Svchost.exe Trojan -- Malwarebytes cannot remove it

Hi there, recently I noticed that my task manager opens and closes immediately. I searched online and the people that have this problem have an infected svchost.exe. I ran Malwarebytes and it quarantined and deleted it, but after I reboot, the virus is still there.
I'll post the logs in a new post.

Malwarebytes' Anti-Malware 1.51.2.1300
www.malwarebytes.org

Database version: 7622

Windows 6.1.7601 Service Pack 1
Internet Explorer 8.0.7601.17514

2/10/2012 6:43:22 PM
mbam-log-2012-02-10 (18-43-22).txt

Scan type: Quick scan
Objects scanned: 38528
Time elapsed: 6 minute(s), 42 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 1
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 1

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\system32.exe (Trojan.MSIL) -> Value: system32.exe -> Quarantined and deleted successfully.

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
c:\Users\Jeffrey\AppData\Local\Temp\system32.exe (Trojan.MSIL) -> Quarantined and deleted successfully.


GMER 1.0.15.15641 - http://www.gmer.net
Rootkit scan 2012-06-06 15:21:46
Windows 6.1.7601 Service Pack 1
Running: hzoshslo.exe
---- Registry - GMER 1.0.15 ----
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg@s1 771343423
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg@s2 285507792
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg@h0 1
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0 0x00 0x00 0x00 0x00 ...
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0 0
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12 0xB2 0x51 0xCC 0x79 ...
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0 C:\Program Files (x86)\DAEMON Tools Pro\
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0 0x00 0x00 0x00 0x00 ...
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0 0
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12 0xB2 0x51 0xCC 0x79 ...
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0 C:\Program Files (x86)\DAEMON Tools Pro\
Reg HKCU\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Persisted@H:\Program Files (x86)\Battlefield 3\x2122\__Installer\vc\vc2008sp1\redist\vcredist_x64.exe 1
---- Files - GMER 1.0.15 ----
File C:\Program Files\COMODO\COMODO Internet Security\Quarantine\04D5A4E6-CCF6-4C1D-B289-AD0FCAEEAA74.data 5668903 bytes executable
File C:\Program Files\COMODO\COMODO Internet Security\Quarantine\04D5A4E6-CCF6-4C1D-B289-AD0FCAEEAA74.data.info 182 bytes
File C:\Program Files\COMODO\COMODO Internet Security\Quarantine\119AFD83-9D83-41E5-A247-5AEC391FF241.data 666112 bytes
File C:\Program Files\COMODO\COMODO Internet Security\Quarantine\119AFD83-9D83-41E5-A247-5AEC391FF241.data.info 188 bytes
File C:\Program Files\COMODO\COMODO Internet Security\Quarantine\1853859B-F56B-44D5-9069-96989FC54BF7.data 93656 bytes executable
File C:\Program Files\COMODO\COMODO Internet Security\Quarantine\1853859B-F56B-44D5-9069-96989FC54BF7.data.info 206 bytes
File C:\Program Files\COMODO\COMODO Internet Security\Quarantine\263CDA10-155C-41BC-BD14-21F9E9783E80.data 4609364 bytes executable
File C:\Program Files\COMODO\COMODO Internet Security\Quarantine\263CDA10-155C-41BC-BD14-21F9E9783E80.data.info 234 bytes
File C:\Program Files\COMODO\COMODO Internet Security\Quarantine\29F1E1F9-26F7-418E-910A-D4FA20F65E69.data 97833 bytes executable
File C:\Program Files\COMODO\COMODO Internet Security\Quarantine\Keygen DI v1.9.exe1.info 172 bytes
File C:\Program Files\COMODO\COMODO Internet Security\Quarantine\Keygen DI v1.9.exe2 2691584 bytes
File C:\Program Files\COMODO\COMODO Internet Security\Quarantine\Keygen DI v1.9.exe2.info 230 bytes
File C:\Program Files\COMODO\COMODO Internet Security\Quarantine\Keygen DI v1.9.exe3 2691584 bytes
File C:\Program Files\COMODO\COMODO Internet Security\Quarantine\Keygen DI v1.9.exe3.info 230 bytes
File C:\Program Files\COMODO\COMODO Internet Security\Quarantine\paul.dll 446976 bytes executable
File C:\Program Files\COMODO\COMODO Internet Security\Quarantine\paul.dll.info 196 bytes
File C:\Program Files\COMODO\COMODO Internet Security\Quarantine\paul.dll1 446976 bytes executable
File C:\Program Files\COMODO\COMODO Internet Security\Quarantine\paul.dll1.info 196 bytes
File C:\Program Files\COMODO\COMODO Internet Security\Quarantine\dvt-fnv.exe1.info 186 bytes
File C:\Program Files\COMODO\COMODO Internet Security\Quarantine\dvt-fnv.exe2 220160 bytes executable
File C:\Program Files\COMODO\COMODO Internet Security\Quarantine\dvt-fnv.exe2.info 186 bytes
File C:\Program Files\COMODO\COMODO Internet Security\Quarantine\dvt-fnv.exe3 220160 bytes executable
File C:\Program Files\COMODO\COMODO Internet Security\Quarantine\dvt-fnv.exe3.info 186 bytes
File C:\Program Files\COMODO\COMODO Internet Security\Quarantine\dvt-fnv.exe4 220160 bytes executable
File C:\Program Files\COMODO\COMODO Internet Security\Quarantine\dvt-fnv.exe4.info 186 bytes
File C:\Program Files\COMODO\COMODO Internet Security\Quarantine\dvt-fnv.exe5 220160 bytes executable
File C:\Program Files\COMODO\COMODO Internet Security\Quarantine\dvt-fnv.exe5.info 186 bytes
File C:\Program Files\COMODO\COMODO Internet Security\Quarantine\dvt-fnv.exe6 220160 bytes executable
File C:\Program Files\COMODO\COMODO Internet Security\Quarantine\dvt-fnv.exe6.info 186 bytes
File C:\Program Files\COMODO\COMODO Internet Security\Quarantine\dvt-fnv.exe7 220160 bytes executable
File C:\Program Files\COMODO\COMODO Internet Security\Quarantine\dvt-fnv.exe7.info 186 bytes
File C:\Program Files\COMODO\COMODO Internet Security\Quarantine\dvt-fnv.exe8 220160 bytes executable
File C:\Program Files\COMODO\COMODO Internet Security\Quarantine\dvt-fnv.exe8.info 186 bytes
File C:\Program Files\COMODO\COMODO Internet Security\Quarantine\paul.dll2.info 168 bytes
File C:\Program Files\COMODO\COMODO Internet Security\Quarantine\paul.dll3 446976 bytes executable
File C:\Program Files\COMODO\COMODO Internet Security\Quarantine\paul.dll3.info 232 bytes
File C:\Program Files\COMODO\COMODO Internet Security\Quarantine\paul.dll4 446976 bytes executable
File C:\Program Files\COMODO\COMODO Internet Security\Quarantine\paul.dll4.info 168 bytes
File C:\Program Files\COMODO\COMODO Internet Security\Quarantine\paul.dll5 444416 bytes executable
File C:\Program Files\COMODO\COMODO Internet Security\Quarantine\paul.dll5.info 204 bytes
File C:\Program Files\COMODO\COMODO Internet Security\Quarantine\paul.dll6 444416 bytes executable
File C:\Program Files\COMODO\COMODO Internet Security\Quarantine\paul.dll6.info 152 bytes
File C:\Program Files\COMODO\COMODO Internet Security\Quarantine\paul.dll7 446976 bytes executable
File C:\Program Files\COMODO\COMODO Internet Security\Quarantine\paul.dll7.info 232 bytes
File C:\Program Files\COMODO\COMODO Internet Security\Quarantine\paul.dll8 444416 bytes executable
File C:\Program Files\COMODO\COMODO Internet Security\Quarantine\paul.dll8.info 152 bytes
File C:\Program Files\COMODO\COMODO Internet Security\Quarantine\paul.dll9 444416 bytes executable
File C:\Program Files\COMODO\COMODO Internet Security\Quarantine\paul.dll9.info 214 bytes
File C:\Program Files\COMODO\COMODO Internet Security\Quarantine\Play.dll 36548 bytes executable
File C:\Program Files\COMODO\COMODO Internet Security\Quarantine\Play.dll.info 180 bytes
File C:\Program Files\COMODO\COMODO Internet Security\Quarantine\RAGE+18Tr-LinGon.exe 2579456 bytes executable
File C:\Program Files\COMODO\COMODO Internet Security\Quarantine\RAGE+18Tr-LinGon.exe.info 238 bytes
File C:\Program Files\COMODO\COMODO Internet Security\Quarantine\reloaded.dll 8192 bytes
File C:\Program Files\COMODO\COMODO Internet Security\Quarantine\reloaded.dll.info 204 bytes
File C:\Program Files\COMODO\COMODO Internet Security\Quarantine\runBanner[1].aspx 3621 bytes
File C:\Program Files\COMODO\COMODO Internet Security\Quarantine\runBanner[1].aspx.info 330 bytes
File C:\Program Files\COMODO\COMODO Internet Security\Quarantine\SKIDROW.exe 572928 bytes executable
File C:\Program Files\COMODO\COMODO Internet Security\Quarantine\SKIDROW.exe.info 206 bytes
File C:\Program Files\COMODO\COMODO Internet Security\Quarantine\SKIDROW.exe1 573440 bytes executable
File C:\Program Files\COMODO\COMODO Internet Security\Quarantine\29F1E1F9-26F7-418E-910A-D4FA20F65E69.data.info 180 bytes
File C:\Program Files\COMODO\COMODO Internet Security\Quarantine\4E650279-E1E7-442D-A08A-E944C3743123.data.info 140 bytes
File C:\Program Files\COMODO\COMODO Internet Security\Quarantine\6903FD37-FEE0-41D6-85F7-2013D5A253F6.data 84029 bytes
File C:\Program Files\COMODO\COMODO Internet Security\Quarantine\ARMA2Patch_1_09.exe.info 246 bytes
File C:\Program Files\COMODO\COMODO Internet Security\Quarantine\brew-b131.exe1 520704 bytes executable
File C:\Program Files\COMODO\COMODO Internet Security\Quarantine\bws-scs10.exe 40960 bytes executable
File C:\Program Files\COMODO\COMODO Internet Security\Quarantine\devdll.dll 30208 bytes executable
File C:\Program Files\COMODO\COMODO Internet Security\Quarantine\dvt-fnv.exe1 220160 bytes executable
File C:\Program Files\COMODO\COMODO Internet Security\Quarantine\FalloutNVLauncher.exe.info 216 bytes
File C:\Program Files\COMODO\COMODO Internet Security\Quarantine\Keygen DI v1.9.exe1 2691584 bytes
File C:\Program Files\COMODO\COMODO Internet Security\Quarantine\paul.dll2 446976 bytes executable
File C:\Program Files\COMODO\COMODO Internet Security\Quarantine\SKIDROW.exe1.info 206 bytes
File C:\Program Files\COMODO\COMODO Internet Security\Quarantine\Stalker Clear Sky Promo Trainer.exe2 1331200 bytes executable
File C:\Program Files\COMODO\COMODO Internet Security\Quarantine\devdll.dll.info 92 bytes
File C:\Program Files\COMODO\COMODO Internet Security\Quarantine\devdll.dll1 30208 bytes executable
File C:\Program Files\COMODO\COMODO Internet Security\Quarantine\devdll.dll1.info 92 bytes
File C:\Program Files\COMODO\COMODO Internet Security\Quarantine\DI+20Tr-LinGon.exe 2267648 bytes executable
File C:\Program Files\COMODO\COMODO Internet Security\Quarantine\DI+20Tr-LinGon.exe.info 230 bytes
File C:\Program Files\COMODO\COMODO Internet Security\Quarantine\DI+20Tr-LinGon.exe1 2267648 bytes executable
File C:\Program Files\COMODO\COMODO Internet Security\Quarantine\DI+20Tr-LinGon.exe1.info 230 bytes
File C:\Program Files\COMODO\COMODO Internet Security\Quarantine\DI+25Tr-LinGon.exe 2568192 bytes executable
File C:\Program Files\COMODO\COMODO Internet Security\Quarantine\DI+25Tr-LinGon.exe.info 230 bytes
File C:\Program Files\COMODO\COMODO Internet Security\Quarantine\DI+25Tr-LinGon.exe1 2568192 bytes executable
File C:\Program Files\COMODO\COMODO Internet Security\Quarantine\DI+25Tr-LinGon.exe1.info 230 bytes
File C:\Program Files\COMODO\COMODO Internet Security\Quarantine\dvt-fnv.exe 220160 bytes executable
File C:\Program Files\COMODO\COMODO Internet Security\Quarantine\dvt-fnv.exe.info 150 bytes
File C:\Program Files\COMODO\COMODO Internet Security\Quarantine\E2C9934E-0135-4219-AE8A-F0B7B83DA29A.data 286208 bytes executable
File C:\Program Files\COMODO\COMODO Internet Security\Quarantine\E2C9934E-0135-4219-AE8A-F0B7B83DA29A.data.info 164 bytes
File C:\Program Files\COMODO\COMODO Internet Security\Quarantine\E55688D6-A710-4A86-9CBB-03DAD49F95B2.data 97921 bytes
File C:\Program Files\COMODO\COMODO Internet Security\Quarantine\E55688D6-A710-4A86-9CBB-03DAD49F95B2.data.info 200 bytes
