Computer Hope

Software => Computer viruses and spyware => Virus and spyware removal => Topic started by: ktseifert on February 17, 2013, 02:54:51 PM

Title: Analysis of ComboFix report please
Post by: ktseifert on February 17, 2013, 02:54:51 PM
My internet connection on this PC seems to be overactive, so I am doing some housekeeping. I first ran TDSSKiller and there were no infections or suspections found. Then ran ComboFix. Here is the report.

ComboFix 13-02-15.01 - El Presidente 02/17/2013  13:04:40.1.2 - x86
Microsoft Windows 7 Professional   6.1.7601.1.1252.1.1033.18.2047.929 [GMT -8:00]
Running from: c:\users\El Presidente\Desktop\ComboFix.exe
AV: avast! Antivirus *Disabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}
SP: avast! Antivirus *Disabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
 * Created a new restore point
.
.
(((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
C:\install.exe
.
.
(((((((((((((((((((((((((   Files Created from 2013-01-17 to 2013-02-17  )))))))))))))))))))))))))))))))
.
.
2013-02-17 18:23 . 2013-02-17 18:23   60872   ----a-w-   c:\programdata\Microsoft\Windows Defender\Definition Updates\{1F49191F-05F8-4F0C-98D7-D9D56078A96A}\offreg.dll
2013-02-15 11:01 . 2013-01-08 04:57   6991832   ----a-w-   c:\programdata\Microsoft\Windows Defender\Definition Updates\{1F49191F-05F8-4F0C-98D7-D9D56078A96A}\mpengine.dll
2013-02-13 11:03 . 2013-01-08 22:01   768000   ----a-w-   c:\program files\Common Files\Microsoft Shared\VGX\VGX.dll
2013-02-13 02:10 . 2013-02-13 02:10   --------   d-----w-   c:\programdata\ATI
2013-02-13 02:10 . 2013-02-13 02:10   --------   d-----w-   c:\program files\AMD AVT
2013-02-13 02:10 . 2013-02-13 02:10   --------   d-----w-   c:\program files\AMD APP
2013-02-13 01:56 . 2013-01-04 03:00   2347008   ----a-w-   c:\windows\system32\win32k.sys
2013-02-13 01:56 . 2013-01-05 05:00   3967848   ----a-w-   c:\windows\system32\ntkrnlpa.exe
2013-02-13 01:56 . 2013-01-05 05:00   3913064   ----a-w-   c:\windows\system32\ntoskrnl.exe
2013-02-13 01:56 . 2013-01-03 05:05   1293672   ----a-w-   c:\windows\system32\drivers\tcpip.sys
2013-02-13 01:56 . 2013-01-03 05:04   187752   ----a-w-   c:\windows\system32\drivers\FWPKCLNT.SYS
2013-02-13 01:56 . 2013-01-04 04:50   169984   ----a-w-   c:\windows\system32\winsrv.dll
2013-02-13 01:04 . 2013-02-13 01:04   --------   d-----w-   c:\users\El Presidente\AppData\Local\Macromedia
2013-01-30 02:18 . 2013-01-30 02:18   --------   d-----w-   c:\users\El Presidente\AppData\Local\Mozilla
2013-01-30 02:18 . 2013-02-13 01:45   --------   d-----w-   c:\program files\Mozilla Maintenance Service
.
.
