Solved Random redirection

blacksvk · 2012/01/11

[Resolved] Random redirection

Hi all! Hope you can help me, here is my problem:
Sometimes (few times a day) my browser(FF) redirect to some junk sites. First I just thought that i missedclicked to ad or something and then MS Sec. Essentials found me Backdoor:Win32/Simda at \AppData\Local\Temp\5726.tmp
Then I realised that browser redirection wasn't my fault....
Problem still exists (MSSecEss remoed simda without any problem), then I also started AVG System Rescue CD and AVG nothing found.... I also started Anti-Malware ... it found some issues and fixed them ... but problem still exists.

That's why I came here. Pls help.
My newest logs:

Anti-Malware:
Malwarebytes Anti-Malware 1.60.0.1800
www.malwarebytes.org

Verzia databÃ¡zy: v2012.01.09.05

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 9.0.8112.16421
ondrej :: ASUS-K50IJ [administrÃ¡tor]

11. 1. 2012 19:57:15
mbam-log-2012-01-11 (19-57-15).txt

Typ kontroly: RÃ½chla kontrola
MoÅ¾nosti kontroly zapnutÃ©: PamÃ¤ť | Po spustenÃ | Registre | SystÃ©movÃ© sÃºbory | Heuristika/Extra | Heuristika/Shuriken | PUP | PUM
MoÅ¾nosti kontroly vypnutÃ©: P2P
Objektov kontrolovanÃ½ch: 191395
UplynutÃ½ čas: 5 min, 39 sek

DetegovanÃ© sluÅ¾by pamÃ¤te: 0
(Å kodlivÃ© poloÅ¾ky neboli zistenÃ©)

DetegovanÃ© moduly pamÃ¤te: 0
(Å kodlivÃ© poloÅ¾ky neboli zistenÃ©)

DetegovanÃ© registračnÃ© kľÃºče: 0
(Å kodlivÃ© poloÅ¾ky neboli zistenÃ©)

DetegovanÃ© registračnÃ© hodnoty: 0
(Å kodlivÃ© poloÅ¾ky neboli zistenÃ©)

DetegovanÃ© poloÅ¾ky registračnÃ½ch dÃ¡t: 0
(Å kodlivÃ© poloÅ¾ky neboli zistenÃ©)

DetegovanÃ© priečinky: 0
(Å kodlivÃ© poloÅ¾ky neboli zistenÃ©)

DetegovanÃ© sÃºbory: 0
(Å kodlivÃ© poloÅ¾ky neboli zistenÃ©)

(koniec)

GMER:
GMER 1.0.15.15641 - http://www.gmer.net
Rootkit scan 2012-01-11 20:40:09
Windows 6.1.7601 Service Pack 1
Running: 2e4yfbxs.exe

---- Registry - GMER 1.0.15 ----

Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\000272a69339
Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\000272a69339@000d41044b57 0x31 0x8D 0xD9 0x82 ...
Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\000272a69339@00123743585f 0xC3 0xED 0x79 0xFB ...
Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\000272a69339@9463d15d9016 0x3D 0xD3 0x90 0x71 ...
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\000272a69339 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\000272a69339@000d41044b57 0x31 0x8D 0xD9 0x82 ...
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\000272a69339@00123743585f 0xC3 0xED 0x79 0xFB ...
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\000272a69339@9463d15d9016 0x3D 0xD3 0x90 0x71 ...

---- EOF - GMER 1.0.15 ----

aswMBR:
aswMBR version 0.9.9.1297 Copyright(c) 2011 AVAST Software
Run date: 2012-01-11 20:41:16
-----------------------------
20:41:16.120 OS Version: Windows x64 6.1.7601 Service Pack 1
20:41:16.120 Number of processors: 2 586 0xF0D
20:41:16.121 ComputerName: ASUS-K50IJ UserName: ondrej
20:41:16.654 Initialize success
21:03:51.341 AVAST engine defs: 12011101
21:13:13.497 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1
21:13:13.500 Disk 0 Vendor: ST932032 0002 Size: 305245MB BusType: 3
21:13:13.556 Disk 0 MBR read successfully
21:13:13.559 Disk 0 MBR scan
21:13:13.584 Disk 0 Windows 7 default MBR code
21:13:13.602 Disk 0 Partition 1 00 1C Hidd FAT32 LBA MSDOS5.0 14998 MB offset 2048
21:13:13.620 Disk 0 Partition 2 80 (A) 07 HPFS/NTFS NTFS 76307 MB offset 30717952
21:13:13.653 Disk 0 Partition - 00 0F Extended LBA 179225 MB offset 186996661
21:13:13.687 Disk 0 Partition 3 00 07 HPFS/NTFS NTFS 34711 MB offset 554051584
21:13:13.743 Disk 0 Partition 4 00 07 HPFS/NTFS NTFS 179225 MB offset 186996663
21:13:13.752 Service scanning
21:13:14.558 Service MpNWMon C:\Windows\system32\DRIVERS\MpNWMon.sys **LOCKED** 32
21:13:15.356 Modules scanning
21:13:15.365 Disk 0 trace - called modules:
21:13:15.434 ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys iaStor.sys hal.dll
21:13:15.441 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa8003391700]
21:13:15.447 3 CLASSPNP.SYS[fffff8800180143f] -> nt!IofCallDriver -> [0xfffffa8002493e40]
21:13:15.454 5 ACPI.sys[fffff88000f3f7a1] -> nt!IofCallDriver -> \Device\Ide\IAAStorageDevice-1[0xfffffa8003208050]
21:13:23.654 AVAST engine scan C:\Windows
21:13:33.592 AVAST engine scan C:\Windows\system32
21:16:51.465 AVAST engine scan C:\Windows\system32\drivers
21:17:08.380 AVAST engine scan C:\Users\ondrej
21:26:53.882 AVAST engine scan C:\ProgramData
21:29:25.938 Scan finished successfully
21:30:59.169 Disk 0 MBR has been saved successfully to "C:\Users\ondrej\Desktop\MBR.dat "
21:30:59.257 The log file has been saved successfully to "C:\Users\ondrej\Desktop\aswMBR.txt "

DDS:
.
DDS (Ver_2011-08-26.01) - NTFSAMD64
Internet Explorer: 9.0.8112.16421 BrowserJavaVersion: 1.6.0_26
Run by ondrej at 21:31:50 on 2012-01-11
Microsoft Windows 7 Home Premium 6.1.7601.1.1250.421.1051.18.3037.1126 [GMT 1:00]
.
AV: Microsoft Security Essentials *Enabled/Updated* {108DAC43-C256-20B7-BB05-914135DA5160}
SP: Microsoft Security Essentials *Enabled/Updated* {ABEC4DA7-E46C-2F39-81B5-AA334E5D1BDD}
SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
============== Running Processes ===============
.
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k RPCSS
C:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
C:\Program Files (x86)\ASUS\ATK Hotkey\ASLDRSrv.exe
C:\Program Files\ATKGFNEX\GFNEXSrv.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Program Files (x86)\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\Windows\system32\svchost.exe -k imgsvc
C:\Program Files\Western Digital\WD SmartWare\WDDMService.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Windows\system32\svchost.exe -k bthsvcs
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Windows\system32\taskhost.exe
C:\Windows\system32\taskeng.exe
C:\Program Files (x86)\ASUS\Splendid\ACMON.exe
C:\Program Files (x86)\ASUS\ControlDeck\ControlDeckStartUp.exe
C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe
C:\Program Files\P4G\BatteryLife.exe
C:\Windows\SysWOW64\ACEngSvr.exe
C:\Program Files (x86)\ASUS\ATK Hotkey\HControl.exe
C:\Program Files (x86)\ASUS\ATK Hotkey\Atouch64.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Program Files (x86)\ASUS\ATK Hotkey\ATKOSD.exe
C:\Program Files (x86)\ASUS\ATK Hotkey\KBFiltr.exe
C:\Program Files (x86)\ASUS\ATK Hotkey\WDC.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe
C:\Windows\WindowsMobile\wmdc.exe
C:\Windows\system32\svchost.exe -k WindowsMobile
C:\Windows\system32\taskeng.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Program Files\Elantech\ETDCtrl.exe
C:\Program Files\Microsoft Security Client\msseces.exe
C:\Windows\System32\igfxtray.exe
C:\Windows\System32\hkcmd.exe
C:\Windows\system32\SearchIndexer.exe
C:\Windows\System32\igfxpers.exe
C:\Users\ondrej\AppData\Roaming\Dropbox\bin\Dropbox.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDECK.EXE
C:\Program Files (x86)\ASUS\ATK Hotkey\HControlUser.exe
C:\Program Files (x86)\ASUS\ATKOSD2\ATKOSD2.exe
C:\Program Files (x86)\ASUS\ATK Media\DMedia.exe
C:\Windows\system32\svchost.exe -k SDRSVC
C:\Program Files (x86)\Mozilla Firefox\firefox.exe
C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe
C:\Program Files\Microsoft Security Client\Antimalware\NisSrv.exe
C:\Windows\system32\WUDFHost.exe
C:\Program Files (x86)\IrfanView\i_view32.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\conhost.exe
C:\Windows\SysWOW64\cscript.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = about:blank
uDefault_Page_URL = hxxp://asus.msn.com
mWinlogon: Userinit=userinit.exe,
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
BHO: Search Helper: {6ebf7485-159f-4bff-a14f-b9e3aac4465b} - C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
BHO: PomocnÃk pri prihlasovanÃ v konte Windows Live ID: {9030d464-4c02-4abf-8ecc-5164760863c6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
TB: {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No File
EB: Developer Tools: {1a6fe369-f28c-4ad9-a3e6-2bcb50807cf1} - C:\Program Files (x86)\Internet Explorer\iedvtool.dll
uRun: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
uRun: [Facebook Update] "C:\Users\ondrej\AppData\Local\Facebook\Update\FacebookUpdate.exe" /c /nocrashserver
mRun: [HDAudDeck] C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe -r
mRun: [HControlUser] C:\Program Files (x86)\ASUS\ATK Hotkey\HControlUser.exe
mRun: [ATKOSD2] C:\Program Files (x86)\ASUS\ATKOSD2\ATKOSD2.exe
mRun: [ATKMEDIA] C:\Program Files (x86)\ASUS\ATK Media\DMedia.exe
StartupFolder: C:\Users\ondrej\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Dropbox.lnk - C:\Users\ondrej\AppData\Roaming\Dropbox\bin\Dropbox.exe
StartupFolder: C:\Users\ondrej\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\FACEBO~1.LNK - C:\Users\ondrej\AppData\Local\Facebook\Messenger\2.0.4392.0\FacebookMessenger.exe
mPolicies-explorer: NoActiveDesktop = 1 (0x1)
mPolicies-explorer: NoActiveDesktopChanges = 1 (0x1)
mPolicies-system: ConsentPromptBehaviorAdmin = 5 (0x5)
mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: E&xport to Microsoft Excel - C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000
IE: {7644E42D-B096-457F-8B5B-901238FC81AE} - C:\Program Files (x86)\ICQ7.6\ICQ.exe
IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
IE: {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - {2EAF5BB0-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
IE: {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - {2EAF5BB0-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab
TCP: DhcpNameServer = 192.168.2.1
TCP: Interfaces\{203EB168-D049-415D-A8A5-2428A09D8584} : DhcpNameServer = 192.168.2.1
TCP: Interfaces\{554ADB45-14AF-4714-B2B1-FB1013943172}\36F6F6C637B637F66647 : DhcpNameServer = 192.168.2.1
TCP: Interfaces\{554ADB45-14AF-4714-B2B1-FB1013943172}\7497D605162747E424 : DhcpNameServer = 195.146.128.62 195.146.132.59
TCP: Interfaces\{554ADB45-14AF-4714-B2B1-FB1013943172}\86F64756C6D20716274796A716E6 : DhcpNameServer = 195.168.1.2 195.168.1.4
TCP: Interfaces\{B73F8639-F00A-4197-87EA-5DA69DAFF66D} : DhcpNameServer = 192.168.0.1
Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
BHO-X64: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
BHO-X64: AcroIEHelperStub - No File
BHO-X64: Search Helper: {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
BHO-X64: Search Helper - No File
BHO-X64: Pomocnˇk pri prihlasovanˇ v konte Windows Live ID: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
BHO-X64: Java(tm) Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
TB-X64: {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No File
EB-X64: {1A6FE369-F28C-4AD9-A3E6-2BCB50807CF1} - No File
mRun-x64: [HDAudDeck] C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe -r
mRun-x64: [HControlUser] C:\Program Files (x86)\ASUS\ATK Hotkey\HControlUser.exe
mRun-x64: [ATKOSD2] C:\Program Files (x86)\ASUS\ATKOSD2\ATKOSD2.exe
mRun-x64: [ATKMEDIA] C:\Program Files (x86)\ASUS\ATK Media\DMedia.exe
IE-X64: {7644E42D-B096-457F-8B5B-901238FC81AE} - C:\Program Files (x86)\ICQ7.6\ICQ.exe
Hosts: 127.0.0.1 www.spywareinfo.com
Hosts: 69.72.252.254 www.google-analytics.com.
Hosts: 69.72.252.254 ad-emea.doubleclick.net.
Hosts: 69.72.252.254 www.statcounter.com.
Hosts: 184.95.41.155 www.google-analytics.com.
.
Note: multiple HOSTS entries found. Please refer to Attach.txt
.
================= FIREFOX ===================
.
FF - ProfilePath - C:\Users\ondrej\AppData\Roaming\Mozilla\Firefox\Profiles\e69i7t0c.default\
FF - plugin: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll
FF - plugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: C:\Program Files (x86)\Microsoft Silverlight\4.0.60831.0\npctrlui.dll
FF - plugin: C:\Program Files (x86)\Mozilla Firefox\plugins\npdeployJava1.dll
FF - plugin: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll
FF - plugin: C:\Users\ondrej\AppData\Local\Facebook\Messenger\2.0.4392.0\npFbDesktopPlugin.dll
FF - plugin: C:\Users\ondrej\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll
FF - plugin: C:\Users\ondrej\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll
FF - plugin: C:\Windows\system32\Wat\npWatWeb.dll
FF - plugin: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll
.
============= SERVICES / DRIVERS ===============
.
R1 appdrv01;Application Driver (01);C:\Windows\system32\Drivers\appdrv01.sys --> C:\Windows\system32\Drivers\appdrv01.sys [?]
R1 HWiNFO32;HWiNFO32 Kernel Driver;D:\Programy\hwinfo32\HWiNFO64A.SYS [2010-2-22 30080]
R1 MpFilter;Microsoft Malware Protection Driver;C:\Windows\system32\DRIVERS\MpFilter.sys --> C:\Windows\system32\DRIVERS\MpFilter.sys [?]
R1 vwififlt;Virtual WiFi Filter Driver;C:\Windows\system32\DRIVERS\vwififlt.sys --> C:\Windows\system32\DRIVERS\vwififlt.sys [?]
R2 ASMMAP64;ASMMAP64;C:\Program Files\ATKGFNEX\ASMMAP64.sys [2009-10-30 14904]
R2 WDDMService;WDDMService;C:\Program Files\Western Digital\WD SmartWare\WDDMService.exe [2011-6-29 317328]
R3 AmUStor;AM USB Stroage Driver;C:\Windows\system32\drivers\AmUStor.SYS --> C:\Windows\system32\drivers\AmUStor.SYS [?]
R3 ETD;ELAN PS/2 Port Input Device;C:\Windows\system32\DRIVERS\ETD.sys --> C:\Windows\system32\DRIVERS\ETD.sys [?]
R3 MpNWMon;Microsoft Malware Protection Network Driver;C:\Windows\system32\DRIVERS\MpNWMon.sys --> C:\Windows\system32\DRIVERS\MpNWMon.sys [?]
R3 NisDrv;Microsoft Network Inspection System;C:\Windows\system32\DRIVERS\NisDrvWFP.sys --> C:\Windows\system32\DRIVERS\NisDrvWFP.sys [?]
R3 NisSrv;Kontrola siete od spoločnosti Microsoft;C:\Program Files\Microsoft Security Client\Antimalware\NisSrv.exe [2011-4-27 288272]
R3 VIAHdAudAddService;VIA High Definition Audio Driver Service;C:\Windows\system32\drivers\viahduaa.sys --> C:\Windows\system32\drivers\viahduaa.sys [?]
R3 vwifimp;Microsoft Virtual WiFi Miniport Service;C:\Windows\system32\DRIVERS\vwifimp.sys --> C:\Windows\system32\DRIVERS\vwifimp.sys [?]
S2 appdrvrem01;Application Driver Auto Removal Service (01);C:\Windows\System32\appdrvrem01.exe svc --> C:\Windows\System32\appdrvrem01.exe svc [?]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]
S3 camdrv42;Philips SPC 900NC PC Camera;C:\Windows\system32\DRIVERS\camdrv42.sys --> C:\Windows\system32\DRIVERS\camdrv42.sys [?]
S3 DrvAgent64;DrvAgent64;C:\Windows\SysWOW64\drivers\DrvAgent64.SYS [2011-11-20 21712]
S3 ivusb;Initio Driver for USB Default Controller;C:\Windows\system32\DRIVERS\ivusb.sys --> C:\Windows\system32\DRIVERS\ivusb.sys [?]
S3 PAC207;USB PC Camera;C:\Windows\system32\DRIVERS\PFC027.SYS --> C:\Windows\system32\DRIVERS\PFC027.SYS [?]
S3 SiSGbeLH;SiS191/SiS190 Ethernet Device NDIS 6.0 Driver;C:\Windows\system32\DRIVERS\SiSG664.sys --> C:\Windows\system32\DRIVERS\SiSG664.sys [?]
S3 TsUsbFlt;TsUsbFlt;C:\Windows\system32\drivers\tsusbflt.sys --> C:\Windows\system32\drivers\tsusbflt.sys [?]
S3 VCSVADHWSer;Avnex Virtual Audio Device (WDM);C:\Windows\system32\DRIVERS\vcsvad.sys --> C:\Windows\system32\DRIVERS\vcsvad.sys [?]
S3 WatAdminSvc;SluÅ¾ba Windows Activation Technologies;C:\Windows\system32\Wat\WatAdminSvc.exe --> C:\Windows\system32\Wat\WatAdminSvc.exe [?]
S3 WDC_SAM;WD SCSI Pass Thru driver;C:\Windows\system32\DRIVERS\wdcsam64.sys --> C:\Windows\system32\DRIVERS\wdcsam64.sys [?]
S4 AdobeARMservice;Adobe Acrobat Update Service;C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2011-6-6 64952]
S4 FastBootAgent;FastBootAgent;C:\Windows\SysWOW64\Fast Boot\FastBootAgent.exe [2009-10-30 306232]
S4 WDFMEService;WDFMEService;C:\Program Files\Western Digital\WD SmartWare\WDFME.exe [2011-6-29 1978256]
S4 WDRulesService;WDRulesService;C:\Program Files\Western Digital\WD SmartWare\WDRulesEngine.exe [2011-6-29 1338256]
.
=============== Created Last 30 ================
.
2012-01-11 19:41:33 69000 ----a-w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{70B15313-9637-4392-9B81-D2E3E60D80CC}\offreg.dll
2012-01-11 19:41:30 8822856 ----a-w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{70B15313-9637-4392-9B81-D2E3E60D80CC}\mpengine.dll
2012-01-11 14:00:46 1572864 ----a-w- C:\Windows\System32\quartz.dll
2012-01-11 14:00:46 1328128 ----a-w- C:\Windows\SysWow64\quartz.dll
2012-01-11 14:00:45 514560 ----a-w- C:\Windows\SysWow64\qdvd.dll
2012-01-11 14:00:45 366592 ----a-w- C:\Windows\System32\qdvd.dll
2012-01-11 14:00:44 1731920 ----a-w- C:\Windows\System32\ntdll.dll
2012-01-11 14:00:44 1292080 ----a-w- C:\Windows\SysWow64\ntdll.dll
2012-01-11 14:00:43 77312 ----a-w- C:\Windows\System32\packager.dll
2012-01-11 14:00:43 67072 ----a-w- C:\Windows\SysWow64\packager.dll
2012-01-09 13:35:55 -------- d-----w- C:\Users\ondrej\AppData\Roaming\Malwarebytes
2012-01-09 13:35:38 -------- d-----w- C:\ProgramData\Malwarebytes
2012-01-09 13:35:36 23152 ----a-w- C:\Windows\System32\drivers\mbam.sys
2012-01-09 13:35:36 -------- d-----w- C:\Program Files (x86)\Malwarebytes' Anti-Malware
2012-01-08 11:09:36 -------- d-----w- C:\Users\ondrej\AppData\Local\{CB4D5EFE-2622-4C93-B292-7CDAB78539E3}
2012-01-08 11:09:24 -------- d-----w- C:\Users\ondrej\AppData\Local\{F5F3A925-3CE8-4AAE-A0BF-BBFF9D00FC35}
2012-01-07 20:34:33 -------- d-----w- C:\Users\ondrej\AppData\Local\{4E6A89B1-87FA-4C7A-A1F0-2469B60F0A5F}
2012-01-07 20:34:20 -------- d-----w- C:\Users\ondrej\AppData\Local\{0AA7FE71-7242-4BDD-8E6C-1F84213A93D9}
2012-01-05 08:48:35 -------- d-----w- C:\Users\ondrej\AppData\Local\{362765F9-6255-4E09-B0EC-1468601E3593}
2012-01-05 08:48:23 -------- d-----w- C:\Users\ondrej\AppData\Local\{FF80144D-9179-49B2-8963-7725CB7041CF}
2012-01-03 13:58:47 -------- d-----w- C:\Program Files (x86)\OS Launcher
2012-01-03 10:04:31 -------- d-----w- C:\Users\ondrej\AppData\Local\{85812F5D-DCE4-4696-98FA-A9F717BF1E5F}
2012-01-03 10:04:18 -------- d-----w- C:\Users\ondrej\AppData\Local\{F483147D-055E-423A-8A35-1F23DAF699B3}
2012-01-01 15:46:38 -------- d-----w- C:\Program Files (x86)\NSIS
2012-01-01 13:20:22 -------- d-----w- C:\Users\ondrej\AppData\Local\{8DC2306F-17F0-40FB-88D3-EF16E0B9E0E1}
2012-01-01 13:20:10 -------- d-----w- C:\Users\ondrej\AppData\Local\{301E205A-D736-4E52-9D0B-25A4D699DA04}
2011-12-31 18:51:38 -------- d-----w- C:\Users\ondrej\AppData\Local\{64B89CCA-2E42-413C-82D2-C49BD678815D}
2011-12-31 18:51:23 -------- d-----w- C:\Users\ondrej\AppData\Local\{BD443ED2-40A0-4348-9D5C-45984499D008}
2011-12-31 18:35:15 -------- d-----w- C:\Users\ondrej\AppData\Roaming\TS3Client
2011-12-31 18:34:03 -------- d-----w- C:\Program Files (x86)\TeamSpeak 3 Client
2011-12-31 00:05:29 -------- d-----w- C:\Users\ondrej\AppData\Local\{128A2DCC-779E-486C-BD62-51034C0A6C95}
2011-12-31 00:05:17 -------- d-----w- C:\Users\ondrej\AppData\Local\{3966FECB-439E-433D-937C-DE76F23C4A2F}
2011-12-29 21:57:32 -------- d-----w- C:\Users\ondrej\AppData\Local\{6795D43B-5AC3-4348-BDAB-D5758A5119AC}
2011-12-29 21:57:20 -------- d-----w- C:\Users\ondrej\AppData\Local\{E5D749E9-F1F2-4BF1-841D-89BD0D9B389B}
2011-12-28 13:51:40 -------- d-----w- C:\Users\ondrej\AppData\Local\{005CBAC0-883F-4555-AADB-105110A328A1}
2011-12-28 13:51:26 -------- d-----w- C:\Users\ondrej\AppData\Local\{63E56BB9-5EB4-4A89-B67C-7B2E70D5C45E}
2011-12-28 11:00:32 -------- d-----w- C:\Users\ondrej\AppData\Roaming\PabloDraw
2011-12-27 09:23:32 -------- d-----w- C:\Users\ondrej\AppData\Local\{EA15AF75-7D83-4D0B-9478-72608A5C3CD8}
2011-12-27 09:23:18 -------- d-----w- C:\Users\ondrej\AppData\Local\{DD7C90C0-6A48-43B5-A021-ACD40B9C86FC}
2011-12-26 13:16:26 -------- d-----w- C:\Users\ondrej\AppData\Local\{792B9EBF-5624-4BE3-874B-4054BE9249B4}
2011-12-26 13:16:12 -------- d-----w- C:\Users\ondrej\AppData\Local\{0DE32E3E-8932-40DA-8B5E-4B40F6067028}
2011-12-26 11:44:11 809496 ----a-r- C:\Windows\SysWow64\tmpAA74.tmp
2011-12-26 11:44:11 109080 ----a-w- C:\Windows\SysWow64\OpenAL32.dll
2011-12-26 11:14:15 -------- d-----w- C:\Program Files (x86)\Common Files\Futuremark Shared
2011-12-26 11:12:17 5632 ----a-w- C:\Windows\SysWow64\drivers\Entech64.sys
2011-12-26 11:12:17 3972 ----a-w- C:\Windows\SysWow64\drivers\PciBus.sys
2011-12-26 11:12:16 21664 ----a-w- C:\Windows\SysWow64\drivers\Entech.sys
2011-12-26 11:12:16 -------- d-----w- C:\Windows\SysWow64\Futuremark
2011-12-26 11:07:43 -------- d-----w- C:\Program Files (x86)\Futuremark
2011-12-26 11:06:52 69715 ----a-w- C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\10\01\Intel32\ctor.dll
2011-12-26 11:06:52 5632 ----a-w- C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\10\01\Intel32\DotNetInstaller.exe
2011-12-26 11:06:52 32768 ----a-w- C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\Objectps.dll
2011-12-26 11:06:52 266240 ----a-w- C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\10\01\Intel32\iscript.dll
2011-12-26 11:06:52 172032 ----a-w- C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\10\01\Intel32\iuser.dll
2011-12-26 11:06:51 733184 ----a-w- C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\10\01\Intel32\iKernel.dll
2011-12-26 11:06:51 303236 ----a-w- C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\10\01\Intel32\setup.dll
2011-12-26 11:06:51 180356 ----a-w- C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\10\01\Intel32\iGdi.dll
2011-12-25 20:24:30 -------- d-----w- C:\Windows\System32\wbem\Framework\root\OpenHardwareMonitor
2011-12-25 20:24:30 -------- d-----w- C:\Windows\System32\wbem\Framework\root
2011-12-25 20:24:30 -------- d-----w- C:\Windows\System32\wbem\Framework
2011-12-25 10:48:43 -------- d-----w- C:\Users\ondrej\AppData\Local\{4CD750A2-836A-4912-9C81-016459A7B333}
2011-12-25 10:48:30 -------- d-----w- C:\Users\ondrej\AppData\Local\{3DD1DF51-1825-4EC2-85A5-437682FF3BE2}
2011-12-24 12:07:03 -------- d-----w- C:\Users\ondrej\AppData\Local\{B5F7AF9A-7159-42C5-BD3F-CA8A1B38531E}
2011-12-24 12:06:50 -------- d-----w- C:\Users\ondrej\AppData\Local\{34A88B44-32C7-46E8-AEA6-62A97CCC5179}
2011-12-23 22:44:26 -------- d-----w- C:\Users\ondrej\AppData\Local\{DC266750-293F-4B99-978D-A7942D2C8C85}
2011-12-23 22:44:14 -------- d-----w- C:\Users\ondrej\AppData\Local\{EBF8A0C4-A92B-4961-9CC2-0619144DFDAA}
2011-12-23 10:43:47 -------- d-----w- C:\Users\ondrej\AppData\Local\{E7F09075-1EDB-4560-96C5-2E54B534FA62}
2011-12-23 10:43:36 -------- d-----w- C:\Users\ondrej\AppData\Local\{25EA0A90-68C5-483A-947A-E97AA2BCA8A3}
2011-12-23 10:43:15 -------- d-----w- C:\Users\ondrej\AppData\Local\{3CBD00EE-7ADC-4DE5-9875-6523445CB7F4}
2011-12-22 14:49:37 -------- d-----w- C:\Users\ondrej\AppData\Local\{53503C9B-CA04-4621-BA57-74D7B46C1D0E}
2011-12-22 14:49:24 -------- d-----w- C:\Users\ondrej\AppData\Local\{EC7136B7-2A22-4585-BEBA-8CA77CDDA5AF}
2011-12-21 14:41:00 -------- d-----w- C:\Users\ondrej\AppData\Local\{DF5B4504-6980-4C66-9F9C-CD35FDE83C54}
2011-12-21 14:40:49 -------- d-----w- C:\Users\ondrej\AppData\Local\{AA08D1B9-BF07-4E80-B16E-7AFD306CF8F5}
2011-12-20 22:27:44 -------- d-----w- C:\Users\ondrej\AppData\Local\{126CFD78-2DC9-400E-85C4-816667A11D42}
2011-12-20 22:27:32 -------- d-----w- C:\Users\ondrej\AppData\Local\{C10B128E-4A26-4DEA-ADEC-C085AEC99F6D}
2011-12-19 15:58:59 -------- d-----w- C:\Users\ondrej\AppData\Local\{9D3213DE-D540-422D-83D2-7BAB07815417}
2011-12-19 15:58:47 -------- d-----w- C:\Users\ondrej\AppData\Local\{4E5ACF61-92DC-430A-8654-CD96506C4D97}
2011-12-18 10:42:48 -------- d-----w- C:\Users\ondrej\AppData\Local\{CD53F574-7D80-445B-BC4D-398616C1583D}
2011-12-18 10:42:34 -------- d-----w- C:\Users\ondrej\AppData\Local\{DDD6052C-7414-4F54-B004-CC5AA9F84CF5}
2011-12-15 19:36:01 2382848 ----a-w- C:\Windows\SysWow64\mshtml.tlb
2011-12-15 19:36:01 2382848 ----a-w- C:\Windows\System32\mshtml.tlb
2011-12-15 19:36:00 174392 ----a-w- C:\Program Files\Internet Explorer\sqmapi.dll
2011-12-15 19:36:00 141112 ----a-w- C:\Program Files (x86)\Internet Explorer\sqmapi.dll
2011-12-15 19:32:58 43520 ----a-w- C:\Windows\System32\csrsrv.dll
2011-12-15 19:32:56 723456 ----a-w- C:\Windows\System32\EncDec.dll
2011-12-15 19:32:56 3145216 ----a-w- C:\Windows\System32\win32k.sys
2011-12-15 19:32:55 534528 ----a-w- C:\Windows\SysWow64\EncDec.dll
2011-12-15 19:32:40 2048 ----a-w- C:\Windows\SysWow64\tzres.dll
2011-12-15 19:32:40 2048 ----a-w- C:\Windows\System32\tzres.dll
2011-12-15 15:13:47 -------- d-----w- C:\Users\ondrej\AppData\Local\{53728DA2-48C5-4101-9D02-59DE8A2817E7}
2011-12-15 15:13:35 -------- d-----w- C:\Users\ondrej\AppData\Local\{E2D48FF4-BAEA-496F-857A-05BF716469E8}
2011-12-14 21:13:23 -------- d-----w- C:\Users\ondrej\AppData\Local\{487804AE-ED4B-449A-A726-C99119F4327C}
2011-12-14 21:13:11 -------- d-----w- C:\Users\ondrej\AppData\Local\{77D0849E-3C09-4A98-A4DF-761EA6247DA8}
2011-12-13 13:33:47 -------- d-----w- C:\Users\ondrej\AppData\Local\{FF96F6D8-56B1-4620-9AED-EB5F467691BB}
2011-12-13 13:33:34 -------- d-----w- C:\Users\ondrej\AppData\Local\{50C56D22-35CB-42E0-83AA-E6B99D26FC7B}
.
==================== Find3M ====================
.
2011-12-26 11:44:11 466456 ----a-w- C:\Windows\System32\wrap_oal.dll
2011-12-26 11:44:11 444952 ----a-w- C:\Windows\SysWow64\wrap_oal.dll
2011-12-26 11:44:11 122904 ----a-w- C:\Windows\System32\OpenAL32.dll
2011-12-26 11:44:07 809496 ----a-r- C:\Windows\SysWow64\tmpAA73.tmp
2011-11-20 12:36:44 21712 ----a-w- C:\Windows\SysWow64\drivers\DrvAgent64.SYS
2011-11-17 06:49:14 95600 ----a-w- C:\Windows\System32\drivers\ksecdd.sys
2011-11-17 06:49:14 152432 ----a-w- C:\Windows\System32\drivers\ksecpkg.sys
2011-11-17 06:44:43 459232 ----a-w- C:\Windows\System32\drivers\cng.sys
2011-11-17 06:35:28 395776 ----a-w- C:\Windows\System32\webio.dll
2011-11-17 06:35:26 29184 ----a-w- C:\Windows\System32\sspisrv.dll
2011-11-17 06:35:26 136192 ----a-w- C:\Windows\System32\sspicli.dll
2011-11-17 06:35:25 340992 ----a-w- C:\Windows\System32\schannel.dll
2011-11-17 06:35:25 28160 ----a-w- C:\Windows\System32\secur32.dll
2011-11-17 06:35:19 1447936 ----a-w- C:\Windows\System32\lsasrv.dll
2011-11-17 06:33:55 31232 ----a-w- C:\Windows\System32\lsass.exe
2011-11-17 05:35:02 314880 ----a-w- C:\Windows\SysWow64\webio.dll
2011-11-17 05:34:52 224768 ----a-w- C:\Windows\SysWow64\schannel.dll
2011-11-17 05:34:52 22016 ----a-w- C:\Windows\SysWow64\secur32.dll
2011-11-17 05:28:48 96768 ----a-w- C:\Windows\SysWow64\sspicli.dll
2011-11-16 21:35:15 414368 ----a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
2011-11-04 11:37:00 224048 ----a-w- C:\Windows\System32\drivers\VBoxDrv.sys
2011-11-04 01:53:39 2309120 ----a-w- C:\Windows\System32\jscript9.dll
2011-11-04 01:44:47 1390080 ----a-w- C:\Windows\System32\wininet.dll
2011-11-04 01:44:21 1493504 ----a-w- C:\Windows\System32\inetcpl.cpl
2011-11-03 22:47:42 1798144 ----a-w- C:\Windows\SysWow64\jscript9.dll
2011-11-03 22:40:21 1427456 ----a-w- C:\Windows\SysWow64\inetcpl.cpl
2011-11-03 22:39:47 1127424 ----a-w- C:\Windows\SysWow64\wininet.dll
2011-10-30 19:44:07 45056 ----a-w- C:\Windows\System32\acovcnt.exe
2011-10-25 10:26:03 2829 ----a-w- C:\Windows\War3Unin.pif
2011-10-25 10:26:03 126976 ----a-w- C:\Windows\War3Unin.exe
2006-05-03 10:06:54 163328 --sh--r- C:\Windows\SysWOW64\flvDX.dll
2007-02-21 11:47:16 31232 --sh--r- C:\Windows\SysWOW64\msfDX.dll
2008-03-16 13:30:52 216064 --sh--r- C:\Windows\SysWOW64\nbDX.dll
.
============= FINISH: 21:32:55,50 ===============

