Google Search Results Redirecting to Ads

Soo…Lately I've noticed two things. First, google redirects some links to unusual ads as described by some other threads. Second, I noticed that I had two instances of dwm.exe in my processes. Spybot S&D detected that it was linked to some sort of Win32 Palevo trojan. I'd like to know how to resolved these issues and would like to know if they are somehow related to one another.

I took the steps to post my OTL:


OTL logfile created on: 7/20/2011 4:57:39 PM - Run 1
OTL by OldTimer - Version 3.2.26.1 Folder = C:\Users\dreidrei\Desktop
An unknown product (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.98 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 67.08% Memory free
5.96 Gb Paging File | 4.87 Gb Available in Paging File | 81.71% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 69.24 Gb Total Space | 4.97 Gb Free Space | 7.17% Space Free | Partition Type: NTFS
Drive E: | 232.88 Gb Total Space | 51.31 Gb Free Space | 22.03% Space Free | Partition Type: NTFS

Computer Name: MILKYWAY | User Name: Andrei | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Users\dreidrei\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Users\dreidrei\AppData\Roaming\dwm.exe ()
PRC - C:\Users\dreidrei\AppData\Local\Temp\csrss.exe ()
PRC - C:\Users\dreidrei\AppData\Roaming\Microsoft\conhost.exe ()
PRC - C:\Program Files\IObit\Advanced SystemCare 4\ASCService.exe (IObit)
PRC - C:\Program Files\AVG\AVG9\avgtray.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG9\avgcsrvx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG9\avgnsx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG9\avgemc.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG9\avgrsx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG9\avgwdsvc.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG9\avgchsvx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\IObit\IObit Security 360\is360tray.exe (IObit)
PRC - C:\Program Files\IObit\IObit Security 360\is360srv.exe (IObit)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - C:\Windows\System32\taskhost.exe (Microsoft Corporation)
PRC - C:\Windows\System32\audiodg.exe (Microsoft Corporation)
PRC - C:\Program Files\IDT\WDM\sttray.exe (IDT, Inc.)
PRC - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe (Safer Networking Ltd.)


========== Modules (SafeList) ==========

MOD - C:\Users\dreidrei\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16661_none_420fe3fa2b8113bd\comctl32.dll (Microsoft Corporation)
MOD - C:\Windows\System32\avgrsstx.dll (AVG Technologies CZ, s.r.o.)


========== Win32 Services (SafeList) ==========

SRV - (WatAdminSvc) – C:\Windows\System32\Wat\WatAdminSvc.exe (Microsoft Corporation)
SRV - (Akamai) – c:\Program Files\Common Files\Akamai\netsession_win_e477fed.dll ()
SRV - (Steam Client Service) – C:\Program Files\Common Files\Steam\SteamService.exe (Valve Corporation)
SRV - (AdvancedSystemCareService) – C:\Program Files\IObit\Advanced SystemCare 4\ASCService.exe (IObit)
SRV - (AVG Security Toolbar Service) – C:\Program Files\AVG\AVG9\Toolbar\ToolbarBroker.exe ()
SRV - (nosGetPlusHelper) getPlus® – C:\Program Files\NOS\bin\getPlus_Helper_3004.dll (NOS Microsystems Ltd.)
SRV - (avg9emc) – C:\Program Files\AVG\AVG9\avgemc.exe (AVG Technologies CZ, s.r.o.)
SRV - (avg9wd) – C:\Program Files\AVG\AVG9\avgwdsvc.exe (AVG Technologies CZ, s.r.o.)
SRV - (IS360service) – C:\Program Files\IObit\IObit Security 360\is360srv.exe (IObit)
SRV - (npggsvc) – C:\Windows\System32\GameMon.des (INCA Internet Co., Ltd.)
SRV - (StorSvc) – C:\Windows\System32\StorSvc.dll (Microsoft Corporation)
SRV - (SensrSvc) – C:\Windows\System32\sensrsvc.dll (Microsoft Corporation)
SRV - (PeerDistSvc) – C:\Windows\System32\PeerDistSvc.dll (Microsoft Corporation)
SRV - (WinDefend) – C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (SBSDWSCService) – C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe (Safer Networking Ltd.)


========== Driver Services (SafeList) ==========

DRV - (AvgTdiX) – C:\Windows\System32\Drivers\avgtdix.sys (AVG Technologies CZ, s.r.o.)
DRV - (PnkBstrK) – C:\Windows\System32\drivers\PnkBstrK.sys ()
DRV - (AvgLdx86) – C:\Windows\System32\Drivers\avgldx86.sys (AVG Technologies CZ, s.r.o.)
DRV - (nvlddmkm) – C:\Windows\System32\drivers\nvlddmkm.sys (NVIDIA Corporation)
DRV - (AvgMfx86) – C:\Windows\System32\Drivers\avgmfx86.sys (AVG Technologies CZ, s.r.o.)
DRV - (vmbus) – C:\Windows\system32\DRIVERS\vmbus.sys (Microsoft Corporation)
DRV - (storflt) – C:\Windows\system32\DRIVERS\vmstorfl.sys (Microsoft Corporation)
DRV - (storvsc) – C:\Windows\system32\DRIVERS\storvsc.sys (Microsoft Corporation)
DRV - (WinUsb) – C:\Windows\System32\drivers\winusb.sys (Microsoft Corporation)
DRV - (s3cap) – C:\Windows\system32\DRIVERS\vms3cap.sys (Microsoft Corporation)
DRV - (VMBusHID) – C:\Windows\system32\DRIVERS\VMBusHID.sys (Microsoft Corporation)
DRV - (e1express) Intel® – C:\Windows\System32\drivers\e1e6032.sys (Intel Corporation)
DRV - (hamachi) – C:\Windows\System32\drivers\hamachi.sys (LogMeIn, Inc.)
DRV - (STHDA) – C:\Windows\System32\drivers\stwrt.sys (IDT, Inc.)
DRV - (ATITool) – C:\Windows\System32\drivers\ATITool.sys ()


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========



IE - HKU\.DEFAULT\..\URLSearchHook: {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG9\Toolbar\IEToolbar.dll ()
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\..\URLSearchHook: {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG9\Toolbar\IEToolbar.dll ()
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0



IE - HKU\S-1-5-21-2889066225-3816148123-2408682452-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar =
IE - HKU\S-1-5-21-2889066225-3816148123-2408682452-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page =
IE - HKU\S-1-5-21-2889066225-3816148123-2408682452-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.youtube.com/
IE - HKU\S-1-5-21-2889066225-3816148123-2408682452-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://www.msn.com/
IE - HKU\S-1-5-21-2889066225-3816148123-2408682452-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-us
IE - HKU\S-1-5-21-2889066225-3816148123-2408682452-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 66 3F 4F 65 3B 72 CA 01 [binary data]
IE - HKU\S-1-5-21-2889066225-3816148123-2408682452-1000\..\URLSearchHook: {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG9\Toolbar\IEToolbar.dll ()
IE - HKU\S-1-5-21-2889066225-3816148123-2408682452-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-2889066225-3816148123-2408682452-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

IE - HKU\S-1-5-21-2889066225-3816148123-2408682452-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar =
IE - HKU\S-1-5-21-2889066225-3816148123-2408682452-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.youtube.com/
IE - HKU\S-1-5-21-2889066225-3816148123-2408682452-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://www.msn.com/
IE - HKU\S-1-5-21-2889066225-3816148123-2408682452-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-us
IE - HKU\S-1-5-21-2889066225-3816148123-2408682452-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 8D 5F C9 55 05 FA CA 01 [binary data]
IE - HKU\S-1-5-21-2889066225-3816148123-2408682452-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 1
IE - HKU\S-1-5-21-2889066225-3816148123-2408682452-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
IE - HKU\S-1-5-21-2889066225-3816148123-2408682452-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:63798

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "AVG Secure Search"
FF - prefs.js..browser.search.selectedEngine: "AVG Secure Search"
FF - prefs.js..extensions.enabledItems: avg@igeared:6.103.018.001
FF - prefs.js..extensions.enabledItems: {ACAA314B-EEBA-48e4-AD47-84E31C44796C}:1.0.1
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: {635abd67-4fe9-1b23-4f01-e679fa7484c1}:1.6.6.20090220
FF - prefs.js..keyword.URL: "http://search.avg.com/route/?d=4b14a11e&v=6.103.018.001&i=23&tp=ab&iy=b&ychte=us&lng=en-US&q="


FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\4.0.51204.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll File not found
FF - HKLM\Software\MozillaPlugins\@nexon.net/NxGame: C:\ProgramData\NexonUS\NGM\npNxGameUS.dll File not found
FF - HKLM\Software\MozillaPlugins\@ogplanet.com/npOGPPlugin: C:\Windows\system32\npOGPPlugin.dll (OGPlanet)
FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF - HKCU\Software\MozillaPlugins\pandonetworks.com/PandoWebPlugin: C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\avg@igeared: C:\Program Files\AVG\AVG9\Toolbar\Firefox\avg@igeared [2011/05/09 15:31:13 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.5.5\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/12/29 15:21:44 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.5.5\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/12/29 15:21:44 | 000,000,000 | —D | M]

[2009/11/30 23:12:07 | 000,000,000 | —D | M] (No name found) – C:\Users\Andrei\AppData\Roaming\Mozilla\Extensions
[2011/02/19 13:34:56 | 000,000,000 | —D | M] (No name found) – C:\Users\Andrei\AppData\Roaming\Mozilla\Firefox\Profiles\lvfa1lpa.default\extensions
[2010/05/05 22:46:19 | 000,000,000 | —D | M] (Yahoo! Toolbar) – C:\Users\Andrei\AppData\Roaming\Mozilla\Firefox\Profiles\lvfa1lpa.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
[2011/02/07 20:05:08 | 000,000,000 | —D | M] ("DVDVideoSoft Menu") – C:\Users\Andrei\AppData\Roaming\Mozilla\Firefox\Profiles\lvfa1lpa.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}
[2011/02/19 13:34:56 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\extensions
[2010/06/06 20:43:26 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
[2011/05/09 15:31:13 | 000,000,000 | —D | M] ("urn:mozilla:install-manifest" em:id="avg@igeared" em:name="AVG Security Toolbar" em:version="6.103.018.001" em:displayname="AVG Security Toolbar" em:iconURL="chrome://tavgp/skin/logo.ico" em:creator="AVG Technologies" em:description="AVG Security Toolbar" em:homepageURL="http://www.avg.com" >) – C:\PROGRAM FILES\AVG\AVG9\TOOLBAR\FIREFOX\AVG@IGEARED
[2010/06/06 20:43:08 | 000,411,368 | —- | M] (Sun Microsystems, Inc.) – C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll

O1 HOSTS File: ([2009/11/30 20:43:49 | 000,000,921 | —- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 genuine.microsoft.com
O1 - Hosts: 127.0.0.1 mpa.one.microsoft.com
O1 - Hosts: 127.0.0.1 sls.microsoft.com
O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG9\avgssie.dll (AVG Technologies CZ, s.r.o.)
O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (AVG Security Toolbar BHO) - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG9\Toolbar\IEToolbar.dll ()
O3 - HKLM\..\Toolbar: (AVG Security Toolbar) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Program Files\AVG\AVG9\Toolbar\IEToolbar.dll ()
O3 - HKU\.DEFAULT\..\Toolbar\WebBrowser: (AVG Security Toolbar) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Program Files\AVG\AVG9\Toolbar\IEToolbar.dll ()
O3 - HKU\S-1-5-18\..\Toolbar\WebBrowser: (AVG Security Toolbar) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Program Files\AVG\AVG9\Toolbar\IEToolbar.dll ()
O3 - HKU\S-1-5-21-2889066225-3816148123-2408682452-1000\..\Toolbar\WebBrowser: (AVG Security Toolbar) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Program Files\AVG\AVG9\Toolbar\IEToolbar.dll ()
O3 - HKU\S-1-5-21-2889066225-3816148123-2408682452-1003\..\Toolbar\WebBrowser: (AVG Security Toolbar) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Program Files\AVG\AVG9\Toolbar\IEToolbar.dll ()
O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Program Files\Adobe\Reader 10.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [AVG9_TRAY] C:\Program Files\AVG\AVG9\avgtray.exe (AVG Technologies CZ, s.r.o.)
O4 - HKLM..\Run: [IObit Security 360] C:\Program Files\IObit\IObit Security 360\IS360tray.exe (IObit)
O4 - HKLM..\Run: [SysTrayApp] C:\Program Files\IDT\WDM\sttray.exe (IDT, Inc.)
O4 - HKU\S-1-5-19..\Run: [Sidebar] File not found
O4 - HKU\S-1-5-20..\Run: [Sidebar] File not found
O4 - HKU\S-1-5-21-2889066225-3816148123-2408682452-1000..\Run: [Advanced SystemCare 4] C:\Program Files\IObit\Advanced SystemCare 4\ASCTray.exe (IObit)
O4 - HKU\S-1-5-21-2889066225-3816148123-2408682452-1000..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.)
O4 - HKU\S-1-5-21-2889066225-3816148123-2408682452-1003..\Run: [conhost] C:\Users\dreidrei\AppData\Roaming\Microsoft\conhost.exe ()
O4 - HKU\S-1-5-21-2889066225-3816148123-2408682452-1003..\Run: [EA Core] File not found
O4 - HKLM..\RunOnce: [*Restore] C:\Windows\System32\rstrui.exe (Microsoft Corporation)
O4 - HKLM..\RunOnce: [DeleteDir[48E] WIPE_48E.TMP] File not found
O4 - HKLM..\RunOnce: [GrpConv] C:\Windows\System32\grpconv.exe (Microsoft Corporation)
O4 - HKLM..\RunOnce: [InstallShieldSetup] C:\Program Files\InstallShield Installation Information\{E3A5A8AB-58F6-45FF-AFCB-C9AE18C05001}\setup.exe (InstallShield Software Corporation)
O4 - HKLM..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKLM..\RunOnce: [Spybot - Search & Destroy] C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe (Safer Networking Limited)
O4 - HKLM..\RunOnce: [Uninstall Adobe Download Manager] C:\Program Files\NOS\bin\getPlusUninst_Adobe.exe (NOS Microsystems Ltd.)
O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (Microsoft Corporation)
O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (Microsoft Corporation)
O4 - HKU\S-1-5-21-2889066225-3816148123-2408682452-1000..\RunOnce: [avg_spchecker] C:\Program Files\AVG\AVG9\Notification\SPChecker1.exe ()
O4 - HKU\S-1-5-21-2889066225-3816148123-2408682452-1000..\RunOnce: [FlashPlayerUpdate] C:\Windows\System32\Macromed\Flash\FlashUtil10q_Plugin.exe (Adobe Systems, Inc.)
F3 - HKU\S-1-5-21-2889066225-3816148123-2408682452-1003 WinNT: Load - (C:\Users\dreidrei\AppData\Local\Temp\csrss.exe) - C:\Users\dreidrei\AppData\Local\Temp\csrss.exe ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\Andrei\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()
O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_20)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O18 - Protocol\Handler\avgsecuritytoolbar {F2DDE6B2-9684-4A55-86D4-E255E237B77C} - C:\Program Files\AVG\AVG9\Toolbar\IEToolbar.dll ()
O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG9\avgpp.dll (AVG Technologies CZ, s.r.o.)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O20 - AppInit_DLLs: (avgrsstx.dll) - C:\Windows\System32\avgrsstx.dll (AVG Technologies CZ, s.r.o.)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20 - HKU\S-1-5-21-2889066225-3816148123-2408682452-1003 Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKU\S-1-5-21-2889066225-3816148123-2408682452-1003 Winlogon: Shell - (C:\Users\dreidrei\AppData\Roaming\dwm.exe) - C:\Users\dreidrei\AppData\Roaming\dwm.exe ()
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/06/10 14:42:20 | 000,000,024 | —- | M] () - C:\autoexec.bat – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