File C:\Program Files\COMODO\COMODO Internet Security\Quarantine\EBAD1F67-2B4C-491D-92F0-E13098E892BF.data 286208 bytes executable
File C:\Program Files\COMODO\COMODO Internet Security\Quarantine\EBAD1F67-2B4C-491D-92F0-E13098E892BF.data.info 164 bytes
File C:\Program Files\COMODO\COMODO Internet Security\Quarantine\ext-stalker_cs_p11.exe 36212 bytes executable
File C:\Program Files\COMODO\COMODO Internet Security\Quarantine\ext-stalker_cs_p11.exe.info 214 bytes
File C:\Program Files\COMODO\COMODO Internet Security\Quarantine\F139BD94-C8EA-40AE-B2D1-2654539BB789.data 93568 bytes
File C:\Program Files\COMODO\COMODO Internet Security\Quarantine\F139BD94-C8EA-40AE-B2D1-2654539BB789.data.info 206 bytes
File C:\Program Files\COMODO\COMODO Internet Security\Quarantine\F60524A4-43D6-4A96-A8A2-212E75113329.data 20468 bytes
File C:\Program Files\COMODO\COMODO Internet Security\Quarantine\F60524A4-43D6-4A96-A8A2-212E75113329.data.info 206 bytes
File C:\Program Files\COMODO\COMODO Internet Security\Quarantine\FalloutNVLauncher.exe 2068992 bytes executable
File C:\Program Files\COMODO\COMODO Internet Security\Quarantine\brew-b131.exe1.info 190 bytes
File C:\Program Files\COMODO\COMODO Internet Security\Quarantine\brew-b131.exe2 520704 bytes executable
File C:\Program Files\COMODO\COMODO Internet Security\Quarantine\brew-b131.exe2.info 190 bytes
File C:\Program Files\COMODO\COMODO Internet Security\Quarantine\brew-b131.exe3 520704 bytes executable
File C:\Program Files\COMODO\COMODO Internet Security\Quarantine\brew-b131.exe3.info 190 bytes
File C:\Program Files\COMODO\COMODO Internet Security\Quarantine\brew-dsu1.exe 413184 bytes executable
File C:\Program Files\COMODO\COMODO Internet Security\Quarantine\brew-dsu1.exe.info 138 bytes
File C:\Program Files\COMODO\COMODO Internet Security\Quarantine\Stalker Clear Sky Promo Trainer.exe2.info 172 bytes
File C:\Program Files\COMODO\COMODO Internet Security\Quarantine\Temp 0 bytes
File C:\Program Files\COMODO\COMODO Internet Security\Quarantine\Temp\baseupd 0 bytes
File C:\Program Files\COMODO\COMODO Internet Security\Quarantine\Trainer.dll 114688 bytes executable
File C:\Program Files\COMODO\COMODO Internet Security\Quarantine\Trainer.dll.info 94 bytes
File C:\Program Files\COMODO\COMODO Internet Security\Quarantine\TW2+8Tr-LinGon.exe 2268160 bytes executable
File C:\Program Files\COMODO\COMODO Internet Security\Quarantine\TW2+8Tr-LinGon.exe.info 230 bytes
File C:\Program Files\COMODO\COMODO Internet Security\Quarantine\whysosrs.DLL 105472 bytes
File C:\Program Files\COMODO\COMODO Internet Security\Quarantine\whysosrs.DLL.info 182 bytes
File C:\Program Files\COMODO\COMODO Internet Security\Quarantine\SKIDROW.exe2 573440 bytes executable
File C:\Program Files\COMODO\COMODO Internet Security\Quarantine\SKIDROW.exe2.info 206 bytes
File C:\Program Files\COMODO\COMODO Internet Security\Quarantine\SKIDROW.exe3 573440 bytes executable
File C:\Program Files\COMODO\COMODO Internet Security\Quarantine\SKIDROW.exe3.info 206 bytes
File C:\Program Files\COMODO\COMODO Internet Security\Quarantine\Stalker Clear Sky Promo Trainer.exe 1331200 bytes executable
File C:\Program Files\COMODO\COMODO Internet Security\Quarantine\Stalker Clear Sky Promo Trainer.exe.info 232 bytes
File C:\Program Files\COMODO\COMODO Internet Security\Quarantine\Stalker Clear Sky Promo Trainer.exe1 1331200 bytes executable
File C:\Program Files\COMODO\COMODO Internet Security\Quarantine\Stalker Clear Sky Promo Trainer.exe1.info 172 bytes
File C:\Program Files\COMODO\COMODO Internet Security\Quarantine\87BDFB05-9D1B-461C-8023-BC1E8C09FC86.data 589824 bytes executable
File C:\Program Files\COMODO\COMODO Internet Security\Quarantine\87BDFB05-9D1B-461C-8023-BC1E8C09FC86.data.info 168 bytes
File C:\Program Files\COMODO\COMODO Internet Security\Quarantine\9C47231C-5849-45E4-9CFD-9DFAFC0E28B2.data 4939776 bytes
File C:\Program Files\COMODO\COMODO Internet Security\Quarantine\9C47231C-5849-45E4-9CFD-9DFAFC0E28B2.data.info 236 bytes
File C:\Program Files\COMODO\COMODO Internet Security\Quarantine\A0ECAC6C-F203-4D36-919B-F2CDBE8055B6.data 3931648 bytes executable
File C:\Program Files\COMODO\COMODO Internet Security\Quarantine\A0ECAC6C-F203-4D36-919B-F2CDBE8055B6.data.info 162 bytes
File C:\Program Files\COMODO\COMODO Internet Security\Quarantine\A7B68294-4C1D-4E6C-A64D-075D429CD021.data 2519248 bytes executable
File C:\Program Files\COMODO\COMODO Internet Security\Quarantine\A7B68294-4C1D-4E6C-A64D-075D429CD021.data.info 202 bytes
File C:\Program Files\COMODO\COMODO Internet Security\Quarantine\ARMA2Patch_1_09.exe 1536 bytes executable
File C:\Program Files\COMODO\COMODO Internet Security\Quarantine\bws-scs10.exe.info 190 bytes
File C:\Program Files\COMODO\COMODO Internet Security\Quarantine\C4E3CDEF-DF03-4E1F-BD0D-9E2308D4C673.data 2126848 bytes executable
File C:\Program Files\COMODO\COMODO Internet Security\Quarantine\C4E3CDEF-DF03-4E1F-BD0D-9E2308D4C673.data.info 220 bytes
File C:\Program Files\COMODO\COMODO Internet Security\Quarantine\C620C30E-A4E3-4AF1-A8CD-FD1335B1D6D9.data 314544 bytes executable
File C:\Program Files\COMODO\COMODO Internet Security\Quarantine\C620C30E-A4E3-4AF1-A8CD-FD1335B1D6D9.data.info 190 bytes
File C:\Program Files\COMODO\COMODO Internet Security\Quarantine\CD0B0DA4-0F02-4146-9C99-C67FE7F679CB.data 24576 bytes executable
File C:\Program Files\COMODO\COMODO Internet Security\Quarantine\CD0B0DA4-0F02-4146-9C99-C67FE7F679CB.data.info 164 bytes
File C:\Program Files\COMODO\COMODO Internet Security\Quarantine\D2836CDB-90D8-4235-9AE1-2DDBA677E831.data 36212 bytes executable
File C:\Program Files\COMODO\COMODO Internet Security\Quarantine\D2836CDB-90D8-4235-9AE1-2DDBA677E831.data.info 178 bytes
File C:\Program Files\COMODO\COMODO Internet Security\Quarantine\4eEZSETP.dll 219192 bytes
File C:\Program Files\COMODO\COMODO Internet Security\Quarantine\4eEZSETP.dll.info 222 bytes
File C:\Program Files\COMODO\COMODO Internet Security\Quarantine\4eEZSETP.dll1 219192 bytes
File C:\Program Files\COMODO\COMODO Internet Security\Quarantine\4eEZSETP.dll1.info 222 bytes
File C:\Program Files\COMODO\COMODO Internet Security\Quarantine\4eEZSETP.dll2 219192 bytes
File C:\Program Files\COMODO\COMODO Internet Security\Quarantine\4eEZSETP.dll2.info 222 bytes
File C:\Program Files\COMODO\COMODO Internet Security\Quarantine\60FB3122-D568-424A-8BE9-DBEAC6FBAE6A.data 509952 bytes
File C:\Program Files\COMODO\COMODO Internet Security\Quarantine\60FB3122-D568-424A-8BE9-DBEAC6FBAE6A.data.info 176 bytes
File C:\Program Files\COMODO\COMODO Internet Security\Quarantine\B01B7545-B7ED-4FE8-B8D3-8071B0C8C7B8.data 589824 bytes executable
File C:\Program Files\COMODO\COMODO Internet Security\Quarantine\B01B7545-B7ED-4FE8-B8D3-8071B0C8C7B8.data.info 168 bytes
File C:\Program Files\COMODO\COMODO Internet Security\Quarantine\B3F48BFB-6B7D-4A48-B78A-85D1F26ED502.data 1538569 bytes executable
File C:\Program Files\COMODO\COMODO Internet Security\Quarantine\B3F48BFB-6B7D-4A48-B78A-85D1F26ED502.data.info 154 bytes
File C:\Program Files\COMODO\COMODO Internet Security\Quarantine\Batman Trainer.exe 1361920 bytes executable
File C:\Program Files\COMODO\COMODO Internet Security\Quarantine\Batman Trainer.exe.info 176 bytes
File C:\Program Files\COMODO\COMODO Internet Security\Quarantine\brew-b131.exe 520704 bytes executable
File C:\Program Files\COMODO\COMODO Internet Security\Quarantine\brew-b131.exe.info 190 bytes
File C:\Program Files\COMODO\COMODO Internet Security\Quarantine\29F97D2D-AF67-4693-9765-D3B574E93AB7.data 286208 bytes executable
File C:\Program Files\COMODO\COMODO Internet Security\Quarantine\29F97D2D-AF67-4693-9765-D3B574E93AB7.data.info 164 bytes
File C:\Program Files\COMODO\COMODO Internet Security\Quarantine\36C1D244-7558-4471-87DA-AF774BBD7534.data 589824 bytes executable
File C:\Program Files\COMODO\COMODO Internet Security\Quarantine\36C1D244-7558-4471-87DA-AF774BBD7534.data.info 170 bytes
File C:\Program Files\COMODO\COMODO Internet Security\Quarantine\3B2D2C77-55EC-457D-9DA6-39187C3ED609.data 356352 bytes executable
File C:\Program Files\COMODO\COMODO Internet Security\Quarantine\3B2D2C77-55EC-457D-9DA6-39187C3ED609.data.info 254 bytes
File C:\Program Files\COMODO\COMODO Internet Security\Quarantine\44752639-4222-4AC4-B85B-96C9921D7959.data 356352 bytes executable
File C:\Program Files\COMODO\COMODO Internet Security\Quarantine\44752639-4222-4AC4-B85B-96C9921D7959.data.info 204 bytes
File C:\Program Files\COMODO\COMODO Internet Security\Quarantine\4D159DA7-D9AD-4AE4-A426-A677576C060E.data 35566 bytes
File C:\Program Files\COMODO\COMODO Internet Security\Quarantine\4D159DA7-D9AD-4AE4-A426-A677576C060E.data.info 220 bytes
File C:\Program Files\COMODO\COMODO Internet Security\Quarantine\4E650279-E1E7-442D-A08A-E944C3743123.data 40960 bytes executable
File C:\Program Files\COMODO\COMODO Internet Security\Quarantine\FalloutNVLauncher.exe1 2068992 bytes executable
File C:\Program Files\COMODO\COMODO Internet Security\Quarantine\FalloutNVLauncher.exe1.info 248 bytes
File C:\Program Files\COMODO\COMODO Internet Security\Quarantine\iRRM_TES4_D3D9.exe 22528 bytes executable
File C:\Program Files\COMODO\COMODO Internet Security\Quarantine\iRRM_TES4_D3D9.exe.info 162 bytes
File C:\Program Files\COMODO\COMODO Internet Security\Quarantine\iRRM_TES4_Trainer.exe 97833 bytes executable
File C:\Program Files\COMODO\COMODO Internet Security\Quarantine\iRRM_TES4_Trainer.exe.info 216 bytes
File C:\Program Files\COMODO\COMODO Internet Security\Quarantine\Keygen DI v1.9.exe 2691584 bytes
File C:\Program Files\COMODO\COMODO Internet Security\Quarantine\Keygen DI v1.9.exe.info 230 bytes
File C:\Program Files\COMODO\COMODO Internet Security\Quarantine\D67E06F9-E2E9-4E08-97DB-300AB291849E.data 189440 bytes executable
File C:\Program Files\COMODO\COMODO Internet Security\Quarantine\D67E06F9-E2E9-4E08-97DB-300AB291849E.data.info 206 bytes
File C:\Program Files\COMODO\COMODO Internet Security\Quarantine\DC22A695-DF2B-45DF-B5A4-4B6F62DAE243.data 40960 bytes executable
File C:\Program Files\COMODO\COMODO Internet Security\Quarantine\DC22A695-DF2B-45DF-B5A4-4B6F62DAE243.data.info 174 bytes
File C:\Program Files\COMODO\COMODO Internet Security\Quarantine\DD39FBAB-19DA-45ED-A1D1-7054AD8196F9.data 2415104 bytes executable
File C:\Program Files\COMODO\COMODO Internet Security\Quarantine\DD39FBAB-19DA-45ED-A1D1-7054AD8196F9.data.info 134 bytes
File C:\Program Files\COMODO\COMODO Internet Security\Quarantine\6903FD37-FEE0-41D6-85F7-2013D5A253F6.data.info 272 bytes
File C:\Program Files\COMODO\COMODO Internet Security\Quarantine\6ED8B599-4426-4101-A78F-BC4C786EA69A.data 97921 bytes
File C:\Program Files\COMODO\COMODO Internet Security\Quarantine\6ED8B599-4426-4101-A78F-BC4C786EA69A.data.info 200 bytes
File C:\Program Files\COMODO\COMODO Internet Security\Quarantine\7230BDC0-4D1D-4562-874F-C8093FB045FA.data 286208 bytes executable
File C:\Program Files\COMODO\COMODO Internet Security\Quarantine\7230BDC0-4D1D-4562-874F-C8093FB045FA.data.info 164 bytes
File C:\Program Files\COMODO\COMODO Internet Security\Quarantine\72F53ABA-595D-454B-9014-7948E650F189.data 40960 bytes executable
File C:\Program Files\COMODO\COMODO Internet Security\Quarantine\72F53ABA-595D-454B-9014-7948E650F189.data.info 176 bytes
---- EOF - GMER 1.0.15 ----

