- d-----w- c:\program files\AVAST Software
2011-08-19 09:01 . 2011-08-19 09:30 27256 ----a-w- c:\windows\system32\drivers\FixTDSS.sys
2011-08-19 09:01 . 2011-08-19 09:01 -------- d-----w- c:\users\Tuure\AppData\Roaming\FixTDSS
2011-08-18 09:49 . 2011-08-20 09:17 -------- d-----w- c:\program files (x86)\Steam
2011-08-17 06:58 . 2011-08-17 06:58 -------- d-----w- c:\users\Tuure\AppData\Roaming\Registry Mechanic
2011-08-16 11:59 . 2011-08-16 12:00 -------- d-----w- c:\program files\CCleaner
2011-08-16 09:48 . 2011-08-16 09:48 2 --shatr- c:\windows\winstart.bat
2011-08-16 09:32 . 2011-08-19 09:14 -------- d-----w- c:\programdata\STOPzilla!
2011-08-16 09:26 . 2011-08-19 09:29 -------- d-----w- c:\program files (x86)\UnHackMe
2011-08-16 08:24 . 2011-08-16 08:24 -------- d-----w- c:\windows\system32\SPReview
2011-08-16 08:23 . 2011-08-16 08:23 -------- d-----w- c:\windows\system32\EventProviders
2011-08-16 06:20 . 2011-08-16 06:20 -------- d-----w- c:\users\Tuure\AppData\Roaming\F-Secure
2011-08-15 12:07 . 2010-04-29 12:46 122624 ----a-w- c:\windows\system32\drivers\zgwhsnmea.sys
2011-08-15 12:07 . 2010-04-29 12:46 122624 ----a-w- c:\windows\system32\drivers\zgwhsmdm.sys
2011-08-15 12:07 . 2010-04-29 12:46 122624 ----a-w- c:\windows\system32\drivers\zgwhsdiag.sys
2011-08-15 12:07 . 2009-06-30 14:47 31744 ----a-w- c:\windows\system32\drivers\androidusb.sys
2011-08-15 12:07 . 2011-08-15 12:07 -------- d---a-w- c:\users\Tuure\.android
2011-08-15 12:07 . 2011-08-15 12:07 -------- d-----w- c:\program files (x86)\ZTE Smartphone Driver
2011-08-13 09:51 . 2011-08-13 09:51 -------- d-----w- c:\users\Tuure\AppData\Roaming\Template
2011-08-12 08:31 . 2010-01-05 09:44 96256 ----a-w- c:\windows\AdbWinApi.dll
2011-08-11 06:48 . 2011-06-23 04:33 3912576 ----a-w- c:\windows\SysWow64\ntoskrnl.exe
2011-08-11 06:48 . 2011-06-23 05:43 5561216 ----a-w- c:\windows\system32\ntoskrnl.exe
2011-08-11 06:48 . 2011-06-23 04:33 3967872 ----a-w- c:\windows\SysWow64\ntkrnlpa.exe
2011-08-06 17:30 . 2011-08-06 17:30 -------- d-----w- c:\users\Tuure\AppData\Roaming\Malwarebytes
2011-08-06 17:30 . 2011-07-06 16:52 41272 ----a-w- c:\windows\SysWow64\drivers\mbamswissarmy.sys
2011-08-06 17:30 . 2011-08-06 17:30 -------- d-----w- c:\programdata\Malwarebytes
2011-08-06 17:30 . 2011-07-06 16:52 25912 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-08-06 17:30 . 2011-08-06 17:30 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware
2011-08-05 07:29 . 2011-08-05 07:30 -------- d-----w- c:\program files (x86)\Microsoft WebMatrix
2011-08-05 07:26 . 2011-08-05 07:26 -------- d-----w- c:\program files\Microsoft SQL Server
2011-08-05 07:26 . 2011-08-05 07:26 -------- d-----w- c:\windows\system32\1033
2011-08-05 07:26 . 2011-08-05 07:26 -------- d-----w- c:\windows\SysWow64\1033
2011-08-05 07:24 . 2011-08-05 07:24 -------- d-----w- c:\program files (x86)\Microsoft SQL Server
2011-08-05 07:23 . 2011-08-05 07:23 -------- d-----w- c:\program files (x86)\IIS Express
2011-08-05 07:22 . 2011-08-05 07:22 -------- d-----w- c:\program files\IIS
2011-08-05 07:22 . 2011-08-05 07:22 -------- d-----w- c:\program files (x86)\IIS
2011-08-05 07:21 . 2011-08-05 07:21 -------- d-----w- c:\program files\Microsoft SQL Server Compact Edition
2011-08-05 07:19 . 2011-08-05 07:19 -------- d-----w- c:\program files (x86)\Microsoft ASP.NET
2011-08-05 07:10 . 2011-08-05 07:10 -------- d-----w- c:\program files\Microsoft
2011-08-04 12:01 . 2011-08-06 20:39 -------- d-----w- c:\program files (x86)\Emsisoft Anti-Malware
2011-07-31 17:01 . 2011-08-16 12:06 -------- d-----w- c:\programdata\Spybot - Search & Destroy
2011-07-31 17:01 . 2011-07-31 17:01 -------- d-----w- c:\program files (x86)\Spybot - Search & Destroy
2011-07-31 12:21 . 2011-07-31 12:17 55384 ----a-w- c:\windows\system32\drivers\SBREDrv.sys
2011-07-31 12:17 . 2011-07-21 11:59 69376 ----a-w- c:\windows\system32\drivers\Lbd.sys
2011-07-31 12:17 . 2011-07-31 12:17 -------- d-----w- c:\programdata\Lavasoft
2011-07-31 12:17 . 2011-07-31 12:17 -------- d-----w- c:\program files (x86)\Lavasoft
2011-07-29 07:34 . 2011-07-13 04:53 8578896 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{EF8C2106-FAD5-44B9-A801-BDA8F4FD5AC7}\mpengine.dll
2011-07-27 15:26 . 2011-07-27 15:26 69120 --sha-r- c:\windows\SysWow64\dmrct.dll
2011-07-24 09:14 . 2011-07-24 09:14 -------- d-----w- c:\program files\iTunes
2011-07-24 09:14 . 2011-07-24 09:14 -------- d-----w- c:\program files\iPod
2011-07-24 09:11 . 2011-07-24 09:11 -------- d-----w- c:\program files\Bonjour
2011-07-24 09:11 . 2011-07-24 09:11 -------- d-----w- c:\program files (x86)\Bonjour
2011-07-24 09:04 . 2011-07-24 09:04 -------- d-----w- c:\program files (x86)\Apple Software Update
2011-07-23 18:44 . 2011-07-23 18:44 -------- d-----w- c:\program files\Blender Foundation
2011-07-22 20:51 . 2011-07-22 20:51 94208 ----a-w- c:\windows\SysWow64\dpl100.dll
.
.
.
(((((((((((((((((((((((((((((((((((( Find3M-report* ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-08-17 08:53 . 2010-05-26 14:50 42672 ----a-w- c:\windows\SysWow64\drivers\fsbts.sys
2011-08-16 08:43 . 2009-07-14 02:36 152576 ----a-w- c:\windows\SysWow64\msclmd.dll
2011-08-16 08:43 . 2009-07-14 02:36 175616 ----a-w- c:\windows\system32\msclmd.dll
2011-08-15 09:34 . 2011-06-29 05:28 404640 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2011-07-16 04:26 . 2011-08-11 06:50 44032 ----a-w- c:\windows\apppatch\acwow64.dll
2011-07-12 08:34 . 2011-07-12 08:34 96104 ----a-w- c:\windows\system32\dns-sd.exe
2011-07-12 08:34 . 2011-07-12 08:34 85864 ----a-w- c:\windows\system32\dnssd.dll
2011-07-12 08:20 . 2011-07-12 08:20 83816 ----a-w- c:\windows\SysWow64\dns-sd.exe
2011-07-12 08:20 . 2011-07-12 08:20 73064 ----a-w- c:\windows\SysWow64\dnssd.dll
2011-06-23 10:26 . 2011-07-11 12:00 1700352 ----a-w- c:\windows\SysWow64\GdiPlus.dll
2011-06-23 10:25 . 2011-07-11 12:00 24576 ----a-w- c:\windows\SysWow64\msxml3a.dll
2011-06-23 10:18 . 2011-07-11 12:01 10915840 ----a-w- c:\windows\SysWow64\libmfxhw32.dll
2011-06-23 10:18 . 2011-07-11 12:01 10833920 ----a-w- c:\windows\SysWow64\libmfxsw32.dll
2011-06-11 03:07 . 2011-07-13 17:51 3137536 ----a-w- c:\windows\system32\win32k.sys
2011-05-24 16:14 . 2010-05-26 15:14 270720 ------w- c:\windows\system32\MpSigStub.exe
2011-05-24 11:42 . 2011-06-29 05:26 404480 ----a-w- c:\windows\system32\umpnpmgr.dll
2011-05-24 10:40 . 2011-06-29 05:26 64512 ----a-w- c:\windows\SysWow64\devobj.dll
2011-05-24 10:40 . 2011-06-29 05:26 44544 ----a-w- c:\windows\SysWow64\devrtl.dll
2011-05-24 10:39 . 2011-06-29 05:26 145920 ----a-w- c:\windows\SysWow64\cfgmgr32.dll
2011-05-24 10:37 . 2011-06-29 05:26 252928 ----a-w- c:\windows\SysWow64\drvinst.exe
.
.
(((((((((((((((((((((((((((((( Register startups* )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* Empty values and default values will not be shows*
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"googletalk "= "c:\users\Tuure\AppData\Roaming\Google\Google Talk\googletalk.exe" [2007-01-01 3739648]
"SpybotSD TeaTimer "= "c:\program files (x86)\Spybot - Search & Destroy\TeaTimer.exe" [2009-01-26 2144088]
"Steam "= "c:\program files (x86)\Steam\Steam.exe" [2011-08-18 1242448]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"hpsysdrv "= "c:\program files (x86)\hewlett-packard\HP odometer\hpsysdrv.exe" [2008-11-20 62768]
"HP Software Update "= "c:\program files (x86)\HP\HP Software Update\HPWuSchd2.exe" [2008-12-08 54576]
"NortonOnlineBackupReminder "= "c:\program files (x86)\Symantec\Norton Online Backup\Activation\NobuActivation.exe" [2009-06-29 600936]
"Easybits Recovery "= "c:\program files (x86)\EasyBits For Kids\ezRecover.exe" [2009-09-02 60464]
"F-Secure Manager "= "c:\program files (x86)\F-Secure\Common\FSM32.EXE" [2010-03-26 301744]
"F-Secure TNB "= "c:\program files (x86)\F-Secure\FSGUI\TNBUtil.exe" [2010-03-26 1653424]
"DigidesignMMERefresh "= "c:\program files (x86)\Digidesign\Drivers\MMERefresh.exe" [2009-06-18 77824]
"QuickTime Task "= "c:\program files (x86)\QuickTime\QTTask.exe" [2010-11-29 421888]
"Google Desktop Search "= "c:\program files (x86)\Google\Google Desktop Search\GoogleDesktop.exe" [2011-01-28 30192]
"VoddlerNet Manager "= "c:\program files (x86)\Voddler\service\VNetManager.exe" [2011-02-09 676040]
"AdobeCS5ServiceManager "= "c:\program files (x86)\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe" [2010-02-22 406992]
"Adobe Reader Speed Launcher "= "c:\program files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2011-06-08 37296]
"Adobe ARM "= "c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-03-30 937920]
"SunJavaUpdateSched "= "c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2011-04-08 254696]
"iTunesHelper "= "c:\program files (x86)\iTunes\iTunesHelper.exe" [2011-07-19 421736]
"Malwarebytes' Anti-Malware "= "c:\program files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" [2011-07-06 449584]
"DivXUpdate "= "c:\program files (x86)\DivX\DivX Update\DivXUpdate.exe" [2011-07-28 1259376]
"avast "= "c:\program files\AVAST Software\Avast\avastUI.exe" [2011-07-04 3493720]
.
c:\users\Tuure\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OpenOffice.org 3.2.lnk - c:\program files (x86)\OpenOffice.org 3\program\quickstart.exe [2009-12-15 384000]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin "= 5 (0x5)
"ConsentPromptBehaviorUser "= 3 (0x3)
"EnableUIADesktopToggle "= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"ForceActiveDesktopOn "= 0 (0x0)
.
[hkey_local_machine\software\Wow6432Node\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs "=c:\progra~2\Google\GOOGLE~2\GoogleDesktopNetwork3.dll
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
SetupExecute REG_MULTI_SZ \0
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@= "Service "
.
R0 is3srv;is3srv;c:\windows\SySWOW64\drivers\is3srv64.sys [x]
R0 szkg5;szkg5;c:\windows\SySWOW64\DRIVERS\szkg64.sys [x]
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 gupdate;Google-päivityspalvelu (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-10-17 136176]
R2 MsDepSvc;Web Deployment Agent Service;c:\program files\IIS\Microsoft Web Deploy\MsDepSvc.exe [2011-04-01 67400]
R3 androidusb;ADB Interface Driver;c:\windows\system32\Drivers\androidusb.sys [x]
R3 GoogleDesktopManager-051210-111108;Google Desktop Manager 5.9.1005.12335;c:\program files (x86)\Google\Google Desktop Search\GoogleDesktop.exe [2011-01-28 30192]
R3 gupdatem;Google Päivitä-palvelu (gupdatem);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-10-17 136176]
R3 MAUSBFASTTRACK;Service for M-Audio FastTrack;c:\windows\system32\DRIVERS\MAudioFastTrack.sys [x]
R3 SynUSB64;SynUSB64;c:\windows\system32\DRIVERS\SynUSB64.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [x]
R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [x]
R3 zgwhsmdm;ZTE WCDMA Handset USB Modem;c:\windows\system32\DRIVERS\zgwhsmdm.sys [x]
R4 F-Secure Filter;F-Secure File System Filter;c:\program files (x86)\F-Secure\Anti-Virus\Win2K\FSfilter.sys [2010-03-26 39856]
R4 F-Secure Recognizer;F-Secure File System Recognizer;c:\program files (x86)\F-Secure\Anti-Virus\Win2K\FSrec.sys [2010-03-26 25264]
S0 FixTDSS;TDSS Fixtool driver;c:\windows\system32\drivers\FixTDSS.sys [x]
S0 Lbd;Lbd;c:\windows\system32\DRIVERS\Lbd.sys [x]
S1 a2injectiondriver;a2injectiondriver;c:\program files (x86)\Emsisoft Anti-Malware\a2dix64.sys [2010-09-05 48216]
S1 a2util;a-squared Malware-IDS utility driver;c:\program files (x86)\Emsisoft Anti-Malware\a2util64.sys [2010-05-05 14720]
S1 aswSnx;aswSnx; [x]
S1 aswSP;aswSP; [x]
S1 F-Secure HIPS;F-Secure HIPS Driver;c:\program files (x86)\F-Secure\HIPS\drivers\fshs.sys [2010-03-26 58000]
S1 FSES;F-Secure Email Scanning Driver;c:\windows\system32\drivers\fses.sys [x]
S1 FSFW;F-Secure Firewall Driver;c:\windows\system32\drivers\fsdfw.sys [x]
S1 fsvista;F-Secure Vista Support Driver;c:\program files (x86)\F-Secure\Anti-Virus\minifilter\fsvista.sys [2010-03-26 14904]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x]
S2 a2AntiMalware;Emsisoft Anti-Malware 5.1 - Service;c:\program files (x86)\Emsisoft Anti-Malware\a2service.exe [2011-06-30 3029208]
S2 Akamai;Akamai NetSession Interface;c:\windows\System32\svchost.exe [2009-07-14 27136]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [x]
S2 Apache2.2;Apache2.2;c:\xampp\apache\bin\httpd.exe [2009-12-19 29416]
S2 aswFsBlk;aswFsBlk; [x]
S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [x]
S2 ezSharedSvc;Easybits Shared Services for Windows;c:\windows\system32\svchost.exe [2009-07-14 27136]
S2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files (x86)\Lavasoft\Ad-Aware\AAWService.exe [2011-07-21 2151640]
S2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2011-07-06 366640]
S2 RichVideo64;Cyberlink RichVideo64 Service(CRVS);c:\program files\CyberLink\Shared files\RichVideo64.exe [2010-08-19 386344]
S2 VoddlerNet;VoddlerNet;c:\program files (x86)\Voddler\service\voddler.exe [2011-02-09 1039640]
S3 a2acc;a2acc;c:\program files (x86)\EMSISOFT ANTI-MALWARE\a2accx64.sys [2011-02-20 85800]
S3 F-Secure Gatekeeper;F-Secure Gatekeeper;c:\program files (x86)\F-Secure\Anti-Virus\minifilter\fsgk.sys [2011-06-09 198824]
S3 FSORSPClient;F-Secure ORSP Client;c:\program files (x86)\F-Secure\ORSP Client\fsorsp.exe [2011-05-23 61088]
S3 Lavasoft Kernexplorer;Lavasoft helper driver;c:\program files (x86)\Lavasoft\Ad-Aware\KernExplorer64.sys [2011-07-31 17152]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [x]
S3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\DRIVERS\vwifimp.sys [x]
S3 ysusb64;Yamaha Steinberg USB Audio;c:\windows\system32\drivers\ysusb64.sys [x]
.
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost]
Akamai REG_MULTI_SZ Akamai
.
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
ezSharedSvc
.
'Scheduled tasks' folder content*
.
2011-08-20 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- c:\program files (x86)\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2011-07-21 11:59]
.
2011-08-20 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-10-17 11:34]
.
2011-08-19 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-10-17 11:34]
.
2011-08-19 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3425611528-2409934986-2553978045-1000Core.job
- c:\users\Tuure\AppData\Local\Google\Update\GoogleUpdate.exe [2011-08-16 19:49]
.
2011-08-19 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3425611528-2409934986-2553978045-1000UA.job
- c:\users\Tuure\AppData\Local\Google\Update\GoogleUpdate.exe [2011-08-16 19:49]
.
2011-06-30 c:\windows\Tasks\PCDRScheduledMaintenance.job
- c:\program files\PC-Doctor for Windows\pcdrcui.exe [2009-09-18 07:11]
.
.
--------- x86-64 -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@= "{472083B0-C522-11CF-8763-00608CC02F24} "
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2011-07-04 11:43 134384 ----a-w- c:\program files\AVAST Software\Avast\ashShA64.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray "= "c:\windows\system32\igfxtray.exe" [2009-09-18 165912]
"HotKeysCmds "= "c:\windows\system32\hkcmd.exe" [2009-09-18 387608]
"Persistence "= "c:\windows\system32\igfxpers.exe" [2009-09-18 365592]
"PC-Doctor for Windows localizer "= "c:\program files\PC-Doctor for Windows\localizer.exe" [2009-09-17 95728]
"M-Audio Taskbar Icon "= "c:\windows\system32\M-AudioTaskBarIcon.exe" [2010-12-07 798728]
"AdobeAAMUpdater-1.0 "= "c:\program files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2010-03-06 500208]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"LoadAppInit_DLLs "=0x0
.
------- Supplementary check* -------
.
uStart Page = https://plus.google.com/up/start/?continue=https://plus.google.com/&type=st&gpcaz=9ee2dfee&hl=en
uLocal Page = c:\windows\system32\blank.htm
mDefault_Page_URL = hxxp://www.bing.com
mStart Page = hxxp://www.bing.com
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = *.local
FF - ProfilePath - c:\users\Tuure\AppData\Roaming\Mozilla\Firefox\Profiles\nehk9mos.default\
FF - prefs.js: browser.startup.homepage - hxxps://plus.google.com/?hl=en
FF - prefs.js: network.proxy.ftp - 209.159.147.196
FF - prefs.js: network.proxy.ftp_port - 80
FF - prefs.js: network.proxy.gopher - 209.159.147.196
FF - prefs.js: network.proxy.gopher_port - 80
FF - prefs.js: network.proxy.http - 209.159.147.196
FF - prefs.js: network.proxy.http_port - 80
FF - prefs.js: network.proxy.socks - 209.159.147.196
FF - prefs.js: network.proxy.socks_port - 80
FF - prefs.js: network.proxy.ssl - 209.159.147.196
FF - prefs.js: network.proxy.ssl_port - 80
FF - prefs.js: network.proxy.type - 0
.
- - - - DELETED EXCESS LINES* - - - -
.
Wow6432Node-HKLM-Run-<NO NAME> - (no file)
AddRemove-Adobe Shockwave Player - c:\windows\system32\Adobe\Shockwave 11\uninstaller.exe
AddRemove-EasyBits Magic Desktop - c:\windows\system32\ezMDUninstall.exe
AddRemove-{30EDC81C-307E-495B-856B-344EB3F21339} - c:\program files (x86)\InstallShield Installation Information\{30EDC81C-307E-495B-856B-344EB3F21339}\setup.exe
.
.
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\MsDepSvc]
"ImagePath "= "\ "c:\program files\IIS\Microsoft Web Deploy\MsDepSvc.exe\" -runService:MsDepSvc "
"ImagePath "= "\ "c:\program files\CyberLink\Shared files\RichVideo64.exe\ "\00Z
[\]^_À\00\00À\00\00\00\00HIJKLMNO\00\00\00\00\00\00\00\00\03\00\00\00|}~À\00\00À\00\00\00\00r\00\00\00\00\00\00\00\00‘’“ "
.
.
--------------------- LOCKED REGISTRY KEYS* ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@= "FlashBroker "
"LocalizedString "= "@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10v_ActiveX.exe,-101 "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled "=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@= "c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10v_ActiveX.exe "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@= "{FAB3E735-69C7-453B-A446-B6823C6DF1C9} "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@= "Shockwave Flash Object "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@= "c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10v.ocx "
"ThreadingModel "= "Apartment "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@= "0 "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@= "ShockwaveFlash.ShockwaveFlash.10 "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@= "c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10v.ocx, 1 "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@= "{D27CDB6B-AE6D-11cf-96B8-444553540000} "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@= "1.0 "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@= "ShockwaveFlash.ShockwaveFlash "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@= "Macromedia Flash Factory Object "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@= "c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10v.ocx "
"ThreadingModel "= "Apartment "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@= "FlashFactory.FlashFactory.1 "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@= "c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10v.ocx, 1 "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@= "{D27CDB6B-AE6D-11cf-96B8-444553540000} "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@= "1.0 "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@= "FlashFactory.FlashFactory "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@= "IFlashBroker4 "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@= "{00020424-0000-0000-C000-000000000046} "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@= "{FAB3E735-69C7-453B-A446-B6823C6DF1C9} "
"Version "= "1.0 "
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial "=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial "=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Other processes* ------------------------
.
c:\program files\AVAST Software\Avast\AvastSvc.exe
c:\windows\SysWOW64\rundll32.exe
c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files (x86)\Bonjour\mDNSResponder.exe
c:\program files (x86)\F-Secure\Anti-Virus\fsgk32st.exe
c:\program files (x86)\F-Secure\Anti-Virus\FSGK32.EXE
c:\program files (x86)\F-Secure\Common\FSMA32.EXE
c:\program files (x86)\Common Files\LightScribe\LSSrvc.exe
c:\program files (x86)\F-Secure\Common\FSHDLL32.EXE
c:\xampp\mysql\bin\mysqld.exe
c:\program files (x86)\F-Secure\Common\FNRB32.EXE
c:\program files (x86)\F-Secure\Common\FIH32.EXE
c:\program files (x86)\F-Secure\Anti-Virus\fssm32.exe
c:\program files (x86)\Lavasoft\Ad-Aware\AAWTray.exe
c:\program files (x86)\Lavasoft\Ad-Aware\AWSC.exe
c:\program files (x86)\Lavasoft\Ad-Aware\AWSC.exe
c:\program files (x86)\F-Secure\Anti-Virus\fsav32.exe
.
**************************************************************************
.
Time of completion*: 2011-08-20 13:08:22 - computer was rebooted*
ComboFix-quarantined-files.txt 2011-08-20 10:08
.
Before run*: 348*313*145*344 bytes free
After run*: 348*230*230*016 bytes free
.
- - End Of File - - F76E8B3800059A35C71C489CDA3636FE

 

I uninstalled F-secure and rebooted. It no longer appears on the system tray. Still, Combofix said that F-secure is running, and I can see it in the log as well. Weird. Anyway, I ran Combofix again, per your instructions. Here's the output. My translations are again denoted with an asterisk. I wonder if there's a way to get it running in English...