NetSvcs: FastUserSwitchingCompatibility - File not found
NetSvcs: Ias - File not found
NetSvcs: Nla - File not found
NetSvcs: Ntmssvc - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: SRService - File not found
NetSvcs: WmdmPmSp - File not found
NetSvcs: LogonHours - File not found
NetSvcs: PCAudit - File not found
NetSvcs: helpsvc - File not found
NetSvcs: uploadmgr - File not found

Drivers32: msacm.bdmpeg - C:\Windows\System32\bdmpega.acm ()
Drivers32: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: vidc.cvid - C:\Windows\System32\iccvid.dll (Radius Inc.)
Drivers32: VIDC.FPS1 - C:\Windows\System32\frapsvid.dll (Beepa P/L)
Drivers32: vidc.mpeg - C:\Windows\System32\bdmpegv.dll ()

CREATERESTOREPOINT
Restore point Set: OTL Restore Point

========== Files/Folders - Created Within 30 Days ==========

[2011/07/20 16:43:13 | 000,000,000 | —D | C] – C:\Users\Andrei\AppData\Roaming\Malwarebytes
[2011/07/20 16:43:05 | 000,041,272 | —- | C] (Malwarebytes Corporation) – C:\Windows\System32\drivers\mbamswissarmy.sys
[2011/07/20 16:43:05 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2011/07/20 16:43:05 | 000,000,000 | —D | C] – C:\ProgramData\Malwarebytes
[2011/07/20 16:43:02 | 000,022,712 | —- | C] (Malwarebytes Corporation) – C:\Windows\System32\drivers\mbam.sys
[2011/07/20 16:43:02 | 000,000,000 | —D | C] – C:\Program Files\Malwarebytes' Anti-Malware
[2011/07/20 14:50:23 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy
[2011/07/20 14:50:15 | 000,000,000 | —D | C] – C:\Program Files\Spybot - Search & Destroy
[2011/07/20 12:54:48 | 000,000,000 | —D | C] – C:\Windows\System32\Wat
[2011/07/20 12:11:25 | 000,000,000 | -HSD | C] – C:\Config.Msi
[2011/07/20 12:06:44 | 000,000,000 | —D | C] – C:\Users\Andrei\Documents\Visual Studio 2008
[2011/07/15 18:35:02 | 000,000,000 | —D | C] – C:\Program Files\Capsule
[2011/07/08 20:49:02 | 000,000,000 | —D | C] – C:\Users\Andrei\AppData\Local\Green Man Gaming
[2011/07/08 20:48:56 | 000,000,000 | —D | C] – C:\Users\Andrei\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Capsule Utilities
[2011/07/05 16:14:16 | 000,000,000 | —D | C] – C:\Users\Andrei\Documents\SavedGames
[2011/06/30 20:22:51 | 000,000,000 | —D | C] – C:\Program Files\Apple Software Update
[2011/06/30 20:22:24 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
[2011/06/30 20:21:56 | 000,000,000 | —D | C] – C:\Program Files\iPod
[2011/06/30 20:21:55 | 000,000,000 | —D | C] – C:\Program Files\iTunes
[2011/06/30 20:19:43 | 000,000,000 | —D | C] – C:\Program Files\Bonjour
[2011/06/26 12:27:57 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google SketchUp 8
[2011/06/23 14:42:02 | 000,000,000 | —D | C] – C:\Users\Andrei\Documents\LOLReplay
[2011/06/23 14:42:02 | 000,000,000 | —D | C] – C:\Program Files\LOLReplay
[2 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
[2 C:\*.tmp files -> C:\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2011/07/20 16:43:06 | 000,001,071 | —- | M] () – C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2011/07/20 16:23:00 | 000,000,920 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2889066225-3816148123-2408682452-1003UA.job
[2011/07/20 15:51:44 | 000,009,600 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2011/07/20 15:51:44 | 000,009,600 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2011/07/20 15:49:17 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2011/07/20 15:49:12 | 2401,697,792 | -HS- | M] () – C:\hiberfil.sys
[2011/07/20 14:50:24 | 000,001,244 | —- | M] () – C:\Users\Andrei\Application Data\Microsoft\Internet Explorer\Quick Launch\Spybot - Search & Destroy.lnk
[2011/07/20 14:50:24 | 000,001,220 | —- | M] () – C:\Users\Andrei\Desktop\Spybot - Search & Destroy.lnk
[2011/07/20 12:56:48 | 000,285,968 | —- | M] () – C:\Windows\System32\FNTCACHE.DAT
[2011/07/20 12:11:40 | 000,668,348 | —- | M] () – C:\Windows\System32\perfh009.dat
[2011/07/20 12:11:40 | 000,124,534 | —- | M] () – C:\Windows\System32\perfc009.dat
[2011/07/20 11:35:38 | 080,198,283 | —- | M] () – C:\Windows\System32\drivers\Avg\incavi.avm
[2011/07/19 19:23:00 | 000,000,868 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2889066225-3816148123-2408682452-1003Core.job
[2011/07/15 18:36:57 | 000,001,043 | —- | M] () – C:\Users\Andrei\Desktop\Capsule.lnk
[2011/07/06 19:52:42 | 000,041,272 | —- | M] (Malwarebytes Corporation) – C:\Windows\System32\drivers\mbamswissarmy.sys
[2011/07/06 19:52:42 | 000,022,712 | —- | M] (Malwarebytes Corporation) – C:\Windows\System32\drivers\mbam.sys
[2011/06/30 20:22:24 | 000,001,753 | —- | M] () – C:\Users\Public\Desktop\iTunes.lnk
[2011/06/26 12:27:57 | 000,001,995 | —- | M] () – C:\Users\Public\Desktop\Google SketchUp 8.lnk
[2011/06/23 14:42:02 | 000,001,851 | —- | M] () – C:\Users\Andrei\Desktop\LOL Recorder.lnk
[2 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
[2 C:\*.tmp files -> C:\*.tmp -> ]

========== Files Created - No Company Name ==========

[2011/07/20 16:43:06 | 000,001,071 | —- | C] () – C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2011/07/20 14:50:24 | 000,001,244 | —- | C] () – C:\Users\Andrei\Application Data\Microsoft\Internet Explorer\Quick Launch\Spybot - Search & Destroy.lnk
[2011/07/20 14:50:24 | 000,001,220 | —- | C] () – C:\Users\Andrei\Desktop\Spybot - Search & Destroy.lnk
[2011/07/08 20:48:56 | 000,001,155 | —- | C] () – C:\Users\Andrei\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Capsule.lnk
[2011/07/08 20:48:56 | 000,001,043 | —- | C] () – C:\Users\Andrei\Desktop\Capsule.lnk
[2011/06/30 20:22:24 | 000,001,753 | —- | C] () – C:\Users\Public\Desktop\iTunes.lnk
[2011/06/26 12:27:57 | 000,001,995 | —- | C] () – C:\Users\Public\Desktop\Google SketchUp 8.lnk
[2011/06/23 19:18:22 | 000,000,920 | —- | C] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2889066225-3816148123-2408682452-1003UA.job
[2011/06/23 19:18:20 | 000,000,868 | —- | C] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2889066225-3816148123-2408682452-1003Core.job
[2011/06/23 14:42:03 | 000,001,863 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LOL Recorder.lnk
[2011/06/23 14:42:02 | 000,001,851 | —- | C] () – C:\Users\Andrei\Desktop\LOL Recorder.lnk
[2011/06/14 16:31:52 | 000,015,360 | —- | C] () – C:\Windows\wpktui10.exe
[2011/05/22 08:24:57 | 000,056,320 | —- | C] () – C:\Windows\System32\iyvu9_32.dll
[2011/05/22 08:17:45 | 000,000,299 | —- | C] () – C:\Windows\EReg515.dat
[2011/05/22 08:17:19 | 000,010,240 | —- | C] () – C:\Windows\System32\vidx16.dll
[2011/05/22 08:16:48 | 000,000,763 | —- | C] () – C:\Windows\disney.ini
[2011/04/22 20:18:26 | 000,000,032 | R— | C] () – C:\ProgramData\hash.dat
[2011/03/13 21:11:00 | 000,139,128 | —- | C] () – C:\Windows\System32\drivers\PnkBstrK.sys
[2011/03/13 21:10:28 | 000,215,128 | —- | C] () – C:\Windows\System32\PnkBstrB.exe
[2010/07/14 19:37:05 | 000,000,094 | —- | C] () – C:\Users\Andrei\AppData\Local\fusioncache.dat
[2010/05/29 16:27:04 | 002,434,856 | —- | C] () – C:\Windows\System32\pbsvc_bc2.exe
[2010/05/11 15:38:42 | 000,000,056 | -H– | C] () – C:\ProgramData\ezsidmv.dat
[2010/03/15 17:55:27 | 000,007,606 | —- | C] () – C:\Users\Andrei\AppData\Local\Resmon.ResmonCfg
[2010/03/11 20:34:41 | 000,138,056 | —- | C] () – C:\Users\Andrei\AppData\Roaming\PnkBstrK.sys
[2010/03/11 20:34:07 | 002,407,792 | —- | C] () – C:\Windows\System32\pbsvc_heroes.exe
[2010/03/11 20:34:07 | 000,075,064 | —- | C] () – C:\Windows\System32\PnkBstrA.exe
[2009/11/30 22:05:30 | 000,000,262 | —- | C] () – C:\Windows\{789289CA-F73A-4A16-A331-54D498CE069F}_WiseFW.ini
[2009/07/13 21:57:37 | 000,067,584 | –S- | C] () – C:\Windows\bootstat.dat
[2009/07/13 21:33:53 | 000,285,968 | —- | C] () – C:\Windows\System32\FNTCACHE.DAT
[2009/07/13 19:05:48 | 000,668,348 | —- | C] () – C:\Windows\System32\perfh009.dat
[2009/07/13 19:05:48 | 000,291,294 | —- | C] () – C:\Windows\System32\perfi009.dat
[2009/07/13 19:05:48 | 000,124,534 | —- | C] () – C:\Windows\System32\perfc009.dat
[2009/07/13 19:05:48 | 000,031,548 | —- | C] () – C:\Windows\System32\perfd009.dat
[2009/07/13 19:05:05 | 000,000,741 | —- | C] () – C:\Windows\System32\NOISE.DAT
[2009/07/13 19:04:11 | 000,215,943 | —- | C] () – C:\Windows\System32\dssec.dat
[2009/07/13 17:19:49 | 000,066,048 | —- | C] () – C:\Windows\System32\PrintBrmUi.exe
[2009/07/13 16:55:01 | 000,043,131 | —- | C] () – C:\Windows\mib.bin
[2009/07/13 16:51:43 | 000,073,728 | —- | C] () – C:\Windows\System32\BthpanContextHandler.dll
[2009/07/13 16:42:10 | 000,064,000 | —- | C] () – C:\Windows\System32\BWContextHandler.dll
[2009/07/13 16:41:47 | 000,001,536 | —- | C] () – C:\Windows\System32\winver.exe
[2009/07/08 18:03:02 | 000,058,880 | —- | C] () – C:\Windows\System32\bdmpegv.dll
[2009/06/10 14:26:10 | 000,673,088 | —- | C] () – C:\Windows\System32\mlang.dat
[2006/11/10 06:08:50 | 000,024,064 | —- | C] () – C:\Windows\System32\drivers\ATITool.sys

========== Custom Scans ==========


< %SYSTEMDRIVE%\*.* >
[2009/06/10 14:42:20 | 000,000,024 | —- | M] () – C:\autoexec.bat
[2009/07/13 18:38:58 | 000,383,562 | RHS- | M] () – C:\bootmgr
[2009/11/30 18:43:28 | 000,008,192 | RHS- | M] () – C:\BOOTSECT.BAK
[2009/06/10 14:42:20 | 000,000,010 | —- | M] () – C:\config.sys
[2011/07/20 15:49:12 | 2401,697,792 | -HS- | M] () – C:\hiberfil.sys
[2007/02/08 20:53:03 | 000,000,183 | —- | M] () – C:\IMO.log
[2007/03/09 22:21:16 | 000,000,000 | RHS- | M] () – C:\IO.SYS
[2007/07/29 00:17:55 | 000,000,972 | -H– | M] () – C:\IPH.PH
[2007/03/09 22:21:16 | 000,000,000 | RHS- | M] () – C:\MSDOS.SYS
[2007/02/08 20:56:08 | 000,262,144 | —- | M] () – C:\ntuser.dat
[2007/02/08 20:56:08 | 000,005,120 | -H– | M] () – C:\ntuser.dat.LOG1
[2007/02/08 20:52:29 | 000,000,000 | -H– | M] () – C:\ntuser.dat.LOG2
[2007/02/08 20:52:30 | 000,065,536 | -HS- | M] () – C:\ntuser.dat{9d07b125-b7ee-11db-b493-0019d11cd733}.TM.blf
[2007/02/08 20:52:30 | 000,524,288 | -HS- | M] () – C:\ntuser.dat{9d07b125-b7ee-11db-b493-0019d11cd733}.TMContainer00000000000000000001.regtrans-ms
[2007/02/08 20:52:30 | 000,524,288 | -HS- | M] () – C:\ntuser.dat{9d07b125-b7ee-11db-b493-0019d11cd733}.TMContainer00000000000000000002.regtrans-ms
[2007/02/08 20:52:30 | 000,065,536 | -HS- | M] () – C:\ntuser.dat{9d07b12a-b7ee-11db-b493-0019d11cd733}.TM.blf
[2007/02/08 20:52:30 | 000,524,288 | -HS- | M] () – C:\ntuser.dat{9d07b12a-b7ee-11db-b493-0019d11cd733}.TMContainer00000000000000000001.regtrans-ms
[2007/02/08 20:52:30 | 000,524,288 | -HS- | M] () – C:\ntuser.dat{9d07b12a-b7ee-11db-b493-0019d11cd733}.TMContainer00000000000000000002.regtrans-ms
[2011/07/20 15:49:14 | 3202,265,088 | -HS- | M] () – C:\pagefile.sys
[2010/11/27 22:11:01 | 000,094,837 | —- | M] () – C:\ReactorException.dmp
[2010/11/27 22:11:02 | 000,004,054 | —- | M] () – C:\ReactorException.log
[2007/02/08 23:19:03 | 000,000,087 | —- | M] () – C:\uleadpdv.log
[2007/02/08 23:16:26 | 000,000,087 | —- | M] () – C:\uleadvs.log
[2007/02/08 20:56:26 | 000,000,163 | —- | M] () – C:\WinDVD.log
[2 C:\*.tmp files -> C:\*.tmp -> ]

