Analysis of ComboFix report please

[ktseifert]

My internet connection on this PC seems to be overactive, so I am doing some housekeeping. I first ran TDSSKiller and there were no infections or suspections found. Then ran ComboFix. Here is the report.

ComboFix 13-02-15.01 - El Presidente 02/17/2013  13:04:40.1.2 - x86
Microsoft Windows 7 Professional   6.1.7601.1.1252.1.1033.18.2047.929 [GMT -8:00]
Running from: c:\users\El Presidente\Desktop\ComboFix.exe
AV: avast! Antivirus *Disabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}
SP: avast! Antivirus *Disabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
 * Created a new restore point
.
.
(((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
C:\install.exe
.
.
(((((((((((((((((((((((((   Files Created from 2013-01-17 to 2013-02-17  )))))))))))))))))))))))))))))))
.
.
2013-02-17 18:23 . 2013-02-17 18:23   60872   ----a-w-   c:\programdata\Microsoft\Windows Defender\Definition Updates\{1F49191F-05F8-4F0C-98D7-D9D56078A96A}\offreg.dll
2013-02-15 11:01 . 2013-01-08 04:57   6991832   ----a-w-   c:\programdata\Microsoft\Windows Defender\Definition Updates\{1F49191F-05F8-4F0C-98D7-D9D56078A96A}\mpengine.dll
2013-02-13 11:03 . 2013-01-08 22:01   768000   ----a-w-   c:\program files\Common Files\Microsoft Shared\VGX\VGX.dll
2013-02-13 02:10 . 2013-02-13 02:10   --------   d-----w-   c:\programdata\ATI
2013-02-13 02:10 . 2013-02-13 02:10   --------   d-----w-   c:\program files\AMD AVT
2013-02-13 02:10 . 2013-02-13 02:10   --------   d-----w-   c:\program files\AMD APP
2013-02-13 01:56 . 2013-01-04 03:00   2347008   ----a-w-   c:\windows\system32\win32k.sys
2013-02-13 01:56 . 2013-01-05 05:00   3967848   ----a-w-   c:\windows\system32\ntkrnlpa.exe
2013-02-13 01:56 . 2013-01-05 05:00   3913064   ----a-w-   c:\windows\system32\ntoskrnl.exe
2013-02-13 01:56 . 2013-01-03 05:05   1293672   ----a-w-   c:\windows\system32\drivers\tcpip.sys
2013-02-13 01:56 . 2013-01-03 05:04   187752   ----a-w-   c:\windows\system32\drivers\FWPKCLNT.SYS
2013-02-13 01:56 . 2013-01-04 04:50   169984   ----a-w-   c:\windows\system32\winsrv.dll
2013-02-13 01:04 . 2013-02-13 01:04   --------   d-----w-   c:\users\El Presidente\AppData\Local\Macromedia
2013-01-30 02:18 . 2013-01-30 02:18   --------   d-----w-   c:\users\El Presidente\AppData\Local\Mozilla
2013-01-30 02:18 . 2013-02-13 01:45   --------   d-----w-   c:\program files\Mozilla Maintenance Service
.
.
.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-02-13 01:56 . 2012-05-06 23:15   691568   ----a-w-   c:\windows\system32\FlashPlayerApp.exe
2013-02-13 01:56 . 2011-10-24 13:37   71024   ----a-w-   c:\windows\system32\FlashPlayerCPLApp.cpl
2013-01-17 09:28 . 2011-08-28 02:15   232336   ------w-   c:\windows\system32\MpSigStub.exe
2013-01-10 03:14 . 2013-01-10 03:14   66030   ----a-w-   C:\cc_20130109_191349.reg
2012-12-19 23:45 . 2012-12-19 23:45   180224   ----a-w-   c:\windows\system32\clinfo.exe
2012-12-19 23:44 . 2012-12-19 23:44   65536   ----a-w-   c:\windows\system32\OpenVideo.dll
2012-12-19 23:44 . 2012-12-19 23:44   56320   ----a-w-   c:\windows\system32\OVDecode.dll
2012-12-19 23:38 . 2012-12-19 23:38   28732928   ----a-w-   c:\windows\system32\amdocl.dll
2012-12-19 23:34 . 2012-12-19 23:34   50176   ----a-w-   c:\windows\system32\OpenCL.dll
2012-12-19 20:50 . 2012-01-05 23:10   5630200   ----a-w-   c:\windows\system32\atiumdag.dll
2012-12-19 20:47 . 2012-12-19 20:47   9647104   ----a-w-   c:\windows\system32\drivers\atikmdag.sys
2012-12-19 20:22 . 2012-12-19 20:22   58880   ----a-w-   c:\windows\system32\coinst_9.012.dll
2012-12-19 20:19 . 2012-12-19 20:19   163840   ----a-w-   c:\windows\system32\atiapfxx.exe
2012-12-19 20:18 . 2012-12-19 20:18   46080   ----a-w-   c:\windows\system32\aticalrt.dll
2012-12-19 20:17 . 2012-12-19 20:17   44032   ----a-w-   c:\windows\system32\aticalcl.dll
2012-12-19 20:13 . 2012-12-19 20:13   13703168   ----a-w-   c:\windows\system32\aticaldd.dll