DDS log
.
DDS (Ver_2011-08-26.01) - NTFSAMD64
Internet Explorer: 9.0.8112.16421 BrowserJavaVersion: 1.6.0_31
Run by Admin at 15:23:02 on 2012-06-06
Microsoft Windows 7 Ultimate 6.1.7601.1.1252.1.1033.18.4096.2358 [GMT -4:00]
.
AV: COMODO Antivirus *Enabled/Updated* {458BB331-2324-0753-3D5F-1472EB102AC0}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
SP: COMODO Defense+ *Disabled/Updated* {FEEA52D5-051E-08DD-07EF-2F009097607D}
FW: COMODO Firewall *Enabled* {7DB03214-694B-060B-1600-BD4715C36DBB}
.
============== Running Processes ===============
.
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\nvvsvc.exe
C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
C:\Windows\system32\svchost.exe -k RPCSS
C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k LocalService
C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
C:\Windows\system32\nvvsvc.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
C:\Windows\system32\svchost.exe -k apphost
C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files (x86)\Bonjour\mDNSResponder.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
C:\Windows\SysWOW64\PnkBstrA.exe
C:\Windows\system32\svchost.exe -k imgsvc
C:\Program Files (x86)\TeamViewer\Version7\TeamViewer_Service.exe
C:\Windows\system32\svchost.exe -k iissvcs
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
C:\Windows\system32\SearchIndexer.exe
C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
C:\Windows\system32\taskhost.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\COMODO\COMODO Internet Security\cfp.exe
C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
C:\Program Files (x86)\DAEMON Tools Pro\DTShellHlp.exe
C:\Users\Jeffrey\AppData\Roaming\MsMpEng.exe
C:\Program Files\Logitech\SetPoint II\SetPointII.exe
C:\Program Files (x86)\ScanSoft\PaperPort\pptd40nt.exe
C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE
C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
C:\Program Files (x86)\Browny02\BrYNSvc.exe
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
C:\Users\Jeffrey\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Jeffrey\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Jeffrey\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Windows\SysWOW64\rundll32.exe
C:\Users\Jeffrey\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
C:\Windows\System32\svchost.exe -k secsvcs
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Windows\system32\taskhost.exe
C:\Program Files (x86)\DAEMON Tools Pro\DTShellHlp.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\conhost.exe
C:\Windows\SysWOW64\cscript.exe
.
============== Pseudo HJT Report ===============
.
uInternet Settings,ProxyOverride = *.local
uURLSearchHooks: H - No File
mURLSearchHooks: uTorrentBar Toolbar: {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - C:\Program Files (x86)\uTorrentBar\prxtbuTo2.dll
mWinlogon: Userinit=userinit.exe,
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
BHO: Java(tm) Plug-In SSV Helper: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll
BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
BHO: Office Document Cache Handler: {b4f3a835-0e21-4959-ba22-42b3008e02ff} - C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL
BHO: uTorrentBar Toolbar: {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - C:\Program Files (x86)\uTorrentBar\prxtbuTo2.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
TB: {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - No File
TB: uTorrentBar Toolbar: {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - C:\Program Files (x86)\uTorrentBar\prxtbuTo2.dll
uRun: [DAEMON Tools Pro Agent] "C:\Program Files (x86)\DAEMON Tools Pro\DTAgent.exe" -autorun
uRun: [AutoScreenshotMaker]
uRun: [StartMenuX] C:\Program Files\Start Menu X\StartMenuX.exe
uRun: [ooVoo.exe] C:\Program Files (x86)\ooVoo\oovoo.exe /minimized
uRun: [Google Update] "C:\Users\Admin\AppData\Local\Google\Update\GoogleUpdate.exe" /c
uRun: [RGSC] D:\Program Files\Rockstar Games\Rockstar Games Social Club\RGSCLauncher.exe /silent
mRun: [amd_dc_opt] C:\Program Files (x86)\AMD\Dual-Core Optimizer\amd_dc_opt.exe
mRun: [BrStsWnd] C:\Program Files (x86)\Brownie\BrstsW64.exe Autorun
mRun: [SSBkgdUpdate] "C:\Program Files (x86)\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
mRun: [PaperPort PTD] "C:\Program Files (x86)\ScanSoft\PaperPort\pptd40nt.exe"
mRun: [IndexSearch] "C:\Program Files (x86)\ScanSoft\PaperPort\IndexSearch.exe"
mRun: [PPort11reminder] "C:\Program Files (x86)\ScanSoft\PaperPort\Ereg\Ereg.exe" -r "C:\ProgramData\ScanSoft\PaperPort\11\Config\Ereg\Ereg.ini"
mRun: [ControlCenter3] C:\Program Files (x86)\Brother\ControlCenter3\brctrcen.exe /autorun
mRun: [BrStsMon00] C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe /AUTORUN
mRun: [SwitchBoard] C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
mRun: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
mRun: [AdobeCS5.5ServiceManager] "C:\Program Files (x86)\Common Files\Adobe\CS5.5ServiceManager\CS5.5ServiceManager.exe" -launchedbylogin
mRun: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\SETPOI~1.LNK - C:\Program Files (x86)\Logitech\SetPoint II\SetPointII.exe
mPolicies-explorer: NoActiveDesktop = 1 (0x1)
mPolicies-explorer: NoActiveDesktopChanges = 1 (0x1)
mPolicies-system: ConsentPromptBehaviorAdmin = 5 (0x5)
mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
mPolicies-system: PromptOnSecureDesktop = 0 (0x0)
IE: E&xport to Microsoft Excel - C:\PROGRA~1\MICROS~2\Office14\EXCEL.EXE/3000
IE: Free YouTube to MP3 Converter - C:\Users\Admin\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm
IE: Se&nd to OneNote - C:\PROGRA~1\MICROS~2\Office14\ONBttnIE.dll/105
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxps://fpdownload.macromedia.com/get/shockwave/cabs/flash/swflash.cab
DPF: {DB9DE2A8-D1BA-472A-B1F8-39697899DEF7} - hxxp://173.52.175.175/HiDvrOcx.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
TCP: DhcpNameServer = 192.168.1.1
TCP: Interfaces\{03900D49-A054-4F9A-A5C9-E2C16EC849C5} : DhcpNameServer = 192.168.1.1
TCP: Interfaces\{13B5C61C-82BC-4174-B8FB-677919D0AEEC} : NameServer = 8.26.56.26,156.154.70.22
TCP: Interfaces\{D4410E18-BF00-487B-99A7-BAB514AB170F} : NameServer = 8.26.56.26,156.154.70.22
Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\MSOXMLMF.DLL
AppInit_DLLs: C:\Windows\SysWOW64\guard32.dll
BHO-X64: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
BHO-X64: AcroIEHelperStub - No File
BHO-X64: Java(tm) Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll
BHO-X64: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
BHO-X64: Office Document Cache Handler: {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL
BHO-X64: URLRedirectionBHO - No File
BHO-X64: uTorrentBar Toolbar: {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - C:\Program Files (x86)\uTorrentBar\prxtbuTo2.dll
BHO-X64: uTorrentBar - No File
BHO-X64: Java(tm) Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
TB-X64: {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - No File
TB-X64: uTorrentBar Toolbar: {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - C:\Program Files (x86)\uTorrentBar\prxtbuTo2.dll
mRun-x64: [amd_dc_opt] C:\Program Files (x86)\AMD\Dual-Core Optimizer\amd_dc_opt.exe
mRun-x64: [BrStsWnd] C:\Program Files (x86)\Brownie\BrstsW64.exe Autorun
mRun-x64: [SSBkgdUpdate] "C:\Program Files (x86)\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
mRun-x64: [PaperPort PTD] "C:\Program Files (x86)\ScanSoft\PaperPort\pptd40nt.exe"
mRun-x64: [IndexSearch] "C:\Program Files (x86)\ScanSoft\PaperPort\IndexSearch.exe"
mRun-x64: [PPort11reminder] "C:\Program Files (x86)\ScanSoft\PaperPort\Ereg\Ereg.exe" -r "C:\ProgramData\ScanSoft\PaperPort\11\Config\Ereg\Ereg.ini"
mRun-x64: [ControlCenter3] C:\Program Files (x86)\Brother\ControlCenter3\brctrcen.exe /autorun
mRun-x64: [BrStsMon00] C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe /AUTORUN
mRun-x64: [SwitchBoard] C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
mRun-x64: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
mRun-x64: [AdobeCS5.5ServiceManager] "C:\Program Files (x86)\Common Files\Adobe\CS5.5ServiceManager\CS5.5ServiceManager.exe" -launchedbylogin
mRun-x64: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
AppInit_DLLs-X64: C:\Windows\SysWOW64\guard32.dll
.
================= FIREFOX ===================
.
FF - ProfilePath -
.
============= SERVICES / DRIVERS ===============
.
R0 PxHlpa64;PxHlpa64;C:\Windows\system32\Drivers\PxHlpa64.sys --> C:\Windows\system32\Drivers\PxHlpa64.sys [?]
R1 cmderd;COMODO Internet Security Eradication Driver;C:\Windows\system32\DRIVERS\cmderd.sys --> C:\Windows\system32\DRIVERS\cmderd.sys [?]
R1 cmdGuard;COMODO Internet Security Sandbox Driver;C:\Windows\system32\DRIVERS\cmdguard.sys --> C:\Windows\system32\DRIVERS\cmdguard.sys [?]
R1 cmdHlp;COMODO Internet Security Helper Driver;C:\Windows\system32\DRIVERS\cmdhlp.sys --> C:\Windows\system32\DRIVERS\cmdhlp.sys [?]
R1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;C:\Windows\system32\DRIVERS\dtsoftbus01.sys --> C:\Windows\system32\DRIVERS\dtsoftbus01.sys [?]
R2 AdobeARMservice;Adobe Acrobat Update Service;C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2012-1-3 63928]
R2 nvUpdatusService;NVIDIA Update Service Daemon;C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe [2012-2-22 2348352]
R2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2012-2-9 382272]
R3 BrYNSvc;BrYNSvc;C:\Program Files (x86)\Browny02\BrYNSvc.exe [2011-10-1 245760]
R3 lvpopf64;Logitech POP Suppression Filter;C:\Windows\system32\DRIVERS\lvpopf64.sys --> C:\Windows\system32\DRIVERS\lvpopf64.sys [?]
R3 LVRS64;Logitech RightSound Filter Driver;C:\Windows\system32\DRIVERS\lvrs64.sys --> C:\Windows\system32\DRIVERS\lvrs64.sys [?]
R3 LVUVC64;Logitech QuickCam Ultra Vision(UVC);C:\Windows\system32\DRIVERS\lvuvc64.sys --> C:\Windows\system32\DRIVERS\lvuvc64.sys [?]
R3 osppsvc;Office Software Protection Platform;C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-1-9 4925184]
S2 Adobe Licensing Console;Adobe Licensing Console;C:\Windows\System32\mrvcl32.exe [2011-7-10 819729]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]
S3 DrvAgent64;DrvAgent64;C:\Windows\SysWOW64\drivers\DrvAgent64.SYS [2011-11-12 21712]
S3 MBAMProtector;MBAMProtector;\??\C:\Windows\system32\drivers\mbam.sys --> C:\Windows\system32\drivers\mbam.sys [?]
S3 MBAMService;MBAMService;C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2011-11-12 366152]
S3 motandroidusb;Mot ADB Interface Driver;C:\Windows\system32\Drivers\motoandroid.sys --> C:\Windows\system32\Drivers\motoandroid.sys [?]
S3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;C:\Windows\system32\drivers\rdpvideominiport.sys --> C:\Windows\system32\drivers\rdpvideominiport.sys [?]