ComboFix 11-08-19.02 - Tuure 20.08.2011 19:55:41.3.2 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.358.1033.18.2047.516 [GMT 3:00]
Location*:: c:\users\Tuure\Desktop\ComboFix.exe
Used command line operations* :: c:\users\Tuure\Desktop\CFScript.txt
AV: F-Secure Client Security 9.01 *Enabled/Updated* {15414183-282E-D62C-CA37-EF24860A2F17}
FW: F-Secure Client Security 9.01 *Enabled* {2D7AC0A6-6241-D774-E168-461178D9686C}
SP: F-Secure Client Security 9.01 *Enabled/Updated* {AE20A067-0E14-D9A2-F087-D456FD8D65AA}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* New recovery point created*
.
FILE ::
"c:\windows\SySWOW64\drivers\is3srv64.sys "
"c:\windows\SySWOW64\DRIVERS\szkg64.sys "
"c:\windows\winstart.bat "
.
.
(((((((((((((((((((((((((((((((((((((( Other removals* ))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\programdata\STOPzilla!
c:\programdata\STOPzilla!\modules_scanned.db
c:\programdata\STOPzilla!\modules_scanned.db.bak
c:\programdata\STOPzilla!\scanner.log
c:\programdata\STOPzilla!\userdata.db
c:\programdata\STOPzilla!\vdb\vb-000.vdb
c:\programdata\STOPzilla!\vdb\vb-001.vdb
c:\programdata\STOPzilla!\vdb\vb-002.vdb
c:\programdata\STOPzilla!\vdb\vb-003.vdb
c:\programdata\STOPzilla!\vdb\vb-004.vdb
c:\programdata\STOPzilla!\vdb\vb-005.vdb
c:\programdata\STOPzilla!\vdb\vb-006.vdb
c:\programdata\STOPzilla!\vdb\vb-007.vdb
c:\programdata\STOPzilla!\vdb\vb-008.vdb
c:\programdata\STOPzilla!\vdb\vb-009.vdb
c:\programdata\STOPzilla!\vdb\vb-010.vdb
c:\programdata\STOPzilla!\vdb\vb-011.vdb
c:\programdata\STOPzilla!\vdb\vb-012.vdb
c:\programdata\STOPzilla!\vdb\vb-013.vdb
c:\programdata\STOPzilla!\vdb\vb-014.vdb
c:\programdata\STOPzilla!\vdb\vb-015.vdb
c:\programdata\STOPzilla!\vdb\vb-016.vdb
c:\programdata\STOPzilla!\vdb\vb-017.vdb
c:\programdata\STOPzilla!\vdb\vb-018.vdb
c:\programdata\STOPzilla!\vdb\vb-019.vdb
c:\programdata\STOPzilla!\vdb\vb-020.vdb
c:\programdata\STOPzilla!\vdb\vb-021.vdb
c:\programdata\STOPzilla!\vdb\vb-022.vdb
c:\programdata\STOPzilla!\vdb\vb-023.vdb
c:\programdata\STOPzilla!\vdb\vb-024.vdb
c:\programdata\STOPzilla!\vdb\vb-025.vdb
c:\programdata\STOPzilla!\vdb\vb-026.vdb
c:\programdata\STOPzilla!\vdb\vb-027.vdb
c:\programdata\STOPzilla!\vdb\vb-028.vdb
c:\programdata\STOPzilla!\vdb\vb-029.vdb
c:\programdata\STOPzilla!\vdb\vb-030.vdb
c:\programdata\STOPzilla!\vdb\vb-031.vdb
c:\programdata\STOPzilla!\vdb\vb-032.vdb
c:\programdata\STOPzilla!\vdb\vb-033.vdb
c:\programdata\STOPzilla!\vdb\vb-034.vdb
c:\programdata\STOPzilla!\vdb\vb-035.vdb
c:\programdata\STOPzilla!\vdb\vb-036.vdb
c:\programdata\STOPzilla!\vdb\vb-037.vdb
c:\programdata\STOPzilla!\vdb\vb-038.vdb
c:\programdata\STOPzilla!\vdb\vb-039.vdb
c:\programdata\STOPzilla!\vdb\vb-040.vdb
c:\programdata\STOPzilla!\vdb\vb-041.vdb
c:\programdata\STOPzilla!\vdb\vb-042.vdb
c:\programdata\STOPzilla!\vdb\vb-043.vdb
c:\programdata\STOPzilla!\vdb\vb-044.vdb
c:\programdata\STOPzilla!\vdb\vb-045.vdb
c:\programdata\STOPzilla!\vdb\vb-046.vdb
c:\programdata\STOPzilla!\vdb\vb-047.vdb
c:\programdata\STOPzilla!\vdb\vb-048.vdb
c:\programdata\STOPzilla!\vdb\vb-049.vdb
c:\programdata\STOPzilla!\vdb\vb-050.vdb
c:\programdata\STOPzilla!\vdb\vb-051.vdb
c:\programdata\STOPzilla!\vdb\vb-052.vdb
c:\programdata\STOPzilla!\vdb\vb-053.vdb
c:\programdata\STOPzilla!\vdb\vb-054.vdb
c:\programdata\STOPzilla!\vdb\vb-055.vdb
c:\programdata\STOPzilla!\vdb\vb-056.vdb
c:\programdata\STOPzilla!\vdb\vb-057.vdb
c:\programdata\STOPzilla!\vdb\vb-058.vdb
c:\programdata\STOPzilla!\vdb\vb-059.vdb
c:\programdata\STOPzilla!\vdb\vb-060.vdb
c:\programdata\STOPzilla!\vdb\vb-061.vdb
c:\programdata\STOPzilla!\vdb\vb-062.vdb
c:\programdata\STOPzilla!\vdb\vb-063.vdb
c:\programdata\STOPzilla!\vdb\vb-064.vdb
c:\programdata\STOPzilla!\vdb\vb-065.vdb
c:\programdata\STOPzilla!\vdb\vb-066.vdb
c:\programdata\STOPzilla!\vdb\vb-067.vdb
c:\programdata\STOPzilla!\vdb\vb-068.vdb
c:\programdata\STOPzilla!\vdb\vb-069.vdb
c:\programdata\STOPzilla!\vdb\vb-070.vdb
c:\programdata\STOPzilla!\vdb\vb-071.vdb
c:\programdata\STOPzilla!\vdb\vb-072.vdb
c:\programdata\STOPzilla!\vdb\vb-073.vdb
c:\programdata\STOPzilla!\vdb\vb-074.vdb
c:\programdata\STOPzilla!\vdb\vb-075.vdb
c:\programdata\STOPzilla!\vdb\vb-076.vdb
c:\programdata\STOPzilla!\vdb\vb-077.vdb
c:\programdata\STOPzilla!\vdb\vb-078.vdb
c:\programdata\STOPzilla!\vdb\vb-079.vdb
c:\programdata\STOPzilla!\vdb\vb-080.vdb
c:\programdata\STOPzilla!\vdb\vb-081.vdb
c:\programdata\STOPzilla!\vdb\vb-082.vdb
c:\programdata\STOPzilla!\vdb\vb-083.vdb
c:\programdata\STOPzilla!\vdb\vb-084.vdb
c:\programdata\STOPzilla!\vdb\vb-085.vdb
c:\programdata\STOPzilla!\vdb\vb-086.vdb
c:\programdata\STOPzilla!\vdb\vb-087.vdb
c:\programdata\STOPzilla!\vdb\vb-088.vdb
c:\programdata\STOPzilla!\vdb\vb-089.vdb
c:\programdata\STOPzilla!\vdb\vb-090.vdb
c:\programdata\STOPzilla!\vdb\vb-091.vdb
c:\programdata\STOPzilla!\vdb\vb-092.vdb
c:\programdata\STOPzilla!\vdb\vb-093.vdb
c:\programdata\STOPzilla!\vdb\vb-094.vdb
c:\programdata\STOPzilla!\vdb\vb-095.vdb
c:\programdata\STOPzilla!\vdb\vb-096.vdb
c:\programdata\STOPzilla!\vdb\vb-097.vdb
c:\programdata\STOPzilla!\vdb\vb-098.vdb
c:\programdata\STOPzilla!\vdb\vb-099.vdb
c:\programdata\STOPzilla!\vdb\vb-100.vdb
c:\programdata\STOPzilla!\vdb\vb-101.vdb
c:\programdata\STOPzilla!\vdb\vb-102.vdb
c:\programdata\STOPzilla!\vdb\vb-103.vdb
c:\programdata\STOPzilla!\vdb\vbcorent.dll
c:\programdata\STOPzilla!\vdb\vdb.xml
c:\programdata\STOPzilla!\vdb\xml_edk.log
c:\programdata\STOPzilla!\zilla5.log
c:\users\Tuure\AppData\Roaming\Registry Mechanic
c:\users\Tuure\AppData\Roaming\Registry Mechanic\SystemReport.txt
c:\windows\winstart.bat
.
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services* )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Legacy_SZKG5
-------\Service_is3srv
-------\Service_szkg5
.
.
((((( Files created within the following timeframe*: 2011-07-20 to 2011-08-20 )))))))))))))))))
.
.
2011-08-20 17:08 . 2011-08-20 17:08 -------- d-----w- c:\users\Default\AppData\Local\temp
2011-08-19 09:45 . 2011-07-04 11:36 288088 ----a-w- c:\windows\system32\drivers\aswSP.sys
2011-08-19 09:45 . 2011-07-04 11:32 22360 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2011-08-19 09:45 . 2011-07-04 11:32 31064 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2011-08-19 09:45 . 2011-07-04 11:35 45400 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2011-08-19 09:45 . 2011-07-04 11:36 600920 ----a-w- c:\windows\system32\drivers\aswSnx.sys
2011-08-19 09:45 . 2011-07-04 11:43 253888 ----a-w- c:\windows\system32\aswBoot.exe
2011-08-19 09:45 . 2011-07-04 11:32 64856 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys
2011-08-19 09:44 . 2011-07-04 11:43 40112 ----a-w- c:\windows\avastSS.scr
2011-08-19 09:44 . 2011-07-04 11:43 199304 ----a-w- c:\windows\SysWow64\aswBoot.exe
2011-08-19 09:44 . 2011-08-19 09:44 -------- d-----w- c:\programdata\AVAST Software
2011-08-19 09:44 . 2011-08-19 09:44 -------- d-----w- c:\program files\AVAST Software
2011-08-19 09:01 . 2011-08-19 09:30 27256 ----a-w- c:\windows\system32\drivers\FixTDSS.sys
2011-08-19 09:01 . 2011-08-19 09:01 -------- d-----w- c:\users\Tuure\AppData\Roaming\FixTDSS
2011-08-18 09:49 . 2011-08-20 16:47 -------- d-----w- c:\program files (x86)\Steam
2011-08-16 11:59 . 2011-08-16 12:00 -------- d-----w- c:\program files\CCleaner
2011-08-16 09:26 . 2011-08-19 09:29 -------- d-----w- c:\program files (x86)\UnHackMe
2011-08-16 08:24 . 2011-08-16 08:24 -------- d-----w- c:\windows\system32\SPReview
2011-08-16 08:23 . 2011-08-16 08:23 -------- d-----w- c:\windows\system32\EventProviders
2011-08-16 06:20 . 2011-08-16 06:20 -------- d-----w- c:\users\Tuure\AppData\Roaming\F-Secure
2011-08-15 12:07 . 2010-04-29 12:46 122624 ----a-w- c:\windows\system32\drivers\zgwhsnmea.sys
2011-08-15 12:07 . 2010-04-29 12:46 122624 ----a-w- c:\windows\system32\drivers\zgwhsmdm.sys
2011-08-15 12:07 . 2010-04-29 12:46 122624 ----a-w- c:\windows\system32\drivers\zgwhsdiag.sys
2011-08-15 12:07 . 2009-06-30 14:47 31744 ----a-w- c:\windows\system32\drivers\androidusb.sys
2011-08-15 12:07 . 2011-08-15 12:07 -------- d---a-w- c:\users\Tuure\.android
2011-08-15 12:07 . 2011-08-15 12:07 -------- d-----w- c:\program files (x86)\ZTE Smartphone Driver
2011-08-13 09:51 . 2011-08-13 09:51 -------- d-----w- c:\users\Tuure\AppData\Roaming\Template
2011-08-12 08:31 . 2010-01-05 09:44 96256 ----a-w- c:\windows\AdbWinApi.dll
2011-08-11 06:48 . 2011-06-23 04:33 3912576 ----a-w- c:\windows\SysWow64\ntoskrnl.exe
2011-08-11 06:48 . 2011-06-23 05:43 5561216 ----a-w- c:\windows\system32\ntoskrnl.exe
2011-08-11 06:48 . 2011-06-23 04:33 3967872 ----a-w- c:\windows\SysWow64\ntkrnlpa.exe
2011-08-06 17:30 . 2011-08-06 17:30 -------- d-----w- c:\users\Tuure\AppData\Roaming\Malwarebytes
2011-08-06 17:30 . 2011-07-06 16:52 41272 ----a-w- c:\windows\SysWow64\drivers\mbamswissarmy.sys
2011-08-06 17:30 . 2011-08-06 17:30 -------- d-----w- c:\programdata\Malwarebytes
2011-08-06 17:30 . 2011-07-06 16:52 25912 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-08-06 17:30 . 2011-08-06 17:30 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware
2011-08-05 07:29 . 2011-08-05 07:30 -------- d-----w- c:\program files (x86)\Microsoft WebMatrix
2011-08-05 07:26 . 2011-08-05 07:26 -------- d-----w- c:\program files\Microsoft SQL Server
2011-08-05 07:26 . 2011-08-05 07:26 -------- d-----w- c:\windows\system32\1033
2011-08-05 07:26 . 2011-08-05 07:26 -------- d-----w- c:\windows\SysWow64\1033
2011-08-05 07:24 . 2011-08-05 07:24 -------- d-----w- c:\program files (x86)\Microsoft SQL Server
2011-08-05 07:23 . 2011-08-05 07:23 -------- d-----w- c:\program files (x86)\IIS Express
2011-08-05 07:22 . 2011-08-05 07:22 -------- d-----w- c:\program files\IIS
2011-08-05 07:22 . 2011-08-05 07:22 -------- d-----w- c:\program files (x86)\IIS
2011-08-05 07:21 . 2011-08-05 07:21 -------- d-----w- c:\program files\Microsoft SQL Server Compact Edition
2011-08-05 07:19 . 2011-08-05 07:19 -------- d-----w- c:\program files (x86)\Microsoft ASP.NET
2011-08-05 07:10 . 2011-08-05 07:10 -------- d-----w- c:\program files\Microsoft
2011-08-04 12:01 . 2011-08-06 20:39 -------- d-----w- c:\program files (x86)\Emsisoft Anti-Malware
2011-07-31 17:01 . 2011-08-16 12:06 -------- d-----w- c:\programdata\Spybot - Search & Destroy
2011-07-31 17:01 . 2011-07-31 17:01 -------- d-----w- c:\program files (x86)\Spybot - Search & Destroy
2011-07-31 12:21 . 2011-07-31 12:17 55384 ----a-w- c:\windows\system32\drivers\SBREDrv.sys
2011-07-31 12:17 . 2011-07-21 11:59 69376 ----a-w- c:\windows\system32\drivers\Lbd.sys
2011-07-31 12:17 . 2011-07-31 12:17 -------- d-----w- c:\programdata\Lavasoft
2011-07-31 12:17 . 2011-07-31 12:17 -------- d-----w- c:\program files (x86)\Lavasoft
2011-07-29 07:34 . 2011-07-13 04:53 8578896 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{EF8C2106-FAD5-44B9-A801-BDA8F4FD5AC7}\mpengine.dll
2011-07-27 15:26 . 2011-07-27 15:26 69120 --sha-r- c:\windows\SysWow64\dmrct.dll
2011-07-24 09:14 . 2011-07-24 09:14 -------- d-----w- c:\program files\iTunes
2011-07-24 09:14 . 2011-07-24 09:14 -------- d-----w- c:\program files\iPod
2011-07-24 09:11 . 2011-07-24 09:11 -------- d-----w- c:\program files\Bonjour
2011-07-24 09:11 . 2011-07-24 09:11 -------- d-----w- c:\program files (x86)\Bonjour
2011-07-24 09:04 . 2011-07-24 09:04 -------- d-----w- c:\program files (x86)\Apple Software Update
2011-07-23 18:44 . 2011-07-23 18:44 -------- d-----w- c:\program files\Blender Foundation
2011-07-22 20:51 . 2011-07-22 20:51 94208 ----a-w- c:\windows\SysWow64\dpl100.dll
.
.
.
(((((((((((((((((((((((((((((((((((( Find3M-report* ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-08-17 08:53 . 2010-05-26 14:50 42672 ----a-w- c:\windows\SysWow64\drivers\fsbts.sys
2011-08-16 08:43 . 2009-07-14 02:36 152576 ----a-w- c:\windows\SysWow64\msclmd.dll
2011-08-16 08:43 . 2009-07-14 02:36 175616 ----a-w- c:\windows\system32\msclmd.dll
2011-08-15 09:34 . 2011-06-29 05:28 404640 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2011-07-16 04:26 . 2011-08-11 06:50 44032 ----a-w- c:\windows\apppatch\acwow64.dll
2011-07-12 08:34 . 2011-07-12 08:34 96104 ----a-w- c:\windows\system32\dns-sd.exe
2011-07-12 08:34 . 2011-07-12 08:34 85864 ----a-w- c:\windows\system32\dnssd.dll
2011-07-12 08:20 . 2011-07-12 08:20 83816 ----a-w- c:\windows\SysWow64\dns-sd.exe
2011-07-12 08:20 . 2011-07-12 08:20 73064 ----a-w- c:\windows\SysWow64\dnssd.dll
2011-06-23 10:26 . 2011-07-11 12:00 1700352 ----a-w- c:\windows\SysWow64\GdiPlus.dll
2011-06-23 10:25 . 2011-07-11 12:00 24576 ----a-w- c:\windows\SysWow64\msxml3a.dll
2011-06-23 10:18 . 2011-07-11 12:01 10915840 ----a-w- c:\windows\SysWow64\libmfxhw32.dll
2011-06-23 10:18 . 2011-07-11 12:01 10833920 ----a-w- c:\windows\SysWow64\libmfxsw32.dll
2011-06-11 03:07 . 2011-07-13 17:51 3137536 ----a-w- c:\windows\system32\win32k.sys
2011-05-24 16:14 . 2010-05-26 15:14 270720 ------w- c:\windows\system32\MpSigStub.exe
2011-05-24 11:42 . 2011-06-29 05:26 404480 ----a-w- c:\windows\system32\umpnpmgr.dll
2011-05-24 10:40 . 2011-06-29 05:26 64512 ----a-w- c:\windows\SysWow64\devobj.dll
2011-05-24 10:40 . 2011-06-29 05:26 44544 ----a-w- c:\windows\SysWow64\devrtl.dll
2011-05-24 10:39 . 2011-06-29 05:26 145920 ----a-w- c:\windows\SysWow64\cfgmgr32.dll
2011-05-24 10:37 . 2011-06-29 05:26 252928 ----a-w- c:\windows\SysWow64\drvinst.exe
.
.
((((((((((((((((((((((((((((( SnapShot@2011-08-20_09.56.43 )))))))))))))))))))))))))))))))))))))))))
.
- 2009-07-14 04:54 . 2011-08-20 09:53 16384 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2009-07-14 04:54 . 2011-08-20 17:10 16384 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2009-07-14 04:54 . 2011-08-20 17:10 32768 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2009-07-14 04:54 . 2011-08-20 09:53 32768 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2009-07-14 04:54 . 2011-08-20 09:53 16384 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2009-07-14 04:54 . 2011-08-20 17:10 16384 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2009-07-14 05:10 . 2011-08-20 17:12 43118 c:\windows\system32\wdi\BootPerformanceDiagnostics_SystemData.bin
+ 2010-05-26 14:18 . 2011-08-20 17:12 16126 c:\windows\system32\wdi\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-3425611528-2409934986-2553978045-1000_UserData.bin
+ 2009-07-14 04:46 . 2011-08-20 11:12 94640 c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\SoftwareProtectionPlatform\Cache\cache.dat
- 2011-08-20 09:17 . 2011-08-20 09:53 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
+ 2011-08-20 17:10 . 2011-08-20 17:10 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
+ 2011-08-20 17:10 . 2011-08-20 17:10 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
- 2011-08-20 09:17 . 2011-08-20 09:53 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
+ 2010-05-27 13:41 . 2011-08-20 13:35 501654 c:\windows\system32\wdi\SuspendPerformanceDiagnostics_SystemData_FastS4.bin
+ 2009-07-14 02:36 . 2011-08-20 16:43 654766 c:\windows\system32\perfh009.dat
+ 2009-07-14 02:36 . 2011-08-20 16:43 122296 c:\windows\system32\perfc009.dat
+ 2009-07-14 05:01 . 2011-08-20 17:09 434204 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat
- 2009-07-14 05:01 . 2011-08-19 09:30 434204 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat
- 2010-05-27 22:25 . 2011-08-19 09:30 4419600 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-3425611528-2409934986-2553978045-1000-8192.dat
+ 2010-05-27 22:25 . 2011-08-20 17:09 4419600 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-3425611528-2409934986-2553978045-1000-8192.dat
.
(((((((((((((((((((((((((((((( Registry stratup objects* )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Empty values and default values not displayed*
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"googletalk "= "c:\users\Tuure\AppData\Roaming\Google\Google Talk\googletalk.exe" [2007-01-01 3739648]
"SpybotSD TeaTimer "= "c:\program files (x86)\Spybot - Search & Destroy\TeaTimer.exe" [2009-01-26 2144088]
"Steam "= "c:\program files (x86)\Steam\Steam.exe" [2011-08-18 1242448]
"Sidebar "= "c:\program files\Windows Sidebar\sidebar.exe" [2010-11-20 1475584]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"hpsysdrv "= "c:\program files (x86)\hewlett-packard\HP odometer\hpsysdrv.exe" [2008-11-20 62768]
"HP Software Update "= "c:\program files (x86)\HP\HP Software Update\HPWuSchd2.exe" [2008-12-08 54576]
"NortonOnlineBackupReminder "= "c:\program files (x86)\Symantec\Norton Online Backup\Activation\NobuActivation.exe" [2009-06-29 600936]
"Easybits Recovery "= "c:\program files (x86)\EasyBits For Kids\ezRecover.exe" [2009-09-02 60464]
"DigidesignMMERefresh "= "c:\program files (x86)\Digidesign\Drivers\MMERefresh.exe" [2009-06-18 77824]
"QuickTime Task "= "c:\program files (x86)\QuickTime\QTTask.exe" [2010-11-29 421888]
"Google Desktop Search "= "c:\program files (x86)\Google\Google Desktop Search\GoogleDesktop.exe" [2011-01-28 30192]
"VoddlerNet Manager "= "c:\program files (x86)\Voddler\service\VNetManager.exe" [2011-02-09 676040]
"AdobeCS5ServiceManager "= "c:\program files (x86)\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe" [2010-02-22 406992]
"Adobe Reader Speed Launcher "= "c:\program files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2011-06-08 37296]
"Adobe ARM "= "c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-03-30 937920]
"SunJavaUpdateSched "= "c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2011-04-08 254696]
"iTunesHelper "= "c:\program files (x86)\iTunes\iTunesHelper.exe" [2011-07-19 421736]
"Malwarebytes' Anti-Malware "= "c:\program files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" [2011-07-06 449584]
"DivXUpdate "= "c:\program files (x86)\DivX\DivX Update\DivXUpdate.exe" [2011-07-28 1259376]
"avast "= "c:\program files\AVAST Software\Avast\avastUI.exe" [2011-07-04 3493720]
.
c:\users\Tuure\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OpenOffice.org 3.2.lnk - c:\program files (x86)\OpenOffice.org 3\program\quickstart.exe [2009-12-15 384000]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin "= 5 (0x5)
"ConsentPromptBehaviorUser "= 3 (0x3)
"EnableUIADesktopToggle "= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"ForceActiveDesktopOn "= 0 (0x0)
.
[hkey_local_machine\software\Wow6432Node\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs "=c:\progra~2\Google\GOOGLE~2\GoogleDesktopNetwork3.dll
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
SetupExecute REG_MULTI_SZ \0
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@= "Service "
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 gupdate;Google-päivityspalvelu (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-10-17 136176]
R2 MsDepSvc;Web Deployment Agent Service;c:\program files\IIS\Microsoft Web Deploy\MsDepSvc.exe [2011-04-01 67400]
R3 androidusb;ADB Interface Driver;c:\windows\system32\Drivers\androidusb.sys [x]
R3 GoogleDesktopManager-051210-111108;Google Desktop Manager 5.9.1005.12335;c:\program files (x86)\Google\Google Desktop Search\GoogleDesktop.exe [2011-01-28 30192]
R3 gupdatem;Google Päivitä-palvelu (gupdatem);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-10-17 136176]
R3 MAUSBFASTTRACK;Service for M-Audio FastTrack;c:\windows\system32\DRIVERS\MAudioFastTrack.sys [x]
R3 SynUSB64;SynUSB64;c:\windows\system32\DRIVERS\SynUSB64.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [x]
R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [x]
R3 zgwhsmdm;ZTE WCDMA Handset USB Modem;c:\windows\system32\DRIVERS\zgwhsmdm.sys [x]
S0 FixTDSS;TDSS Fixtool driver;c:\windows\system32\drivers\FixTDSS.sys [x]
S0 Lbd;Lbd;c:\windows\system32\DRIVERS\Lbd.sys [x]
S1 a2injectiondriver;a2injectiondriver;c:\program files (x86)\Emsisoft Anti-Malware\a2dix64.sys [2010-09-05 48216]
S1 a2util;a-squared Malware-IDS utility driver;c:\program files (x86)\Emsisoft Anti-Malware\a2util64.sys [2010-05-05 14720]
S1 aswSnx;aswSnx; [x]
S1 aswSP;aswSP; [x]
S1 FSES;F-Secure Email Scanning Driver;c:\windows\system32\drivers\fses.sys [x]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x]
S2 a2AntiMalware;Emsisoft Anti-Malware 5.1 - Service;c:\program files (x86)\Emsisoft Anti-Malware\a2service.exe [2011-06-30 3029208]
S2 Akamai;Akamai NetSession Interface;c:\windows\System32\svchost.exe [2009-07-14 27136]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [x]
S2 Apache2.2;Apache2.2;c:\xampp\apache\bin\httpd.exe [2009-12-19 29416]
S2 aswFsBlk;aswFsBlk; [x]
S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [x]
S2 ezSharedSvc;Easybits Shared Services for Windows;c:\windows\system32\svchost.exe [2009-07-14 27136]
S2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files (x86)\Lavasoft\Ad-Aware\AAWService.exe [2011-07-21 2151640]
S2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2011-07-06 366640]
S2 RichVideo64;Cyberlink RichVideo64 Service(CRVS);c:\program files\CyberLink\Shared files\RichVideo64.exe [2010-08-19 386344]
S2 VoddlerNet;VoddlerNet;c:\program files (x86)\Voddler\service\voddler.exe [2011-02-09 1039640]
S3 a2acc;a2acc;c:\program files (x86)\EMSISOFT ANTI-MALWARE\a2accx64.sys [2011-02-20 85800]
S3 Lavasoft Kernexplorer;Lavasoft helper driver;c:\program files (x86)\Lavasoft\Ad-Aware\KernExplorer64.sys [2011-07-31 17152]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [x]
S3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\DRIVERS\vwifimp.sys [x]
S3 ysusb64;Yamaha Steinberg USB Audio;c:\windows\system32\drivers\ysusb64.sys [x]
.
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost]
Akamai REG_MULTI_SZ Akamai
.
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
ezSharedSvc
.
'Scheduled tasks' folder content*
.
2011-08-20 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- c:\program files (x86)\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2011-07-21 11:59]
.
2011-08-20 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-10-17 11:34]
.
2011-08-20 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-10-17 11:34]
.
2011-08-20 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3425611528-2409934986-2553978045-1000Core.job
- c:\users\Tuure\AppData\Local\Google\Update\GoogleUpdate.exe [2011-08-16 19:49]
.
2011-08-20 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3425611528-2409934986-2553978045-1000UA.job
- c:\users\Tuure\AppData\Local\Google\Update\GoogleUpdate.exe [2011-08-16 19:49]
.
2011-06-30 c:\windows\Tasks\PCDRScheduledMaintenance.job
- c:\program files\PC-Doctor for Windows\pcdrcui.exe [2009-09-18 07:11]
.
.
--------- x86-64 -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@= "{472083B0-C522-11CF-8763-00608CC02F24} "
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2011-07-04 11:43 134384 ----a-w- c:\program files\AVAST Software\Avast\ashShA64.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"combofix "= "c:\combofix\CF163.cfxxe" [X]
"IgfxTray "= "c:\windows\system32\igfxtray.exe" [2009-09-18 165912]
"HotKeysCmds "= "c:\windows\system32\hkcmd.exe" [2009-09-18 387608]
"Persistence "= "c:\windows\system32\igfxpers.exe" [2009-09-18 365592]
"PC-Doctor for Windows localizer "= "c:\program files\PC-Doctor for Windows\localizer.exe" [2009-09-17 95728]
"M-Audio Taskbar Icon "= "c:\windows\system32\M-AudioTaskBarIcon.exe" [2010-12-07 798728]
"AdobeAAMUpdater-1.0 "= "c:\program files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2010-03-06 500208]
.
------- Supplementary check* -------
.
uStart Page = https://plus.google.com/up/start/?continue=https://plus.google.com/&type=st&gpcaz=9ee2dfee&hl=en
uLocal Page = c:\windows\system32\blank.htm
mDefault_Page_URL = hxxp://www.bing.com
mStart Page = hxxp://www.bing.com
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = *.local
FF - ProfilePath - c:\users\Tuure\AppData\Roaming\Mozilla\Firefox\Profiles\nehk9mos.default\
FF - prefs.js: browser.startup.homepage - hxxps://plus.google.com/?hl=en
.
- - - - DELETED EXCESS LINES* - - - -
.
Wow6432Node-HKLM-Run-<NO NAME> - (no file)
.
.
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\MsDepSvc]
"ImagePath "= "\ "c:\program files\IIS\Microsoft Web Deploy\MsDepSvc.exe\" -runService:MsDepSvc "
"ImagePath "= "\ "c:\program files\CyberLink\Shared files\RichVideo64.exe\ "\00Z
[\]^_À\00\00À\00\00\00\00HIJKLMNO\00\00\00\00\00\00\00\00\03\00\00\00|}~À\00\00À\00\00\00\00r\00\00\00\00\00\00\00\00‘’“ "
.
.
--------------------- LOCKED REGISTRY KEYS* ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@= "FlashBroker "
"LocalizedString "= "@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10v_ActiveX.exe,-101 "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled "=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@= "c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10v_ActiveX.exe "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@= "{FAB3E735-69C7-453B-A446-B6823C6DF1C9} "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@= "Shockwave Flash Object "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@= "c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10v.ocx "
"ThreadingModel "= "Apartment "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@= "0 "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@= "ShockwaveFlash.ShockwaveFlash.10 "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@= "c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10v.ocx, 1 "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@= "{D27CDB6B-AE6D-11cf-96B8-444553540000} "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@= "1.0 "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@= "ShockwaveFlash.ShockwaveFlash "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@= "Macromedia Flash Factory Object "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@= "c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10v.ocx "
"ThreadingModel "= "Apartment "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@= "FlashFactory.FlashFactory.1 "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@= "c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10v.ocx, 1 "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@= "{D27CDB6B-AE6D-11cf-96B8-444553540000} "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@= "1.0 "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@= "FlashFactory.FlashFactory "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@= "IFlashBroker4 "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@= "{00020424-0000-0000-C000-000000000046} "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@= "{FAB3E735-69C7-453B-A446-B6823C6DF1C9} "
"Version "= "1.0 "
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial "=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial "=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Other processes* ------------------------
.
c:\program files\AVAST Software\Avast\AvastSvc.exe
c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files (x86)\Bonjour\mDNSResponder.exe
c:\program files (x86)\Common Files\LightScribe\LSSrvc.exe
c:\xampp\mysql\bin\mysqld.exe
c:\program files (x86)\Lavasoft\Ad-Aware\AAWTray.exe
.
**************************************************************************
.
Time of completion*: 2011-08-20 20:22:33 - computer rebooted*
ComboFix-quarantined-files.txt 2011-08-20 17:22
ComboFix2.txt 2011-08-20 10:08
.
Before run*: 349*431*541*760 bytes free
After run*: 349*230*473*216 bytes free
.
- - End Of File - - F0BA71F4A294A8097CD46E1AE1A7CA47

