The_Communicator

January 12, 2013

Hi Gringo,

Thank you very much for providing me with your expert support. I have been reading more about internet security because of your tips. I've decided to further enhance my system's security software. I'm currently contemplating about purchasing MBAM Pro. Anyway, once again thank you very much. Your assistance is much appreciated. Please go ahead and close this thread.

Best Regards,

The Communicator

January 10, 2013

So far so good, nothing was found!

January 9, 2013

svchost.exe doesn't try to access potentially malicious IPs anymore according to MBAM. Today's the last day of the trial I hope it doesnt come back til I get the pro version.

Also, would you mind telling me what you found in the other logs? As far as I know there were some registry items detected by adwcleaner, if I understand correctly. Thanks Gringo.

Anyway here are the logs:

Malwarebytes Anti-Malware (Trial) 1.70.0.1100

www.malwarebytes.org

Database version: v2013.01.09.03

Windows 7 Service Pack 1 x86 NTFS

Internet Explorer 9.0.8112.16421

Atong :: ATONG-PC [administrator]

Protection: Enabled

1/9/2013 5:59:06 PM

mbam-log-2013-01-09 (17-59-06).txt

Scan type: Quick scan

Scan options disabled: P2P

Objects scanned: 219536

Time elapsed: 8 minute(s), 46 second(s)

Memory Processes Detected: 0

(No malicious items detected)

Memory Modules Detected: 0

(No malicious items detected)

Registry Keys Detected: 0

(No malicious items detected)

Registry Values Detected: 0

(No malicious items detected)

Registry Data Items Detected: 0

(No malicious items detected)

Folders Detected: 0

(No malicious items detected)

Files Detected: 0

(No malicious items detected)

(end)

Logfile of Trend Micro HijackThis v2.0.4

Scan saved at 6:15:59 PM, on 1/9/2013

Platform: Windows 7 SP1 (WinNT 6.00.3505)

MSIE: Internet Explorer v9.00 (9.00.8112.16457)

Boot mode: Normal

Running processes:

C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe

C:\Windows\system32\taskhost.exe

C:\Windows\system32\Dwm.exe

C:\Windows\Explorer.EXE

C:\Program Files\Avira\AntiVir Desktop\avgnt.exe

C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe

C:\Program Files\Sandboxie\SbieCtrl.exe

C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe

C:\Program Files\Western Digital\WD SmartWare\WD Drive Manager\WDDMStatus.exe

C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe

C:\Windows\system32\taskeng.exe

C:\Program Files\MSI Afterburner\MSIAfterburner.exe

C:\Program Files\MSI Afterburner\Bundle\OSDServer\RTSS.exe

C:\Windows\system32\wuauclt.exe

C:\Windows\system32\StikyNot.exe

C:\Windows\system32\taskmgr.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Windows\system32\taskhost.exe

C:\Program Files\VideoLAN\VLC\vlc.exe

C:\Windows\notepad.exe

C:\Users\Atong\Desktop\HijackThis.exe

C:\Windows\system32\SearchFilterHost.exe

C:\Windows\system32\taskeng.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - c:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

O2 - BHO: Lync Click to Call BHO - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files\Microsoft Office\Office15\OCHelper.dll

O2 - BHO: Java Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll

O2 - BHO: URLRedirectionBHO - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~1\MICROS~1\Office15\URLREDIR.DLL

O2 - BHO: Microsoft SPFS Browser Helper - {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} - C:\PROGRA~1\MICROS~1\Office15\GROOVEEX.DLL

O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll

O4 - HKLM\..\Run: [startCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun

O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min

O4 - HKLM\..\Run: [Adobe ARM] "c:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"

O4 - HKCU\..\Run: [sandboxieControl] "C:\Program Files\Sandboxie\SbieCtrl.exe"

