[SweetTech]

Hi!

Please delete your current copy of ComboFix, and download a new copy from the link below. Run it and post the log it produces for you.

Running ComboFix
Download Combofix from either of the links below, and save it to your desktop.

Link 1
Link 2

**Note: It is important that it is saved directly to your desktop**

--------------------------------------------------------------------
IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here

Note: If AVG or CA Internet Security Suite is installed, you must remove these programs before using Combofix. If for some reason these applications will not uninstall, try uninstalling with AppRemover by Opswat.
--------------------------------------------------------------------

Double click on ComboFix.exe & follow the prompts.

• When finished, it will produce a report for you.
• Please post the C:\ComboFix.txt for further review.
  
• If you get an error message saying: "Illegal operation attempted on a registry key that was marked for deletion." please reboot your computer, and that should take care of that error message.

[Advertisements]

I apologize for my delay in getting you this information. I've been very busy lately. Will attempt to get the info to asap!

-Matt

[Matt Smith]

I apologize for my delay in getting you this information. I've been very busy lately. Will attempt to get the info to asap!

-Matt

[SweetTech]

Thanks for letting me know you're still with me.

[Matt Smith]

ComboFix 12-02-23.02 - Mafu 02/23/2012 22:50:06.6.2 - x64
Microsoft Windows 7 Ultimate 6.1.7600.0.1252.1.1033.18.4094.2263 [GMT -8:00]
Running from: c:\users\Mafu\Desktop\ComboFix.exe
SP: Windows Defender *Enabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((( Files Created from 2012-01-24 to 2012-02-24 )))))))))))))))))))))))))))))))
.
.
2012-02-24 07:42 . 2012-02-24 07:42 -------- d-----w- c:\users\Public\AppData\Local\temp
2012-02-24 07:42 . 2012-02-24 07:42 -------- d-----w- c:\users\Default\AppData\Local\temp
2012-02-24 05:54 . 2012-02-24 05:56 -------- d-----w- c:\users\Mafu\AppData\Roaming\.mojam
2012-02-23 08:31 . 2012-02-23 08:31 -------- d-----w- c:\users\Mafu\AppData\Roaming\vnc
2012-02-23 04:50 . 2012-02-08 07:13 8643640 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{E676ED67-1778-4E41-8CC4-9AF8C8D7E7E0}\mpengine.dll
2012-02-22 12:06 . 2012-02-22 12:06 -------- d-----w- c:\users\Mafu\AppData\Local\Droplr
2012-02-22 12:06 . 2012-02-22 12:06 -------- d-----w- c:\program files\Droplr
2012-02-22 05:47 . 2012-02-23 08:31 -------- d-----w- c:\users\Mafu\.remobo
2012-02-22 05:45 . 2012-02-22 05:48 -------- d-----w- c:\program files (x86)\Remobo
2012-02-22 05:40 . 2012-02-22 05:39 314360 ----a-w- c:\windows\system32\EvoDisplayHelper.dll
2012-02-22 05:40 . 2012-02-22 05:39 197112 ----a-w- c:\windows\SysWow64\EvoDisplayHelper.dll
2012-02-22 05:40 . 2012-02-22 05:40 -------- d--h--w- c:\windows\msdownld.tmp
2012-02-22 05:39 . 2012-02-22 05:39 21656 ----a-w- c:\windows\system32\drivers\evolve.sys
2012-02-22 05:38 . 2012-02-22 05:38 -------- d-----w- c:\program files\Echobit
2012-02-22 05:36 . 2012-02-22 05:36 -------- d-----w- c:\programdata\Echobit
2012-02-22 05:36 . 2012-02-22 05:36 -------- d-----w- c:\users\Mafu\AppData\Local\Echobit
2012-02-19 04:59 . 2012-02-19 09:37 -------- d-----w- c:\users\Mafu\AppData\Local\Bvckup
2012-02-19 04:59 . 2012-02-19 04:59 -------- d-----w- c:\users\Mafu\Program Files (x86)
2012-02-17 10:31 . 2012-02-17 10:37 -------- d-----w- c:\users\Mafu\AppData\Roaming\.Tribler
2012-02-17 10:26 . 2012-02-17 10:31 -------- d-----w- c:\program files (x86)\Tribler
2012-02-15 07:52 . 2012-02-15 07:52 -------- d-----w- c:\program files\Java
2012-02-12 09:49 . 2012-02-15 10:55 -------- d-----w- c:\users\Mafu\AppData\Roaming\Mipony
2012-02-12 09:48 . 2012-02-12 09:48 -------- d-----w- c:\program files (x86)\MiPony
2012-02-10 12:57 . 2012-02-10 12:57 -------- d-----w- c:\program files (x86)\Java