 

I tried searches with Firefox and Chrome, and everything seems to be normal! I even googled "goingonearth ", which used to lead to bogus search results 100% of the time.

Here's the output of the latest scan. This time Combofix didn't say that I was running an anti-virus program.




ComboFix 11-08-21.01 - Tuure 21.08.2011 9:33.4.2 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.358.1033.18.2047.583 [GMT 3:00]
Location*: c:\users\Tuure\Desktop\ComboFix.exe
Command line options* :: c:\users\Tuure\Desktop\CFScript.txt
AV: avast! Antivirus *Disabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}
AV: Emsisoft Anti-Malware *Disabled/Outdated* {0ADC9F7D-20C1-240F-01E2-43466EBA893A}
AV: Lavasoft Ad-Watch Live! Anti-Virus *Disabled/Updated* {9FF26384-70D4-CE6B-3ECB-E759A6A40116}
SP: avast! Antivirus *Disabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681}
SP: Emsisoft Anti-Malware *Disabled/Outdated* {B1BD7E99-06FB-2B81-3B52-7834153DC387}
SP: Lavasoft Ad-Watch Live! *Disabled/Updated* {24938260-56EE-C1E5-047B-DC2BDD234BAB}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* New recovery point created*
.
FILE ::
"c:\windows\SysWow64\dmrct.dll "
.
.
(((((((((((((((((((((((((((((((((((((( Other removals* ))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\SysWow64\dmrct.dll
.
.
((((( Files created within the timeframe*: 2011-07-21 to 2011-08-21 )))))))))))))))))
.
.
2011-08-21 06:46 . 2011-08-21 06:46 -------- d-----w- c:\users\Default\AppData\Local\temp
2011-08-19 09:45 . 2011-07-04 11:36 288088 ----a-w- c:\windows\system32\drivers\aswSP.sys
2011-08-19 09:45 . 2011-07-04 11:32 22360 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2011-08-19 09:45 . 2011-07-04 11:32 31064 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2011-08-19 09:45 . 2011-07-04 11:35 45400 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2011-08-19 09:45 . 2011-07-04 11:36 600920 ----a-w- c:\windows\system32\drivers\aswSnx.sys
2011-08-19 09:45 . 2011-07-04 11:43 253888 ----a-w- c:\windows\system32\aswBoot.exe
2011-08-19 09:45 . 2011-07-04 11:32 64856 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys
2011-08-19 09:44 . 2011-07-04 11:43 40112 ----a-w- c:\windows\avastSS.scr
2011-08-19 09:44 . 2011-07-04 11:43 199304 ----a-w- c:\windows\SysWow64\aswBoot.exe
2011-08-19 09:44 . 2011-08-19 09:44 -------- d-----w- c:\programdata\AVAST Software
2011-08-19 09:44 . 2011-08-19 09:44 -------- d-----w- c:\program files\AVAST Software
2011-08-19 09:01 . 2011-08-19 09:30 27256 ----a-w- c:\windows\system32\drivers\FixTDSS.sys
2011-08-19 09:01 . 2011-08-19 09:01 -------- d-----w- c:\users\Tuure\AppData\Roaming\FixTDSS
2011-08-18 09:49 . 2011-08-21 06:14 -------- d-----w- c:\program files (x86)\Steam
2011-08-16 11:59 . 2011-08-16 12:00 -------- d-----w- c:\program files\CCleaner
2011-08-16 09:26 . 2011-08-19 09:29 -------- d-----w- c:\program files (x86)\UnHackMe
2011-08-16 08:24 . 2011-08-16 08:24 -------- d-----w- c:\windows\system32\SPReview
2011-08-16 08:23 . 2011-08-16 08:23 -------- d-----w- c:\windows\system32\EventProviders
2011-08-16 06:20 . 2011-08-16 06:20 -------- d-----w- c:\users\Tuure\AppData\Roaming\F-Secure
2011-08-15 12:07 . 2010-04-29 12:46 122624 ----a-w- c:\windows\system32\drivers\zgwhsnmea.sys
2011-08-15 12:07 . 2010-04-29 12:46 122624 ----a-w- c:\windows\system32\drivers\zgwhsmdm.sys
2011-08-15 12:07 . 2010-04-29 12:46 122624 ----a-w- c:\windows\system32\drivers\zgwhsdiag.sys
2011-08-15 12:07 . 2009-06-30 14:47 31744 ----a-w- c:\windows\system32\drivers\androidusb.sys
2011-08-15 12:07 . 2011-08-15 12:07 -------- d---a-w- c:\users\Tuure\.android
2011-08-15 12:07 . 2011-08-15 12:07 -------- d-----w- c:\program files (x86)\ZTE Smartphone Driver
2011-08-13 09:51 . 2011-08-13 09:51 -------- d-----w- c:\users\Tuure\AppData\Roaming\Template
2011-08-12 08:31 . 2010-01-05 09:44 96256 ----a-w- c:\windows\AdbWinApi.dll
2011-08-11 06:48 . 2011-06-23 04:33 3912576 ----a-w- c:\windows\SysWow64\ntoskrnl.exe
2011-08-11 06:48 . 2011-06-23 05:43 5561216 ----a-w- c:\windows\system32\ntoskrnl.exe
2011-08-11 06:48 . 2011-06-23 04:33 3967872 ----a-w- c:\windows\SysWow64\ntkrnlpa.exe
2011-08-06 17:30 . 2011-08-06 17:30 -------- d-----w- c:\users\Tuure\AppData\Roaming\Malwarebytes
2011-08-06 17:30 . 2011-07-06 16:52 41272 ----a-w- c:\windows\SysWow64\drivers\mbamswissarmy.sys
2011-08-06 17:30 . 2011-08-06 17:30 -------- d-----w- c:\programdata\Malwarebytes
2011-08-06 17:30 . 2011-07-06 16:52 25912 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-08-06 17:30 . 2011-08-06 17:30 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware
2011-08-05 07:29 . 2011-08-05 07:30 -------- d-----w- c:\program files (x86)\Microsoft WebMatrix
2011-08-05 07:26 . 2011-08-05 07:26 -------- d-----w- c:\program files\Microsoft SQL Server
2011-08-05 07:26 . 2011-08-05 07:26 -------- d-----w- c:\windows\system32\1033
2011-08-05 07:26 . 2011-08-05 07:26 -------- d-----w- c:\windows\SysWow64\1033
2011-08-05 07:24 . 2011-08-05 07:24 -------- d-----w- c:\program files (x86)\Microsoft SQL Server
2011-08-05 07:23 . 2011-08-05 07:23 -------- d-----w- c:\program files (x86)\IIS Express
2011-08-05 07:22 . 2011-08-05 07:22 -------- d-----w- c:\program files\IIS
2011-08-05 07:22 . 2011-08-05 07:22 -------- d-----w- c:\program files (x86)\IIS
2011-08-05 07:21 . 2011-08-05 07:21 -------- d-----w- c:\program files\Microsoft SQL Server Compact Edition
2011-08-05 07:19 . 2011-08-05 07:19 -------- d-----w- c:\program files (x86)\Microsoft ASP.NET
2011-08-05 07:10 . 2011-08-05 07:10 -------- d-----w- c:\program files\Microsoft
2011-08-04 12:01 . 2011-08-06 20:39 -------- d-----w- c:\program files (x86)\Emsisoft Anti-Malware
2011-07-31 17:01 . 2011-08-16 12:06 -------- d-----w- c:\programdata\Spybot - Search & Destroy
2011-07-31 17:01 . 2011-07-31 17:01 -------- d-----w- c:\program files (x86)\Spybot - Search & Destroy
2011-07-31 12:21 . 2011-07-31 12:17 55384 ----a-w- c:\windows\system32\drivers\SBREDrv.sys
2011-07-31 12:17 . 2011-07-21 11:59 69376 ----a-w- c:\windows\system32\drivers\Lbd.sys
2011-07-31 12:17 . 2011-07-31 12:17 -------- d-----w- c:\programdata\Lavasoft
2011-07-31 12:17 . 2011-07-31 12:17 -------- d-----w- c:\program files (x86)\Lavasoft
2011-07-29 07:34 . 2011-07-13 04:53 8578896 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{EF8C2106-FAD5-44B9-A801-BDA8F4FD5AC7}\mpengine.dll
2011-07-24 09:14 . 2011-07-24 09:14 -------- d-----w- c:\program files\iTunes
2011-07-24 09:14 . 2011-07-24 09:14 -------- d-----w- c:\program files\iPod
2011-07-24 09:11 . 2011-07-24 09:11 -------- d-----w- c:\program files\Bonjour
2011-07-24 09:11 . 2011-07-24 09:11 -------- d-----w- c:\program files (x86)\Bonjour
2011-07-24 09:04 . 2011-07-24 09:04 -------- d-----w- c:\program files (x86)\Apple Software Update
2011-07-23 18:44 . 2011-07-23 18:44 -------- d-----w- c:\program files\Blender Foundation
2011-07-22 20:51 . 2011-07-22 20:51 94208 ----a-w- c:\windows\SysWow64\dpl100.dll
.
.
.
(((((((((((((((((((((((((((((((((((( Find3M-report* ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-08-17 08:53 . 2010-05-26 14:50 42672 ----a-w- c:\windows\SysWow64\drivers\fsbts.sys
2011-08-16 08:43 . 2009-07-14 02:36 152576 ----a-w- c:\windows\SysWow64\msclmd.dll
2011-08-16 08:43 . 2009-07-14 02:36 175616 ----a-w- c:\windows\system32\msclmd.dll
2011-08-15 09:34 . 2011-06-29 05:28 404640 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2011-07-16 04:26 . 2011-08-11 06:50 44032 ----a-w- c:\windows\apppatch\acwow64.dll
2011-07-12 08:34 . 2011-07-12 08:34 96104 ----a-w- c:\windows\system32\dns-sd.exe
2011-07-12 08:34 . 2011-07-12 08:34 85864 ----a-w- c:\windows\system32\dnssd.dll
2011-07-12 08:20 . 2011-07-12 08:20 83816 ----a-w- c:\windows\SysWow64\dns-sd.exe
2011-07-12 08:20 . 2011-07-12 08:20 73064 ----a-w- c:\windows\SysWow64\dnssd.dll
2011-06-23 10:26 . 2011-07-11 12:00 1700352 ----a-w- c:\windows\SysWow64\GdiPlus.dll
2011-06-23 10:25 . 2011-07-11 12:00 24576 ----a-w- c:\windows\SysWow64\msxml3a.dll
2011-06-23 10:18 . 2011-07-11 12:01 10915840 ----a-w- c:\windows\SysWow64\libmfxhw32.dll
2011-06-23 10:18 . 2011-07-11 12:01 10833920 ----a-w- c:\windows\SysWow64\libmfxsw32.dll
2011-06-11 03:07 . 2011-07-13 17:51 3137536 ----a-w- c:\windows\system32\win32k.sys
2011-05-24 16:14 . 2010-05-26 15:14 270720 ------w- c:\windows\system32\MpSigStub.exe
2011-05-24 11:42 . 2011-06-29 05:26 404480 ----a-w- c:\windows\system32\umpnpmgr.dll
2011-05-24 10:40 . 2011-06-29 05:26 64512 ----a-w- c:\windows\SysWow64\devobj.dll
2011-05-24 10:40 . 2011-06-29 05:26 44544 ----a-w- c:\windows\SysWow64\devrtl.dll
2011-05-24 10:39 . 2011-06-29 05:26 145920 ----a-w- c:\windows\SysWow64\cfgmgr32.dll
2011-05-24 10:37 . 2011-06-29 05:26 252928 ----a-w- c:\windows\SysWow64\drvinst.exe
.
.
((((((((((((((((((((((((((((( SnapShot@2011-08-20_09.56.43 )))))))))))))))))))))))))))))))))))))))))
.
- 2009-07-14 04:54 . 2011-08-20 09:53 16384 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2009-07-14 04:54 . 2011-08-21 06:47 16384 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2009-07-14 04:54 . 2011-08-21 06:47 32768 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2009-07-14 04:54 . 2011-08-20 09:53 32768 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2009-07-14 04:54 . 2011-08-20 09:53 16384 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2009-07-14 04:54 . 2011-08-21 06:47 16384 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2010-03-19 17:34 . 2011-08-21 06:49 46952 c:\windows\system32\wdi\ShutdownPerformanceDiagnostics_SystemData.bin
+ 2009-07-14 05:10 . 2011-08-21 06:49 43222 c:\windows\system32\wdi\BootPerformanceDiagnostics_SystemData.bin
+ 2010-05-26 14:18 . 2011-08-21 06:49 16174 c:\windows\system32\wdi\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-3425611528-2409934986-2553978045-1000_UserData.bin
+ 2009-07-14 04:46 . 2011-08-20 11:12 94640 c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\SoftwareProtectionPlatform\Cache\cache.dat
- 2011-08-20 09:17 . 2011-08-20 09:53 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
+ 2011-08-21 06:47 . 2011-08-21 06:47 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
+ 2011-08-21 06:47 . 2011-08-21 06:47 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
- 2011-08-20 09:17 . 2011-08-20 09:53 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
- 2010-05-27 18:42 . 2011-08-16 09:11 262144 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\IETldCache\index.dat
+ 2010-05-27 18:42 . 2011-08-21 06:47 262144 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\IETldCache\index.dat
+ 2010-05-27 13:41 . 2011-08-20 13:35 501654 c:\windows\system32\wdi\SuspendPerformanceDiagnostics_SystemData_FastS4.bin
+ 2009-07-14 02:36 . 2011-08-20 16:43 654766 c:\windows\system32\perfh009.dat
+ 2009-07-14 02:36 . 2011-08-20 16:43 122296 c:\windows\system32\perfc009.dat
- 2009-07-14 05:01 . 2011-08-19 09:30 434204 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat
+ 2009-07-14 05:01 . 2011-08-21 06:46 434204 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat
- 2010-05-27 22:25 . 2011-08-19 09:30 4419600 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-3425611528-2409934986-2553978045-1000-8192.dat
+ 2010-05-27 22:25 . 2011-08-21 06:46 4419600 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-3425611528-2409934986-2553978045-1000-8192.dat
.
(((((((((((((((((((((((((((((( Registry startup* )))))))))))))))))))))))))))))))))))))))))))))
.
.
Empty values and default values not shown*
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"googletalk "= "c:\users\Tuure\AppData\Roaming\Google\Google Talk\googletalk.exe" [2007-01-01 3739648]
"SpybotSD TeaTimer "= "c:\program files (x86)\Spybot - Search & Destroy\TeaTimer.exe" [2009-01-26 2144088]
"Steam "= "c:\program files (x86)\Steam\Steam.exe" [2011-08-18 1242448]
"Sidebar "= "c:\program files\Windows Sidebar\sidebar.exe" [2010-11-20 1475584]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"hpsysdrv "= "c:\program files (x86)\hewlett-packard\HP odometer\hpsysdrv.exe" [2008-11-20 62768]
"HP Software Update "= "c:\program files (x86)\HP\HP Software Update\HPWuSchd2.exe" [2008-12-08 54576]
"NortonOnlineBackupReminder "= "c:\program files (x86)\Symantec\Norton Online Backup\Activation\NobuActivation.exe" [2009-06-29 600936]
"Easybits Recovery "= "c:\program files (x86)\EasyBits For Kids\ezRecover.exe" [2009-09-02 60464]
"DigidesignMMERefresh "= "c:\program files (x86)\Digidesign\Drivers\MMERefresh.exe" [2009-06-18 77824]
"QuickTime Task "= "c:\program files (x86)\QuickTime\QTTask.exe" [2010-11-29 421888]
"Google Desktop Search "= "c:\program files (x86)\Google\Google Desktop Search\GoogleDesktop.exe" [2011-01-28 30192]
"VoddlerNet Manager "= "c:\program files (x86)\Voddler\service\VNetManager.exe" [2011-02-09 676040]
"AdobeCS5ServiceManager "= "c:\program files (x86)\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe" [2010-02-22 406992]
"Adobe Reader Speed Launcher "= "c:\program files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2011-06-08 37296]
"Adobe ARM "= "c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-03-30 937920]
"SunJavaUpdateSched "= "c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2011-04-08 254696]
"iTunesHelper "= "c:\program files (x86)\iTunes\iTunesHelper.exe" [2011-07-19 421736]
"Malwarebytes' Anti-Malware "= "c:\program files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" [2011-07-06 449584]
"DivXUpdate "= "c:\program files (x86)\DivX\DivX Update\DivXUpdate.exe" [2011-07-28 1259376]
"avast "= "c:\program files\AVAST Software\Avast\avastUI.exe" [2011-07-04 3493720]
.
c:\users\Tuure\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OpenOffice.org 3.2.lnk - c:\program files (x86)\OpenOffice.org 3\program\quickstart.exe [2009-12-15 384000]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin "= 5 (0x5)
"ConsentPromptBehaviorUser "= 3 (0x3)
"EnableUIADesktopToggle "= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"ForceActiveDesktopOn "= 0 (0x0)
.
[hkey_local_machine\software\Wow6432Node\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs "=c:\progra~2\Google\GOOGLE~2\GoogleDesktopNetwork3.dll
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
SetupExecute REG_MULTI_SZ \0
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@= "Service "
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 gupdate;Google-päivityspalvelu (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-10-17 136176]
R2 MsDepSvc;Web Deployment Agent Service;c:\program files\IIS\Microsoft Web Deploy\MsDepSvc.exe [2011-04-01 67400]