2012-12-19 20:12 . 2012-12-19 20:12   18982400   ----a-w-   c:\windows\system32\atioglxx.dll
2012-12-19 20:09 . 2012-01-05 23:52   960512   ----a-w-   c:\windows\system32\aticfx32.dll
2012-12-19 20:06 . 2012-01-05 23:42   6681088   ----a-w-   c:\windows\system32\atidxx32.dll
2012-12-19 19:57 . 2012-12-19 19:57   442368   ----a-w-   c:\windows\system32\atidemgy.dll
2012-12-19 19:56 . 2012-12-19 19:56   482304   ----a-w-   c:\windows\system32\atieclxx.exe
2012-12-19 19:55 . 2012-12-19 19:55   219136   ----a-w-   c:\windows\system32\atiesrxx.exe
2012-12-19 19:54 . 2012-12-19 19:54   163840   ----a-w-   c:\windows\system32\atitmmxx.dll
2012-12-19 19:54 . 2012-12-19 19:54   20992   ----a-w-   c:\windows\system32\atimuixx.dll
2012-12-19 19:54 . 2012-12-19 19:54   43520   ----a-w-   c:\windows\system32\ati2edxx.dll
2012-12-19 19:44 . 2012-01-05 23:01   4162048   ----a-w-   c:\windows\system32\atiumdva.dll
2012-12-19 19:34 . 2012-12-19 19:34   78336   ----a-w-   c:\windows\system32\amdave32.dll
2012-12-19 19:34 . 2012-12-19 19:34   71168   ----a-w-   c:\windows\system32\atisamu32.dll
2012-12-19 19:33 . 2012-12-19 19:33   56832   ----a-w-   c:\windows\system32\atimpc32.dll
2012-12-19 19:33 . 2012-12-19 19:33   56832   ----a-w-   c:\windows\system32\amdpcom32.dll
2012-12-19 19:33 . 2012-12-19 19:33   421888   ----a-w-   c:\windows\system32\atiadlxx.dll
2012-12-19 19:33 . 2012-12-19 19:33   14848   ----a-w-   c:\windows\system32\atiglpxx.dll
2012-12-19 19:33 . 2012-12-19 19:33   33280   ----a-w-   c:\windows\system32\atigktxx.dll
2012-12-19 19:32 . 2012-12-19 19:32   442368   ----a-w-   c:\windows\system32\drivers\atikmpag.sys
2012-12-19 19:31 . 2012-01-05 22:49   109568   ----a-w-   c:\windows\system32\atiuxpag.dll
2012-12-19 19:30 . 2012-01-05 22:49   83968   ----a-w-   c:\windows\system32\atiu9pag.dll
2012-12-19 19:30 . 2012-12-19 19:30   53248   ----a-w-   c:\windows\system32\drivers\ati2erec.dll
2012-12-16 14:13 . 2012-12-21 11:01   295424   ----a-w-   c:\windows\system32\atmfd.dll
2012-12-16 14:13 . 2012-12-21 11:01   34304   ----a-w-   c:\windows\system32\atmlib.dll
2012-12-07 12:26 . 2013-01-08 20:58   308736   ----a-w-   c:\windows\system32\Wpc.dll
2012-12-07 12:20 . 2013-01-08 20:58   2576384   ----a-w-   c:\windows\system32\gameux.dll
2012-12-07 10:46 . 2013-01-08 20:58   43520   ----a-w-   c:\windows\system32\csrr.rs
2012-12-07 10:46 . 2013-01-08 20:58   30720   ----a-w-   c:\windows\system32\usk.rs
2012-12-07 10:46 . 2013-01-08 20:58   45568   ----a-w-   c:\windows\system32\oflc-nz.rs
2012-12-07 10:46 . 2013-01-08 20:58   44544   ----a-w-   c:\windows\system32\pegibbfc.rs
2012-12-07 10:46 . 2013-01-08 20:58   20480   ----a-w-   c:\windows\system32\pegi-pt.rs
2012-12-07 10:46 . 2013-01-08 20:58   23552   ----a-w-   c:\windows\system32\oflc.rs
2012-12-07 10:46 . 2013-01-08 20:58   20480   ----a-w-   c:\windows\system32\pegi-fi.rs
2012-12-07 10:46 . 2013-01-08 20:58   46592   ----a-w-   c:\windows\system32\fpb.rs
2012-12-07 10:46 . 2013-01-08 20:58   20480   ----a-w-   c:\windows\system32\pegi.rs
2012-12-07 10:46 . 2013-01-08 20:58   21504   ----a-w-   c:\windows\system32\grb.rs
2012-12-07 10:46 . 2013-01-08 20:58   40960   ----a-w-   c:\windows\system32\cob-au.rs
2012-12-07 10:46 . 2013-01-08 20:58   15360   ----a-w-   c:\windows\system32\djctq.rs
2012-12-07 10:46 . 2013-01-08 20:58   51712   ----a-w-   c:\windows\system32\esrb.rs
2012-12-07 10:46 . 2013-01-08 20:58   55296   ----a-w-   c:\windows\system32\cero.rs
2012-11-30 04:47 . 2013-01-08 20:55   293376   ----a-w-   c:\windows\system32\KernelBase.dll
2012-11-30 04:45 . 2013-01-08 20:55   4096   ---ha-w-   c:\windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2012-11-30 04:45 . 2013-01-08 20:55   4096   ---ha-w-   c:\windows\system32\api-ms-win-core-synch-l1-1-0.dll
2012-11-30 04:45 . 2013-01-08 20:55   3072   ---ha-w-   c:\windows\system32\api-ms-win-core-string-l1-1-0.dll