S3 SbieDrv;SbieDrv;C:\Program Files\Sandboxie\SbieDrv.sys [2010-10-17 145512]
S3 TsUsbFlt;TsUsbFlt;C:\Windows\system32\drivers\tsusbflt.sys --> C:\Windows\system32\drivers\tsusbflt.sys [?]
S3 USBAAPL64;Apple Mobile USB Driver;C:\Windows\system32\Drivers\usbaapl64.sys --> C:\Windows\system32\Drivers\usbaapl64.sys [?]
S3 WSDPrintDevice;WSD Print Support via UMB;C:\Windows\system32\DRIVERS\WSDPrint.sys --> C:\Windows\system32\DRIVERS\WSDPrint.sys [?]
S4 MotoConnect Service;MotoConnect Service;C:\Program Files (x86)\Motorola\MotoConnectService\MotoConnectService.exe [2011-4-28 91456]
.
=============== Created Last 30 ================
.
2012-06-05 09:03:418955792----a-w-C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{162792DB-7BF4-4EE9-A705-AAB96AC640E7}\mpengine.dll
2012-06-03 21:28:02--------d-----w-C:\Users\Admin\AppData\Local\Chromium
2012-06-03 20:54:46--------d-----w-C:\Users\Admin\AppData\Local\Rockstar Games
2012-05-29 06:35:39163048----a-w-C:\ProgramData\Microsoft\Windows\Sqm\Manifest\Sqm10141.bin
2012-05-27 07:26:01539984----a-w-C:\ProgramData\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight-2\SpotlightResources.dll
2012-05-25 22:54:24--------d-----w-C:\Windows\usgwmt
2012-05-13 22:57:34--------d-----w-C:\Users\Admin\AppData\Local\PMB Files
2012-05-13 22:57:25--------d-----w-C:\ProgramData\PMB Files
2012-05-13 22:55:03--------d-----w-C:\Users\Admin\AppData\Local\LogiShrd
2012-05-13 22:17:19--------d-----w-C:\Program Files (x86)\Pando Networks
.
==================== Find3M ====================
.
2012-06-06 17:56:03151552----a-w-C:\Windows\KMSEmulator.exe
2012-04-08 23:36:06472808----a-w-C:\Windows\SysWow64\deployJava1.dll
2012-04-08 18:30:40271200----a-w-C:\Windows\SysWow64\PnkBstrB.xtr
2012-04-08 18:30:40271200----a-w-C:\Windows\SysWow64\PnkBstrB.exe
2012-03-31 06:05:575559664----a-w-C:\Windows\System32\ntoskrnl.exe
2012-03-31 04:39:373968368----a-w-C:\Windows\SysWow64\ntkrnlpa.exe
2012-03-31 04:39:373913072----a-w-C:\Windows\SysWow64\ntoskrnl.exe
2012-03-31 03:10:033146240----a-w-C:\Windows\System32\win32k.sys
2012-03-30 11:35:471918320----a-w-C:\Windows\System32\drivers\tcpip.sys
2012-03-17 07:58:5775120----a-w-C:\Windows\System32\drivers\partmgr.sys
2012-03-11 21:13:4143248----a-w-C:\Windows\System32\drivers\cmdhlp.sys
2012-03-11 21:13:40577824----a-w-C:\Windows\System32\drivers\cmdGuard.sys
2012-03-11 21:13:3822696----a-w-C:\Windows\System32\drivers\cmderd.sys
2012-03-11 21:13:2041200----a-w-C:\Windows\System32\cmdcsr.dll
2012-03-11 21:13:18301224----a-w-C:\Windows\SysWow64\guard32.dll
2012-03-11 21:13:17389840----a-w-C:\Windows\System32\guard64.dll
.
============= FINISH: 15:26:02.21 ===============
DDS Attach Log
.
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
.
DDS (Ver_2011-08-26.01)
.
Microsoft Windows 7 Ultimate
Boot Device: \Device\HarddiskVolume1
Install Date: 11/15/2010 1:29:56 AM
System Uptime: 6/6/2012 1:55:13 PM (2 hours ago)
.
Motherboard: Gigabyte Technology Co., Ltd. | | M61P-S3
Processor: AMD Athlon(tm) 64 X2 Dual Core Processor 4000+ | Socket M2 | 2100/200mhz
.
==== Disk Partitions =========================
.
A: is Removable
C: is FIXED (NTFS) - 234 GiB total, 60.008 GiB free.
D: is FIXED (NTFS) - 232 GiB total, 100.695 GiB free.
E: is CDROM (CDFS)
F: is CDROM ()
G: is CDROM ()
H: is FIXED (NTFS) - 500 GiB total, 56.178 GiB free.
I: is FIXED (NTFS) - 432 GiB total, 126.408 GiB free.
J: is CDROM ()
.
==== Disabled Device Manager Items =============
.
Class GUID: {4d36e972-e325-11ce-bfc1-08002be10318}
Description: Microsoft Loopback Adapter
Device ID: ROOT\NET\0000
Manufacturer: Microsoft
Name: Microsoft Loopback Adapter
PNP Device ID: ROOT\NET\0000
Service: msloop
.
Class GUID: {4d36e972-e325-11ce-bfc1-08002be10318}
Description: Microsoft Loopback Adapter
Device ID: ROOT\NET\0001
Manufacturer: Microsoft
Name: Microsoft Loopback Adapter #2
PNP Device ID: ROOT\NET\0001
Service: msloop
.
==== System Restore Points ===================
.
RP317: 6/5/2012 11:25:14 AM - Installed DirectX
.
==== Installed Programs ======================
.
µTorrent
15 Days
4Media HD Video Converter 6
Adobe After Effects CS5.5
Adobe AIR
Adobe Community Help
Adobe Creative Suite 5.5 Master Collection
Adobe Download Assistant
Adobe Dreamweaver CS5.5
Adobe Flash Player 10 Plugin
Adobe Flash Player 11 ActiveX
Adobe Illustrator CS5.1
Adobe Media Player
Adobe Photoshop CS5
Adobe Premiere Pro CS5.5
Adobe Reader X (10.1.2)
Adobe Story
Adobe Widget Browser
AdobeColorCommonSetRGB
Advanced RAR Password Recovery (remove only)
AIM 7
Antares Auto-Tune Evo RTAS
Antares Auto-Tune Evo VST
APB Reloaded
Apple Application Support
Apple Software Update
ArcaniA - Gothic 4
ArcaniA - Gothic 4 Hotfix
ASIO4ALL
Attribute Changer 6.20
Audacity 1.2.6
Auto Screenshot Maker 3.0
Autodesk DirectConnect 2009
AVI Converter v1.6 (Try)
Batman: Arkham Asylum
Battlefield 3
BattlEye for OA Uninstall
Blades of Time
Braid (Version 1.015)
Brother HL-2170W
Brother MFL-Pro Suite MFC-J410W
Buildaria 1.8.4
BulletStorm
Cheat Engine 6.1
Cogs
Combat Arms
Compatibility Pack for the 2007 Office system
Counter-Strike: Global Offensive Beta
Crayon Physics Deluxe - release 51
Crysis® 2
DAEMON Tools Pro
Definition Update for Microsoft Office 2010 (KB982726) 32-Bit Edition
Download Updater (AOL LLC)
Dual-Core Optimizer
E.Y.E Divine Cybermancy
erLT
Fable III
Fallout New Vegas
FileZilla Client 3.5.2
FL Studio 10
Forsaken World Halcyon
Foxit Reader
Fraps (remove only)
Free 3GP Video Converter version 3.7.25.524
Free Audio CD Burner version 1.4.7
Free YouTube to MP3 Converter version 3.10.4.721
FW Private 1.0
Google Chrome
Grand Theft Auto IV
Hacker Evolution: Untold (2.01.033)(remove only)
Half-Life 2 - Strider Mountain 9.99
Half-Life 2 [DiGiTALZoNE]
Half-Life 2 Episode One
Half Life 2 Episode 2
Hitman 2 Silent Assassin
Hitman Blood Money
Hitman: Contracts
ID3-TagIT 3
IL Download Manager
Java Auto Updater
Java(TM) 6 Update 31
Just Cause 2
Killing Floor
Kingdoms of Amalur Reckoning
LAME v3.98.3 for Audacity
Legend of Grimrock
Lumines
Machinarium
Magicka
Malwarebytes' Anti-Malware version 1.51.2.1300
MapleStory
Mass Effect 3
Max Payne 3
Maya 2009
Media Player Codec Pack 3.9.9
Metro 2033
MGTEK dopisp
Microsoft Games for Windows - LIVE Redistributable
Microsoft Games for Windows Marketplace
Microsoft Office Access MUI (English) 2010
Microsoft Office Access Setup Metadata MUI (English) 2010
Microsoft Office Excel MUI (English) 2010
Microsoft Office Groove MUI (English) 2010
Microsoft Office InfoPath MUI (English) 2010
Microsoft Office OneNote MUI (English) 2010
Microsoft Office Outlook MUI (English) 2010
Microsoft Office PowerPoint MUI (English) 2010
Microsoft Office Professional Plus 2010
Microsoft Office Proof (English) 2010
Microsoft Office Proof (French) 2010
Microsoft Office Proof (Spanish) 2010
Microsoft Office Proofing (English) 2010
Microsoft Office Publisher MUI (English) 2010
Microsoft Office Shared MUI (English) 2010
Microsoft Office Shared Setup Metadata MUI (English) 2010
Microsoft Office Word MUI (English) 2010
Microsoft Silverlight
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
Microsoft XNA Framework Redistributable 3.1
Microsoft XNA Framework Redistributable 4.0
Microsoft_VC80_ATL_x86
Microsoft_VC80_CRT_x86
Microsoft_VC80_MFC_x86
Microsoft_VC80_MFCLOC_x86
Microsoft_VC90_ATL_x86
Microsoft_VC90_CRT_x86
Microsoft_VC90_MFC_x86
Microsoft_VC90_MFCLOC_x86
MotoConnect
Mount&Blade With Fire and Sword
Mozilla Firefox 7.0.1 (x86 en-US)
MSVC80_x86_v2
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
Native Instruments Massive
Nexon Game Manager
Nokia Connectivity Cable Driver
Nokia PC Suite
Notepad++
NVIDIA 3D Vision Controller Driver
NVIDIA PhysX
NVIDIA Stereoscopic 3D Driver
Oblivion
ooVoo
Pando Media Booster
Payday The Heist (c) OVERKILL Software version 1
PC Connectivity Solution
PDF Settings CS5
PlayClaw
Postal 2 Share The Pain
Presentation To Video Converter
PunkBuster Services
PxMergeModule
QuickTime
Rage
Realm of the Mad God
Realtek High Definition Audio Driver
Ridge Racer Unbounded
Risen 2 - Dark Waters
Risen 2 - Dark Waters (DLC FIX)
Risen 2 Dark Waters
Rockstar Games Social Club
S.T.A.L.K.E.R. - Clear Sky [v1.0007]
ScanSoft PaperPort 11
ScreenSnapr version 3.0.0.3
Security Update for Microsoft .NET Framework 4 Client Profile (KB2160841)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2446708)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2478663)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2539636)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2572078)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2604121)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2633870)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656405)
Security Update for Microsoft .NET Framework 4 Extended (KB2487367)
Security Update for Microsoft .NET Framework 4 Extended (KB2656351)
Sniper Elite V2
Sniper Ghost Warrior
Sonic Generations
Spiral Knights
Spiral Knights Preview
Steam
Stranded II 1.0.0.1
Syndicate
System Requirements Lab
System Requirements Lab CYRI
TeamViewer 6
TeamViewer 7
Terraria 1.1.2
The Darkness II
The Walking Dead (c) 3 version 1
Total Video Converter 3.71 100812
Ubisoft Game Launcher
Uninstall 1.0.0.1
Update for Microsoft .NET Framework 4 Client Profile (KB2468871)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217)
Update for Microsoft .NET Framework 4 Extended (KB2468871)
Update for Microsoft .NET Framework 4 Extended (KB2533523)
Update for Microsoft .NET Framework 4 Extended (KB2600217)
Update for Microsoft Office 2010 (KB2494150)
Update for Microsoft Office 2010 (KB2553092)
uTorrentBar Toolbar
Visual Studio 2008 x64 Redistributables
VST Bridge 1.1
Warp
Windows Media Player Firefox Plugin
WinPcap 4.1.1
Xfire (remove only)
YouTube Downloader 3.3
.
==== Event Viewer Messages From Past Week ========
.
6/6/2012 2:02:07 PM, Error: Service Control Manager [7022] - The Windows Update service hung on starting.
6/6/2012 1:56:58 PM, Error: Microsoft-Windows-DistributedCOM [10016] - The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID {C97FCC79-E628-407D-AE68-A06AD6D8B4D1} and APPID {344ED43D-D086-4961-86A6-1106F4ACAD9B} to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC). This security permission can be modified using the Component Services administrative tool.
6/6/2012 1:55:36 PM, Error: Service Control Manager [7000] - The Adobe Licensing Console service failed to start due to the following error: The system cannot find the file specified.
6/4/2012 3:21:25 AM, Error: volsnap [36] - The shadow copies of volume C: were aborted because the shadow copy storage could not grow due to a user imposed limit.
.
==== End Of File ===========================