DDS-attach:
.
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
.
DDS (Ver_2011-08-26.01)
.
Microsoft Windows 7 Home Premium
Boot Device: \Device\HarddiskVolume2
Install Date: 24. 12. 2009 22:16:18
System Uptime: 11. 1. 2012 18:23:42 (3 hours ago)
.
Motherboard: ASUSTeK Computer Inc. | | K50IJ
Processor: Intel(R) Core(TM)2 Duo CPU T5870 @ 2.00GHz | Socket 478 | 2001/200mhz
.
==== Disk Partitions =========================
.
C: is FIXED (NTFS) - 75 GiB total, 14,795 GiB free.
D: is FIXED (NTFS) - 175 GiB total, 1,174 GiB free.
E: is CDROM (CDFS)
F: is FIXED (NTFS) - 34 GiB total, 15,837 GiB free.
I: is Removable
.
==== Disabled Device Manager Items =============
.
==== System Restore Points ===================
.
RP404: 11. 1. 2012 16:11:00 - Windows Update
.
==== Hosts File Hijack ======================
.
Hosts: 127.0.0.1 www.spywareinfo.com
Hosts: 69.72.252.254 www.google-analytics.com.
Hosts: 69.72.252.254 ad-emea.doubleclick.net.
Hosts: 69.72.252.254 www.statcounter.com.
Hosts: 184.95.41.155 www.google-analytics.com.
Hosts: 184.95.41.155 ad-emea.doubleclick.net.
Hosts: 184.95.41.155 www.statcounter.com.
.
==== Installed Programs ======================
.
1C Company\Space Rangers 2 - Reboot Add-on
3DMark06
Adobe AIR
Adobe Flash Player 10 ActiveX
Adobe Reader X (10.1.1) - Czech
Alcor Micro USB Card Reader
Android SDK Tools
Angry Birds
Angry Birds Rio
Angry Birds Seasons
Apple Application Support
AREA-51 (remove only)
ASUS AI Recovery
ASUS FancyStart
ASUS LifeFrame3
ASUS SmartLogon
ASUS Splendid Video Enhancement Technology
ASUS Virtual Camera
Asus_Camera_ScreenSaver
Atheros Communications Inc.(R) AR8121/AR8113/AR8114 Gigabit/Fast Ethernet Driver
ATK Generic Function Service
ATK Hotkey
ATK Media
ATKOSD2
AutoIt v3.3.6.1
Autorun 2.1
Avencast
Bazaar 2.3.4
Canon Utilities PhotoStitch
ControlDeck
D3DX10
Dropbox
EasyBCD 2.1
Facebook Messenger 2.0.4392.0
Facebook Video Calling 1.0.0.7339
Facebook Video Calling 1.0.0.8953
Feedback Tool
Free Pascal 2.4.0
Futuremark SystemInfo
Hacker Evolution - Demo
Hacker Evolution: Untold - Demo
Half-Life 2
Hugin 2010.4.0
ICQ7.6
IETester v0.4.11 (remove only)
Inno Setup verzia 5.4.3
Intel(R) Graphics Media Accelerator Driver
IrfanView (remove only)
Island Wars 2
Java Auto Updater
Java(TM) 6 Update 26
Junk Mail filter update
LAME v3.98.3 for Audacity
LibreOffice 3.4
Malwarebytes Anti-Malware verzia 1.60.0.1800
Maxima 5.25.1
Microsoft .NET Compact Framework 2.0 SP2
Microsoft .NET Compact Framework 3.5
Microsoft .NET Framework 4 Multi-Targeting Pack
Microsoft Age of Empires II
Microsoft Age of Empires II: The Conquerors Expansion
Microsoft Application Error Reporting
Microsoft Device Experience Development Kit 7R2
Microsoft Games for Windows - LIVE Redistributable
Microsoft Games for Windows Marketplace
Microsoft Search Enhancement Pack
Microsoft Silverlight
Microsoft Small Basic v0.95
Microsoft SQL Server 2008 R2 Management Objects
Microsoft SQL Server Compact 3.5 SP2 ENU
Microsoft SQL Server Database Publishing Wizard 1.2
Microsoft SQL Server System CLR Types
Microsoft Visual C# 2010 Express - ENU
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.30319
Microsoft Visual C++ 2010 x86 Runtime - 10.0.40219
Microsoft Visual Studio 2010 ADO.NET Entity Framework Tools
Microsoft Visual Studio 2010 Service Pack 1
Microsoft XNA Framework Redistributable 4.0
Microsoft XNA Game Studio 4.0
Microsoft XNA Game Studio 4.0 (ARP entry)
Microsoft XNA Game Studio 4.0 (Redists)
Microsoft XNA Game Studio 4.0 (Shared Components)
Microsoft XNA Game Studio 4.0 (Visual Studio)
Microsoft XNA Game Studio 4.0 (XnaLiveProxy)
Microsoft XNA Game Studio 4.0 Documentation
Microsoft XNA Game Studio Platform Tools
Mozilla Firefox 9.0.1 (x86 sk)
MSVCRT
MSVCRT_amd64
MusicBrainz Picard
MusicJet
Need for Speed Underground 2
Need For Speedâ„¢ World
Notepad++
OpenAL
OS Launcher verzia 2.0
PabloDraw
PacIn: Nermessova pomsta 1.0
PC sys info 2.7.2
Philips SPC 900NC PC Camera
PHP Obfuscator
Platform
QuickTime
Really Slick Screensavers 0.2
Scorpions WinCheater
Security Update for Microsoft .NET Framework 4 Client Profile (KB2160841)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2446708)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2478663)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2539636)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2572078)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351)
Security Update for Microsoft .NET Framework 4 Extended (KB2487367)
Security Update for Microsoft .NET Framework 4 Extended (KB2656351)
Sgc 3D Simulator 1.5
Steam
SUPER © Version 2010.bld.37 (Jan 2, 2010)
SuperTux 0.3.1
System Explorer 3.0.0
TeamSpeak 3 Client
TmNationsForever Update 2010-03-15
Total Commander (Remove or Repair)
Unity Web Player
Update for Microsoft .NET Framework 4 Client Profile (KB2468871)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523)
Update for Microsoft .NET Framework 4 Extended (KB2468871)
Update for Microsoft .NET Framework 4 Extended (KB2533523)
Uplink Demo (remove only)
VIA Platform Device Manager
Visual C++ 8.0 Runtime Setup Package (x64)
Visual Studio 2010 Tools for SQL Server Compact 3.5 SP2 ENU
Visual Studio Tools for the Office system 3.0 Runtime
VLC media player 1.1.5
Warcraft III
Warmux
Windows 7 USB/DVD Download Tool
Windows Live Communications Platform
Windows Live Essentials
Windows Live FotogalÃ©ria
Windows Live Installer
Windows Live Mail
Windows Live Movie Maker
Windows Live Photo Common
Windows Live Photo Gallery
Windows Live PIMT Platform
Windows Live SOXE
Windows Live SOXE Definitions
Windows Live Sync
Windows Live UX Platform
Windows Live UX Platform Language Pack
Windows Live Writer
Windows Live Writer Resources
Windows Media Player Firefox Plugin
WinFlash
Wireless Console 3
World of Warcraft
XBMC
.
==== Event Viewer Messages From Past Week ========
.
9. 1. 2012 22:20:40, Error: Microsoft Antimalware [3002] - Vo funkcii Ochrana v reÃ¡lnom čase programu Microsoft Antimalware sa vyskytla chyba a funkcia zlyhala. Funkcia: Monitorovanie sprÃ¡vania KÃ³d chyby: 0x80004005 Popis chyby: NeznÃ¡ma chyba DÃ´vod: SprÃ¡vne fungovanie ovlÃ¡dača filtra vyÅ¾aduje aktuÃ¡lny nÃ¡stroj. Ak chcete povoliť ochranu v reÃ¡lnom čase, musÃte nainÅ¡talovať najnovÅ¡ie aktualizÃ¡cie definÃciÃ.
9. 1. 2012 16:02:18, Error: Microsoft-Windows-DNS-Client [1012] - There was an error while attempting to read the local hosts file.
9. 1. 2012 14:31:30, Error: Microsoft Antimalware [3002] - Vo funkcii Ochrana v reÃ¡lnom čase programu Microsoft Antimalware sa vyskytla chyba a funkcia zlyhala. Funkcia: Monitorovanie sprÃ¡vania KÃ³d chyby: 0x80004005 Popis chyby: NeznÃ¡ma chyba DÃ´vod: SprÃ¡vne fungovanie ovlÃ¡dača filtra vyÅ¾aduje aktuÃ¡lny nÃ¡stroj. Ak chcete povoliť ochranu v reÃ¡lnom čase, musÃte nainÅ¡talovať najnovÅ¡ie aktualizÃ¡cie definÃciÃ.
9. 1. 2012 14:25:24, Error: Service Control Manager [7001] - Spustenie sluÅ¾by Network Location Awareness, od ktorej zÃ¡visÃ sluÅ¾ba Network List Service, zlyhalo kvÃ´li nasledujÃºcej chybe: ZÃ¡vislÃº sluÅ¾bu alebo skupinu sa nepodarilo spustiť.
9. 1. 2012 14:25:24, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service fdPHost with arguments " " in order to run the server: {D3DCB472-7261-43CE-924B-0704BD730D5F}
9. 1. 2012 14:25:24, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service fdPHost with arguments " " in order to run the server: {145B4335-FE2A-4927-A040-7C35AD3180EF}
9. 1. 2012 14:25:04, Error: Service Control Manager [7001] - Spustenie sluÅ¾by Network Location Awareness, od ktorej zÃ¡visÃ sluÅ¾ba Network List Service, zlyhalo kvÃ´li nasledujÃºcej chybe: ZÃ¡vislÃº sluÅ¾bu alebo skupinu sa nepodarilo spustiť.
9. 1. 2012 14:25:04, Error: Service Control Manager [7001] - Spustenie sluÅ¾by Network Location Awareness, od ktorej zÃ¡visÃ sluÅ¾ba Network List Service, zlyhalo kvÃ´li nasledujÃºcej chybe: ZÃ¡vislÃº sluÅ¾bu alebo skupinu sa nepodarilo spustiť.
9. 1. 2012 14:25:04, Error: Service Control Manager [7001] - Spustenie sluÅ¾by Network Location Awareness, od ktorej zÃ¡visÃ sluÅ¾ba Network List Service, zlyhalo kvÃ´li nasledujÃºcej chybe: ZÃ¡vislÃº sluÅ¾bu alebo skupinu sa nepodarilo spustiť.
9. 1. 2012 14:25:04, Error: Service Control Manager [7001] - Spustenie sluÅ¾by Network Location Awareness, od ktorej zÃ¡visÃ sluÅ¾ba Network List Service, zlyhalo kvÃ´li nasledujÃºcej chybe: ZÃ¡vislÃº sluÅ¾bu alebo skupinu sa nepodarilo spustiť.
9. 1. 2012 14:25:04, Error: Service Control Manager [7001] - Spustenie sluÅ¾by Network Location Awareness, od ktorej zÃ¡visÃ sluÅ¾ba Network List Service, zlyhalo kvÃ´li nasledujÃºcej chybe: ZÃ¡vislÃº sluÅ¾bu alebo skupinu sa nepodarilo spustiť.
9. 1. 2012 14:25:04, Error: Service Control Manager [7001] - Spustenie sluÅ¾by Network Location Awareness, od ktorej zÃ¡visÃ sluÅ¾ba Network List Service, zlyhalo kvÃ´li nasledujÃºcej chybe: ZÃ¡vislÃº sluÅ¾bu alebo skupinu sa nepodarilo spustiť.
9. 1. 2012 14:25:04, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service WSearch with arguments " " in order to run the server: {9E175B6D-F52A-11D8-B9A5-505054503030}
9. 1. 2012 14:25:03, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service WSearch with arguments " " in order to run the server: {7D096C5F-AC08-4F1F-BEB7-5C22C517CE39}
9. 1. 2012 14:25:02, Error: Service Control Manager [7001] - Spustenie sluÅ¾by Network Location Awareness, od ktorej zÃ¡visÃ sluÅ¾ba Network List Service, zlyhalo kvÃ´li nasledujÃºcej chybe: ZÃ¡vislÃº sluÅ¾bu alebo skupinu sa nepodarilo spustiť.
9. 1. 2012 14:25:02, Error: Service Control Manager [7001] - Spustenie sluÅ¾by Network Location Awareness, od ktorej zÃ¡visÃ sluÅ¾ba Network List Service, zlyhalo kvÃ´li nasledujÃºcej chybe: ZÃ¡vislÃº sluÅ¾bu alebo skupinu sa nepodarilo spustiť.
9. 1. 2012 14:25:02, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service netprofm with arguments " " in order to run the server: {A47979D2-C419-11D9-A5B4-001185AD2B89}
9. 1. 2012 14:25:02, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service netman with arguments " " in order to run the server: {BA126AD1-2166-11D1-B1D0-00805FC1270E}
9. 1. 2012 14:25:00, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service EventSystem with arguments " " in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}
9. 1. 2012 14:24:51, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service ShellHWDetection with arguments " " in order to run the server: {DD522ACC-F821-461A-A407-50B198B896DC}
9. 1. 2012 14:24:33, Error: Service Control Manager [7026] - NasledujÃºce ovlÃ¡dače pre spustenie zavedenia alebo spustenie systÃ©mu zlyhali pri načÃtanÃ: AFD appdrv01 DfsC discache HWiNFO32 MpFilter NetBIOS NetBT nsiproxy Psched rdbss spldr tdx VBoxDrv vwififlt Wanarpv6 WfpLwf
9. 1. 2012 14:24:32, Error: Service Control Manager [7001] - Spustenie sluÅ¾by SMB MiniRedirector Wrapper and Engine, od ktorej zÃ¡visÃ sluÅ¾ba SMB 2.0 MiniRedirector, zlyhalo kvÃ´li nasledujÃºcej chybe: ZÃ¡vislÃº sluÅ¾bu alebo skupinu sa nepodarilo spustiť.
9. 1. 2012 14:24:32, Error: Service Control Manager [7001] - Spustenie sluÅ¾by SMB MiniRedirector Wrapper and Engine, od ktorej zÃ¡visÃ sluÅ¾ba SMB 1.x MiniRedirector, zlyhalo kvÃ´li nasledujÃºcej chybe: ZÃ¡vislÃº sluÅ¾bu alebo skupinu sa nepodarilo spustiť.
9. 1. 2012 14:24:32, Error: Service Control Manager [7001] - Spustenie sluÅ¾by Redirected Buffering Sub Sysytem, od ktorej zÃ¡visÃ sluÅ¾ba SMB MiniRedirector Wrapper and Engine, zlyhalo kvÃ´li nasledujÃºcej chybe: Zariadenie pripojenÃ© na*systÃ©m nie je funkčnÃ©.
9. 1. 2012 14:24:32, Error: Service Control Manager [7001] - Spustenie sluÅ¾by Network Store Interface Service, od ktorej zÃ¡visÃ sluÅ¾ba Network Location Awareness, zlyhalo kvÃ´li nasledujÃºcej chybe: ZÃ¡vislÃº sluÅ¾bu alebo skupinu sa nepodarilo spustiť.
9. 1. 2012 14:24:32, Error: Service Control Manager [7001] - Spustenie sluÅ¾by Network Store Interface Service, od ktorej zÃ¡visÃ sluÅ¾ba IP Helper, zlyhalo kvÃ´li nasledujÃºcej chybe: ZÃ¡vislÃº sluÅ¾bu alebo skupinu sa nepodarilo spustiť.
9. 1. 2012 14:24:31, Error: Service Control Manager [7001] - Spustenie sluÅ¾by Network Store Interface Service, od ktorej zÃ¡visÃ sluÅ¾ba Workstation, zlyhalo kvÃ´li nasledujÃºcej chybe: ZÃ¡vislÃº sluÅ¾bu alebo skupinu sa nepodarilo spustiť.
9. 1. 2012 14:24:30, Error: Service Control Manager [7001] - Spustenie sluÅ¾by SieťovÃ½ vstupno-vÃ½stupnÃ½ ovlÃ¡dač starÅ¡ej verzie na podporu zariadenÃ TDI, od ktorej zÃ¡visÃ sluÅ¾ba DNS Client, zlyhalo kvÃ´li nasledujÃºcej chybe: Zariadenie pripojenÃ© na*systÃ©m nie je funkčnÃ©.
9. 1. 2012 14:24:30, Error: Service Control Manager [7001] - Spustenie sluÅ¾by NSI proxy service driver., od ktorej zÃ¡visÃ sluÅ¾ba Network Store Interface Service, zlyhalo kvÃ´li nasledujÃºcej chybe: Zariadenie pripojenÃ© na*systÃ©m nie je funkčnÃ©.
9. 1. 2012 14:24:30, Error: Service Control Manager [7001] - Spustenie sluÅ¾by Ancillary Function Driver for Winsock, od ktorej zÃ¡visÃ sluÅ¾ba TCP/IP NetBIOS Helper, zlyhalo kvÃ´li nasledujÃºcej chybe: Zariadenie pripojenÃ© na*systÃ©m nie je funkčnÃ©.
9. 1. 2012 14:24:30, Error: Service Control Manager [7001] - Spustenie sluÅ¾by Ancillary Function Driver for Winsock, od ktorej zÃ¡visÃ sluÅ¾ba DHCP Client, zlyhalo kvÃ´li nasledujÃºcej chybe: Zariadenie pripojenÃ© na*systÃ©m nie je funkčnÃ©.
9. 1. 2012 14:20:53, Error: Service Control Manager [7031] - SluÅ¾ba WMI Performance Adapter sa neočakÃ¡vane ukončila. SluÅ¾ba sa tÃ½mto spÃ´sobom ukončila uÅ¾ 1 krÃ¡t. O 120000 ms bude vykonanÃ¡ nasledujÃºca opravnÃ¡ akcia: ReÅ¡tartovať sluÅ¾bu.
9. 1. 2012 14:20:46, Error: Service Control Manager [7031] - SluÅ¾ba Windows Media Player - sluÅ¾ba zdieľania v sieti sa neočakÃ¡vane ukončila. SluÅ¾ba sa tÃ½mto spÃ´sobom ukončila uÅ¾ 1 krÃ¡t. O 30000 ms bude vykonanÃ¡ nasledujÃºca opravnÃ¡ akcia: ReÅ¡tartovať sluÅ¾bu.
9. 1. 2012 13:06:33, Error: Microsoft Antimalware [3002] - Vo funkcii Ochrana v reÃ¡lnom čase programu Microsoft Antimalware sa vyskytla chyba a funkcia zlyhala. Funkcia: Monitorovanie sprÃ¡vania KÃ³d chyby: 0x80004005 Popis chyby: NeznÃ¡ma chyba DÃ´vod: SprÃ¡vne fungovanie ovlÃ¡dača filtra vyÅ¾aduje aktuÃ¡lny nÃ¡stroj. Ak chcete povoliť ochranu v reÃ¡lnom čase, musÃte nainÅ¡talovať najnovÅ¡ie aktualizÃ¡cie definÃciÃ.
8. 1. 2012 22:11:43, Error: Microsoft Antimalware [3002] - Vo funkcii Ochrana v reÃ¡lnom čase programu Microsoft Antimalware sa vyskytla chyba a funkcia zlyhala. Funkcia: Monitorovanie sprÃ¡vania KÃ³d chyby: 0x80004005 Popis chyby: NeznÃ¡ma chyba DÃ´vod: SprÃ¡vne fungovanie ovlÃ¡dača filtra vyÅ¾aduje aktuÃ¡lny nÃ¡stroj. Ak chcete povoliť ochranu v reÃ¡lnom čase, musÃte nainÅ¡talovať najnovÅ¡ie aktualizÃ¡cie definÃciÃ.
8. 1. 2012 18:07:51, Error: Microsoft Antimalware [3002] - Vo funkcii Ochrana v reÃ¡lnom čase programu Microsoft Antimalware sa vyskytla chyba a funkcia zlyhala. Funkcia: Monitorovanie sprÃ¡vania KÃ³d chyby: 0x80004005 Popis chyby: NeznÃ¡ma chyba DÃ´vod: SprÃ¡vne fungovanie ovlÃ¡dača filtra vyÅ¾aduje aktuÃ¡lny nÃ¡stroj. Ak chcete povoliť ochranu v reÃ¡lnom čase, musÃte nainÅ¡talovať najnovÅ¡ie aktualizÃ¡cie definÃciÃ.
8. 1. 2012 11:11:38, Error: Microsoft Antimalware [3002] - Vo funkcii Ochrana v reÃ¡lnom čase programu Microsoft Antimalware sa vyskytla chyba a funkcia zlyhala. Funkcia: Monitorovanie sprÃ¡vania KÃ³d chyby: 0x80004005 Popis chyby: NeznÃ¡ma chyba DÃ´vod: SprÃ¡vne fungovanie ovlÃ¡dača filtra vyÅ¾aduje aktuÃ¡lny nÃ¡stroj. Ak chcete povoliť ochranu v reÃ¡lnom čase, musÃte nainÅ¡talovať najnovÅ¡ie aktualizÃ¡cie definÃciÃ.
7. 1. 2012 9:52:58, Error: Service Control Manager [7009] - Počas čakania na pripojenie sluÅ¾by Steam Client Service bol dosiahnutÃ½ časovÃ½ limit (30000 ms).
7. 1. 2012 9:52:58, Error: Service Control Manager [7000] - Spustenie sluÅ¾by Steam Client Service zlyhalo kvÃ´li nasledujÃºcej chybe: SluÅ¾ba neodpovedala na*riadiaci alebo spÃºÅ¡ťacÃ pokyn načas.
7. 1. 2012 9:45:16, Error: Microsoft Antimalware [3002] - Vo funkcii Ochrana v reÃ¡lnom čase programu Microsoft Antimalware sa vyskytla chyba a funkcia zlyhala. Funkcia: Monitorovanie sprÃ¡vania KÃ³d chyby: 0x80004005 Popis chyby: NeznÃ¡ma chyba DÃ´vod: SprÃ¡vne fungovanie ovlÃ¡dača filtra vyÅ¾aduje aktuÃ¡lny nÃ¡stroj. Ak chcete povoliť ochranu v reÃ¡lnom čase, musÃte nainÅ¡talovať najnovÅ¡ie aktualizÃ¡cie definÃciÃ.
5. 1. 2012 16:11:25, Error: volsnap [36] - The shadow copies of volume C: were aborted because the shadow copy storage could not grow due to a user imposed limit.
4. 1. 2012 23:22:33, Error: Disk [11] - The driver detected a controller error on \Device\Harddisk3\DR4.
4. 1. 2012 23:20:42, Error: Disk [11] - The driver detected a controller error on \Device\Harddisk1\DR1.
4. 1. 2012 14:38:59, Error: NetBT [4319] - A duplicate name has been detected on the TCP network. The IP address of the computer that sent the message is in the data. Use nbtstat -n in a command window to see which name is in the Conflict state.
4. 1. 2012 12:31:45, Error: Microsoft Antimalware [3002] - Vo funkcii Ochrana v reÃ¡lnom čase programu Microsoft Antimalware sa vyskytla chyba a funkcia zlyhala. Funkcia: Monitorovanie sprÃ¡vania KÃ³d chyby: 0x80004005 Popis chyby: NeznÃ¡ma chyba DÃ´vod: SprÃ¡vne fungovanie ovlÃ¡dača filtra vyÅ¾aduje aktuÃ¡lny nÃ¡stroj. Ak chcete povoliť ochranu v reÃ¡lnom čase, musÃte nainÅ¡talovať najnovÅ¡ie aktualizÃ¡cie definÃciÃ.
4. 1. 2012 12:31:35, Error: BTHUSB [5] - OvlÃ¡dač Bluetooth očakÃ¡val udalosť HCI s danou veľkosťou, ale neprijal ju.
11. 1. 2012 18:25:12, Error: Microsoft Antimalware [3002] - Vo funkcii Ochrana v reÃ¡lnom čase programu Microsoft Antimalware sa vyskytla chyba a funkcia zlyhala. Funkcia: Monitorovanie sprÃ¡vania KÃ³d chyby: 0x80004005 Popis chyby: NeznÃ¡ma chyba DÃ´vod: SprÃ¡vne fungovanie ovlÃ¡dača filtra vyÅ¾aduje aktuÃ¡lny nÃ¡stroj. Ak chcete povoliť ochranu v reÃ¡lnom čase, musÃte nainÅ¡talovať najnovÅ¡ie aktualizÃ¡cie definÃciÃ.
11. 1. 2012 14:53:46, Error: Microsoft Antimalware [3002] - Vo funkcii Ochrana v reÃ¡lnom čase programu Microsoft Antimalware sa vyskytla chyba a funkcia zlyhala. Funkcia: Monitorovanie sprÃ¡vania KÃ³d chyby: 0x80004005 Popis chyby: NeznÃ¡ma chyba DÃ´vod: SprÃ¡vne fungovanie ovlÃ¡dača filtra vyÅ¾aduje aktuÃ¡lny nÃ¡stroj. Ak chcete povoliť ochranu v reÃ¡lnom čase, musÃte nainÅ¡talovať najnovÅ¡ie aktualizÃ¡cie definÃciÃ.
10. 1. 2012 20:00:35, Error: Service Control Manager [7009] - Počas čakania na pripojenie sluÅ¾by Steam Client Service bol dosiahnutÃ½ časovÃ½ limit (30000 ms).
10. 1. 2012 20:00:35, Error: Service Control Manager [7000] - Spustenie sluÅ¾by Steam Client Service zlyhalo kvÃ´li nasledujÃºcej chybe: SluÅ¾ba neodpovedala na*riadiaci alebo spÃºÅ¡ťacÃ pokyn načas.
10. 1. 2012 16:35:30, Error: Service Control Manager [7031] - SluÅ¾ba Print Spooler sa neočakÃ¡vane ukončila. SluÅ¾ba sa tÃ½mto spÃ´sobom ukončila uÅ¾ 2 krÃ¡t. O 60000 ms bude vykonanÃ¡ nasledujÃºca opravnÃ¡ akcia: ReÅ¡tartovať sluÅ¾bu.
10. 1. 2012 16:33:42, Error: Service Control Manager [7031] - SluÅ¾ba Print Spooler sa neočakÃ¡vane ukončila. SluÅ¾ba sa tÃ½mto spÃ´sobom ukončila uÅ¾ 1 krÃ¡t. O 60000 ms bude vykonanÃ¡ nasledujÃºca opravnÃ¡ akcia: ReÅ¡tartovať sluÅ¾bu.
10. 1. 2012 14:32:48, Error: Microsoft Antimalware [3002] - Vo funkcii Ochrana v reÃ¡lnom čase programu Microsoft Antimalware sa vyskytla chyba a funkcia zlyhala. Funkcia: Monitorovanie sprÃ¡vania KÃ³d chyby: 0x80004005 Popis chyby: NeznÃ¡ma chyba DÃ´vod: SprÃ¡vne fungovanie ovlÃ¡dača filtra vyÅ¾aduje aktuÃ¡lny nÃ¡stroj. Ak chcete povoliť ochranu v reÃ¡lnom čase, musÃte nainÅ¡talovať najnovÅ¡ie aktualizÃ¡cie definÃciÃ.
.
==== End Of File ===========================