O4 - HKCU\..\Run: [steam] "C:\Program Files\Steam\Steam.exe" -silent

O4 - HKCU\..\Run: [sUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe

O4 - HKCU\..\Run: [RESTART_STICKY_NOTES] C:\Windows\system32\StikyNot.exe

O4 - Global Startup: WDDMStatus.lnk = C:\Program Files\Western Digital\WD SmartWare\WD Drive Manager\WDDMStatus.exe

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~1\Office15\EXCEL.EXE/3000

O8 - Extra context menu item: Se&nd to OneNote - res://C:\PROGRA~1\MICROS~1\Office15\ONBttnIE.dll/105

O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office15\ONBttnIE.dll

O9 - Extra 'Tools' menuitem: Se&nd to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office15\ONBttnIE.dll

O9 - Extra button: Lync Click to Call - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files\Microsoft Office\Office15\OCHelper.dll

O9 - Extra 'Tools' menuitem: Lync Click to Call - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files\Microsoft Office\Office15\OCHelper.dll

O9 - Extra button: OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office\Office15\ONBttnIELinkedNotes.dll

O9 - Extra 'Tools' menuitem: OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office\Office15\ONBttnIELinkedNotes.dll

O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

O18 - Protocol: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office\Office15\MSOSB.DLL

O18 - Filter hijack: text/xml - {807583E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE15\MSOXMLMF.DLL

O23 - Service: SAS Core Service (!SASCORE) - SUPERAntiSpyware.com - C:\Program Files\SUPERAntiSpyware\SASCORE.EXE

O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - c:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe

O23 - Service: AMD External Events Utility - AMD - C:\Windows\system32\atiesrxx.exe

O23 - Service: AMD FUEL Service - Advanced Micro Devices, Inc. - C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe

O23 - Service: Avira Scheduler (AntiVirSchedulerService) - Avira Operations GmbH & Co. KG - C:\Program Files\Avira\AntiVir Desktop\sched.exe

O23 - Service: Avira Realtime Protection (AntiVirService) - Avira Operations GmbH & Co. KG - C:\Program Files\Avira\AntiVir Desktop\avguard.exe

O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe

O23 - Service: Google Update Service (gupdatem) (gupdatem) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe

O23 - Service: MBAMScheduler - Malwarebytes Corporation - C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe

O23 - Service: MBAMService - Malwarebytes Corporation - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe

O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe

O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe

O23 - Service: Sandboxie Service (SbieSvc) - SANDBOXIE L.T.D - C:\Program Files\Sandboxie\SbieSvc.exe

O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files\Common Files\Steam\SteamService.exe

O23 - Service: WDDMService - WDC - C:\Program Files\Western Digital\WD SmartWare\WD Drive Manager\WDDMService.exe

O23 - Service: WD File Management Engine (WDFME) - Unknown owner - C:\Program Files\Western Digital\WD SmartWare\Front Parlor\WDFME\WDFME.exe

O23 - Service: WD File Management Shadow Engine (WDSC) - Unknown owner - C:\Program Files\Western Digital\WD SmartWare\Front Parlor\WDSC.exe

--

End of file - 7139 bytes

January 8, 2013

Also I should mention around two weeks ago my browsers kept playing this song We are the Party by the Ex Girlfriends featuring Lupe Fuentes, in the background. I believe what caused this was running my browser without a script blocker. Tried closing all webpages and restarting both browsers but it wasn't isolated to either firefox or chrome. Ran full scans with avira, super antispyware and mbam. No detections with avira and mbam but super antispyware detected various items and the problem disappeared.

Note: When the problem appeared only avira was installed, it was a time when I just formatted the computer so I haven't installed mbam and sas.

Anyway, here's the log of combofix with the clear java cache script:

ComboFix 13-01-08.01 - Atong 01/09/2013 2:26.2.4 - x86

Microsoft Windows 7 Professional 6.1.7601.1.1252.1.1033.18.3071.2113 [GMT 8:00]

Running from: c:\users\Atong\Desktop\ComboFix.exe

Command switches used :: c:\users\Atong\Desktop\CFScript.txt

AV: Avira Desktop *Disabled/Updated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}

SP: Avira Desktop *Disabled/Updated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

((((((((((((((((((((((((( Files Created from 2012-12-08 to 2013-01-08 )))))))))))))))))))))))))))))))

.