< %systemroot%\Fonts\*.com >
[2009/07/13 21:52:25 | 000,026,040 | —- | M] () – C:\Windows\Fonts\GlobalMonospace.CompositeFont
[2009/07/13 21:52:25 | 000,026,489 | —- | M] () – C:\Windows\Fonts\GlobalSansSerif.CompositeFont
[2009/07/13 21:52:25 | 000,029,779 | —- | M] () – C:\Windows\Fonts\GlobalSerif.CompositeFont
[2009/07/13 21:52:25 | 000,043,318 | —- | M] () – C:\Windows\Fonts\GlobalUserInterface.CompositeFont

< %systemroot%\Fonts\*.dll >

< %systemroot%\Fonts\*.ini >
[2009/06/10 14:31:19 | 000,000,065 | —- | M] () – C:\Windows\Fonts\desktop.ini

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\Fonts\*.exe >

< %systemroot%\system32\spool\prtprocs\w32x86\*.* >
[2009/07/13 18:15:35 | 000,022,528 | —- | M] (Microsoft Corporation) – C:\Windows\system32\spool\prtprocs\w32x86\jnwppr.dll
[2009/07/13 18:16:19 | 000,029,696 | —- | M] (Microsoft Corporation) – C:\Windows\system32\spool\prtprocs\w32x86\winprint.dll

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.jpg >

< %systemroot%\*.jpg >

< %systemroot%\*.png >

< %systemroot%\*.scr >

< %systemroot%\*._sy >

< %APPDATA%\Adobe\Update\*.* >

< %ALLUSERSPROFILE%\Favorites\*.* >

< %APPDATA%\Microsoft\*.* >

< %PROGRAMFILES%\*.* >
[2009/07/13 21:41:57 | 000,000,174 | -HS- | M] () – C:\Program Files\desktop.ini

< %APPDATA%\Update\*.* >

< %systemroot%\*. /mp /s >

< %systemroot%\System32\config\*.sav >

< %PROGRAMFILES%\bak. /s >

< %systemroot%\system32\bak. /s >

< %ALLUSERSPROFILE%\Start Menu\*.lnk /x >

< %systemroot%\system32\config\systemprofile\*.dat /x >

< %systemroot%\*.config >

< %systemroot%\system32\*.db >

< %PROGRAMFILES%\Internet Explorer\*.dat >

< %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
[2009/11/30 21:02:37 | 000,000,221 | -HS- | M] () – C:\Users\Andrei\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini

< %USERPROFILE%\Desktop\*.exe >

< %PROGRAMFILES%\Common Files\*.* >

< %systemroot%\*.src >

< %systemroot%\install\*.* >

< %systemroot%\system32\DLL\*.* >

< %systemroot%\system32\HelpFiles\*.* >

< %systemroot%\system32\rundll\*.* >

< %systemroot%\winn32\*.* >

< %systemroot%\Java\*.* >

< %systemroot%\system32\test\*.* >

< %systemroot%\system32\Rundll32\*.* >

< %systemroot%\AppPatch\Custom\*.* >

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2010-04-14 10:01:09

< End of report >



OTL Extras logfile created on: 7/20/2011 4:57:39 PM - Run 1
OTL by OldTimer - Version 3.2.26.1 Folder = C:\Users\dreidrei\Desktop
An unknown product (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.98 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 67.08% Memory free
5.96 Gb Paging File | 4.87 Gb Available in Paging File | 81.71% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 69.24 Gb Total Space | 4.97 Gb Free Space | 7.17% Space Free | Partition Type: NTFS
Drive E: | 232.88 Gb Total Space | 51.31 Gb Free Space | 22.03% Space Free | Partition Type: NTFS

Computer Name: MILKYWAY | User Name: Andrei | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.cpl [@ = cplfile] – C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] – C:\Windows\winhlp32.exe (Microsoft Corporation)

[HKEY_USERS\S-1-5-21-2889066225-3816148123-2408682452-1000\SOFTWARE\Classes\]
.html [@ = FirefoxHTML] – C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

[HKEY_USERS\S-1-5-21-2889066225-3816148123-2408682452-1003\SOFTWARE\Classes\]
.html [@ = FirefoxHTML] – C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
cplfile [cplopen] – %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] – "%1" %*
helpfile [open] – Reg Error: Key error.
hlpfile [open] – %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
inffile [install] – %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] – cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] – Reg Error: Value error.
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = Reg Error: Unknown registry data type – File not found
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

========== Authorized Applications List ==========


========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{044F9133-B8D7-4d11-BF39-803FA20F5C8B}" = Microsoft Windows SDK for Visual Studio 2008 SP1 Express Tools for Win32
"{048298C9-A4D3-490B-9FF9-AB023A9238F3}" = Steam
"{0A0CADCF-78DA-33C4-A350-CD51849B9702}" = Microsoft .NET Framework 4 Extended
"{196BB40D-1578-3D01-B289-BEFC77A11A1E}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.30319
"{19BFDA5D-1FE2-4F25-97F9-1A79DD04EE20}" = Microsoft XNA Framework Redistributable 3.1
"{26A24AE4-039D-4CA4-87B4-2F83216020FF}" = Java™ 6 Update 20
"{2BFC7AA0-544C-4E3A-8796-67F3BE655BE9}" = Microsoft XNA Framework Redistributable 4.0
"{342D4AD7-EC4C-4EC8-AEA6-E70F5905A490}" = SQL Server System CLR Types
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{3C3D696B-0DB7-3C6D-A356-3DB8CE541918}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729
"{3D3E663D-4E7E-4577-A560-7ECDDD45548A}" = PVSonyDll
"{41785C66-90F2-40CE-8CB5-1C94BFC97280}" = Microsoft Chart Controls for Microsoft .NET Framework 3.5
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{57752979-A1C9-4C02-856B-FBB27AC4E02C}" = QuickTime
"{5BE1E709-30E4-3D6D-A708-96CE8D5E5E8D}" = Microsoft Windows SDK for Visual Studio 2008 SP1 Express Tools for .NET Framework - enu
"{5BFB956C-3AB9-492A-9E91-5D8C87DCC598}" = Paint.NET v3.5.1
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{789289CA-F73A-4A16-A331-54D498CE069F}" = Ventrilo Client
"{7E6066E6-8B5B-4100-B0FA-1D9E9B663CBA}" = iTunes
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{842FAF7C-50EF-4463-9B8F-6222E1384D7D}" = Microsoft Windows SDK for Visual Studio 2008 Headers and Libraries
"{868EC22E-7E82-4760-9265-3F2E705BF24B}" = League of Legends
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{90120000-0015-0409-0000-0000000FF1CE}" = Microsoft Office Access MUI (English) 2007
"{90120000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2007
"{90120000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2007
"{90120000-0019-0409-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (English) 2007
"{90120000-001A-0409-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (English) 2007
"{90120000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2007
"{90120000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2007
"{90120000-0030-0000-0000-0000000FF1CE}" = Microsoft Office Enterprise 2007
"{90120000-0044-0409-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2007
"{90120000-00A1-0409-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (English) 2007
"{90120000-00BA-0409-0000-0000000FF1CE}" = Microsoft Office Groove MUI (English) 2007
"{90120000-0114-0409-0000-0000000FF1CE}" = Microsoft Office Groove Setup Metadata MUI (English) 2007
"{90120000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2007
"{90120000-0117-0409-0000-0000000FF1CE}" = Microsoft Office Access Setup Metadata MUI (English) 2007
"{92606477-9366-4D3B-8AE3-6BE4B29727AB}" = League of Legends
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{980A182F-E0A2-4A40-94C1-AE0C1235902E}" = Pando Media Booster
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{A2BCA9F1-566C-4805-97D1-7FDC93386723}" = Adobe AIR
"{AC76BA86-7AD7-1033-7B44-AA0000000001}" = Adobe Reader X
"{B3575D00-27EF-49C2-B9E0-14B3D954E992}" = Apple Application Support
"{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy
"{C23CD6DA-1958-43A5-ADD0-59396572E02E}" = Apple Mobile Device Support
"{C2E4B5BD-32DB-4817-A060-341AB17C3F90}" = Bonjour
"{C6579A65-9CAE-4B31-8B6B-3306E0630A66}" = Apple Software Update
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{D22002ED-EE2A-4CB1-A63D-430E62A2E8D8}" = Google SketchUp 8
"{D8087907-E255-3A41-A46D-D0F798709C71}" = Microsoft Visual C++ 2008 Express Edition with SP1 - ENU
"{DEA314C4-0929-4250-BC92-98E4C105F28D}" = NVIDIA PhysX
"{DF6A13C0-77DF-41FE-BD05-6D5201EB0CE7}_is1" = AusLogics Disk Defrag
"{E2883E8F-472F-4fb0-9522-AC9BF37916A7}" = Adobe Download Manager
"{E3A5A8AB-58F6-45FF-AFCB-C9AE18C05001}" = IDT Audio
"{E633D396-5188-4E9D-8F6B-BFB8BF3467E8}" = Skype™ 5.0
"{F5E87B12-3C27-452F-8E78-21D42164FD83}" = Microsoft SQL Server 2008 Management Objects
"{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
"12345_is1" = WeGame Client 2.3.0
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Advanced SystemCare 4_is1" = Advanced SystemCare 4 Beta 3.0
"Akamai" = Akamai NetSession Interface
"Audacity 1.3 Beta (Unicode)_is1" = Audacity 1.3.7 (Unicode)
"AVG9Uninstall" = AVG Free 9.0
"BandiMPEG1" = Bandisoft MPEG-1 Decoder
"Capsule" = Capsule
"CCleaner" = CCleaner
"ENTERPRISE" = Microsoft Office Enterprise 2007
"FFmpeg for Audacity on Windows_is1" = FFmpeg for Audacity on Windows
"Free YouTube to MP3 Converter_is1" = Free YouTube to MP3 Converter version 3.9.35.324
"G-tune 1.22" = G-tune 1.22
"IObit Security 360_is1" = IObit Security 360
"lmms" = LMMS 0.4.10
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware version 1.51.1.1800
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Extended" = Microsoft .NET Framework 4 Extended
"Microsoft Visual C++ 2008 Express Edition with SP1 - ENU" = Microsoft Visual C++ 2008 Express Edition with SP1 - ENU
"Mozilla Firefox (3.5.5)" = Mozilla Firefox (3.5.5)
"NVIDIA Display Control Panel" = NVIDIA Display Control Panel
"NVIDIA Drivers" = NVIDIA Drivers
"OpenAL" = OpenAL
"PunkBusterSvc" = PunkBuster Services
"StarCraft II" = StarCraft II
"Steam App 215" = Source SDK Base 2006
"Steam App 440" = Team Fortress 2
"UDK-f15f6633-9c98-4206-9dae-0d48b7248b2c" = Unreal Development Kit: 2011-05
"Uninstall_is1" = Uninstall 1.0.0.1
"WinRAR archiver" = WinRAR archiver

========== HKEY_USERS Uninstall List ==========

[HKEY_USERS\S-1-5-21-2889066225-3816148123-2408682452-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Google Chrome" = Google Chrome

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 7/19/2011 2:38:27 AM | Computer Name = MilkyWay | Source = Application Hang | ID = 1002
Description = The program iexplore.exe version 8.0.7600.16385 stopped interacting
with Windows and was closed. To see if more information about the problem is available,
check the problem history in the Action Center control panel. Process ID: fcf4 Start
Time: 01cc45de5586f252 Termination Time: 31 Application Path: C:\Program Files\Internet
Explorer\iexplore.exe Report Id: b2b282de-b1d1-11e0-814f-0019d11cd733

Error - 7/19/2011 4:44:46 AM | Computer Name = MilkyWay | Source = Application Error | ID = 1000
Description = Faulting application name: hl2.exe, version: 0.0.0.0, time stamp:
0x4e1f512e Faulting module name: filesystem_steam.dll_unloaded, version: 0.0.0.0,
time stamp: 0x4e249285 Exception code: 0xc0000005 Fault offset: 0x67eee649 Faulting
process id: 0x101dc Faulting application start time: 0x01cc45ec8c78bb40 Faulting
application path: c:\program files\steam\steamapps\hawatcha\team fortress 2\hl2.exe
Faulting
module path: filesystem_steam.dll Report Id: 5aa3c73a-b1e3-11e0-814f-0019d11cd733

Error - 7/19/2011 6:11:14 PM | Computer Name = MilkyWay | Source = Application Error | ID = 1000
Description = Faulting application name: hl2.exe, version: 0.0.0.0, time stamp:
0x4e1f512e Faulting module name: filesystem_steam.dll_unloaded, version: 0.0.0.0,
time stamp: 0x4e249285 Exception code: 0xc0000005 Fault offset: 0x6809e649 Faulting
process id: 0x10510 Faulting application start time: 0x01cc465f6d75b582 Faulting
application path: c:\program files\steam\steamapps\hawatcha\team fortress 2\hl2.exe
Faulting
module path: filesystem_steam.dll Report Id: 04003547-b254-11e0-814f-0019d11cd733

Error - 7/20/2011 5:42:14 AM | Computer Name = MilkyWay | Source = Application Error | ID = 1000
Description = Faulting application name: hl2.exe, version: 0.0.0.0, time stamp:
0x4e1f512e Faulting module name: filesystem_steam.dll_unloaded, version: 0.0.0.0,
time stamp: 0x4e249285 Exception code: 0xc0000005 Fault offset: 0x680de649 Faulting
process id: 0x10260 Faulting application start time: 0x01cc46aceb6374fd Faulting
application path: c:\program files\steam\steamapps\hawatcha\team fortress 2\hl2.exe
Faulting
module path: filesystem_steam.dll Report Id: 8bccfd1d-b2b4-11e0-814f-0019d11cd733

Error - 7/20/2011 4:05:11 PM | Computer Name = MilkyWay | Source = Software Protection Platform Service | ID = 8198
Description = License Activation (slui.exe) failed with the following error code:
0x800401F9

Error - 7/20/2011 4:05:11 PM | Computer Name = MilkyWay | Source = Winlogon | ID = 4103
Description = Windows license activation failed. Error 0x00000000.