2012-11-30 04:45 . 2013-01-08 20:55   4608   ---ha-w-   c:\windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2012-11-30 04:45 . 2013-01-08 20:55   3584   ---ha-w-   c:\windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2012-11-30 04:45 . 2013-01-08 20:55   3072   ---ha-w-   c:\windows\system32\api-ms-win-core-profile-l1-1-0.dll
2012-11-30 04:45 . 2013-01-08 20:55   4096   ---ha-w-   c:\windows\system32\api-ms-win-core-misc-l1-1-0.dll
2012-11-30 04:45 . 2013-01-08 20:55   3584   ---ha-w-   c:\windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2012-11-30 04:45 . 2013-01-08 20:55   3584   ---ha-w-   c:\windows\system32\api-ms-win-core-memory-l1-1-0.dll
2012-11-30 04:45 . 2013-01-08 20:55   4096   ---ha-w-   c:\windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2012-11-30 04:45 . 2013-01-08 20:55   3584   ---ha-w-   c:\windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2012-11-30 04:45 . 2013-01-08 20:55   3584   ---ha-w-   c:\windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2012-11-30 04:45 . 2013-01-08 20:55   3584   ---ha-w-   c:\windows\system32\api-ms-win-core-heap-l1-1-0.dll
2012-11-30 04:45 . 2013-01-08 20:55   3072   ---ha-w-   c:\windows\system32\api-ms-win-core-io-l1-1-0.dll
2012-11-30 04:45 . 2013-01-08 20:55   3072   ---ha-w-   c:\windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2012-11-30 04:45 . 2013-01-08 20:55   4096   ---ha-w-   c:\windows\system32\api-ms-win-core-localization-l1-1-0.dll
2012-11-30 04:45 . 2013-01-08 20:55   5120   ---ha-w-   c:\windows\system32\api-ms-win-core-file-l1-1-0.dll
2012-11-30 04:45 . 2013-01-08 20:55   3072   ---ha-w-   c:\windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2012-11-30 04:45 . 2013-01-08 20:55   3072   ---ha-w-   c:\windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2012-11-30 04:45 . 2013-01-08 20:55   3072   ---ha-w-   c:\windows\system32\api-ms-win-core-handle-l1-1-0.dll
2012-11-30 04:45 . 2013-01-08 20:55   3072   ---ha-w-   c:\windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2012-11-30 04:45 . 2013-01-08 20:55   3072   ---ha-w-   c:\windows\system32\api-ms-win-core-debug-l1-1-0.dll
2012-11-30 04:45 . 2013-01-08 20:55   3072   ---ha-w-   c:\windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2012-11-30 04:45 . 2013-01-08 20:55   3072   ---ha-w-   c:\windows\system32\api-ms-win-core-console-l1-1-0.dll
2012-11-30 02:55 . 2013-01-08 20:55   271360   ----a-w-   c:\windows\system32\conhost.exe
2012-11-30 02:38 . 2013-01-08 20:55   6144   ---ha-w-   c:\windows\system32\api-ms-win-security-base-l1-1-0.dll
2012-11-30 02:38 . 2013-01-08 20:55   3584   ---ha-w-   c:\windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2012-11-30 02:38 . 2013-01-08 20:55   3072   ---ha-w-   c:\windows\system32\api-ms-win-core-util-l1-1-0.dll
2012-11-30 02:38 . 2013-01-08 20:55   4608   ---ha-w-   c:\windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2012-11-23 02:48 . 2013-01-08 20:54   49152   ----a-w-   c:\windows\system32\taskhost.exe
2012-11-22 04:45 . 2013-01-08 20:59   626688   ----a-w-   c:\windows\system32\usp10.dll
2012-11-20 04:51 . 2013-01-08 20:54   220160   ----a-w-   c:\windows\system32\ncrypt.dll
2013-02-06 03:46 . 2013-02-06 03:46   262552   ----a-w-   c:\program files\mozilla firefox\components\browsercomps.dll
.
.
(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2012-10-30 23:50   121528   ----a-w-   c:\program files\Alwil Software\Avast5\ashShell.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\1AMPCBOK]
@="{04cd1f3e-81d5-4904-a3ab-e0f99a7d769d}"
[HKEY_CLASSES_ROOT\CLSID\{04cd1f3e-81d5-4904-a3ab-e0f99a7d769d}]
2010-11-05 01:58   297808   ----a-w-   c:\windows\System32\mscoree.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\1AMPCBSyncing]
@="{4d87b7a7-23f1-470c-aa45-96b25b9bd138}"
[HKEY_CLASSES_ROOT\CLSID\{4d87b7a7-23f1-470c-aa45-96b25b9bd138}]