2013-01-08 18:33 . 2013-01-08 18:33 -------- d-----w- c:\users\Default\AppData\Local\temp

2013-01-05 23:52 . 2013-01-05 23:52 -------- d-----w- c:\program files\Creative

2013-01-05 23:52 . 2002-06-06 06:38 139264 ----a-w- c:\windows\system32\eax.dll

2013-01-05 23:52 . 1998-10-29 08:45 306688 ----a-w- c:\windows\IsUninst.exe

2013-01-05 22:37 . 2013-01-05 22:47 -------- d-----w- C:\Root

2013-01-05 22:37 . 2013-01-05 22:37 -------- d-----w- c:\program files\Activision

2013-01-01 13:53 . 2013-01-01 13:53 -------- d-----w- c:\program files\Sleeping.Dogs-1.7+North.Point.DLC

2012-12-26 20:15 . 2012-12-26 20:15 -------- d-----w- c:\programdata\Malwarebytes

2012-12-26 20:15 . 2012-12-14 08:49 21104 ----a-w- c:\windows\system32\drivers\mbam.sys

2012-12-26 20:15 . 2012-12-28 08:59 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2012-12-26 20:12 . 2012-12-26 20:13 -------- d-----w- c:\program files\SUPERAntiSpyware

2012-12-26 20:12 . 2012-12-26 20:12 -------- d-----w- c:\programdata\SUPERAntiSpyware.com

2012-12-25 22:53 . 2010-08-12 03:46 758784 ----a-w- c:\windows\system32\cohelper.dll

2012-12-25 22:53 . 2010-08-09 14:33 11164 ----a-w- c:\windows\system32\drivers\nvphy.bin

2012-12-25 22:50 . 2012-12-25 22:50 -------- d-----w- c:\program files\Microsoft Silverlight

2012-12-25 19:45 . 2012-12-25 19:45 -------- d-----w- c:\program files\Common Files\Steam

2012-12-25 19:45 . 2013-01-08 17:44 -------- d-----w- c:\program files\Steam

2012-12-25 16:30 . 2012-12-25 22:53 -------- d-----w- c:\program files\NVIDIA Corporation

2012-12-25 16:23 . 2012-12-25 16:24 -------- d-----w- c:\program files\FreeArc

2012-12-25 15:56 . 2012-12-25 16:38 -------- d-----w- c:\program files\Mass Effect 3

2012-12-25 14:46 . 2011-03-25 02:58 258560 ----a-w- c:\windows\system32\drivers\usbhub.sys

2012-12-25 14:46 . 2011-03-25 02:58 284672 ----a-w- c:\windows\system32\drivers\usbport.sys

2012-12-25 14:46 . 2011-03-25 02:58 75776 ----a-w- c:\windows\system32\drivers\usbccgp.sys

2012-12-25 14:46 . 2011-03-25 02:57 43008 ----a-w- c:\windows\system32\drivers\usbehci.sys

2012-12-25 14:46 . 2011-03-25 02:57 20480 ----a-w- c:\windows\system32\drivers\usbohci.sys

2012-12-25 14:46 . 2011-03-25 02:57 24064 ----a-w- c:\windows\system32\drivers\usbuhci.sys

2012-12-25 14:46 . 2011-03-25 02:57 5888 ----a-w- c:\windows\system32\drivers\usbd.sys

2012-12-25 14:41 . 2011-03-11 05:39 148864 ----a-w- c:\windows\system32\drivers\storport.sys

2012-12-25 14:41 . 2011-03-11 05:39 143744 ----a-w- c:\windows\system32\drivers\nvstor.sys

2012-12-25 14:41 . 2011-03-11 05:39 117120 ----a-w- c:\windows\system32\drivers\nvraid.sys

2012-12-25 14:41 . 2011-03-11 05:38 332160 ----a-w- c:\windows\system32\drivers\iaStorV.sys