R3 androidusb;ADB Interface Driver;c:\windows\system32\Drivers\androidusb.sys [x]
R3 GoogleDesktopManager-051210-111108;Google Desktop Manager 5.9.1005.12335;c:\program files (x86)\Google\Google Desktop Search\GoogleDesktop.exe [2011-01-28 30192]
R3 gupdatem;Google Päivitä-palvelu (gupdatem);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-10-17 136176]
R3 MAUSBFASTTRACK;Service for M-Audio FastTrack;c:\windows\system32\DRIVERS\MAudioFastTrack.sys [x]
R3 SynUSB64;SynUSB64;c:\windows\system32\DRIVERS\SynUSB64.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [x]
R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [x]
R3 zgwhsmdm;ZTE WCDMA Handset USB Modem;c:\windows\system32\DRIVERS\zgwhsmdm.sys [x]
S0 FixTDSS;TDSS Fixtool driver;c:\windows\system32\drivers\FixTDSS.sys [x]
S0 Lbd;Lbd;c:\windows\system32\DRIVERS\Lbd.sys [x]
S1 a2injectiondriver;a2injectiondriver;c:\program files (x86)\Emsisoft Anti-Malware\a2dix64.sys [2010-09-05 48216]
S1 a2util;a-squared Malware-IDS utility driver;c:\program files (x86)\Emsisoft Anti-Malware\a2util64.sys [2010-05-05 14720]
S1 aswSnx;aswSnx; [x]
S1 aswSP;aswSP; [x]
S1 FSES;F-Secure Email Scanning Driver;c:\windows\system32\drivers\fses.sys [x]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x]
S2 a2AntiMalware;Emsisoft Anti-Malware 5.1 - Service;c:\program files (x86)\Emsisoft Anti-Malware\a2service.exe [2011-06-30 3029208]
S2 Akamai;Akamai NetSession Interface;c:\windows\System32\svchost.exe [2009-07-14 27136]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [x]
S2 Apache2.2;Apache2.2;c:\xampp\apache\bin\httpd.exe [2009-12-19 29416]
S2 aswFsBlk;aswFsBlk; [x]
S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [x]
S2 ezSharedSvc;Easybits Shared Services for Windows;c:\windows\system32\svchost.exe [2009-07-14 27136]
S2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files (x86)\Lavasoft\Ad-Aware\AAWService.exe [2011-07-21 2151640]
S2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2011-07-06 366640]
S2 RichVideo64;Cyberlink RichVideo64 Service(CRVS);c:\program files\CyberLink\Shared files\RichVideo64.exe [2010-08-19 386344]
S2 VoddlerNet;VoddlerNet;c:\program files (x86)\Voddler\service\voddler.exe [2011-02-09 1039640]
S3 a2acc;a2acc;c:\program files (x86)\EMSISOFT ANTI-MALWARE\a2accx64.sys [2011-02-20 85800]
S3 Lavasoft Kernexplorer;Lavasoft helper driver;c:\program files (x86)\Lavasoft\Ad-Aware\KernExplorer64.sys [2011-07-31 17152]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [x]
S3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\DRIVERS\vwifimp.sys [x]
S3 ysusb64;Yamaha Steinberg USB Audio;c:\windows\system32\drivers\ysusb64.sys [x]
.
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost]
Akamai REG_MULTI_SZ Akamai
.
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
ezSharedSvc
.
'Scheduled tasks' folder content*
.
2011-08-21 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- c:\program files (x86)\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2011-07-21 11:59]
.
2011-08-21 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-10-17 11:34]
.
2011-08-21 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-10-17 11:34]
.
2011-08-20 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3425611528-2409934986-2553978045-1000Core.job
- c:\users\Tuure\AppData\Local\Google\Update\GoogleUpdate.exe [2011-08-16 19:49]
.
2011-08-21 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3425611528-2409934986-2553978045-1000UA.job
- c:\users\Tuure\AppData\Local\Google\Update\GoogleUpdate.exe [2011-08-16 19:49]
.
2011-06-30 c:\windows\Tasks\PCDRScheduledMaintenance.job
- c:\program files\PC-Doctor for Windows\pcdrcui.exe [2009-09-18 07:11]
.
.
--------- x86-64 -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@= "{472083B0-C522-11CF-8763-00608CC02F24} "
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2011-07-04 11:43 134384 ----a-w- c:\program files\AVAST Software\Avast\ashShA64.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray "= "c:\windows\system32\igfxtray.exe" [2009-09-18 165912]
"HotKeysCmds "= "c:\windows\system32\hkcmd.exe" [2009-09-18 387608]
"Persistence "= "c:\windows\system32\igfxpers.exe" [2009-09-18 365592]
"PC-Doctor for Windows localizer "= "c:\program files\PC-Doctor for Windows\localizer.exe" [2009-09-17 95728]
"M-Audio Taskbar Icon "= "c:\windows\system32\M-AudioTaskBarIcon.exe" [2010-12-07 798728]
"AdobeAAMUpdater-1.0 "= "c:\program files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2010-03-06 500208]
.
------- Supplementary check* -------
.
uStart Page = https://plus.google.com/up/start/?continue=https://plus.google.com/&type=st&gpcaz=9ee2dfee&hl=en
uLocal Page = c:\windows\system32\blank.htm
mDefault_Page_URL = hxxp://www.bing.com
mStart Page = hxxp://www.bing.com
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = *.local
FF - ProfilePath - c:\users\Tuure\AppData\Roaming\Mozilla\Firefox\Profiles\nehk9mos.default\
FF - prefs.js: browser.startup.homepage - hxxps://plus.google.com/?hl=en
.
- - - - REMOVED EXCESS LINES* - - - -
.
Wow6432Node-HKLM-Run-<NO NAME> - (no file)
.
.
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\MsDepSvc]
"ImagePath "= "\ "c:\program files\IIS\Microsoft Web Deploy\MsDepSvc.exe\" -runService:MsDepSvc "
"ImagePath "= "\ "c:\program files\CyberLink\Shared files\RichVideo64.exe\ "\00Z
[\]^_À\00\00À\00\00\00\00HIJKLMNO\00\00\00\00\00\00\00\00\03\00\00\00|}~À\00\00À\00\00\00\00r\00\00\00\00\00\00\00\00‘’“ "
.
.
--------------------- LOCKED REGISTRY KEYS* ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@= "FlashBroker "
"LocalizedString "= "@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10v_ActiveX.exe,-101 "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled "=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@= "c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10v_ActiveX.exe "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@= "{FAB3E735-69C7-453B-A446-B6823C6DF1C9} "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@= "Shockwave Flash Object "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@= "c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10v.ocx "
"ThreadingModel "= "Apartment "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@= "0 "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@= "ShockwaveFlash.ShockwaveFlash.10 "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@= "c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10v.ocx, 1 "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@= "{D27CDB6B-AE6D-11cf-96B8-444553540000} "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@= "1.0 "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@= "ShockwaveFlash.ShockwaveFlash "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@= "Macromedia Flash Factory Object "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@= "c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10v.ocx "
"ThreadingModel "= "Apartment "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@= "FlashFactory.FlashFactory.1 "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@= "c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10v.ocx, 1 "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@= "{D27CDB6B-AE6D-11cf-96B8-444553540000} "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@= "1.0 "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@= "FlashFactory.FlashFactory "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@= "IFlashBroker4 "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@= "{00020424-0000-0000-C000-000000000046} "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@= "{FAB3E735-69C7-453B-A446-B6823C6DF1C9} "
"Version "= "1.0 "
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial "=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial "=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Other processes* ------------------------
.
c:\program files\AVAST Software\Avast\AvastSvc.exe
c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files (x86)\Bonjour\mDNSResponder.exe
c:\program files (x86)\Common Files\LightScribe\LSSrvc.exe
c:\xampp\mysql\bin\mysqld.exe
c:\program files (x86)\Lavasoft\Ad-Aware\AAWTray.exe
.
**************************************************************************
.
Time of completion*: 2011-08-21 09:59:44 - computer rebooted*
ComboFix-quarantined-files.txt 2011-08-21 06:59
ComboFix2.txt 2011-08-20 17:22
ComboFix3.txt 2011-08-20 10:08
.
Before run*: 349*340*356*608 bytes free
After run*: 349*280*796*672 bytes free
.
- - End Of File - - 57D9838DAC11B99132691E416CB0DBAB

 

I disabled the virus shields of all these programs before running Combofix. Or should I terminate the programs using Task manager?

 

I uninstalled the Lavasoft and Emsisoft scanners. Before running the OTL scan I disabled Avast and disconnected from the internet. I did this because the first time I tried running OTL, Avast produced a warning popup.



OTL.txt

OTL logfile created on: 2011-08-22 09:26:57 - Run 2
OTL by OldTimer - Version 3.2.26.5 Folder = C:\Users\Tuure\Desktop
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 0000041d | Country: Finland | Language: FIN | Date Format: d.M.yyyy

2,00 Gb Total Physical Memory | 0,51 Gb Available Physical Memory | 25,68% Memory free
4,00 Gb Paging File | 2,51 Gb Available in Paging File | 62,76% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 453,74 Gb Total Space | 325,22 Gb Free Space | 71,68% Space Free | Partition Type: NTFS
Drive D: | 11,93 Gb Total Space | 1,69 Gb Free Space | 14,21% Space Free | Partition Type: NTFS
Drive F: | 3,69 Gb Total Space | 2,35 Gb Free Space | 63,72% Space Free | Partition Type: FAT32

Computer Name: TUURE-PC | User Name: Tuure | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2011-08-22 09:10:15 | 000,580,096 | ---- | M] (OldTimer Tools) -- C:\Users\Tuure\Desktop\OTL.exe
PRC - [2011-07-29 02:08:12 | 001,259,376 | ---- | M] () -- C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe
PRC - [2011-07-04 14:43:54 | 003,493,720 | ---- | M] (AVAST Software) -- C:\Program Files\AVAST Software\Avast\AvastUI.exe
PRC - [2011-07-04 14:43:51 | 000,042,184 | ---- | M] (AVAST Software) -- C:\Program Files\AVAST Software\Avast\AvastSvc.exe
PRC - [2011-02-09 19:17:40 | 001,039,640 | ---- | M] (Voddler) -- C:\Program Files (x86)\Voddler\service\voddler.exe
PRC - [2011-02-09 19:17:36 | 000,676,040 | ---- | M] () -- C:\Program Files (x86)\Voddler\service\VNetManager.exe
PRC - [2010-02-02 00:10:14 | 007,418,368 | ---- | M] (OpenOffice.org) -- C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin
PRC - [2010-02-02 00:10:10 | 007,424,000 | ---- | M] (OpenOffice.org) -- C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe
PRC - [2009-12-20 01:00:00 | 006,095,504 | ---- | M] (MySQL AB) -- C:\xampp\mysql\bin\mysqld.exe
PRC - [2009-12-20 01:00:00 | 000,029,416 | ---- | M] (Apache Software Foundation) -- C:\xampp\apache\bin\httpd.exe
PRC - [2009-06-18 12:00:10 | 000,077,824 | ---- | M] (Avid Technology, Inc.) -- C:\Program Files (x86)\Digidesign\Drivers\MMERefresh.exe
PRC - [2009-01-26 15:31:16 | 002,144,088 | RHS- | M] (Safer Networking Limited) -- C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe
PRC - [2008-11-20 12:47:28 | 000,062,768 | ---- | M] (Hewlett-Packard) -- C:\Program Files (x86)\Hewlett-Packard\HP Odometer\hpsysdrv.exe
PRC - [2007-01-02 00:22:02 | 003,739,648 | ---- | M] (Google) -- C:\Users\Tuure\AppData\Roaming\Google\Google Talk\googletalk.exe


========== Modules (No Company Name) ==========

MOD - [2011-07-29 02:09:42 | 000,096,112 | ---- | M] () -- C:\Program Files (x86)\DivX\DivX Update\DivXUpdateCheck.dll
MOD - [2011-07-29 02:08:12 | 001,259,376 | ---- | M] () -- C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe
MOD - [2011-02-09 19:17:36 | 000,676,040 | ---- | M] () -- C:\Program Files (x86)\Voddler\service\VNetManager.exe
MOD - [2011-01-28 20:02:12 | 000,034,816 | ---- | M] () -- C:\Program Files (x86)\Google\Google Desktop Search\gzlib.dll
MOD - [2010-05-26 18:32:45 | 000,970,752 | ---- | M] () -- C:\Program Files (x86)\OpenOffice.org 3\program\libxml2.dll
MOD - [2010-03-15 16:57:20 | 000,067,872 | ---- | M] () -- C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll


========== Win32 Services (SafeList) ==========

SRV:64bit: - [2011-07-04 14:43:51 | 000,042,184 | ---- | M] (AVAST Software) [Auto | Running] -- C:\Program Files\AVAST Software\Avast\AvastSvc.exe -- (avast! Antivirus)
SRV:64bit: - [2011-04-01 20:17:08 | 000,067,400 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Program Files\IIS\Microsoft Web Deploy\MsDepSvc.exe -- (MsDepSvc)
SRV:64bit: - [2010-08-19 17:43:23 | 000,386,344 | ---- | M] () [Auto | Running] -- C:\Program Files\CyberLink\Shared files\RichVideo64.exe -- (RichVideo64)
SRV:64bit: - [2009-08-18 02:36:20 | 000,203,264 | ---- | M] (AMD) [Auto | Running] -- C:\Windows\SysNative\atiesrxx.exe -- (AMD External Events Utility)
SRV:64bit: - [2009-07-14 04:41:27 | 001,011,712 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2011-08-18 12:51:08 | 000,411,432 | ---- | M] (Valve Corporation) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe -- (Steam Client Service)
SRV - [2011-08-01 23:01:41 | 003,542,616 | ---- | M] () [Auto | Running] -- c:\Program Files (x86)\Common Files\Akamai\netsession_win_2da1ebd.dll -- (Akamai)
SRV - [2011-02-09 19:17:40 | 001,039,640 | ---- | M] (Voddler) [Auto | Running] -- C:\Program Files (x86)\Voddler\service\voddler.exe -- (VoddlerNet)
SRV - [2010-03-18 13:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2009-12-20 01:00:00 | 006,095,504 | ---- | M] (MySQL AB) [Auto | Running] -- C:\xampp\mysql\bin\mysqld.exe -- (MySQL)
SRV - [2009-12-20 01:00:00 | 000,029,416 | ---- | M] (Apache Software Foundation) [Auto | Running] -- C:\xampp\apache\bin\httpd.exe -- (Apache2.2)
SRV - [2009-06-18 12:00:10 | 000,077,824 | ---- | M] (Avid Technology, Inc.) [Auto | Running] -- C:\Program Files (x86)\Digidesign\Drivers\MMERefresh.exe -- (DigiRefresh)
SRV - [2009-06-18 11:24:42 | 000,159,744 | ---- | M] (Avid Technology, Inc.) [On_Demand | Stopped] -- C:\Program Files (x86)\Digidesign\Pro Tools\digiSPTIService.exe -- (digiSPTIService)
SRV - [2009-06-11 00:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
SRV - [2009-06-06 03:07:28 | 000,250,616 | ---- | M] (WildTangent, Inc.) [On_Demand | Stopped] -- C:\Program Files (x86)\HP Games\HP Game Console\GameConsoleService.exe -- (GameConsoleService)
SRV - [2009-02-22 14:00:00 | 000,129,584 | ---- | M] (EasyBits Sofware AS) [Auto | Running] -- C:\Windows\SysWOW64\ezsvc7.dll -- (ezSharedSvc)