Thank you for the reply!

Bootkit Remover tells me ATA_PASS_THROUGH_DIRECT is not supported. Is this okay?

Bootkit Remover
(c) 2009 Esage Lab
www.esagelab.com

Program version: 1.2.0.1
OS Version: Microsoft Windows 7 Ultimate Edition Service Pack 1 (build 7601), 64
-bit

System volume is \\.\C:
\\.\C: -> \\.\PhysicalDrive0 at offset 0x00000000`00007e00
ATA_Read(): DeviceIoControl() ERROR 1
Boot sector MD5 is: bb4f1627d8b9beda49ac0d010229f3ff

Size Device Name MBR Status
--------------------------------------------
465 GB \\.\PhysicalDrive0 OK (DOS/Win32 Boot code found)


Done;
Press any key to quit...


aswMBR version 0.9.9.1665 Copyright(c) 2011 AVAST Software
Run date: 2012-06-06 22:56:01
-----------------------------
22:56:01.448 OS Version: Windows x64 6.1.7601 Service Pack 1
22:56:01.448 Number of processors: 2 586 0x6B01
22:56:01.450 ComputerName: JEFFYPC UserName: Admin
22:56:02.800 Initialize success
22:57:05.826 AVAST engine defs: 12060602
22:57:17.108 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\0000006c
22:57:17.111 Disk 0 Vendor: ST350032 SD15 Size: 476938MB BusType: 3
22:57:17.114 Disk 1 \Device\Harddisk1\DR1 -> \Device\0000006d
22:57:17.116 Disk 1 Vendor: Hitachi_ JP4O Size: 953869MB BusType: 3
22:57:17.127 Disk 0 MBR read successfully
22:57:17.130 Disk 0 MBR scan
22:57:17.135 Disk 0 Windows 7 default MBR code
22:57:17.139 Disk 0 Partition 1 80 (A) 07 HPFS/NTFS NTFS 239578 MB offset 63
22:57:17.147 Disk 0 Partition - 00 05 Extended 237358 MB offset 490657230
22:57:17.185 Disk 0 Partition 2 00 07 HPFS/NTFS NTFS 237358 MB offset 490657293
22:57:17.271 Disk 0 scanning C:\Windows\system32\drivers
22:57:33.416 Service scanning
22:58:00.629 Modules scanning
22:58:00.971 Disk 0 trace - called modules:
22:58:00.978 ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys >>UNKNOWN [0xfffffa80046062c0]<<sptd.sys storport.sys hal.dll nvstor.sys
22:58:00.985 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa8004c19060]
22:58:00.991 3 CLASSPNP.SYS[fffff88001b8143f] -> nt!IofCallDriver -> [0xfffffa8004aab9c0]
22:58:00.997 5 ACPI.sys[fffff88000f9b7a1] -> nt!IofCallDriver -> \Device\0000006c[0xfffffa8003cf48b0]
22:58:01.003 \Driver\nvstor[0xfffffa80046d02f0] -> IRP_MJ_CREATE -> 0xfffffa80046062c0
22:58:01.769 AVAST engine scan C:\Windows
22:58:04.930 AVAST engine scan C:\Windows\system32
23:06:40.966 AVAST engine scan C:\Windows\system32\drivers
23:07:21.843 AVAST engine scan C:\Users\Admin
23:13:11.248 File: C:\Users\Admin\AppData\Roaming\MsMpEng.exe **INFECTED** MSIL:Inject-BD [Trj]
23:14:06.921 AVAST engine scan C:\ProgramData
23:18:08.832 Scan finished successfully
23:20:58.229 Disk 0 MBR has been saved successfully to "C:\Users\Jeffrey\Desktop\MBR.dat"
23:20:58.235 The log file has been saved successfully to "C:\Users\Jeffrey\Desktop\aswMBR.txt"

okay I ran into a problem running combofix. it rebooted my computer and when I logged back in, combofix keeps opening itself multiple times in a cascading manner and closing immediately. im unsure what to do now

I'm currently booted into safe mode and everything seems to be fine. I can use the task manager and combofix isn't running. However, when I boot normally, combofix keeps attempting to run and opens indefinitely but closes on itself. I cannot end the process because I still can't bring the task manager up.

Do I need to use Rkill?

I ran Rkill and combofix, but I cannot find the logs anywhere.

I also still have the problem with combofix when I boot normally

Edit: I found the combofix.txt but where is the rkill log?

This is all combofix log says though, I don't understand what's wrong

ComboFix 12-06-07.03 - Admin 06/07/2012 14:32:05.3.2 - x64 NETWORK
Microsoft Windows 7 Ultimate 6.1.7601.1.1252.1.1033.18.4096.2860 [GMT -4:00]
Running from: C:\Users\Jeffrey\Desktop\Jeffrey.exe
AV: COMODO Antivirus *Disabled/Updated* {458BB331-2324-0753-3D5F-1472EB102AC0}
FW: COMODO Firewall *Disabled* {7DB03214-694B-060B-1600-BD4715C36DBB}
SP: COMODO Defense+ *Disabled/Updated* {FEEA52D5-051E-08DD-07EF-2F009097607D}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* Created a new restore point

Edit 2: While browsing my C: I noticed a folder called Qoobox. I didn't see it before. Could it be the source of my infection?