.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-02-13 01:56 . 2012-05-06 23:15   691568   ----a-w-   c:\windows\system32\FlashPlayerApp.exe
2013-02-13 01:56 . 2011-10-24 13:37   71024   ----a-w-   c:\windows\system32\FlashPlayerCPLApp.cpl
2013-01-17 09:28 . 2011-08-28 02:15   232336   ------w-   c:\windows\system32\MpSigStub.exe
2013-01-10 03:14 . 2013-01-10 03:14   66030   ----a-w-   C:\cc_20130109_191349.reg
2012-12-19 23:45 . 2012-12-19 23:45   180224   ----a-w-   c:\windows\system32\clinfo.exe
2012-12-19 23:44 . 2012-12-19 23:44   65536   ----a-w-   c:\windows\system32\OpenVideo.dll
2012-12-19 23:44 . 2012-12-19 23:44   56320   ----a-w-   c:\windows\system32\OVDecode.dll
2012-12-19 23:38 . 2012-12-19 23:38   28732928   ----a-w-   c:\windows\system32\amdocl.dll
2012-12-19 23:34 . 2012-12-19 23:34   50176   ----a-w-   c:\windows\system32\OpenCL.dll
2012-12-19 20:50 . 2012-01-05 23:10   5630200   ----a-w-   c:\windows\system32\atiumdag.dll
2012-12-19 20:47 . 2012-12-19 20:47   9647104   ----a-w-   c:\windows\system32\drivers\atikmdag.sys
2012-12-19 20:22 . 2012-12-19 20:22   58880   ----a-w-   c:\windows\system32\coinst_9.012.dll
2012-12-19 20:19 . 2012-12-19 20:19   163840   ----a-w-   c:\windows\system32\atiapfxx.exe
2012-12-19 20:18 . 2012-12-19 20:18   46080   ----a-w-   c:\windows\system32\aticalrt.dll
2012-12-19 20:17 . 2012-12-19 20:17   44032   ----a-w-   c:\windows\system32\aticalcl.dll
2012-12-19 20:13 . 2012-12-19 20:13   13703168   ----a-w-   c:\windows\system32\aticaldd.dll
2012-12-19 20:12 . 2012-12-19 20:12   18982400   ----a-w-   c:\windows\system32\atioglxx.dll
2012-12-19 20:09 . 2012-01-05 23:52   960512   ----a-w-   c:\windows\system32\aticfx32.dll
2012-12-19 20:06 . 2012-01-05 23:42   6681088   ----a-w-   c:\windows\system32\atidxx32.dll
2012-12-19 19:57 . 2012-12-19 19:57   442368   ----a-w-   c:\windows\system32\atidemgy.dll
2012-12-19 19:56 . 2012-12-19 19:56   482304   ----a-w-   c:\windows\system32\atieclxx.exe
2012-12-19 19:55 . 2012-12-19 19:55   219136   ----a-w-   c:\windows\system32\atiesrxx.exe
2012-12-19 19:54 . 2012-12-19 19:54   163840   ----a-w-   c:\windows\system32\atitmmxx.dll
2012-12-19 19:54 . 2012-12-19 19:54   20992   ----a-w-   c:\windows\system32\atimuixx.dll
2012-12-19 19:54 . 2012-12-19 19:54   43520   ----a-w-   c:\windows\system32\ati2edxx.dll
2012-12-19 19:44 . 2012-01-05 23:01   4162048   ----a-w-   c:\windows\system32\atiumdva.dll
2012-12-19 19:34 . 2012-12-19 19:34   78336   ----a-w-   c:\windows\system32\amdave32.dll
2012-12-19 19:34 . 2012-12-19 19:34   71168   ----a-w-   c:\windows\system32\atisamu32.dll
2012-12-19 19:33 . 2012-12-19 19:33   56832   ----a-w-   c:\windows\system32\atimpc32.dll
2012-12-19 19:33 . 2012-12-19 19:33   56832   ----a-w-   c:\windows\system32\amdpcom32.dll
2012-12-19 19:33 . 2012-12-19 19:33   421888   ----a-w-   c:\windows\system32\atiadlxx.dll
2012-12-19 19:33 . 2012-12-19 19:33   14848   ----a-w-   c:\windows\system32\atiglpxx.dll
2012-12-19 19:33 . 2012-12-19 19:33   33280   ----a-w-   c:\windows\system32\atigktxx.dll
2012-12-19 19:32 . 2012-12-19 19:32   442368   ----a-w-   c:\windows\system32\drivers\atikmpag.sys
2012-12-19 19:31 . 2012-01-05 22:49   109568   ----a-w-   c:\windows\system32\atiuxpag.dll
2012-12-19 19:30 . 2012-01-05 22:49   83968   ----a-w-   c:\windows\system32\atiu9pag.dll
2012-12-19 19:30 . 2012-12-19 19:30   53248   ----a-w-   c:\windows\system32\drivers\ati2erec.dll
2012-12-16 14:13 . 2012-12-21 11:01   295424   ----a-w-   c:\windows\system32\atmfd.dll
2012-12-16 14:13 . 2012-12-21 11:01   34304   ----a-w-   c:\windows\system32\atmlib.dll
2012-12-07 12:26 . 2013-01-08 20:58   308736   ----a-w-   c:\windows\system32\Wpc.dll
2012-12-07 12:20 . 2013-01-08 20:58   2576384   ----a-w-   c:\windows\system32\gameux.dll
2012-12-07 10:46 . 2013-01-08 20:58   43520   ----a-w-   c:\windows\system32\csrr.rs
2012-12-07 10:46 . 2013-01-08 20:58   30720   ----a-w-   c:\windows\system32\usk.rs
2012-12-07 10:46 . 2013-01-08 20:58   45568   ----a-w-   c:\windows\system32\oflc-nz.rs
2012-12-07 10:46 . 2013-01-08 20:58   44544   ----a-w-   c:\windows\system32\pegibbfc.rs