broni · 2012/01/11

Welcome aboard

Please, observe following rules:

Read all of my instructions very carefully. Your mistakes during cleaning process may have very serious consequences, like unbootable computer.

If you're stuck, or you're not sure about certain step, always ask before doing anything else.

Please refrain from running tools or applying updates other than those I suggest.

Never run more than one scan at a time.

Keep updating me regarding your computer behavior, good, or bad.

The cleaning process, once started, has to be completed. Even if your computer appears to act better, it may still be infected. Once the computer is totally clean, I'll certainly let you know.

If you leave the topic without explanation in the middle of a cleaning process, you may not be eligible to receive any more help in malware removal forum.

I close my topics if you have not replied in 5 days. If you need more time, simply let me know. If I closed your topic and you need it to be reopened, simply PM me.

===========================================================

Please do NOT use any prefixes in your topic title.
It misleads me.

Your "hosts" file has been hijacked.

Please download ComboFix from [color= "Red"]Here[/color] or [color= "#FF0000"]Here[/color] to your Desktop.

[color= "Blue"]**Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**[/color]

Please, never rename Combofix unless instructed.

Close any open browsers.

Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results ".

Click on [color= "Red"]this link[/color] to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.

NOTE1. If Combofix asks you to install Recovery Console, please allow it.
NOTE 2. If Combofix asks you to update the program, always do so.

Close any open browsers.

[color= "Red"]WARNING:[/color] Combofix will disconnect your machine from the Internet as soon as it starts

Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.

If there is no internet connection after running Combofix, then restart your computer to restore back your connection.

Double click on combofix.exe & follow the prompts.

When finished, it will produce a report for you.

Please post the "C:\ComboFix.txt"

**Note 1: Do not mouseclick combofix's window while it's running. That may cause it to stall
**Note 2 for AVG and CA Internet Security users: ComboFix will not run until AVG/CA Internet Security is uninstalled as a protective measure against the anti-virus. This is because AVG/CA Internet Security "falsely" detects ComboFix (or its embedded files) as a threat and may remove them resulting in the tool not working correctly which in turn can cause "unpredictable results ". Since AVG/CA Internet Security cannot be effectively disabled before running ComboFix, the author recommends you to uninstall AVG/CA Internet Security first.
Use AppRemover to uninstall it: http://www.appremover.com/
We can reinstall it when we're done with CF.

**Note 3: If you receive an error "Illegal operation attempted on a registery key that has been marked for deletion ", restart computer to fix the issue.

Make sure, you re-enable your security programs, when you're done with Combofix.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

NOTE.
If, for some reason, Combofix refuses to run, try one of the following:

1. Run Combofix from Safe Mode (How to...)

2. Delete Combofix file, download fresh one, but rename combofix.exe to yourname.exe BEFORE saving it to your desktop.
Do NOT run it yet.

Please download and run the below tool named Rkill (courtesy of BleepingComputer.com) which may help allow other programs to run.

There are 4 different versions. If one of them won't run then download and try to run the other one.

Vista and Win7 users need to right click Rkill and choose Run as Administrator

You only need to get one of these to run, not all of them. You may get warnings from your antivirus about this tool, ignore them or shutdown your antivirus.

Rkill.com
Rkill.scr
Rkill.exe

Double-click on the Rkill desktop icon to run the tool.

If using Vista or Windows 7 right-click on it and choose Run As Administrator.

A black DOS box will briefly flash and then disappear. This is normal and indicates the tool ran successfully.

If not, delete the file, then download and use the one provided in Link 2.

If it does not work, repeat the process and attempt to use one of the remaining links until the tool runs.

Do not reboot until instructed.

If the tool does not run from any of the links provided, please let me know.

Once you've gotten one of them to run, immediately run your_name.exe by double clicking on it.

If normal mode still doesn't work, run BOTH tools from safe mode.

In case #2, please post BOTH logs, rKill and Combofix.