2012-12-25 14:41 . 2011-03-11 05:38 80256 ----a-w- c:\windows\system32\drivers\amdsata.sys

2012-12-25 14:41 . 2011-03-11 05:38 22400 ----a-w- c:\windows\system32\drivers\amdxata.sys

2012-12-25 14:41 . 2011-03-11 05:33 1699328 ----a-w- c:\windows\system32\esent.dll

2012-12-25 14:41 . 2011-03-11 05:31 74240 ----a-w- c:\windows\system32\fsutil.exe

2012-12-25 12:45 . 2012-12-25 12:50 -------- d-----w- c:\program files\SAMSUNG

2012-12-25 12:44 . 2012-12-25 12:44 -------- d-----w- c:\programdata\Samsung

2012-12-24 12:34 . 2012-12-24 12:35 -------- d-----w- c:\program files\foobar2000

2012-12-24 10:48 . 2012-12-23 18:57 -------- d-----w- c:\windows\Panther

2012-12-24 10:48 . 2012-12-24 10:48 -------- d-----w- C:\Boot

2012-12-24 01:43 . 2012-12-24 01:44 -------- d-----w- c:\users\Mama

2012-12-23 22:17 . 2012-12-23 22:17 -------- d-----w- c:\programdata\Ubisoft

2012-12-23 21:23 . 2012-12-23 21:23 189248 ----a-w- c:\windows\system32\PnkBstrB.exe

2012-12-23 21:23 . 2012-12-23 21:23 75136 ----a-w- c:\windows\system32\PnkBstrA.exe

2012-12-23 21:21 . 2008-10-14 22:22 452440 ----a-w- c:\windows\system32\d3dx10_40.dll

2012-12-23 21:21 . 2008-10-14 22:22 2036576 ----a-w- c:\windows\system32\D3DCompiler_40.dll

2012-12-23 21:21 . 2008-10-14 22:22 4379984 ----a-w- c:\windows\system32\D3DX9_40.dll

2012-12-23 21:10 . 2013-01-05 22:47 -------- d--h--w- c:\program files\InstallShield Installation Information

2012-12-23 20:38 . 2012-12-23 20:38 -------- d-----w- c:\program files\Common Files\Adobe

2012-12-23 20:38 . 2012-12-23 20:38 -------- d-----w- c:\program files\7-Zip

2012-12-23 20:37 . 2012-07-26 03:39 526952 ----a-w- c:\windows\system32\drivers\Wdf01000.sys

2012-12-23 20:37 . 2012-07-26 03:39 47720 ----a-w- c:\windows\system32\drivers\WdfLdr.sys

2012-12-23 20:37 . 2012-07-26 02:46 9728 ----a-w- c:\windows\system32\Wdfres.dll

2012-12-23 20:36 . 2012-12-23 20:36 -------- d-----w- c:\program files\uTorrent

2012-12-23 20:36 . 2012-07-26 02:33 66560 ----a-w- c:\windows\system32\drivers\WUDFPf.sys

2012-12-23 20:36 . 2012-07-26 02:32 155136 ----a-w- c:\windows\system32\drivers\WUDFRd.sys

2012-12-23 20:36 . 2012-07-26 03:21 196608 ----a-w- c:\windows\system32\WUDFHost.exe

2012-12-23 20:36 . 2012-07-26 03:20 73216 ----a-w- c:\windows\system32\WUDFSvc.dll

2012-12-23 20:36 . 2012-07-26 03:20 613888 ----a-w- c:\windows\system32\WUDFx.dll

2012-12-23 20:36 . 2012-07-26 03:20 38912 ----a-w- c:\windows\system32\WUDFCoinstaller.dll

2012-12-23 20:36 . 2012-07-26 03:20 172032 ----a-w- c:\windows\system32\WUDFPlatform.dll

2012-12-23 20:34 . 2012-08-02 16:57 490496 ----a-w- c:\windows\system32\d3d10level9.dll