2012-12-07 10:46 . 2013-01-08 20:58   20480   ----a-w-   c:\windows\system32\pegi-pt.rs
2012-12-07 10:46 . 2013-01-08 20:58   23552   ----a-w-   c:\windows\system32\oflc.rs
2012-12-07 10:46 . 2013-01-08 20:58   20480   ----a-w-   c:\windows\system32\pegi-fi.rs
2012-12-07 10:46 . 2013-01-08 20:58   46592   ----a-w-   c:\windows\system32\fpb.rs
2012-12-07 10:46 . 2013-01-08 20:58   20480   ----a-w-   c:\windows\system32\pegi.rs
2012-12-07 10:46 . 2013-01-08 20:58   21504   ----a-w-   c:\windows\system32\grb.rs
2012-12-07 10:46 . 2013-01-08 20:58   40960   ----a-w-   c:\windows\system32\cob-au.rs
2012-12-07 10:46 . 2013-01-08 20:58   15360   ----a-w-   c:\windows\system32\djctq.rs
2012-12-07 10:46 . 2013-01-08 20:58   51712   ----a-w-   c:\windows\system32\esrb.rs
2012-12-07 10:46 . 2013-01-08 20:58   55296   ----a-w-   c:\windows\system32\cero.rs
2012-11-30 04:47 . 2013-01-08 20:55   293376   ----a-w-   c:\windows\system32\KernelBase.dll
2012-11-30 04:45 . 2013-01-08 20:55   4096   ---ha-w-   c:\windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2012-11-30 04:45 . 2013-01-08 20:55   4096   ---ha-w-   c:\windows\system32\api-ms-win-core-synch-l1-1-0.dll
2012-11-30 04:45 . 2013-01-08 20:55   3072   ---ha-w-   c:\windows\system32\api-ms-win-core-string-l1-1-0.dll
2012-11-30 04:45 . 2013-01-08 20:55   4608   ---ha-w-   c:\windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2012-11-30 04:45 . 2013-01-08 20:55   3584   ---ha-w-   c:\windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2012-11-30 04:45 . 2013-01-08 20:55   3072   ---ha-w-   c:\windows\system32\api-ms-win-core-profile-l1-1-0.dll
2012-11-30 04:45 . 2013-01-08 20:55   4096   ---ha-w-   c:\windows\system32\api-ms-win-core-misc-l1-1-0.dll
2012-11-30 04:45 . 2013-01-08 20:55   3584   ---ha-w-   c:\windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2012-11-30 04:45 . 2013-01-08 20:55   3584   ---ha-w-   c:\windows\system32\api-ms-win-core-memory-l1-1-0.dll
2012-11-30 04:45 . 2013-01-08 20:55   4096   ---ha-w-   c:\windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2012-11-30 04:45 . 2013-01-08 20:55   3584   ---ha-w-   c:\windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2012-11-30 04:45 . 2013-01-08 20:55   3584   ---ha-w-   c:\windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2012-11-30 04:45 . 2013-01-08 20:55   3584   ---ha-w-   c:\windows\system32\api-ms-win-core-heap-l1-1-0.dll
2012-11-30 04:45 . 2013-01-08 20:55   3072   ---ha-w-   c:\windows\system32\api-ms-win-core-io-l1-1-0.dll
2012-11-30 04:45 . 2013-01-08 20:55   3072   ---ha-w-   c:\windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2012-11-30 04:45 . 2013-01-08 20:55   4096   ---ha-w-   c:\windows\system32\api-ms-win-core-localization-l1-1-0.dll
2012-11-30 04:45 . 2013-01-08 20:55   5120   ---ha-w-   c:\windows\system32\api-ms-win-core-file-l1-1-0.dll
2012-11-30 04:45 . 2013-01-08 20:55   3072   ---ha-w-   c:\windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2012-11-30 04:45 . 2013-01-08 20:55   3072   ---ha-w-   c:\windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2012-11-30 04:45 . 2013-01-08 20:55   3072   ---ha-w-   c:\windows\system32\api-ms-win-core-handle-l1-1-0.dll
2012-11-30 04:45 . 2013-01-08 20:55   3072   ---ha-w-   c:\windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2012-11-30 04:45 . 2013-01-08 20:55   3072   ---ha-w-   c:\windows\system32\api-ms-win-core-debug-l1-1-0.dll
2012-11-30 04:45 . 2013-01-08 20:55   3072   ---ha-w-   c:\windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2012-11-30 04:45 . 2013-01-08 20:55   3072   ---ha-w-   c:\windows\system32\api-ms-win-core-console-l1-1-0.dll
2012-11-30 02:55 . 2013-01-08 20:55   271360   ----a-w-   c:\windows\system32\conhost.exe
2012-11-30 02:38 . 2013-01-08 20:55   6144   ---ha-w-   c:\windows\system32\api-ms-win-security-base-l1-1-0.dll
2012-11-30 02:38 . 2013-01-08 20:55   3584   ---ha-w-   c:\windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2012-11-30 02:38 . 2013-01-08 20:55   3072   ---ha-w-   c:\windows\system32\api-ms-win-core-util-l1-1-0.dll