========== Driver Services (SafeList) ==========

DRV:64bit: - [2011-08-19 12:30:02 | 000,027,256 | ---- | M] (Symantec Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\FixTDSS.sys -- (FixTDSS)
DRV:64bit: - [2011-07-04 14:36:56 | 000,600,920 | ---- | M] (AVAST Software) [File_System | System | Running] -- C:\Windows\SysNative\drivers\aswSnx.sys -- (aswSnx)
DRV:64bit: - [2011-07-04 14:36:54 | 000,288,088 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\aswSP.sys -- (aswSP)
DRV:64bit: - [2011-07-04 14:35:28 | 000,045,400 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\aswTdi.sys -- (aswTdi)
DRV:64bit: - [2011-07-04 14:32:35 | 000,031,064 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\aswRdr.sys -- (aswRdr)
DRV:64bit: - [2011-07-04 14:32:24 | 000,064,856 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\Windows\SysNative\drivers\aswMonFlt.sys -- (aswMonFlt)
DRV:64bit: - [2011-07-04 14:32:14 | 000,022,360 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\Windows\SysNative\drivers\aswFsBlk.sys -- (aswFsBlk)
DRV:64bit: - [2011-03-11 09:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
DRV:64bit: - [2011-03-11 09:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
DRV:64bit: - [2010-12-07 16:08:20 | 000,187,912 | ---- | M] (Avid Technology, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\MAudioFastTrack.sys -- (MAUSBFASTTRACK)
DRV:64bit: - [2010-11-20 16:33:35 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
DRV:64bit: - [2010-11-20 14:07:05 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV:64bit: - [2010-04-29 15:46:04 | 000,122,624 | ---- | M] (ZTE Incorporated) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\zgwhsmdm.sys -- (zgwhsmdm)
DRV:64bit: - [2010-04-22 15:02:44 | 000,088,208 | ---- | M] (Yamaha Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ysusb64.sys -- (ysusb64)
DRV:64bit: - [2010-04-19 20:47:42 | 000,050,688 | ---- | M] (Apple, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\usbaapl64.sys -- (USBAAPL64)
DRV:64bit: - [2010-03-26 12:08:00 | 000,044,624 | ---- | M] (F-Secure Corporation) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\fses.sys -- (FSES)
DRV:64bit: - [2009-09-02 14:54:20 | 007,369,728 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\igdkmd64.sys -- (igfx)
DRV:64bit: - [2009-08-21 03:05:06 | 000,239,616 | ---- | M] (Realtek ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Rt64win7.sys -- (RTL8167)
DRV:64bit: - [2009-08-18 03:48:48 | 006,037,504 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\atikmdag.sys -- (atikmdag)
DRV:64bit: - [2009-07-14 04:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
DRV:64bit: - [2009-07-14 04:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:64bit: - [2009-07-14 04:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
DRV:64bit: - [2009-06-30 17:47:44 | 000,031,744 | ---- | M] (Google Inc) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\androidusb.sys -- (androidusb)
DRV:64bit: - [2009-06-20 05:09:57 | 001,394,688 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\athrx.sys -- (athr)
DRV:64bit: - [2009-06-10 23:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
DRV:64bit: - [2009-06-10 23:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009-06-10 23:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2009-06-10 23:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
DRV:64bit: - [2009-05-21 14:40:06 | 000,103,272 | ---- | M] (PACE Anti-Piracy, Inc.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\Tpkd.sys -- (Tpkd)
DRV:64bit: - [2009-05-18 13:17:08 | 000,034,152 | ---- | M] (GEAR Software Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys -- (GEARAspiWDM)
DRV:64bit: - [2007-10-24 10:47:04 | 000,029,432 | ---- | M] (SIA Syncrosoft) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\synUSB64.sys -- (SynUSB64)
DRV - [2009-07-14 04:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.bing.com
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.bing.com
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.bing.com


IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0



IE - HKU\S-1-5-21-3425611528-2409934986-2553978045-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = https://plus.google.com/up/start/?continue=https://plus.google.com/&type=st&gpcaz=9ee2dfee&hl=en
IE - HKU\S-1-5-21-3425611528-2409934986-2553978045-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-3425611528-2409934986-2553978045-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..browser.search.suggest.enabled: false
FF - prefs.js..browser.startup.homepage: "https://plus.google.com/?hl=en "
FF - prefs.js..extensions.enabledItems: litmus-ff@f-secure.com:1.10
FF - prefs.js..extensions.enabledItems: firegestures@xuldev.org:1.6.4
FF - prefs.js..extensions.enabledItems: {AE93811A-5C9A-4d34-8462-F7B864FC4696}:3.81
FF - prefs.js..extensions.enabledItems: {a3a5c777-f583-4fef-9380-ab4add1bc2a8}:1.2
FF - prefs.js..extensions.enabledItems: foxyproxy@eric.h.jung:2.22.5
FF - prefs.js..extensions.enabledItems: CrystalFox_Qute@BigRedBrent:3.7
FF - prefs.js..network.proxy.backup.ftp: "209.159.147.196 "
FF - prefs.js..network.proxy.backup.ftp_port: 80
FF - prefs.js..network.proxy.backup.gopher: "209.159.147.196 "
FF - prefs.js..network.proxy.backup.gopher_port: 80
FF - prefs.js..network.proxy.backup.socks: "209.159.147.196 "
FF - prefs.js..network.proxy.backup.socks_port: 80
FF - prefs.js..network.proxy.backup.ssl: "209.159.147.196 "
FF - prefs.js..network.proxy.backup.ssl_port: 80
FF - prefs.js..network.proxy.no_proxies_on: "localhost, 127.0.0.1, www.facebook.com, www.youtube.com, www.proxy-list.org "
FF - prefs.js..network.proxy.share_proxy_settings: true

FF:64bit: - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/wpi,version=1.4: C:\Program Files\Microsoft\Web Platform Installer\\npwpidetector.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX,Inc.)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\4.0.60531.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=14.0.8117.0416: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/wpi,version=1.4: C:\Program Files\Microsoft\Web Platform Installer\\npwpidetector.dll ()
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.65\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.65\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@voddler/voddlerplugin: C:\Program Files (x86)\Voddler\plugin\npvoddler.dll (Voddler Sweden AB)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\Tuure\AppData\Local\Google\Update\1.3.21.65\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\Tuure\AppData\Local\Google\Update\1.3.21.65\npGoogleUpdate3.dll (Google Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\wrc@avast.com: C:\Program Files\AVAST Software\Avast\WebRep\FF [2011-08-19 12:44:57 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 5.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2011-08-16 11:16:16 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 5.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2011-08-17 09:51:27 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 6.0\extensions\\Components: C:\Program Files (x86)\Mozilla Thunderbird\components [2011-08-17 22:28:43 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 6.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Thunderbird\plugins [2011-08-17 09:51:28 | 000,000,000 | ---D | M]

[2010-05-26 18:38:01 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Tuure\AppData\Roaming\Mozilla\Extensions
[2010-05-26 18:38:01 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Tuure\AppData\Roaming\Mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6}
[2011-08-11 13:53:50 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Tuure\AppData\Roaming\Mozilla\Firefox\Profiles\nehk9mos.default\extensions
[2011-08-11 13:53:50 | 000,000,000 | ---D | M] ( "Grooveshark Remote ") -- C:\Users\Tuure\AppData\Roaming\Mozilla\Firefox\Profiles\nehk9mos.default\extensions\{140af0fa-680f-45fc-8a25-8fde5f5e0844}
[2010-09-20 21:35:12 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Tuure\AppData\Roaming\Mozilla\Firefox\Profiles\nehk9mos.default\extensions\{a3a5c777-f583-4fef-9380-ab4add1bc2a8}
[2010-10-23 23:32:44 | 000,000,000 | ---D | M] (CrystalFox Qute) -- C:\Users\Tuure\AppData\Roaming\Mozilla\Firefox\Profiles\nehk9mos.default\extensions\CrystalFox_Qute@BigRedBrent
[2011-08-11 11:17:22 | 000,000,000 | ---D | M] (FoxyProxy Standard) -- C:\Users\Tuure\AppData\Roaming\Mozilla\Firefox\Profiles\nehk9mos.default\extensions\foxyproxy@eric.h.jung
[2011-02-15 19:46:39 | 000,000,000 | ---D | M] (Premium Proxy Switcher) -- C:\Users\Tuure\AppData\Roaming\Mozilla\Firefox\Profiles\nehk9mos.default\extensions\premiumproxyswitcher@freeproxylist.org
[2011-08-16 11:16:16 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\extensions
[2011-06-12 23:10:48 | 000,000,000 | ---D | M] (Skype extension) -- C:\Program Files (x86)\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
[2011-05-22 13:55:51 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA}
[2011-06-10 15:24:40 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA}
File not found (No name found) --
[2011-08-19 12:44:57 | 000,000,000 | ---D | M] (avast! WebRep) -- C:\PROGRAM FILES\AVAST SOFTWARE\AVAST\WEBREP\FF
() (No name found) -- C:\USERS\TUURE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NEHK9MOS.DEFAULT\EXTENSIONS\{AE93811A-5C9A-4D34-8462-F7B864FC4696}.XPI
() (No name found) -- C:\USERS\TUURE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NEHK9MOS.DEFAULT\EXTENSIONS\FIREGESTURES@XULDEV.ORG.XPI
[2011-07-08 10:16:28 | 000,142,296 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2011-05-04 04:52:23 | 000,476,904 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npdeployJava1.dll
[2010-01-01 11:00:00 | 000,002,252 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml

O1 HOSTS File: ([2011-08-21 09:48:46 | 000,000,027 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2:64bit: - BHO: (avast! WebRep) - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files (x86)\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O3:64bit: - HKLM\..\Toolbar: (avast! WebRep) - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
O3 - HKLM\..\Toolbar: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
O4:64bit: - HKLM..\Run: [AdobeAAMUpdater-1.0] C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe (Adobe Systems Incorporated)
O4:64bit: - HKLM..\Run: [HotKeysCmds] C:\Windows\SysNative\hkcmd.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [IgfxTray] C:\Windows\SysNative\igfxtray.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [PC-Doctor for Windows localizer] C:\Program Files\PC-Doctor for Windows\localizer.exe (PC-Doctor, Inc.)
O4:64bit: - HKLM..\Run: [Persistence] C:\Windows\SysNative\igfxpers.exe (Intel Corporation)
O4 - HKLM..\Run: [] File not found
O4 - HKLM..\Run: [AdobeCS5ServiceManager] C:\Program Files (x86)\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [avast] C:\Program Files\AVAST Software\Avast\avastUI.exe (AVAST Software)
O4 - HKLM..\Run: [DigidesignMMERefresh] C:\Program Files (x86)\Digidesign\Drivers\MMERefresh.exe (Avid Technology, Inc.)
O4 - HKLM..\Run: [DivXUpdate] C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe ()
O4 - HKLM..\Run: [Easybits Recovery] C:\Program Files (x86)\EasyBits For Kids\ezRecover.exe (EasyBits Software AS)
O4 - HKLM..\Run: [hpsysdrv] c:\Program Files (x86)\Hewlett-Packard\HP Odometer\hpsysdrv.exe (Hewlett-Packard)
O4 - HKLM..\Run: [NortonOnlineBackupReminder] C:\Program Files (x86)\Symantec\Norton Online Backup\Activation\NobuActivation.exe (Symantec Corporation)
O4 - HKLM..\Run: [VoddlerNet Manager] C:\Program Files (x86)\Voddler\service\VNetManager.exe ()
O4 - HKU\S-1-5-21-3425611528-2409934986-2553978045-1000..\Run: [googletalk] C:\Users\Tuure\AppData\Roaming\Google\Google Talk\googletalk.exe (Google)
O4 - HKU\S-1-5-21-3425611528-2409934986-2553978045-1000..\Run: [SpybotSD TeaTimer] C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe (Safer Networking Limited)
O4 - HKU\S-1-5-21-3425611528-2409934986-2553978045-1000..\Run: [Steam] C:\Program Files (x86)\Steam\Steam.exe (Valve Corporation)
O4 - Startup: C:\Users\Tuure\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.2.lnk = C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\control panel present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\control panel present
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\control panel present
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\control panel present
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\control panel present
O7 - HKU\S-1-5-21-3425611528-2409934986-2553978045-1000\Software\Policies\Microsoft\Internet Explorer\control panel present
O7 - HKU\S-1-5-21-3425611528-2409934986-2553978045-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O9 - Extra Button: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files (x86)\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries\000000000005 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000005 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O13 - gopher Prefix: missing
O15 - HKU\S-1-5-21-3425611528-2409934986-2553978045-1000\..Trusted Domains: localhost ([]http in Local intranet)
O15 - HKU\S-1-5-21-3425611528-2409934986-2553978045-1000\..Trusted Ranges: GD ([http] in Local intranet)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.89.123.231 193.210.19.190
O18:64bit: - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - Reg Error: Key error. File not found
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O20 - AppInit_DLLs: (C:\PROGRA~2\Google\GOOGLE~2\GoogleDesktopNetwork3.dll) - C:\Program Files (x86)\Google\Google Desktop Search\GoogleDesktopNetwork3.dll (Google)
O20:64bit: - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysWOW64\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20:64bit: - Winlogon\Notify\igfxcui: DllName - Reg Error: Key error. - C:\Windows\SysNative\igfxdev.dll (Intel Corporation)
O28 - HKLM ShellExecuteHooks: {E54729E8-BB3D-4270-9D49-7389EA579090} - C:\Windows\SysWOW64\ezUPBHook.dll (EasyBits Software Corp.)
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O35 - HKU\S-1-5-21-3425611528-2409934986-2553978045-1000..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = ComFile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKU\S-1-5-21-3425611528-2409934986-2553978045-1000\...exe [@ = exefile] -- "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2011-08-22 09:10:16 | 000,580,096 | ---- | C] (OldTimer Tools) -- C:\Users\Tuure\Desktop\OTL.exe
[2011-08-21 10:05:56 | 000,000,000 | -HSD | C] -- C:\$RECYCLE.BIN
[2011-08-21 09:46:02 | 000,000,000 | ---D | C] -- C:\Windows\temp
[2011-08-20 12:33:22 | 004,179,400 | R--- | C] (Swearware) -- C:\Users\Tuure\Desktop\ComboFix.exe
[2011-08-19 12:45:30 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\avast! Free Antivirus
[2011-08-19 12:45:29 | 000,288,088 | ---- | C] (AVAST Software) -- C:\Windows\SysNative\drivers\aswSP.sys
[2011-08-19 12:45:29 | 000,022,360 | ---- | C] (AVAST Software) -- C:\Windows\SysNative\drivers\aswFsBlk.sys
[2011-08-19 12:45:25 | 000,031,064 | ---- | C] (AVAST Software) -- C:\Windows\SysNative\drivers\aswRdr.sys
[2011-08-19 12:45:24 | 000,045,400 | ---- | C] (AVAST Software) -- C:\Windows\SysNative\drivers\aswTdi.sys
[2011-08-19 12:45:23 | 000,600,920 | ---- | C] (AVAST Software) -- C:\Windows\SysNative\drivers\aswSnx.sys
[2011-08-19 12:45:21 | 000,253,888 | ---- | C] (AVAST Software) -- C:\Windows\SysNative\aswBoot.exe
[2011-08-19 12:45:21 | 000,064,856 | ---- | C] (AVAST Software) -- C:\Windows\SysNative\drivers\aswMonFlt.sys
[2011-08-19 12:44:41 | 000,040,112 | ---- | C] (AVAST Software) -- C:\Windows\avastSS.scr
[2011-08-19 12:44:35 | 000,199,304 | ---- | C] (AVAST Software) -- C:\Windows\SysWow64\aswBoot.exe
[2011-08-19 12:44:02 | 000,000,000 | ---D | C] -- C:\ProgramData\AVAST Software
[2011-08-19 12:44:02 | 000,000,000 | ---D | C] -- C:\Program Files\AVAST Software
[2011-08-19 12:01:48 | 000,027,256 | ---- | C] (Symantec Corporation) -- C:\Windows\SysNative\drivers\FixTDSS.sys
[2011-08-19 12:01:48 | 000,000,000 | ---D | C] -- C:\Users\Tuure\AppData\Roaming\FixTDSS
[2011-08-18 12:49:20 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Steam
[2011-08-18 12:49:18 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Steam
[2011-08-17 12:51:19 | 000,000,000 | ---D | C] -- C:\Users\Tuure\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\AVS4YOU
[2011-08-17 09:50:18 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Registry Mechanic
[2011-08-16 15:13:05 | 000,000,000 | ---D | C] -- C:\Users\Tuure\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Google Chrome
[2011-08-16 15:00:08 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner
[2011-08-16 14:59:55 | 000,000,000 | ---D | C] -- C:\Program Files\CCleaner
[2011-08-16 12:48:37 | 000,000,000 | ---D | C] -- C:\Users\Tuure\Documents\RegRun2
[2011-08-16 12:26:14 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\UnHackMe
[2011-08-16 11:24:14 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\SPReview
[2011-08-16 11:23:05 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\EventProviders
[2011-08-16 09:21:16 | 000,518,144 | ---- | C] (SteelWerX) -- C:\Windows\SWREG.exe
[2011-08-16 09:21:16 | 000,060,416 | ---- | C] (NirSoft) -- C:\Windows\NIRCMD.exe
[2011-08-16 09:21:15 | 000,406,528 | ---- | C] (SteelWerX) -- C:\Windows\SWSC.exe
[2011-08-16 09:20:53 | 000,000,000 | ---D | C] -- C:\Windows\ERDNT
[2011-08-16 09:20:31 | 000,000,000 | ---D | C] -- C:\Users\Tuure\AppData\Roaming\F-Secure
[2011-08-16 09:16:07 | 000,000,000 | ---D | C] -- C:\Qoobox
[2011-08-16 02:33:39 | 000,000,000 | ---D | C] -- C:\Windows\pss
[2011-08-15 15:07:45 | 000,122,624 | ---- | C] (ZTE Incorporated) -- C:\Windows\SysNative\drivers\zgwhsnmea.sys
[2011-08-15 15:07:45 | 000,122,624 | ---- | C] (ZTE Incorporated) -- C:\Windows\SysNative\drivers\zgwhsmdm.sys
[2011-08-15 15:07:45 | 000,122,624 | ---- | C] (ZTE Incorporated) -- C:\Windows\SysNative\drivers\zgwhsdiag.sys
[2011-08-15 15:07:41 | 000,000,000 | ---D | C] -- C:\Users\Tuure\.android
[2011-08-15 15:07:32 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\ZTE Smartphone Driver
[2011-08-15 15:06:48 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\JoinMe
[2011-08-13 12:51:41 | 000,000,000 | ---D | C] -- C:\Users\Tuure\AppData\Roaming\Template
[2011-08-08 11:45:38 | 000,000,000 | ---D | C] -- C:\Users\Tuure\Documents\Kalevi
[2011-08-06 20:30:40 | 000,000,000 | ---D | C] -- C:\Users\Tuure\AppData\Roaming\Malwarebytes
[2011-08-06 20:30:26 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2011-08-06 20:30:22 | 000,025,912 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys
[2011-08-05 10:31:16 | 000,000,000 | ---D | C] -- C:\Users\Tuure\Documents\My Web Sites
[2011-08-05 10:31:16 | 000,000,000 | ---D | C] -- C:\Users\Tuure\Documents\IISExpress
[2011-08-05 10:30:53 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft WebMatrix
[2011-08-05 10:29:55 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft WebMatrix
[2011-08-05 10:26:04 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft SQL Server
[2011-08-05 10:26:04 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\1033
[2011-08-05 10:26:04 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\1033
[2011-08-05 10:24:58 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft SQL Server
[2011-08-05 10:23:18 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\IIS Express
[2011-08-05 10:22:20 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\IIS 7.0 Extensions
[2011-08-05 10:22:04 | 000,000,000 | ---D | C] -- C:\Program Files\IIS
[2011-08-05 10:22:03 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\IIS
[2011-08-05 10:21:13 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft SQL Server Compact Edition
[2011-08-05 10:19:51 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft ASP.NET
[2011-08-05 10:10:30 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft
[2011-08-04 15:01:56 | 000,000,000 | ---D | C] -- C:\Users\Tuure\Documents\Anti-Malware
[2011-07-31 20:01:24 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy
[2011-07-31 20:01:12 | 000,000,000 | ---D | C] -- C:\ProgramData\Spybot - Search & Destroy
[2011-07-31 20:01:12 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Spybot - Search & Destroy
[2011-07-31 15:21:33 | 000,055,384 | ---- | C] (Sunbelt Software) -- C:\Windows\SysNative\drivers\SBREDrv.sys
[2011-07-31 15:17:01 | 000,000,000 | ---D | C] -- C:\ProgramData\Lavasoft
[2011-07-26 14:26:32 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
[2011-07-24 12:15:03 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
[2011-07-24 12:14:24 | 000,000,000 | ---D | C] -- C:\Program Files\iTunes
[2011-07-24 12:14:24 | 000,000,000 | ---D | C] -- C:\Program Files\iPod
[2011-07-24 12:11:22 | 000,000,000 | ---D | C] -- C:\Program Files\Bonjour
[2011-07-24 12:11:22 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Bonjour
[2011-07-24 12:04:34 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Apple Software Update
[2011-07-23 21:44:46 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Blender Foundation
[2011-07-23 21:44:16 | 000,000,000 | ---D | C] -- C:\Program Files\Blender Foundation