Error - 7/20/2011 6:48:14 PM | Computer Name = MilkyWay | Source = IS360service | ID = 0
Description =

Error - 7/20/2011 6:48:14 PM | Computer Name = MilkyWay | Source = IS360service | ID = 0
Description =

Error - 7/20/2011 6:49:27 PM | Computer Name = MilkyWay | Source = Software Protection Platform Service | ID = 8198
Description = License Activation (slui.exe) failed with the following error code:
0x800401F9

Error - 7/20/2011 6:49:27 PM | Computer Name = MilkyWay | Source = Winlogon | ID = 4103
Description = Windows license activation failed. Error 0x00000000.

[ OSession Events ]
Error - 1/27/2011 1:57:36 AM | Computer Name = MilkyWay | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 1, Application Name: Microsoft Office Excel, Application Version:
12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session lasted 6589
seconds with 2160 seconds of active time. This session ended with a crash.

Error - 1/27/2011 2:01:10 AM | Computer Name = MilkyWay | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 1, Application Name: Microsoft Office Excel, Application Version:
12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session lasted 203
seconds with 180 seconds of active time. This session ended with a crash.

[ System Events ]
Error - 6/22/2011 1:10:40 AM | Computer Name = MilkyWay | Source = EventLog | ID = 6008
Description = The previous system shutdown at 10:08:36 PM on ?6/?21/?2011 was unexpected.

Error - 6/22/2011 1:10:10 AM | Computer Name = MilkyWay | Source = volmgr | ID = 262190
Description = Crash dump initialization failed!

Error - 6/22/2011 1:10:23 AM | Computer Name = MilkyWay | Source = volmgr | ID = 262190
Description = Crash dump initialization failed!

Error - 6/22/2011 1:10:53 AM | Computer Name = MilkyWay | Source = Service Control Manager | ID = 7026
Description = The following boot-start or system-start driver(s) failed to load:
ATITool Null

Error - 6/22/2011 5:44:26 AM | Computer Name = MilkyWay | Source = Microsoft-Windows-HAL | ID = 12
Description = The platform firmware has corrupted memory across the previous system
power transition. Please check for updated firmware for your system.

Error - 6/24/2011 4:44:45 PM | Computer Name = MilkyWay | Source = volmgr | ID = 262190
Description = Crash dump initialization failed!

Error - 6/24/2011 4:45:06 PM | Computer Name = MilkyWay | Source = EventLog | ID = 6008
Description = The previous system shutdown at 1:43:21 PM on ?6/?24/?2011 was unexpected.

Error - 6/24/2011 4:44:59 PM | Computer Name = MilkyWay | Source = volmgr | ID = 262190
Description = Crash dump initialization failed!

Error - 6/24/2011 4:45:23 PM | Computer Name = MilkyWay | Source = Service Control Manager | ID = 7026
Description = The following boot-start or system-start driver(s) failed to load:
ATITool Null

Error - 6/26/2011 5:33:46 AM | Computer Name = MilkyWay | Source = Microsoft-Windows-HAL | ID = 12
Description = The platform firmware has corrupted memory across the previous system
power transition. Please check for updated firmware for your system.


< End of report >

Thank You for your time!

So my brother said yesterday to just run MBAM to get rid of the issues, so I ended up doing it. It did get rid of a couple things and removed the google redirecting problem. However, I'm still concerned that there may be some lurking infections that I haven't found (seeing that I had more infections than I originally thought, according to MBAM). I'm not sure if this changes anything but I'd still like to go through with this process as the aswMBR detected something suspicious. I'll post the MBAM ,OTL and aswMBR logs.

MBAM
Malwarebytes' Anti-Malware 1.51.1.1800
www.malwarebytes.org

Database version: 7216

Windows 6.1.7600
Internet Explorer 8.0.7600.16385

7/20/2011 8:47:56 PM
mbam-log-2011-07-20 (20-47-56).txt

Scan type: Quick scan
Objects scanned: 137404
Time elapsed: 3 minute(s), 5 second(s)

Memory Processes Infected: 3
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 3
Registry Data Items Infected: 1
Folders Infected: 0
Files Infected: 4

Memory Processes Infected:
c:\Users\dreidrei\AppData\Local\Temp\csrss.exe (Trojan.Backdoor) -> 2768 -> Unloaded process successfully.
c:\Users\dreidrei\AppData\Roaming\microsoft\conhost.exe (Trojan.Agent) -> 2952 -> Unloaded process successfully.
c:\Users\dreidrei\AppData\Roaming\dwm.exe (Trojan.Backdoor) -> 7012 -> Unloaded process successfully.

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\conhost (Trojan.Agent) -> Value: conhost -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\Load (Trojan.Agent) -> Value: Load -> Delete on reboot.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell (Hijack.Shell.Gen) -> Value: Shell -> Quarantined and deleted successfully.

Registry Data Items Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\Load (Trojan.Backdoor) -> Bad: (C:\Users\dreidrei\AppData\Local\Temp\csrss.exe) Good: () -> Quarantined and deleted successfully.

Folders Infected:
(No malicious items detected)

Files Infected:
c:\Users\dreidrei\AppData\Local\Temp\csrss.exe (Trojan.Backdoor) -> Quarantined and deleted successfully.
c:\Users\dreidrei\AppData\Roaming\microsoft\conhost.exe (Trojan.Agent) -> Quarantined and deleted successfully.
c:\Users\dreidrei\AppData\Roaming\dwm.exe (Trojan.Backdoor) -> Quarantined and deleted successfully.
c:\Users\dreidrei\AppData\Local\Temp\0.07844038843786727.exe (Trojan.Agent) -> Quarantined and deleted successfully.



OTL
OTL logfile created on: 7/21/2011 2:14:12 PM - Run 2
OTL by OldTimer - Version 3.2.26.1 Folder = C:\Users\dreidrei\Desktop
An unknown product (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.98 Gb Total Physical Memory | 1.97 Gb Available Physical Memory | 66.12% Memory free
5.96 Gb Paging File | 4.86 Gb Available in Paging File | 81.44% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 69.24 Gb Total Space | 4.27 Gb Free Space | 6.16% Space Free | Partition Type: NTFS
Drive E: | 232.88 Gb Total Space | 51.25 Gb Free Space | 22.01% Space Free | Partition Type: NTFS

Computer Name: MILKYWAY | User Name: Andrei | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Users\dreidrei\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\IObit\Advanced SystemCare 4\ASCService.exe (IObit)
PRC - C:\Program Files\AVG\AVG9\avgtray.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG9\avgcsrvx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG9\avgnsx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG9\avgemc.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG9\avgrsx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG9\avgwdsvc.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG9\avgchsvx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\IObit\IObit Security 360\is360tray.exe (IObit)
PRC - C:\Program Files\IObit\IObit Security 360\is360srv.exe (IObit)
PRC - C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - C:\Windows\System32\taskhost.exe (Microsoft Corporation)
PRC - C:\Windows\System32\audiodg.exe (Microsoft Corporation)
PRC - C:\Program Files\IDT\WDM\sttray.exe (IDT, Inc.)
PRC - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe (Safer Networking Ltd.)


========== Modules (SafeList) ==========

MOD - C:\Users\dreidrei\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16661_none_420fe3fa2b8113bd\comctl32.dll (Microsoft Corporation)
MOD - C:\Windows\System32\avgrsstx.dll (AVG Technologies CZ, s.r.o.)


========== Win32 Services (SafeList) ==========

SRV - (Akamai) – c:\Program Files\Common Files\Akamai\netsession_win_e477fed.dll ()
SRV - (Steam Client Service) – C:\Program Files\Common Files\Steam\SteamService.exe (Valve Corporation)
SRV - (AdvancedSystemCareService) – C:\Program Files\IObit\Advanced SystemCare 4\ASCService.exe (IObit)
SRV - (AVG Security Toolbar Service) – C:\Program Files\AVG\AVG9\Toolbar\ToolbarBroker.exe ()
SRV - (nosGetPlusHelper) getPlus® – C:\Program Files\NOS\bin\getPlus_Helper_3004.dll (NOS Microsystems Ltd.)
SRV - (avg9emc) – C:\Program Files\AVG\AVG9\avgemc.exe (AVG Technologies CZ, s.r.o.)
SRV - (avg9wd) – C:\Program Files\AVG\AVG9\avgwdsvc.exe (AVG Technologies CZ, s.r.o.)
SRV - (IS360service) – C:\Program Files\IObit\IObit Security 360\is360srv.exe (IObit)
SRV - (npggsvc) – C:\Windows\System32\GameMon.des (INCA Internet Co., Ltd.)
SRV - (StorSvc) – C:\Windows\System32\StorSvc.dll (Microsoft Corporation)
SRV - (SensrSvc) – C:\Windows\System32\sensrsvc.dll (Microsoft Corporation)
SRV - (PeerDistSvc) – C:\Windows\System32\PeerDistSvc.dll (Microsoft Corporation)
SRV - (WinDefend) – C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (SBSDWSCService) – C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe (Safer Networking Ltd.)


========== Driver Services (SafeList) ==========

DRV - (AvgTdiX) – C:\Windows\System32\Drivers\avgtdix.sys (AVG Technologies CZ, s.r.o.)
DRV - (PnkBstrK) – C:\Windows\System32\drivers\PnkBstrK.sys ()
DRV - (AvgLdx86) – C:\Windows\System32\Drivers\avgldx86.sys (AVG Technologies CZ, s.r.o.)
DRV - (nvlddmkm) – C:\Windows\System32\drivers\nvlddmkm.sys (NVIDIA Corporation)
DRV - (AvgMfx86) – C:\Windows\System32\Drivers\avgmfx86.sys (AVG Technologies CZ, s.r.o.)
DRV - (vmbus) – C:\Windows\system32\DRIVERS\vmbus.sys (Microsoft Corporation)
DRV - (storflt) – C:\Windows\system32\DRIVERS\vmstorfl.sys (Microsoft Corporation)
DRV - (storvsc) – C:\Windows\system32\DRIVERS\storvsc.sys (Microsoft Corporation)
DRV - (WinUsb) – C:\Windows\System32\drivers\winusb.sys (Microsoft Corporation)
DRV - (s3cap) – C:\Windows\system32\DRIVERS\vms3cap.sys (Microsoft Corporation)
DRV - (VMBusHID) – C:\Windows\system32\DRIVERS\VMBusHID.sys (Microsoft Corporation)
DRV - (e1express) Intel® – C:\Windows\System32\drivers\e1e6032.sys (Intel Corporation)
DRV - (hamachi) – C:\Windows\System32\drivers\hamachi.sys (LogMeIn, Inc.)
DRV - (STHDA) – C:\Windows\System32\drivers\stwrt.sys (IDT, Inc.)
DRV - (ATITool) – C:\Windows\System32\drivers\ATITool.sys ()


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========


IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar =
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page =
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.youtube.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://www.msn.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-us
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 66 3F 4F 65 3B 72 CA 01 [binary data]
IE - HKCU\..\URLSearchHook: {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG9\Toolbar\IEToolbar.dll ()
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "AVG Secure Search"
FF - prefs.js..browser.search.selectedEngine: "AVG Secure Search"
FF - prefs.js..extensions.enabledItems: avg@igeared:6.103.018.001
FF - prefs.js..extensions.enabledItems: {ACAA314B-EEBA-48e4-AD47-84E31C44796C}:1.0.1
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: {635abd67-4fe9-1b23-4f01-e679fa7484c1}:1.6.6.20090220
FF - prefs.js..keyword.URL: "http://search.avg.com/route/?d=4b14a11e&v=6.103.018.001&i=23&tp=ab&iy=b&ychte=us&lng=en-US&q="


FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\4.0.51204.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll File not found
FF - HKLM\Software\MozillaPlugins\@nexon.net/NxGame: C:\ProgramData\NexonUS\NGM\npNxGameUS.dll File not found
FF - HKLM\Software\MozillaPlugins\@ogplanet.com/npOGPPlugin: C:\Windows\system32\npOGPPlugin.dll (OGPlanet)
FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF - HKCU\Software\MozillaPlugins\pandonetworks.com/PandoWebPlugin: C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\avg@igeared: C:\Program Files\AVG\AVG9\Toolbar\Firefox\avg@igeared [2011/05/09 15:31:13 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.5.5\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/12/29 15:21:44 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.5.5\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/12/29 15:21:44 | 000,000,000 | —D | M]

[2009/11/30 23:12:07 | 000,000,000 | —D | M] (No name found) – C:\Users\Andrei\AppData\Roaming\Mozilla\Extensions
[2011/02/19 13:34:56 | 000,000,000 | —D | M] (No name found) – C:\Users\Andrei\AppData\Roaming\Mozilla\Firefox\Profiles\lvfa1lpa.default\extensions
[2010/05/05 22:46:19 | 000,000,000 | —D | M] (Yahoo! Toolbar) – C:\Users\Andrei\AppData\Roaming\Mozilla\Firefox\Profiles\lvfa1lpa.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
[2011/02/07 20:05:08 | 000,000,000 | —D | M] ("DVDVideoSoft Menu") – C:\Users\Andrei\AppData\Roaming\Mozilla\Firefox\Profiles\lvfa1lpa.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}
[2011/02/19 13:34:56 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\extensions
[2010/06/06 20:43:26 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
[2011/05/09 15:31:13 | 000,000,000 | —D | M] ("urn:mozilla:install-manifest" em:id="avg@igeared" em:name="AVG Security Toolbar" em:version="6.103.018.001" em:displayname="AVG Security Toolbar" em:iconURL="chrome://tavgp/skin/logo.ico" em:creator="AVG Technologies" em:description="AVG Security Toolbar" em:homepageURL="http://www.avg.com" >) – C:\PROGRAM FILES\AVG\AVG9\TOOLBAR\FIREFOX\AVG@IGEARED
[2010/06/06 20:43:08 | 000,411,368 | —- | M] (Sun Microsystems, Inc.) – C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll

O1 HOSTS File: ([2011/07/21 14:09:16 | 000,000,098 | —- | M]) - C:\Windows\System32\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG9\avgssie.dll (AVG Technologies CZ, s.r.o.)
O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (AVG Security Toolbar BHO) - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG9\Toolbar\IEToolbar.dll ()
O3 - HKLM\..\Toolbar: (AVG Security Toolbar) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Program Files\AVG\AVG9\Toolbar\IEToolbar.dll ()
O3 - HKCU\..\Toolbar\WebBrowser: (AVG Security Toolbar) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Program Files\AVG\AVG9\Toolbar\IEToolbar.dll ()
O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Program Files\Adobe\Reader 10.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [AVG9_TRAY] C:\Program Files\AVG\AVG9\avgtray.exe (AVG Technologies CZ, s.r.o.)
O4 - HKLM..\Run: [IObit Security 360] C:\Program Files\IObit\IObit Security 360\IS360tray.exe (IObit)
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware (reboot)] C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [SysTrayApp] C:\Program Files\IDT\WDM\sttray.exe (IDT, Inc.)
O4 - HKCU..\Run: [Advanced SystemCare 4] C:\Program Files\IObit\Advanced SystemCare 4\ASCTray.exe (IObit)
O4 - HKCU..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.)
O4 - HKLM..\RunOnce: [*Restore] C:\Windows\System32\rstrui.exe (Microsoft Corporation)
O4 - HKLM..\RunOnce: [DeleteDir[48E] WIPE_48E.TMP] File not found
O4 - HKLM..\RunOnce: [GrpConv] C:\Windows\System32\grpconv.exe (Microsoft Corporation)
O4 - HKLM..\RunOnce: [InstallShieldSetup] C:\Program Files\InstallShield Installation Information\{E3A5A8AB-58F6-45FF-AFCB-C9AE18C05001}\setup.exe (InstallShield Software Corporation)
O4 - HKLM..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKLM..\RunOnce: [Spybot - Search & Destroy] C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe (Safer Networking Limited)
O4 - HKLM..\RunOnce: [Uninstall Adobe Download Manager] C:\Program Files\NOS\bin\getPlusUninst_Adobe.exe (NOS Microsystems Ltd.)
O4 - HKCU..\RunOnce: [avg_spchecker] C:\Program Files\AVG\AVG9\Notification\SPChecker1.exe ()
O4 - HKCU..\RunOnce: [FlashPlayerUpdate] C:\Windows\System32\Macromed\Flash\FlashUtil10q_Plugin.exe (Adobe Systems, Inc.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\Andrei\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()
O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_20)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O18 - Protocol\Handler\avgsecuritytoolbar {F2DDE6B2-9684-4A55-86D4-E255E237B77C} - C:\Program Files\AVG\AVG9\Toolbar\IEToolbar.dll ()
O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG9\avgpp.dll (AVG Technologies CZ, s.r.o.)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O20 - AppInit_DLLs: (avgrsstx.dll) - C:\Windows\System32\avgrsstx.dll (AVG Technologies CZ, s.r.o.)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/06/10 14:42:20 | 000,000,024 | —- | M] () - C:\autoexec.bat – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2011/07/21 14:09:14 | 000,000,000 | —D | C] – C:\_OTL
[2011/07/20 16:43:13 | 000,000,000 | —D | C] – C:\Users\Andrei\AppData\Roaming\Malwarebytes
[2011/07/20 16:43:05 | 000,041,272 | —- | C] (Malwarebytes Corporation) – C:\Windows\System32\drivers\mbamswissarmy.sys
[2011/07/20 16:43:05 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2011/07/20 16:43:05 | 000,000,000 | —D | C] – C:\ProgramData\Malwarebytes
[2011/07/20 16:43:02 | 000,022,712 | —- | C] (Malwarebytes Corporation) – C:\Windows\System32\drivers\mbam.sys
[2011/07/20 16:43:02 | 000,000,000 | —D | C] – C:\Program Files\Malwarebytes' Anti-Malware
[2011/07/20 14:50:23 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy
[2011/07/20 14:50:15 | 000,000,000 | —D | C] – C:\Program Files\Spybot - Search & Destroy
[2011/07/20 12:11:25 | 000,000,000 | -HSD | C] – C:\Config.Msi
[2011/07/20 12:06:44 | 000,000,000 | —D | C] – C:\Users\Andrei\Documents\Visual Studio 2008
[2011/07/15 18:35:02 | 000,000,000 | —D | C] – C:\Program Files\Capsule
[2011/07/08 20:49:02 | 000,000,000 | —D | C] – C:\Users\Andrei\AppData\Local\Green Man Gaming
[2011/07/08 20:48:56 | 000,000,000 | —D | C] – C:\Users\Andrei\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Capsule Utilities
[2011/07/05 16:14:16 | 000,000,000 | —D | C] – C:\Users\Andrei\Documents\SavedGames
[2011/06/30 20:22:51 | 000,000,000 | —D | C] – C:\Program Files\Apple Software Update
[2011/06/30 20:22:24 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
[2011/06/30 20:21:56 | 000,000,000 | —D | C] – C:\Program Files\iPod
[2011/06/30 20:21:55 | 000,000,000 | —D | C] – C:\Program Files\iTunes
[2011/06/30 20:19:43 | 000,000,000 | —D | C] – C:\Program Files\Bonjour
[2011/06/26 12:27:57 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google SketchUp 8
[2011/06/23 14:42:02 | 000,000,000 | —D | C] – C:\Users\Andrei\Documents\LOLReplay
[2011/06/23 14:42:02 | 000,000,000 | —D | C] – C:\Program Files\LOLReplay

========== Files - Modified Within 30 Days ==========

[2011/07/21 14:11:16 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2011/07/21 14:11:12 | 2401,697,792 | -HS- | M] () – C:\hiberfil.sys
[2011/07/21 14:10:15 | 000,009,600 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2011/07/21 14:10:15 | 000,009,600 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2011/07/21 14:09:16 | 000,000,098 | —- | M] () – C:\Windows\System32\drivers\etc\Hosts
[2011/07/21 13:33:17 | 080,240,300 | —- | M] () – C:\Windows\System32\drivers\Avg\incavi.avm
[2011/07/21 13:27:17 | 000,000,920 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2889066225-3816148123-2408682452-1003UA.job
[2011/07/20 19:30:25 | 000,000,868 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2889066225-3816148123-2408682452-1003Core.job
[2011/07/20 16:43:06 | 000,001,071 | —- | M] () – C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2011/07/20 14:50:24 | 000,001,244 | —- | M] () – C:\Users\Andrei\Application Data\Microsoft\Internet Explorer\Quick Launch\Spybot - Search & Destroy.lnk
[2011/07/20 14:50:24 | 000,001,220 | —- | M] () – C:\Users\Andrei\Desktop\Spybot - Search & Destroy.lnk
[2011/07/20 12:56:48 | 000,285,968 | —- | M] () – C:\Windows\System32\FNTCACHE.DAT
[2011/07/20 12:11:40 | 000,668,348 | —- | M] () – C:\Windows\System32\perfh009.dat
[2011/07/20 12:11:40 | 000,124,534 | —- | M] () – C:\Windows\System32\perfc009.dat
[2011/07/15 18:36:57 | 000,001,043 | —- | M] () – C:\Users\Andrei\Desktop\Capsule.lnk
[2011/07/06 19:52:42 | 000,041,272 | —- | M] (Malwarebytes Corporation) – C:\Windows\System32\drivers\mbamswissarmy.sys
[2011/07/06 19:52:42 | 000,022,712 | —- | M] (Malwarebytes Corporation) – C:\Windows\System32\drivers\mbam.sys
[2011/06/30 20:22:24 | 000,001,753 | —- | M] () – C:\Users\Public\Desktop\iTunes.lnk
[2011/06/26 12:27:57 | 000,001,995 | —- | M] () – C:\Users\Public\Desktop\Google SketchUp 8.lnk
[2011/06/23 14:42:02 | 000,001,851 | —- | M] () – C:\Users\Andrei\Desktop\LOL Recorder.lnk

========== Files Created - No Company Name ==========

[2011/07/20 16:43:06 | 000,001,071 | —- | C] () – C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2011/07/20 14:50:24 | 000,001,244 | —- | C] () – C:\Users\Andrei\Application Data\Microsoft\Internet Explorer\Quick Launch\Spybot - Search & Destroy.lnk
[2011/07/20 14:50:24 | 000,001,220 | —- | C] () – C:\Users\Andrei\Desktop\Spybot - Search & Destroy.lnk
[2011/07/08 20:48:56 | 000,001,155 | —- | C] () – C:\Users\Andrei\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Capsule.lnk
[2011/07/08 20:48:56 | 000,001,043 | —- | C] () – C:\Users\Andrei\Desktop\Capsule.lnk
[2011/06/30 20:22:24 | 000,001,753 | —- | C] () – C:\Users\Public\Desktop\iTunes.lnk
[2011/06/26 12:27:57 | 000,001,995 | —- | C] () – C:\Users\Public\Desktop\Google SketchUp 8.lnk
[2011/06/23 19:18:22 | 000,000,920 | —- | C] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2889066225-3816148123-2408682452-1003UA.job
[2011/06/23 19:18:20 | 000,000,868 | —- | C] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2889066225-3816148123-2408682452-1003Core.job
[2011/06/23 14:42:03 | 000,001,863 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LOL Recorder.lnk
[2011/06/23 14:42:02 | 000,001,851 | —- | C] () – C:\Users\Andrei\Desktop\LOL Recorder.lnk
[2011/06/14 16:31:52 | 000,015,360 | —- | C] () – C:\Windows\wpktui10.exe
[2011/05/22 08:24:57 | 000,056,320 | —- | C] () – C:\Windows\System32\iyvu9_32.dll
[2011/05/22 08:17:45 | 000,000,299 | —- | C] () – C:\Windows\EReg515.dat
[2011/05/22 08:17:19 | 000,010,240 | —- | C] () – C:\Windows\System32\vidx16.dll
[2011/05/22 08:16:48 | 000,000,763 | —- | C] () – C:\Windows\disney.ini
[2011/04/22 20:18:26 | 000,000,032 | R— | C] () – C:\ProgramData\hash.dat
[2011/03/13 21:11:00 | 000,139,128 | —- | C] () – C:\Windows\System32\drivers\PnkBstrK.sys
[2011/03/13 21:10:28 | 000,215,128 | —- | C] () – C:\Windows\System32\PnkBstrB.exe
[2010/07/14 19:37:05 | 000,000,094 | —- | C] () – C:\Users\Andrei\AppData\Local\fusioncache.dat
[2010/05/29 16:27:04 | 002,434,856 | —- | C] () – C:\Windows\System32\pbsvc_bc2.exe
[2010/05/11 15:38:42 | 000,000,056 | -H– | C] () – C:\ProgramData\ezsidmv.dat
[2010/03/15 17:55:27 | 000,007,606 | —- | C] () – C:\Users\Andrei\AppData\Local\Resmon.ResmonCfg
[2010/03/11 20:34:41 | 000,138,056 | —- | C] () – C:\Users\Andrei\AppData\Roaming\PnkBstrK.sys
[2010/03/11 20:34:07 | 002,407,792 | —- | C] () – C:\Windows\System32\pbsvc_heroes.exe
[2010/03/11 20:34:07 | 000,075,064 | —- | C] () – C:\Windows\System32\PnkBstrA.exe
[2009/11/30 22:05:30 | 000,000,262 | —- | C] () – C:\Windows\{789289CA-F73A-4A16-A331-54D498CE069F}_WiseFW.ini
[2009/07/13 21:57:37 | 000,067,584 | –S- | C] () – C:\Windows\bootstat.dat
[2009/07/13 21:33:53 | 000,285,968 | —- | C] () – C:\Windows\System32\FNTCACHE.DAT
[2009/07/13 19:05:48 | 000,668,348 | —- | C] () – C:\Windows\System32\perfh009.dat
[2009/07/13 19:05:48 | 000,291,294 | —- | C] () – C:\Windows\System32\perfi009.dat
[2009/07/13 19:05:48 | 000,124,534 | —- | C] () – C:\Windows\System32\perfc009.dat
[2009/07/13 19:05:48 | 000,031,548 | —- | C] () – C:\Windows\System32\perfd009.dat
[2009/07/13 19:05:05 | 000,000,741 | —- | C] () – C:\Windows\System32\NOISE.DAT
[2009/07/13 19:04:11 | 000,215,943 | —- | C] () – C:\Windows\System32\dssec.dat
[2009/07/13 17:19:49 | 000,066,048 | —- | C] () – C:\Windows\System32\PrintBrmUi.exe
[2009/07/13 16:55:01 | 000,043,131 | —- | C] () – C:\Windows\mib.bin
[2009/07/13 16:51:43 | 000,073,728 | —- | C] () – C:\Windows\System32\BthpanContextHandler.dll
[2009/07/13 16:42:10 | 000,064,000 | —- | C] () – C:\Windows\System32\BWContextHandler.dll
[2009/07/13 16:41:47 | 000,001,536 | —- | C] () – C:\Windows\System32\winver.exe
[2009/07/08 18:03:02 | 000,058,880 | —- | C] () – C:\Windows\System32\bdmpegv.dll
[2009/06/10 14:26:10 | 000,673,088 | —- | C] () – C:\Windows\System32\mlang.dat
[2006/11/10 06:08:50 | 000,024,064 | —- | C] () – C:\Windows\System32\drivers\ATITool.sys

========== LOP Check ==========

[2011/05/28 19:49:15 | 000,000,000 | —D | M] – C:\Users\Andrei\AppData\Roaming\.minecraft
[2010/07/16 14:28:04 | 000,000,000 | —D | M] – C:\Users\Andrei\AppData\Roaming\BugTrap Console Test
[2011/02/07 20:05:07 | 000,000,000 | —D | M] – C:\Users\Andrei\AppData\Roaming\DVDVideoSoftIEHelpers
[2010/07/13 17:56:41 | 000,000,000 | —D | M] – C:\Users\Andrei\AppData\Roaming\GetRightToGo
[2011/05/08 11:46:45 | 000,000,000 | —D | M] – C:\Users\Andrei\AppData\Roaming\IObit
[2010/05/11 15:29:58 | 000,000,000 | —D | M] – C:\Users\Andrei\AppData\Roaming\LolClient
[2010/01/02 18:57:35 | 000,000,000 | —D | M] – C:\Users\Andrei\AppData\Roaming\LolClient.F24C99354F615F3BAB18AE7B93E3F9B9E8784FA6.1
[2010/07/14 19:37:25 | 000,000,000 | —D | M] – C:\Users\Andrei\AppData\Roaming\Turbine
[2010/12/28 21:06:56 | 000,032,560 | —- | M] () – C:\Windows\Tasks\SCHEDLGU.TXT

========== Purity Check ==========



< End of report >


aswMBR
aswMBR version 0.9.8.942 Copyright© 2011 AVAST Software
Run date: 2011-07-21 14:20:55
—————————–
14:20:55.755 OS Version: Windows 6.1.7600
14:20:55.755 Number of processors: 2 586 0x604
14:20:55.771 ComputerName: MILKYWAY UserName: Andrei
14:21:03.568 Initialize success
14:21:46.660 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-0
14:21:46.660 Disk 0 Vendor: WDC_WD74 20.0 Size: 70911MB BusType: 8
14:21:46.675 Disk 1 \Device\Harddisk1\DR1 -> \Device\Ide\IAAStorageDevice-1
14:21:46.675 Disk 1 Vendor: WDC_WD25 02.0 Size: 238475MB BusType: 8
14:21:46.675 Disk 0 MBR read successfully
14:21:46.691 Disk 0 MBR scan
14:21:46.691 Disk 0 Windows 7 default MBR code
14:21:46.691 Disk 0 scanning sectors +145211535
14:21:46.738 Disk 0 scanning C:\Windows\system32\drivers
14:21:51.144 Service scanning
14:21:52.253 Modules scanning
14:21:57.519 Module: C:\Windows\System32\user32.dll **SUSPICIOUS**
14:21:58.050 Disk 0 trace - called modules:
14:21:58.066
14:21:58.582 Scan finished successfully
14:22:14.363 Disk 0 MBR has been saved successfully to "C:\Users\Andrei\Desktop\MBR.dat"
14:22:14.378 The log file has been saved successfully to "C:\Users\Andrei\Desktop\aswMBR.txt"


Again, thank you for your time!