2012-11-30 02:38 . 2013-01-08 20:55   4608   ---ha-w-   c:\windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2012-11-23 02:48 . 2013-01-08 20:54   49152   ----a-w-   c:\windows\system32\taskhost.exe
2012-11-22 04:45 . 2013-01-08 20:59   626688   ----a-w-   c:\windows\system32\usp10.dll
2012-11-20 04:51 . 2013-01-08 20:54   220160   ----a-w-   c:\windows\system32\ncrypt.dll
2013-02-06 03:46 . 2013-02-06 03:46   262552   ----a-w-   c:\program files\mozilla firefox\components\browsercomps.dll
.
.
(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2012-10-30 23:50   121528   ----a-w-   c:\program files\Alwil Software\Avast5\ashShell.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\1AMPCBOK]
@="{04cd1f3e-81d5-4904-a3ab-e0f99a7d769d}"
[HKEY_CLASSES_ROOT\CLSID\{04cd1f3e-81d5-4904-a3ab-e0f99a7d769d}]
2010-11-05 01:58   297808   ----a-w-   c:\windows\System32\mscoree.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\1AMPCBSyncing]
@="{4d87b7a7-23f1-470c-aa45-96b25b9bd138}"
[HKEY_CLASSES_ROOT\CLSID\{4d87b7a7-23f1-470c-aa45-96b25b9bd138}]
2010-11-05 01:58   297808   ----a-w-   c:\windows\System32\mscoree.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveBlacklistedOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42}]
2012-12-18 03:50   556648   ----a-w-   c:\program files\Google\Drive\googledrivesync32.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSharedOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D43}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D43}]
2012-12-18 03:50   556648   ----a-w-   c:\program files\Google\Drive\googledrivesync32.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSyncedOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40}]
2012-12-18 03:50   556648   ----a-w-   c:\program files\Google\Drive\googledrivesync32.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSyncingOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41}]
2012-12-18 03:50   556648   ----a-w-   c:\program files\Google\Drive\googledrivesync32.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-20 1174016]
"GoogleDriveSync"="c:\program files\Google\Drive\googledrivesync.exe" [2012-12-18 16328976]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Intuit SyncManager"="c:\program files\Common Files\Intuit\Sync\IntuitSyncManager.exe" [2012-10-08 2643320]
"LogMeIn GUI"="c:\program files\LogMeIn\x86\LogMeInSystray.exe" [2011-09-16 63048]
"ControlCenter4"="c:\program files\ControlCenter4\BrCcBoot.exe" [2010-10-28 139264]
"BrStsMon00"="c:\program files\Browny02\Brother\BrStMonW.exe" [2010-06-10 2621440]
"avast"="c:\program files\Alwil Software\Avast5\avastUI.exe" [2012-10-30 4297136]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2012-12-19 642808]
.
c:\users\Autosys\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OpenOffice.org 3.3.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2012-8-13 1199104]
OpenOffice.org 3.4.1.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2012-8-13 1199104]
.
c:\users\El Presidente\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
EvernoteClipper.lnk - c:\program files\Evernote\Evernote\EvernoteClipper.exe [2012-12-3 1044320]
JustCloud.lnk - c:\program files\JustCloud\JustCloud.exe [2013-1-16 1994792]
OpenOffice.org 3.4.1.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2012-8-13 1199104]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Intuit Data Protect.lnk - c:\program files\Common Files\Intuit\DataProtect\IntuitDataProtect.exe [2012-10-15 6153080]
QuickBooks Update Agent.lnk - c:\program files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe [2012-10-24 1157008]
QuickBooks_Standard_21.lnk - c:\program files\Intuit\QuickBooks 2011\QBW32.EXE [2012-10-24 1179024]
Run VNC Server.lnk - c:\program files\RealVNC\VNC4\winvnc4.exe [2011-10-30 439632]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2011-07-19 113024]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2011-05-04 17:54   551296   ----a-w-   c:\program files\SUPERAntiSpyware\SASWINLO.DLL
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute   REG_MULTI_SZ      autocheck autochk *\0sdnclean.exe
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\!SASCORE]
@=""
.