DO NOT make any other changes to your computer (like installing programs, using other cleaning tools, etc.), until it's officially declared clean!!!

blacksvk · 2012/01/12

Combofix log:

ComboFix 12-01-10.02 - ondrej . 01. 2012 13:29:36.1.2 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1250.421.1051.18.3037.1663 [GMT 1:00]
Running from: c:\users\ondrej\Desktop\ComboFix.exe
AV: Microsoft Security Essentials *Disabled/Updated* {108DAC43-C256-20B7-BB05-914135DA5160}
SP: Microsoft Security Essentials *Disabled/Updated* {ABEC4DA7-E46C-2F39-81B5-AA334E5D1BDD}
SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\programdata\FullRemove.exe
c:\users\ondrej\AppData\Local\assembly\tmp
c:\users\ondrej\AppData\Roaming\.#
c:\users\ondrej\TENIS.EXE
c:\windows\pkunzip.pif
c:\windows\pkzip.pif
c:\windows\SwSys1.bmp
c:\windows\SwSys2.bmp
c:\windows\system32\java.exe
c:\windows\SysWow64\html
c:\windows\SysWow64\images
c:\windows\SysWow64\tmpAA73.tmp
c:\windows\SysWow64\tmpAA74.tmp
.
.
((((((((((((((((((((((((( Files Created from 2011-12-12 to 2012-01-12 )))))))))))))))))))))))))))))))
.
.
2012-01-12 12:36 . 2012-01-12 12:36 -------- d-----w- c:\users\Guest\AppData\Local\temp
2012-01-12 12:36 . 2012-01-12 12:36 -------- d-----w- c:\users\Default\AppData\Local\temp
2012-01-12 12:19 . 2012-01-12 12:19 69000 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{D780B5ED-AEBD-41ED-BC7C-98D56F0AE2DA}\offreg.dll
2012-01-11 20:36 . 2011-11-21 11:40 8822856 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{D780B5ED-AEBD-41ED-BC7C-98D56F0AE2DA}\mpengine.dll
2012-01-11 14:00 . 2011-10-26 05:25 1572864 ----a-w- c:\windows\system32\quartz.dll
2012-01-11 14:00 . 2011-10-26 04:32 1328128 ----a-w- c:\windows\SysWow64\quartz.dll
2012-01-11 14:00 . 2011-10-26 05:25 366592 ----a-w- c:\windows\system32\qdvd.dll
2012-01-11 14:00 . 2011-10-26 04:32 514560 ----a-w- c:\windows\SysWow64\qdvd.dll
2012-01-11 14:00 . 2011-11-17 06:41 1731920 ----a-w- c:\windows\system32\ntdll.dll
2012-01-11 14:00 . 2011-11-17 05:38 1292080 ----a-w- c:\windows\SysWow64\ntdll.dll
2012-01-11 14:00 . 2011-11-19 14:58 77312 ----a-w- c:\windows\system32\packager.dll
2012-01-11 14:00 . 2011-11-19 14:01 67072 ----a-w- c:\windows\SysWow64\packager.dll
2012-01-09 13:35 . 2012-01-09 13:35 -------- d-----w- c:\users\ondrej\AppData\Roaming\Malwarebytes
2012-01-09 13:35 . 2012-01-09 13:35 -------- d-----w- c:\programdata\Malwarebytes
2012-01-09 13:35 . 2012-01-09 13:35 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware
2012-01-09 13:35 . 2011-12-10 14:24 23152 ----a-w- c:\windows\system32\drivers\mbam.sys
2012-01-03 13:58 . 2012-01-03 14:04 -------- d-----w- c:\program files (x86)\OS Launcher
2012-01-01 15:46 . 2012-01-04 23:54 -------- d-----w- c:\program files (x86)\NSIS
2011-12-31 18:35 . 2011-12-31 22:19 -------- d-----w- c:\users\ondrej\AppData\Roaming\TS3Client
2011-12-31 18:34 . 2011-12-31 18:34 -------- d-----w- c:\program files (x86)\TeamSpeak 3 Client
2011-12-28 11:00 . 2011-12-28 11:38 -------- d-----w- c:\users\ondrej\AppData\Roaming\PabloDraw
2011-12-26 11:44 . 2011-12-26 11:44 109080 ----a-w- c:\windows\SysWow64\OpenAL32.dll
2011-12-26 11:14 . 2011-12-26 11:14 -------- d-----w- c:\program files (x86)\Common Files\Futuremark Shared
2011-12-26 11:12 . 2004-06-22 14:44 5632 ----a-w- c:\windows\SysWow64\drivers\Entech64.sys
2011-12-26 11:12 . 2001-11-19 18:05 3972 ----a-w- c:\windows\SysWow64\drivers\PciBus.sys
2011-12-26 11:12 . 2011-12-26 11:12 -------- d-----w- c:\windows\SysWow64\Futuremark
2011-12-26 11:12 . 2004-10-25 19:02 21664 ----a-w- c:\windows\SysWow64\drivers\Entech.sys
2011-12-26 11:07 . 2011-12-26 11:07 -------- d-----w- c:\program files (x86)\Futuremark
2011-12-26 11:06 . 2004-07-15 23:20 69715 ----a-w- c:\program files (x86)\Common Files\InstallShield\Professional\RunTime\10\01\Intel32\ctor.dll
2011-12-26 11:06 . 2004-07-15 23:19 266240 ----a-w- c:\program files (x86)\Common Files\InstallShield\Professional\RunTime\10\01\Intel32\iscript.dll
2011-12-26 11:06 . 2004-07-15 23:18 172032 ----a-w- c:\program files (x86)\Common Files\InstallShield\Professional\RunTime\10\01\Intel32\iuser.dll
2011-12-26 11:06 . 2004-07-15 23:18 5632 ----a-w- c:\program files (x86)\Common Files\InstallShield\Professional\RunTime\10\01\Intel32\DotNetInstaller.exe
2011-12-26 11:06 . 2004-07-15 23:16 32768 ----a-w- c:\program files (x86)\Common Files\InstallShield\Professional\RunTime\Objectps.dll
2011-12-26 11:06 . 2011-12-26 11:06 303236 ----a-w- c:\program files (x86)\Common Files\InstallShield\Professional\RunTime\10\01\Intel32\setup.dll
2011-12-26 11:06 . 2011-12-26 11:06 180356 ----a-w- c:\program files (x86)\Common Files\InstallShield\Professional\RunTime\10\01\Intel32\iGdi.dll
2011-12-26 11:06 . 2005-03-22 16:50 733184 ----a-w- c:\program files (x86)\Common Files\InstallShield\Professional\RunTime\10\01\Intel32\iKernel.dll
2011-12-25 20:24 . 2011-12-25 20:24 -------- d-----w- c:\windows\system32\wbem\Framework
2011-12-16 23:05 . 2011-12-16 23:05 -------- d-----w- c:\users\Guest\AppData\Roaming\IrfanView
2011-12-15 19:36 . 2011-11-04 01:34 2382848 ----a-w- c:\windows\system32\mshtml.tlb
2011-12-15 19:36 . 2011-11-03 22:31 2382848 ----a-w- c:\windows\SysWow64\mshtml.tlb
2011-12-15 19:36 . 2011-11-04 02:44 174392 ----a-w- c:\program files\Internet Explorer\sqmapi.dll
2011-12-15 19:36 . 2011-11-03 23:16 141112 ----a-w- c:\program files (x86)\Internet Explorer\sqmapi.dll
2011-12-15 19:32 . 2011-10-26 05:21 43520 ----a-w- c:\windows\system32\csrsrv.dll
2011-12-15 19:32 . 2011-11-24 04:52 3145216 ----a-w- c:\windows\system32\win32k.sys
2011-12-15 19:32 . 2011-10-15 06:31 723456 ----a-w- c:\windows\system32\EncDec.dll
2011-12-15 19:32 . 2011-10-15 05:38 534528 ----a-w- c:\windows\SysWow64\EncDec.dll
2011-12-15 19:32 . 2011-11-05 05:32 2048 ----a-w- c:\windows\system32\tzres.dll
2011-12-15 19:32 . 2011-11-05 04:26 2048 ----a-w- c:\windows\SysWow64\tzres.dll
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-12-26 11:44 . 2011-10-26 19:22 466456 ----a-w- c:\windows\system32\wrap_oal.dll
2011-12-26 11:44 . 2011-10-26 19:22 444952 ----a-w- c:\windows\SysWow64\wrap_oal.dll
2011-12-26 11:44 . 2011-10-26 19:22 122904 ----a-w- c:\windows\system32\OpenAL32.dll
2011-11-21 11:40 . 2010-12-04 10:06 8822856 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2011-11-20 12:36 . 2011-11-20 12:36 21712 ----a-w- c:\windows\SysWow64\drivers\DrvAgent64.SYS
2011-11-17 06:35 . 2012-01-11 15:10 340992 ----a-w- c:\windows\system32\schannel.dll
2011-11-17 05:34 . 2012-01-11 15:10 224768 ----a-w- c:\windows\SysWow64\schannel.dll
2011-11-16 21:35 . 2011-05-15 18:24 414368 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2011-11-12 12:32 . 2011-11-03 16:10 190656 ----a-w- c:\programdata\Microsoft\VCSExpress\10.0\1033\ResourceCache.dll
2011-11-11 19:42 . 2011-11-11 19:42 119808 ----a-r- c:\users\ondrej\AppData\Roaming\Microsoft\Installer\{CCF298AF-9CE1-4B26-B251-486E98A34789}\icons.exe
2011-11-04 11:37 . 2011-11-11 14:27 224048 ----a-w- c:\windows\system32\drivers\VBoxDrv.sys
2011-10-30 19:44 . 2010-01-25 16:30 45056 ----a-w- c:\windows\system32\acovcnt.exe
2011-10-25 10:26 . 2011-10-25 10:26 2829 ----a-w- c:\windows\War3Unin.pif
2011-10-25 10:26 . 2011-10-25 10:26 126976 ----a-w- c:\windows\War3Unin.exe
2006-05-03 10:06 163328 --sh--r- c:\windows\SysWOW64\flvDX.dll
2007-02-21 11:47 31232 --sh--r- c:\windows\SysWOW64\msfDX.dll
2008-03-16 13:30 216064 --sh--r- c:\windows\SysWOW64\nbDX.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@= "{FB314ED9-A251-47B7-93E1-CDD82E34AF8B} "
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12 94208 ----a-w- c:\users\ondrej\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@= "{FB314EDA-A251-47B7-93E1-CDD82E34AF8B} "
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12 94208 ----a-w- c:\users\ondrej\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@= "{FB314EDB-A251-47B7-93E1-CDD82E34AF8B} "
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12 94208 ----a-w- c:\users\ondrej\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar "= "c:\program files\Windows Sidebar\sidebar.exe" [2010-11-20 1475584]
"Facebook Update "= "c:\users\ondrej\AppData\Local\Facebook\Update\FacebookUpdate.exe" [2011-12-30 137536]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"HDAudDeck "= "c:\program files (x86)\VIA\VIAudioi\VDeck\VDeck.exe" [2009-07-13 2244096]
"HControlUser "= "c:\program files (x86)\ASUS\ATK Hotkey\HControlUser.exe" [2009-06-19 105016]
"ATKOSD2 "= "c:\program files (x86)\ASUS\ATKOSD2\ATKOSD2.exe" [2009-07-07 8493624]
"ATKMEDIA "= "c:\program files (x86)\ASUS\ATK Media\DMedia.exe" [2009-04-20 159744]
.
c:\users\ondrej\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Dropbox.lnk - c:\users\ondrej\AppData\Roaming\Dropbox\bin\Dropbox.exe [2011-12-5 24242056]
Facebook Messenger.lnk - c:\users\ondrej\AppData\Local\Facebook\Messenger\2.0.4392.0\FacebookMessenger.exe [2012-1-10 201728]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin "= 5 (0x5)
"ConsentPromptBehaviorUser "= 3 (0x3)
"EnableUIADesktopToggle "= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@= "Service "
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ASUS Camera ScreenSaver]
2009-10-30 19:04 72248 ----a-w- c:\windows\AsScrProlog.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ASUS Screen Saver Protector]
2009-10-30 19:04 3054136 ----a-w- c:\windows\AsScrPro.exe
.
R2 appdrvrem01;Application Driver Auto Removal Service (01);c:\windows\System32\appdrvrem01.exe svc [x]
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R3 camdrv42;Philips SPC 900NC PC Camera;c:\windows\system32\DRIVERS\camdrv42.sys [x]
R3 cpuz130;cpuz130;c:\users\ondrej\AppData\Local\Temp\cpuz130\cpuz_x64.sys [x]
R3 cpuz135;cpuz135;c:\users\ondrej\AppData\Local\Temp\cpuz135\cpuz135_x64.sys [x]
R3 DrvAgent64;DrvAgent64;c:\windows\SysWOW64\Drivers\DrvAgent64.SYS [2011-11-20 21712]
R3 ivusb;Initio Driver for USB Default Controller;c:\windows\system32\DRIVERS\ivusb.sys [x]
R3 MpNWMon;Microsoft Malware Protection Network Driver;c:\windows\system32\DRIVERS\MpNWMon.sys [x]
R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys [x]
R3 NisSrv;Kontrola siete od spoločnosti Microsoft;c:\program files\Microsoft Security Client\Antimalware\NisSrv.exe [2011-04-27 288272]
R3 PAC207;USB PC Camera;c:\windows\system32\DRIVERS\PFC027.SYS [x]
R3 SiSGbeLH;SiS191/SiS190 Ethernet Device NDIS 6.0 Driver;c:\windows\system32\DRIVERS\SiSG664.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]
R3 VBoxNetAdp;VirtualBox Host-Only Ethernet Adapter;c:\windows\system32\DRIVERS\VBoxNetAdp.sys [x]
R3 VBoxNetFlt;VBoxNetFlt Service;c:\windows\system32\DRIVERS\VBoxNetFlt.sys [x]
R3 VCSVADHWSer;Avnex Virtual Audio Device (WDM);c:\windows\system32\DRIVERS\vcsvad.sys [x]
R3 WatAdminSvc;SluÅ¾ba Windows Activation Technologies;c:\windows\system32\Wat\WatAdminSvc.exe [x]
R3 WDC_SAM;WD SCSI Pass Thru driver;c:\windows\system32\DRIVERS\wdcsam64.sys [x]
R3 xpvcom;XPVCOM Port;c:\windows\system32\Drivers\xpvcom.sys [x]
R4 AdobeARMservice;Adobe Acrobat Update Service;c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2011-06-06 64952]
R4 FastBootAgent;FastBootAgent;c:\windows\SysWOW64\Fast Boot\FastBootAgent.exe [2009-07-24 306232]
R4 WDFMEService;WDFMEService;c:\program files\Western Digital\WD SmartWare\WDFME.exe [2011-06-29 1978256]
R4 WDRulesService;WDRulesService;c:\program files\Western Digital\WD SmartWare\WDRulesEngine.exe [2011-06-29 1338256]
S1 appdrv01;Application Driver (01);c:\windows\system32\Drivers\appdrv01.sys [x]
S1 HWiNFO32;HWiNFO32 Kernel Driver;d:\programy\hwinfo32\HWiNFO64A.SYS [2009-07-16 30080]
S1 VBoxDrv;VirtualBox Service;c:\windows\system32\DRIVERS\VBoxDrv.sys [x]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x]
S2 ASMMAP64;ASMMAP64;c:\program files\ATKGFNEX\ASMMAP64.sys [2007-07-24 14904]
S2 WDDMService;WDDMService;c:\program files\Western Digital\WD SmartWare\WDDMService.exe [2011-06-29 317328]
S3 AmUStor;AM USB Stroage Driver;c:\windows\system32\drivers\AmUStor.SYS [x]
S3 ETD;ELAN PS/2 Port Input Device;c:\windows\system32\DRIVERS\ETD.sys [x]
S3 VIAHdAudAddService;VIA High Definition Audio Driver Service;c:\windows\system32\drivers\viahduaa.sys [x]
S3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\DRIVERS\vwifimp.sys [x]
.
.
Contents of the 'Scheduled Tasks' folder
.
2012-01-09 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1753200179-3676571525-1487517018-1000Core.job
- c:\users\ondrej\AppData\Local\Facebook\Update\FacebookUpdate.exe [2011-07-08 12:57]
.
2012-01-11 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1753200179-3676571525-1487517018-1000UA.job
- c:\users\ondrej\AppData\Local\Facebook\Update\FacebookUpdate.exe [2011-07-08 12:57]
.
.
--------- x86-64 -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@= "{FB314ED9-A251-47B7-93E1-CDD82E34AF8B} "
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12 97792 ----a-w- c:\users\ondrej\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@= "{FB314EDA-A251-47B7-93E1-CDD82E34AF8B} "
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12 97792 ----a-w- c:\users\ondrej\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@= "{FB314EDB-A251-47B7-93E1-CDD82E34AF8B} "
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12 97792 ----a-w- c:\users\ondrej\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]
@= "{FB314EDC-A251-47B7-93E1-CDD82E34AF8B} "
[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12 97792 ----a-w- c:\users\ondrej\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AmIcoSinglun64 "= "c:\program files (x86)\AmIcoSingLun\AmIcoSinglun64.exe" [2009-04-09 320000]
"Windows Mobile Device Center "= "c:\windows\WindowsMobile\wmdc.exe" [2007-05-31 660360]
"ETDWare "= "c:\program files\Elantech\ETDCtrl.exe" [2009-06-12 619392]
"MSC "= "c:\program files\Microsoft Security Client\msseces.exe" [2011-06-15 1436736]
"IgfxTray "= "c:\windows\system32\igfxtray.exe" [2011-02-11 162328]
"HotKeysCmds "= "c:\windows\system32\hkcmd.exe" [2011-02-11 386584]
"Persistence "= "c:\windows\system32\igfxpers.exe" [2011-02-11 417304]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"LoadAppInit_DLLs "=0x1
.
------- Supplementary Scan -------
.
uStart Page = about:blank
uLocal Page = c:\windows\system32\blank.htm
mLocal Page = c:\windows\SysWOW64\blank.htm
IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~1\Office12\EXCEL.EXE/3000
IE: {{7644E42D-B096-457F-8B5B-901238FC81AE} - c:\program files (x86)\ICQ7.6\ICQ.exe
TCP: DhcpNameServer = 192.168.2.1
FF - ProfilePath - c:\users\ondrej\AppData\Roaming\Mozilla\Firefox\Profiles\e69i7t0c.default\
.
- - - - ORPHANS REMOVED - - - -
.
Toolbar-Locked - (no file)
MSConfigStartUp-Adobe Reader Speed Launcher - c:\program files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe
MSConfigStartUp-CLMLServer - c:\program files (x86)\CyberLink\Power2Go\CLMLSvc.exe
Toolbar-Locked - (no file)
.
.
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@= "FlashBroker "
"LocalizedString "= "@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10h_ActiveX.exe,-101 "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled "=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@= "c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10h_ActiveX.exe "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@= "{FAB3E735-69C7-453B-A446-B6823C6DF1C9} "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@= "Shockwave Flash Object "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@= "c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10h.ocx "
"ThreadingModel "= "Apartment "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@= "0 "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@= "ShockwaveFlash.ShockwaveFlash.10 "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@= "c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10h.ocx, 1 "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@= "{D27CDB6B-AE6D-11cf-96B8-444553540000} "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@= "1.0 "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@= "ShockwaveFlash.ShockwaveFlash "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@= "Macromedia Flash Factory Object "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@= "c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10h.ocx "
"ThreadingModel "= "Apartment "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@= "FlashFactory.FlashFactory.1 "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@= "c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10h.ocx, 1 "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@= "{D27CDB6B-AE6D-11cf-96B8-444553540000} "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@= "1.0 "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@= "FlashFactory.FlashFactory "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@= "IFlashBroker4 "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@= "{00020424-0000-0000-C000-000000000046} "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@= "{FAB3E735-69C7-453B-A446-B6823C6DF1C9} "
"Version "= "1.0 "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]
@Denied: (A) (Everyone)
"Solution "= "{15727DE6-F92D-4E46-ACB4-0E2C58B31A18} "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3]
@Denied: (A) (Everyone)
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0]
"Key "= "ActionsPane3 "
"Location "= "c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows CE Services]
"SymbolicLinkValue "=hex(6):5c,00,72,00,65,00,67,00,69,00,73,00,74,00,72,00,79,
00,5c,00,4d,00,41,00,43,00,48,00,49,00,4e,00,45,00,5c,00,53,00,4f,00,46,00,\
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial "=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial "=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial "=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial "=dword:00000001
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Completion time: 2012-01-12 13:39:19
ComboFix-quarantined-files.txt 2012-01-12 12:39
.
Pre-Run: 15*432*392*704 bytes free
Post-Run: 15*418*523*648 bytes free
.
- - End Of File - - CAD71735C53CBC7FFD015CAACAF5B2EA

broni · 2012/01/12

Looks good.

How is redirection?

Download OTL to your Desktop.

Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.

Click the Scan All Users checkbox.

Under the Custom Scan box paste this in:

netsvcs
drivers32
%SYSTEMDRIVE%\*.*
%systemroot%\Fonts\*.com
%systemroot%\Fonts\*.dll
%systemroot%\Fonts\*.ini
%systemroot%\Fonts\*.ini2
%systemroot%\Fonts\*.exe
%systemroot%\system32\spool\prtprocs\w32x86\*.*
%systemroot%\REPAIR\*.bak1
%systemroot%\REPAIR\*.ini
%systemroot%\system32\*.jpg
%systemroot%\*.jpg
%systemroot%\*.png
%systemroot%\*.scr
%systemroot%\*._sy
%APPDATA%\Adobe\Update\*.*
%ALLUSERSPROFILE%\Favorites\*.*
%APPDATA%\Microsoft\*.*
%PROGRAMFILES%\*.*
%APPDATA%\Update\*.*
%systemroot%\*. /mp /s
CREATERESTOREPOINT
%systemroot%\System32\config\*.sav
%PROGRAMFILES%\bak. /s
%systemroot%\system32\bak. /s
%ALLUSERSPROFILE%\Start Menu\*.lnk /x
%systemroot%\system32\config\systemprofile\*.dat /x
%systemroot%\*.config
%systemroot%\system32\*.db
%APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x
%USERPROFILE%\Desktop\*.exe
%PROGRAMFILES%\Common Files\*.*
%systemroot%\*.src
%systemroot%\install\*.*
%systemroot%\system32\DLL\*.*
%systemroot%\system32\HelpFiles\*.*
%systemroot%\system32\rundll\*.*
%systemroot%\winn32\*.*
%systemroot%\Java\*.*
%systemroot%\system32\test\*.*
%systemroot%\system32\Rundll32\*.*
%systemroot%\AppPatch\Custom\*.*
%APPDATA%\Roaming\Microsoft\Windows\Recent\*.lnk /x
%PROGRAMFILES%\PC-Doctor\Downloads\*.*
%PROGRAMFILES%\Internet Explorer\*.tmp
%PROGRAMFILES%\Internet Explorer\*.dat
%USERPROFILE%\My Documents\*.exe
%USERPROFILE%\*.exe
%systemroot%\ADDINS\*.*
%systemroot%\assembly\*.bak2
%systemroot%\Config\*.*
%systemroot%\REPAIR\*.bak2
%systemroot%\SECURITY\Database\*.sdb /x
%systemroot%\SYSTEM\*.bak2
%systemroot%\Web\*.bak2
%systemroot%\Driver Cache\*.*
%PROGRAMFILES%\Mozilla Firefox\0*.exe
%ProgramFiles%\Microsoft Common\*.*
%ProgramFiles%\TinyProxy.
%USERPROFILE%\Favorites\*.url /x
%systemroot%\system32\*.bk
%systemroot%\*.te
%systemroot%\system32\system32\*.*
%ALLUSERSPROFILE%\*.dat /x
%systemroot%\system32\drivers\*.rmv
dir /b "%systemroot%\system32\*.exe" | find /i " " /c
dir /b "%systemroot%\*.exe" | find /i " " /c
%PROGRAMFILES%\Microsoft\*.*
%systemroot%\System32\Wbem\proquota.exe
%PROGRAMFILES%\Mozilla Firefox\*.dat
%USERPROFILE%\Cookies\*.txt /x
%SystemRoot%\system32\fonts\*.*
%systemroot%\system32\winlog\*.*
%systemroot%\system32\Language\*.*
%systemroot%\system32\Settings\*.*
%systemroot%\system32\*.quo
%SYSTEMROOT%\AppPatch\*.exe
%SYSTEMROOT%\inf\*.exe
%SYSTEMROOT%\Installer\*.exe
%systemroot%\system32\config\*.bak2
%systemroot%\system32\Computers\*.*
%SystemRoot%\system32\Sound\*.*
%SystemRoot%\system32\SpecialImg\*.*
%SystemRoot%\system32\code\*.*
%SystemRoot%\system32\draft\*.*
%SystemRoot%\system32\MSSSys\*.*
%ProgramFiles%\Javascript\*.*
%systemroot%\pchealth\helpctr\System\*.exe /s
%systemroot%\Web\*.exe
%systemroot%\system32\msn\*.*
%systemroot%\system32\*.tro
%AppData%\Microsoft\Installer\msupdates\*.*
%ProgramFiles%\Messenger\*.*
%systemroot%\system32\systhem32\*.*
%systemroot%\system\*.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs
/md5start
/md5stop

Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.

When the scan completes, it will open two notepad windows: OTL.txt and Extras.txt. These are saved in the same location as OTL.

Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post them back here.

blacksvk · 2012/01/12

It seems it's fixed. THX!