ComboFix 12-06-07.03 - Admin 06/07/2012 15:20:24.4.2 - x64 NETWORK
Microsoft Windows 7 Ultimate 6.1.7601.1.1252.1.1033.18.4096.3404 [GMT -4:00]
Running from: c:\users\Jeffrey\Desktop\Jeff.exe
AV: COMODO Antivirus *Disabled/Updated* {458BB331-2324-0753-3D5F-1472EB102AC0}
FW: COMODO Firewall *Disabled* {7DB03214-694B-060B-1600-BD4715C36DBB}
SP: COMODO Defense+ *Disabled/Updated* {FEEA52D5-051E-08DD-07EF-2F009097607D}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* Created a new restore point
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Legacy_NPF
-------\Service_npf
.
.
((((((((((((((((((((((((( Files Created from 2012-05-07 to 2012-06-07 )))))))))))))))))))))))))))))))
.
.
2012-06-07 19:30 . 2012-06-07 19:32--------d-----w-c:\users\Admin\AppData\Local\temp
2012-06-07 19:30 . 2012-06-07 19:30--------d-----w-c:\users\UpdatusUser\AppData\Local\temp
2012-06-07 19:30 . 2012-06-07 19:30--------d-----w-c:\users\Mom\AppData\Local\temp
2012-06-07 19:30 . 2012-06-07 19:30--------d-----w-c:\users\DefaultAppPool\AppData\Local\temp
2012-06-07 19:30 . 2012-06-07 19:30--------d-----w-c:\users\Default\AppData\Local\temp
2012-06-07 19:30 . 2012-06-07 19:30--------d-----w-c:\users\Andy\AppData\Local\temp
2012-06-07 05:48 . 2012-06-07 05:48--------d-----w-c:\users\Jeffrey\AppData\Local\Lazy 8 Studios
2012-06-05 19:54 . 2012-06-05 19:55--------d-----w-c:\users\Jeffrey\AppData\Roaming\Braid
2012-06-05 09:03 . 2012-05-08 17:028955792----a-w-c:\programdata\Microsoft\Windows Defender\Definition Updates\{162792DB-7BF4-4EE9-A705-AAB96AC640E7}\mpengine.dll
2012-06-03 21:28 . 2012-06-03 21:28--------d-----w-c:\users\Admin\AppData\Local\Chromium
2012-06-03 20:54 . 2012-06-03 20:54--------d-----w-c:\users\Admin\AppData\Local\Rockstar Games
2012-05-29 06:35 . 2012-05-29 06:35163048----a-w-c:\programdata\Microsoft\Windows\Sqm\Manifest\Sqm10141.bin
2012-05-27 07:26 . 2012-05-27 07:26539984----a-w-c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight-2\SpotlightResources.dll
2012-05-26 20:57 . 2012-05-26 20:57--------d-----w-c:\users\Jeffrey\AppData\Roaming\RotMG.Production
2012-05-13 22:57 . 2012-05-13 23:28--------d-----w-c:\users\Admin\AppData\Local\PMB Files
2012-05-13 22:57 . 2012-05-13 22:58--------d-----w-c:\programdata\PMB Files
2012-05-13 22:55 . 2012-05-13 22:55--------d-----w-c:\users\Admin\AppData\Local\LogiShrd
2012-05-13 22:17 . 2012-05-13 22:17--------d-----w-c:\program files (x86)\Pando Networks
2012-05-13 06:01 . 2012-05-13 06:01--------d-----w-c:\users\Mom\AppData\Roaming\acccore
2012-05-13 06:00 . 2012-05-13 06:00--------d-----w-c:\users\Mom\AppData\Local\AIM
2012-05-13 06:00 . 2012-05-13 06:00--------d-----w-c:\users\Mom\AppData\Local\AOL
2012-05-12 22:20 . 2012-05-12 22:20--------d-----w-c:\users\Mom\AppData\Roaming\Zeon
2012-05-12 22:17 . 2012-05-12 22:17--------d-----w-c:\users\Mom\AppData\Roaming\ScanSoft
2012-05-12 21:30 . 2012-05-12 21:30--------d-----w-c:\users\Mom\AppData\Roaming\DAEMON Tools Pro
2012-05-12 21:30 . 2012-05-12 21:30--------d-----w-c:\users\Mom\AppData\Local\LogiShrd
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-06-07 19:31 . 2011-06-14 02:29151552----a-w-c:\windows\KMSEmulator.exe
2012-05-27 07:26 . 2011-03-27 17:514283672----a-w-c:\programdata\Microsoft\eHome\Packages\MCEClientUX\UpdateableMarkup\markup.dll
2012-05-27 07:26 . 2011-03-27 17:5142776----a-w-c:\programdata\Microsoft\eHome\Packages\MCEClientUX\dSM\StartResources.dll
2012-04-08 23:36 . 2010-11-21 23:30472808----a-w-c:\windows\SysWow64\deployJava1.dll
2012-04-08 18:30 . 2011-02-17 02:33271200----a-w-c:\windows\SysWow64\PnkBstrB.exe
2012-04-08 18:30 . 2011-02-17 02:33271200----a-w-c:\windows\SysWow64\PnkBstrB.xtr
2012-03-11 21:13 . 2010-09-11 06:4043248----a-w-c:\windows\system32\drivers\cmdhlp.sys
2012-03-11 21:13 . 2010-09-11 06:40577824----a-w-c:\windows\system32\drivers\cmdGuard.sys
2012-03-11 21:13 . 2010-09-11 06:4022696----a-w-c:\windows\system32\drivers\cmderd.sys
2012-03-11 21:13 . 2011-10-26 23:5941200----a-w-c:\windows\system32\cmdcsr.dll
2012-03-11 21:13 . 2010-09-11 06:41301224----a-w-c:\windows\SysWow64\guard32.dll
2012-03-11 21:13 . 2010-09-11 06:41389840----a-w-c:\windows\system32\guard64.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}]
2011-05-09 09:49176936----a-w-c:\program files (x86)\uTorrentBar\prxtbuTo2.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar]
"{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}"= "c:\program files (x86)\uTorrentBar\prxtbuTo2.dll" [2011-05-09 176936]
.
[HKEY_CLASSES_ROOT\clsid\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}]
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DAEMON Tools Pro Agent"="c:\program files (x86)\DAEMON Tools Pro\DTAgent.exe" [2011-08-17 4527424]
"ooVoo.exe"="c:\program files (x86)\ooVoo\oovoo.exe" [2011-12-12 22459984]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"amd_dc_opt"="c:\program files (x86)\AMD\Dual-Core Optimizer\amd_dc_opt.exe" [2008-07-22 77824]
"BrStsWnd"="c:\program files (x86)\Brownie\BrstsW64.exe" [2009-08-19 3695928]
"SSBkgdUpdate"="c:\program files (x86)\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2006-10-25 210472]
"PaperPort PTD"="c:\program files (x86)\ScanSoft\PaperPort\pptd40nt.exe" [2008-07-10 29984]
"IndexSearch"="c:\program files (x86)\ScanSoft\PaperPort\IndexSearch.exe" [2008-07-10 46368]
"PPort11reminder"="c:\program files (x86)\ScanSoft\PaperPort\Ereg\Ereg.exe" [2007-08-31 328992]
"ControlCenter3"="c:\program files (x86)\Brother\ControlCenter3\brctrcen.exe" [2008-12-24 114688]
"BrStsMon00"="c:\program files (x86)\Browny02\Brother\BrStMonW.exe" [2010-02-09 2621440]
"SwitchBoard"="c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe" [2010-02-19 517096]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-03 843712]
"AdobeCS5.5ServiceManager"="c:\program files (x86)\Common Files\Adobe\CS5.5ServiceManager\CS5.5ServiceManager.exe" [2011-01-12 1523360]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2012-01-18 254696]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
SetPointII.lnk - c:\program files\Logitech\SetPoint II\SetPointII.exe [2009-7-21 815104]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\windows\SysWOW64\guard32.dll
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security PackagesREG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R3 BrYNSvc;BrYNSvc;c:\program files (x86)\Browny02\BrYNSvc.exe [2010-01-25 245760]
R3 DrvAgent64;DrvAgent64;c:\windows\SysWOW64\Drivers\DrvAgent64.SYS [2011-11-12 21712]
R3 EagleX64;EagleX64;c:\windows\system32\drivers\EagleX64.sys [x]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [x]
R3 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2011-08-31 366152]
R3 motandroidusb;Mot ADB Interface Driver;c:\windows\system32\Drivers\motoandroid.sys [x]
R3 motusbdevice;Motorola USB Dev Driver;c:\windows\system32\DRIVERS\motusbdevice.sys [x]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [x]
R3 SwitchBoard;SwitchBoard;c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096]
R3 Synth3dVsc;Synth3dVsc;c:\windows\system32\drivers\synth3dvsc.sys [x]
R3 TeamViewer6;TeamViewer 6;c:\program files (x86)\TeamViewer\Version6\TeamViewer_Service.exe [2011-06-01 2337144]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]
R3 tsusbhub;tsusbhub;c:\windows\system32\drivers\tsusbhub.sys [x]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [x]
R3 VGPU;VGPU;c:\windows\system32\drivers\rdvgkmd.sys [x]
R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [x]
R3 X6va005;X6va005;c:\users\Admin\AppData\Local\Temp\00512F5.tmp [x]
R4 MotoConnect Service;MotoConnect Service;c:\program files (x86)\Motorola\MotoConnectService\MotoConnectService.exe [2010-04-29 91456]
S0 PxHlpa64;PxHlpa64;c:\windows\System32\Drivers\PxHlpa64.sys [x]
S0 sptd;sptd;c:\windows\\SystemRoot\System32\Drivers\sptd.sys [x]
S1 cmderd;COMODO Internet Security Eradication Driver;c:\windows\system32\DRIVERS\cmderd.sys [x]
S1 cmdGuard;COMODO Internet Security Sandbox Driver;c:\windows\system32\DRIVERS\cmdguard.sys [x]
S1 cmdHlp;COMODO Internet Security Helper Driver;c:\windows\system32\DRIVERS\cmdhlp.sys [x]
S1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys [x]
S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2012-01-03 63928]
S2 nvUpdatusService;NVIDIA Update Service Daemon;c:\program files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe [2012-02-10 2348352]
S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2012-02-10 382272]
S2 TeamViewer7;TeamViewer 7;c:\program files (x86)\TeamViewer\Version7\TeamViewer_Service.exe [2011-12-02 2923392]
S3 lvpopf64;Logitech POP Suppression Filter;c:\windows\system32\DRIVERS\lvpopf64.sys [x]
S3 LVRS64;Logitech RightSound Filter Driver;c:\windows\system32\DRIVERS\lvrs64.sys [x]
S3 LVUVC64;Logitech QuickCam Ultra Vision(UVC);c:\windows\system32\DRIVERS\lvuvc64.sys [x]
S3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-10 4925184]
S3 WSDPrintDevice;WSD Print Support via UMB;c:\windows\system32\DRIVERS\WSDPrint.sys [x]
.
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost]
iissvcsREG_MULTI_SZ w3svc was
apphostREG_MULTI_SZ apphostsvc
.
Contents of the 'Scheduled Tasks' folder
.
2012-06-07 c:\windows\Tasks\AutoKMS.job
- c:\windows\AutoKMS\AutoKMS.exe [2011-06-14 02:30]
.
2012-06-06 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2585918745-4062148143-2383822450-1001Core.job
- c:\users\Admin\AppData\Local\Google\Update\GoogleUpdate.exe [2011-02-12 08:35]
.
2012-06-07 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2585918745-4062148143-2383822450-1001UA.job
- c:\users\Admin\AppData\Local\Google\Update\GoogleUpdate.exe [2011-02-12 08:35]
.
2012-06-06 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2585918745-4062148143-2383822450-1003Core.job
- c:\users\Jeffrey\AppData\Local\Google\Update\GoogleUpdate.exe [2010-11-16 04:12]
.
2012-06-07 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2585918745-4062148143-2383822450-1003UA.job
- c:\users\Jeffrey\AppData\Local\Google\Update\GoogleUpdate.exe [2010-11-16 04:12]
.
2012-06-06 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2585918745-4062148143-2383822450-1004Core.job
- c:\users\Mom\AppData\Local\Google\Update\GoogleUpdate.exe [2011-01-28 23:32]
.
2012-06-07 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2585918745-4062148143-2383822450-1004UA.job
- c:\users\Mom\AppData\Local\Google\Update\GoogleUpdate.exe [2011-01-28 23:32]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:1297792----a-w-c:\users\Jeffrey\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:1297792----a-w-c:\users\Jeffrey\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:1297792----a-w-c:\users\Jeffrey\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]
@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:1297792----a-w-c:\users\Jeffrey\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"COMODO Internet Security"="c:\program files\COMODO\COMODO Internet Security\cfp.exe" [2012-03-11 9569096]
"RTHDVCPL"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2011-10-17 13307496]
"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2009-06-17 130576]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"LoadAppInit_DLLs"=0x1
"AppInit_DLLs"=c:\windows\System32\guard64.dll
.
------- Supplementary Scan -------
.
uLocal Page = c:\windows\system32\blank.htm
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = *.local
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office14\EXCEL.EXE/3000
IE: Free YouTube to MP3 Converter - c:\users\Admin\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm
IE: Se&nd to OneNote - c:\progra~1\MICROS~2\Office14\ONBttnIE.dll/105
TCP: DhcpNameServer = 192.168.1.1
TCP: Interfaces\{13B5C61C-82BC-4174-B8FB-677919D0AEEC}: NameServer = 8.26.56.26,156.154.70.22
TCP: Interfaces\{D4410E18-BF00-487B-99A7-BAB514AB170F}: NameServer = 8.26.56.26,156.154.70.22
DPF: {DB9DE2A8-D1BA-472A-B1F8-39697899DEF7} - hxxp://173.52.175.175/HiDvrOcx.cab
FF - ProfilePath -
.
- - - - ORPHANS REMOVED - - - -
.
URLSearchHooks-{A3BC75A2-1F87-4686-AA43-5347D756017C} - (no file)
Toolbar-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
ShellIconOverlayIdentifiers-{FB314ED9-A251-47B7-93E1-CDD82E34AF8B} - (no file)
ShellIconOverlayIdentifiers-{FB314EDA-A251-47B7-93E1-CDD82E34AF8B} - (no file)
ShellIconOverlayIdentifiers-{FB314EDB-A251-47B7-93E1-CDD82E34AF8B} - (no file)
Wow6432Node-HKCU-Run-AutoScreenshotMaker - (no file)
WebBrowser-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
WebBrowser-{BF7380FA-E3B4-4DB2-AF3E-9D8783A45BFC} - (no file)
HKLM-Run-combofix - c:\combofix\CF29648.3XE
AddRemove-15 Days - h:\program files\15 Days\uninst.exe
AddRemove-BattlEye for OA - c:\program files (x86)\Bohemia Interactive\ArmAExpansion\BattlEye\UnInstallBE.exe
AddRemove-Risen 2 - Dark Waters (DLC FIX)_is1 - h:\program files (x86)\Deep Silver\Risen 2 Dark Waters\Risen 2 - Dark Waters\unins000.exe
AddRemove-Risen 2 - Dark Waters_is1 - h:\program files (x86)\Deep Silver\Risen 2 - Dark Waters\Uninstall\unins000.exe
AddRemove-Steam App 113400 - c:\program files (x86)\Steam\steam.exe
AddRemove-Steam App 42910 - c:\program files (x86)\Steam\steam.exe
AddRemove-Terraria 1.1.2 - c:\program files (x86)\Terraria\Uninstall.exe
.
.
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\X6va005]
"ImagePath"="\??\c:\users\Admin\AppData\Local\Temp\00512F5.tmp"
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{BEB3C0C7-B648-4257-96D9-B5D024816E27}\Version*Version]
"Version"=hex:a1,11,e8,cd,06,34,89,15,72,34,97,77,d8,eb,52,ee,2c,23,d8,83,3a,
9f,74,0d,90,ba,f1,ed,b8,58,b7,c2,30,48,2b,be,98,b0,88,2b,26,99,ee,1c,f7,4d,\
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil11c_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil11c_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11c.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.10"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11c.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11c.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11c.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\software\Minnetonka Audio Software\SurCode Dolby Digital Premiere\Version*Version]
"Version"=hex:a1,11,e8,cd,06,34,89,15,72,34,97,77,d8,eb,52,ee,2c,23,d8,83,3a,
9f,74,0d,90,ba,f1,ed,b8,58,b7,c2,30,48,2b,be,98,b0,88,2b,26,99,ee,1c,f7,4d,\
.
[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]
@Denied: (A) (Everyone)
"Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}"
.
[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Schema Library\ActionsPane3]
@Denied: (A) (Everyone)
.
[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0]
"Key"="ActionsPane3"
"Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Other Running Processes ------------------------
.
c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files (x86)\Bonjour\mDNSResponder.exe
c:\windows\SysWOW64\PnkBstrA.exe
.
**************************************************************************
.
Completion time: 2012-06-07 15:39:31 - machine was rebooted
ComboFix-quarantined-files.txt 2012-06-07 19:39
.
Pre-Run: 85,325,492,224 bytes free
Post-Run: 84,912,635,904 bytes free
.
- - End Of File - - E053FE1D28175C6DB0C540C572416B2D