[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^GammaTray.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\GammaTray.lnk
backup=c:\windows\pss\GammaTray.lnk.CommonStartup
backupExtension=.CommonStartup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Logitech Download Assistant]
2010-11-04 05:50   1246544   ----a-w-   c:\windows\System32\LogiLDA.DLL
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LxrAutorun]
2009-12-18 04:10   24576   ----a-w-   c:\users\El Presidente\AppData\Local\Lexar Media\LxrAutorun.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MagicTuneLauncher]
2011-10-17 18:18   51712   ----a-w-   c:\program files\MagicTune Premium\MagicTuneLauncher.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2012-07-03 16:04   252848   ----a-w-   c:\program files\Common Files\Java\Java Update\jusched.exe
.
R1 aswSnx;aswSnx;
R3 Gizmo Central;Gizmo Central;c:\program files\Gizmo\gservice.exe
R3 MsDtsServer100;SQL Server Integration Services 10.0;c:\program files\Microsoft SQL Server\100\DTS\Binn\MsDtsSrvr.exe
R3 MSSQLFDLauncher;SQL Full-text Filter Daemon Launcher (MSSQLSERVER);c:\program files\Microsoft SQL Server\MSSQL10.MSSQLSERVER\MSSQL\Binn\fdlauncher.exe
R3 QBVSS;QBIDPService;c:\program files\Common Files\Intuit\DataProtect\QBIDPService.exe
R3 radpms;Driver for RADPMS Device;c:\windows\system32\DRIVERS\radpms.sys
R3 ReportServer;SQL Server Reporting Services (MSSQLSERVER);c:\program files\Microsoft SQL Server\MSRS10.MSSQLSERVER\Reporting Services\ReportServer\bin\ReportingServicesService.exe
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys
R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe
R4 BrYNSvc;BrYNSvc;c:\program files\Browny02\BrYNSvc.exe
R4 MSSQLServerADHelper100;SQL Active Directory Helper Service;c:\program files\Microsoft SQL Server\100\Shared\SQLADHLP.EXE
R4 RsFx0103;RsFx0103 Driver;c:\windows\system32\DRIVERS\RsFx0103.sys
S1 aswSP;aswSP;
S1 GizmoDrv;Gizmo Device Driver;
S1 ISODisk;ISODisk;
S1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV.SYS
S1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS
S2 !SASCORE;SAS Core Service;c:\program files\SUPERAntiSpyware\SASCORE.EXE
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe
S2 AMD FUEL Service;AMD FUEL Service;c:\program files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe
S2 aswFsBlk;aswFsBlk;
S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys
S2 BackupStack;Computer Backup (JustCloud);c:\program files\JustCloud\BackupStack.exe
S2 LMIGuardianSvc;LMIGuardianSvc;c:\program files\LogMeIn\x86\LMIGuardianSvc.exe
S2 LMIInfo;LogMeIn Kernel Information Provider;c:\program files\LogMeIn\x86\RaInfo.sys
S2 LxrSII1d;Secure II Driver;c:\windows\System32\Drivers\LxrSII1d.sys
S3 amdiox86;AMD IO Driver;c:\windows\system32\DRIVERS\amdiox86.sys
S3 AtiHDAudioService;AMD Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW73.sys
S3 netr28u;Belkin USB Wireless LAN Card Driver for Vista;c:\windows\system32\DRIVERS\netr28u.sys
.
.
--- Other Services/Drivers In Memory ---
.
*NewlyCreated* - 43344107
*Deregistered* - 43344107
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2013-02-01 19:15   1607120   ----a-w-   c:\program files\Google\Chrome\Application\24.0.1312.57\Installer\chrmstp.exe
.
Contents of the 'Scheduled Tasks' folder
.
2013-02-16 c:\windows\Tasks\Autosys_Inc 1355806477.job
- c:\program files\Intuit\QuickBooks 2011\AutoBackupEXE.exe [2012-10-24 17:57]
.
2013-02-17 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-11-27 04:39]
.
2013-02-17 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-11-27 04:39]
.