2010-11-05 01:58   297808   ----a-w-   c:\windows\System32\mscoree.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveBlacklistedOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42}]
2012-12-18 03:50   556648   ----a-w-   c:\program files\Google\Drive\googledrivesync32.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSharedOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D43}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D43}]
2012-12-18 03:50   556648   ----a-w-   c:\program files\Google\Drive\googledrivesync32.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSyncedOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40}]
2012-12-18 03:50   556648   ----a-w-   c:\program files\Google\Drive\googledrivesync32.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSyncingOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41}]
2012-12-18 03:50   556648   ----a-w-   c:\program files\Google\Drive\googledrivesync32.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-20 1174016]
"GoogleDriveSync"="c:\program files\Google\Drive\googledrivesync.exe" [2012-12-18 16328976]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Intuit SyncManager"="c:\program files\Common Files\Intuit\Sync\IntuitSyncManager.exe" [2012-10-08 2643320]
"LogMeIn GUI"="c:\program files\LogMeIn\x86\LogMeInSystray.exe" [2011-09-16 63048]
"ControlCenter4"="c:\program files\ControlCenter4\BrCcBoot.exe" [2010-10-28 139264]
"BrStsMon00"="c:\program files\Browny02\Brother\BrStMonW.exe" [2010-06-10 2621440]
"avast"="c:\program files\Alwil Software\Avast5\avastUI.exe" [2012-10-30 4297136]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2012-12-19 642808]
.
c:\users\Autosys\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OpenOffice.org 3.3.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2012-8-13 1199104]
OpenOffice.org 3.4.1.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2012-8-13 1199104]
.
c:\users\El Presidente\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
EvernoteClipper.lnk - c:\program files\Evernote\Evernote\EvernoteClipper.exe [2012-12-3 1044320]
JustCloud.lnk - c:\program files\JustCloud\JustCloud.exe [2013-1-16 1994792]
OpenOffice.org 3.4.1.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2012-8-13 1199104]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Intuit Data Protect.lnk - c:\program files\Common Files\Intuit\DataProtect\IntuitDataProtect.exe [2012-10-15 6153080]
QuickBooks Update Agent.lnk - c:\program files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe [2012-10-24 1157008]
QuickBooks_Standard_21.lnk - c:\program files\Intuit\QuickBooks 2011\QBW32.EXE [2012-10-24 1179024]
Run VNC Server.lnk - c:\program files\RealVNC\VNC4\winvnc4.exe [2011-10-30 439632]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2011-07-19 113024]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2011-05-04 17:54   551296   ----a-w-   c:\program files\SUPERAntiSpyware\SASWINLO.DLL
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute   REG_MULTI_SZ      autocheck autochk *\0sdnclean.exe
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\!SASCORE]
@=""
.
[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^GammaTray.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\GammaTray.lnk
backup=c:\windows\pss\GammaTray.lnk.CommonStartup
backupExtension=.CommonStartup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Logitech Download Assistant]
2010-11-04 05:50   1246544   ----a-w-   c:\windows\System32\LogiLDA.DLL
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LxrAutorun]
2009-12-18 04:10   24576   ----a-w-   c:\users\El Presidente\AppData\Local\Lexar Media\LxrAutorun.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MagicTuneLauncher]
2011-10-17 18:18   51712   ----a-w-   c:\program files\MagicTune Premium\MagicTuneLauncher.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2012-07-03 16:04   252848   ----a-w-   c:\program files\Common Files\Java\Java Update\jusched.exe
.
R1 aswSnx;aswSnx;