========== Files - Modified Within 30 Days ==========

[2011-08-22 09:17:01 | 000,001,018 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-3425611528-2409934986-2553978045-1000UA.job
[2011-08-22 09:14:31 | 000,015,792 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2011-08-22 09:14:31 | 000,015,792 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2011-08-22 09:10:15 | 000,580,096 | ---- | M] (OldTimer Tools) -- C:\Users\Tuure\Desktop\OTL.exe
[2011-08-22 09:06:21 | 000,001,002 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2011-08-22 09:06:08 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2011-08-22 09:06:02 | 1610,014,720 | -HS- | M] () -- C:\hiberfil.sys
[2011-08-22 08:58:18 | 000,001,006 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2011-08-21 19:55:54 | 000,000,966 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-3425611528-2409934986-2553978045-1000Core.job
[2011-08-21 19:49:14 | 000,000,064 | ---- | M] () -- C:\Windows\SysWow64\rp_stats.dat
[2011-08-21 19:49:14 | 000,000,044 | ---- | M] () -- C:\Windows\SysWow64\rp_rules.dat
[2011-08-21 09:48:46 | 000,000,027 | ---- | M] () -- C:\Windows\SysNative\drivers\etc\hosts
[2011-08-21 09:30:58 | 004,179,400 | R--- | M] (Swearware) -- C:\Users\Tuure\Desktop\ComboFix.exe
[2011-08-20 19:43:33 | 000,654,766 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2011-08-20 19:43:33 | 000,122,296 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2011-08-20 17:42:13 | 000,091,947 | ---- | M] () -- C:\Users\Tuure\.recently-used.xbel
[2011-08-20 17:07:07 | 000,006,481 | ---- | M] () -- C:\Users\Tuure\heade.2011_08_20_17_07_07.0.svg
[2011-08-20 16:54:58 | 000,790,434 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2011-08-19 17:28:35 | 000,000,512 | ---- | M] () -- C:\Users\Tuure\Documents\MBR.dat
[2011-08-19 12:30:02 | 000,027,256 | ---- | M] (Symantec Corporation) -- C:\Windows\SysNative\drivers\FixTDSS.sys
[2011-08-19 12:06:17 | 000,000,784 | ---- | M] () -- C:\Windows\SysNative\drivers\kgpcpy.cfg
[2011-08-17 22:30:40 | 000,002,120 | ---- | M] () -- C:\Users\Tuure\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Thunderbird.lnk
[2011-08-17 22:16:49 | 004,920,472 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2011-08-17 11:53:49 | 000,042,672 | ---- | M] () -- C:\Windows\SysWow64\drivers\fsbts.sys
[2011-08-17 11:19:38 | 000,046,141 | ---- | M] () -- C:\Users\Tuure\ansioluettelo.2011_08_17_11_19_38.0.svg
[2011-08-16 15:03:32 | 000,103,808 | ---- | M] () -- C:\Users\Tuure\Documents\cc_20110816_150318.reg
[2011-08-16 12:48:44 | 000,000,002 | RHS- | M] () -- C:\Windows\SysWow64\CONFIG.NT
[2011-08-16 12:48:44 | 000,000,002 | RHS- | M] () -- C:\Windows\SysWow64\AUTOEXEC.NT
[2011-08-16 12:13:54 | 000,001,447 | ---- | M] () -- C:\Users\Tuure\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
[2011-08-16 11:49:57 | 000,072,822 | ---- | M] () -- C:\Windows\SysWow64\ieuinit.inf
[2011-08-16 11:49:51 | 000,072,822 | ---- | M] () -- C:\Windows\SysNative\ieuinit.inf
[2011-08-16 11:06:50 | 000,000,000 | ---- | M] () -- C:\Users\Tuure\AppData\Local\{9CB6C88B-3061-44B8-9F56-F7BF5819A828}
[2011-08-13 12:52:47 | 000,000,218 | ---- | M] () -- C:\Users\Tuure\AppData\Roaming\wklnhst.dat
[2011-08-12 03:12:17 | 000,775,902 | ---- | M] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2011-08-08 14:56:44 | 000,074,290 | ---- | M] () -- C:\Users\Tuure\Documents\kalevi_juliste.svg
[2011-08-08 14:27:50 | 000,057,780 | ---- | M] () -- C:\Users\Tuure\kalevi_julist.2011_08_08_14_27_50.0.svg
[2011-08-08 12:55:55 | 000,032,677 | ---- | M] () -- C:\Users\Tuure\kalevi_julist.2011_08_08_12_55_55.0.svg
[2011-08-08 11:58:55 | 000,035,467 | ---- | M] () -- C:\Users\Tuure\Documents\inkscape_pasted_image_20110808_115855.png
[2011-08-08 11:55:42 | 000,059,965 | ---- | M] () -- C:\Users\Tuure\Documents\inkscape_pasted_image_20110808_115542.png
[2011-07-31 15:17:40 | 000,055,384 | ---- | M] (Sunbelt Software) -- C:\Windows\SysNative\drivers\SBREDrv.sys

========== Files Created - No Company Name ==========

[2011-08-20 17:42:13 | 000,091,947 | ---- | C] () -- C:\Users\Tuure\.recently-used.xbel
[2011-08-20 17:07:07 | 000,006,481 | ---- | C] () -- C:\Users\Tuure\heade.2011_08_20_17_07_07.0.svg
[2011-08-19 17:28:35 | 000,000,512 | ---- | C] () -- C:\Users\Tuure\Documents\MBR.dat
[2011-08-19 12:05:32 | 000,000,784 | ---- | C] () -- C:\Windows\SysNative\drivers\kgpcpy.cfg
[2011-08-17 11:19:38 | 000,046,141 | ---- | C] () -- C:\Users\Tuure\ansioluettelo.2011_08_17_11_19_38.0.svg
[2011-08-16 15:12:17 | 000,001,018 | ---- | C] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-3425611528-2409934986-2553978045-1000UA.job
[2011-08-16 15:12:16 | 000,000,966 | ---- | C] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-3425611528-2409934986-2553978045-1000Core.job
[2011-08-16 15:03:22 | 000,103,808 | ---- | C] () -- C:\Users\Tuure\Documents\cc_20110816_150318.reg
[2011-08-16 12:48:44 | 000,000,002 | RHS- | C] () -- C:\Windows\SysWow64\CONFIG.NT
[2011-08-16 12:48:44 | 000,000,002 | RHS- | C] () -- C:\Windows\SysWow64\AUTOEXEC.NT
[2011-08-16 11:49:57 | 000,072,822 | ---- | C] () -- C:\Windows\SysWow64\ieuinit.inf
[2011-08-16 11:49:51 | 000,072,822 | ---- | C] () -- C:\Windows\SysNative\ieuinit.inf
[2011-08-16 11:16:35 | 000,001,160 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
[2011-08-16 11:06:50 | 000,000,000 | ---- | C] () -- C:\Users\Tuure\AppData\Local\{9CB6C88B-3061-44B8-9F56-F7BF5819A828}
[2011-08-16 09:21:16 | 000,256,000 | ---- | C] () -- C:\Windows\PEV.exe
[2011-08-16 09:21:16 | 000,208,896 | ---- | C] () -- C:\Windows\MBR.exe
[2011-08-16 09:21:15 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe
[2011-08-16 09:21:15 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe
[2011-08-16 09:21:15 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe
[2011-08-13 12:51:38 | 000,000,218 | ---- | C] () -- C:\Users\Tuure\AppData\Roaming\wklnhst.dat
[2011-08-08 14:27:50 | 000,057,780 | ---- | C] () -- C:\Users\Tuure\kalevi_julist.2011_08_08_14_27_50.0.svg
[2011-08-08 12:55:55 | 000,032,677 | ---- | C] () -- C:\Users\Tuure\kalevi_julist.2011_08_08_12_55_55.0.svg
[2011-08-08 11:58:55 | 000,035,467 | ---- | C] () -- C:\Users\Tuure\Documents\inkscape_pasted_image_20110808_115855.png
[2011-08-08 11:55:42 | 000,059,965 | ---- | C] () -- C:\Users\Tuure\Documents\inkscape_pasted_image_20110808_115542.png
[2011-08-08 11:42:51 | 000,074,290 | ---- | C] () -- C:\Users\Tuure\Documents\kalevi_juliste.svg
[2011-08-06 19:54:31 | 000,000,064 | ---- | C] () -- C:\Windows\SysWow64\rp_stats.dat
[2011-08-06 19:54:31 | 000,000,044 | ---- | C] () -- C:\Windows\SysWow64\rp_rules.dat
[2011-08-05 10:10:34 | 000,002,065 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Web Platform Installer.lnk
[2011-07-11 16:26:03 | 000,003,584 | ---- | C] () -- C:\Users\Tuure\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011-04-02 16:10:33 | 000,000,051 | ---- | C] () -- C:\Windows\SysWow64\SYNSOPOS.exe.cfg
[2011-04-02 16:05:40 | 000,002,892 | ---- | C] () -- C:\Windows\SysWow64\audcon.sys
[2011-04-02 16:04:57 | 000,086,016 | ---- | C] () -- C:\Windows\SysWow64\SYNSOPOS.exe
[2010-11-19 23:16:52 | 000,000,031 | ---- | C] () -- C:\Program Files\plugins-04041e-3e8.dat
[2010-08-26 22:47:43 | 000,819,200 | ---- | C] () -- C:\Windows\SysWow64\xvidcore.dll
[2010-08-26 22:47:42 | 000,180,224 | ---- | C] () -- C:\Windows\SysWow64\xvidvfw.dll
[2010-06-17 21:24:17 | 000,000,040 | ---- | C] () -- C:\ProgramData\ra3.ini
[2010-06-13 20:18:08 | 000,217,088 | ---- | C] () -- C:\Windows\SysWow64\qtmlClient.dll
[2010-06-06 04:56:50 | 000,000,056 | -H-- | C] () -- C:\Windows\SysWow64\ezsidmv.dat
[2010-05-29 19:45:00 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin
[2010-05-26 17:50:21 | 000,042,672 | ---- | C] () -- C:\Windows\SysWow64\drivers\fsbts.sys
[2010-05-26 17:50:01 | 000,775,902 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2010-03-20 04:27:21 | 000,982,220 | ---- | C] () -- C:\Windows\SysWow64\igkrng500.bin
[2010-03-20 04:27:20 | 000,439,300 | ---- | C] () -- C:\Windows\SysWow64\igcompkrng500.bin
[2010-03-20 04:27:20 | 000,134,592 | ---- | C] () -- C:\Windows\SysWow64\igfcg500.bin
[2010-03-20 04:27:20 | 000,092,216 | ---- | C] () -- C:\Windows\SysWow64\igfcg500m.bin
[2010-03-19 21:01:47 | 000,009,868 | ---- | C] () -- C:\Windows\SysWow64\ezdigsgn.dat
[2009-07-14 08:38:36 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat
[2009-07-14 05:35:51 | 000,000,741 | ---- | C] () -- C:\Windows\SysWow64\NOISE.DAT
[2009-07-14 05:34:42 | 000,215,943 | ---- | C] () -- C:\Windows\SysWow64\dssec.dat
[2009-07-14 03:10:29 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin
[2009-07-14 02:42:10 | 000,064,000 | ---- | C] () -- C:\Windows\SysWow64\BWContextHandler.dll
[2009-07-14 00:03:59 | 000,364,544 | ---- | C] () -- C:\Windows\SysWow64\msjetoledb40.dll
[2009-06-11 00:26:10 | 000,673,088 | ---- | C] () -- C:\Windows\SysWow64\mlang.dat

========== LOP Check ==========

[2011-07-11 17:01:09 | 000,000,000 | ---D | M] -- C:\Users\Tuure\AppData\Roaming\AnvSoft
[2011-07-11 14:52:37 | 000,000,000 | ---D | M] -- C:\Users\Tuure\AppData\Roaming\avidemux
[2011-03-31 23:41:23 | 000,000,000 | ---D | M] -- C:\Users\Tuure\AppData\Roaming\Digidesign
[2011-08-16 09:20:31 | 000,000,000 | ---D | M] -- C:\Users\Tuure\AppData\Roaming\F-Secure
[2011-08-16 15:06:47 | 000,000,000 | ---D | M] -- C:\Users\Tuure\AppData\Roaming\FileZilla
[2011-08-19 12:01:48 | 000,000,000 | ---D | M] -- C:\Users\Tuure\AppData\Roaming\FixTDSS
[2011-05-29 21:51:04 | 000,000,000 | ---D | M] -- C:\Users\Tuure\AppData\Roaming\FreeBurner
[2011-08-16 16:51:16 | 000,000,000 | ---D | M] -- C:\Users\Tuure\AppData\Roaming\go
[2011-08-20 17:21:02 | 000,000,000 | ---D | M] -- C:\Users\Tuure\AppData\Roaming\gtk-2.0
[2010-08-02 14:16:08 | 000,000,000 | ---D | M] -- C:\Users\Tuure\AppData\Roaming\inkscape
[2010-05-26 18:34:56 | 000,000,000 | ---D | M] -- C:\Users\Tuure\AppData\Roaming\OpenOffice.org
[2010-06-13 20:37:37 | 000,000,000 | ---D | M] -- C:\Users\Tuure\AppData\Roaming\PACE Anti-Piracy
[2011-04-03 18:17:34 | 000,000,000 | ---D | M] -- C:\Users\Tuure\AppData\Roaming\PStill
[2010-06-18 22:29:10 | 000,000,000 | ---D | M] -- C:\Users\Tuure\AppData\Roaming\Red Alert 3
[2011-02-07 19:35:18 | 000,000,000 | ---D | M] -- C:\Users\Tuure\AppData\Roaming\SnapDialer
[2011-07-26 12:39:41 | 000,000,000 | ---D | M] -- C:\Users\Tuure\AppData\Roaming\Spotify
[2011-01-03 15:21:47 | 000,000,000 | ---D | M] -- C:\Users\Tuure\AppData\Roaming\Ssh
[2011-04-02 16:22:01 | 000,000,000 | ---D | M] -- C:\Users\Tuure\AppData\Roaming\Steinberg
[2010-06-13 20:24:52 | 000,000,000 | ---D | M] -- C:\Users\Tuure\AppData\Roaming\Structure
[2011-01-28 19:52:30 | 000,000,000 | ---D | M] -- C:\Users\Tuure\AppData\Roaming\Suite
[2010-12-03 14:53:03 | 000,000,000 | ---D | M] -- C:\Users\Tuure\AppData\Roaming\SystemRequirementsLab
[2011-08-13 12:51:41 | 000,000,000 | ---D | M] -- C:\Users\Tuure\AppData\Roaming\Template
[2010-05-26 18:38:00 | 000,000,000 | ---D | M] -- C:\Users\Tuure\AppData\Roaming\Thunderbird
[2010-05-26 18:54:35 | 000,000,000 | ---D | M] -- C:\Users\Tuure\AppData\Roaming\VoddlerPlayer.22AA32E1C519F8FB77514A36DC6C2AE2C623240F.1
[2010-05-26 22:42:09 | 000,000,000 | ---D | M] -- C:\Users\Tuure\AppData\Roaming\WildTangent
[2011-04-02 16:21:11 | 000,000,000 | ---D | M] -- C:\Users\Tuure\AppData\Roaming\Yamaha
[2011-06-30 10:48:54 | 000,000,544 | ---- | M] () -- C:\Windows\Tasks\PCDRScheduledMaintenance.job
[2011-08-20 12:54:05 | 000,032,542 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT

========== Purity Check ==========

(Continued in next post)

 

========== Custom Scans ==========


< %SYSTEMDRIVE%\*.* >
[2011-08-21 09:59:49 | 000,027,227 | ---- | M] () -- C:\ComboFix.txt
[2007-11-07 08:00:40 | 000,017,734 | ---- | M] () -- C:\eula.1028.txt
[2007-11-07 08:00:40 | 000,017,734 | ---- | M] () -- C:\eula.1031.txt
[2007-11-07 08:00:40 | 000,010,134 | ---- | M] () -- C:\eula.1033.txt
[2007-11-07 08:00:40 | 000,017,734 | ---- | M] () -- C:\eula.1036.txt
[2007-11-07 08:00:40 | 000,017,734 | ---- | M] () -- C:\eula.1040.txt
[2007-11-07 08:00:40 | 000,000,118 | ---- | M] () -- C:\eula.1041.txt
[2007-11-07 08:00:40 | 000,017,734 | ---- | M] () -- C:\eula.1042.txt
[2007-11-07 08:00:40 | 000,017,734 | ---- | M] () -- C:\eula.2052.txt
[2007-11-07 08:00:40 | 000,017,734 | ---- | M] () -- C:\eula.3082.txt
[2007-11-07 08:00:40 | 000,001,110 | ---- | M] () -- C:\globdata.ini
[2011-08-22 09:06:02 | 1610,014,720 | -HS- | M] () -- C:\hiberfil.sys
[2007-11-07 08:00:40 | 000,000,843 | ---- | M] () -- C:\install.ini
[2007-11-07 08:44:20 | 000,075,280 | ---- | M] (Microsoft Corporation) -- C:\install.res.1028.dll
[2007-11-07 08:44:20 | 000,095,248 | ---- | M] (Microsoft Corporation) -- C:\install.res.1031.dll
[2007-11-07 08:44:20 | 000,090,128 | ---- | M] (Microsoft Corporation) -- C:\install.res.1033.dll
[2007-11-07 08:44:20 | 000,096,272 | ---- | M] (Microsoft Corporation) -- C:\install.res.1036.dll
[2007-11-07 08:44:20 | 000,094,224 | ---- | M] (Microsoft Corporation) -- C:\install.res.1040.dll
[2007-11-07 08:44:20 | 000,080,400 | ---- | M] (Microsoft Corporation) -- C:\install.res.1041.dll
[2007-11-07 08:44:20 | 000,078,864 | ---- | M] (Microsoft Corporation) -- C:\install.res.1042.dll
[2007-11-07 08:44:20 | 000,074,768 | ---- | M] (Microsoft Corporation) -- C:\install.res.2052.dll
[2007-11-07 08:44:20 | 000,095,248 | ---- | M] (Microsoft Corporation) -- C:\install.res.3082.dll
[2006-12-02 01:37:14 | 000,904,704 | ---- | M] (Microsoft Corporation) -- C:\msdia80.dll
[2011-08-22 09:06:04 | 2146,689,024 | -HS- | M] () -- C:\pagefile.sys
[2011-08-16 11:43:05 | 000,002,240 | ---- | M] () -- C:\TDSSKiller.2.5.15.0_16.08.2011_11.42.54_log.txt
[2011-08-16 12:21:07 | 000,067,326 | ---- | M] () -- C:\TDSSKiller.2.5.15.0_16.08.2011_12.19.36_log.txt
[2007-11-07 08:00:40 | 000,005,686 | ---- | M] () -- C:\vcredist.bmp
[2007-11-07 08:50:40 | 001,927,956 | ---- | M] () -- C:\VC_RED.cab
[2007-11-07 08:53:12 | 000,242,176 | ---- | M] () -- C:\VC_RED.MSI

< %systemroot%\Fonts\*.com >
[2009-07-14 08:32:31 | 000,026,040 | ---- | M] () -- C:\Windows\Fonts\GlobalMonospace.CompositeFont
[2009-07-14 08:32:31 | 000,026,489 | ---- | M] () -- C:\Windows\Fonts\GlobalSansSerif.CompositeFont
[2009-07-14 08:32:31 | 000,029,779 | ---- | M] () -- C:\Windows\Fonts\GlobalSerif.CompositeFont
[2009-07-14 08:32:31 | 000,043,318 | ---- | M] () -- C:\Windows\Fonts\GlobalUserInterface.CompositeFont

< %systemroot%\Fonts\*.dll >

< %systemroot%\Fonts\*.ini >
[2009-06-10 23:49:50 | 000,000,065 | ---- | M] () -- C:\Windows\Fonts\desktop.ini

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\Fonts\*.exe >

< %systemroot%\system32\spool\prtprocs\w32x86\*.* >

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.jpg >

< %systemroot%\*.jpg >

< %systemroot%\*.png >

< %systemroot%\*.scr >
[2011-07-04 14:43:53 | 000,040,112 | ---- | M] (AVAST Software) -- C:\Windows\avastSS.scr
[2010-04-17 00:04:40 | 000,306,032 | ---- | M] (Microsoft Corporation) -- C:\Windows\WLXPGSS.SCR

< %systemroot%\*._sy >

< %APPDATA%\Adobe\Update\*.* >

< %ALLUSERSPROFILE%\Favorites\*.* >

< %APPDATA%\Microsoft\*.* >

< %PROGRAMFILES%\*.* >
[2009-07-14 07:54:24 | 000,000,174 | -HS- | M] () -- C:\Program Files (x86)\desktop.ini

< %APPDATA%\Update\*.* >

< %systemroot%\*. /mp /s >

< %systemroot%\System32\config\*.sav >

< %PROGRAMFILES%\bak. /s >

< %systemroot%\system32\bak. /s >

< %ALLUSERSPROFILE%\Start Menu\*.lnk /x >

< %systemroot%\system32\config\systemprofile\*.dat /x >

< %systemroot%\*.config >

< %systemroot%\system32\*.db >

< %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
[2011-08-16 12:13:54 | 000,000,221 | -HS- | M] () -- C:\Users\Tuure\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini

< %USERPROFILE%\Desktop\*.exe >
[2011-08-21 09:30:58 | 004,179,400 | R--- | M] (Swearware) -- C:\Users\Tuure\Desktop\ComboFix.exe
[2011-08-22 09:10:15 | 000,580,096 | ---- | M] (OldTimer Tools) -- C:\Users\Tuure\Desktop\OTL.exe

< %PROGRAMFILES%\Common Files\*.* >

< %systemroot%\*.src >

< %systemroot%\install\*.* >

< %systemroot%\system32\DLL\*.* >

< %systemroot%\system32\HelpFiles\*.* >

< %systemroot%\system32\rundll\*.* >

< %systemroot%\winn32\*.* >

< %systemroot%\Java\*.* >

< %systemroot%\system32\test\*.* >

< %systemroot%\system32\Rundll32\*.* >

< %systemroot%\AppPatch\Custom\*.* >

< %APPDATA%\Roaming\Microsoft\Windows\Recent\*.lnk /x >

< %PROGRAMFILES%\PC-Doctor\Downloads\*.* >

< %PROGRAMFILES%\Internet Explorer\*.tmp >

< %PROGRAMFILES%\Internet Explorer\*.dat >

< %USERPROFILE%\My Documents\*.exe >

< %USERPROFILE%\*.exe >

< %systemroot%\ADDINS\*.* >
[2009-06-11 00:20:04 | 000,000,802 | ---- | M] () -- C:\Windows\ADDINS\FXSEXT.ecf