2013-02-17 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2657849761-2623932749-2735718110-1003Core.job
- c:\users\El Presidente\AppData\Local\Google\Update\GoogleUpdate.exe [2013-01-10 16:09]
.
2013-02-17 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2657849761-2623932749-2735718110-1003UA.job
- c:\users\El Presidente\AppData\Local\Google\Update\GoogleUpdate.exe [2013-01-10 16:09]
.
2013-02-17 c:\windows\Tasks\SUPERAntiSpyware Scheduled Task 327f8739-3035-4481-a440-0a85c6600994.job
- c:\program files\SUPERAntiSpyware\SASTask.exe [2011-05-04 17:52]
.
2013-02-16 c:\windows\Tasks\SUPERAntiSpyware Scheduled Task 908a3f11-0d45-4eec-bf44-023af2be388d.job
- c:\program files\SUPERAntiSpyware\SASTask.exe [2011-05-04 17:52]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/
IE: Add to Evernote 4.0 - c:\program files\Evernote\Evernote\EvernoteIE.dll/204
TCP: DhcpNameServer = 8.8.4.4 192.168.0.1
FF - ProfilePath - c:\users\El Presidente\AppData\Roaming\Mozilla\Firefox\Profiles\p2nfav4m.default\
.
- - - - ORPHANS REMOVED - - - -
.
WebBrowser-{17C962EC-C712-4230-90C4-1D611CAB6E08} - (no file)
HKCU-Run-SUPERAntiSpyware - c:\program files\SUPERAntiSpyware\84a210a9-f9d1-45ca-b223-adf3db41f441.com
MSConfigStartUp-ISUSPM - c:\programdata\FLEXnet\Connect\11\ISUSPM.exe
.
.
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'Explorer.exe'(1184)
c:\program files\JustCloud\LogicNP.EZShellExtensions.dll
c:\program files\JustCloud\x86\System.Data.SQLite.dll
c:\windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\cb562e2e4f74ae607f1186f6ec50cec7\System.Windows.Forms.ni.dll
.
Completion time: 2013-02-17  13:16:19
ComboFix-quarantined-files.txt  2013-02-17 21:16
.
Pre-Run: 97,442,193,408 bytes free
Post-Run: 97,455,493,120 bytes free
.
- - End Of File - - 596842D7BB93FF0124EF20DA40DD72F1

Thank you for your help.
Title: Re: Analysis of ComboFix report please
Post by: SuperDave on February 17, 2013, 04:42:48 PM
Hello and welcome to Computer Hope Forum. My name is Dave. I will be helping you out with your particular problem on your computer.

1. I will be working on your Malware issues. This may or may not solve other issues you have with your machine.
2. The fixes are specific to your problem and should only be used for this issue on this machine.
3. If you don't know or understand something, please don't hesitate to ask.
4. Please DO NOT run any other tools or scans while I am helping you.
5. It is important that you reply to this thread. Do not start a new topic.
6. Your security programs may give warnings for some of the tools I will ask you to use. Be assured, any links I give are safe.
7. Absence of symptoms does not mean that everything is clear.

If you can't access the internet with your infected computer you will have to download and transfer any programs to the computer you're using now and transfer them to the infected computer with a CD-RW or a USB storage device. I prefer a CD because a storage device can get infected. If you use a storage device hold the shift key down while inserting the USB storage device for about 10 secs. You will also have to transfer the logs you receive back to the good computer using the same method until we can get the computer back on-line.
*************************************************************************
Please download AdwCleaner  (http://general-changelog-team.fr/fr/downloads/finish/20-outils-de-xplode/2-adwcleaner)by Xplode onto your Desktop.
*********************************************
(http://i424.photobucket.com/albums/pp322/digistar/mbamicontw5.gif) Please download Malwarebytes Anti-Malware from here. (http://download.bleepingcomputer.com/malwarebytes/mbam-setup.exe)
Double Click mbam-setup.exe to install the application.
Extra Note:

If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process. If asked to restart the computer, please do so immediately.
*************************************************
Download Security Check by screen317 from one of the following links and save it to your desktop.

Link 1 (http://screen317.spywareinfoforum.org/SecurityCheck.exe)
Link 2 (http://screen317.changelog.fr/SecurityCheck.exe)

* Double-click Security Check.bat
* Follow the on-screen instructions inside of the black box.
* A Notepad document should open automatically called checkup.txt
* Post the contents of that document in your next reply.

Note: If a security program requests permission from dig.exe to access the Internet, allow it to do so.