OTL.Txt:
OTL logfile created on: 1/12/2012 6:24:32 PM - Run 1
OTL by OldTimer - Version 3.2.31.0 Folder = C:\Users\ondrej\Desktop
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: Slovensko | Language: SKY | Date Format: d. M. yyyy

2.97 Gb Total Physical Memory | 1.20 Gb Available Physical Memory | 40.40% Memory free
5.93 Gb Paging File | 3.92 Gb Available in Paging File | 66.13% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 74.52 Gb Total Space | 14.37 Gb Free Space | 19.28% Space Free | Partition Type: NTFS
Drive D: | 175.02 Gb Total Space | 1.14 Gb Free Space | 0.65% Space Free | Partition Type: NTFS
Drive E: | 4.10 Gb Total Space | 0.00 Gb Free Space | 0.00% Space Free | Partition Type: CDFS
Drive F: | 33.90 Gb Total Space | 15.84 Gb Free Space | 46.72% Space Free | Partition Type: NTFS
Drive I: | 944.67 Mb Total Space | 902.59 Mb Free Space | 95.55% Space Free | Partition Type: FAT

Computer Name: ASUS-K50IJ | User Name: ondrej | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2012/01/12 17:58:10 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Users\ondrej\Desktop\OTL.exe
PRC - [2012/01/07 09:52:29 | 000,419,624 | ---- | M] (Valve Corporation) -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe
PRC - [2011/08/04 09:59:36 | 001,242,448 | ---- | M] (Valve Corporation) -- D:\Hry\Steam\Steam.exe
PRC - [2009/07/23 01:58:46 | 000,017,976 | ---- | M] () -- C:\Program Files (x86)\ASUS\ControlDeck\ControlDeckStartUp.exe
PRC - [2009/07/16 18:07:54 | 000,178,744 | ---- | M] (ASUS) -- C:\Program Files (x86)\ASUS\ATK Hotkey\HControl.exe
PRC - [2009/07/07 19:20:56 | 008,493,624 | ---- | M] (ASUS) -- C:\Program Files (x86)\ASUS\ATKOSD2\ATKOSD2.exe
PRC - [2009/06/19 18:29:42 | 000,105,016 | ---- | M] (ASUS) -- C:\Program Files (x86)\ASUS\ATK Hotkey\HControlUser.exe
PRC - [2009/06/19 18:29:26 | 002,488,888 | ---- | M] (ASUS) -- C:\Program Files (x86)\ASUS\ATK Hotkey\ATKOSD.exe
PRC - [2009/06/16 01:30:42 | 000,084,536 | ---- | M] (ASUS) -- C:\Program Files (x86)\ASUS\ATK Hotkey\AsLdrSrv.exe
PRC - [2009/04/20 19:09:30 | 000,159,744 | ---- | M] (ASUS) -- C:\Program Files (x86)\ASUS\ATK Media\DMedia.exe
PRC - [2008/12/23 01:15:34 | 000,174,648 | ---- | M] (ASUS) -- C:\Program Files (x86)\ASUS\ATK Hotkey\WDC.exe
PRC - [2008/08/14 05:00:08 | 000,113,208 | ---- | M] (ASUS) -- C:\Program Files (x86)\ASUS\ATK Hotkey\KBFiltr.exe
PRC - [2008/08/14 04:59:56 | 000,301,624 | ---- | M] () -- C:\Program Files (x86)\ASUS\ATK Hotkey\Atouch64.exe
PRC - [2007/08/08 08:08:40 | 000,094,208 | ---- | M] () -- C:\Program Files\ATKGFNEX\GFNEXSrv.exe

========== Modules (No Company Name) ==========

MOD - [2012/01/07 09:52:27 | 014,410,024 | ---- | M] () -- D:\Hry\Steam\bin\libcef.dll
MOD - [2012/01/07 09:52:25 | 000,914,216 | ---- | M] () -- D:\Hry\Steam\bin\avcodec-52.dll
MOD - [2012/01/07 09:52:25 | 000,194,344 | ---- | M] () -- D:\Hry\Steam\bin\chromehtml.dll
MOD - [2012/01/07 09:52:25 | 000,155,432 | ---- | M] () -- D:\Hry\Steam\bin\avformat-52.dll
MOD - [2012/01/07 09:52:25 | 000,091,432 | ---- | M] () -- D:\Hry\Steam\bin\avutil-50.dll
MOD - [2011/11/05 12:49:24 | 000,368,128 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\07cdef1a740151932dcf161f3306bd9c\PresentationFramework.Aero.ni.dll
MOD - [2011/11/05 12:43:17 | 014,339,072 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\70e2ca33ffa52c743285dc5b4910a229\PresentationFramework.ni.dll
MOD - [2011/11/04 22:58:56 | 012,234,752 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationCore\7c94a121334aeca7553c7f01290740f0\PresentationCore.ni.dll
MOD - [2011/11/04 22:58:41 | 003,347,968 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\WindowsBase\d7a64c28cf0c90e6c48af4f7d6f9ed41\WindowsBase.ni.dll
MOD - [2011/11/04 22:58:03 | 007,963,648 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System\abab08afa60a6f06bdde0fcc9649c379\System.ni.dll
MOD - [2011/11/04 22:57:55 | 011,490,304 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\a1a82db68b3badc7c27ea1f6579d22c5\mscorlib.ni.dll
MOD - [2009/07/23 01:58:46 | 000,017,976 | ---- | M] () -- C:\Program Files (x86)\ASUS\ControlDeck\ControlDeckStartUp.exe

========== Win32 Services (SafeList) ==========

SRV:64bit: - [2011/06/29 07:02:24 | 001,978,256 | ---- | M] (Western Digital ) [Disabled | Stopped] -- C:\Program Files\Western Digital\WD SmartWare\WDFME.exe -- (WDFMEService)
SRV:64bit: - [2011/06/29 07:02:24 | 001,338,256 | ---- | M] (Western Digital ) [Disabled | Stopped] -- C:\Program Files\Western Digital\WD SmartWare\WDRulesEngine.exe -- (WDRulesService)
SRV:64bit: - [2011/06/29 07:02:16 | 000,317,328 | ---- | M] (WDC) [Auto | Running] -- C:\Program Files\Western Digital\WD SmartWare\WDDMService.exe -- (WDDMService)
SRV:64bit: - [2011/04/27 16:21:18 | 000,288,272 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Microsoft Security Client\Antimalware\NisSrv.exe -- (NisSrv)
SRV:64bit: - [2011/04/27 16:21:18 | 000,012,784 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe -- (MsMpSvc)
SRV:64bit: - [2011/01/21 13:53:39 | 000,538,000 | ---- | M] (Protection Technology) [Auto | Stopped] -- C:\Windows\SysNative\appdrvrem01.exe -- (appdrvrem01)
SRV:64bit: - [2009/07/14 02:41:27 | 001,011,712 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV:64bit: - [2007/08/08 08:08:40 | 000,094,208 | ---- | M] () [Auto | Running] -- C:\Program Files\ATKGFNEX\GFNEXSrv.exe -- (ATKGFNEXSrv)
SRV - [2012/01/07 09:52:29 | 000,419,624 | ---- | M] (Valve Corporation) [On_Demand | Running] -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe -- (Steam Client Service)
SRV - [2012/01/03 14:10:42 | 000,063,928 | ---- | M] (Adobe Systems Incorporated) [Auto | Stopped] -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2010/03/18 12:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2009/07/24 01:13:38 | 000,306,232 | ---- | M] (ASUSTeK Computer Inc.) [Disabled | Stopped] -- C:\Windows\SysWOW64\Fast Boot\FastBootAgent.exe -- (FastBootAgent)
SRV - [2009/06/16 01:30:42 | 000,084,536 | ---- | M] (ASUS) [Auto | Running] -- C:\Program Files (x86)\ASUS\ATK Hotkey\AsLdrSrv.exe -- (ASLDRService)
SRV - [2009/06/10 22:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
SRV - [2007/05/31 10:11:54 | 000,443,784 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\WindowsMobile\wcescomm.dll -- (WcesComm)
SRV - [2007/05/31 10:11:46 | 000,225,672 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\WindowsMobile\rapimgr.dll -- (RapiMgr)

========== Driver Services (SafeList) ==========

DRV:64bit: - [2011/06/27 01:37:00 | 002,753,536 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\athrx.sys -- (athr)
DRV:64bit: - [2011/04/27 14:25:24 | 000,084,864 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\NisDrvWFP.sys -- (NisDrv)
DRV:64bit: - [2011/03/11 07:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
DRV:64bit: - [2011/03/11 07:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
DRV:64bit: - [2011/02/11 18:16:38 | 010,628,640 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\igdkmd64.sys -- (igfx)
DRV:64bit: - [2011/01/21 13:53:39 | 002,687,592 | ---- | M] (Protection Technology) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\appdrv01.sys -- (appdrv01) Application Driver (01)
DRV:64bit: - [2010/11/20 14:34:04 | 000,194,944 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\vpchbus.sys -- (vpcbus)
DRV:64bit: - [2010/11/20 14:33:35 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
DRV:64bit: - [2010/11/20 12:35:34 | 000,095,232 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\vpcusb.sys -- (vpcusb)
DRV:64bit: - [2010/11/20 12:07:05 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV:64bit: - [2010/03/10 16:16:36 | 000,029,720 | ---- | M] (Initio Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ivusb.sys -- (ivusb)
DRV:64bit: - [2009/12/17 14:58:04 | 000,145,360 | ---- | M] (Sun Microsystems, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\VBoxNetAdp.sys -- (VBoxNetAdp)
DRV:64bit: - [2009/08/23 05:08:10 | 000,056,320 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\L1E62x64.sys -- (L1E)
DRV:64bit: - [2009/07/20 10:29:39 | 000,015,416 | ---- | M] ( ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\kbfiltr.sys -- (kbfiltr)
DRV:64bit: - [2009/07/14 02:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
DRV:64bit: - [2009/07/14 02:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:64bit: - [2009/07/14 02:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
DRV:64bit: - [2009/07/14 01:09:50 | 000,019,968 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\usb8023x.sys -- (usb_rndisx)
DRV:64bit: - [2009/07/14 01:09:02 | 000,120,320 | ---- | M] (Microsoft Corporation) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\irda.sys -- (irda)
DRV:64bit: - [2009/07/14 01:08:58 | 000,030,208 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\MSIRCOMM.sys -- (MSIRCOMM)
DRV:64bit: - [2009/07/09 09:11:31 | 001,222,144 | ---- | M] (VIA Technologies, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\viahduaa.sys -- (VIAHdAudAddService)
DRV:64bit: - [2009/06/12 04:41:55 | 000,112,128 | ---- | M] (ELAN Microelectronic Corp.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ETD.sys -- (ETD)
DRV:64bit: - [2009/06/10 21:35:57 | 000,056,832 | ---- | M] (Silicon Integrated Systems Corp.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\SiSG664.sys -- (SiSGbeLH)
DRV:64bit: - [2009/06/10 21:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
DRV:64bit: - [2009/06/10 21:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009/06/10 21:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2009/06/10 21:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
DRV:64bit: - [2009/06/05 11:15:55 | 001,806,400 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\snp2uvc.sys -- (SNP2UVC) USB2.0 PC Camera (SNP2UVC)
DRV:64bit: - [2009/06/04 11:54:35 | 000,408,600 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\iaStor.sys -- (iaStor)
DRV:64bit: - [2009/05/26 14:32:37 | 000,040,448 | ---- | M] (Alcor Micro, Corp.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\AmUStor.sys -- (AmUStor)
DRV:64bit: - [2009/05/18 12:17:08 | 000,034,152 | ---- | M] (GEAR Software Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys -- (GEARAspiWDM)
DRV:64bit: - [2009/05/13 02:07:19 | 000,015,928 | ---- | M] (ASUS) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ATK64AMD.sys -- (MTsensor)
DRV:64bit: - [2009/02/13 11:02:52 | 000,014,464 | ---- | M] (Western Digital Technologies) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\wdcsam64.sys -- (WDC_SAM)
DRV:64bit: - [2008/12/26 12:56:04 | 000,021,504 | ---- | M] (Avnex) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\vcsvad.sys -- (VCSVADHWSer) Avnex Virtual Audio Device (WDM)
DRV:64bit: - [2008/05/24 01:27:28 | 000,154,168 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\WimFltr.sys -- (WimFltr)
DRV:64bit: - [2008/03/18 02:06:14 | 000,115,328 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ewusbmdm.sys -- (hwdatacard)
DRV:64bit: - [2008/01/19 06:28:36 | 000,033,792 | ---- | M] (SigmaTel, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\irstusb.sys -- (STIrUsb)
DRV:64bit: - [2007/10/25 18:30:52 | 000,684,544 | ---- | M] (PixArt Imaging Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\PFC027.SYS -- (PAC207)
DRV:64bit: - [2007/07/24 19:11:32 | 000,014,904 | ---- | M] () [Kernel | Auto | Running] -- C:\Program Files\ATKGFNEX\ASMMAP64.sys -- (ASMMAP64)
DRV:64bit: - [2007/05/04 08:45:34 | 001,533,952 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\camdrv42.sys -- (camdrv42)
DRV - [2011/11/20 13:36:44 | 000,021,712 | ---- | M] (Phoenix Technologies) [Kernel | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\DrvAgent64.SYS -- (DrvAgent64)
DRV - [2009/07/16 15:22:10 | 000,030,080 | ---- | M] (REALiX(tm)) [Kernel | System | Running] -- d:\Programy\hwinfo32\HWiNFO64A.SYS -- (HWiNFO32)
DRV - [2009/07/14 02:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm

IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-21-1753200179-3676571525-1487517018-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank
IE - HKU\S-1-5-21-1753200179-3676571525-1487517018-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_1_102.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre7\bin\new_plugin\npjp2.dll (Oracle Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: C:\Windows\system32\Wat\npWatWeb.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: C:\Windows\system32\Wat\npWatWeb.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\4.0.60831.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3508.1109: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3538.0513: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@Skype Limited.com/Facebook Video Calling Plugin: C:\Users\ondrej\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited)
FF - HKCU\Software\MozillaPlugins\@unity3d.com/UnityPlayer,version=1.0: C:\Users\ondrej\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
FF - HKCU\Software\MozillaPlugins\facebook.com/fbDesktopPlugin: C:\Users\ondrej\AppData\Local\Facebook\Messenger\2.0.4393.0\npFbDesktopPlugin.dll (Facebook, Inc.)
FF - HKCU\Software\MozillaPlugins\intel.com/AppUp: C:\Program Files (x86)\Intel\IntelAppStore\bin\npAppUp.dll File not found

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\auto-update@mozilla.org: C:\Users\ondrej\AppData\Roaming\Mozilla\Firefox\Extensions\MozillaUpdate [2011/07/18 09:31:49 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 9.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012/01/10 15:32:46 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 9.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2012/01/12 14:53:39 | 000,000,000 | ---D | M]

[2012/01/10 15:31:41 | 000,000,000 | ---D | M] (No name found) -- C:\Users\ondrej\AppData\Roaming\mozilla\Extensions
[2010/01/22 21:54:36 | 000,000,000 | ---D | M] (No name found) -- C:\Users\ondrej\AppData\Roaming\mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6}
[2011/07/18 09:31:49 | 000,000,000 | ---D | M] (No name found) -- C:\Users\ondrej\AppData\Roaming\mozilla\Firefox\Extensions
[2011/07/18 09:31:49 | 000,000,000 | ---D | M] (Mozilla Auto-Update) -- C:\Users\ondrej\AppData\Roaming\mozilla\Firefox\Extensions\MozillaUpdate
[2012/01/10 19:36:23 | 000,000,000 | ---D | M] (No name found) -- C:\Users\ondrej\AppData\Roaming\mozilla\Firefox\Profiles\e69i7t0c.default\extensions
[2012/01/10 15:32:45 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\extensions
() (No name found) -- C:\USERS\ONDREJ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\E69I7T0C.DEFAULT\EXTENSIONS\{D10D0BF8-F5B5-C8B4-A8B2-2B9879E08C5D}.XPI
[2011/12/21 09:07:09 | 000,121,816 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2011/10/11 13:18:04 | 000,476,904 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npdeployJava1.dll
[2011/12/21 06:25:11 | 000,001,583 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\atlas-sk.xml
[2011/12/21 06:25:11 | 000,001,380 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\azet-sk.xml
[2011/12/21 06:25:11 | 000,001,479 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\dunaj-sk.xml
[2011/12/21 06:25:11 | 000,001,473 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\slovnik-sk.xml
[2011/12/21 06:25:11 | 000,001,104 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-sk.xml
[2011/12/21 06:25:11 | 000,000,830 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\zoznam-sk.xml