2012-12-23 20:33 . 2012-12-23 20:33 -------- d-----w- c:\program files\CCleaner

2012-12-23 20:32 . 2013-01-08 17:44 -------- d-----w- c:\program files\MSI Afterburner

2012-12-23 20:31 . 2011-02-03 05:54 219008 ----a-w- c:\windows\system32\drivers\dxgmms1.sys

2012-12-23 20:31 . 2011-04-22 19:14 27008 ----a-w- c:\windows\system32\drivers\Diskdump.sys

2012-12-23 20:25 . 2012-12-23 21:17 -------- d-----w- c:\program files\CPUID

2012-12-23 20:16 . 2012-12-16 14:13 295424 ----a-w- c:\windows\system32\atmfd.dll

2012-12-23 20:16 . 2012-12-16 14:13 34304 ----a-w- c:\windows\system32\atmlib.dll

2012-12-23 20:16 . 2010-09-30 06:47 70656 ----a-w- c:\windows\system32\fontsub.dll

2012-12-23 20:07 . 2012-12-23 20:07 -------- d-----w- c:\program files\Mozilla Maintenance Service

2012-12-23 20:06 . 2012-12-23 20:11 -------- d-----w- c:\programdata\Western Digital

2012-12-23 20:05 . 2012-12-23 20:05 -------- d-----w- c:\program files\Western Digital

2012-12-23 19:47 . 2012-12-23 19:47 -------- d-----w- C:\NVIDIA

2012-12-23 19:43 . 2012-12-23 19:43 -------- d-----w- c:\windows\system32\Wat

2012-12-23 19:31 . 2012-06-06 05:05 1019904 ----a-w- c:\program files\Common Files\System\ado\msado15.dll

2012-12-23 19:31 . 2012-06-06 05:03 805376 ----a-w- c:\windows\system32\cdosys.dll

2012-12-23 19:31 . 2012-06-06 05:05 143360 ----a-w- c:\program files\Common Files\System\ado\msjro.dll

2012-12-23 19:31 . 2012-06-06 05:05 372736 ----a-w- c:\program files\Common Files\System\ado\msadox.dll

2012-12-23 19:31 . 2012-06-06 05:05 57344 ----a-w- c:\program files\Common Files\System\ado\msador15.dll

2012-12-23 19:31 . 2012-06-06 05:05 352256 ----a-w- c:\program files\Common Files\System\ado\msadomd.dll

2012-12-23 19:31 . 2012-06-06 05:05 212992 ----a-w- c:\program files\Common Files\System\msadc\msadco.dll

2012-12-23 19:31 . 2012-06-02 04:36 140288 ----a-w- c:\windows\system32\cryptsvc.dll

2012-12-23 19:31 . 2012-06-02 04:36 1159680 ----a-w- c:\windows\system32\crypt32.dll

2012-12-23 19:31 . 2012-06-02 04:36 103936 ----a-w- c:\windows\system32\cryptnet.dll

2012-12-23 19:29 . 2012-12-26 19:07 73656 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl

2012-12-23 19:29 . 2012-12-26 19:07 697272 ----a-w- c:\windows\system32\FlashPlayerApp.exe

2012-12-23 19:29 . 2012-11-02 05:11 376832 ----a-w- c:\windows\system32\dpnet.dll

2012-12-23 19:29 . 2012-03-31 04:30 1221632 ----a-w- c:\program files\Windows Journal\NBDoc.DLL

2012-12-23 19:29 . 2012-03-31 04:29 936960 ----a-w- c:\program files\Common Files\Microsoft Shared\ink\journal.dll

2012-12-23 19:29 . 2012-03-31 04:29 989184 ----a-w- c:\program files\Windows Journal\JNTFiltr.dll

2012-12-23 19:29 . 2012-03-31 04:29 969216 ----a-w- c:\program files\Windows Journal\JNWDRV.dll

2012-12-23 19:29 . 2012-12-23 19:29 -------- d-----w- c:\program files\Microsoft Analysis Services