< %systemroot%\assembly\*.bak2 >

< %systemroot%\Config\*.* >

< %systemroot%\REPAIR\*.bak2 >

< %systemroot%\SECURITY\Database\*.sdb /x >

< %systemroot%\SYSTEM\*.bak2 >

< %systemroot%\Web\*.bak2 >

< %systemroot%\Driver Cache\*.* >

< %PROGRAMFILES%\Mozilla Firefox\0*.exe >

< %ProgramFiles%\Microsoft Common\*.* >

< %ProgramFiles%\TinyProxy. >

< %USERPROFILE%\Favorites\*.url /x >
[2011-08-16 12:13:52 | 000,000,402 | -HS- | M] () -- C:\Users\Tuure\Favorites\desktop.ini

< %systemroot%\system32\*.bk >

< %systemroot%\*.te >

< %systemroot%\system32\system32\*.* >

< %ALLUSERSPROFILE%\*.dat /x >
[2010-06-17 21:24:17 | 000,000,040 | ---- | M] () -- C:\ProgramData\ra3.ini

< %systemroot%\system32\drivers\*.rmv >

< dir /b "%systemroot%\system32\*.exe" | find /i " " /c >

< dir /b "%systemroot%\*.exe" | find /i " " /c >

< %PROGRAMFILES%\Microsoft\*.* >

< %systemroot%\System32\Wbem\proquota.exe >

< %PROGRAMFILES%\Mozilla Firefox\*.dat >

< %USERPROFILE%\Cookies\*.txt /x >

< %SystemRoot%\system32\fonts\*.* >

< %systemroot%\system32\winlog\*.* >

< %systemroot%\system32\Language\*.* >

< %systemroot%\system32\Settings\*.* >

< %systemroot%\system32\*.quo >

< %SYSTEMROOT%\AppPatch\*.exe >

< %SYSTEMROOT%\inf\*.exe >

< %SYSTEMROOT%\Installer\*.exe >

< %systemroot%\system32\config\*.bak2 >

< %systemroot%\system32\Computers\*.* >

< %SystemRoot%\system32\Sound\*.* >

< %SystemRoot%\system32\SpecialImg\*.* >

< %SystemRoot%\system32\code\*.* >

< %SystemRoot%\system32\draft\*.* >

< %SystemRoot%\system32\MSSSys\*.* >

< %ProgramFiles%\Javascript\*.* >

< %systemroot%\pchealth\helpctr\System\*.exe /s >

< %systemroot%\Web\*.exe >

< %systemroot%\system32\msn\*.* >

< %systemroot%\system32\*.tro >

< %AppData%\Microsoft\Installer\msupdates\*.* >

< %ProgramFiles%\Messenger\*.* >

< %systemroot%\system32\systhem32\*.* >

< %systemroot%\system\*.exe >

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\ Auto Update\Results\Install|LastSuccessTime /rs >


========== Alternate Data Streams ==========

@Alternate Data Stream - 1249 bytes -> C:\Users\Tuure\AppData\Local\Temp:NGxnXxCSGZK1YMzFoZmVU
@Alternate Data Stream - 1204 bytes -> C:\ProgramData\Microsoft:nlTfXC8310iQWWHi3L3ogRG
@Alternate Data Stream - 1200 bytes -> C:\ProgramData\Microsoft:NiXSYM9gZY6xUuxEIe4Uq2XlbM
@Alternate Data Stream - 1179 bytes -> C:\Users\Tuure\AppData\Local\Temp:NHG4wl4OpqPw2fUFK1F62Td9n2
@Alternate Data Stream - 1118 bytes -> C:\Program Files (x86)\Common Files\microsoft shared:demyKte1961FhjMkuUD7RJ
@Alternate Data Stream - 104 bytes -> C:\ProgramData\Temp1B5B4F1

< End of report >

 

And Extras.txt

OTL Extras logfile created on: 2011-08-22 09:11:35 - Run 1
OTL by OldTimer - Version 3.2.26.5 Folder = C:\Users\Tuure\Desktop
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 0000041d | Country: Finland | Language: FIN | Date Format: d.M.yyyy

2,00 Gb Total Physical Memory | 0,66 Gb Available Physical Memory | 33,14% Memory free
4,00 Gb Paging File | 2,61 Gb Available in Paging File | 65,32% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 453,74 Gb Total Space | 325,70 Gb Free Space | 71,78% Space Free | Partition Type: NTFS
Drive D: | 11,93 Gb Total Space | 1,69 Gb Free Space | 14,21% Space Free | Partition Type: NTFS
Drive F: | 3,69 Gb Total Space | 2,35 Gb Free Space | 63,72% Space Free | Partition Type: FAT32

Computer Name: TUURE-PC | User Name: Tuure | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========


========== File Associations ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)

[HKEY_USERS\S-1-5-21-3425611528-2409934986-2553978045-1000\SOFTWARE\Classes\<extension>]

========== Shell Spawning ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %* File not found
cmdfile [open] -- "%1" %* File not found
comfile [open] -- "%1" %* File not found
exefile [open] -- "%1" %* File not found
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %SystemRoot%\system32\mshtml.dll,PrintHTML "%1" (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\rundll32.exe setupapi,InstallHinfSection DefaultInstall 132 %1 (Microsoft Corporation)
InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll ",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll ",PrintHTML "%1" (Microsoft Corporation)
piffile [open] -- "%1" %* File not found
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1" File not found
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l File not found
scrfile [open] -- "%1" /S File not found
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1 File not found
Directory [AddToPlaylistVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [Bridge] -- C:\Program Files (x86)\Adobe\Adobe Bridge CS5\Bridge.exe "%L" (Adobe Systems, Inc.)
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [OpenAsAWebSite] -- C:\Program Files (x86)\Microsoft WebMatrix\WebMatrix.exe #ExecuteCommand# SiteFromFolder %L (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1 ",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1 "
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [Bridge] -- C:\Program Files (x86)\Adobe\Adobe Bridge CS5\Bridge.exe "%L" (Adobe Systems, Inc.)
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [OpenAsAWebSite] -- C:\Program Files (x86)\Microsoft WebMatrix\WebMatrix.exe #ExecuteCommand# SiteFromFolder %L (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01 [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]


========== HKEY_LOCAL_MACHINE Uninstall List ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{058678D8-0F63-450A-B716-4394A65E0A68}" = Yamaha Steinberg USB Driver
"{071c9b48-7c32-4621-a0ac-3f809523288f}" = Microsoft Visual C++ 2005 Redistributable (x64)
"{0B8565BA-BAD5-4732-B122-5FD78EFC50A9}" = Native Instruments Service Center
"{2180B33F-3225-423E-BBC1-7798CFD3CD1F}" = Microsoft SQL Server 2008 R2 Native Client
"{25613C10-27D2-410B-942B-D922D5C3A7BE}" = Interlok driver setup x64
"{350AA351-21FA-3270-8B7A-835434E766AD}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.21022
"{436EE58B-5A6B-4021-B66E-C93C8BDB5A34}" = SmartFTP Client
"{439760BC-7737-4386-9B1D-A90A3E8A22EA}" = Apple Mobile Device Support
"{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148
"{5134B35A-B559-4762-94A4-FD4918977953}" = Microsoft Web Deploy 2.0
"{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161
"{8220EEFE-38CD-377E-8595-13398D740ACE}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17
"{8338783A-0968-3B85-AFC7-BAAE0A63DC50}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x64 9.0.30729.5570
"{8424B163-D1E0-48B7-88A2-C7A61767B3D7}" = Microsoft SQL Server Compact 4.0 x64 ENU
"{8E34682C-8118-31F1-BC4C-98CD9675E1C2}" = Microsoft .NET Framework 4 Extended
"{95120000-00B9-0409-1000-0000000FF1CE}" = Microsoft Application Error Reporting
"{aac9fcc4-dd9e-4add-901c-b5496a07ab2e}" = Microsoft Visual C++ 2005 Redistributable (x64) - KB2467175
"{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}" = Microsoft Visual C++ 2005 Redistributable (x64)
"{B613A9BB-2B34-4824-A4BE-2427653D59D6}" = iTunes
"{B6E3757B-5E77-3915-866A-CCFC4B8D194C}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x64 8.0.50727.4053
"{BCA9334F-B6C9-4F65-9A73-AC5A329A4D04}" = PlayReady PC Runtime amd64
"{CA0D2F09-F811-48D4-843E-C87696C6A9D9}" = Bonjour
"{CB099890-1D5F-11D5-9EA9-0050BAE317E1}" = CyberLink PowerDirector
"{CC4878C0-4A6A-49CD-AAA7-DD3FCB06CC84}" = Microsoft Web Platform Installer 3.0
"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile
"{FF600C37-6328-4348-A67A-3F85D8039604}" = Native Instruments Kore Player
"Blender" = Blender
"CCleaner" = CCleaner
"HDMI" = Intel(R) Graphics Media Accelerator Driver
"MaplePDF Pro_is1" = MaplePDF Pro 5.0
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Extended" = Microsoft .NET Framework 4 Extended
"OfficeTrial" = Microsoft Office Home and Student 2007 -kokeiluversio
"PC-Doctor for Windows" = HÃ¥rdvarudiagnostikverktyg

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{033E378E-6AD3-4AD5-BDEB-CBD69B31046C}" = Microsoft_VC90_ATL_x86
"{048298C9-A4D3-490B-9FF9-AB023A9238F3}" = Steam
"{07FA4960-B038-49EB-891B-9F95930AA544}" = HP Customer Experience Enhancements
"{08D2E121-7F6A-43EB-97FD-629B44903403}" = Microsoft_VC90_CRT_x86
"{0D2DBE8A-43D0-7830-7AE7-CA6C99A832E7}" = Adobe Community Help
"{10CCF16B-F1C9-4B24-9570-B4CCEE42392D}" = LightScribe System Software
"{17B4760F-334B-475D-829F-1A3E94A6A4E6}" = HP Setup
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}" = CyberLink DVD Suite Deluxe
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live Upload Tool
"{22025051-1991-48EB-8BE8-7A3329DAE7ED}" = IIS 7.5 Express
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{26A24AE4-039D-4CA4-87B4-2F83216025FF}" = Java(TM) 6 Update 26
"{2F8BA3FD-1FA9-4279-B696-712ABB12F09F}" = SmartSound Quicktracks 5
"{30EDC81C-307E-495B-856B-344EB3F21339}" = JoinMe
"{3175E049-F9A9-4A3D-8F19-AC9FB04514D1}" = Windows Live Communications Platform
"{40BF1E83-20EB-11D8-97C5-0009C5020658}" = Power2Go
"{44B2A0AB-412E-4F8C-B058-D1E8AECCDFF5}" = Recovery Manager
"{45338B07-A236-4270-9A77-EBB4115517B5}" = Windows Live Sign-in Assistant
"{46C045BF-2B3F-4BC4-8E4C-00E0CF8BD9DB}" = Adobe AIR
"{46F6B0A9-699F-626D-A7FD-19625AAB161B}" = VoddlerPlayer
"{474F25F5-BDC9-40E5-B1B6-F6BF23FC106F}" = Windows Live Essentials
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{57752979-A1C9-4C02-856B-FBB27AC4E02C}" = QuickTime
"{5D38A14D-8B90-434E-A28F-47A2279C0F40}" = ActiveState Komodo Edit 6.1.1
"{631471BE-DEAB-454B-A9AC-CE3EB42C28B3}" = Microsoft ASP.NET Web Pages
"{635FED5B-2C6D-49BE-87E6-7A6FCD22BC5A}" = Microsoft_VC90_MFC_x86
"{66239456-F8B1-49EC-818C-822603C5B712}" = ZTE Smartphone Driver 1.2066.1.3
"{66F0E678-69C2-4C46-BA95-117DF28C87E4}" = Microsoft WebMatrix
"{6ADD0603-16EF-400D-9F9E-486432835002}" = OpenOffice.org 3.2
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
"{7A2A27F4-0FBE-4C0C-8A6F-8FB08A249345}" = SSH Tectia Client 4.2.0
"{7C5B4583-7CBF-4289-B195-03B553959DEA}" = VoiceOver Kit
"{7D9EF8C1-1B76-44AF-A918-86CBA6FD24C8}" = Microsoft Works
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{90120000-0020-040B-0000-0000000FF1CE}" = 2007 Office Systemin yhteensopivuuspaketti
"{90218F93-6CB9-42B6-B7ED-D1E559E38769}" = iMindMap 5
"{92D58719-BBC1-4CC3-A08B-56C9E884CC2C}" = Microsoft_VC80_CRT_x86
"{933B4015-4618-4716-A828-5289FC03165F}" = VC80CRTRedist - 8.0.50727.6195
"{95120000-00AF-040B-0000-0000000FF1CE}" = Microsoft Office PowerPoint Viewer 2007 (Finnish)
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9B97EC91-B3FD-4BFF-88FC-5345A26AC2E7}" = Adobe Illustrator CS5
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9E1BAB75-EB78-440D-94C0-A3857BE2E733}" = System Requirements Lab
"{9F479685-180E-4C05-9400-D59292A1B29C}" = Windows Live Movie Maker
"{A47FD1BF-A815-4A76-BE65-53A15BD5D25D}" = Microsoft SQL Server System CLR Types
"{A51500FE-6408-4305-B071-B961F691A4CE}" = Microsoft SQL Server Compact 4.0 Web Tools ENU
"{A78FE97A-C0C8-49CE-89D0-EDD524A17392}" = PDF Settings CS5
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{A9F6CFB0-806D-11E0-8EA1-B8AC6F97B88E}" = Google Earth Plug-in
"{AC76BA86-7AD7-1033-7B44-A94000000001}" = Adobe Reader 9.4.5
"{AC997F93-0757-4ED4-A701-F40C2D654D09}" = Steinberg HALionOne GM Drum Set
"{B064BF5C-EBCC-449E-97F8-9E58310B8A96}" = Steinberg CI2 Extension 64bit
"{B10914FD-8812-47A4-85A1-50FCDE7F1F33}" = Windows Live Sync
"{B3575D00-27EF-49C2-B9E0-14B3D954E992}" = Apple Application Support
"{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy
"{B692E59A-055C-43B7-BE0A-9C2FE0AB88B6}" = Microsoft SQL Server 2008 R2 Management Objects
"{B6CF2967-C81E-40C0-9815-C05774FEF120}" = Skype Toolbars
"{B8AC1A89-FFD1-4F97-8051-E505A160F562}" = HP Odometer
"{B9A03B7B-E0FF-4FB3-BA83-762E58A1B0AA}" = HP Support Information
"{BAF3C332-CF42-4593-AC9A-E9B2A3FA3B8E}" = Steinberg Cubase AI 5
"{C23E49E7-DC19-EB85-766E-06B337EAAF7B}" = AIRInstallTest
"{C57BCDE1-7CB9-467D-B3BA-7E119916CDC1}" = Norton Online Backup
"{C59C179C-668D-49A9-B6EA-0121CCFC1243}" = LabelPrint
"{C611CF88-969D-43E6-A877-D6D6439DD081}" = HP Remote Solution
"{D1A19B02-817E-4296-A45B-07853FD74D57}" = Microsoft_VC80_MFC_x86
"{D46D081B-F60E-467E-A7C4-117B70D76731}" = HP Update
"{D6F879CC-59D6-4D4B-AE9B-D761E48D25ED}" = Skype™ 5.3
"{D92BBB52-82FF-42ED-8A3C-4E062F944AB7}" = Microsoft_VC80_MFCLOC_x86
"{DE3A9DC5-9A5D-6485-9662-347162C7E4CA}" = Adobe Media Player
"{E70E7159-93B1-470D-9FBD-D8E9EF34B538}" = Steinberg HALionOne
"{E9E34215-82EF-4909-BE2F-F581F0DC9062}" = DirectX for Managed Code Update (Summer 2004)
"{EE39FFBD-544E-49E4-A999-6819828EAE91}" = Windows Live Photo Gallery
"{F057965A-D974-4C64-ADB1-4381CD4B8956}" = Steinberg HALionOne GM Set
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{FE8CD9C9-7650-4B8D-928A-85D6CAB6CA59}" = Digidesign Pro Tools M-Powered Essential 8.0.2
"Acoustica Beatcraft" = Acoustica Beatcraft
"Acoustica Effects Pack" = Acoustica Effects Pack
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player 11.5
"AIRInstallTest" = AIRInstallTest
"Akamai" = Akamai NetSession Interface
"Any Video Converter_is1" = Any Video Converter 3.2.5
"avast" = avast! Free Antivirus
"Avidemux 2.5 (64-bit)" = Avidemux 2.5
"AVS Image Converter_is1" = AVS Image Converter 2.0.2.160
"AVS Update Manager_is1" = AVS Update Manager 1.0
"AVS4YOU Software Navigator_is1" = AVS4YOU Software Navigator 1.4
"chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Adobe Community Help
"com.adobe.amp.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Adobe Media Player
"daHornet VSTi V1.34_is1" = daHornet Version 1.34
"DivX Setup" = DivX Setup
"EasyBits Magic Desktop" = Magic Desktop
"eLicenser Control" = eLicenser Control
"FileZilla Client" = FileZilla Client 3.5.0
"Free Easy Burner_is1" = Free Easy Burner V 4.4.1
"GoldWave v5.56" = GoldWave v5.56
"Google Desktop" = Google Desktop
"GPStill" = PStill PostScript to PDF Converter (remove only)
"HammerHead Rhythm Station" = HammerHead Rhythm Station
"HP Remote Solution" = HP Remote Solution
"Hydrogen" = Hydrogen
"Inkscape" = Inkscape 0.47
"InstallShield_{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}" = CyberLink DVD Suite Deluxe
"InstallShield_{2F8BA3FD-1FA9-4279-B696-712ABB12F09F}" = SmartSound Quicktracks 5
"InstallShield_{40BF1E83-20EB-11D8-97C5-0009C5020658}" = Power2Go
"InstallShield_{C59C179C-668D-49A9-B6EA-0121CCFC1243}" = LabelPrint
"InstallShield_{CB099890-1D5F-11D5-9EA9-0050BAE317E1}" = CyberLink PowerDirector
"Mozilla Firefox 5.0.1 (x86 en-US)" = Mozilla Firefox 5.0.1 (x86 en-US)
"Mozilla Thunderbird (6.0)" = Mozilla Thunderbird (6.0)
"NalsoftSubPlay" = Nalsoft Subtitle Player v10200
"Native Instruments Kore Player" = Native Instruments Kore Player
"Native Instruments Service Center" = Native Instruments Service Center
"ordrumbox_is1" = ordrumbox-0.9.04
"Scribus 1.3.3.14" = Scribus 1.3.3.14
"SmartFTP Client 4.0 (x64) Setup Files" = SmartFTP Client Setup Files 4.0 (x64) (remove only)
"Spotify" = Spotify
"TuxGuitar_0" = TuxGuitar 1.2
"WildTangent hp Master Uninstall" = HP Games
"WinGimp-2.0_is1" = GIMP 2.6.10
"WinLiveSuite_Wave3" = Windows Live Essentials
"VLC media player" = VLC media player 1.1.5
"Voddler" = VoddlerNet
"VoddlerPlayer.22AA32E1C519F8FB77514A36DC6C2AE2C623240F.1" = VoddlerPlayer
"Xvid_is1" = Xvid 1.2.2 final uninstall

========== HKEY_USERS Uninstall List ==========

[HKEY_USERS\S-1-5-21-3425611528-2409934986-2553978045-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{226b64e8-dc75-4eea-a6c8-abcb496320f2}-Google Talk" = Google Talk (remove only)
"Google Chrome" = Google Chrome
"Octoshape add-in for Adobe Flash Player" = Octoshape add-in for Adobe Flash Player

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 2011-07-27 07:10:49 | Computer Name = Tuure-PC | Source = SideBySide | ID = 16842785
Description = Activation context generation failed for "C:\Windows\system32\conhost.exe ".
Dependent
Assembly Microsoft.Windows.SystemCompatible,processorArchitecture= "amd64 ",publicKeyToken= "6595b64144ccf1df ",type= "win32 ",version= "6.0.7600.16823 "
could not be found. Please use sxstrace.exe for detailed diagnosis.

Error - 2011-07-27 08:10:49 | Computer Name = Tuure-PC | Source = SideBySide | ID = 16842785
Description = Activation context generation failed for "C:\Windows\system32\conhost.exe ".
Dependent
Assembly Microsoft.Windows.SystemCompatible,processorArchitecture= "amd64 ",publicKeyToken= "6595b64144ccf1df ",type= "win32 ",version= "6.0.7600.16823 "
could not be found. Please use sxstrace.exe for detailed diagnosis.

Error - 2011-07-27 08:22:55 | Computer Name = Tuure-PC | Source = SideBySide | ID = 16842785
Description = Activation context generation failed for "C:\Windows\system32\conhost.exe ".
Dependent
Assembly Microsoft.Windows.SystemCompatible,processorArchitecture= "amd64 ",publicKeyToken= "6595b64144ccf1df ",type= "win32 ",version= "6.0.7600.16823 "
could not be found. Please use sxstrace.exe for detailed diagnosis.

Error - 2011-07-27 08:24:13 | Computer Name = Tuure-PC | Source = SideBySide | ID = 16842785
Description = Activation context generation failed for "C:\Windows\system32\conhost.exe ".
Dependent
Assembly Microsoft.Windows.SystemCompatible,processorArchitecture= "amd64 ",publicKeyToken= "6595b64144ccf1df ",type= "win32 ",version= "6.0.7600.16823 "
could not be found. Please use sxstrace.exe for detailed diagnosis.

Error - 2011-07-27 09:10:10 | Computer Name = Tuure-PC | Source = SideBySide | ID = 16842785
Description = Activation context generation failed for "C:\Windows\system32\conhost.exe ".
Dependent
Assembly Microsoft.Windows.SystemCompatible,processorArchitecture= "amd64 ",publicKeyToken= "6595b64144ccf1df ",type= "win32 ",version= "6.0.7600.16823 "
could not be found. Please use sxstrace.exe for detailed diagnosis.