O1 HOSTS File: ([2012/01/12 13:36:25 | 000,000,027 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2:64bit: - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKU\S-1-5-21-1753200179-3676571525-1487517018-1000\..\Toolbar\WebBrowser: (no name) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No CLSID value found.
O4:64bit: - HKLM..\Run: [AmIcoSinglun64] C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe (AlcorMicro Co., Ltd.)
O4:64bit: - HKLM..\Run: [ETDWare] C:\Program Files\Elantech\ETDCtrl.exe (ELAN Microelectronic Corp.)
O4:64bit: - HKLM..\Run: [HotKeysCmds] C:\Windows\SysNative\hkcmd.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [IgfxTray] C:\Windows\SysNative\igfxtray.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [MSC] C:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)
O4:64bit: - HKLM..\Run: [Persistence] C:\Windows\SysNative\igfxpers.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [Windows Mobile Device Center] C:\Windows\WindowsMobile\wmdc.exe (Microsoft Corporation)
O4 - HKLM..\Run: [ATKMEDIA] C:\Program Files (x86)\ASUS\ATK Media\DMedia.exe (ASUS)
O4 - HKLM..\Run: [ATKOSD2] C:\Program Files (x86)\ASUS\ATKOSD2\ATKOSD2.exe (ASUS)
O4 - HKLM..\Run: [HControlUser] C:\Program Files (x86)\ASUS\ATK Hotkey\HControlUser.exe (ASUS)
O4 - HKLM..\Run: [HDAudDeck] C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe (VIA)
O4 - HKU\S-1-5-21-1753200179-3676571525-1487517018-1000..\Run: [Facebook Update] C:\Users\ondrej\AppData\Local\Facebook\Update\FacebookUpdate.exe (Facebook Inc.)
O4 - Startup: C:\Users\ondrej\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk = C:\Users\ondrej\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
O4 - Startup: C:\Users\ondrej\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Facebook Messenger.lnk = C:\Users\ondrej\AppData\Local\Facebook\Messenger\2.0.4393.0\FacebookMessenger.exe (Facebook)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-1753200179-3676571525-1487517018-1000\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-1753200179-3676571525-1487517018-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 0
O7 - HKU\S-1-5-21-1753200179-3676571525-1487517018-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8:64bit: - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000 File not found
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000 File not found
O9 - Extra Button: @C:\Windows\WindowsMobile\INetRepl.dll,-222 - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : @C:\Windows\WindowsMobile\INetRepl.dll,-223 - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll (Microsoft Corporation)
O9 - Extra Button: ICQ7.6 - {7644E42D-B096-457F-8B5B-901238FC81AE} - C:\Program Files (x86)\ICQ7.6\ICQ.exe (ICQ, LLC.)
O9 - Extra 'Tools' menuitem : ICQ7.6 - {7644E42D-B096-457F-8B5B-901238FC81AE} - C:\Program Files (x86)\ICQ7.6\ICQ.exe (ICQ, LLC.)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.7.0/jinstall-1_7_0-windows-i586.cab (Java Plug-in 10.0.0)
O16 - DPF: {CAFEEFAC-0017-0000-0000-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jinstall-1_7_0-windows-i586.cab (Java Plug-in 1.7.0)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jinstall-1_7_0-windows-i586.cab (Reg Error: Key error.)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{203EB168-D049-415D-A8A5-2428A09D8584}: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{554ADB45-14AF-4714-B2B1-FB1013943172}: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{B73F8639-F00A-4197-87EA-5DA69DAFF66D}: DhcpNameServer = 192.168.0.1
O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found
O18:64bit: - Protocol\Handler\wlpg - No CLSID value found
O20:64bit: - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20 - HKLM Winlogon: Shell - (Explorer.exe) -C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) -C:\Windows\SysWOW64\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20:64bit: - Winlogon\Notify\igfxcui: DllName - (igfxdev.dll) - C:\Windows\SysNative\igfxdev.dll (Intel Corporation)
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = ComFile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2012/01/12 18:03:23 | 000,584,192 | ---- | C] (OldTimer Tools) -- C:\Users\ondrej\Desktop\OTL.exe
[2012/01/12 14:53:13 | 000,000,000 | -HSD | C] -- C:\Config.Msi
[2012/01/12 14:43:53 | 000,000,000 | ---D | C] -- C:\Users\ondrej\AppData\Local\{4A71A8A3-ABD0-4649-9B2F-D6621B629A72}
[2012/01/12 14:43:41 | 000,000,000 | ---D | C] -- C:\Users\ondrej\AppData\Local\{CAB77E1C-46B5-4413-954C-319A0050A0E1}
[2012/01/12 14:02:34 | 000,000,000 | ---D | C] -- C:\Users\ondrej\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Facebook
[2012/01/12 13:39:21 | 000,000,000 | ---D | C] -- C:\Windows\temp
[2012/01/12 13:28:20 | 000,518,144 | ---- | C] (SteelWerX) -- C:\Windows\SWREG.exe
[2012/01/12 13:28:20 | 000,406,528 | ---- | C] (SteelWerX) -- C:\Windows\SWSC.exe
[2012/01/12 13:28:20 | 000,060,416 | ---- | C] (NirSoft) -- C:\Windows\NIRCMD.exe
[2012/01/12 13:28:16 | 000,000,000 | ---D | C] -- C:\Windows\ERDNT
[2012/01/12 13:28:13 | 000,000,000 | ---D | C] -- C:\Qoobox
[2012/01/10 09:14:56 | 001,972,528 | ---- | C] (Kaspersky Lab ZAO) -- C:\Users\ondrej\Desktop\TDSSKiller.exe
[2012/01/09 14:35:55 | 000,000,000 | ---D | C] -- C:\Users\ondrej\AppData\Roaming\Malwarebytes
[2012/01/09 14:35:41 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012/01/09 14:35:38 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2012/01/09 14:35:36 | 000,023,152 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys
[2012/01/09 14:35:36 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware
[2012/01/08 12:09:36 | 000,000,000 | ---D | C] -- C:\Users\ondrej\AppData\Local\{CB4D5EFE-2622-4C93-B292-7CDAB78539E3}
[2012/01/08 12:09:24 | 000,000,000 | ---D | C] -- C:\Users\ondrej\AppData\Local\{F5F3A925-3CE8-4AAE-A0BF-BBFF9D00FC35}
[2012/01/07 21:34:33 | 000,000,000 | ---D | C] -- C:\Users\ondrej\AppData\Local\{4E6A89B1-87FA-4C7A-A1F0-2469B60F0A5F}
[2012/01/07 21:34:20 | 000,000,000 | ---D | C] -- C:\Users\ondrej\AppData\Local\{0AA7FE71-7242-4BDD-8E6C-1F84213A93D9}
[2012/01/05 09:48:35 | 000,000,000 | ---D | C] -- C:\Users\ondrej\AppData\Local\{362765F9-6255-4E09-B0EC-1468601E3593}
[2012/01/05 09:48:23 | 000,000,000 | ---D | C] -- C:\Users\ondrej\AppData\Local\{FF80144D-9179-49B2-8963-7725CB7041CF}
[2012/01/03 14:59:00 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\OS Launcher
[2012/01/03 14:58:47 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\OS Launcher
[2012/01/03 11:04:31 | 000,000,000 | ---D | C] -- C:\Users\ondrej\AppData\Local\{85812F5D-DCE4-4696-98FA-A9F717BF1E5F}
[2012/01/03 11:04:18 | 000,000,000 | ---D | C] -- C:\Users\ondrej\AppData\Local\{F483147D-055E-423A-8A35-1F23DAF699B3}
[2012/01/01 16:46:38 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\NSIS
[2012/01/01 14:20:22 | 000,000,000 | ---D | C] -- C:\Users\ondrej\AppData\Local\{8DC2306F-17F0-40FB-88D3-EF16E0B9E0E1}
[2012/01/01 14:20:10 | 000,000,000 | ---D | C] -- C:\Users\ondrej\AppData\Local\{301E205A-D736-4E52-9D0B-25A4D699DA04}
[2011/12/31 19:51:38 | 000,000,000 | ---D | C] -- C:\Users\ondrej\AppData\Local\{64B89CCA-2E42-413C-82D2-C49BD678815D}
[2011/12/31 19:51:23 | 000,000,000 | ---D | C] -- C:\Users\ondrej\AppData\Local\{BD443ED2-40A0-4348-9D5C-45984499D008}
[2011/12/31 19:35:15 | 000,000,000 | ---D | C] -- C:\Users\ondrej\AppData\Roaming\TS3Client
[2011/12/31 19:34:11 | 000,000,000 | ---D | C] -- C:\Users\ondrej\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\TeamSpeak 3 Client
[2011/12/31 19:34:03 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\TeamSpeak 3 Client
[2011/12/31 01:05:29 | 000,000,000 | ---D | C] -- C:\Users\ondrej\AppData\Local\{128A2DCC-779E-486C-BD62-51034C0A6C95}
[2011/12/31 01:05:17 | 000,000,000 | ---D | C] -- C:\Users\ondrej\AppData\Local\{3966FECB-439E-433D-937C-DE76F23C4A2F}
[2011/12/29 22:57:32 | 000,000,000 | ---D | C] -- C:\Users\ondrej\AppData\Local\{6795D43B-5AC3-4348-BDAB-D5758A5119AC}
[2011/12/29 22:57:20 | 000,000,000 | ---D | C] -- C:\Users\ondrej\AppData\Local\{E5D749E9-F1F2-4BF1-841D-89BD0D9B389B}
[2011/12/28 14:51:40 | 000,000,000 | ---D | C] -- C:\Users\ondrej\AppData\Local\{005CBAC0-883F-4555-AADB-105110A328A1}
[2011/12/28 14:51:26 | 000,000,000 | ---D | C] -- C:\Users\ondrej\AppData\Local\{63E56BB9-5EB4-4A89-B67C-7B2E70D5C45E}
[2011/12/28 12:00:32 | 000,000,000 | ---D | C] -- C:\Users\ondrej\AppData\Roaming\PabloDraw
[2011/12/28 12:00:26 | 000,000,000 | ---D | C] -- C:\Users\ondrej\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Picoe Software
[2011/12/27 10:23:32 | 000,000,000 | ---D | C] -- C:\Users\ondrej\AppData\Local\{EA15AF75-7D83-4D0B-9478-72608A5C3CD8}
[2011/12/27 10:23:18 | 000,000,000 | ---D | C] -- C:\Users\ondrej\AppData\Local\{DD7C90C0-6A48-43B5-A021-ACD40B9C86FC}
[2011/12/26 14:16:26 | 000,000,000 | ---D | C] -- C:\Users\ondrej\AppData\Local\{792B9EBF-5624-4BE3-874B-4054BE9249B4}
[2011/12/26 14:16:12 | 000,000,000 | ---D | C] -- C:\Users\ondrej\AppData\Local\{0DE32E3E-8932-40DA-8B5E-4B40F6067028}
[2011/12/26 12:14:15 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Futuremark Shared
[2011/12/26 12:12:16 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\Futuremark
[2011/12/26 12:07:43 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Futuremark
[2011/12/26 12:07:43 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Futuremark
[2011/12/25 11:48:43 | 000,000,000 | ---D | C] -- C:\Users\ondrej\AppData\Local\{4CD750A2-836A-4912-9C81-016459A7B333}
[2011/12/25 11:48:30 | 000,000,000 | ---D | C] -- C:\Users\ondrej\AppData\Local\{3DD1DF51-1825-4EC2-85A5-437682FF3BE2}
[2011/12/24 13:07:03 | 000,000,000 | ---D | C] -- C:\Users\ondrej\AppData\Local\{B5F7AF9A-7159-42C5-BD3F-CA8A1B38531E}
[2011/12/24 13:06:50 | 000,000,000 | ---D | C] -- C:\Users\ondrej\AppData\Local\{34A88B44-32C7-46E8-AEA6-62A97CCC5179}
[2011/12/23 23:44:26 | 000,000,000 | ---D | C] -- C:\Users\ondrej\AppData\Local\{DC266750-293F-4B99-978D-A7942D2C8C85}
[2011/12/23 23:44:14 | 000,000,000 | ---D | C] -- C:\Users\ondrej\AppData\Local\{EBF8A0C4-A92B-4961-9CC2-0619144DFDAA}
[2011/12/23 22:55:25 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Rovio
[2011/12/23 11:43:47 | 000,000,000 | ---D | C] -- C:\Users\ondrej\AppData\Local\{E7F09075-1EDB-4560-96C5-2E54B534FA62}
[2011/12/23 11:43:36 | 000,000,000 | ---D | C] -- C:\Users\ondrej\AppData\Local\{25EA0A90-68C5-483A-947A-E97AA2BCA8A3}
[2011/12/23 11:43:15 | 000,000,000 | ---D | C] -- C:\Users\ondrej\AppData\Local\{3CBD00EE-7ADC-4DE5-9875-6523445CB7F4}
[2011/12/22 15:49:37 | 000,000,000 | ---D | C] -- C:\Users\ondrej\AppData\Local\{53503C9B-CA04-4621-BA57-74D7B46C1D0E}
[2011/12/22 15:49:24 | 000,000,000 | ---D | C] -- C:\Users\ondrej\AppData\Local\{EC7136B7-2A22-4585-BEBA-8CA77CDDA5AF}
[2011/12/21 15:41:00 | 000,000,000 | ---D | C] -- C:\Users\ondrej\AppData\Local\{DF5B4504-6980-4C66-9F9C-CD35FDE83C54}
[2011/12/21 15:40:49 | 000,000,000 | ---D | C] -- C:\Users\ondrej\AppData\Local\{AA08D1B9-BF07-4E80-B16E-7AFD306CF8F5}
[2011/12/20 23:27:44 | 000,000,000 | ---D | C] -- C:\Users\ondrej\AppData\Local\{126CFD78-2DC9-400E-85C4-816667A11D42}
[2011/12/20 23:27:32 | 000,000,000 | ---D | C] -- C:\Users\ondrej\AppData\Local\{C10B128E-4A26-4DEA-ADEC-C085AEC99F6D}
[2011/12/19 16:58:59 | 000,000,000 | ---D | C] -- C:\Users\ondrej\AppData\Local\{9D3213DE-D540-422D-83D2-7BAB07815417}
[2011/12/19 16:58:47 | 000,000,000 | ---D | C] -- C:\Users\ondrej\AppData\Local\{4E5ACF61-92DC-430A-8654-CD96506C4D97}
[2011/12/18 12:39:26 | 000,000,000 | ---D | C] -- C:\Users\ondrej\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\IETester
[2011/12/18 11:42:48 | 000,000,000 | ---D | C] -- C:\Users\ondrej\AppData\Local\{CD53F574-7D80-445B-BC4D-398616C1583D}
[2011/12/18 11:42:34 | 000,000,000 | ---D | C] -- C:\Users\ondrej\AppData\Local\{DDD6052C-7414-4F54-B004-CC5AA9F84CF5}
[2011/12/15 16:13:47 | 000,000,000 | ---D | C] -- C:\Users\ondrej\AppData\Local\{53728DA2-48C5-4101-9D02-59DE8A2817E7}
[2011/12/15 16:13:35 | 000,000,000 | ---D | C] -- C:\Users\ondrej\AppData\Local\{E2D48FF4-BAEA-496F-857A-05BF716469E8}
[2011/12/14 22:13:23 | 000,000,000 | ---D | C] -- C:\Users\ondrej\AppData\Local\{487804AE-ED4B-449A-A726-C99119F4327C}
[2011/12/14 22:13:11 | 000,000,000 | ---D | C] -- C:\Users\ondrej\AppData\Local\{77D0849E-3C09-4A98-A4DF-761EA6247DA8}

========== Files - Modified Within 30 Days ==========

[2012/01/12 17:58:10 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Users\ondrej\Desktop\OTL.exe
[2012/01/12 17:44:40 | 000,000,932 | ---- | M] () -- C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-1753200179-3676571525-1487517018-1000UA.job
[2012/01/12 17:44:33 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012/01/12 14:02:34 | 000,001,343 | ---- | M] () -- C:\Users\ondrej\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Facebook Messenger.lnk
[2012/01/12 14:02:00 | 000,000,910 | ---- | M] () -- C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-1753200179-3676571525-1487517018-1000Core.job
[2012/01/12 13:36:25 | 000,000,027 | ---- | M] () -- C:\Windows\SysNative\drivers\etc\hosts
[2012/01/12 13:28:43 | 000,782,678 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2012/01/12 13:28:43 | 000,654,476 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2012/01/12 13:28:43 | 000,122,308 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2012/01/12 13:26:56 | 000,019,056 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012/01/12 13:26:56 | 000,019,056 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012/01/12 13:18:55 | 2388,459,520 | -HS- | M] () -- C:\hiberfil.sys
[2012/01/11 21:30:59 | 000,000,512 | ---- | M] () -- C:\Users\ondrej\Desktop\MBR.dat
[2012/01/11 19:28:42 | 001,972,528 | ---- | M] (Kaspersky Lab ZAO) -- C:\Users\ondrej\Desktop\TDSSKiller.exe
[2012/01/11 16:17:21 | 000,768,590 | ---- | M] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2012/01/10 22:31:49 | 000,007,607 | ---- | M] () -- C:\Users\ondrej\AppData\Local\Resmon.ResmonCfg
[2012/01/08 22:11:12 | 000,473,288 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2012/01/08 16:51:18 | 000,000,089 | ---- | M] () -- C:\Users\ondrej\AppData\Local\msmathematics.qat.ondrej
[2012/01/05 00:50:29 | 000,037,014 | ---- | M] () -- D:\Documents\cc_20120105_005025.reg
[2012/01/04 23:54:21 | 000,013,824 | ---- | M] () -- C:\Users\ondrej\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2012/01/03 13:56:05 | 000,000,088 | ---- | M] () -- C:\Users\ondrej\Desktop\index.php
[2011/12/31 19:34:13 | 000,001,168 | ---- | M] () -- C:\Users\ondrej\Desktop\TeamSpeak 3 Client.lnk
[2011/12/31 15:00:11 | 589,434,880 | ---- | M] () -- C:\Users\ondrej\Desktop\haiku-r1alpha3.iso
[2011/12/31 14:37:45 | 000,000,827 | ---- | M] () -- C:\Users\ondrej\Desktop\index.html
[2011/12/29 11:25:41 | 000,001,006 | ---- | M] () -- C:\Users\ondrej\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
[2011/12/28 21:10:33 | 000,000,600 | ---- | M] () -- C:\Users\ondrej\AppData\Local\PUTTY.RND
[2011/12/28 13:58:49 | 000,001,395 | RHS- | M] () -- C:\Windows\SysNative\drivers\etc\hosts.20120109-151717.backup
[2011/12/28 13:58:49 | 000,001,395 | RHS- | M] () -- C:\Windows\SysNative\drivers\etc\hosts.20120109-142206.backup
[2011/12/28 13:58:49 | 000,001,395 | RHS- | M] () -- C:\Windows\SysNative\drivers\etc\hosts.20120109-142122.backup
[2011/12/28 13:58:49 | 000,001,395 | RHS- | M] () -- C:\Windows\SysNative\drivers\etc\hosts.20120109-141956.backup
[2011/12/28 13:58:49 | 000,001,395 | RHS- | M] () -- C:\Windows\SysNative\drivers\etc\hosts.20120109-141916.backup
[2011/12/28 13:58:49 | 000,001,395 | RHS- | M] () -- C:\Windows\SysNative\drivers\etc\hosts.20120109-141729.backup
[2011/12/28 13:58:49 | 000,001,395 | -HS- | M] () -- C:\Windows\SysNative\drivers\etc\hosts.20120109-160340.backup
[2011/12/28 12:09:17 | 003,974,706 | ---- | M] () -- D:\Documents\mhargadon-thesis.pdf
[2011/12/27 22:18:15 | 018,895,255 | ---- | M] () -- C:\Users\ondrej\ASUS K 50.mp4
[2011/12/26 12:44:11 | 000,466,456 | ---- | M] (Creative Labs) -- C:\Windows\SysNative\wrap_oal.dll
[2011/12/26 12:44:11 | 000,444,952 | ---- | M] (Creative Labs) -- C:\Windows\SysWow64\wrap_oal.dll
[2011/12/18 13:57:26 | 000,034,009 | ---- | M] () -- D:\Documents\nekonecny-geometricky-rad.pdf

blacksvk · 2012/01/12

(continue OTL.TXT)
========== Files Created - No Company Name ==========

[2012/01/12 13:28:20 | 000,256,000 | ---- | C] () -- C:\Windows\PEV.exe
[2012/01/12 13:28:20 | 000,208,896 | ---- | C] () -- C:\Windows\MBR.exe
[2012/01/12 13:28:20 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe
[2012/01/12 13:28:20 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe
[2012/01/12 13:28:20 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe
[2012/01/11 21:30:59 | 000,000,512 | ---- | C] () -- C:\Users\ondrej\Desktop\MBR.dat
[2012/01/10 15:32:51 | 000,001,156 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
[2012/01/05 00:50:28 | 000,037,014 | ---- | C] () -- D:\Documents\cc_20120105_005025.reg
[2011/12/31 19:34:13 | 000,001,168 | ---- | C] () -- C:\Users\ondrej\Desktop\TeamSpeak 3 Client.lnk
[2011/12/31 14:36:59 | 000,000,827 | ---- | C] () -- C:\Users\ondrej\Desktop\index.html
[2011/12/30 13:57:53 | 000,001,343 | ---- | C] () -- C:\Users\ondrej\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Facebook Messenger.lnk
[2011/12/28 12:09:16 | 003,974,706 | ---- | C] () -- D:\Documents\mhargadon-thesis.pdf
[2011/12/27 22:16:17 | 018,895,255 | ---- | C] () -- C:\Users\ondrej\ASUS K 50.mp4
[2011/12/26 12:12:17 | 000,006,173 | ---- | C] () -- C:\Windows\SysWow64\drivers\Entech.vxd
[2011/12/26 12:12:17 | 000,003,972 | ---- | C] () -- C:\Windows\SysWow64\drivers\PciBus.sys
[2011/12/18 13:57:26 | 000,034,009 | ---- | C] () -- D:\Documents\nekonecny-geometricky-rad.pdf
[2011/10/25 11:26:04 | 000,015,610 | ---- | C] () -- C:\Windows\War3Unin.dat
[2011/10/02 13:04:35 | 000,000,089 | ---- | C] () -- C:\Users\ondrej\AppData\Local\msmathematics.qat.ondrej
[2011/06/26 09:16:47 | 000,000,020 | ---- | C] () -- C:\Windows\mafosav.INI
[2011/04/09 18:55:28 | 000,179,261 | ---- | C] () -- C:\Windows\SysWow64\xlive.dll.cat
[2011/02/18 19:25:45 | 000,000,600 | ---- | C] () -- C:\Users\ondrej\AppData\Local\PUTTY.RND
[2011/01/26 09:23:06 | 000,768,590 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2010/10/10 13:00:27 | 000,000,079 | ---- | C] () -- C:\Users\ondrej\AppData\Local\CrystalDiskMark30.ini
[2010/07/18 11:03:13 | 000,013,824 | ---- | C] () -- C:\Users\ondrej\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/06/29 17:25:59 | 000,982,240 | ---- | C] () -- C:\Windows\SysWow64\igkrng500.bin
[2010/06/29 17:25:58 | 000,092,356 | ---- | C] () -- C:\Windows\SysWow64\igfcg500m.bin
[2010/06/29 17:25:57 | 000,439,308 | ---- | C] () -- C:\Windows\SysWow64\igcompkrng500.bin
[2010/06/28 18:07:13 | 000,000,028 | ---- | C] () -- C:\Windows\ODBC.INI
[2010/03/22 14:28:42 | 000,043,502 | ---- | C] () -- C:\Users\ondrej\AppData\Roaming\UserTile.png
[2010/03/07 19:29:40 | 000,027,648 | ---- | C] () -- C:\Windows\SysWow64\AVSredirect.dll
[2010/01/31 08:51:33 | 000,000,088 | -H-- | C] () -- C:\ProgramData\aspg.dat
[2009/12/25 09:04:57 | 000,007,607 | ---- | C] () -- C:\Users\ondrej\AppData\Local\Resmon.ResmonCfg
[2009/12/25 07:47:58 | 000,000,024 | ---- | C] () -- C:\Windows\ATKPF.ini
[2009/10/30 20:04:15 | 000,053,248 | ---- | C] () -- C:\Windows\SysWow64\LogonStart.dll
[2009/08/19 09:33:09 | 000,018,432 | ---- | C] () -- C:\Windows\OOBEPlayer.exe
[2009/08/19 09:33:09 | 000,000,031 | ---- | C] () -- C:\Windows\OOBEPlayer.ini
[2009/07/29 06:20:40 | 000,000,010 | ---- | C] () -- C:\Windows\SysWow64\ABLKSR.ini
[2009/07/14 06:38:36 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat
[2009/07/14 03:35:51 | 000,000,741 | ---- | C] () -- C:\Windows\SysWow64\NOISE.DAT
[2009/07/14 03:34:42 | 000,215,943 | ---- | C] () -- C:\Windows\SysWow64\dssec.dat
[2009/07/14 01:10:29 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin
[2009/07/14 00:42:10 | 000,064,000 | ---- | C] () -- C:\Windows\SysWow64\BWContextHandler.dll
[2009/07/13 22:03:59 | 000,364,544 | ---- | C] () -- C:\Windows\SysWow64\msjetoledb40.dll
[2009/07/03 02:40:27 | 000,134,592 | ---- | C] () -- C:\Windows\SysWow64\igfcg500.bin
[2009/07/01 09:10:50 | 000,000,176 | ---- | C] () -- C:\Windows\explorer.exe.config
[2009/06/10 22:26:10 | 000,673,088 | ---- | C] () -- C:\Windows\SysWow64\mlang.dat
[2008/09/04 13:16:00 | 002,059,264 | ---- | C] () -- C:\Windows\setup_rangers_2.exe
[1997/06/14 03:56:08 | 000,056,832 | ---- | C] () -- C:\Windows\SysWow64\iyvu9_32.dll

========== LOP Check ==========

[2011/12/17 00:05:54 | 000,000,000 | ---D | M] -- C:\Users\Guest\AppData\Roaming\IrfanView
[2010/11/16 21:37:01 | 000,000,000 | ---D | M] -- C:\Users\ondrej\AppData\Roaming\.minecraft
[2011/06/24 20:34:53 | 000,000,000 | ---D | M] -- C:\Users\ondrej\AppData\Roaming\.purple
[2011/03/19 15:50:14 | 000,000,000 | ---D | M] -- C:\Users\ondrej\AppData\Roaming\aicon
[2010/12/15 20:07:45 | 000,000,000 | ---D | M] -- C:\Users\ondrej\AppData\Roaming\Asus WebStorage
[2011/11/30 15:04:53 | 000,000,000 | ---D | M] -- C:\Users\ondrej\AppData\Roaming\Avnex
[2011/08/12 16:54:44 | 000,000,000 | ---D | M] -- C:\Users\ondrej\AppData\Roaming\bazaar
[2011/06/03 15:54:22 | 000,000,000 | ---D | M] -- C:\Users\ondrej\AppData\Roaming\BlackSVK
[2011/09/02 12:18:02 | 000,000,000 | ---D | M] -- C:\Users\ondrej\AppData\Roaming\BMC
[2009/12/26 22:54:13 | 000,000,000 | ---D | M] -- C:\Users\ondrej\AppData\Roaming\bsodlock
[2011/05/22 13:09:53 | 000,000,000 | ---D | M] -- C:\Users\ondrej\AppData\Roaming\Canneverbe Limited
[2010/10/09 13:00:17 | 000,000,000 | ---D | M] -- C:\Users\ondrej\AppData\Roaming\Canon
[2010/06/28 18:56:05 | 000,000,000 | ---D | M] -- C:\Users\ondrej\AppData\Roaming\CellularEmulator
[2012/01/12 13:20:58 | 000,000,000 | ---D | M] -- C:\Users\ondrej\AppData\Roaming\Dropbox
[2009/12/27 08:24:19 | 000,000,000 | ---D | M] -- C:\Users\ondrej\AppData\Roaming\EeeStorageUploader
[2009/12/30 22:35:56 | 000,000,000 | ---D | M] -- C:\Users\ondrej\AppData\Roaming\GHISLER
[2011/03/19 15:21:56 | 000,000,000 | ---D | M] -- C:\Users\ondrej\AppData\Roaming\gtk-2.0
[2012/01/07 23:46:20 | 000,000,000 | ---D | M] -- C:\Users\ondrej\AppData\Roaming\ICQ
[2010/02/08 15:23:05 | 000,000,000 | ---D | M] -- C:\Users\ondrej\AppData\Roaming\IrfanView
[2010/07/24 10:49:30 | 000,000,000 | ---D | M] -- C:\Users\ondrej\AppData\Roaming\iScreensaver
[2010/06/12 12:59:17 | 000,000,000 | ---D | M] -- C:\Users\ondrej\AppData\Roaming\KoshyJohn.com
[2011/08/10 09:05:46 | 000,000,000 | ---D | M] -- C:\Users\ondrej\AppData\Roaming\LibreOffice
[2011/07/18 09:31:45 | 000,000,000 | ---D | M] -- C:\Users\ondrej\AppData\Roaming\MCommon
[2011/06/11 10:06:51 | 000,000,000 | ---D | M] -- C:\Users\ondrej\AppData\Roaming\MusicBrainz
[2010/07/28 07:55:52 | 000,000,000 | ---D | M] -- C:\Users\ondrej\AppData\Roaming\Need for Speed World
[2011/06/02 13:34:32 | 000,000,000 | ---D | M] -- C:\Users\ondrej\AppData\Roaming\Notepad++
[2010/02/13 12:20:36 | 000,000,000 | ---D | M] -- C:\Users\ondrej\AppData\Roaming\OpenOffice.org
[2011/12/28 12:38:09 | 000,000,000 | ---D | M] -- C:\Users\ondrej\AppData\Roaming\PabloDraw
[2010/03/22 14:28:42 | 000,000,000 | ---D | M] -- C:\Users\ondrej\AppData\Roaming\PeerNetworking
[2011/12/24 00:22:45 | 000,000,000 | ---D | M] -- C:\Users\ondrej\AppData\Roaming\Rovio
[2009/12/25 16:15:50 | 000,000,000 | ---D | M] -- C:\Users\ondrej\AppData\Roaming\sysinfo
[2011/07/18 10:46:56 | 000,000,000 | ---D | M] -- C:\Users\ondrej\AppData\Roaming\Teeworlds
[2010/01/22 17:09:48 | 000,000,000 | ---D | M] -- C:\Users\ondrej\AppData\Roaming\temp
[2011/06/18 18:30:51 | 000,000,000 | ---D | M] -- C:\Users\ondrej\AppData\Roaming\Thunderbird
[2011/12/31 23:19:23 | 000,000,000 | ---D | M] -- C:\Users\ondrej\AppData\Roaming\TS3Client
[2011/09/24 01:10:58 | 000,000,000 | ---D | M] -- C:\Users\ondrej\AppData\Roaming\Unity
[2010/02/23 19:02:42 | 000,000,000 | ---D | M] -- C:\Users\ondrej\AppData\Roaming\VitySoft
[2010/12/24 23:34:34 | 000,000,000 | ---D | M] -- C:\Users\ondrej\AppData\Roaming\Western Digital
[2011/06/11 09:38:36 | 000,000,000 | ---D | M] -- C:\Users\ondrej\AppData\Roaming\Windows Live Writer
[2011/12/01 20:26:50 | 000,000,000 | ---D | M] -- C:\Users\ondrej\AppData\Roaming\XBMC
[2012/01/12 14:02:00 | 000,000,910 | ---- | M] () -- C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1753200179-3676571525-1487517018-1000Core.job
[2012/01/12 17:44:40 | 000,000,932 | ---- | M] () -- C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1753200179-3676571525-1487517018-1000UA.job
[2011/11/16 13:33:35 | 000,032,552 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT

========== Purity Check ==========

========== Custom Scans ==========

< %SYSTEMDRIVE%\*.* >
[2009/06/15 12:11:59 | 000,000,054 | ---- | M] () -- C:\AdobeReader.log
[2011/08/24 04:19:50 | 000,367,472 | RHS- | M] () -- C:\bootmgr
[2011/05/02 20:57:08 | 000,000,001 | -HS- | M] () -- C:\BOOTNXT
[2011/11/12 07:04:02 | 000,008,192 | RHS- | M] () -- C:\BOOTSECT.BAK
[2012/01/12 13:39:19 | 000,022,714 | ---- | M] () -- C:\ComboFix.txt
[2009/10/30 20:15:03 | 000,013,613 | ---- | M] () -- C:\devlist.txt
[2009/10/30 20:15:02 | 000,000,009 | ---- | M] () -- C:\Finish.log
[2012/01/12 13:18:55 | 2388,459,520 | -HS- | M] () -- C:\hiberfil.sys
[2009/07/10 09:35:33 | 001,048,576 | -H-- | M] () -- C:\K40IJ.BIN
[2009/07/29 12:46:19 | 000,000,018 | ---- | M] () -- C:\K40IJ_K50IJ_WIN7.10
[2009/07/10 09:40:31 | 001,048,576 | -H-- | M] () -- C:\K50IJ.BIN
[2009/07/02 08:17:15 | 000,000,037 | ---- | M] () -- C:\Nero.Log
[2009/06/12 02:32:00 | 000,000,057 | ---- | M] () -- C:\OFFICE2007_M.TXT
[2012/01/12 13:19:38 | 3184,615,424 | -HS- | M] () -- C:\pagefile.sys
[2009/10/30 07:24:08 | 000,000,146 | ---- | M] () -- C:\Pass.txt
[2009/09/01 03:54:37 | 000,003,750 | ---- | M] () -- C:\Patch.LOG
[2009/07/29 12:46:19 | 000,000,014 | ---- | M] () -- C:\RECOVERY.DAT
[2009/10/30 20:04:37 | 000,000,090 | ---- | M] () -- C:\setup.log
[2010/02/24 16:04:00 | 000,921,624 | ---- | M] () -- C:\snp2uvc-001.raw
[2012/01/11 19:29:54 | 000,084,010 | ---- | M] () -- C:\TDSSKiller.2.7.0.0_11.01.2012_19.29.04_log.txt
[2009/09/16 19:04:46 | 000,000,024 | ---- | M] () -- C:\v82.txt
[2010/03/20 00:55:52 | 002,073,703 | ---- | M] () -- C:\VS_EXPBSLN_x64_enu.CAB
[2010/03/20 00:58:20 | 000,551,424 | ---- | M] () -- C:\VS_EXPBSLN_x64_enu.MSI

< %systemroot%\Fonts\*.com >
[2009/07/14 06:32:31 | 000,026,040 | ---- | M] () -- C:\Windows\Fonts\GlobalMonospace.CompositeFont
[2009/07/14 06:32:31 | 000,026,489 | ---- | M] () -- C:\Windows\Fonts\GlobalSansSerif.CompositeFont
[2009/07/14 06:32:31 | 000,029,779 | ---- | M] () -- C:\Windows\Fonts\GlobalSerif.CompositeFont
[2009/07/14 06:32:31 | 000,043,318 | ---- | M] () -- C:\Windows\Fonts\GlobalUserInterface.CompositeFont

< %systemroot%\Fonts\*.dll >

< %systemroot%\Fonts\*.ini >
[2009/06/10 21:49:50 | 000,000,065 | ---- | M] () -- C:\Windows\Fonts\desktop.ini

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\Fonts\*.exe >

< %systemroot%\system32\spool\prtprocs\w32x86\*.* >

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.jpg >

< %systemroot%\*.jpg >

< %systemroot%\*.png >

< %systemroot%\*.scr >
[2011/05/13 14:42:24 | 000,302,448 | ---- | M] (Microsoft Corporation) -- C:\Windows\WLXPGSS.SCR

< %systemroot%\*._sy >

< %APPDATA%\Adobe\Update\*.* >

< %ALLUSERSPROFILE%\Favorites\*.* >

< %APPDATA%\Microsoft\*.* >
[2011/02/04 17:09:42 | 000,001,654 | -HS- | M] () -- C:\Users\ondrej\AppData\Roaming\Microsoft\LastFlashConfig.wfc

< %PROGRAMFILES%\*.* >
[2009/07/14 05:54:24 | 000,000,174 | -HS- | M] () -- C:\Program Files (x86)\desktop.ini

< %APPDATA%\Update\*.* >

< %systemroot%\*. /mp /s >

< %systemroot%\System32\config\*.sav >

< %PROGRAMFILES%\bak. /s >

< %systemroot%\system32\bak. /s >

< %ALLUSERSPROFILE%\Start Menu\*.lnk /x >

< %systemroot%\system32\config\systemprofile\*.dat /x >

< %systemroot%\*.config >
[2009/07/01 09:10:50 | 000,000,176 | ---- | M] () -- C:\Windows\explorer.exe.config

< %systemroot%\system32\*.db >

< %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
[2011/04/01 10:57:09 | 000,000,221 | -HS- | M] () -- C:\Users\ondrej\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini

< %USERPROFILE%\Desktop\*.exe >
[2012/01/12 17:58:10 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Users\ondrej\Desktop\OTL.exe
[2012/01/11 19:28:42 | 001,972,528 | ---- | M] (Kaspersky Lab ZAO) -- C:\Users\ondrej\Desktop\TDSSKiller.exe

< %PROGRAMFILES%\Common Files\*.* >

< %systemroot%\*.src >

< %systemroot%\install\*.* >

< %systemroot%\system32\DLL\*.* >

< %systemroot%\system32\HelpFiles\*.* >

< %systemroot%\system32\rundll\*.* >

< %systemroot%\winn32\*.* >

< %systemroot%\Java\*.* >

< %systemroot%\system32\test\*.* >

< %systemroot%\system32\Rundll32\*.* >

< %systemroot%\AppPatch\Custom\*.* >

< %APPDATA%\Roaming\Microsoft\Windows\Recent\*.lnk /x >

< %PROGRAMFILES%\PC-Doctor\Downloads\*.* >

< %PROGRAMFILES%\Internet Explorer\*.tmp >

< %PROGRAMFILES%\Internet Explorer\*.dat >

< %USERPROFILE%\My Documents\*.exe >

< %USERPROFILE%\*.exe >

< %systemroot%\ADDINS\*.* >
[2009/06/10 22:20:04 | 000,000,802 | ---- | M] () -- C:\Windows\ADDINS\FXSEXT.ecf

< %systemroot%\assembly\*.bak2 >

< %systemroot%\Config\*.* >

< %systemroot%\REPAIR\*.bak2 >

< %systemroot%\SECURITY\Database\*.sdb /x >
[2011/04/01 10:04:37 | 000,008,192 | ---- | M] () -- C:\Windows\SECURITY\Database\edb.chk
[2011/04/01 10:04:37 | 001,048,576 | ---- | M] () -- C:\Windows\SECURITY\Database\edb.log
[2009/12/27 11:17:27 | 001,048,576 | ---- | M] () -- C:\Windows\SECURITY\Database\edbres00001.jrs
[2009/12/27 11:17:27 | 001,048,576 | ---- | M] () -- C:\Windows\SECURITY\Database\edbres00002.jrs
[2011/04/01 10:04:37 | 001,056,768 | ---- | M] () -- C:\Windows\SECURITY\Database\tmp.edb

< %systemroot%\SYSTEM\*.bak2 >

< %systemroot%\Web\*.bak2 >

< %systemroot%\Driver Cache\*.* >

< %PROGRAMFILES%\Mozilla Firefox\0*.exe >

< %ProgramFiles%\Microsoft Common\*.* >

< %ProgramFiles%\TinyProxy. >

< %USERPROFILE%\Favorites\*.url /x >
[2011/11/05 17:49:45 | 000,000,402 | -HS- | M] () -- C:\Users\ondrej\Favorites\desktop.ini

< %systemroot%\system32\*.bk >

< %systemroot%\*.te >

< %systemroot%\system32\system32\*.* >

< %ALLUSERSPROFILE%\*.dat /x >
[2009/10/30 19:39:40 | 000,000,105 | ---- | M] () -- C:\ProgramData\{40BF1E83-20EB-11D8-97C5-0009C5020658}.log
[2009/10/30 19:38:53 | 000,000,107 | ---- | M] () -- C:\ProgramData\{C59C179C-668D-49A9-B6EA-0121CCFC1243}.log

< %systemroot%\system32\drivers\*.rmv >

< dir /b "%systemroot%\system32\*.exe" | find /i " " /c >

< dir /b "%systemroot%\*.exe" | find /i " " /c >
ASUS Camera ScreenSaver Uninstaller.exe
ASUS Camera ScreenSaver.exe

< %PROGRAMFILES%\Microsoft\*.* >

< %systemroot%\System32\Wbem\proquota.exe >

< %PROGRAMFILES%\Mozilla Firefox\*.dat >

< %USERPROFILE%\Cookies\*.txt /x >

< %SystemRoot%\system32\fonts\*.* >

< %systemroot%\system32\winlog\*.* >

< %systemroot%\system32\Language\*.* >

< %systemroot%\system32\Settings\*.* >

< %systemroot%\system32\*.quo >

< %SYSTEMROOT%\AppPatch\*.exe >

< %SYSTEMROOT%\inf\*.exe >

< %SYSTEMROOT%\Installer\*.exe >

< %systemroot%\system32\config\*.bak2 >

< %systemroot%\system32\Computers\*.* >

< %SystemRoot%\system32\Sound\*.* >

< %SystemRoot%\system32\SpecialImg\*.* >

< %SystemRoot%\system32\code\*.* >

< %SystemRoot%\system32\draft\*.* >

< %SystemRoot%\system32\MSSSys\*.* >

< %ProgramFiles%\Javascript\*.* >

< %systemroot%\pchealth\helpctr\System\*.exe /s >

< %systemroot%\Web\*.exe >

< %systemroot%\system32\msn\*.* >

< %systemroot%\system32\*.tro >

< %AppData%\Microsoft\Installer\msupdates\*.* >

< %ProgramFiles%\Messenger\*.* >

< %systemroot%\system32\systhem32\*.* >

< %systemroot%\system\*.exe >

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\ Auto Update\Results\Install|LastSuccessTime /rs >

========== Alternate Data Streams ==========

@Alternate Data Stream - 145 bytes -> C:\ProgramData\Temp:AB689DEA
@Alternate Data Stream - 141 bytes -> C:\ProgramData\Temp:15024E60
@Alternate Data Stream - 135 bytes -> C:\ProgramData\Temp:734E442A
@Alternate Data Stream - 121 bytes -> C:\ProgramData\Temp:B88E99C8
@Alternate Data Stream - 118 bytes -> C:\ProgramData\Temp:A724744F

< End of report >

Extras.txt
OTL Extras logfile created on: 1/12/2012 6:24:32 PM - Run 1
OTL by OldTimer - Version 3.2.31.0 Folder = C:\Users\ondrej\Desktop
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: Slovensko | Language: SKY | Date Format: d. M. yyyy

2.97 Gb Total Physical Memory | 1.20 Gb Available Physical Memory | 40.40% Memory free
5.93 Gb Paging File | 3.92 Gb Available in Paging File | 66.13% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 74.52 Gb Total Space | 14.37 Gb Free Space | 19.28% Space Free | Partition Type: NTFS
Drive D: | 175.02 Gb Total Space | 1.14 Gb Free Space | 0.65% Space Free | Partition Type: NTFS
Drive E: | 4.10 Gb Total Space | 0.00 Gb Free Space | 0.00% Space Free | Partition Type: CDFS
Drive F: | 33.90 Gb Total Space | 15.84 Gb Free Space | 46.72% Space Free | Partition Type: NTFS
Drive I: | 944.67 Mb Total Space | 902.59 Mb Free Space | 95.55% Space Free | Partition Type: FAT

Computer Name: ASUS-K50IJ | User Name: ondrej | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========

========== File Associations ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)
.html [@ = Reg Error: Value error.] -- Reg Error: Key error. File not found

[HKEY_USERS\S-1-5-21-1753200179-3676571525-1487517018-1000\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %SystemRoot%\system32\mshtml.dll,PrintHTML "%1" (Microsoft Corporation)
https [open] -- "C:\Program Files (x86)\Mozilla Firefox\firefox.exe" -requestPending -osint -url "%1" (Mozilla Corporation)
inffile [install] -- %SystemRoot%\System32\rundll32.exe setupapi,InstallHinfSection DefaultInstall 132 %1 (Microsoft Corporation)
InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll ",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll ",PrintHTML "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1 "
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1 ",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
https [open] -- "C:\Program Files (x86)\Mozilla Firefox\firefox.exe" -requestPending -osint -url "%1" (Mozilla Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1 "
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
"FirewallDisableNotify" = 0
"AntiVirusDisableNotify" = 0
"UpdatesDisableNotify" = 0

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01 [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirewallDisableNotify" = 0
"AntiVirusDisableNotify" = 0
"UpdatesDisableNotify" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

========== Firewall Settings ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]

========== HKEY_LOCAL_MACHINE Uninstall List ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{05BFB060-4F22-4710-B0A2-2801A1B606C5}" = Microsoft Antimalware
"{0FB871A9-C617-4415-BB5D-619A8D946115}" = Microsoft Antimalware Service SK-SK Language Pack
"{1686C4D1-B1FD-42E8-B7A8-FB4C4DBA5BA8}" = ASUS Power4Gear Hybrid
"{180C8888-50F1-426B-A9DC-AB83A1989C65}" = Windows Live Language Selector
"{1ACC8FFB-9D84-4C05-A4DE-D28A9BC91698}" = Windows Live ID Sign-in Assistant
"{1C7C8AAF-A16D-32E8-89E5-F6D165DE0BCE}" = Microsoft Visual C++ 2010 x64 Runtime - 10.0.40219
"{23170F69-40C1-2702-0920-000001000000}" = 7-Zip 9.20 (x64 edition)
"{26A24AE4-039D-4CA4-87B4-2F86417000FF}" = Java(TM) 7 (64-bit)
"{350AA351-21FA-3270-8B7A-835434E766AD}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.21022
"{42738DB0-FC3E-4672-A99B-9372F5696E30}" = Microsoft Security Client
"{57019733-78E6-43DE-8E6D-55349F0FDE6F}" = inSSIDer 2.0
"{5ED9FDE9-E24B-4AB3-9D6B-1303F0696BA8}" = WD SmartWare
"{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161
"{626672CD-BFCF-49A9-AEFE-AB0FED3BFC5B}" = Centrum zariadenÃ Windows Mobile
"{64A3A4F4-B792-11D6-A78A-00B0D0170000}" = Java(TM) SE Development Kit 7 (64-bit)
"{7E265513-8CDA-4631-B696-F40D983F3B07}_is1" = CDBurnerXP
"{8220EEFE-38CD-377E-8595-13398D740ACE}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17
"{8E34682C-8118-31F1-BC4C-98CD9675E1C2}" = Microsoft .NET Framework 4 Extended
"{92DBCA36-9B41-4DD1-941A-AED149DD37F0}" = AktualizÃ¡cia ovlÃ¡dača aplikÃ¡cie Centrum zariadenÃ Windows Mobile
"{95120000-00B9-0409-1000-0000000FF1CE}" = Microsoft Application Error Reporting
"{997C9EC4-B53D-479D-81B7-0AEC8D174BA1}" = iTunes
"{A401975C-C1C5-4ECB-BC18-BFD9F8F401B8}" = Paint.NET v3.5.3
"{BCA26999-EC22-3007-BB79-638913079C9A}" = Microsoft Visual Studio 2010 Express Prerequisites x64 - ENU
"{C3600AE6-93A0-3DB7-B7AA-45BD58F133B5}" = Microsoft Visual Studio 2010 Tools for Office Runtime (x64)
"{D3E39E77-0EB4-36FB-B97A-8C8AB21B9A45}" = Visual Studio .NET Prerequisites - English
"{D4AD39AD-091E-4D33-BB2B-59F6FCB8ADC3}" = Microsoft SQL Server Compact 3.5 SP2 x64 ENU
"{DA54F80E-261C-41A2-A855-549A144F2F59}" = Windows Live MIME IFilter
"{DC911ADF-7B60-40F2-A112-FB1EB6402D07}" = Microsoft Security Client SK-SK Language Pack
"{E5748D30-7E6D-3A8E-BFE6-C1D02C6DDABB}" = Microsoft Help Viewer 1.1
"{E57B7E0A-8BE5-42E2-BE60-C07ED680A063}" = Microsoft Mathematics (64-bit)
"{E704008B-0515-490F-83E1-95AA2A7F4641}" = Oracle VM VirtualBox 4.1.6
"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin 64-bit
"CCleaner" = CCleaner
"Elantech" = ETDWare PS/2-x64 7.0.5.5_WHQL
"HDMI" = Intel(R) Graphics Media Accelerator Driver
"Lazarus_is1" = Lazarus 0.9.28.2
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Extended" = Microsoft .NET Framework 4 Extended
"Microsoft Help Viewer 1.1" = Microsoft Help Viewer 1.1
"Microsoft Security Client" = Microsoft Security Essentials
"Microsoft Visual Studio 2010 Tools for Office Runtime (x64)" = Microsoft Visual Studio 2010 Tools for Office Runtime (x64)
"USB 2.0 1.3M UVC WebCam" = USB 2.0 1.3M UVC WebCam