2012-12-23 19:27 . 2011-07-09 02:30 223744 ----a-w- c:\windows\system32\drivers\mrxsmb10.sys

2012-12-23 19:27 . 2011-04-27 02:17 96768 ----a-w- c:\windows\system32\drivers\mrxsmb20.sys

2012-12-23 19:27 . 2011-04-27 02:17 123904 ----a-w- c:\windows\system32\drivers\mrxsmb.sys

2012-12-23 19:27 . 2011-10-26 04:32 1328128 ----a-w- c:\windows\system32\quartz.dll

2012-12-23 19:27 . 2011-04-25 02:18 338944 ----a-w- c:\windows\system32\drivers\afd.sys

2012-12-23 19:27 . 2012-08-10 23:56 542208 ----a-w- c:\windows\system32\kerberos.dll

2012-12-23 19:27 . 2011-11-17 05:35 314880 ----a-w- c:\windows\system32\webio.dll

2012-12-23 19:27 . 2011-11-17 05:34 15872 ----a-w- c:\windows\system32\sspisrv.dll

2012-12-23 19:27 . 2011-11-17 05:34 100352 ----a-w- c:\windows\system32\sspicli.dll

2012-12-23 19:27 . 2011-11-17 05:34 22016 ----a-w- c:\windows\system32\secur32.dll

2012-12-23 19:27 . 2011-11-17 05:29 22528 ----a-w- c:\windows\system32\lsass.exe

2012-12-23 19:26 . 2012-12-23 19:26 -------- d-----w- c:\windows\system32\Macromed

2012-12-23 19:26 . 2012-06-06 05:05 1390080 ----a-w- c:\windows\system32\msxml6.dll

2012-12-23 19:26 . 2012-06-06 05:05 1236992 ----a-w- c:\windows\system32\msxml3.dll

2012-12-23 19:26 . 2010-06-26 03:24 2048 ----a-w- c:\windows\system32\msxml3r.dll

2012-12-23 19:26 . 2011-08-27 04:26 571904 ----a-w- c:\windows\system32\oleaut32.dll

2012-12-23 19:26 . 2011-08-27 04:26 233472 ----a-w- c:\windows\system32\oleacc.dll

2012-12-23 19:26 . 2012-08-24 16:57 172544 ----a-w- c:\windows\system32\wintrust.dll

2012-12-23 19:26 . 2011-05-03 04:30 741376 ----a-w- c:\windows\system32\inetcomm.dll

2012-12-23 19:22 . 2012-12-23 19:22 -------- d-----w- c:\program files\PowerISO

2012-12-23 19:22 . 2012-03-03 05:31 1077248 ----a-w- c:\windows\system32\DWrite.dll

2012-12-23 19:21 . 2012-11-09 04:42 2048 ----a-w- c:\windows\system32\tzres.dll

2012-12-23 19:21 . 2012-12-23 19:29 -------- d-----w- c:\program files\Google

2012-12-23 19:20 . 2011-03-11 05:33 1164288 ----a-w- c:\windows\system32\mfc42u.dll

2012-12-23 19:20 . 2011-03-11 05:33 1137664 ----a-w- c:\windows\system32\mfc42.dll

2012-12-23 19:20 . 2012-03-17 07:27 56176 ----a-w- c:\windows\system32\drivers\partmgr.sys

2012-12-23 19:20 . 2011-12-16 07:52 690688 ----a-w- c:\windows\system32\msvcrt.dll

2012-12-23 19:20 . 2011-04-09 05:56 123904 ----a-w- c:\windows\system32\poqexec.exe

2012-12-23 19:20 . 2012-04-26 04:45 58880 ----a-w- c:\windows\system32\rdpwsx.dll

2012-12-23 19:20 . 2012-04-26 04:45 129536 ----a-w- c:\windows\system32\rdpcorekmts.dll

2012-12-23 19:20 . 2012-04-26 04:41 8192 ----a-w- c:\windows\system32\rdrmemptylst.exe