AVG was conflicting with combofix so I uninstalled it, ran it and got the log. I'll probably download Avast instead of reinstalling AVG.

ComboFix 11-07-19.03 - Andrei 07/22/2011 19:25:20.1.2 - x86
Microsoft Windows 7 Professional 6.1.7600.0.1252.1.1033.18.3054.2277 [GMT -7:00]
Running from: c:\users\[removed]\Desktop\ComboFix.exe
SP: IObit Security 360 *Disabled/Updated* {FAE2835A-B90A-9E7A-85DA-82DBDA7C1E3A}
SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
C:\CFLog
E:\install.exe
.
.
((((((((((((((((((((((((( Files Created from 2011-06-23 to 2011-07-23 )))))))))))))))))))))))))))))))
.
.
2011-07-23 02:22 . 2011-07-23 02:22 ——– d—–w- C:\32788R22FWJFW
2011-07-21 21:41 . 2011-07-21 21:41 ——– d—–w- c:\users\dreidrei\AppData\Local\Microsoft Games
2011-07-21 21:09 . 2011-07-21 21:09 ——– d—–w- C:\_OTL
2011-07-20 23:45 . 2011-07-20 23:45 ——– d—–w- c:\users\dreidrei\AppData\Roaming\Malwarebytes
2011-07-20 23:43 . 2011-07-20 23:43 ——– d—–w- c:\users\Andrei\AppData\Roaming\Malwarebytes
2011-07-20 23:43 . 2011-07-20 23:43 ——– d—–w- c:\programdata\Malwarebytes
2011-07-20 23:43 . 2011-07-07 02:52 41272 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-07-20 23:43 . 2011-07-20 23:43 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2011-07-20 23:43 . 2011-07-07 02:52 22712 —-a-w- c:\windows\system32\drivers\mbam.sys
2011-07-20 21:50 . 2011-07-20 21:52 ——– d—–w- c:\program files\Spybot - Search & Destroy
2011-07-20 19:15 . 2011-07-20 19:15 759296 —-a-w- c:\program files\Common Files\Microsoft Shared\VGX\VGX.dll
2011-07-20 19:15 . 2011-07-20 19:15 311296 —-a-w- c:\windows\system32\drivers\srv.sys
2011-07-20 19:15 . 2011-07-20 19:15 309760 —-a-w- c:\windows\system32\drivers\srv2.sys
2011-07-20 19:15 . 2011-07-20 19:15 114176 —-a-w- c:\windows\system32\drivers\srvnet.sys
2011-07-20 19:15 . 2011-07-20 19:15 78336 —-a-w- c:\windows\system32\drivers\dfsc.sys
2011-07-20 19:14 . 2011-07-20 19:14 1286016 —-a-w- c:\windows\system32\drivers\tcpip.sys
2011-07-20 19:14 . 2011-07-20 19:14 338944 —-a-w- c:\windows\system32\drivers\afd.sys
2011-07-20 19:14 . 2011-07-20 19:14 571904 —-a-w- c:\windows\system32\oleaut32.dll
2011-07-20 19:07 . 2011-07-20 19:07 222720 —-a-w- c:\windows\system32\drivers\mrxsmb10.sys
2011-07-20 19:07 . 2011-07-20 19:07 96256 —-a-w- c:\windows\system32\drivers\mrxsmb20.sys
2011-07-20 19:07 . 2011-07-20 19:07 123392 —-a-w- c:\windows\system32\drivers\mrxsmb.sys
2011-07-20 19:07 . 2011-07-20 19:07 740864 —-a-w- c:\windows\system32\inetcomm.dll
2011-07-20 19:05 . 2011-07-20 19:05 123904 —-a-w- c:\windows\system32\poqexec.exe
2011-07-20 19:04 . 2011-07-20 19:04 28672 —-a-w- c:\windows\system32\dnscacheugc.exe
2011-07-20 19:04 . 2011-07-20 19:04 132608 —-a-w- c:\windows\system32\dnsrslvr.dll
2011-07-20 19:04 . 2011-07-20 19:04 428032 —-a-w- c:\windows\system32\vbscript.dll
2011-07-20 19:04 . 2011-07-20 19:04 34304 —-a-w- c:\windows\system32\atmlib.dll
2011-07-20 19:04 . 2011-07-20 19:04 294912 —-a-w- c:\windows\system32\atmfd.dll
2011-07-20 19:03 . 2011-07-20 19:03 191488 —-a-w- c:\windows\system32\FXSCOVER.exe
2011-07-20 19:03 . 2011-07-20 19:03 69632 —-a-w- c:\windows\system32\drivers\bowser.sys
2011-07-20 19:03 . 2011-07-20 19:03 1164288 —-a-w- c:\windows\system32\mfc42u.dll
2011-07-20 19:03 . 2011-07-20 19:03 1137664 —-a-w- c:\windows\system32\mfc42.dll
2011-07-20 19:02 . 2011-07-20 19:02 2690560 —-a-w- c:\windows\system32\mstscax.dll
2011-07-20 19:02 . 2011-07-20 19:02 1034240 —-a-w- c:\windows\system32\mstsc.exe
2011-07-20 19:02 . 2011-07-20 19:02 850432 —-a-w- c:\windows\system32\sbe.dll
2011-07-20 19:02 . 2011-07-20 19:02 642048 —-a-w- c:\windows\system32\CPFilters.dll
2011-07-20 19:02 . 2011-07-20 19:02 534528 —-a-w- c:\windows\system32\EncDec.dll
2011-07-20 19:02 . 2011-07-20 19:02 199680 —-a-w- c:\windows\system32\mpg2splt.ax
2011-07-20 19:02 . 2011-07-20 19:02 3957120 —-a-w- c:\windows\system32\ntkrnlpa.exe
2011-07-20 19:02 . 2011-07-20 19:02 3901824 —-a-w- c:\windows\system32\ntoskrnl.exe
2011-07-20 19:02 . 2011-07-20 19:02 1289536 —-a-w- c:\windows\system32\ntdll.dll
2011-07-20 19:01 . 2011-07-20 19:01 541184 —-a-w- c:\windows\system32\kerberos.dll
2011-07-20 19:01 . 2011-07-20 19:01 987136 —-a-w- c:\program files\Common Files\System\ado\msado15.dll
2011-07-20 19:01 . 2011-07-20 19:01 573440 —-a-w- c:\windows\system32\odbc32.dll
2011-07-20 19:01 . 2011-07-20 19:01 372736 —-a-w- c:\program files\Common Files\System\ado\msadox.dll
2011-07-20 19:01 . 2011-07-20 19:01 352256 —-a-w- c:\program files\Common Files\System\ado\msadomd.dll
2011-07-20 19:01 . 2011-07-20 19:01 208896 —-a-w- c:\program files\Common Files\System\msadc\msadco.dll
2011-07-20 19:00 . 2011-07-20 19:00 109056 —-a-w- c:\windows\system32\t2embed.dll
2011-07-20 19:00 . 2011-07-20 19:00 4247040 —-a-w- c:\program files\Windows NT\Accessories\wordpad.exe
2011-07-20 19:00 . 2011-07-20 19:00 1413632 —-a-w- c:\windows\system32\ole32.dll
2011-07-20 18:59 . 2011-07-20 18:59 954752 —-a-w- c:\windows\system32\mfc40.dll
2011-07-20 18:59 . 2011-07-20 18:59 954288 —-a-w- c:\windows\system32\mfc40u.dll
2011-07-20 18:59 . 2011-07-20 18:59 530432 —-a-w- c:\windows\system32\comctl32.dll
2011-07-20 18:59 . 2011-07-20 18:59 738816 —-a-w- c:\windows\system32\wmpmde.dll
2011-07-16 01:35 . 2011-07-16 01:36 ——– d—–w- c:\program files\Capsule
2011-07-09 04:04 . 2011-07-09 04:05 ——– d—–w- c:\users\dreidrei\AppData\Local\Green Man Gaming
2011-07-09 03:49 . 2011-07-09 04:00 ——– d—–w- c:\users\Andrei\AppData\Local\Green Man Gaming
2011-07-01 03:22 . 2011-07-01 03:22 ——– d—–w- c:\program files\Apple Software Update
2011-07-01 03:21 . 2011-07-01 03:21 ——– d—–w- c:\program files\iPod
2011-07-01 03:21 . 2011-07-01 03:22 ——– d—–w- c:\program files\iTunes
2011-07-01 03:19 . 2011-07-01 03:19 ——– d—–w- c:\program files\Bonjour
2011-06-28 03:14 . 2011-06-28 03:14 ——– d—–w- c:\users\dreidrei\AppData\Roaming\NVIDIA
2011-06-28 03:14 . 2010-06-02 11:55 239960 —-a-w- c:\windows\system32\xactengine3_7.dll
2011-06-28 03:14 . 2010-05-26 18:41 470880 —-a-w- c:\windows\system32\d3dx10_43.dll
2011-06-28 03:14 . 2010-05-26 18:41 1868128 —-a-w- c:\windows\system32\d3dcsx_43.dll
2011-06-28 03:14 . 2010-02-04 17:01 74072 —-a-w- c:\windows\system32\XAPOFX1_4.dll
2011-06-28 03:14 . 2010-02-04 17:01 528216 —-a-w- c:\windows\system32\XAudio2_6.dll
2011-06-28 03:14 . 2010-02-04 17:01 238936 —-a-w- c:\windows\system32\xactengine3_6.dll
2011-06-23 21:42 . 2011-06-23 21:42 ——– d—–w- c:\program files\LOLReplay
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-06-14 23:31 . 2011-06-14 23:31 15360 —-a-w- c:\windows\wpktui10.exe
2011-06-05 20:32 . 2011-06-05 20:32 404640 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-05-22 15:17 . 2011-05-22 15:17 4608 —-a-w- c:\windows\system32\w95inf32.dll
2011-05-22 15:17 . 2011-05-22 15:17 2272 —-a-w- c:\windows\system32\w95inf16.dll
2011-05-10 15:06 . 2011-05-10 15:06 4517664 —-a-w- c:\windows\system32\usbaaplrc.dll
2011-05-10 15:06 . 2011-05-10 15:06 42496 —-a-w- c:\windows\system32\drivers\usbaapl.sys
2011-05-08 19:05 . 2011-05-08 19:05 224256 —-a-w- c:\windows\system32\schannel.dll
2011-05-08 19:05 . 2011-05-08 19:05 101760 —-a-w- c:\windows\system32\consent.exe
2011-05-08 19:05 . 2011-05-08 19:05 314368 —-a-w- c:\windows\system32\webio.dll
2011-05-08 19:04 . 2011-05-08 19:04 749056 —-a-w- c:\windows\system32\schedsvc.dll
2011-05-08 19:04 . 2011-05-08 19:04 496128 —-a-w- c:\windows\system32\taskschd.dll
2011-05-08 19:04 . 2011-05-08 19:04 351232 —-a-w- c:\windows\system32\wmicmiplugin.dll
2011-05-08 19:04 . 2011-05-08 19:04 305152 —-a-w- c:\windows\system32\taskcomp.dll
2011-05-08 19:04 . 2011-05-08 19:04 192000 —-a-w- c:\windows\system32\taskeng.exe
2011-05-08 19:04 . 2011-05-08 19:04 179712 —-a-w- c:\windows\system32\schtasks.exe
2011-05-08 19:04 . 2011-05-08 19:04 12625408 —-a-w- c:\windows\system32\wmploc.DLL
2011-05-08 19:03 . 2011-05-08 19:03 363520 —-a-w- c:\windows\system32\StructuredQuery.dll
2011-05-08 19:03 . 2011-05-08 19:03 316928 —-a-w- c:\windows\system32\spoolsv.exe
2011-05-08 19:03 . 2011-05-08 19:03 1233920 —-a-w- c:\windows\system32\msxml3.dll
2011-05-08 19:02 . 2011-05-08 19:02 37376 —-a-w- c:\windows\system32\rtutils.dll
2011-05-08 19:02 . 2011-05-08 19:02 82944 —-a-w- c:\windows\system32\iccvid.dll
2011-05-08 19:02 . 2011-05-08 19:02 197632 —-a-w- c:\windows\system32\ir32_32.dll
2011-05-08 19:01 . 2011-05-08 19:01 99176 —-a-w- c:\windows\system32\PresentationHostProxy.dll
2011-05-08 19:01 . 2011-05-08 19:01 49472 —-a-w- c:\windows\system32\netfxperf.dll
2011-05-08 19:01 . 2011-05-08 19:01 295264 —-a-w- c:\windows\system32\PresentationHost.exe
2011-05-08 19:01 . 2011-05-08 19:01 1130824 —-a-w- c:\windows\system32\dfshim.dll
2011-05-08 19:01 . 2011-05-08 19:01 297808 —-a-w- c:\windows\system32\mscoree.dll
2011-05-08 19:00 . 2011-05-08 19:00 67584 —-a-w- c:\windows\system32\asycfilt.dll
.
.
——- Sigcheck ——-
Note: Unsigned files aren't necessarily malware.
.
[-] 2009-07-14 . 8626F0C30D4E3564FFDD25C90F4426F1 . 811520 . . [6.1.7600.16385] . . c:\windows\System32\user32.dll
[7] 2009-07-14 . 34B7E222E81FAFA885F0C5F2CFA56861 . 811520 . . [6.1.7600.16385] . . c:\windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_cd0ec264ceb014a3\user32.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Advanced SystemCare 4"="c:\program files\IObit\Advanced SystemCare 4\ASCTray.exe" [2011-04-15 402832]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SysTrayApp"="c:\program files\IDT\WDM\sttray.exe" [2009-03-12 483422]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 10.0\Reader\Reader_sl.exe" [2010-11-10 35736]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-11-10 932288]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-11-30 421888]
"IObit Security 360"="c:\program files\IObit\IObit Security 360\IS360tray.exe" [2010-06-12 1280344]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2011-06-08 421160]
"Malwarebytes' Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2011-07-07 1047656]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"AvgUninstallURL"="start http://www.avg.com/ww.special-uninstallati...r=9.0.894" [?]
"DeleteDir[48E] WIPE_48E.TMP"="RD" [X]
"GrpConv"="grpconv.exe -o" [X]
"InstallShieldSetup"="c:\progra~1\INSTAL~1\{E3A5A~1\setup.exe" [2004-07-16 117200]
"Uninstall Adobe Download Manager"="c:\program files\NOS\bin\getPlusUninst_Adobe.exe" [2010-11-29 39200]
"Spybot - Search & Destroy"="c:\program files\Spybot - Search & Destroy\SpybotSD.exe" [2009-01-26 5365592]
"Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2011-07-07 449584]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"mixer"=wdmaud.drv
.
[HKLM\~\startupfolder\C:^Users^Andrei^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Xfire.lnk]
path=c:\users\Andrei\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xfire.lnk
backup=c:\windows\pss\Xfire.lnk.Startup
backupExtension=.Startup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2011-06-08 00:51 421160 —-a-w- c:\program files\iTunes\iTunesHelper.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Pando Media Booster]
2011-01-15 22:15 3046808 —-a-w- c:\program files\Pando Networks\Media Booster\PMB.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2010-11-30 01:38 421888 —-a-w- c:\program files\QuickTime\QTTask.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
2010-10-12 00:49 14940040 —-a-r- c:\program files\Skype\Phone\Skype.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2010-02-18 18:43 248040 —-a-w- c:\program files\Common Files\Java\Java Update\jusched.exe
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R3 cpuz130;cpuz130;c:\users\Andrei\AppData\Local\Temp\cpuz130\cpuz_x32.sys [x]
R3 EagleXNt;EagleXNt;c:\windows\system32\drivers\EagleXNt.sys [x]
R3 GarenaPEngine;GarenaPEngine;c:\users\Andrei\AppData\Local\Temp\GAJ34A8.tmp [x]
R3 GGSAFERDriver;GGSAFER Driver;c:\program files\Garena\plugins\UI\safedrv.sys [x]
R3 nosGetPlusHelper;getPlus® Helper 3004;c:\windows\System32\svchost.exe [2009-07-14 20992]
R3 npggsvc;nProtect GameGuard Service;c:\windows\system32\GameMon.des [2010-02-16 3465452]
R3 XDva296;XDva296;c:\windows\system32\XDva296.sys [x]
R3 XDva332;XDva332;c:\windows\system32\XDva332.sys [x]
R3 XDva380;XDva380;c:\windows\system32\XDva380.sys [x]
R3 XDva383;XDva383;c:\windows\system32\XDva383.sys [x]
S0 amacpi;Microsoft Away Mode System;c:\windows\system32\DRIVERS\null.sys [2009-07-13 4608]
S2 AdvancedSystemCareService;Advanced SystemCare Service;c:\program files\IObit\Advanced SystemCare 4\ASCService.exe [2011-04-15 352144]
S2 Akamai;Akamai NetSession Interface;c:\windows\System32\svchost.exe [2009-07-14 20992]
S2 IS360service;IS360service;c:\program files\IObit\IObit Security 360\IS360srv.exe [2010-06-12 312152]
S2 SBSDWSCService;SBSD Security Center Service;c:\program files\Spybot - Search & Destroy\SDWinSec.exe [2009-01-26 1153368]
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
Akamai REG_MULTI_SZ Akamai
nosGetPlusHelper REG_MULTI_SZ nosGetPlusHelper
.
Contents of the 'Scheduled Tasks' folder
.
2011-07-23 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2889066225-3816148123-2408682452-1003Core.job
- c:\users\dreidrei\AppData\Local\Google\Update\GoogleUpdate.exe [2011-06-24 02:18]
.
2011-07-23 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2889066225-3816148123-2408682452-1003UA.job
- c:\users\dreidrei\AppData\Local\Google\Update\GoogleUpdate.exe [2011-06-24 02:18]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.youtube.com/
uInternet Settings,ProxyOverride = *.local
IE: Free YouTube to MP3 Converter - c:\users\Andrei\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm
IE: Save YouTube Video as MP3
TCP: DhcpNameServer = 192.168.2.1
FF - ProfilePath - c:\users\Andrei\AppData\Roaming\Mozilla\Firefox\Profiles\lvfa1lpa.default\
FF - prefs.js: browser.search.selectedEngine - AVG Secure Search
FF - prefs.js: keyword.URL - hxxp://search.avg.com/route/?d=4b14a11e&v=6.103.018.001&i=23&tp=ab&iy=b&ychte=us&lng=en-US&q=
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
FF - Ext: Yahoo! Toolbar: {635abd67-4fe9-1b23-4f01-e679fa7484c1} - %profile%\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
FF - Ext: DVDVideoSoft Menu: {ACAA314B-EEBA-48e4-AD47-84E31C44796C} - %profile%\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}
FF - user.js: yahoo.homepage.dontask - true
.
- - - - ORPHANS REMOVED - - - -
.
Toolbar-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
WebBrowser-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
MSConfigStartUp-BitTorrent DNA - c:\program files\DNA\btdna.exe
.
.
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\GarenaPEngine]
"ImagePath"="\??\c:\users\Andrei\AppData\Local\Temp\GAJ34A8.tmp"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\npggsvc]
"ImagePath"="c:\windows\system32\GameMon.des -service"
.
——————— LOCKED REGISTRY KEYS ———————
.
[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (LocalSystem)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,9a,86,3d,33,fc,4a,58,4c,a7,bc,c5,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,9a,86,3d,33,fc,4a,58,4c,a7,bc,c5,\
.
[HKEY_USERS\S-1-5-21-2889066225-3816148123-2408682452-1000\Software\SecuROM\License information*]
"datasecu"=hex:e0,1c,76,a7,f5,0d,fb,9a,7d,00,23,7a,6c,6c,dc,34,e4,5a,d1,da,09,
20,39,84,ea,93,67,7e,38,67,45,d1,81,73,89,35,92,2d,1b,95,55,ac,5d,b6,cd,66,\
"rkeysecu"=hex:26,19,59,83,b7,af,fa,b0,3b,42,28,b5,c1,33,0d,22
.
[HKEY_USERS\S-1-5-21-2889066225-3816148123-2408682452-1003\Software\SecuROM\License information*]
"datasecu"=hex:5c,f5,55,97,d3,79,14,13,94,37,c1,ff,8d,91,5b,8c,1b,2a,9f,22,b3,
78,21,c8,22,31,ea,b1,01,97,52,6f,66,86,41,e3,ab,10,8c,01,7b,24,68,07,55,1b,\
"rkeysecu"=hex:cb,bd,f2,61,5a,4e,c6,95,f2,29,8b,82,ba,6b,3d,44
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Completion time: 2011-07-22 19:37:22
ComboFix-quarantined-files.txt 2011-07-23 02:37
.
Pre-Run: 7,872,110,592 bytes free
Post-Run: 7,440,846,848 bytes free
.
- - End Of File - - 100F58F7B1CFE4EEFC717DD238240C08