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{01C79EF3-DE84-4B56-B638-8BEA0D507506}" = Microsoft XNA Game Studio 4.0 (XnaLiveProxy)
"{048298C9-A4D3-490B-9FF9-AB023A9238F3}" = Steam
"{06585B02-F20D-4AB2-9A64-86EF2AE0F8F0}" = ASUS AI Recovery
"{0666E46E-A860-4353-BE6D-13AA72FABB57}" = Microsoft XNA Game Studio Platform Tools
"{08C84CC6-E7FD-4B2D-BBF9-B02CC90EE031}" = Microsoft XNA Game Studio 4.0 (Shared Components)
"{0969AF05-4FF6-4C00-9406-43599238DE0D}" = ASUS Splendid Video Enhancement Technology
"{0B0F231F-CE6A-483D-AA23-77B364F75917}" = Windows Live Installer
"{112C23F2-C036-4D40-BED4-0CB47BF5555C}" = Visual Studio 2010 Tools for SQL Server Compact 3.5 SP2 ENU
"{11778DA1-0495-4ED9-972F-F9E0B0367CD5}" = Windows Live Writer
"{13233CD8-5ED4-4B5B-A45C-0DAFEA26996E}" = Microsoft Device Experience Development Kit 7R2
"{13A5E785-5197-4EAD-8EE3-D660271E49BC}" = Feedback Tool
"{14DD7530-CCD2-3798-B37D-3839ED6A441C}" = Microsoft Visual Studio 2010 ADO.NET Entity Framework Tools
"{196BB40D-1578-3D01-B289-BEFC77A11A1E}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.30319
"{1D7CE340-70C3-4848-BCCF-215950328A4C}" = Facebook Video Calling 1.0.0.8953
"{1DBD1F12-ED93-49C0-A7CC-56CBDE488158}" = ASUS LifeFrame3
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{1F6AB0E7-8CDD-4B93-8A23-AA9EB2FEFCE4}" = Junk Mail filter update
"{200FEC62-3C34-4D60-9CE8-EC372E01C08F}" = Windows Live SOXE Definitions
"{20D4A895-748C-4D88-871C-FDB1695B0169}" = Platform
"{20FDF948-C8ED-4543-A539-F7F4AEF5AFA2}" = Wireless Console 3
"{26A24AE4-039D-4CA4-87B4-2F83216026FF}" = Java(TM) 6 Update 26
"{28456131-01CD-4BE4-8D67-BDBDD1ED636A}" = Windows Live Sync
"{291B3A3B-F808-45B8-8113-DF232FCB6C82}" = Microsoft .NET Compact Framework 3.5
"{293FC6B3-60AE-487D-8382-A4AC1103E9A3}" = Facebook Messenger 2.0.4393.0
"{2BFC7AA0-544C-4E3A-8796-67F3BE655BE9}" = Microsoft XNA Framework Redistributable 4.0
"{2FDBBCEA-62DB-45F4-B6E5-0E1FB2A1F29D}" = Visual C++ 8.0 Runtime Setup Package (x64)
"{3108C217-BE83-42E4-AE9E-A56A2A92E549}" = Atheros Communications Inc.(R) AR8121/AR8113/AR8114 Gigabit/Fast Ethernet Driver
"{3336F667-9049-4D46-98B6-4C743EEBC5B1}" = Windows Live Photo Gallery
"{357428EF-BC74-42C8-AC5D-922AB201979C}" = PHP Obfuscator
"{37F8C732-02B5-41A2-9F5B-D94EAC2226AB}" = Angry Birds Seasons
"{3A9FC03D-C685-4831-94CF-4EDFD3749497}" = Microsoft SQL Server Compact 3.5 SP2 ENU
"{3B05F2FB-745B-4012-ADF2-439F36B2E70B}" = ATKOSD2
"{3F4EB5FE-B5BE-4069-A5A8-6D9262E1B379}" = Microsoft XNA Game Studio 4.0 Documentation
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4CB0307C-565E-4441-86BE-0DF2E4FB828C}" = Microsoft Games for Windows Marketplace
"{4CBA3D4C-8F51-4D60-B27E-F6B641C571E7}" = Microsoft Search Enhancement Pack
"{51E13E14-F72A-4C97-8FD7-04322D995E2F}" = Philips SPC 900NC PC Camera
"{59F24743-2EA1-3A45-B8C2-6E0E1E078FA8}" = Microsoft Visual C# 2010 Express - ENU
"{5A22D889-FBDD-4AE8-86EC-089D45FC133E}" = Alcor Micro USB Card Reader
"{5AB7D739-1735-3A9E-BE73-C43507CB4E6F}" = Microsoft Visual Studio 2010 Service Pack 1
"{5B65EF64-1DFA-414A-8C94-7BB726158E21}" = ControlDeck
"{5D9ED403-94DE-3BA0-B1D6-71F4BDA412E6}" = Microsoft Visual C++ 2010 x86 Runtime - 10.0.40219
"{5E627606-53B9-42D1-97E1-D03F6229E248}" = Windows Live UX Platform Language Pack
"{60D6618B-153F-4353-8185-908E676E5888}" = ASUS FancyStart
"{63850BE8-3C34-42B7-95C0-859B0C9BB5FB}_is1" = Autorun 2.1
"{64452561-169F-4A36-A2FF-B5E118EC65F5}" = ASUS SmartLogon
"{6491AB99-A11E-41FD-A5E7-32DE8A097B8E}" = Windows Live Essentials
"{682B3E4F-696A-42DE-A41C-4C07EA1678B4}" = Windows Live SOXE
"{68BD57D3-D606-411E-A7E0-3EB6EA5660F6}" = Microsoft XNA Game Studio 4.0 (Redists)
"{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin
"{6F37D92B-41AA-44B7-80D2-457ABDE11896}" = Windows Live Photo Common
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{73AD5A08-FCFE-44EA-9436-3F7BEAF60049}" = Angry Birds
"{73BE04D9-BA0E-4BAF-9C9D-677278BDB3DC}" = Microsoft XNA Game Studio 4.0 (ARP entry)
"{7644E42D-B096-457F-8B5B-901238FC81AE}" = ICQ7.6
"{77F1F8AD-51B8-4490-AEEC-BF480073E0FC}" = Microsoft SQL Server 2008 R2 Management Objects
"{7AAA27E4-CDB3-49C0-AA2D-41827C001BA3}" = Microsoft Small Basic v0.95
"{7B2CC3DF-64FA-44AE-8F57-B0F915147E4F}_is1" = Need For Speedâ„¢ World
"{7C05592D-424B-46CB-B505-E0013E8E75C9}" = ATK Hotkey
"{7CB529B2-6C74-4878-9C3F-C29C3C3BBDC6}" = Windows Live Writer Resources
"{7F3AD00A-1819-4B15-BB7D-08B3586336D7}" = 3DMark06
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-110304260}" = Island Wars 2
"{83C292B7-38A5-440B-A731-07070E81A64F}" = Windows Live PIMT Platform
"{877B76B2-F83F-4F5A-B28D-3F398641ADB6}" = Microsoft SQL Server System CLR Types
"{8917DCC8-0A58-4ED1-AC55-0C187848C7A9}_is1" = OS Launcher verzia 2.0
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8C496FBF-DB4A-468D-A3A1-15E127382218}" = Microsoft XNA Game Studio 4.0 (Visual Studio)
"{8DD46C6A-0056-4FEC-B70A-28BB16A1F11F}" = MSVCRT
"{8F21291E-0444-4B1D-B9F9-4370A73E346D}" = WinFlash
"{8FB53850-246A-3507-8ADE-0060093FFEA6}" = Visual Studio Tools for the Office system 3.0 Runtime
"{909F8EBC-EC7F-48FF-0085-475D818F0F31}" = Need for Speed Underground 2
"{92EA4134-10D1-418A-91E1-5A0453131A38}" = Windows Live Movie Maker
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{97F77D62-5110-4FA3-A2D3-410B92D31199}" = Windows Live FotogalÃ©ria
"{9A33B83D-FFC4-44CF-BEEF-632DECEF2FCD}" = Microsoft SQL Server Database Publishing Wizard 1.2
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9D56775A-93F3-44A3-8092-840E3826DE30}" = Windows Live Mail
"{A49F249F-0C91-497F-86DF-B2585E8E76B7}" = Microsoft Visual C++ 2005 Redistributable
"{A6C18ECE-BD43-4413-9CE2-E396DF2807C6}_is1" = PC sys info 2.7.2
"{A726AE06-AAA3-43D1-87E3-70F510314F04}" = Windows Live Writer
"{A9BDCA6B-3653-467B-AC83-94367DA3BFE3}" = Windows Live Photo Common
"{AAAFC670-569B-4A2F-82B4-42945E0DE3EF}" = Windows Live Writer
"{AC76BA86-7AD7-1029-7B44-AA1000000001}" = Adobe Reader X (10.1.2) - Czech
"{B3575D00-27EF-49C2-B9E0-14B3D954E992}" = Apple Application Support
"{BEE64C14-BEF1-4610-8A68-A16EAA47B882}" = Futuremark SystemInfo
"{C9E14402-3631-4182-B377-6B0DFB1C0339}" = QuickTime
"{CCF298AF-9CE1-4B26-B251-486E98A34789}" = Windows 7 USB/DVD Download Tool
"{CE95A79E-E4FC-4FFF-8A75-29F04B942FF2}" = Windows Live UX Platform
"{CFEF48A8-BFB8-3EAC-8BA5-DE4F8AA267CE}" = Microsoft .NET Framework 4 Multi-Targeting Pack
"{D0B44725-3666-492D-BEF6-587A14BD9BD9}" = MSVCRT_amd64
"{D1E5870E-E3E5-4475-98A6-ADD614524ADF}" = ATK Media
"{D3D54F3E-C5C3-443D-978F-87A72E5616E8}" = ATK Generic Function Service
"{D45240D3-B6B3-4FF9-B243-54ECE3E10066}" = Windows Live Communications Platform
"{E09C4DB7-630C-4F06-A631-8EA7239923AF}" = D3DX10
"{E0B3F290-186B-46C8-BA95-F3D6542C2407}" = Angry Birds Rio
"{EC8BD21F-0CA0-4BBF-97D9-4A52B30041A1}" = ASUS Virtual Camera
"{EDDF99D9-9FE3-4871-A7DB-D1522C51EE9A}" = Microsoft .NET Compact Framework 2.0 SP2
"{EEA5F1E7-E934-4F4E-85C8-8FEC9CCE525C}" = Facebook Video Calling 1.0.0.7339
"{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}" = Intel(R) Graphics Media Accelerator Driver
"{F1161EC6-7CC1-4D9F-83F6-8839C17019C2}" = LibreOffice 3.4
"{F2508213-9989-4E85-A078-72BE483917EF}" = Microsoft Games for Windows - LIVE Redistributable
"{FA6CF94F-DACF-4FE7-959D-55C421B91B17}" = Windows Live Mail
"{FB3D07AE-73D0-47A9-AC12-6F50BF8B6202}" = Windows Live Movie Maker
"{FDB3B167-F4FA-461D-976F-286304A57B2A}" = Adobe AIR
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Age of Empires 2.0" = Microsoft Age of Empires II
"Age of Empires II: The Conquerors Expansion 1.0" = Microsoft Age of Empires II: The Conquerors Expansion
"Android SDK Tools" = Android SDK Tools
"AREA-51" = AREA-51 (remove only)
"Asus_Camera_ScreenSaver" = Asus_Camera_ScreenSaver
"AutoItv3" = AutoIt v3.3.6.1
"Avencast_is1" = Avencast
"Bazaar_is1" = Bazaar 2.3.4
"EasyBCD" = EasyBCD 2.1
"FreePascal_is1" = Free Pascal 2.4.0
"Hugin" = Hugin 2010.4.0
"IETester" = IETester v0.4.11 (remove only)
"Inno Setup 5_is1" = Inno Setup verzia 5.4.3
"InstallShield_{20D4A895-748C-4D88-871C-FDB1695B0169}" = VIA Platform Device Manager
"InstallShield_{5A22D889-FBDD-4AE8-86EC-089D45FC133E}" = Alcor Micro USB Card Reader
"IrfanView" = IrfanView (remove only)
"LAME for Audacity_is1" = LAME v3.98.3 for Audacity
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware verzia 1.60.0.1800
"Maxima-5.25.1_is1" = Maxima 5.25.1
"Microsoft Visual C# 2010 Express - ENU" = Microsoft Visual C# 2010 Express - ENU
"Microsoft Visual Studio 2010 Service Pack 1" = Microsoft Visual Studio 2010 Service Pack 1
"Mozilla Firefox 9.0.1 (x86 sk)" = Mozilla Firefox 9.0.1 (x86 sk)
"MusicBrainz Picard" = MusicBrainz Picard
"Notepad++" = Notepad++
"OpenAL" = OpenAL
"PacIn: Nermessova pomsta" = PacIn: Nermessova pomsta 1.0
"PhotoStitch" = Canon Utilities PhotoStitch
"ReallySlickScreensavers" = Really Slick Screensavers 0.2
"Scorpions WinCheater 2.07 (pouze program)_is1" = Scorpions WinCheater
"Sgc 3D Simulator_is1" = Sgc 3D Simulator 1.5
"Space Rangers 2" = 1C Company\Space Rangers 2 - Reboot Add-on
"Steam App 220" = Half-Life 2
"Steam App 70130" = Hacker Evolution - Demo
"Steam App 70140" = Hacker Evolution: Untold - Demo
"SUPER ©" = SUPER © Version 2010.bld.37 (Jan 2, 2010)
"SuperTux 0.3.1" = SuperTux 0.3.1
"System Explorer_is1" = System Explorer 3.0.0
"TmNationsForever_is1" = TmNationsForever Update 2010-03-15
"Totalcmd" = Total Commander (Remove or Repair)
"Uplink Demo" = Uplink Demo (remove only)
"Visual Studio Tools for the Office system 3.0 Runtime" = Visual Studio Tools for the Office system 3.0 Runtime
"VLC media player" = VLC media player 1.1.5
"Warcraft III" = Warcraft III
"Warmux" = Warmux
"WinLiveSuite" = Windows Live Essentials
"World of Warcraft" = World of Warcraft
"XNA Game Studio 4.0" = Microsoft XNA Game Studio 4.0

========== HKEY_USERS Uninstall List ==========

[HKEY_USERS\S-1-5-21-1753200179-3676571525-1487517018-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"76f4758ca7e15dc6" = MusicJet
"d01ceffabf01ac0c" = PabloDraw
"Dropbox" = Dropbox
"TeamSpeak 3 Client" = TeamSpeak 3 Client
"UnityWebPlayer" = Unity Web Player
"XBMC" = XBMC

========== Last 10 Event Log Errors ==========

Error reading Event Logs: The Event Service is not operating properly or the Event Logs are corrupt!

< End of report >

broni · 2012/01/12

I can't proceed because you didn't answer my question:

How is redirection?
Click to expand...

blacksvk · 2012/01/12

It seems Combofix fixed my redirection problems. Thank you.

broni · 2012/01/12

Good

Run OTL
Under the [color= "#0000FF"]Custom Scans/Fixes[/color] box at the bottom, paste in the following
Code:
:OTL
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKU\S-1-5-21-1753200179-3676571525-1487517018-1000\..\Toolbar\WebBrowser: (no name) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No CLSID value found.
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jin...ndows-i586.cab (Reg Error: Key error.)

:Commands
[purity]
[emptytemp]
[emptyjava]
[emptyflash]
[Reboot]
Then click the [color= "#FF0000"]Run Fix[/color] button at the top

Let the program run unhindered, reboot the PC when it is done

You will get a log that shows the results of the fix. Please post it.
=============================================================

Last scans...

1. Download Security Check from HERE, and save it to your Desktop.

Double-click SecurityCheck.exe

Follow the onscreen instructions inside of the black box.

A Notepad document should open automatically called checkup.txt; please post the contents of that document.

NOTE SecurityCheck may produce some false warning(s), so leave the results reading to me.

2. Please download Farbar Service Scanner and run it on the computer with the issue.

Make sure the following options are checked:

Internet Services

Windows Firewall

System Restore

Security Center

Windows Update

Press "Scan ".

It will create a log (FSS.txt) in the same directory the tool is run.

Please copy and paste the log to your reply.

3. Download Temp File Cleaner (TFC)

Double click on TFC.exe to run the program.

Click on Start button to begin cleaning process.

TFC will close all running programs, and it may ask you to restart computer.

4. Please run a free online scan with the ESET Online Scanner

Disable your antivirus program

Tick the box next to YES, I accept the Terms of Use

Click Start

Accept any security warnings from your browser.

Check Scan archives

Click Start

ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.

When the scan completes, click on List of found threats

Click on Export to text file , and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.

NOTE. If Eset won't find any threats, it won't produce any log.

blacksvk · 2012/01/13

Here it is:

OTL:
All processes killed
========== OTL ==========
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\Locked deleted successfully.
Registry value HKEY_USERS\S-1-5-21-1753200179-3676571525-1487517018-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{21FA44EF-376D-4D53-9B0F-8A89D3229068} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{21FA44EF-376D-4D53-9B0F-8A89D3229068}\ not found.
Starting removal of ActiveX control {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ not found.
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes
->Flash cache emptied: 56468 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Guest
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes
->Flash cache emptied: 56468 bytes

User: ondrej
->Temp folder emptied: 69557 bytes
->Temporary Internet Files folder emptied: 4025994 bytes
->Java cache emptied: 6525673 bytes
->FireFox cache emptied: 635121488 bytes
->Flash cache emptied: 71056 bytes

User: Public
->Temp folder emptied: 0 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 15046 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 50453 bytes
%systemroot%\sysnative\config\systemprofile\AppData\LocalLow\Sun\Java\Deployment folder emptied: 748 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 616.00 mb

[EMPTYJAVA]

User: All Users

User: Default

User: Default User

User: Guest

User: ondrej
->Java cache emptied: 0 bytes

User: Public

Total Java Files Cleaned = 0.00 mb

[EMPTYFLASH]

User: All Users

User: Default
->Flash cache emptied: 0 bytes

User: Default User
->Flash cache emptied: 0 bytes

User: Guest
->Flash cache emptied: 0 bytes

User: ondrej
->Flash cache emptied: 0 bytes

User: Public

Total Flash Files Cleaned = 0.00 mb

OTL by OldTimer - Version 3.2.31.0 log created on 01132012_125519

Files\Folders moved on Reboot...
C:\Users\ondrej\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.

Registry entries deleted on Reboot...

Security Check:

Results of screen317's Security Check version 0.99.24
Windows 7 x64 (UAC is enabled)
Internet Explorer 9
``````````````````````````````
Antivirus/Firewall Check:
Windows Firewall Enabled!
WMI entry may not exist for antivirus; attempting automatic update.
```````````````````````````````
Anti-malware/Other Utilities Check:
Java(TM) 6 Update 26
Out of date Java installed!
Adobe Reader X (10.1.2)
````````````````````````````````
Process Check:
objlist.exe by Laurent
Windows Defender MSMpEng.exe
Microsoft Security Essentials msseces.exe
Microsoft Security Client Antimalware MsMpEng.exe
Microsoft Security Client Antimalware NisSrv.exe
``````````End of Log````````````

FSS:
Farbar Service Scanner
Ran by ondrej (administrator) on 13-01-2012 at 13:11:17
Microsoft Windows 7 Home Premium Service Pack 1 (X64)
Boot Mode: Normal
****************************************************************

Internet Services:
============

Connection Status:
==============
Localhost is accessible.
LAN connected.
Google IP is accessible.
Yahoo IP is accessible.

Windows Firewall:
=============

Firewall Disabled Policy:
==================

System Restore:
============
SDRSVC Service is not running. Checking service configuration:
The start type of SDRSVC service is OK.
The ImagePath of SDRSVC service is OK.
The ServiceDll of SDRSVC service is OK.

VSS Service is not running. Checking service configuration:
The start type of VSS service is OK.
The ImagePath of VSS service is OK.

System Restore Disabled Policy:
========================

Security Center:
============

Windows Update:
===========

File Check:
========
C:\Windows\System32\nsisvc.dll => MD5 is legit
C:\Windows\System32\drivers\nsiproxy.sys => MD5 is legit
C:\Windows\System32\dhcpcore.dll => MD5 is legit
C:\Windows\System32\drivers\afd.sys => MD5 is legit
C:\Windows\System32\drivers\tdx.sys => MD5 is legit
C:\Windows\System32\Drivers\tcpip.sys => MD5 is legit
C:\Windows\System32\dnsrslvr.dll => MD5 is legit
C:\Windows\System32\mpssvc.dll => MD5 is legit
C:\Windows\System32\bfe.dll => MD5 is legit
C:\Windows\System32\drivers\mpsdrv.sys => MD5 is legit
C:\Windows\System32\SDRSVC.dll => MD5 is legit
C:\Windows\System32\vssvc.exe => MD5 is legit
C:\Windows\System32\wscsvc.dll => MD5 is legit
C:\Windows\System32\wbem\WMIsvc.dll => MD5 is legit
C:\Windows\System32\wuaueng.dll => MD5 is legit
C:\Windows\System32\qmgr.dll => MD5 is legit
C:\Windows\System32\es.dll => MD5 is legit
C:\Windows\System32\cryptsvc.dll => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit

**** End of log ****

And ESET's still scannig ... I will post it later

broni · 2012/01/13

Ok...

blacksvk · 2012/01/13

Eset: No threats found

broni · 2012/01/13

1. Update your Java version here: http://www.java.com/en/download/installed.jsp

Note 1: UNCHECK any pre-checked toolbar and/or software offered with the Java update. The pre-checked toolbars/software are not part of the Java update.

Note 2: The Java Quick Starter (JQS.exe) adds a service to improve the initial startup time of Java applets and applications. If you don't want to run another extra service, go to Start > Control Panel > Java > Advanced > Miscellaneous and uncheck the box for Java Quick Starter. Click OK and restart your computer.

2. Now, we need to remove old Java version and its remnants...

Download JavaRa to your desktop and unzip it to its own folder

Run JavaRa.exe (Vista users! Right click on JavaRa.exe, click Run As Administrator), pick the language of your choice and click Select. Then click Remove Older Versions.

Accept any prompts.

Do NOT post JavaRa log.

=========================================================

Your computer is clean

1. We need to reset system restore to prevent your computer from being accidentally reinfected by using some old restore point(s). We'll create fresh, clean restore point, using following OTL script:

Run OTL

Under the Custom Scans/Fixes box at the bottom, paste in the following:
Code:
:OTL
:Commands
[purity]
[emptytemp]
[EMPTYFLASH]
[emptyjava]
[CLEARALLRESTOREPOINTS]
[Reboot]
Then click the Run Fix button at the top

Let the program run unhindered, reboot the PC when it is done

Post resulting log.

2. Now, we'll remove all tools, we used during our cleaning process

Clean up with OTL:

Double-click OTL.exe to start the program.

Close all other programs apart from OTL as this step will require a reboot

On the OTL main screen, press the CLEANUP button

Say Yes to the prompt and then allow the program to reboot your computer.

If you still have any tools or logs leftover on your computer you can go ahead and delete those off of your computer now.

3. Make sure, Windows Updates are current.

4. If any Trojan was listed among your infection(s), make sure, you change all of your on-line important passwords (bank account(s), secured web sites, etc.) immediately!

5. Download, and install WOT (Web OF Trust): http://www.mywot.com/. It'll warn you (in most cases) about dangerous web sites.

6. Run Malwarebytes "Quick scan" once in a while to assure safety of your computer.

7. Run Temporary File Cleaner (TFC) weekly.

8. Download and install Secunia Personal Software Inspector (PSI): http://secunia.com/vulnerability_scanning/personal/. The Secunia PSI is a FREE security tool designed to detect vulnerable and out-dated programs and plug-ins which expose your PC to attacks. Run it weekly.

9. (optional) If you want to keep all your programs up to date, download and install FileHippo Update Checker.
The Update Checker will scan your computer for installed software, check the versions and then send this information to FileHippo.com to see if there are any newer releases.

10. (Windows XP only) Run defrag at your convenience.

11. When installing\updating ANY program, make sure you always select "Custom " installation, so you can UN-check any possible "drive-by-install" (foistware), like toolbars etc., which may try to install along with the legitimate program. Do NOT click "Next" button without looking at any given page.

12. Read How did I get infected?, With steps so it does not happen again!: http://www.bleepingcomputer.com/forums/topic2520.html

13. Please, let me know, how your computer is doing.

blacksvk · 2012/01/13

OTL:
All processes killed
========== OTL ==========
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Guest
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: ondrej
->Temp folder emptied: 7716 bytes
->Temporary Internet Files folder emptied: 3288278 bytes
->Java cache emptied: 2027 bytes
->FireFox cache emptied: 140524658 bytes
->Flash cache emptied: 1844 bytes

User: Public
->Temp folder emptied: 0 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 5104 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 0 bytes
%systemroot%\sysnative\config\systemprofile\AppData\LocalLow\Sun\Java\Deployment folder emptied: 0 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 137,00 mb

[EMPTYFLASH]

User: All Users

User: Default
->Flash cache emptied: 0 bytes

User: Default User
->Flash cache emptied: 0 bytes

User: Guest
->Flash cache emptied: 0 bytes

User: ondrej
->Flash cache emptied: 0 bytes

User: Public

Total Flash Files Cleaned = 0,00 mb

[EMPTYJAVA]

User: All Users

User: Default

User: Default User

User: Guest

User: ondrej
->Java cache emptied: 0 bytes

User: Public

Total Java Files Cleaned = 0,00 mb

Restore point Set: OTL Restore Point

OTL by OldTimer - Version 3.2.31.0 log created on 01132012_182837

Files\Folders moved on Reboot...
C:\Users\ondrej\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.

Registry entries deleted on Reboot...

Thank you for your help

broni · 2012/01/13

13. Please, let me know, how your computer is doing.
Click to expand...

Whenever ready.....

blacksvk · 2012/01/13

PC's running fine. Thank you again. If I will have any problems in the future, I will post it here.

broni · 2012/01/13

Way to go!!
Good luck and stay safe

Log in or Sign up

Solved Random redirection

blacksvk Inactive Thread Starter

broni Moderator Malware Analyst

blacksvk Inactive Thread Starter

broni Moderator Malware Analyst

blacksvk Inactive Thread Starter

blacksvk Inactive Thread Starter

broni Moderator Malware Analyst

blacksvk Inactive Thread Starter

broni Moderator Malware Analyst

blacksvk Inactive Thread Starter

broni Moderator Malware Analyst

blacksvk Inactive Thread Starter

broni Moderator Malware Analyst

blacksvk Inactive Thread Starter

broni Moderator Malware Analyst

blacksvk Inactive Thread Starter

broni Moderator Malware Analyst

Share This Page

Log in or Sign up

Solved Random redirection

blacksvk Inactive Thread Starter

broni Moderator Malware Analyst

blacksvk Inactive Thread Starter

broni Moderator Malware Analyst

blacksvk Inactive Thread Starter

blacksvk Inactive Thread Starter

broni Moderator Malware Analyst

blacksvk Inactive Thread Starter

broni Moderator Malware Analyst

blacksvk Inactive Thread Starter

broni Moderator Malware Analyst

blacksvk Inactive Thread Starter

broni Moderator Malware Analyst

blacksvk Inactive Thread Starter

broni Moderator Malware Analyst

blacksvk Inactive Thread Starter

broni Moderator Malware Analyst

Share This Page

Useful Searches