2012-12-23 19:20 . 2012-09-25 22:47 78336 ----a-w- c:\windows\system32\synceng.dll

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2012-10-16 07:39 . 2012-12-23 20:35 561664 ----a-w- c:\windows\apppatch\AcLayers.dll

2012-11-29 08:27 . 2012-12-23 20:07 262112 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrivePro1 (ErrorConflict)]

@="{8BA85C75-763B-4103-94EB-9470F12FE0F7}"

[HKEY_CLASSES_ROOT\CLSID\{8BA85C75-763B-4103-94EB-9470F12FE0F7}]

2012-06-23 10:19 2042504 ----a-w- c:\progra~1\MICROS~1\Office15\GROOVEEX.DLL

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrivePro2 (SyncInProgress)]

@="{CD55129A-B1A1-438E-A425-CEBC7DC684EE}"

[HKEY_CLASSES_ROOT\CLSID\{CD55129A-B1A1-438E-A425-CEBC7DC684EE}]

2012-06-23 10:19 2042504 ----a-w- c:\progra~1\MICROS~1\Office15\GROOVEEX.DLL

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrivePro3 (InSync)]

@="{E768CD3B-BDDC-436D-9C13-E1B39CA257B1}"

[HKEY_CLASSES_ROOT\CLSID\{E768CD3B-BDDC-436D-9C13-E1B39CA257B1}]

2012-06-23 10:19 2042504 ----a-w- c:\progra~1\MICROS~1\Office15\GROOVEEX.DLL

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"SandboxieControl"="c:\program files\Sandboxie\SbieCtrl.exe" [2012-08-25 545552]

"uTorrent"="c:\program files\uTorrent\uTorrent.exe" [2012-12-23 969104]

"Steam"="c:\program files\Steam\Steam.exe" [2012-11-19 1348944]

"SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2012-11-01 4763008]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2012-09-28 642728]

"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2012-12-25 348664]

"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-09-23 926896]

.

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\

WDDMStatus.lnk - c:\program files\Western Digital\WD SmartWare\WD Drive Manager\WDDMStatus.exe [2010-9-8 5185536]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"ConsentPromptBehaviorAdmin"= 5 (0x5)

"ConsentPromptBehaviorUser"= 3 (0x3)

"EnableUIADesktopToggle"= 0 (0x0)

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\!SASCORE]

@=""

.

R3 AIDA64Driver;FinalWire AIDA64 Kernel Driver;c:\users\Atong\Desktop\aida64extreme_build_2232_nwj7tfz9dl\kerneld.x32 [x]

R3 cpuz135;cpuz135;c:\users\Atong\AppData\Local\Temp\cpuz135\cpuz135_x32.sys [x]

R3 dg_ssudbus;SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudbus.sys [x]

R3 dmvsc;dmvsc;c:\windows\system32\drivers\dmvsc.sys [x]

R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [x]

R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]

R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [x]

R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [x]

R3 WDC_SAM;WD SCSI Pass Thru driver;c:\windows\system32\DRIVERS\wdcsam.sys [x]

S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys [x]

S1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV.SYS [x]

S1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [x]

S2 !SASCORE;SAS Core Service;c:\program files\SUPERAntiSpyware\SASCORE.EXE [x]

S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [x]

S2 AMD FUEL Service;AMD FUEL Service;c:\program files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [x]

S2 AntiVirSchedulerService;Avira Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [x]

S2 AODDriver4.2;AODDriver4.2;c:\program files\ATI Technologies\ATI.ACE\Fuel\i386\AODDriver2.sys [x]

S2 MBAMScheduler;MBAMScheduler;c:\program files\Malwarebytes' Anti-Malware\mbamscheduler.exe [x]

S2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [x]

S2 WDDMService;WDDMService;c:\program files\Western Digital\WD SmartWare\WD Drive Manager\WDDMService.exe [x]

S2 WDFME;WD File Management Engine;c:\program files\Western Digital\WD SmartWare\Front Parlor\WDFME\WDFME.exe [x]

S2 WDSC;WD File Management Shadow Engine;c:\program files\Western Digital\WD SmartWare\Front Parlor\WDSC.exe [x]

S3 AtiHDAudioService;AMD Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW73.sys [x]

S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [x]

S3 RTCore32;RTCore32;c:\program files\MSI Afterburner\RTCore32.sys [x]

.