ComboFix 11-07-19.03 - Andrei 07/23/2011 12:10:46.2.2 - x86
Microsoft Windows 7 Professional 6.1.7600.0.1252.1.1033.18.3054.2250 [GMT -7:00]
Running from: c:\users\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\users\dreidrei\Desktop\CFScript.txt
AV: avast! Antivirus *Disabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}
SP: avast! Antivirus *Disabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681}
SP: IObit Security 360 *Disabled/Updated* {FAE2835A-B90A-9E7A-85DA-82DBDA7C1E3A}
SP: Windows Defender *Enabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
.
————— FCopy —————
.
c:\windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_cd0ec264ceb014a3\user32.dll –> c:\windows\System32\user32.dll
.
((((((((((((((((((((((((( Files Created from 2011-06-23 to 2011-07-23 )))))))))))))))))))))))))))))))
.
.
2011-07-23 19:27 . 2011-07-23 19:27 ——– d—–w- c:\users\Default\AppData\Local\temp
2011-07-23 03:16 . 2011-07-23 07:30 ——– d—–w- c:\users\dreidrei\AppData\Roaming\.minecraft
2011-07-23 02:50 . 2011-07-04 11:36 309848 —-a-w- c:\windows\system32\drivers\aswSP.sys
2011-07-23 02:50 . 2011-07-04 11:32 19544 —-a-w- c:\windows\system32\drivers\aswFsBlk.sys
2011-07-23 02:50 . 2011-07-04 11:32 25432 —-a-w- c:\windows\system32\drivers\aswRdr.sys
2011-07-23 02:50 . 2011-07-04 11:35 43608 —-a-w- c:\windows\system32\drivers\aswTdi.sys
2011-07-23 02:50 . 2011-07-04 11:36 441176 —-a-w- c:\windows\system32\drivers\aswSnx.sys
2011-07-23 02:50 . 2011-07-04 11:32 54104 —-a-w- c:\windows\system32\drivers\aswMonFlt.sys
2011-07-23 02:49 . 2011-07-04 11:43 40112 —-a-w- c:\windows\avastSS.scr
2011-07-23 02:49 . 2011-07-04 11:43 199304 —-a-w- c:\windows\system32\aswBoot.exe
2011-07-23 02:49 . 2011-07-23 02:49 ——– d—–w- c:\programdata\AVAST Software
2011-07-23 02:49 . 2011-07-23 02:49 ——– d—–w- c:\program files\AVAST Software
2011-07-23 02:37 . 2011-07-23 19:27 ——– d—–w- c:\users\dreidrei\AppData\Local\temp
2011-07-23 02:37 . 2011-07-23 19:27 ——– d—–w- c:\users\Andrei\AppData\Local\temp
2011-07-21 21:41 . 2011-07-21 21:41 ——– d—–w- c:\users\dreidrei\AppData\Local\Microsoft Games
2011-07-21 21:09 . 2011-07-21 21:09 ——– d—–w- C:\_OTL
2011-07-20 23:45 . 2011-07-20 23:45 ——– d—–w- c:\users\dreidrei\AppData\Roaming\Malwarebytes
2011-07-20 23:43 . 2011-07-20 23:43 ——– d—–w- c:\users\Andrei\AppData\Roaming\Malwarebytes
2011-07-20 23:43 . 2011-07-20 23:43 ——– d—–w- c:\programdata\Malwarebytes
2011-07-20 23:43 . 2011-07-07 02:52 41272 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-07-20 23:43 . 2011-07-20 23:43 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2011-07-20 23:43 . 2011-07-07 02:52 22712 —-a-w- c:\windows\system32\drivers\mbam.sys
2011-07-20 21:50 . 2011-07-20 21:52 ——– d—–w- c:\program files\Spybot - Search & Destroy
2011-07-20 19:15 . 2011-07-20 19:15 759296 —-a-w- c:\program files\Common Files\Microsoft Shared\VGX\VGX.dll
2011-07-20 19:15 . 2011-07-20 19:15 311296 —-a-w- c:\windows\system32\drivers\srv.sys
2011-07-20 19:15 . 2011-07-20 19:15 309760 —-a-w- c:\windows\system32\drivers\srv2.sys
2011-07-20 19:15 . 2011-07-20 19:15 114176 —-a-w- c:\windows\system32\drivers\srvnet.sys
2011-07-20 19:15 . 2011-07-20 19:15 78336 —-a-w- c:\windows\system32\drivers\dfsc.sys
2011-07-20 19:14 . 2011-07-20 19:14 1286016 —-a-w- c:\windows\system32\drivers\tcpip.sys
2011-07-20 19:14 . 2011-07-20 19:14 338944 —-a-w- c:\windows\system32\drivers\afd.sys
2011-07-20 19:14 . 2011-07-20 19:14 571904 —-a-w- c:\windows\system32\oleaut32.dll
2011-07-20 19:07 . 2011-07-20 19:07 222720 —-a-w- c:\windows\system32\drivers\mrxsmb10.sys
2011-07-20 19:07 . 2011-07-20 19:07 96256 —-a-w- c:\windows\system32\drivers\mrxsmb20.sys
2011-07-20 19:07 . 2011-07-20 19:07 123392 —-a-w- c:\windows\system32\drivers\mrxsmb.sys
2011-07-20 19:07 . 2011-07-20 19:07 740864 —-a-w- c:\windows\system32\inetcomm.dll
2011-07-20 19:05 . 2011-07-20 19:05 123904 —-a-w- c:\windows\system32\poqexec.exe
2011-07-20 19:04 . 2011-07-20 19:04 28672 —-a-w- c:\windows\system32\dnscacheugc.exe
2011-07-20 19:04 . 2011-07-20 19:04 132608 —-a-w- c:\windows\system32\dnsrslvr.dll
2011-07-20 19:04 . 2011-07-20 19:04 428032 —-a-w- c:\windows\system32\vbscript.dll
2011-07-20 19:04 . 2011-07-20 19:04 34304 —-a-w- c:\windows\system32\atmlib.dll
2011-07-20 19:04 . 2011-07-20 19:04 294912 —-a-w- c:\windows\system32\atmfd.dll
2011-07-20 19:03 . 2011-07-20 19:03 191488 —-a-w- c:\windows\system32\FXSCOVER.exe
2011-07-20 19:03 . 2011-07-20 19:03 69632 —-a-w- c:\windows\system32\drivers\bowser.sys
2011-07-20 19:03 . 2011-07-20 19:03 1164288 —-a-w- c:\windows\system32\mfc42u.dll
2011-07-20 19:03 . 2011-07-20 19:03 1137664 —-a-w- c:\windows\system32\mfc42.dll
2011-07-20 19:02 . 2011-07-20 19:02 2690560 —-a-w- c:\windows\system32\mstscax.dll
2011-07-20 19:02 . 2011-07-20 19:02 1034240 —-a-w- c:\windows\system32\mstsc.exe
2011-07-20 19:02 . 2011-07-20 19:02 850432 —-a-w- c:\windows\system32\sbe.dll
2011-07-20 19:02 . 2011-07-20 19:02 642048 —-a-w- c:\windows\system32\CPFilters.dll
2011-07-20 19:02 . 2011-07-20 19:02 534528 —-a-w- c:\windows\system32\EncDec.dll
2011-07-20 19:02 . 2011-07-20 19:02 199680 —-a-w- c:\windows\system32\mpg2splt.ax
2011-07-20 19:02 . 2011-07-20 19:02 3957120 —-a-w- c:\windows\system32\ntkrnlpa.exe
2011-07-20 19:02 . 2011-07-20 19:02 3901824 —-a-w- c:\windows\system32\ntoskrnl.exe
2011-07-20 19:02 . 2011-07-20 19:02 1289536 —-a-w- c:\windows\system32\ntdll.dll
2011-07-20 19:01 . 2011-07-20 19:01 541184 —-a-w- c:\windows\system32\kerberos.dll
2011-07-20 19:01 . 2011-07-20 19:01 987136 —-a-w- c:\program files\Common Files\System\ado\msado15.dll
2011-07-20 19:01 . 2011-07-20 19:01 573440 —-a-w- c:\windows\system32\odbc32.dll
2011-07-20 19:01 . 2011-07-20 19:01 372736 —-a-w- c:\program files\Common Files\System\ado\msadox.dll
2011-07-20 19:01 . 2011-07-20 19:01 352256 —-a-w- c:\program files\Common Files\System\ado\msadomd.dll
2011-07-20 19:01 . 2011-07-20 19:01 208896 —-a-w- c:\program files\Common Files\System\msadc\msadco.dll
2011-07-20 19:00 . 2011-07-20 19:00 109056 —-a-w- c:\windows\system32\t2embed.dll
2011-07-20 19:00 . 2011-07-20 19:00 4247040 —-a-w- c:\program files\Windows NT\Accessories\wordpad.exe
2011-07-20 19:00 . 2011-07-20 19:00 1413632 —-a-w- c:\windows\system32\ole32.dll
2011-07-20 18:59 . 2011-07-20 18:59 954752 —-a-w- c:\windows\system32\mfc40.dll
2011-07-20 18:59 . 2011-07-20 18:59 954288 —-a-w- c:\windows\system32\mfc40u.dll
2011-07-20 18:59 . 2011-07-20 18:59 530432 —-a-w- c:\windows\system32\comctl32.dll
2011-07-20 18:59 . 2011-07-20 18:59 738816 —-a-w- c:\windows\system32\wmpmde.dll
2011-07-16 01:35 . 2011-07-16 01:36 ——– d—–w- c:\program files\Capsule
2011-07-09 04:04 . 2011-07-09 04:05 ——– d—–w- c:\users\dreidrei\AppData\Local\Green Man Gaming
2011-07-09 03:49 . 2011-07-09 04:00 ——– d—–w- c:\users\Andrei\AppData\Local\Green Man Gaming
2011-07-01 03:22 . 2011-07-01 03:22 ——– d—–w- c:\program files\Apple Software Update
2011-07-01 03:21 . 2011-07-01 03:21 ——– d—–w- c:\program files\iPod
2011-07-01 03:21 . 2011-07-01 03:22 ——– d—–w- c:\program files\iTunes
2011-07-01 03:19 . 2011-07-01 03:19 ——– d—–w- c:\program files\Bonjour
2011-06-28 03:14 . 2011-06-28 03:14 ——– d—–w- c:\users\dreidrei\AppData\Roaming\NVIDIA
2011-06-28 03:14 . 2010-06-02 11:55 239960 —-a-w- c:\windows\system32\xactengine3_7.dll
2011-06-28 03:14 . 2010-05-26 18:41 470880 —-a-w- c:\windows\system32\d3dx10_43.dll
2011-06-28 03:14 . 2010-05-26 18:41 1868128 —-a-w- c:\windows\system32\d3dcsx_43.dll
2011-06-28 03:14 . 2010-02-04 17:01 74072 —-a-w- c:\windows\system32\XAPOFX1_4.dll
2011-06-28 03:14 . 2010-02-04 17:01 528216 —-a-w- c:\windows\system32\XAudio2_6.dll
2011-06-28 03:14 . 2010-02-04 17:01 238936 —-a-w- c:\windows\system32\xactengine3_6.dll
2011-06-23 21:42 . 2011-06-23 21:42 ——– d—–w- c:\program files\LOLReplay
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-06-14 23:31 . 2011-06-14 23:31 15360 —-a-w- c:\windows\wpktui10.exe
2011-06-05 20:32 . 2011-06-05 20:32 404640 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-05-22 15:17 . 2011-05-22 15:17 4608 —-a-w- c:\windows\system32\w95inf32.dll
2011-05-22 15:17 . 2011-05-22 15:17 2272 —-a-w- c:\windows\system32\w95inf16.dll
2011-05-10 15:06 . 2011-05-10 15:06 4517664 —-a-w- c:\windows\system32\usbaaplrc.dll
2011-05-10 15:06 . 2011-05-10 15:06 42496 —-a-w- c:\windows\system32\drivers\usbaapl.sys
2011-05-08 19:05 . 2011-05-08 19:05 224256 —-a-w- c:\windows\system32\schannel.dll
2011-05-08 19:05 . 2011-05-08 19:05 101760 —-a-w- c:\windows\system32\consent.exe
2011-05-08 19:05 . 2011-05-08 19:05 314368 —-a-w- c:\windows\system32\webio.dll
2011-05-08 19:04 . 2011-05-08 19:04 749056 —-a-w- c:\windows\system32\schedsvc.dll