Error - 2011-07-27 09:10:21 | Computer Name = Tuure-PC | Source = SideBySide | ID = 16842785
Description = Activation context generation failed for "C:\Windows\system32\conhost.exe ".
Dependent
Assembly Microsoft.Windows.SystemCompatible,processorArchitecture= "amd64 ",publicKeyToken= "6595b64144ccf1df ",type= "win32 ",version= "6.0.7600.16823 "
could not be found. Please use sxstrace.exe for detailed diagnosis.

Error - 2011-07-27 09:31:14 | Computer Name = Tuure-PC | Source = Application Error | ID = 1000
Description = Faulting application name: Scribus.exe, version: 1.3.3.14, time stamp:
0x4b61dc37 Faulting module name: unknown, version: 0.0.0.0, time stamp: 0x00000000
Exception
code: 0xc0000005 Fault offset: 0x16940070 Faulting process id: 0xd98 Faulting application
start time: 0x01cc4c4786b94268 Faulting application path: C:\Program Files (x86)\Scribus
1.3.3.14\Scribus.exe Faulting module path: unknown Report Id: b2adc481-b854-11e0-8c24-adbc5285621c

Error - 2011-07-27 09:56:00 | Computer Name = Tuure-PC | Source = SideBySide | ID = 16842785
Description = Activation context generation failed for "C:\Windows\system32\conhost.exe ".
Dependent
Assembly Microsoft.Windows.SystemCompatible,processorArchitecture= "amd64 ",publicKeyToken= "6595b64144ccf1df ",type= "win32 ",version= "6.0.7600.16823 "
could not be found. Please use sxstrace.exe for detailed diagnosis.

Error - 2011-07-27 10:48:24 | Computer Name = Tuure-PC | Source = Application Error | ID = 1000
Description = Faulting application name: hl2.exe, version: 0.0.0.0, time stamp:
0x4e2f053e Faulting module name: filesystem_steam.dll_unloaded, version: 0.0.0.0,
time stamp: 0x4e2f06b3 Exception code: 0xc0000005 Fault offset: 0x6b22e649 Faulting
process id: 0x13b4 Faulting application start time: 0x01cc4c630d20dd3c Faulting application
path: c:\program files (x86)\steam\steamapps\paranoia_nerd\day of defeat source\hl2.exe
Faulting
module path: filesystem_steam.dll Report Id: 7a9f2770-b85f-11e0-8c24-adbc5285621c

Error - 2011-07-27 10:56:00 | Computer Name = Tuure-PC | Source = SideBySide | ID = 16842785
Description = Activation context generation failed for "C:\Windows\system32\conhost.exe ".
Dependent
Assembly Microsoft.Windows.SystemCompatible,processorArchitecture= "amd64 ",publicKeyToken= "6595b64144ccf1df ",type= "win32 ",version= "6.0.7600.16823 "
could not be found. Please use sxstrace.exe for detailed diagnosis.

[ Hewlett-Packard Events ]
Error - 2011-04-14 09:50:28 | Computer Name = Tuure-PC | Source = Hewlett-Packard | ID = 0
Description = fi-FI Could not find file 'C:\Program Files (x86)\Hewlett-Packard\HP
Support Framework\Logs\SystemInfoAA.xml'. mscorlib at System.IO.__Error.WinIOError(Int32
errorCode, String maybeFullPath) at System.IO.FileStream.Init(String path, FileMode
mode, FileAccess access, Int32 rights, Boolean useRights, FileShare share, Int32
bufferSize, FileOptions options, SECURITY_ATTRIBUTES secAttrs, String msgPath,
Boolean bFromProxy) at System.IO.FileStream..ctor(String path, FileMode mode,
FileAccess access, FileShare share, Int32 bufferSize, FileOptions options, String
msgPath, Boolean bFromProxy) at System.IO.FileStream..ctor(String path, FileMode
mode, FileAccess access, FileShare share, Int32 bufferSize, FileOptions options)

at System.IO.StreamReader..ctor(String path, Encoding encoding, Boolean detectEncodingFromByteOrderMarks,
Int32 bufferSize) at System.IO.StreamReader..ctor(String path, Encoding encoding)

at System.IO.File.ReadAllText(String path, Encoding encoding) at n.a(Object
A_0, EventArgs A_1)

Error - 2011-04-14 09:50:29 | Computer Name = Tuure-PC | Source = Hewlett-Packard | ID = 0
Description = fi-FI Could not find file 'C:\Program Files (x86)\Hewlett-Packard\HP
Support Framework\Logs\SystemInfoAA.xml'. mscorlib at System.IO.__Error.WinIOError(Int32
errorCode, String maybeFullPath) at System.IO.FileStream.Init(String path, FileMode
mode, FileAccess access, Int32 rights, Boolean useRights, FileShare share, Int32
bufferSize, FileOptions options, SECURITY_ATTRIBUTES secAttrs, String msgPath,
Boolean bFromProxy) at System.IO.FileStream..ctor(String path, FileMode mode,
FileAccess access, FileShare share, Int32 bufferSize, FileOptions options, String
msgPath, Boolean bFromProxy) at System.IO.FileStream..ctor(String path, FileMode
mode, FileAccess access, FileShare share, Int32 bufferSize, FileOptions options)

at System.IO.StreamReader..ctor(String path, Encoding encoding, Boolean detectEncodingFromByteOrderMarks,
Int32 bufferSize) at System.IO.StreamReader..ctor(String path, Encoding encoding)

at System.IO.File.ReadAllText(String path, Encoding encoding) at n.a(Object
A_0, EventArgs A_1)

Error - 2011-05-26 09:43:32 | Computer Name = Tuure-PC | Source = Hewlett-Packard | ID = 0
Description = fi-FI Could not find file 'C:\Program Files (x86)\Hewlett-Packard\HP
Support Framework\Logs\SystemInfoAA.xml'. mscorlib at System.IO.__Error.WinIOError(Int32
errorCode, String maybeFullPath) at System.IO.FileStream.Init(String path, FileMode
mode, FileAccess access, Int32 rights, Boolean useRights, FileShare share, Int32
bufferSize, FileOptions options, SECURITY_ATTRIBUTES secAttrs, String msgPath,
Boolean bFromProxy) at System.IO.FileStream..ctor(String path, FileMode mode,
FileAccess access, FileShare share, Int32 bufferSize, FileOptions options, String
msgPath, Boolean bFromProxy) at System.IO.FileStream..ctor(String path, FileMode
mode, FileAccess access, FileShare share, Int32 bufferSize, FileOptions options)

at System.IO.StreamReader..ctor(String path, Encoding encoding, Boolean detectEncodingFromByteOrderMarks,
Int32 bufferSize) at System.IO.StreamReader..ctor(String path, Encoding encoding)

at System.IO.File.ReadAllText(String path, Encoding encoding) at n.a(Object
A_0, EventArgs A_1)

Error - 2011-05-26 09:43:33 | Computer Name = Tuure-PC | Source = Hewlett-Packard | ID = 0
Description = fi-FI Could not find file 'C:\Program Files (x86)\Hewlett-Packard\HP
Support Framework\Logs\SystemInfoAA.xml'. mscorlib at System.IO.__Error.WinIOError(Int32
errorCode, String maybeFullPath) at System.IO.FileStream.Init(String path, FileMode
mode, FileAccess access, Int32 rights, Boolean useRights, FileShare share, Int32
bufferSize, FileOptions options, SECURITY_ATTRIBUTES secAttrs, String msgPath,
Boolean bFromProxy) at System.IO.FileStream..ctor(String path, FileMode mode,
FileAccess access, FileShare share, Int32 bufferSize, FileOptions options, String
msgPath, Boolean bFromProxy) at System.IO.FileStream..ctor(String path, FileMode
mode, FileAccess access, FileShare share, Int32 bufferSize, FileOptions options)

at System.IO.StreamReader..ctor(String path, Encoding encoding, Boolean detectEncodingFromByteOrderMarks,
Int32 bufferSize) at System.IO.StreamReader..ctor(String path, Encoding encoding)

at System.IO.File.ReadAllText(String path, Encoding encoding) at n.a(Object
A_0, EventArgs A_1)

Error - 2011-05-26 10:10:53 | Computer Name = Tuure-PC | Source = Hewlett-Packard | ID = 0
Description = fi-FI Could not find file 'C:\Program Files (x86)\Hewlett-Packard\HP
Support Framework\Logs\SystemInfoAA.xml'. mscorlib at System.IO.__Error.WinIOError(Int32
errorCode, String maybeFullPath) at System.IO.FileStream.Init(String path, FileMode
mode, FileAccess access, Int32 rights, Boolean useRights, FileShare share, Int32
bufferSize, FileOptions options, SECURITY_ATTRIBUTES secAttrs, String msgPath,
Boolean bFromProxy) at System.IO.FileStream..ctor(String path, FileMode mode,
FileAccess access, FileShare share, Int32 bufferSize, FileOptions options, String
msgPath, Boolean bFromProxy) at System.IO.FileStream..ctor(String path, FileMode
mode, FileAccess access, FileShare share, Int32 bufferSize, FileOptions options)

at System.IO.StreamReader..ctor(String path, Encoding encoding, Boolean detectEncodingFromByteOrderMarks,
Int32 bufferSize) at System.IO.StreamReader..ctor(String path, Encoding encoding)

at System.IO.File.ReadAllText(String path, Encoding encoding) at n.a(Object
A_0, EventArgs A_1)

Error - 2011-05-26 10:10:54 | Computer Name = Tuure-PC | Source = Hewlett-Packard | ID = 0
Description = fi-FI Could not find file 'C:\Program Files (x86)\Hewlett-Packard\HP
Support Framework\Logs\SystemInfoAA.xml'. mscorlib at System.IO.__Error.WinIOError(Int32
errorCode, String maybeFullPath) at System.IO.FileStream.Init(String path, FileMode
mode, FileAccess access, Int32 rights, Boolean useRights, FileShare share, Int32
bufferSize, FileOptions options, SECURITY_ATTRIBUTES secAttrs, String msgPath,
Boolean bFromProxy) at System.IO.FileStream..ctor(String path, FileMode mode,
FileAccess access, FileShare share, Int32 bufferSize, FileOptions options, String
msgPath, Boolean bFromProxy) at System.IO.FileStream..ctor(String path, FileMode
mode, FileAccess access, FileShare share, Int32 bufferSize, FileOptions options)

at System.IO.StreamReader..ctor(String path, Encoding encoding, Boolean detectEncodingFromByteOrderMarks,
Int32 bufferSize) at System.IO.StreamReader..ctor(String path, Encoding encoding)

at System.IO.File.ReadAllText(String path, Encoding encoding) at n.a(Object
A_0, EventArgs A_1)

Error - 2011-05-26 10:13:07 | Computer Name = Tuure-PC | Source = Hewlett-Packard | ID = 0
Description = fi-FI Object reference not set to an instance of an object. HPSF at
HPAssistant.Pages.MaintainAnalyzing.MaintainAnalyzing_Unloaded(Object sender, RoutedEventArgs
e) at System.Windows.RoutedEventHandlerInfo.InvokeHandler(Object target, RoutedEventArgs
routedEventArgs) at System.Windows.EventRoute.InvokeHandlersImpl(Object source,
RoutedEventArgs args, Boolean reRaised) at System.Windows.UIElement.RaiseEventImpl(DependencyObject
sender, RoutedEventArgs args) at System.Windows.UIElement.RaiseEvent(RoutedEventArgs
e) at System.Windows.BroadcastEventHelper.BroadcastEvent(DependencyObject root,
RoutedEvent routedEvent) at System.Windows.BroadcastEventHelper.BroadcastUnloadedEvent(Object
root) at MS.Internal.LoadedOrUnloadedOperation.DoWork() at System.Windows.Media.MediaContext.FireLoadedPendingCallbacks()

at System.Windows.Media.MediaContext.FireInvokeOnRenderCallbacks() at System.Windows.Media.MediaContext.RenderMessageHandlerCore(Object
resizedCompositionTarget) at System.Windows.Media.MediaContext.RenderMessageHandler(Object
resizedCompositionTarget) at System.Windows.Threading.ExceptionWrapper.InternalRealCall(Delegate
callback, Object args, Boolean isSingleParameter) at System.Windows.Threading.ExceptionWrapper.TryCatchWhen(Object
source, Delegate callback, Object args, Boolean isSingleParameter, Delegate catchHandler)


Error - 2011-06-02 09:47:33 | Computer Name = Tuure-PC | Source = Hewlett-Packard | ID = 0
Description = fi-FI Could not find file 'C:\Program Files (x86)\Hewlett-Packard\HP
Support Framework\Logs\SystemInfoAA.xml'. mscorlib at System.IO.__Error.WinIOError(Int32
errorCode, String maybeFullPath) at System.IO.FileStream.Init(String path, FileMode
mode, FileAccess access, Int32 rights, Boolean useRights, FileShare share, Int32
bufferSize, FileOptions options, SECURITY_ATTRIBUTES secAttrs, String msgPath,
Boolean bFromProxy) at System.IO.FileStream..ctor(String path, FileMode mode,
FileAccess access, FileShare share, Int32 bufferSize, FileOptions options, String
msgPath, Boolean bFromProxy) at System.IO.FileStream..ctor(String path, FileMode
mode, FileAccess access, FileShare share, Int32 bufferSize, FileOptions options)

at System.IO.StreamReader..ctor(String path, Encoding encoding, Boolean detectEncodingFromByteOrderMarks,
Int32 bufferSize) at System.IO.StreamReader..ctor(String path, Encoding encoding)

at System.IO.File.ReadAllText(String path, Encoding encoding) at n.a(Object
A_0, EventArgs A_1)

Error - 2011-06-02 09:47:33 | Computer Name = Tuure-PC | Source = Hewlett-Packard | ID = 0
Description = fi-FI Could not find file 'C:\Program Files (x86)\Hewlett-Packard\HP
Support Framework\Logs\SystemInfoAA.xml'. mscorlib at System.IO.__Error.WinIOError(Int32
errorCode, String maybeFullPath) at System.IO.FileStream.Init(String path, FileMode
mode, FileAccess access, Int32 rights, Boolean useRights, FileShare share, Int32
bufferSize, FileOptions options, SECURITY_ATTRIBUTES secAttrs, String msgPath,
Boolean bFromProxy) at System.IO.FileStream..ctor(String path, FileMode mode,
FileAccess access, FileShare share, Int32 bufferSize, FileOptions options, String
msgPath, Boolean bFromProxy) at System.IO.FileStream..ctor(String path, FileMode
mode, FileAccess access, FileShare share, Int32 bufferSize, FileOptions options)

at System.IO.StreamReader..ctor(String path, Encoding encoding, Boolean detectEncodingFromByteOrderMarks,
Int32 bufferSize) at System.IO.StreamReader..ctor(String path, Encoding encoding)

at System.IO.File.ReadAllText(String path, Encoding encoding) at n.a(Object
A_0, EventArgs A_1)

Error - 2011-07-07 09:22:33 | Computer Name = Tuure-PC | Source = Hewlett-Packard | ID = 0
Description = fi-FI Could not find file 'C:\Program Files (x86)\Hewlett-Packard\HP
Support Framework\Logs\SystemInfoAA.xml'. mscorlib at System.IO.__Error.WinIOError(Int32
errorCode, String maybeFullPath) at System.IO.FileStream.Init(String path, FileMode
mode, FileAccess access, Int32 rights, Boolean useRights, FileShare share, Int32
bufferSize, FileOptions options, SECURITY_ATTRIBUTES secAttrs, String msgPath,
Boolean bFromProxy) at System.IO.FileStream..ctor(String path, FileMode mode,
FileAccess access, FileShare share, Int32 bufferSize, FileOptions options, String
msgPath, Boolean bFromProxy) at System.IO.FileStream..ctor(String path, FileMode
mode, FileAccess access, FileShare share, Int32 bufferSize, FileOptions options)

at System.IO.StreamReader..ctor(String path, Encoding encoding, Boolean detectEncodingFromByteOrderMarks,
Int32 bufferSize) at System.IO.StreamReader..ctor(String path, Encoding encoding)

at System.IO.File.ReadAllText(String path, Encoding encoding) at n.a(Object
A_0, EventArgs A_1)

[ System Events ]
Error - 2011-03-07 07:54:28 | Computer Name = Tuure-PC | Source = Server | ID = 2505
Description = The server could not bind to the transport \Device\NetBT_Tcpip_{3AD79ADB-4FD5-431E-AFEA-D2AB7646BFB8}
because another computer on the network has the same name. The server could not
start.

Error - 2011-03-07 07:54:48 | Computer Name = Tuure-PC | Source = atikmdag | ID = 43029
Description = Display is not active

Error - 2011-03-07 11:23:03 | Computer Name = Tuure-PC | Source = Service Control Manager | ID = 7024
Description = The Apache2.2 service terminated with service-specific error %%1.

Error - 2011-03-08 00:15:33 | Computer Name = Tuure-PC | Source = atikmdag | ID = 52236
Description = CPLIB :: General - Invalid Parameter

Error - 2011-03-08 00:15:33 | Computer Name = Tuure-PC | Source = atikmdag | ID = 43029
Description = Display is not active

Error - 2011-03-08 02:17:58 | Computer Name = Tuure-PC | Source = atikmdag | ID = 43029
Description = Display is not active

Error - 2011-03-08 08:26:56 | Computer Name = Tuure-PC | Source = atikmdag | ID = 43029
Description = Display is not active

Error - 2011-03-08 10:30:19 | Computer Name = Tuure-PC | Source = Service Control Manager | ID = 7011
Description = A timeout (30000 milliseconds) was reached while waiting for a transaction
response from the Wlansvc service.

Error - 2011-03-08 10:30:26 | Computer Name = Tuure-PC | Source = atikmdag | ID = 43029
Description = Display is not active

Error - 2011-03-09 03:37:40 | Computer Name = Tuure-PC | Source = atikmdag | ID = 43029
Description = Display is not active


< End of report >

 

When I started OTL and TFC, Avast warned that they are potentially unsafe programs, and recommended that I run them in a "sandbox ". I chose to run the programs normally. I assume that was the way to go?

Here are the logs. There appears to be a problem with the ESET Scanner's website, or at least I'm not getting anywhere on it. I'll try again later.

So yeah, the logs:

OTL

All processes killed
========== OTL ==========
Prefs.js: "209.159.147.196" removed from network.proxy.backup.ftp
Prefs.js: 80 removed from network.proxy.backup.ftp_port
Prefs.js: "209.159.147.196" removed from network.proxy.backup.gopher
Prefs.js: 80 removed from network.proxy.backup.gopher_port
Prefs.js: "209.159.147.196" removed from network.proxy.backup.socks
Prefs.js: 80 removed from network.proxy.backup.socks_port
Prefs.js: "209.159.147.196" removed from network.proxy.backup.ssl
Prefs.js: 80 removed from network.proxy.backup.ssl_port
Prefs.js: "localhost, 127.0.0.1, www.facebook.com, www.youtube.com, www.proxy-list.org" removed from network.proxy.no_proxies_on
Prefs.js: true removed from network.proxy.share_proxy_settings
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\ deleted successfully.
Registry key HKEY_USERS\S-1-5-21-3425611528-2409934986-2553978045-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\localhost\ deleted successfully.
Registry value HKEY_USERS\S-1-5-21-3425611528-2409934986-2553978045-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\GD\\http deleted successfully.
ADS C:\ProgramData\Microsoft:nlTfXC8310iQWWHi3L3ogRG deleted successfully.
ADS C:\ProgramData\Microsoft:NiXSYM9gZY6xUuxEIe4Uq2XlbM deleted successfully.
ADS C:\Users\Tuure\AppData\Local\Temp:NHG4wl4OpqPw2fUFK1F62Td9n2 deleted successfully.
ADS C:\Program Files (x86)\Common Files\microsoft shared:demyKte1961FhjMkuUD7RJ deleted successfully.
ADS C:\ProgramData\Temp1B5B4F1 deleted successfully.
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes
->Flash cache emptied: 56502 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Public
->Temp folder emptied: 0 bytes

User: Tuure
->Temp folder emptied: 2310533 bytes
->Temporary Internet Files folder emptied: 1288449 bytes
->Java cache emptied: 2806567 bytes
->FireFox cache emptied: 59894147 bytes
->Google Chrome cache emptied: 377880508 bytes
->Flash cache emptied: 3971892 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 1216 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 33304 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 427,00 mb


[EMPTYFLASH]

User: All Users

User: Default
->Flash cache emptied: 0 bytes

User: Default User
->Flash cache emptied: 0 bytes

User: Public

User: Tuure
->Flash cache emptied: 0 bytes

Total Flash Files Cleaned = 0,00 mb


OTL by OldTimer - Version 3.2.26.5 log created on 08232011_083753

Files\Folders moved on Reboot...
C:\Users\Tuure\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.
File move failed. C:\Windows\temp\_avast_\Webshlock.txt scheduled to be moved on reboot.

Registry entries deleted on Reboot...


Security Check


Results of screen317's Security Check version 0.99.7
Windows 7 (UAC is enabled)
Internet Explorer 8
``````````````````````````````
Antivirus/Firewall Check:
Windows Firewall Enabled!
avast! Free Antivirus
WMI entry may not exist for antivirus; attempting automatic update.
```````````````````````````````
Anti-malware/Other Utilities Check:
Spybot - Search & Destroy
Java(TM) 6 Update 26
Out of date Java installed!
Adobe Flash Player 10.3.181.26
Adobe Reader 9.4.5
Out of date Adobe Reader installed!
Mozilla Firefox (x86 en-US..) Firefox Out of Date!
Mozilla Thunderbird (6.0.) Thunderbird Out of Date!
````````````````````````````````
Process Check:
objlist.exe by Laurent
AVAST Software Avast AvastSvc.exe
AVAST Software Avast AvastUI.exe
``````````End of Log````````````

 

Here's the F-Secure report:

Scanning Report

Wednesday, August 24, 2011 06:25:59 - 06:28:48

Computer name: TUURE-PC
Scanning type: Quick scan
Target: System

No malware found

Statistics

Scanned:
Files: 5985
System: 5985
Not scanned: 0
Actions:
Disinfected: 0
Renamed: 0
Deleted: 0
Not cleaned: 0
Submitted: 0
Options

Scanning engines: