Ads in bottom (browser) + some more

EZP · December 17, 2012

Hello , currently dealing with some ads in bottom left corner in every browser including Steam , been running some tools , I will give you the logs :

1)Malwarebytes Anti-Malware 1.65.1.1000

www.malwarebytes.org

Version de la base de données: v2012.12.14.04

Windows 7 Service Pack 1 x64 NTFS

Internet Explorer 9.0.8112.16421

Grimlot :: GRIMLOT-PC [administrateur]

14/12/2012 13:40:37

mbam-log-2012-12-14 (16-32-04).txt

Type d'examen: Examen complet (C:\|D:\|E:\|F:\|)

Options d'examen désactivées:

Elément(s) analysé(s): 476029

Temps écoulé: 1 heure(s), 30 minute(s), 16 seconde(s)

Processus mémoire détecté(s): 0

(Aucun élément nuisible détecté)

Module(s) mémoire détecté(s): 0

(Aucun élément nuisible détecté)

Clé(s) du Registre détectée(s): 2

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{78F3A323-798E-4AEA-9A57-88F4B05FD5DD} (PUP.VShareRedir) -> Aucune action effectuée.

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{7AC3E13B-3BCA-4158-B330-F66DBB03C1B5} (PUP.VShareRedir) -> Aucune action effectuée.

Valeur(s) du Registre détectée(s): 0

(Aucun élément nuisible détecté)

Elément(s) de données du Registre détecté(s): 1

HKLM\SOFTWARE\Microsoft\Internet Explorer\Main|Start Page (Hijack.StartPage) -> Mauvais: (http://startsear.ch/?aff=2&cf=e5d2c87d-e566-11e1-9841-8c89a597f03a) Bon: (http://www.google.com) -> Aucune action effectuée.

Dossier(s) détecté(s): 0

(Aucun élément nuisible détecté)

Fichier(s) détecté(s): 4

C:\Users\Grimlot\AppData\Local\svcxdcl32.exe (Trojan.Ransom) -> Aucune action effectuée.

C:\Users\Grimlot\AppData\Roaming\svcxdcl32.exe (Trojan.Ransom) -> Aucune action effectuée.

C:\Users\Grimlot\AppData\Roaming\4C3CC0\4C3CC0.exe (Spyware.Carberp) -> Aucune action effectuée.

C:\Users\Grimlot\Local Settings\Application Data\svcxdcl32.exe (Trojan.Agent) -> Aucune action effectuée.

(fin)Cleaned them after.Second scan reveals nothing

.

+aswbmr showed up a Trojan.gen infected file , manually msconfig to stop it and then VirusTotal'd it , appears to be Zbot.

+Ran zbotkiller : No results.

Thank you for your help.

attach.txt

dds.txt

Maniac · December 17, 2012

Hello EZP and :welcome: ! My name is Maniac and I will be glad to help you solve your malware problem.

Please note:

If you are a paying customer, you have the privilege to contact the help desk at Consumer Support. If you choose this option to get help, please let me know.
I recommend you to keep the instructions I will be giving you so that they are available to you at any time. You can save them in a text file or print them.
Make sure you read all of the instructions and fixes thoroughly before continuing with them.
Follow my instructions strictly and don’t hesitate to stop and ask me if you have any questions.
Post your log files, don't attach them. Every log file should be copy/pasted in your next reply.
Do not perform any kind of scanning and fixing without my instructions. If you want to proceed on your own, please let me know.

BACKDOOR WARNING

One or more of the identified infections is known to use a backdoor.

This allows hackers to remotely control your computer, steal critical system information and download and execute files.

I would advice you to disconnect this PC from the Internet immediately. If you do any banking or other financial transactions on the PC or if it should contain any other sensitive information, please get to a known clean computer and change all passwords where applicable, and it would be wise to contact those same financial institutions to apprise them of your situation.

Though the infection has been identified and can be killed, because of it's backdoor functionality, your PC is very likely compromised and there is no way to be sure your computer can ever again be trusted. Many experts in the security community believe that once infected with this type of trojan, the best course of action would be a reformat and reinstall of the OS. Please read these for more information:

Help: I Got Hacked. Now What Do I Do?

Help: I Got Hacked. Now What Do I Do? Part II

How Do I Handle Possible Identify Theft, Internet Fraud and CC Fraud?

When Should I Format, How Should I Reinstall

We can still clean this machine but I can't guarantee that it will be 100% secure afterwards. Let me know what you decide to do. If you decide to go through with the cleanup, please let me know.

EZP · December 17, 2012

Let's try to clean it.

Maybe afterwards , I want to ask you some questions.

Maniac · December 18, 2012

Feel free to ask me.

EZP · December 19, 2012

Thanks !

Ok what can I do to clean the machine ?

And it's not my PC but one in my place , and it is security softwareless !!! Can you guide me to the point the machine is malware free and help me to install some security softs ? (Because I know that malware can tamper with antivirus and such if installed in an infected machine)

EZP · December 20, 2012

If you don't mind , here's some news : I ran Kaspersky Virus removal tool and found multiple instance of Win32.Trojan.hosts.gen , I deleted them all and reboot and it seems that fixed my problem , no more ads.

But please , can we still continue the cleaning process like if I did not run the tool ?

I repeat , would you kindly guide me to the point the machine is malware free and help me to install some security softs ? (Because I know that malware can tamper with antivirus and such if installed in an infected machine) , I don't wanna have something laying in the back :unsure:

Maniac · December 20, 2012

Can you guide me to the point the machine is malware free and help me to install some security softs ? (Because I know that malware can tamper with antivirus and such if installed in an infected machine)

Please read my post back:

We can still clean this machine but I can't guarantee that it will be 100% secure afterwards.

I just want to be sure that you are agree with that statement and could proceed with the cleaning.

EZP · December 21, 2012

I agree and hope you agree with my statements too !

Maniac · December 21, 2012

Please generate a new fresh DDS log files.

EZP · December 22, 2012

Here we go

attach.txt

dds.txt

EZP · December 22, 2012

dds.txt :

DDS (Ver_2012-11-20.01) - NTFS_AMD64

Internet Explorer: 9.0.8112.16457 BrowserJavaVersion: 10.6.2

Run by Grimlot at 18:56:50 on 2012-12-22

Microsoft Windows 7 Édition Familiale Premium 6.1.7601.1.1252.33.1036.18.6126.3930 [GMT 1:00]

.

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

SP: Spybot - Search and Destroy *Enabled/Outdated* {9BC38DF1-3CCA-732D-A930-C1CA5F20A4B0}

.

============== Running Processes ===============

.

C:\Windows\system32\lsm.exe

C:\Windows\system32\svchost.exe -k DcomLaunch

C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe

C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe

C:\Windows\system32\svchost.exe -k RPCSS

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted

C:\Windows\system32\svchost.exe -k netsvcs

C:\Windows\system32\svchost.exe -k GPSvcGroup

C:\Windows\system32\svchost.exe -k LocalService

C:\Windows\system32\svchost.exe -k NetworkService

C:\Windows\System32\spoolsv.exe

C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork

C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan 2.0\kss.exe

C:\Windows\SysWOW64\PnkBstrA.exe

C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe

C:\Program Files\Soluto\SolutoService.exe

C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe

C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe

C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted

C:\Windows\System32\WUDFHost.exe

C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation

C:\Windows\system32\SearchIndexer.exe

C:\Windows\system32\taskhost.exe

C:\Program Files\Soluto\soluto.exe

C:\Windows\system32\Dwm.exe

C:\Windows\Explorer.EXE

C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan 2.0\kss.exe

C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe

C:\Program Files (x86)\ROCCAT\Kone Pure Mouse\KonePureMonitor.exe

C:\Windows\System32\svchost.exe -k LocalServicePeerNet

C:\Program Files (x86)\Mumble\mumble.exe

C:\Windows\system32\taskeng.exe

C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe

C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2.exe

C:\Program Files (x86)\Steam\Steam.exe

C:\Program Files (x86)\Common Files\Steam\SteamService.exe

C:\Windows\system32\SearchProtocolHost.exe

C:\Windows\system32\taskhost.exe

C:\Program Files (x86)\Mozilla Firefox\firefox.exe

C:\Program Files (x86)\Steam\bin\SteamService.exe

C:\Windows\system32\msiexec.exe

C:\Windows\system32\vssvc.exe

C:\Windows\System32\svchost.exe -k swprv

C:\Windows\servicing\TrustedInstaller.exe

C:\Windows\system32\SearchFilterHost.exe

C:\Program Files (x86)\Steam\steamapps\common\Borderlands 2\Binaries\Redist\dotNetFx40_Client_x86_x64.exe

C:\d1d92a8dda8f23add883\Setup.exe

C:\Windows\system32\wbem\wmiprvse.exe

C:\Windows\System32\cscript.exe

.

============== Pseudo HJT Report ===============

.

uStart Page = hxxp://www.google.fr/

uDefault_Page_URL = hxxp://www.google.com/ig/redirectdomain?brand=MDNF&bmod=MDNF

mStart Page = hxxp://www.google.com

uProxyOverride = <local>

mWinlogon: Userinit = userinit.exe,

BHO: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

BHO: Spybot-S&D IE Protection: {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files (x86)\Spybot - Search & Destroy 2\SDHelper.dll

BHO: Java Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll

BHO: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

BHO: Java Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll

uRun: [skype] "C:\Program Files (x86)\Skype\Phone\Skype.exe" /minimized /regrun

uRun: [spybot-S&D Cleaning] "C:\Program Files (x86)\Spybot - Search & Destroy 2\SDCleaner.exe" /autoclean

uRun: [KSS] "C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan 2.0\kss.exe" /autorun

mRun: [NUSB3MON] "C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe"

mRun: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

mRun: [RoccatKonePure] "C:\Program Files (x86)\ROCCAT\Kone Pure Mouse\KonePureMonitor.EXE"

mRun: [sDTray] "C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe"

mRun: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"

mRun: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime

mRun: [LogMeIn Hamachi Ui] "C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe" --auto-start

StartupFolder: C:\Users\Grimlot\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Dropbox.lnk - C:\Users\Grimlot\AppData\Roaming\Dropbox\bin\Dropbox.exe

mPolicies-Explorer: NoActiveDesktop = dword:1

mPolicies-Explorer: NoActiveDesktopChanges = dword:1

mPolicies-System: ConsentPromptBehaviorAdmin = dword:5

mPolicies-System: ConsentPromptBehaviorUser = dword:3

mPolicies-System: EnableUIADesktopToggle = dword:0

IE: {0B65DCC9-1740-43dc-B19C-4F309FB6A6CA} - http://rover.ebay.com/rover/1/709-72743-17534-1/4

IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll

IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files (x86)\Spybot - Search & Destroy 2\SDHelper.dll

DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - hxxp://download.eset.com/special/eos/OnlineScanner.cab

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_06-windows-i586.cab

DPF: {CAFEEFAC-0017-0000-0006-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_06-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_06-windows-i586.cab

TCP: NameServer = 192.168.1.1

TCP: Interfaces\{720C1A75-4571-40EF-A82D-D0B8B2A696BE} : DHCPNameServer = 192.168.1.1

Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll

Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll

Notify: SDWinLogon - SDWinLogon.dll

SSODL: WebCheck - <orphaned>

x64-mWinlogon: Userinit = C:\Windows\System32\userinit.exe,C:\Program Files\Soluto\soluto.exe /userinit

x64-BHO: Java Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll

x64-BHO: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

x64-BHO: Java Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll

x64-Run: [RTHDVCPL] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe -s

x64-RunOnce: [MedionReminder] C:\Program Files (x86)\CyberLink\PowerRecover\Reminder.exe /DeleteRunKey

x64-IE: {0B65DCC9-1740-43dc-B19C-4F309FB6A6CA} - http://rover.ebay.com/rover/1/709-72743-17534-1/4

x64-Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - <orphaned>

x64-Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - <orphaned>

x64-SSODL: WebCheck - <orphaned>

.

================= FIREFOX ===================

.

FF - ProfilePath - C:\Users\Grimlot\AppData\Roaming\Mozilla\Firefox\Profiles\akxg0fl9.default-1354040531239\

FF - plugin: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll

FF - plugin: C:\Program Files (x86)\Google\Update\1.3.21.123\npGoogleUpdate3.dll

FF - plugin: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll

FF - plugin: c:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\npctrlui.dll

FF - plugin: C:\Program Files (x86)\Mozilla Firefox\plugins\npvsharetvplg.dll

FF - plugin: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll

FF - plugin: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll

FF - plugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll

FF - plugin: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll

FF - plugin: C:\Program Files\ma-config.com\nphardwaredetection.dll

FF - plugin: C:\Windows\SysWOW64\Adobe\Director\np32dsw.dll

FF - plugin: C:\Windows\SysWOW64\Adobe\Director\np32dsw_1166636.dll

FF - plugin: C:\Windows\SysWOW64\Adobe\Director\np32dsw_1168638.dll

FF - plugin: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_5_502_135.dll

FF - plugin: C:\Windows\SysWOW64\npDeployJava1.dll

FF - plugin: C:\Windows\SysWOW64\npmproxy.dll

FF - ExtSQL: 2012-11-27 19:39; personas@christopher.beard; C:\Users\Grimlot\AppData\Roaming\Mozilla\Firefox\Profiles\akxg0fl9.default-1354040531239\extensions\personas@christopher.beard.xpi

FF - ExtSQL: 2012-11-27 20:11; {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}; C:\Users\Grimlot\AppData\Roaming\Mozilla\Firefox\Profiles\akxg0fl9.default-1354040531239\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi

.

============= SERVICES / DRIVERS ===============

.

R0 iaStorA;iaStorA;C:\Windows\System32\drivers\iaStorA.sys [2012-11-23 647736]

R0 iaStorF;iaStorF;C:\Windows\System32\drivers\iaStorF.sys [2012-11-23 28216]

R0 Soluto;Soluto;C:\Windows\System32\drivers\Soluto.sys [2012-4-2 54728]

R2 KSS;Kaspersky Security Scan Service;C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan 2.0\kss.exe [2012-4-25 202296]

R2 SDScannerService;Spybot-S&D 2 Scanner Service;C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [2012-12-9 1103392]

R2 SDUpdateService;Spybot-S&D 2 Updating Service;C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [2012-12-9 1369624]

R2 SDWSCService;Spybot-S&D 2 Security Center Service;C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [2012-12-9 168384]

R2 SolutoService;Soluto PCGenome Core Service;C:\Program Files\Soluto\SolutoService.exe [2012-8-28 598032]

R3 nusb3hub;Renesas Electronics USB 3.0 Hub Driver;C:\Windows\System32\drivers\nusb3hub.sys [2012-5-10 97792]

R3 nusb3xhc;Renesas Electronics USB 3.0 Host Controller Driver;C:\Windows\System32\drivers\nusb3xhc.sys [2012-5-10 217600]

R3 RTL8167;Realtek 8167 NT Driver;C:\Windows\System32\drivers\Rt64win7.sys [2012-11-21 726160]

S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]

S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]

S2 SkypeUpdate;Skype Updater;C:\Program Files (x86)\Skype\Updater\Updater.exe [2012-11-9 160944]

S3 driverhardwarev2x64;driverhardwarev2x64;C:\Program Files\ma-config.com\Drivers\driverhardwarev2x64.sys [2011-7-21 16640]

S3 KoneFltr;ROCCAT Kone;C:\Windows\System32\drivers\Kone.sys [2008-12-11 15488]

S3 npggsvc;nProtect GameGuard Service;C:\Windows\System32\GameMon.des -service --> C:\Windows\System32\GameMon.des -service [?]

S3 PSI;PSI;C:\Windows\System32\drivers\psi_mf.sys [2010-9-1 17976]

S3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;C:\Windows\System32\drivers\rdpvideominiport.sys [2012-12-16 19456]

S3 RTL8192su;Realtek RTL8192SU Wireless LAN 802.11n USB 2.0 Network Adapter;C:\Windows\System32\drivers\RTL8192su.sys [2011-7-18 694888]

S3 TsUsbFlt;TsUsbFlt;C:\Windows\System32\drivers\TsUsbFlt.sys [2012-12-16 57856]

S3 TsUsbGD;Remote Desktop Generic USB Device;C:\Windows\System32\drivers\TsUsbGD.sys [2012-12-16 30208]

S3 wsvd;wsvd;C:\Windows\System32\drivers\wsvd.sys [2010-9-23 129008]

S4 Intel® Capability Licensing Service Interface;Intel® Capability Licensing Service Interface;C:\Program Files\Intel\iCLS Client\HeciServer.exe [2012-4-20 635104]

S4 maconfservice;Ma-Config Service;C:\Program Files\ma-config.com\x64\maconfservice.exe [2012-10-28 427976]

S4 MemeoBackgroundService;MemeoBackgroundService;C:\Program Files (x86)\Memeo\AutoBackup\MemeoBackgroundService.exe [2011-9-28 25824]

S4 Secunia PSI Agent;Secunia PSI Agent;C:\Program Files (x86)\Secunia\PSI\psia.exe [2011-10-14 994360]

.

=============== Created Last 30 ================

.

2012-12-22 17:56:32 -------- d-----w- C:\d1d92a8dda8f23add883

2012-12-22 16:51:49 419840 ----a-w- C:\Windows\System32\wrap_oal.dll

2012-12-22 16:51:49 413696 ----a-w- C:\Windows\SysWow64\wrap_oal.dll

2012-12-22 16:51:49 133632 ----a-w- C:\Windows\System32\OpenAL32.dll

2012-12-22 16:51:49 110592 ----a-w- C:\Windows\SysWow64\OpenAL32.dll

2012-12-22 16:51:49 -------- d-----w- C:\Program Files (x86)\OpenAL

2012-12-22 11:39:28 -------- d-----w- C:\Program Files (x86)\LogMeIn Hamachi

2012-12-21 09:52:20 46080 ----a-w- C:\Windows\System32\atmlib.dll

2012-12-21 09:52:20 34304 ----a-w- C:\Windows\SysWow64\atmlib.dll

2012-12-21 09:52:19 367616 ----a-w- C:\Windows\System32\atmfd.dll

2012-12-21 09:52:19 295424 ----a-w- C:\Windows\SysWow64\atmfd.dll

2012-12-18 15:44:50 -------- d-----w- C:\Users\Grimlot\AppData\Local\{C8F26FE3-69A9-4295-9DCE-1D6ABC30E175}

2012-12-18 13:50:59 -------- d-----w- C:\Program Files (x86)\ESET

2012-12-18 13:37:03 -------- d-----w- C:\Users\Grimlot\AppData\Local\Apple Computer

2012-12-18 12:38:14 -------- d-----w- C:\Users\Grimlot\AppData\Local\4A Games

2012-12-17 21:01:18 -------- d-----w- C:\Users\Grimlot\AppData\Local\Apple

2012-12-17 12:19:43 388096 ------w- C:\Users\Grimlot\AppData\Roaming\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe

2012-12-17 12:19:43 -------- d-----w- C:\Program Files (x86)\Trend Micro

2012-12-16 20:46:51 -------- d-----w- C:\ProgramData\Kaspersky Lab

2012-12-16 20:46:51 -------- d-----w- C:\Program Files (x86)\Kaspersky Lab

2012-12-16 14:52:31 -------- d-----w- C:\Windows\Migration

2012-12-16 14:39:59 3584 ----a-w- C:\Windows\System32\drivers\fr-FR\tsusbflt.sys.mui

2012-12-15 23:25:58 -------- d---a-w- C:\Kaspersky Rescue Disk 10.0

2012-12-12 11:49:38 2048 ----a-w- C:\Windows\SysWow64\tzres.dll

2012-12-09 17:12:03 -------- d-----w- C:\ProgramData\Spybot - Search & Destroy

2012-12-09 17:11:58 17272 ----a-w- C:\Windows\System32\sdnclean64.exe

2012-12-09 17:11:55 -------- d-----w- C:\Program Files (x86)\Spybot - Search & Destroy 2

2012-12-09 17:11:31 -------- d-----w- C:\Users\Grimlot\AppData\Local\Programs

2012-11-29 20:20:01 -------- d-----w- C:\Users\Grimlot\AppData\Local\{A51A1903-C796-496E-90E0-1C58673EEDC9}

2012-11-29 13:38:50 -------- d-----w- C:\ProgramData\ROCCAT

2012-11-29 13:36:48 77824 ----a-w- C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\ctor.dll

2012-11-29 13:36:48 32768 ----a-w- C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\objectps.dll

2012-11-29 13:36:48 225280 ------w- C:\Program Files (x86)\Common Files\InstallShield\IScript\iscript.dll

2012-11-29 13:36:48 176128 ----a-w- C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\iuser.dll

2012-11-29 13:36:47 614532 ----a-w- C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe

2012-11-27 15:20:13 -------- d-----w- C:\Windows\pss

2012-11-27 14:44:42 -------- d-----w- C:\Users\Grimlot\AppData\Roaming\Yxow

2012-11-27 14:44:42 -------- d-----w- C:\Users\Grimlot\AppData\Roaming\Fiaka

2012-11-25 18:07:56 1034216 ----a-w- C:\Windows\System32\npDeployJava1.dll

2012-11-25 18:07:44 108008 ----a-w- C:\Windows\System32\WindowsAccessBridge-64.dll

2012-11-25 18:04:24 -------- d-----w- C:\Users\Grimlot\AppData\Local\{A97EA898-AFAA-470E-AD4C-E72E818986A3}

2012-11-24 09:12:17 -------- d-----w- C:\Users\Grimlot\AppData\Local\{A17F01AB-9B08-4F1D-9847-2128FB0FFE3D}

2012-11-23 19:16:25 -------- d-----w- C:\Users\Grimlot\AppData\Local\{8E0E7DEC-8302-4AB5-81A7-AA3EF926B040}

2012-11-23 12:40:32 647736 ----a-w- C:\Windows\System32\drivers\iaStorA.sys

2012-11-23 12:40:32 28216 ----a-w- C:\Windows\System32\drivers\iaStorF.sys

2012-11-23 12:37:26 315904 ----a-w- C:\Windows\SysWow64\Difxfb5e.rra

2012-11-23 12:37:26 -------- d-----w- C:\RaidTool

2012-11-23 12:36:34 123704 ----a-w- C:\Windows\System32\drivers\jraid.sys

.

==================== Find3M ====================

.

2012-12-12 11:37:38 73656 ----a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl

2012-12-12 11:37:38 697272 ----a-w- C:\Windows\SysWow64\FlashPlayerApp.exe

2012-11-25 18:07:36 916456 ----a-w- C:\Windows\System32\deployJava1.dll

2012-11-22 03:26:40 3149824 ----a-w- C:\Windows\System32\win32k.sys

2012-11-14 06:11:44 2312704 ----a-w- C:\Windows\System32\jscript9.dll

2012-11-14 06:04:11 1392128 ----a-w- C:\Windows\System32\wininet.dll

2012-11-14 06:02:49 1494528 ----a-w- C:\Windows\System32\inetcpl.cpl

2012-11-14 05:57:46 599040 ----a-w- C:\Windows\System32\vbscript.dll

2012-11-14 05:57:35 173056 ----a-w- C:\Windows\System32\ieUnatt.exe

2012-11-14 05:52:40 2382848 ----a-w- C:\Windows\System32\mshtml.tlb

2012-11-14 02:09:22 1800704 ----a-w- C:\Windows\SysWow64\jscript9.dll

2012-11-14 01:58:15 1427968 ----a-w- C:\Windows\SysWow64\inetcpl.cpl

2012-11-14 01:57:37 1129472 ----a-w- C:\Windows\SysWow64\wininet.dll

2012-11-14 01:49:25 142848 ----a-w- C:\Windows\SysWow64\ieUnatt.exe

2012-11-14 01:48:27 420864 ----a-w- C:\Windows\SysWow64\vbscript.dll

2012-11-14 01:44:42 2382848 ----a-w- C:\Windows\SysWow64\mshtml.tlb

2012-11-09 11:44:27 3598764 ----a-w- C:\Windows\System32\nvcoproc.bin

2012-11-09 11:44:26 63336 ----a-w- C:\Windows\System32\nvshext.dll

2012-11-09 11:44:25 2557800 ----a-w- C:\Windows\System32\nvsvcr.dll

2012-11-09 11:44:25 118120 ----a-w- C:\Windows\System32\nvmctray.dll

2012-11-09 11:44:24 890216 ----a-w- C:\Windows\System32\nvvsvc.exe

2012-11-09 11:43:41 6223208 ----a-w- C:\Windows\System32\nvcpl.dll

2012-11-09 11:42:50 3311464 ----a-w- C:\Windows\System32\nvsvc64.dll

2012-11-09 05:45:09 2048 ----a-w- C:\Windows\System32\tzres.dll

2012-11-09 03:22:48 438632 ----a-w- C:\Windows\SysWow64\nvStreaming.exe

2012-11-02 18:41:18 53248 ----a-w- C:\Windows\SysWow64\CSVer.dll

2012-11-02 05:59:11 478208 ----a-w- C:\Windows\System32\dpnet.dll

2012-11-02 05:11:31 376832 ----a-w- C:\Windows\SysWow64\dpnet.dll

2012-10-25 02:12:26 94208 ----a-w- C:\Windows\SysWow64\QuickTimeVR.qtx

2012-10-25 02:12:26 69632 ----a-w- C:\Windows\SysWow64\QuickTime.qts

2012-10-16 08:38:37 135168 ----a-w- C:\Windows\apppatch\AppPatch64\AcXtrnal.dll

2012-10-16 08:38:34 350208 ----a-w- C:\Windows\apppatch\AppPatch64\AcLayers.dll

2012-10-16 07:39:52 561664 ----a-w- C:\Windows\apppatch\AcLayers.dll

2012-10-09 18:17:13 55296 ----a-w- C:\Windows\System32\dhcpcsvc6.dll

2012-10-09 18:17:13 226816 ----a-w- C:\Windows\System32\dhcpcore6.dll

2012-10-09 17:40:31 44032 ----a-w- C:\Windows\SysWow64\dhcpcsvc6.dll

2012-10-09 17:40:31 193536 ----a-w- C:\Windows\SysWow64\dhcpcore6.dll

2012-10-04 17:46:16 362496 ----a-w- C:\Windows\System32\wow64win.dll

2012-10-04 17:46:15 243200 ----a-w- C:\Windows\System32\wow64.dll

2012-10-04 17:46:15 13312 ----a-w- C:\Windows\System32\wow64cpu.dll

2012-10-04 17:45:55 215040 ----a-w- C:\Windows\System32\winsrv.dll

2012-10-04 17:43:28 16384 ----a-w- C:\Windows\System32\ntvdm64.dll

2012-10-04 17:41:16 424960 ----a-w- C:\Windows\System32\KernelBase.dll

2012-10-04 16:47:41 5120 ----a-w- C:\Windows\SysWow64\wow32.dll

2012-10-04 16:47:41 274944 ----a-w- C:\Windows\SysWow64\KernelBase.dll

2012-10-04 15:21:55 338432 ----a-w- C:\Windows\System32\conhost.exe

2012-10-04 14:46:46 7680 ----a-w- C:\Windows\SysWow64\instnm.exe

2012-10-04 14:46:46 25600 ----a-w- C:\Windows\SysWow64\setup16.exe

2012-10-04 14:46:44 14336 ----a-w- C:\Windows\SysWow64\ntvdm64.dll

2012-10-04 14:46:43 2048 ----a-w- C:\Windows\SysWow64\user.exe

2012-10-04 14:41:50 6144 ---ha-w- C:\Windows\SysWow64\api-ms-win-security-base-l1-1-0.dll

2012-10-04 14:41:50 4608 ---ha-w- C:\Windows\SysWow64\api-ms-win-core-threadpool-l1-1-0.dll

2012-10-04 14:41:50 3584 ---ha-w- C:\Windows\SysWow64\api-ms-win-core-xstate-l1-1-0.dll

2012-10-04 14:41:50 3072 ---ha-w- C:\Windows\SysWow64\api-ms-win-core-util-l1-1-0.dll

2012-10-03 17:56:54 1914248 ----a-w- C:\Windows\System32\drivers\tcpip.sys

2012-10-03 17:44:21 70656 ----a-w- C:\Windows\System32\nlaapi.dll

2012-10-03 17:44:21 303104 ----a-w- C:\Windows\System32\nlasvc.dll

2012-10-03 17:44:17 246272 ----a-w- C:\Windows\System32\netcorehc.dll

2012-10-03 17:44:17 18944 ----a-w- C:\Windows\System32\netevent.dll

2012-10-03 17:44:16 216576 ----a-w- C:\Windows\System32\ncsi.dll

2012-10-03 17:42:16 569344 ----a-w- C:\Windows\System32\iphlpsvc.dll

2012-10-03 16:42:24 18944 ----a-w- C:\Windows\SysWow64\netevent.dll

2012-10-03 16:42:24 175104 ----a-w- C:\Windows\SysWow64\netcorehc.dll

2012-10-03 16:42:23 156672 ----a-w- C:\Windows\SysWow64\ncsi.dll

2012-10-03 16:07:26 45568 ----a-w- C:\Windows\System32\drivers\tcpipreg.sys

2012-09-29 18:54:26 25928 ----a-w- C:\Windows\System32\drivers\mbam.sys

2012-09-25 22:47:43 78336 ----a-w- C:\Windows\SysWow64\synceng.dll

2012-09-25 22:46:17 95744 ----a-w- C:\Windows\System32\synceng.dll

.

============= FINISH: 18:59:54,39 ===============

attach.txt :

.

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.

IF REQUESTED, ZIP IT UP & ATTACH IT

.

DDS (Ver_2012-11-20.01)

.

Microsoft Windows 7 Édition Familiale Premium

Boot Device: \Device\HarddiskVolume1

Install Date: 01/04/2012 13:43:24

System Uptime: 22/12/2012 10:07:22 (8 hours ago)

.

Motherboard: MEDION | | MS-7667

Processor: Intel® Core i5-2500K CPU @ 3.30GHz | CPU 1 | 1584/100mhz

.

==== Disk Partitions =========================

.

C: is FIXED (NTFS) - 1812 GiB total, 1630,305 GiB free.

D: is FIXED (NTFS) - 50 GiB total, 30,529 GiB free.

E: is CDROM (CDFS)

F: is Removable

.

==== Disabled Device Manager Items =============

.

==== System Restore Points ===================

.

RP98: 22/12/2012 12:36:52 - Installed LogMeIn Hamachi

RP99: 22/12/2012 16:52:44 - Installé Microsoft Visual C++ 2005 Redistributable

RP100: 22/12/2012 16:54:07 - DirectX est installé

RP101: 22/12/2012 17:49:52 - DirectX est installé

RP102: 22/12/2012 18:54:49 - Installé Microsoft Visual C++ 2005 Redistributable

RP103: 22/12/2012 18:56:10 - DirectX est installé

.

==== Installed Programs ======================

.

Adobe Flash Player 11 ActiveX

Adobe Flash Player 11 Plugin

Adobe Reader X (10.1.1) MUI

Adobe Reader X (10.1.4) - Français

Adobe Shockwave Player 11.6

Amazon Kindle

Apple Application Support

Apple Software Update

Borderlands 2

CCleaner

Closure

Company of Heroes

Company of Heroes - FAKEMSI

Company of Heroes: Opposing Fronts

Contrôle ActiveX Windows Live Mesh pour connexions à distance

Control ActiveX de Windows Live Mesh para conexiones remotas

Controlo ActiveX do Windows Live Mesh para Ligações Remotas

Counter-Strike

Counter-Strike: Source

CyberLink LabelPrint

CyberLink Power2Go

CyberLink PowerDVD Copy

CyberLink PowerRecover

CyberLink WaveEditor

D3DX10

Dark Messiah Might and Magic Single Player

Darksiders II

Diablo III

Dota 2

Dropbox

Erazer Control Center

ESET Online Scanner v3

Formant ActiveX programu Windows Live Mesh odpowiedzialny za obsluge polaczen zdalnych

Fotogalerija Windows Live

Galeria de Fotografias do Windows Live

Galeria fotografii uslugi Windows Live

Galerie de photos Windows Live

Galería fotográfica de Windows Live

Google Chrome

Google Update Helper

GUILD WARS

Guild Wars 2

HiJackThis

Homefront

Indie Game: The Movie

Intel® Control Center

Intel® Management Engine Components

Intel® Trusted Connect Service Client

Java 7 Update 6

Java 7 Update 9 (64-bit)

Java Auto Updater

JMicron JMB36X Driver

Junk Mail filter update

Kaspersky Security Scan

Kontrolnik Windows Live Mesh ActiveX za oddaljene povezave

League of Legends

Legend of Grimrock

LogMeIn Hamachi

Ma-Config.com (64 bits)

Malwarebytes Anti-Malware version 1.65.1.1000

Medion Home Cinema

Memeo Instant Backup

Mesh Runtime

Metro 2033

Microsoft .NET Framework 4 Client Profile

Microsoft .NET Framework 4 Extended

Microsoft Age of Empires Gold

Microsoft Age of Empires II

Microsoft Age of Empires II : The Conquerors Expansion

Microsoft Application Error Reporting

Microsoft Games for Windows - LIVE

Microsoft Games for Windows - LIVE Redistributable

Microsoft Office 2010

Microsoft Silverlight

Microsoft SQL Server 2005 Compact Edition [ENU]

Microsoft Visual C++ 2005 Redistributable

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161

Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30411

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161

Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219

Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219

Mises à jour NVIDIA 1.11.3

Mozilla Firefox 17.0.1 (x86 fr)

Mozilla Maintenance Service

MSVCRT

MSVCRT_amd64

Mumble 1.2.3

NVIDIA Install Application

NVIDIA Logiciel système PhysX 9.12.1031

NVIDIA PhysX

NVIDIA Pilote 3D Vision 310.54

NVIDIA Pilote audio HD : 1.3.18.0

NVIDIA Pilote du contrôleur 3D Vision 310.54

NVIDIA Pilote graphique 310.54

NVIDIA Stereoscopic 3D Driver

NVIDIA Update Components

OpenAL

OpenOffice.org 3.4

Pando Media Booster

Panneau de configuration NVIDIA 310.54

PlayReady PC Runtime amd64

Poczta uslugi Windows Live

Podstawowe programy Windows Live

PokerTH

Pošta Windows Live

PunkBuster Services

QuickTime

Raccolta foto di Windows Live

Realtek Ethernet Controller Driver

Realtek High Definition Audio Driver

Red Faction: Armageddon

Renesas Electronics USB 3.0 Host Controller Driver

ROCCAT Kone Pure Mouse Driver

S?????? f?t???af??? t?? Windows Live

Secunia PSI (2.0.0.4003)

Security Update for Microsoft .NET Framework 4 Extended (KB2487367)

Security Update for Microsoft .NET Framework 4 Extended (KB2656351)

Shank 2

Skype™ 6.0

Snapshot

Soluto

Spelling Dictionaries Support For Adobe Reader X

Spybot - Search & Destroy

St???e?? e?????? ActiveX t?? Windows Live Mesh ??a ap?µa???sµ??e? s??d?se??

StarCraft II

Steam

swMSM

The Binding of Isaac

Update for Microsoft .NET Framework 4 Extended (KB2468871)

Update for Microsoft .NET Framework 4 Extended (KB2533523)

Update for Microsoft .NET Framework 4 Extended (KB2600217)

Uzak Baglantilar Için Windows Live Mesh ActiveX Denetimi

VLC media player 2.0.4

Warhammer® 40,000™: Dawn of War® II

Warhammer® 40,000™: Dawn of War® II - Chaos Rising™

Warhammer® 40,000™: Dawn of War® II – Retribution™

Windows Live

Windows Live Communications Platform

Windows Live Essentials

Windows Live Fotótár

Windows Live Fotogalerie

Windows Live Fotograf Galerisi

Windows Live ID Sign-in Assistant

Windows Live Installer

Windows Live Language Selector

Windows Live Mail

Windows Live Mesh

Windows Live Mesh - ActiveX-besturingselement voor externe verbindingen

Windows Live Mesh ActiveX-objekt til fjernforbindelser

Windows Live Mesh ActiveX-vezérlo távoli kapcsolatokhoz

Windows Live Mesh ActiveX Control for Remote Connections

Windows Live Messenger

Windows Live MIME IFilter

Windows Live Movie Maker

Windows Live Photo Common

Windows Live Photo Gallery

Windows Live PIMT Platform

Windows Live Remote Client

Windows Live Remote Client Resources

Windows Live Remote Service

Windows Live Remote Service Resources

Windows Live SOXE

Windows Live SOXE Definitions

Windows Live Temel Parçalar

Windows Live UX Platform

Windows Live UX Platform Language Pack

Windows Live Writer

Windows Live Writer Resources

WinRAR 4.20 (32-bit)

.

==== End Of File ===========================

Maniac · December 24, 2012

Please download Malwarebytes Anti-Rootkit from here.

Unzip the contents to a folder in a convenient location.
Open the folder where the contents were unzipped and run mbar.exe ( right click and select Run as adminsistrator for Vista and Windows 7)
Follow the instructions in the wizard to update and allow the program to scan your computer for threats.
Click on the Cleanup button to remove any threats and reboot if prompted to do so.
Wait while the system shuts down and the cleanup process is performed.
Please post the two logs produced.

EZP · December 24, 2012

Malwarebytes Anti-Rootkit 1.01.0.1011

www.malwarebytes.org

Database version: v2012.12.24.04

Windows 7 Service Pack 1 x64 NTFS

Internet Explorer 9.0.8112.16421

Grimlot :: GRIMLOT-PC [administrator]

24/12/2012 14:06:16

mbar-log-2012-12-24 (14-06-16).txt

Scan type: Quick scan

Scan options disabled:

Objects scanned: 30475

Time elapsed: 12 minute(s), 54 second(s)

Memory Processes Detected: 0

(No malicious items detected)

Memory Modules Detected: 0

(No malicious items detected)

Registry Keys Detected: 0

(No malicious items detected)

Registry Values Detected: 0

(No malicious items detected)

Registry Data Items Detected: 0

(No malicious items detected)

Folders Detected: 0

(No malicious items detected)

Files Detected: 0

(No malicious items detected)

(end)

---------------------------------------

Malwarebytes Anti-Rootkit BETA 1.01.0.1011

OS version: 6.1.7601 Windows 7 Service Pack 1 x64

Account is Administrative

Internet Explorer version: 9.0.8112.16421

File system is: NTFS

Disk drives: C:\ DRIVE_FIXED, D:\ DRIVE_FIXED

CPU speed: 3.292000 GHz

Memory total: 6423269376, free: 4880474112

------------ Kernel report ------------

12/24/2012 13:52:51

------------ Loaded modules -----------

\SystemRoot\system32\ntoskrnl.exe

\SystemRoot\system32\hal.dll

\SystemRoot\system32\kdcom.dll

\SystemRoot\system32\mcupdate_GenuineIntel.dll

\SystemRoot\system32\PSHED.dll

\SystemRoot\system32\CLFS.SYS

\SystemRoot\system32\CI.dll

\SystemRoot\system32\drivers\Wdf01000.sys

\SystemRoot\system32\drivers\WDFLDR.SYS

\SystemRoot\system32\drivers\ACPI.sys

\SystemRoot\system32\drivers\WMILIB.SYS

\SystemRoot\system32\drivers\msisadrv.sys

\SystemRoot\system32\drivers\pci.sys

\SystemRoot\system32\drivers\vdrvroot.sys

\SystemRoot\System32\drivers\partmgr.sys

\SystemRoot\system32\drivers\volmgr.sys

\SystemRoot\System32\drivers\volmgrx.sys

\SystemRoot\system32\drivers\jraid.sys

\SystemRoot\system32\drivers\SCSIPORT.SYS

\SystemRoot\System32\drivers\mountmgr.sys

\SystemRoot\system32\drivers\iaStor.sys

\SystemRoot\system32\DRIVERS\atapi.sys

\SystemRoot\system32\DRIVERS\ataport.SYS

\SystemRoot\system32\DRIVERS\msahci.sys

\SystemRoot\system32\DRIVERS\PCIIDEX.SYS

\SystemRoot\system32\DRIVERS\iaStorA.sys

\SystemRoot\system32\DRIVERS\storport.sys

\SystemRoot\system32\drivers\amdxata.sys

\SystemRoot\system32\drivers\fltmgr.sys

\SystemRoot\system32\drivers\fileinfo.sys

\SystemRoot\System32\Drivers\Ntfs.sys

\SystemRoot\System32\Drivers\msrpc.sys

\SystemRoot\System32\Drivers\ksecdd.sys

\SystemRoot\System32\Drivers\cng.sys

\SystemRoot\System32\drivers\pcw.sys

\SystemRoot\System32\Drivers\Fs_Rec.sys

\SystemRoot\system32\drivers\ndis.sys

\SystemRoot\system32\drivers\NETIO.SYS

\SystemRoot\System32\Drivers\ksecpkg.sys

\SystemRoot\System32\drivers\tcpip.sys

\SystemRoot\System32\drivers\fwpkclnt.sys

\SystemRoot\system32\drivers\volsnap.sys

\SystemRoot\System32\Drivers\spldr.sys

\SystemRoot\system32\DRIVERS\Soluto.sys

\SystemRoot\System32\drivers\rdyboost.sys

\SystemRoot\System32\Drivers\mup.sys

\SystemRoot\system32\DRIVERS\iaStorF.sys

\SystemRoot\System32\drivers\hwpolicy.sys

\SystemRoot\System32\DRIVERS\fvevol.sys

\SystemRoot\system32\drivers\disk.sys

\SystemRoot\system32\drivers\CLASSPNP.SYS

\SystemRoot\system32\DRIVERS\cdrom.sys

\SystemRoot\System32\Drivers\Null.SYS

\SystemRoot\System32\Drivers\Beep.SYS

\SystemRoot\System32\drivers\vga.sys

\SystemRoot\System32\drivers\VIDEOPRT.SYS

\SystemRoot\System32\drivers\watchdog.sys

\SystemRoot\System32\DRIVERS\RDPCDD.sys

\SystemRoot\system32\drivers\rdpencdd.sys

\SystemRoot\system32\drivers\rdprefmp.sys

\SystemRoot\System32\Drivers\Msfs.SYS

\SystemRoot\System32\Drivers\Npfs.SYS

\SystemRoot\system32\DRIVERS\tdx.sys

\SystemRoot\system32\DRIVERS\TDI.SYS

\SystemRoot\system32\drivers\afd.sys

\SystemRoot\System32\DRIVERS\netbt.sys

\SystemRoot\system32\DRIVERS\wfplwf.sys

\SystemRoot\system32\DRIVERS\pacer.sys

\SystemRoot\system32\DRIVERS\vwififlt.sys

\SystemRoot\system32\DRIVERS\netbios.sys

\SystemRoot\system32\DRIVERS\wanarp.sys

\SystemRoot\system32\drivers\termdd.sys

\SystemRoot\system32\DRIVERS\rdbss.sys

\SystemRoot\system32\drivers\nsiproxy.sys

\SystemRoot\system32\drivers\mssmbios.sys

\SystemRoot\System32\drivers\discache.sys

\SystemRoot\System32\Drivers\dfsc.sys

\SystemRoot\system32\drivers\blbdrive.sys

\SystemRoot\system32\DRIVERS\tunnel.sys

\SystemRoot\system32\DRIVERS\nvlddmkm.sys

\SystemRoot\System32\drivers\dxgkrnl.sys

\SystemRoot\System32\drivers\dxgmms1.sys

\SystemRoot\system32\DRIVERS\HDAudBus.sys

\SystemRoot\system32\DRIVERS\HECIx64.sys

\SystemRoot\system32\DRIVERS\usbehci.sys

\SystemRoot\system32\DRIVERS\USBPORT.SYS

\SystemRoot\system32\DRIVERS\nusb3xhc.sys

\SystemRoot\system32\DRIVERS\USBD.SYS

\SystemRoot\system32\DRIVERS\Rt64win7.sys

\SystemRoot\system32\DRIVERS\1394ohci.sys

\SystemRoot\system32\drivers\wmiacpi.sys

\SystemRoot\system32\DRIVERS\intelppm.sys

\SystemRoot\system32\drivers\CompositeBus.sys

\SystemRoot\system32\DRIVERS\AgileVpn.sys

\SystemRoot\system32\DRIVERS\rasl2tp.sys

\SystemRoot\system32\DRIVERS\ndistapi.sys

\SystemRoot\system32\DRIVERS\ndiswan.sys

\SystemRoot\system32\DRIVERS\raspppoe.sys

\SystemRoot\system32\DRIVERS\raspptp.sys

\SystemRoot\system32\DRIVERS\rassstp.sys

\SystemRoot\system32\DRIVERS\hamachi.sys

\SystemRoot\system32\DRIVERS\kbdclass.sys

\SystemRoot\system32\DRIVERS\mouclass.sys

\SystemRoot\system32\drivers\swenum.sys

\SystemRoot\system32\drivers\ks.sys

\SystemRoot\system32\DRIVERS\umbus.sys

\SystemRoot\system32\DRIVERS\usbhub.sys

\SystemRoot\System32\Drivers\NDProxy.SYS

\SystemRoot\system32\drivers\nvhda64v.sys

\SystemRoot\system32\drivers\portcls.sys

\SystemRoot\system32\drivers\drmk.sys

\SystemRoot\system32\drivers\ksthunk.sys

\SystemRoot\system32\drivers\RTKVHD64.sys

\SystemRoot\system32\DRIVERS\nusb3hub.sys

\SystemRoot\system32\DRIVERS\cdfs.sys

\SystemRoot\system32\DRIVERS\usbccgp.sys

\SystemRoot\system32\DRIVERS\hidusb.sys

\SystemRoot\system32\DRIVERS\HIDCLASS.SYS

\SystemRoot\system32\DRIVERS\HIDPARSE.SYS

\SystemRoot\system32\DRIVERS\mouhid.sys

\SystemRoot\system32\DRIVERS\kbdhid.sys

\SystemRoot\System32\Drivers\crashdmp.sys

\SystemRoot\System32\Drivers\dump_dumpata.sys

\SystemRoot\System32\Drivers\dump_msahci.sys

\SystemRoot\System32\Drivers\dump_dumpfve.sys

\SystemRoot\system32\DRIVERS\USBSTOR.SYS

\SystemRoot\System32\win32k.sys

\SystemRoot\System32\drivers\Dxapi.sys

\SystemRoot\system32\DRIVERS\monitor.sys

\SystemRoot\System32\TSDDD.dll

\SystemRoot\System32\cdd.dll

\SystemRoot\system32\drivers\luafv.sys

\SystemRoot\system32\DRIVERS\lltdio.sys

\SystemRoot\system32\DRIVERS\nwifi.sys

\SystemRoot\system32\DRIVERS\ndisuio.sys

\SystemRoot\system32\DRIVERS\rspndr.sys

\SystemRoot\system32\drivers\HTTP.sys

\SystemRoot\system32\DRIVERS\bowser.sys

\SystemRoot\System32\drivers\mpsdrv.sys

\SystemRoot\system32\DRIVERS\mrxsmb.sys

\SystemRoot\system32\DRIVERS\mrxsmb10.sys

\SystemRoot\system32\DRIVERS\mrxsmb20.sys

\SystemRoot\system32\drivers\peauth.sys

\SystemRoot\System32\Drivers\secdrv.SYS

\SystemRoot\System32\DRIVERS\srvnet.sys

\SystemRoot\System32\drivers\tcpipreg.sys

\SystemRoot\System32\DRIVERS\srv2.sys

\SystemRoot\System32\DRIVERS\srv.sys

\SystemRoot\system32\drivers\WudfPf.sys

\SystemRoot\system32\DRIVERS\WUDFRd.sys

\??\C:\Windows\TEMP\cpuz135\cpuz135_x64.sys

\SystemRoot\system32\drivers\qwavedrv.sys

\??\C:\Windows\system32\drivers\mbamchameleon.sys

\??\C:\Windows\system32\drivers\mbamswissarmy.sys

\Windows\System32\ntdll.dll

\Windows\System32\smss.exe

\Windows\System32\apisetschema.dll

----------- End -----------

<<<1>>>

Upper Device Name: \Device\Harddisk1\DR1

Upper Device Object: 0xfffffa80081e1790

Upper Device Driver Name: \Driver\Disk\

Lower Device Name: \Device\0000007f\

Lower Device Object: 0xfffffa8007ff8b60

Lower Device Driver Name: \Driver\USBSTOR\

Driver name found: USBSTOR

DriverEntry returned 0x0

Function returned 0x0

<<<1>>>

Upper Device Name: \Device\Harddisk0\DR0

Upper Device Object: 0xfffffa80065fb060

Upper Device Driver Name: \Driver\Disk\

Lower Device Name: \Device\Ide\IdeDeviceP0T0L0-0\

Lower Device Object: 0xfffffa80063221f0

Lower Device Driver Name: \Driver\atapi\

Driver name found: atapi

DriverEntry returned 0x0

Function returned 0x0

Downloaded database version: v2012.12.24.04

Initializing...

Done!

<<<2>>>

Device number: 0, partition: 2

Physical Sector Size: 512

Drive: 0, DevicePointer: 0xfffffa80065fb060, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\

--------- Disk Stack ------

DevicePointer: 0xfffffa80065fbb90, DeviceName: Unknown, DriverName: \Driver\partmgr\

DevicePointer: 0xfffffa80065fb060, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\

DevicePointer: 0xfffffa800644fba0, DeviceName: Unknown, DriverName: \Driver\iaStorF\

DevicePointer: 0xfffffa8006358500, DeviceName: Unknown, DriverName: \Driver\ACPI\

DevicePointer: 0xfffffa80063221f0, DeviceName: \Device\Ide\IdeDeviceP0T0L0-0\, DriverName: \Driver\atapi\

------------ End ----------

Upper DeviceData: 0xfffff8a00fc6a670, 0xfffffa80065fb060, 0xfffffa800909c090

Lower DeviceData: 0xfffff8a0024475c0, 0xfffffa80063221f0, 0xfffffa80089024e0

<<<3>>>

Volume: C:

File system type: NTFS

SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes

Scanning directory: C:\Windows\system32\drivers...

Done!

Drive 0

Scanning MBR on drive 0...

Inspecting partition table:

MBR Signature: 55AA

Disk Signature: 6E09F79C

Partition information:

Partition 0 type is Primary (0x7)

Partition is ACTIVE.

Partition starts at LBA: 2048 Numsec = 204800

Partition file system is NTFS

Partition is bootable

Partition 1 type is Primary (0x7)

Partition is NOT ACTIVE.

Partition starts at LBA: 206848 Numsec = 3799861248

Partition 2 type is Primary (0x7)

Partition is NOT ACTIVE.

Partition starts at LBA: 3800068096 Numsec = 104857600

Partition 3 type is Other (0x12)

Partition is NOT ACTIVE.

Partition starts at LBA: 3904925696 Numsec = 2101248

Disk Size: 2000398934016 bytes

Sector size: 512 bytes

Scanning physical sectors of unpartitioned space on drive 0 (1-2047-3907009168-3907029168)...

Physical Sector Size: 0

Drive: 1, DevicePointer: 0xfffffa80081e1790, DeviceName: \Device\Harddisk1\DR1\, DriverName: \Driver\Disk\

--------- Disk Stack ------

DevicePointer: 0xfffffa8007f6ab90, DeviceName: Unknown, DriverName: \Driver\partmgr\

DevicePointer: 0xfffffa80081e1790, DeviceName: \Device\Harddisk1\DR1\, DriverName: \Driver\Disk\

DevicePointer: 0xfffffa8008007c50, DeviceName: Unknown, DriverName: \Driver\iaStorF\

DevicePointer: 0xfffffa8007ff8b60, DeviceName: \Device\0000007f\, DriverName: \Driver\USBSTOR\

------------ End ----------

Done!

Performing system, memory and registry scan...

Done!

Scan finished

=======================================

Maniac · December 24, 2012

Note: Please do not run this tool without special supervision and instructions of someone authorized to do so. Otherwise, you could end up with serious problems. For more details, read this article: ComboFix usage, Questions, Help? - Look here

Please visit this webpage for download links, and instructions for running the tool:

http://www.bleepingc...to-use-combofix

* Ensure you have disabled all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

Please post the C:\ComboFix.txt in your next reply for further review.

Note: If you encounter a message "illegal operation attempted on registry key that has been marked for deletion" and no programs will run - please just reboot and that will resolve that error.

EZP · December 27, 2012

Hi , I just double clicked on ComboFix as explained , not "Run as Admin".Please tell me if it is correct or if I need to rescan !

Combofix.txt :

ComboFix 12-12-27.02 - Grimlot 27/12/2012 10:52:36.1.4 - x64

Microsoft Windows 7 Édition Familiale Premium 6.1.7601.1.1252.33.1036.18.6126.4640 [GMT 1:00]

Lancé depuis: c:\users\Grimlot\Desktop\ComboFix.exe

SP: Spybot - Search and Destroy *Disabled/Outdated* {9BC38DF1-3CCA-732D-A930-C1CA5F20A4B0}

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

* Un nouveau point de restauration a été créé

.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))

.

C:\Install.exe

c:\program files (x86)\StartSearch plugin

.

((((((((((((((((((((((((((((( Fichiers créés du 2012-11-27 au 2012-12-27 ))))))))))))))))))))))))))))))))))))

.

2012-12-23 11:45 . 2012-12-23 11:57 -------- d-----w- c:\users\Grimlot\AppData\Local\Darksiders2

2012-12-23 11:45 . 2012-12-23 11:45 -------- d--h--w- c:\windows\msdownld.tmp

2012-12-22 16:51 . 2012-12-22 16:51 419840 ----a-w- c:\windows\system32\wrap_oal.dll

2012-12-22 16:51 . 2012-12-22 16:51 413696 ----a-w- c:\windows\SysWow64\wrap_oal.dll

2012-12-22 16:51 . 2012-12-22 16:51 133632 ----a-w- c:\windows\system32\OpenAL32.dll

2012-12-22 16:51 . 2012-12-22 16:51 110592 ----a-w- c:\windows\SysWow64\OpenAL32.dll

2012-12-22 16:51 . 2012-12-22 16:51 -------- d-----w- c:\program files (x86)\OpenAL

2012-12-22 11:39 . 2012-12-22 11:39 -------- d-----w- c:\program files (x86)\LogMeIn Hamachi

2012-12-21 09:52 . 2012-12-16 17:11 46080 ----a-w- c:\windows\system32\atmlib.dll

2012-12-21 09:52 . 2012-12-16 14:13 34304 ----a-w- c:\windows\SysWow64\atmlib.dll

2012-12-21 09:52 . 2012-12-16 14:45 367616 ----a-w- c:\windows\system32\atmfd.dll

2012-12-21 09:52 . 2012-12-16 14:13 295424 ----a-w- c:\windows\SysWow64\atmfd.dll

2012-12-18 13:50 . 2012-12-18 13:50 -------- d-----w- c:\program files (x86)\ESET

2012-12-18 13:37 . 2012-12-18 13:37 -------- d-----w- c:\users\Grimlot\AppData\Local\Apple Computer

2012-12-18 12:38 . 2012-12-18 12:38 -------- d-----w- c:\users\Grimlot\AppData\Local\4A Games

2012-12-18 09:22 . 2012-12-18 09:22 -------- d-----w- c:\users\Grimlot\AppData\Roaming\Apple Computer

2012-12-17 21:01 . 2012-12-17 21:01 -------- d-----w- c:\program files (x86)\Common Files\Apple

2012-12-17 21:01 . 2012-12-17 21:01 -------- d-----w- c:\users\Grimlot\AppData\Local\Apple

2012-12-17 21:01 . 2012-12-17 21:01 -------- d-----w- c:\programdata\Apple

2012-12-17 21:01 . 2012-12-17 21:01 -------- d-----w- c:\program files (x86)\Apple Software Update

2012-12-17 12:19 . 2012-12-17 12:19 388096 ------w- c:\users\Grimlot\AppData\Roaming\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe

2012-12-17 12:19 . 2012-12-17 12:19 -------- d-----w- c:\program files (x86)\Trend Micro

2012-12-16 14:52 . 2012-12-16 14:52 -------- d-----w- c:\windows\Migration

2012-12-16 14:39 . 2012-08-23 15:09 3584 ----a-w- c:\windows\system32\drivers\fr-FR\tsusbflt.sys.mui

2012-12-15 23:25 . 2012-12-15 23:34 -------- d---a-w- C:\Kaspersky Rescue Disk 10.0

2012-12-12 11:49 . 2012-11-09 05:45 2048 ----a-w- c:\windows\system32\tzres.dll

2012-12-09 17:12 . 2012-12-09 17:36 -------- d-----w- c:\programdata\Spybot - Search & Destroy

2012-12-09 17:11 . 2009-01-25 11:14 17272 ----a-w- c:\windows\system32\sdnclean64.exe

2012-12-09 17:11 . 2012-12-09 17:12 -------- d-----w- c:\program files (x86)\Spybot - Search & Destroy 2

2012-12-09 17:11 . 2012-12-09 17:11 -------- d-----w- c:\users\Grimlot\AppData\Local\Programs

2012-11-29 13:38 . 2012-11-29 13:38 -------- d-----w- c:\programdata\ROCCAT

2012-11-29 13:36 . 2001-09-06 10:18 225280 ------w- c:\program files (x86)\Common Files\InstallShield\IScript\iscript.dll

2012-11-29 13:36 . 2001-09-05 03:18 77824 ----a-w- c:\program files (x86)\Common Files\InstallShield\Engine\6\Intel 32\ctor.dll

2012-11-29 13:36 . 2001-09-05 03:14 176128 ----a-w- c:\program files (x86)\Common Files\InstallShield\Engine\6\Intel 32\iuser.dll

2012-11-29 13:36 . 2001-09-05 03:13 32768 ----a-w- c:\program files (x86)\Common Files\InstallShield\Engine\6\Intel 32\objectps.dll

2012-11-29 13:36 . 2002-07-25 15:07 614532 ----a-w- c:\program files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe

2012-11-27 14:44 . 2012-11-27 17:36 -------- d-----w- c:\users\Grimlot\AppData\Roaming\Fiaka

2012-11-27 14:44 . 2012-11-27 14:44 -------- d-----w- c:\users\Grimlot\AppData\Roaming\Yxow

.

(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))

.

2012-12-12 22:17 . 2011-07-18 20:31 67413224 ----a-w- c:\windows\system32\MRT.exe

2012-12-12 11:37 . 2012-04-01 12:57 697272 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe

2012-12-12 11:37 . 2011-11-25 18:00 73656 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl

2012-11-25 18:07 . 2012-11-25 18:07 289768 ----a-w- c:\windows\system32\javaws.exe

2012-11-25 18:07 . 2012-11-25 18:07 189416 ----a-w- c:\windows\system32\javaw.exe

2012-11-25 18:07 . 2012-11-25 18:07 108008 ----a-w- c:\windows\system32\WindowsAccessBridge-64.dll

2012-11-25 18:07 . 2012-11-25 18:07 1034216 ----a-w- c:\windows\system32\npDeployJava1.dll

2012-11-25 18:07 . 2012-11-25 18:07 188904 ----a-w- c:\windows\system32\java.exe

2012-11-25 18:07 . 2011-07-18 21:14 916456 ----a-w- c:\windows\system32\deployJava1.dll

2012-11-09 16:46 . 2012-11-21 17:22 11519848 ----a-w- c:\windows\system32\drivers\nvlddmkm.sys

2012-11-09 16:46 . 2012-11-21 17:22 9270328 ----a-w- c:\windows\system32\nvcuda.dll

2012-11-09 16:46 . 2012-11-21 17:22 841784 ----a-w- c:\windows\SysWow64\nvumdshim.dll

2012-11-09 16:46 . 2012-11-21 17:22 7818504 ----a-w- c:\windows\SysWow64\nvcuda.dll

2012-11-09 16:46 . 2012-11-21 17:22 7446192 ----a-w- c:\windows\system32\nvopencl.dll

2012-11-09 16:46 . 2012-11-21 17:22 6149904 ----a-w- c:\windows\SysWow64\nvopencl.dll

2012-11-09 16:46 . 2012-11-21 17:22 2784104 ----a-w- c:\windows\system32\nvcuvid.dll

2012-11-09 16:46 . 2012-11-21 17:22 26810728 ----a-w- c:\windows\system32\nvoglv64.dll

2012-11-09 16:46 . 2012-11-21 17:22 2606440 ----a-w- c:\windows\SysWow64\nvcuvid.dll

2012-11-09 16:46 . 2012-11-21 17:22 25256296 ----a-w- c:\windows\system32\nvcompiler.dll

2012-11-09 16:46 . 2012-11-21 17:22 2496976 ----a-w- c:\windows\SysWow64\nvapi.dll

2012-11-09 16:46 . 2012-11-21 17:22 245432 ----a-w- c:\windows\system32\nvinitx.dll

2012-11-09 16:46 . 2012-11-21 17:22 2226024 ----a-w- c:\windows\system32\nvcuvenc.dll

2012-11-09 16:46 . 2012-11-21 17:22 20335464 ----a-w- c:\windows\SysWow64\nvoglv32.dll

2012-11-09 16:46 . 2012-11-21 17:22 201136 ----a-w- c:\windows\SysWow64\nvinit.dll

2012-11-09 16:46 . 2012-11-21 17:22 1874280 ----a-w- c:\windows\SysWow64\nvcuvenc.dll

2012-11-09 16:46 . 2012-11-21 17:22 18039264 ----a-w- c:\windows\system32\nvd3dumx.dll

2012-11-09 16:46 . 2012-11-21 17:22 17559912 ----a-w- c:\windows\SysWow64\nvcompiler.dll

2012-11-09 16:46 . 2012-09-14 18:20 1504104 ----a-w- c:\windows\system32\nvdispgenco64.dll

2012-11-09 16:46 . 2012-04-21 13:39 984448 ----a-w- c:\windows\system32\nvumdshimx.dll

2012-11-09 16:46 . 2012-04-21 13:39 12541648 ----a-w- c:\windows\SysWow64\nvwgf2um.dll

2012-11-09 16:46 . 2011-11-28 19:29 2816824 ----a-w- c:\windows\system32\nvapi64.dll

2012-11-09 16:46 . 2011-11-28 19:29 1805672 ----a-w- c:\windows\system32\nvdispco64.dll

2012-11-09 16:46 . 2011-11-28 19:29 15117136 ----a-w- c:\windows\SysWow64\nvd3dum.dll

2012-11-09 16:46 . 2011-11-28 19:29 14953408 ----a-w- c:\windows\system32\nvwgf2umx.dll

2012-11-09 11:44 . 2012-04-21 13:41 3598764 ----a-w- c:\windows\system32\nvcoproc.bin

2012-11-09 11:44 . 2011-11-28 19:30 63336 ----a-w- c:\windows\system32\nvshext.dll

2012-11-09 11:44 . 2011-11-28 19:30 2557800 ----a-w- c:\windows\system32\nvsvcr.dll

2012-11-09 11:44 . 2011-11-28 19:30 118120 ----a-w- c:\windows\system32\nvmctray.dll

2012-11-09 11:44 . 2011-11-28 19:30 890216 ----a-w- c:\windows\system32\nvvsvc.exe

2012-11-09 11:43 . 2011-11-28 19:30 6223208 ----a-w- c:\windows\system32\nvcpl.dll

2012-11-09 11:42 . 2011-11-28 19:30 3311464 ----a-w- c:\windows\system32\nvsvc64.dll

2012-11-09 03:22 . 2012-11-09 03:22 438632 ----a-w- c:\windows\SysWow64\nvStreaming.exe

2012-11-02 18:41 . 2011-11-25 18:32 53248 ----a-w- c:\windows\SysWow64\CSVer.dll

2012-11-01 22:39 . 2012-11-01 22:39 899184 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\UpdateableMarkup\markup.dll

2012-11-01 22:39 . 2012-11-01 22:39 42776 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\dSM\StartResources.dll

2012-11-01 22:39 . 2012-11-01 22:39 639312 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight\SpotlightResources.dll

2012-10-25 02:12 . 2012-10-25 02:12 94208 ----a-w- c:\windows\SysWow64\QuickTimeVR.qtx

2012-10-25 02:12 . 2012-10-25 02:12 69632 ----a-w- c:\windows\SysWow64\QuickTime.qts

2012-10-16 08:38 . 2012-11-28 11:37 135168 ----a-w- c:\windows\apppatch\AppPatch64\AcXtrnal.dll

2012-10-16 08:38 . 2012-11-28 11:37 350208 ----a-w- c:\windows\apppatch\AppPatch64\AcLayers.dll

2012-10-16 07:39 . 2012-11-28 11:37 561664 ----a-w- c:\windows\apppatch\AcLayers.dll

2012-10-09 18:17 . 2012-11-15 17:30 55296 ----a-w- c:\windows\system32\dhcpcsvc6.dll

2012-10-09 18:17 . 2012-11-15 17:30 226816 ----a-w- c:\windows\system32\dhcpcore6.dll

2012-10-09 17:40 . 2012-11-15 17:30 44032 ----a-w- c:\windows\SysWow64\dhcpcsvc6.dll

2012-10-09 17:40 . 2012-11-15 17:30 193536 ----a-w- c:\windows\SysWow64\dhcpcore6.dll

2012-10-04 16:40 . 2012-12-12 11:49 44032 ----a-w- c:\windows\apppatch\acwow64.dll

2012-10-03 17:56 . 2012-11-15 17:30 1914248 ----a-w- c:\windows\system32\drivers\tcpip.sys

2012-10-03 17:44 . 2012-11-15 17:30 70656 ----a-w- c:\windows\system32\nlaapi.dll

2012-10-03 17:44 . 2012-11-15 17:30 303104 ----a-w- c:\windows\system32\nlasvc.dll

2012-10-03 17:44 . 2012-11-15 17:30 246272 ----a-w- c:\windows\system32\netcorehc.dll

2012-10-03 17:44 . 2012-11-15 17:30 18944 ----a-w- c:\windows\system32\netevent.dll

2012-10-03 17:44 . 2012-11-15 17:30 216576 ----a-w- c:\windows\system32\ncsi.dll

2012-10-03 17:42 . 2012-11-15 17:30 569344 ----a-w- c:\windows\system32\iphlpsvc.dll

2012-10-03 16:42 . 2012-11-15 17:30 18944 ----a-w- c:\windows\SysWow64\netevent.dll

2012-10-03 16:42 . 2012-11-15 17:30 175104 ----a-w- c:\windows\SysWow64\netcorehc.dll

2012-10-03 16:42 . 2012-11-15 17:30 156672 ----a-w- c:\windows\SysWow64\ncsi.dll

2012-10-03 16:07 . 2012-11-15 17:30 45568 ----a-w- c:\windows\system32\drivers\tcpipreg.sys

2012-09-29 18:54 . 2012-04-01 13:32 25928 ----a-w- c:\windows\system32\drivers\mbam.sys

.

((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés

REGEDIT4

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]

@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]

2012-10-18 21:52 94208 ----a-w- c:\users\Grimlot\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]

@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]

2012-10-18 21:52 94208 ----a-w- c:\users\Grimlot\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]

@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]

2012-10-18 21:52 94208 ----a-w- c:\users\Grimlot\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Skype"="c:\program files (x86)\Skype\Phone\Skype.exe" [2012-11-09 17888944]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]

"NUSB3MON"="c:\program files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe" [2012-04-21 115048]

"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-07-27 919008]

"RoccatKonePure"="c:\program files (x86)\ROCCAT\Kone Pure Mouse\KonePureMonitor.EXE" [2012-09-11 564848]

"LogMeIn Hamachi Ui"="c:\program files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe" [2012-12-10 2254768]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"ConsentPromptBehaviorAdmin"= 5 (0x5)

"ConsentPromptBehaviorUser"= 3 (0x3)

"EnableUIADesktopToggle"= 0 (0x0)

.

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]

BootExecute REG_MULTI_SZ autocheck autochk *\0\0sdnclean64.exe

.

R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]

R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe [2012-11-09 160944]

R3 driverhardwarev2x64;driverhardwarev2x64;c:\program files\ma-config.com\Drivers\driverhardwarev2x64.sys [2011-07-21 16640]

R3 KoneFltr;ROCCAT Kone;c:\windows\system32\drivers\Kone.sys [2008-12-11 15488]

R3 npggsvc;nProtect GameGuard Service;c:\windows\system32\GameMon.des [x]

R3 PSI;PSI;c:\windows\system32\DRIVERS\psi_mf.sys [2010-09-01 17976]

R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [2012-08-23 19456]

R3 RTL8192su;Realtek RTL8192SU Wireless LAN 802.11n USB 2.0 Network Adapter;c:\windows\system32\DRIVERS\RTL8192su.sys [2010-11-25 694888]

R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2012-08-23 57856]

R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [2012-08-23 30208]

R3 WatAdminSvc;Service Windows Activation Technologies;c:\windows\system32\Wat\WatAdminSvc.exe [2012-04-01 1255736]

R3 wsvd;wsvd;c:\windows\system32\DRIVERS\wsvd.sys [2010-09-23 129008]

R4 Intel® Capability Licensing Service Interface;Intel® Capability Licensing Service Interface;c:\program files\Intel\iCLS Client\HeciServer.exe [2012-04-20 635104]

R4 maconfservice;Ma-Config Service;c:\program files\ma-config.com\x64\maconfservice.exe [2012-10-28 427976]

R4 MemeoBackgroundService;MemeoBackgroundService;c:\program files (x86)\Memeo\AutoBackup\MemeoBackgroundService.exe [2011-09-28 25824]

R4 SDScannerService;Spybot-S&D 2 Scanner Service;c:\program files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [2012-11-13 1103392]

R4 SDUpdateService;Spybot-S&D 2 Updating Service;c:\program files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [2012-11-13 1369624]

R4 SDWSCService;Spybot-S&D 2 Security Center Service;c:\program files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [2012-11-13 168384]

R4 Secunia PSI Agent;Secunia PSI Agent;c:\program files (x86)\Secunia\PSI\PSIA.exe [2011-10-14 994360]

R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-23 57184]

S0 iaStorA;iaStorA;c:\windows\system32\DRIVERS\iaStorA.sys [2012-09-01 647736]

S0 iaStorF;iaStorF;c:\windows\system32\DRIVERS\iaStorF.sys [2012-09-01 28216]

S0 Soluto;Soluto;c:\windows\system32\DRIVERS\Soluto.sys [2012-08-28 54728]

S2 Hamachi2Svc;LogMeIn Hamachi Tunneling Engine;c:\program files (x86)\LogMeIn Hamachi\hamachi-2.exe [2012-12-10 2465712]

S2 SolutoService;Soluto PCGenome Core Service;c:\program files\Soluto\SolutoService.exe [2012-08-28 598032]

S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2012-11-09 382824]

S3 cpuz135;cpuz135;c:\windows\TEMP\cpuz135\cpuz135_x64.sys [x]

S3 nusb3hub;Renesas Electronics USB 3.0 Hub Driver;c:\windows\system32\DRIVERS\nusb3hub.sys [2012-05-10 97792]

S3 nusb3xhc;Renesas Electronics USB 3.0 Host Controller Driver;c:\windows\system32\DRIVERS\nusb3xhc.sys [2012-05-10 217600]

S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [2012-06-13 726160]

.

Contenu du dossier 'Tâches planifiées'

.

2012-12-27 c:\windows\Tasks\Adobe Flash Player Updater.job

- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-01 11:37]

.

2012-09-19 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-04-01 11:41]

.

2012-12-27 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-04-01 11:41]

.

--------- X64 Entries -----------

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]

@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]

2012-10-18 21:52 97792 ----a-w- c:\users\Grimlot\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]

@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]

2012-10-18 21:52 97792 ----a-w- c:\users\Grimlot\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]

@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]

2012-10-18 21:52 97792 ----a-w- c:\users\Grimlot\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]

@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]

2012-10-18 21:52 97792 ----a-w- c:\users\Grimlot\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"RTHDVCPL"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2011-08-16 12673128]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]

"MedionReminder"="c:\program files (x86)\CyberLink\PowerRecover\Reminder.exe" [2011-05-25 443688]

.

------- Examen supplémentaire -------

.

uLocal Page = c:\windows\system32\blank.htm

uStart Page = hxxp://www.google.fr/

mStart Page = hxxp://www.google.com

mLocal Page = c:\windows\SysWOW64\blank.htm

uInternet Settings,ProxyOverride = <local>

IE: {{0B65DCC9-1740-43dc-B19C-4F309FB6A6CA} - http://rover.ebay.com/rover/1/709-72743-17534-1/4

FF - ProfilePath - c:\users\Grimlot\AppData\Roaming\Mozilla\Firefox\Profiles\akxg0fl9.default-1354040531239\

FF - ExtSQL: 2012-11-27 19:39; personas@christopher.beard; c:\users\Grimlot\AppData\Roaming\Mozilla\Firefox\Profiles\akxg0fl9.default-1354040531239\extensions\personas@christopher.beard.xpi

FF - ExtSQL: 2012-11-27 20:11; {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}; c:\users\Grimlot\AppData\Roaming\Mozilla\Firefox\Profiles\akxg0fl9.default-1354040531239\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi

.

- - - - ORPHELINS SUPPRIMES - - - -

.

Notify-SDWinLogon - SDWinLogon.dll

SafeBoot-62739973.sys

AddRemove-PunkBusterSvc - c:\windows\system32\pbsvc_blr.exe

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\npggsvc]

"ImagePath"="c:\windows\system32\GameMon.des -service"

.

--------------------- CLES DE REGISTRE BLOQUEES ---------------------

.

[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ChromeHTML"

.

[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ChromeHTML"

.

[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ChromeHTML"

.

[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ChromeHTML"

.

[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ChromeHTML"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_4_402_287_ActiveX.exe,-101"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]

"Enabled"=dword:00000001

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]

@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_4_402_287_ActiveX.exe"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="IFlashBroker5"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_4_402_287_ActiveX.exe,-101"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]

"Enabled"=dword:00000001

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_4_402_287_ActiveX.exe"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Shockwave Flash Object"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_4_402_287.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]

@="0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]

@="ShockwaveFlash.ShockwaveFlash.11"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_4_402_287.ocx, 1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="ShockwaveFlash.ShockwaveFlash"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Macromedia Flash Factory Object"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_4_402_287.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]

@="FlashFactory.FlashFactory.1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_4_402_287.ocx, 1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="FlashFactory.FlashFactory"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="IFlashBroker5"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VideoLAN.VLCPlugin.*1*]

@="?????????????????? v1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VideoLAN.VLCPlugin.*1*\CLSID]

@="{E23FE9C6-778E-49D4-B537-38FCDE4887D8}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VideoLAN.VLCPlugin.*2*]

@="?????????????????? v2"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VideoLAN.VLCPlugin.*2*\CLSID]

@="{9BE31822-FDAD-461B-AD51-BE1D1C159921}"

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]

@Denied: (Full) (Everyone)

.

Heure de fin: 2012-12-27 11:00:56

ComboFix-quarantined-files.txt 2012-12-27 10:00

.

Avant-CF: 1 751 384 973 312 octets libres

Après-CF: 1 750 935 916 544 octets libres

.

- - End Of File - - 6D86CFFA0A3B2FADCE7CBE9EEAAFABFF

Maniac · December 31, 2012

1. Close any open browsers.

2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

3. Open notepad and copy/paste the text in the quotebox below into it:

Folder::
c:\users\Grimlot\AppData\Roaming\Fiaka
c:\users\Grimlot\AppData\Roaming\Yxow
JavaClearCache::

Save this as CFScript.txt, in the same location as ComboFix.exe

Refering to the picture above, drag CFScript into ComboFix.exe

When finished, it shall produce a log for you at C:\ComboFix.txt which I will require in your next reply.

EZP · January 1, 2013

ComboFix 13-01-01.02 - Grimlot 01/01/2013 13:59:45.2.4 - x64

Microsoft Windows 7 Édition Familiale Premium 6.1.7601.1.1252.33.1036.18.6126.4222 [GMT 1:00]

Lancé depuis: c:\users\Grimlot\Desktop\ComboFix.exe

Commutateurs utilisés :: c:\users\Grimlot\Desktop\CFScript.txt

SP: Spybot - Search and Destroy *Disabled/Outdated* {9BC38DF1-3CCA-732D-A930-C1CA5F20A4B0}

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\users\Grimlot\AppData\Roaming\csrss.exe

c:\users\Grimlot\AppData\Roaming\Fiaka

c:\users\Grimlot\AppData\Roaming\rundll32.exe

c:\users\Grimlot\AppData\Roaming\svchost.exe

c:\users\Grimlot\AppData\Roaming\system32

c:\users\Grimlot\AppData\Roaming\system32\csrss.exe

c:\users\Grimlot\AppData\Roaming\system32\rundll32.exe

c:\users\Grimlot\AppData\Roaming\system32\svchost.exe

c:\users\Grimlot\AppData\Roaming\Yxow

c:\users\Grimlot\AppData\Roaming\Yxow\tyyxs.ygi

.

((((((((((((((((((((((((((((( Fichiers créés du 2012-12-01 au 2013-01-01 ))))))))))))))))))))))))))))))))))))

.

2013-01-01 13:08 . 2013-01-01 13:08 -------- d-----w- c:\users\UpdatusUser\AppData\Local\temp

2013-01-01 13:08 . 2013-01-01 13:08 -------- d-----w- c:\users\L.Grimlot\AppData\Local\temp

2013-01-01 13:08 . 2013-01-01 13:08 -------- d-----w- c:\users\Default\AppData\Local\temp

2012-12-31 21:09 . 2012-12-31 21:09 -------- d-----w- c:\programdata\Age of Empires 3

2012-12-31 21:09 . 2012-12-31 21:09 -------- d-----w- c:\program files (x86)\Common Files\Microsoft Games

2012-12-31 14:21 . 2012-12-31 14:21 -------- d-----w- c:\program files\Soluto