R3 Gizmo Central;Gizmo Central;c:\program files\Gizmo\gservice.exe

R3 MsDtsServer100;SQL Server Integration Services 10.0;c:\program files\Microsoft SQL Server\100\DTS\Binn\MsDtsSrvr.exe

R3 MSSQLFDLauncher;SQL Full-text Filter Daemon Launcher (MSSQLSERVER);c:\program files\Microsoft SQL Server\MSSQL10.MSSQLSERVER\MSSQL\Binn\fdlauncher.exe

R3 QBVSS;QBIDPService;c:\program files\Common Files\Intuit\DataProtect\QBIDPService.exe

R3 radpms;Driver for RADPMS Device;c:\windows\system32\DRIVERS\radpms.sys

R3 ReportServer;SQL Server Reporting Services (MSSQLSERVER);c:\program files\Microsoft SQL Server\MSRS10.MSSQLSERVER\Reporting Services\ReportServer\bin\ReportingServicesService.exe

R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys

R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe

R4 BrYNSvc;BrYNSvc;c:\program files\Browny02\BrYNSvc.exe

R4 MSSQLServerADHelper100;SQL Active Directory Helper Service;c:\program files\Microsoft SQL Server\100\Shared\SQLADHLP.EXE

R4 RsFx0103;RsFx0103 Driver;c:\windows\system32\DRIVERS\RsFx0103.sys

S1 aswSP;aswSP;

S1 GizmoDrv;Gizmo Device Driver;

S1 ISODisk;ISODisk;

S1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV.SYS

S1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS

S2 !SASCORE;SAS Core Service;c:\program files\SUPERAntiSpyware\SASCORE.EXE

S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe

S2 AMD FUEL Service;AMD FUEL Service;c:\program files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe

S2 aswFsBlk;aswFsBlk;

S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys

S2 BackupStack;Computer Backup (JustCloud);c:\program files\JustCloud\BackupStack.exe

S2 LMIGuardianSvc;LMIGuardianSvc;c:\program files\LogMeIn\x86\LMIGuardianSvc.exe

S2 LMIInfo;LogMeIn Kernel Information Provider;c:\program files\LogMeIn\x86\RaInfo.sys

S2 LxrSII1d;Secure II Driver;c:\windows\System32\Drivers\LxrSII1d.sys

S3 amdiox86;AMD IO Driver;c:\windows\system32\DRIVERS\amdiox86.sys

S3 AtiHDAudioService;AMD Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW73.sys

S3 netr28u;Belkin USB Wireless LAN Card Driver for Vista;c:\windows\system32\DRIVERS\netr28u.sys