I have a problem with booting in normal mode. I cannot open any applications, it tells me it is marked for deletion.

I'm sorry! I didn't see Note 3 D:

I'm going to run Combofix, I will post the log when it is done

ComboFix 12-06-07.03 - Admin 06/07/2012 16:05:59.5.2 - x64
Microsoft Windows 7 Ultimate 6.1.7601.1.1252.1.1033.18.4096.2666 [GMT -4:00]
Running from: c:\users\Admin\Desktop\ComboFix.exe
Command switches used :: c:\users\Admin\Desktop\CFScript.txt
AV: COMODO Antivirus *Disabled/Updated* {458BB331-2324-0753-3D5F-1472EB102AC0}
FW: COMODO Firewall *Disabled* {7DB03214-694B-060B-1600-BD4715C36DBB}
SP: COMODO Defense+ *Disabled/Updated* {FEEA52D5-051E-08DD-07EF-2F009097607D}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
FILE ::
"c:\users\Admin\AppData\Roaming\MsMpEng.exe"
.
.
((((((((((((((((((((((((( Files Created from 2012-05-07 to 2012-06-07 )))))))))))))))))))))))))))))))
.
.
2012-06-07 20:17 . 2012-06-07 20:178782----a-w-c:\programdata\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\BUTTON.JS
2012-06-07 20:17 . 2012-06-07 20:177271----a-w-c:\programdata\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\CHECKBOX.JS
2012-06-07 20:17 . 2012-06-07 20:1723327----a-w-c:\programdata\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\COMBOBOX.JS
2012-06-07 20:17 . 2012-06-07 20:1720719----a-w-c:\programdata\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\DIVWRAPPER.JS
2012-06-07 20:16 . 2012-06-07 20:16--------d-----w-c:\users\UpdatusUser\AppData\Local\temp
2012-06-07 20:16 . 2012-06-07 20:16--------d-----w-c:\users\Mom\AppData\Local\temp
2012-06-07 20:16 . 2012-06-07 20:16--------d-----w-c:\users\Jeffrey\AppData\Local\temp
2012-06-07 20:16 . 2012-06-07 20:16--------d-----w-c:\users\Jeffery\AppData\Local\temp
2012-06-07 20:16 . 2012-06-07 20:16--------d-----w-c:\users\DefaultAppPool\AppData\Local\temp
2012-06-07 20:16 . 2012-06-07 20:16--------d-----w-c:\users\Default\AppData\Local\temp
2012-06-07 20:16 . 2012-06-07 20:16--------d-----w-c:\users\Andy\AppData\Local\temp
2012-06-07 19:47 . 2012-06-07 19:47--------d-----w-c:\users\Admin\AppData\Local\Lazy 8 Studios
2012-06-07 19:30 . 2012-06-07 20:18--------d-----w-c:\users\Admin\AppData\Local\temp
2012-06-07 05:48 . 2012-06-07 05:48--------d-----w-c:\users\Jeffrey\AppData\Local\Lazy 8 Studios
2012-06-05 19:54 . 2012-06-05 19:55--------d-----w-c:\users\Jeffrey\AppData\Roaming\Braid
2012-06-05 09:03 . 2012-05-08 17:028955792----a-w-c:\programdata\Microsoft\Windows Defender\Definition Updates\{162792DB-7BF4-4EE9-A705-AAB96AC640E7}\mpengine.dll
2012-06-03 21:28 . 2012-06-03 21:28--------d-----w-c:\users\Admin\AppData\Local\Chromium
2012-06-03 20:54 . 2012-06-03 20:54--------d-----w-c:\users\Admin\AppData\Local\Rockstar Games
2012-05-29 06:35 . 2012-05-29 06:35163048----a-w-c:\programdata\Microsoft\Windows\Sqm\Manifest\Sqm10141.bin
2012-05-27 07:26 . 2012-05-27 07:26539984----a-w-c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight-2\SpotlightResources.dll
2012-05-26 20:57 . 2012-05-26 20:57--------d-----w-c:\users\Jeffrey\AppData\Roaming\RotMG.Production
2012-05-13 22:57 . 2012-05-13 23:28--------d-----w-c:\users\Admin\AppData\Local\PMB Files
2012-05-13 22:57 . 2012-05-13 22:58--------d-----w-c:\programdata\PMB Files
2012-05-13 22:55 . 2012-05-13 22:55--------d-----w-c:\users\Admin\AppData\Local\LogiShrd
2012-05-13 22:17 . 2012-05-13 22:17--------d-----w-c:\program files (x86)\Pando Networks
2012-05-13 06:01 . 2012-05-13 06:01--------d-----w-c:\users\Mom\AppData\Roaming\acccore
2012-05-13 06:00 . 2012-05-13 06:00--------d-----w-c:\users\Mom\AppData\Local\AIM
2012-05-13 06:00 . 2012-05-13 06:00--------d-----w-c:\users\Mom\AppData\Local\AOL
2012-05-12 22:20 . 2012-05-12 22:20--------d-----w-c:\users\Mom\AppData\Roaming\Zeon
2012-05-12 22:17 . 2012-05-12 22:17--------d-----w-c:\users\Mom\AppData\Roaming\ScanSoft
2012-05-12 21:30 . 2012-05-12 21:30--------d-----w-c:\users\Mom\AppData\Roaming\DAEMON Tools Pro
2012-05-12 21:30 . 2012-05-12 21:30--------d-----w-c:\users\Mom\AppData\Local\LogiShrd
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-06-07 20:18 . 2011-06-14 02:29151552----a-w-c:\windows\KMSEmulator.exe
2012-05-27 07:26 . 2011-03-27 17:514283672----a-w-c:\programdata\Microsoft\eHome\Packages\MCEClientUX\UpdateableMarkup\markup.dll
2012-05-27 07:26 . 2011-03-27 17:5142776----a-w-c:\programdata\Microsoft\eHome\Packages\MCEClientUX\dSM\StartResources.dll
2012-04-08 23:36 . 2010-11-21 23:30472808----a-w-c:\windows\SysWow64\deployJava1.dll
2012-04-08 18:30 . 2011-02-17 02:33271200----a-w-c:\windows\SysWow64\PnkBstrB.exe
2012-04-08 18:30 . 2011-02-17 02:33271200----a-w-c:\windows\SysWow64\PnkBstrB.xtr
2012-03-11 21:13 . 2010-09-11 06:4043248----a-w-c:\windows\system32\drivers\cmdhlp.sys
2012-03-11 21:13 . 2010-09-11 06:40577824----a-w-c:\windows\system32\drivers\cmdGuard.sys
2012-03-11 21:13 . 2010-09-11 06:4022696----a-w-c:\windows\system32\drivers\cmderd.sys
2012-03-11 21:13 . 2011-10-26 23:5941200----a-w-c:\windows\system32\cmdcsr.dll
2012-03-11 21:13 . 2010-09-11 06:41301224----a-w-c:\windows\SysWow64\guard32.dll
2012-03-11 21:13 . 2010-09-11 06:41389840----a-w-c:\windows\system32\guard64.dll
.
.
((((((((((((((((((((((((((((( SnapShot@2012-06-07_19.32.14 )))))))))))))))))))))))))))))))))))))))))
.
+ 2010-11-16 02:13 . 2012-06-07 20:1954152 c:\windows\system32\wdi\ShutdownPerformanceDiagnostics_SystemData.bin
+ 2009-07-14 05:10 . 2012-06-07 20:1945552 c:\windows\system32\wdi\BootPerformanceDiagnostics_SystemData.bin
+ 2010-11-15 06:26 . 2012-06-07 19:5616384 c:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2010-11-15 06:26 . 2012-06-07 18:4316384 c:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2010-11-15 06:26 . 2012-06-07 19:5632768 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2010-11-15 06:26 . 2012-06-07 18:4332768 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2009-07-14 04:54 . 2012-06-07 18:4316384 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2009-07-14 04:54 . 2012-06-07 19:5616384 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2010-12-07 15:25 . 2012-06-07 19:404336 c:\windows\system32\wdi\ERCQueuedResolutions.dat
+ 2010-11-15 03:35 . 2012-06-07 20:198860 c:\windows\system32\wdi\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-2585918745-4062148143-2383822450-1001_UserData.bin
- 2012-06-07 19:31 . 2012-06-07 19:312048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
+ 2012-06-07 20:17 . 2012-06-07 20:172048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
+ 2012-06-07 20:17 . 2012-06-07 20:172048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
- 2012-06-07 19:31 . 2012-06-07 19:312048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
- 2009-07-14 05:01 . 2012-06-07 18:49478560 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat
+ 2009-07-14 05:01 . 2012-06-07 20:16478560 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat
- 2012-06-04 13:19 . 2012-06-04 13:19479328 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-2585918745-4062148143-2383822450-1001-8192.dat
+ 2012-06-04 13:19 . 2012-06-07 20:16479328 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-2585918745-4062148143-2383822450-1001-8192.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}]
2011-05-09 09:49176936----a-w-c:\program files (x86)\uTorrentBar\prxtbuTo2.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar]
"{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}"= "c:\program files (x86)\uTorrentBar\prxtbuTo2.dll" [2011-05-09 176936]
.
[HKEY_CLASSES_ROOT\clsid\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}]
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DAEMON Tools Pro Agent"="c:\program files (x86)\DAEMON Tools Pro\DTAgent.exe" [2011-08-17 4527424]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"amd_dc_opt"="c:\program files (x86)\AMD\Dual-Core Optimizer\amd_dc_opt.exe" [2008-07-22 77824]
"BrStsWnd"="c:\program files (x86)\Brownie\BrstsW64.exe" [2009-08-19 3695928]
"SSBkgdUpdate"="c:\program files (x86)\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2006-10-25 210472]
"PaperPort PTD"="c:\program files (x86)\ScanSoft\PaperPort\pptd40nt.exe" [2008-07-10 29984]
"IndexSearch"="c:\program files (x86)\ScanSoft\PaperPort\IndexSearch.exe" [2008-07-10 46368]
"PPort11reminder"="c:\program files (x86)\ScanSoft\PaperPort\Ereg\Ereg.exe" [2007-08-31 328992]
"ControlCenter3"="c:\program files (x86)\Brother\ControlCenter3\brctrcen.exe" [2008-12-24 114688]