2011-05-08 19:04 . 2011-05-08 19:04 496128 —-a-w- c:\windows\system32\taskschd.dll
2011-05-08 19:04 . 2011-05-08 19:04 351232 —-a-w- c:\windows\system32\wmicmiplugin.dll
2011-05-08 19:04 . 2011-05-08 19:04 305152 —-a-w- c:\windows\system32\taskcomp.dll
2011-05-08 19:04 . 2011-05-08 19:04 192000 —-a-w- c:\windows\system32\taskeng.exe
2011-05-08 19:04 . 2011-05-08 19:04 179712 —-a-w- c:\windows\system32\schtasks.exe
2011-05-08 19:04 . 2011-05-08 19:04 12625408 —-a-w- c:\windows\system32\wmploc.DLL
2011-05-08 19:03 . 2011-05-08 19:03 363520 —-a-w- c:\windows\system32\StructuredQuery.dll
2011-05-08 19:03 . 2011-05-08 19:03 316928 —-a-w- c:\windows\system32\spoolsv.exe
2011-05-08 19:03 . 2011-05-08 19:03 1233920 —-a-w- c:\windows\system32\msxml3.dll
2011-05-08 19:02 . 2011-05-08 19:02 37376 —-a-w- c:\windows\system32\rtutils.dll
2011-05-08 19:02 . 2011-05-08 19:02 82944 —-a-w- c:\windows\system32\iccvid.dll
2011-05-08 19:02 . 2011-05-08 19:02 197632 —-a-w- c:\windows\system32\ir32_32.dll
2011-05-08 19:01 . 2011-05-08 19:01 99176 —-a-w- c:\windows\system32\PresentationHostProxy.dll
2011-05-08 19:01 . 2011-05-08 19:01 49472 —-a-w- c:\windows\system32\netfxperf.dll
2011-05-08 19:01 . 2011-05-08 19:01 295264 —-a-w- c:\windows\system32\PresentationHost.exe
2011-05-08 19:01 . 2011-05-08 19:01 1130824 —-a-w- c:\windows\system32\dfshim.dll
2011-05-08 19:01 . 2011-05-08 19:01 297808 —-a-w- c:\windows\system32\mscoree.dll
2011-05-08 19:00 . 2011-05-08 19:00 67584 —-a-w- c:\windows\system32\asycfilt.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2011-07-04 11:43 122512 —-a-w- c:\program files\AVAST Software\Avast\ashShell.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Advanced SystemCare 4"="c:\program files\IObit\Advanced SystemCare 4\ASCTray.exe" [2011-04-15 402832]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SysTrayApp"="c:\program files\IDT\WDM\sttray.exe" [2009-03-12 483422]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 10.0\Reader\Reader_sl.exe" [2010-11-10 35736]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-11-10 932288]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-11-30 421888]
"IObit Security 360"="c:\program files\IObit\IObit Security 360\IS360tray.exe" [2010-06-12 1280344]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2011-06-08 421160]
"Malwarebytes' Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2011-07-07 1047656]
"avast"="c:\program files\AVAST Software\Avast\avastUI.exe" [2011-07-04 3493720]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"AvgUninstallURL"="start http://www.avg.com/ww.special-uninstallati...r=9.0.894" [?]
"DeleteDir[48E] WIPE_48E.TMP"="RD" [X]
"GrpConv"="grpconv.exe -o" [X]
"InstallShieldSetup"="c:\progra~1\INSTAL~1\{E3A5A~1\setup.exe" [2004-07-16 117200]
"Uninstall Adobe Download Manager"="c:\program files\NOS\bin\getPlusUninst_Adobe.exe" [2010-11-29 39200]
"Spybot - Search & Destroy"="c:\program files\Spybot - Search & Destroy\SpybotSD.exe" [2009-01-26 5365592]
"Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2011-07-07 449584]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"mixer"=wdmaud.drv
.
[HKLM\~\startupfolder\C:^Users^Andrei^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Xfire.lnk]
path=c:\users\Andrei\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xfire.lnk
backup=c:\windows\pss\Xfire.lnk.Startup
backupExtension=.Startup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2011-06-08 00:51 421160 —-a-w- c:\program files\iTunes\iTunesHelper.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Pando Media Booster]
2011-01-15 22:15 3046808 —-a-w- c:\program files\Pando Networks\Media Booster\PMB.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2010-11-30 01:38 421888 —-a-w- c:\program files\QuickTime\QTTask.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
2010-10-12 00:49 14940040 —-a-r- c:\program files\Skype\Phone\Skype.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2010-02-18 18:43 248040 —-a-w- c:\program files\Common Files\Java\Java Update\jusched.exe
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R3 cpuz130;cpuz130;c:\users\Andrei\AppData\Local\Temp\cpuz130\cpuz_x32.sys [x]
R3 EagleXNt;EagleXNt;c:\windows\system32\drivers\EagleXNt.sys [x]
R3 GarenaPEngine;GarenaPEngine;c:\users\Andrei\AppData\Local\Temp\GAJ34A8.tmp [x]
R3 GGSAFERDriver;GGSAFER Driver;c:\program files\Garena\plugins\UI\safedrv.sys [x]
R3 nosGetPlusHelper;getPlus® Helper 3004;c:\windows\System32\svchost.exe [2009-07-14 20992]
R3 npggsvc;nProtect GameGuard Service;c:\windows\system32\GameMon.des [2010-02-16 3465452]
R3 XDva296;XDva296;c:\windows\system32\XDva296.sys [x]
R3 XDva332;XDva332;c:\windows\system32\XDva332.sys [x]
R3 XDva380;XDva380;c:\windows\system32\XDva380.sys [x]
R3 XDva383;XDva383;c:\windows\system32\XDva383.sys [x]
S0 amacpi;Microsoft Away Mode System;c:\windows\system32\DRIVERS\null.sys [2009-07-13 4608]
S1 aswSnx;aswSnx; [x]
S1 aswSP;aswSP; [x]
S2 AdvancedSystemCareService;Advanced SystemCare Service;c:\program files\IObit\Advanced SystemCare 4\ASCService.exe [2011-04-15 352144]
S2 Akamai;Akamai NetSession Interface;c:\windows\System32\svchost.exe [2009-07-14 20992]
S2 aswFsBlk;aswFsBlk; [x]
S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [2011-07-04 54104]
S2 IS360service;IS360service;c:\program files\IObit\IObit Security 360\IS360srv.exe [2010-06-12 312152]
S2 SBSDWSCService;SBSD Security Center Service;c:\program files\Spybot - Search & Destroy\SDWinSec.exe [2009-01-26 1153368]
.
.
— Other Services/Drivers In Memory —
.
*NewlyCreated* - ASWFSBLK
*NewlyCreated* - ASWMONFLT
*NewlyCreated* - ASWRDR
*NewlyCreated* - ASWSNX
*NewlyCreated* - ASWSP
*NewlyCreated* - ASWTDI
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
Akamai REG_MULTI_SZ Akamai
nosGetPlusHelper REG_MULTI_SZ nosGetPlusHelper
.
Contents of the 'Scheduled Tasks' folder
.
2011-07-23 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2889066225-3816148123-2408682452-1003Core.job
- c:\users\dreidrei\AppData\Local\Google\Update\GoogleUpdate.exe [2011-06-24 02:18]
.
2011-07-23 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2889066225-3816148123-2408682452-1003UA.job
- c:\users\dreidrei\AppData\Local\Google\Update\GoogleUpdate.exe [2011-06-24 02:18]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.youtube.com/
uInternet Settings,ProxyOverride = *.local
IE: Free YouTube to MP3 Converter - c:\users\Andrei\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm
IE: Save YouTube Video as MP3
TCP: DhcpNameServer = 192.168.2.1
FF - ProfilePath - c:\users\Andrei\AppData\Roaming\Mozilla\Firefox\Profiles\lvfa1lpa.default\
FF - prefs.js: browser.search.selectedEngine - AVG Secure Search
FF - prefs.js: keyword.URL - hxxp://search.avg.com/route/?d=4b14a11e&v=6.103.018.001&i=23&tp=ab&iy=b&ychte=us&lng=en-US&q=
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
FF - Ext: Yahoo! Toolbar: {635abd67-4fe9-1b23-4f01-e679fa7484c1} - %profile%\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
FF - Ext: DVDVideoSoft Menu: {ACAA314B-EEBA-48e4-AD47-84E31C44796C} - %profile%\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}
FF - user.js: yahoo.homepage.dontask - true
.
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\GarenaPEngine]
"ImagePath"="\??\c:\users\Andrei\AppData\Local\Temp\GAJ34A8.tmp"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\npggsvc]
"ImagePath"="c:\windows\system32\GameMon.des -service"
.
——————— LOCKED REGISTRY KEYS ———————
.
[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (LocalSystem)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,9a,86,3d,33,fc,4a,58,4c,a7,bc,c5,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,9a,86,3d,33,fc,4a,58,4c,a7,bc,c5,\
.
[HKEY_USERS\S-1-5-21-2889066225-3816148123-2408682452-1000\Software\SecuROM\License information*]
"datasecu"=hex:e0,1c,76,a7,f5,0d,fb,9a,7d,00,23,7a,6c,6c,dc,34,e4,5a,d1,da,09,
20,39,84,ea,93,67,7e,38,67,45,d1,81,73,89,35,92,2d,1b,95,55,ac,5d,b6,cd,66,\
"rkeysecu"=hex:26,19,59,83,b7,af,fa,b0,3b,42,28,b5,c1,33,0d,22
.
[HKEY_USERS\S-1-5-21-2889066225-3816148123-2408682452-1003\Software\SecuROM\License information*]
"datasecu"=hex:5c,f5,55,97,d3,79,14,13,94,37,c1,ff,8d,91,5b,8c,1b,2a,9f,22,b3,
78,21,c8,22,31,ea,b1,01,97,52,6f,66,86,41,e3,ab,10,8c,01,7b,24,68,07,55,1b,\
"rkeysecu"=hex:cb,bd,f2,61,5a,4e,c6,95,f2,29,8b,82,ba,6b,3d,44
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Completion time: 2011-07-23 12:42:06
ComboFix-quarantined-files.txt 2011-07-23 19:42
ComboFix2.txt 2011-07-23 02:37
.
Pre-Run: 6,417,797,120 bytes free
Post-Run: 6,134,976,512 bytes free
.
- - End Of File - - FA0575C3C915258B84E9745836CDB45C