.
.
--- Other Services/Drivers In Memory ---
.
*NewlyCreated* - 43344107
*Deregistered* - 43344107
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2013-02-01 19:15   1607120   ----a-w-   c:\program files\Google\Chrome\Application\24.0.1312.57\Installer\chrmstp.exe
.
Contents of the 'Scheduled Tasks' folder
.
2013-02-16 c:\windows\Tasks\Autosys_Inc 1355806477.job
- c:\program files\Intuit\QuickBooks 2011\AutoBackupEXE.exe [2012-10-24 17:57]
.
2013-02-17 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-11-27 04:39]
.
2013-02-17 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-11-27 04:39]
.
2013-02-17 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2657849761-2623932749-2735718110-1003Core.job
- c:\users\El Presidente\AppData\Local\Google\Update\GoogleUpdate.exe [2013-01-10 16:09]
.
2013-02-17 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2657849761-2623932749-2735718110-1003UA.job
- c:\users\El Presidente\AppData\Local\Google\Update\GoogleUpdate.exe [2013-01-10 16:09]
.
2013-02-17 c:\windows\Tasks\SUPERAntiSpyware Scheduled Task 327f8739-3035-4481-a440-0a85c6600994.job
- c:\program files\SUPERAntiSpyware\SASTask.exe [2011-05-04 17:52]
.
2013-02-16 c:\windows\Tasks\SUPERAntiSpyware Scheduled Task 908a3f11-0d45-4eec-bf44-023af2be388d.job
- c:\program files\SUPERAntiSpyware\SASTask.exe [2011-05-04 17:52]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/
IE: Add to Evernote 4.0 - c:\program files\Evernote\Evernote\EvernoteIE.dll/204
TCP: DhcpNameServer = 8.8.4.4 192.168.0.1
FF - ProfilePath - c:\users\El Presidente\AppData\Roaming\Mozilla\Firefox\Profiles\p2nfav4m.default\
.
- - - - ORPHANS REMOVED - - - -
.
WebBrowser-{17C962EC-C712-4230-90C4-1D611CAB6E08} - (no file)
HKCU-Run-SUPERAntiSpyware - c:\program files\SUPERAntiSpyware\84a210a9-f9d1-45ca-b223-adf3db41f441.com
MSConfigStartUp-ISUSPM - c:\programdata\FLEXnet\Connect\11\ISUSPM.exe
.
.
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'Explorer.exe'(1184)
c:\program files\JustCloud\LogicNP.EZShellExtensions.dll
c:\program files\JustCloud\x86\System.Data.SQLite.dll
c:\windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\cb562e2e4f74ae607f1186f6ec50cec7\System.Windows.Forms.ni.dll
.
Completion time: 2013-02-17  13:16:19
ComboFix-quarantined-files.txt  2013-02-17 21:16
.
Pre-Run: 97,442,193,408 bytes free
Post-Run: 97,455,493,120 bytes free
.
- - End Of File - - 596842D7BB93FF0124EF20DA40DD72F1

Thank you for your help.

[SuperDave]

Hello and welcome to Computer Hope Forum. My name is Dave. I will be helping you out with your particular problem on your computer.

1. I will be working on your Malware issues. This may or may not solve other issues you have with your machine.
2. The fixes are specific to your problem and should only be used for this issue on this machine.
3. If you don't know or understand something, please don't hesitate to ask.
4. Please DO NOT run any other tools or scans while I am helping you.
5. It is important that you reply to this thread. Do not start a new topic.
6. Your security programs may give warnings for some of the tools I will ask you to use. Be assured, any links I give are safe.
7. Absence of symptoms does not mean that everything is clear.

If you can't access the internet with your infected computer you will have to download and transfer any programs to the computer you're using now and transfer them to the infected computer with a CD-RW or a USB storage device. I prefer a CD because a storage device can get infected. If you use a storage device hold the shift key down while inserting the USB storage device for about 10 secs. You will also have to transfer the logs you receive back to the good computer using the same method until we can get the computer back on-line.
*************************************************************************
Please download AdwCleaner by Xplode onto your Desktop.

• Double click on AdwCleaner.exe to run the tool.
  
• Click on Search.
  
• A logfile will automatically open after the scan has finished.
• Please post the content of that logfile in your reply.
• You can find the logfile at C:\AdwCleaner[Rn].txt as well - n is the order number.

*********************************************
Please download Malwarebytes Anti-Malware from here.
Double Click mbam-setup.exe to install the application.

• Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes Anti-Malware, then click Finish.
  
• If an update is found, it will download and install the latest version.
• Once the program has loaded, select "Perform Full Scan", then click Scan.
  
• The scan may take some time to finish,so please be patient.
• When the scan is complete, click OK, then Show Results to view the results.
• Make sure that everything is checked, and click Remove Selected.
  
• When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Extra Note)
• Please save the log to a location you will remember.
• The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
• Copy and paste the entire report in your next reply.

Extra Note:

If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process. If asked to restart the computer, please do so immediately.
*************************************************
Download Security Check by screen317 from one of the following links and save it to your desktop.

Link 1
Link 2

* Double-click Security Check.bat
* Follow the on-screen instructions inside of the black box.
* A Notepad document should open automatically called checkup.txt
* Post the contents of that document in your next reply.

Note: If a security program requests permission from dig.exe to access the Internet, allow it to do so.