"BrStsMon00"="c:\program files (x86)\Browny02\Brother\BrStMonW.exe" [2010-02-09 2621440]
"SwitchBoard"="c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe" [2010-02-19 517096]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-03 843712]
"AdobeCS5.5ServiceManager"="c:\program files (x86)\Common Files\Adobe\CS5.5ServiceManager\CS5.5ServiceManager.exe" [2011-01-12 1523360]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2012-01-18 254696]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
SetPointII.lnk - c:\program files\Logitech\SetPoint II\SetPointII.exe [2009-7-21 815104]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\windows\SysWOW64\guard32.dll
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security PackagesREG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R3 BrYNSvc;BrYNSvc;c:\program files (x86)\Browny02\BrYNSvc.exe [2010-01-25 245760]
R3 DrvAgent64;DrvAgent64;c:\windows\SysWOW64\Drivers\DrvAgent64.SYS [2011-11-12 21712]
R3 EagleX64;EagleX64;c:\windows\system32\drivers\EagleX64.sys [x]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [x]
R3 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2011-08-31 366152]
R3 motandroidusb;Mot ADB Interface Driver;c:\windows\system32\Drivers\motoandroid.sys [x]
R3 motusbdevice;Motorola USB Dev Driver;c:\windows\system32\DRIVERS\motusbdevice.sys [x]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [x]
R3 SwitchBoard;SwitchBoard;c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096]
R3 Synth3dVsc;Synth3dVsc;c:\windows\system32\drivers\synth3dvsc.sys [x]
R3 TeamViewer6;TeamViewer 6;c:\program files (x86)\TeamViewer\Version6\TeamViewer_Service.exe [2011-06-01 2337144]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]
R3 tsusbhub;tsusbhub;c:\windows\system32\drivers\tsusbhub.sys [x]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [x]
R3 VGPU;VGPU;c:\windows\system32\drivers\rdvgkmd.sys [x]
R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [x]
R3 X6va005;X6va005;c:\users\Admin\AppData\Local\Temp\00512F5.tmp [x]
R4 MotoConnect Service;MotoConnect Service;c:\program files (x86)\Motorola\MotoConnectService\MotoConnectService.exe [2010-04-29 91456]
S0 PxHlpa64;PxHlpa64;c:\windows\System32\Drivers\PxHlpa64.sys [x]
S0 sptd;sptd;c:\windows\\SystemRoot\System32\Drivers\sptd.sys [x]
S1 cmderd;COMODO Internet Security Eradication Driver;c:\windows\system32\DRIVERS\cmderd.sys [x]
S1 cmdGuard;COMODO Internet Security Sandbox Driver;c:\windows\system32\DRIVERS\cmdguard.sys [x]
S1 cmdHlp;COMODO Internet Security Helper Driver;c:\windows\system32\DRIVERS\cmdhlp.sys [x]
S1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys [x]
S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2012-01-03 63928]
S2 nvUpdatusService;NVIDIA Update Service Daemon;c:\program files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe [2012-02-10 2348352]
S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2012-02-10 382272]
S2 TeamViewer7;TeamViewer 7;c:\program files (x86)\TeamViewer\Version7\TeamViewer_Service.exe [2011-12-02 2923392]
S3 lvpopf64;Logitech POP Suppression Filter;c:\windows\system32\DRIVERS\lvpopf64.sys [x]
S3 LVRS64;Logitech RightSound Filter Driver;c:\windows\system32\DRIVERS\lvrs64.sys [x]
S3 LVUVC64;Logitech QuickCam Ultra Vision(UVC);c:\windows\system32\DRIVERS\lvuvc64.sys [x]
S3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-10 4925184]
S3 WSDPrintDevice;WSD Print Support via UMB;c:\windows\system32\DRIVERS\WSDPrint.sys [x]
.
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost]
iissvcsREG_MULTI_SZ w3svc was
apphostREG_MULTI_SZ apphostsvc
.
Contents of the 'Scheduled Tasks' folder
.
2012-06-07 c:\windows\Tasks\AutoKMS.job
- c:\windows\AutoKMS\AutoKMS.exe [2011-06-14 02:30]
.
2012-06-06 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2585918745-4062148143-2383822450-1001Core.job
- c:\users\Admin\AppData\Local\Google\Update\GoogleUpdate.exe [2011-02-12 08:35]
.
2012-06-07 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2585918745-4062148143-2383822450-1001UA.job
- c:\users\Admin\AppData\Local\Google\Update\GoogleUpdate.exe [2011-02-12 08:35]
.
2012-06-06 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2585918745-4062148143-2383822450-1003Core.job
- c:\users\Jeffrey\AppData\Local\Google\Update\GoogleUpdate.exe [2010-11-16 04:12]
.
2012-06-07 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2585918745-4062148143-2383822450-1003UA.job
- c:\users\Jeffrey\AppData\Local\Google\Update\GoogleUpdate.exe [2010-11-16 04:12]
.
2012-06-06 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2585918745-4062148143-2383822450-1004Core.job
- c:\users\Mom\AppData\Local\Google\Update\GoogleUpdate.exe [2011-01-28 23:32]
.
2012-06-07 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2585918745-4062148143-2383822450-1004UA.job
- c:\users\Mom\AppData\Local\Google\Update\GoogleUpdate.exe [2011-01-28 23:32]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]
@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:1297792----a-w-c:\users\Jeffrey\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"COMODO Internet Security"="c:\program files\COMODO\COMODO Internet Security\cfp.exe" [2012-03-11 9569096]
"RTHDVCPL"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2011-10-17 13307496]
"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2009-06-17 130576]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=c:\windows\System32\guard64.dll
.
------- Supplementary Scan -------
.
uLocal Page = c:\windows\system32\blank.htm
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = *.local
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office14\EXCEL.EXE/3000
IE: Free YouTube to MP3 Converter - c:\users\Admin\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm
IE: Se&nd to OneNote - c:\progra~1\MICROS~2\Office14\ONBttnIE.dll/105
TCP: DhcpNameServer = 192.168.1.1
TCP: Interfaces\{13B5C61C-82BC-4174-B8FB-677919D0AEEC}: NameServer = 8.26.56.26,156.154.70.22
TCP: Interfaces\{D4410E18-BF00-487B-99A7-BAB514AB170F}: NameServer = 8.26.56.26,156.154.70.22
DPF: {DB9DE2A8-D1BA-472A-B1F8-39697899DEF7} - hxxp://173.52.175.175/HiDvrOcx.cab
FF - ProfilePath -
.
- - - - ORPHANS REMOVED - - - -
.
Toolbar-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
WebBrowser-{BF7380FA-E3B4-4DB2-AF3E-9D8783A45BFC} - (no file)
ShellIconOverlayIdentifiers-{FB314ED9-A251-47B7-93E1-CDD82E34AF8B} - (no file)
ShellIconOverlayIdentifiers-{FB314EDA-A251-47B7-93E1-CDD82E34AF8B} - (no file)
ShellIconOverlayIdentifiers-{FB314EDB-A251-47B7-93E1-CDD82E34AF8B} - (no file)
.
.
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\X6va005]
"ImagePath"="\??\c:\users\Admin\AppData\Local\Temp\00512F5.tmp"
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{BEB3C0C7-B648-4257-96D9-B5D024816E27}\Version*Version]
"Version"=hex:a1,11,e8,cd,06,34,89,15,72,34,97,77,d8,eb,52,ee,2c,23,d8,83,3a,
9f,74,0d,90,ba,f1,ed,b8,58,b7,c2,30,48,2b,be,98,b0,88,2b,26,99,ee,1c,f7,4d,\
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil11c_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil11c_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11c.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.10"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11c.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11c.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11c.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\software\Minnetonka Audio Software\SurCode Dolby Digital Premiere\Version*Version]
"Version"=hex:a1,11,e8,cd,06,34,89,15,72,34,97,77,d8,eb,52,ee,2c,23,d8,83,3a,
9f,74,0d,90,ba,f1,ed,b8,58,b7,c2,30,48,2b,be,98,b0,88,2b,26,99,ee,1c,f7,4d,\
.
[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]
@Denied: (A) (Everyone)
"Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}"
.
[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Schema Library\ActionsPane3]
@Denied: (A) (Everyone)
.
[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0]
"Key"="ActionsPane3"
"Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Other Running Processes ------------------------
.
c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files (x86)\Bonjour\mDNSResponder.exe
c:\windows\SysWOW64\PnkBstrA.exe
.
**************************************************************************
.
Completion time: 2012-06-07 16:24:57 - machine was rebooted
ComboFix-quarantined-files.txt 2012-06-07 20:24
ComboFix2.txt 2012-06-07 19:39
.
Pre-Run: 85,034,229,760 bytes free
Post-Run: 84,764,164,096 bytes free
.
- - End Of File - - 43FCDE565FB52D28E1EF552E0FB43174