--- Other Services/Drivers In Memory ---

.

*NewlyCreated* - RTCORE32

*NewlyCreated* - WS2IFSL

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

GPSvcGroup REG_MULTI_SZ GPSvc

.

Contents of the 'Scheduled Tasks' folder

.

2013-01-08 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files\Google\Update\GoogleUpdate.exe [2012-12-23 19:21]

.

2013-01-08 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files\Google\Update\GoogleUpdate.exe [2012-12-23 19:21]

.

2013-01-08 c:\windows\Tasks\SUPERAntiSpyware Scheduled Task 37d57356-491d-4780-ae9c-e1905f19a63a.job

- c:\program files\SUPERAntiSpyware\SASTask.exe [2011-05-04 17:52]

.

------- Supplementary Scan -------

.

IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~1\Office15\EXCEL.EXE/3000

IE: Se&nd to OneNote - c:\progra~1\MICROS~1\Office15\ONBttnIE.dll/105

TCP: DhcpNameServer = 192.168.1.1

Filter: text/xml - {807583E5-5146-11D5-A672-00B0D022E945} - c:\program files\Common Files\microsoft shared\OFFICE15\MSOXMLMF.DLL

FF - ProfilePath - c:\users\Atong\AppData\Roaming\Mozilla\Firefox\Profiles\iw9xst90.default\

FF - ExtSQL: 2012-12-27 03:57; {73a6fe31-595d-460b-a920-fcc0f8843232}; c:\users\Atong\AppData\Roaming\Mozilla\Firefox\Profiles\iw9xst90.default\extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi

FF - ExtSQL: 2013-01-07 01:07; {a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}; c:\users\Atong\AppData\Roaming\Mozilla\Firefox\Profiles\iw9xst90.default\extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AIDA64Driver]

"ImagePath"="\??\c:\users\Atong\Desktop\aida64extreme_build_2232_nwj7tfz9dl\kerneld.x32"

.

--------------------- LOCKED REGISTRY KEYS ---------------------

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]

@Denied: (Full) (Everyone)

.

--------------------- DLLs Loaded Under Running Processes ---------------------

.

- - - - - - - > 'lsass.exe'(620)

c:\windows\system32\dssenh.dll

.

- - - - - - - > 'Explorer.exe'(4768)

c:\program files\MSI Afterburner\Bundle\OSDServer\RTSSHooks.dll

.

Completion time: 2013-01-09 02:38:57

ComboFix-quarantined-files.txt 2013-01-08 18:38

ComboFix2.txt 2013-01-08 17:39

.

Pre-Run: 26,378,362,880 bytes free

Post-Run: 26,337,587,200 bytes free

.

- - End Of File - - 7892C27542A561E17B5B05CAEDD07E7E

January 8, 2013

I just checked mbam protection logs and the incoming/outgoing connections by svchost.exe to the said IP address stopped 3 hours ago, before we even started troubleshooting. That's odd, anyway here's the log from combofix

ComboFix 13-01-08.01 - Atong 01/09/2013 1:32.1.4 - x86

Microsoft Windows 7 Professional 6.1.7601.1.1252.1.1033.18.3071.2208 [GMT 8:00]

Running from: c:\users\Atong\Desktop\ComboFix.exe

AV: Avira Desktop *Disabled/Updated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}

SP: Avira Desktop *Disabled/Updated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

* Created a new restore point

.

((((((((((((((((((((((((( Files Created from 2012-12-08 to 2013-01-08 )))))))))))))))))))))))))))))))

.

2013-01-08 17:38 . 2013-01-08 17:38 -------- d-----w- c:\users\Default\AppData\Local\temp