2012-02-10 12:20 . 2012-02-04 08:52 11264 ----a-w- c:\program files (x86)\Mozilla Firefox\npt.dll
2012-02-07 05:31 . 2012-02-07 05:31 -------- d-----w- c:\users\Mafu\AppData\Roaming\gnupg
2012-02-07 05:31 . 2012-02-07 05:31 -------- d-----w- c:\users\Mafu\AppData\Roaming\Appupdater
2012-02-07 05:31 . 2012-02-07 05:31 -------- d-----w- c:\program files (x86)\GNU
2012-02-07 05:30 . 2012-02-24 06:59 -------- d-----w- c:\programdata\Appupdater
2012-02-07 05:30 . 2012-02-07 11:11 -------- d-----w- c:\program files (x86)\Appupdater
2012-02-05 13:08 . 2012-02-05 13:08 -------- d-----w- c:\programdata\Kaspersky Lab
2012-02-04 15:26 . 2012-02-04 16:05 -------- d-----w- c:\program files (x86)\Rigs of Rods 0.38
2012-02-03 07:46 . 2012-02-03 07:46 -------- d-----w- C:\_OTL
2012-01-30 07:22 . 2012-01-30 07:34 -------- d-----w- C:\xbox
2012-01-25 11:02 . 2012-01-25 11:02 -------- d-----w- c:\users\Mafu\AppData\Roaming\IDM
2012-01-25 11:02 . 2012-01-26 04:11 -------- d-----w- c:\program files (x86)\Internet Download Manager
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-02-24 04:00 . 2011-09-07 09:40 414368 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2012-02-22 05:40 . 2010-11-26 02:58 197112 ----a-w- c:\windows\SysWow64\aticfx32.dll
2012-02-22 05:40 . 2010-11-26 02:57 345080 ----a-w- c:\windows\system32\aticfx64.dll
2012-02-22 05:40 . 2010-11-26 02:17 358392 ----a-w- c:\windows\system32\atig6pxx.dll
2012-02-22 05:40 . 2010-11-26 02:17 274936 ----a-w- c:\windows\SysWow64\atiglpxx.dll
2012-02-15 07:52 . 2011-01-28 05:24 525544 ----a-w- c:\windows\system32\deployJava1.dll
2012-02-10 12:39 . 2012-01-08 10:55 750488 ----a-w- c:\windows\system32\npdeployJava1.dll
2012-02-08 07:13 . 2012-01-11 08:02 8643640 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2012-01-31 12:44 . 2010-12-20 11:55 279656 ------w- c:\windows\system32\MpSigStub.exe
2012-01-13 11:08 . 2011-01-24 03:21 112832 ----a-w- c:\programdata\Microsoft\VCExpress\10.0\1033\ResourceCache.dll
2012-01-08 12:19 . 2012-01-08 11:06 3 ----a-w- c:\users\Mafu\AppData\Roaming\ispnetkey.dll
2012-01-08 11:12 . 2012-01-08 11:12 917840 ------w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{DE765D2F-385F-4D42-B0ED-5A521A2D88B6}\gapaengine.dll
2012-01-08 11:02 . 2012-01-08 11:02 89088 ----a-w- c:\windows\system32\RegisterIEPKEYs.exe
2012-01-08 11:02 . 2012-01-08 11:02 86528 ----a-w- c:\windows\SysWow64\iesysprep.dll
2012-01-08 11:02 . 2012-01-08 11:02 76800 ----a-w- c:\windows\SysWow64\SetIEInstalledDate.exe
2012-01-08 11:02 . 2012-01-08 11:02 74752 ----a-w- c:\windows\SysWow64\RegisterIEPKEYs.exe
2012-01-08 11:02 . 2012-01-08 11:02 74752 ----a-w- c:\windows\SysWow64\iesetup.dll
2012-01-08 11:02 . 2012-01-08 11:02 63488 ----a-w- c:\windows\SysWow64\tdc.ocx
2012-01-08 11:02 . 2012-01-08 11:02 48640 ----a-w- c:\windows\SysWow64\mshtmler.dll
2012-01-08 11:02 . 2012-01-08 11:02 420864 ----a-w- c:\windows\SysWow64\vbscript.dll
2012-01-08 11:02 . 2012-01-08 11:02 367104 ----a-w- c:\windows\SysWow64\html.iec
2012-01-08 11:02 . 2012-01-08 11:02 35840 ----a-w- c:\windows\SysWow64\imgutil.dll
2012-01-08 11:02 . 2012-01-08 11:02 2382848 ----a-w- c:\windows\SysWow64\mshtml.tlb
2012-01-08 11:02 . 2012-01-08 11:02 23552 ----a-w- c:\windows\SysWow64\licmgr10.dll
2012-01-08 11:02 . 2012-01-08 11:02 222208 ----a-w- c:\windows\system32\msls31.dll
2012-01-08 11:02 . 2012-01-08 11:02 1798144 ----a-w- c:\windows\SysWow64\jscript9.dll
2012-01-08 11:02 . 2012-01-08 11:02 161792 ----a-w- c:\windows\SysWow64\msls31.dll
2012-01-08 11:02 . 2012-01-08 11:02 152064 ----a-w- c:\windows\SysWow64\wextract.exe
2012-01-08 11:02 . 2012-01-08 11:02 150528 ----a-w- c:\windows\SysWow64\iexpress.exe
2012-01-08 11:02 . 2012-01-08 11:02 142848 ----a-w- c:\windows\SysWow64\ieUnatt.exe
2012-01-08 11:02 . 2012-01-08 11:02 1427456 ----a-w- c:\windows\SysWow64\inetcpl.cpl
2012-01-08 11:02 . 2012-01-08 11:02 1390080 ----a-w- c:\windows\system32\wininet.dll
2012-01-08 11:02 . 2012-01-08 11:02 11776 ----a-w- c:\windows\SysWow64\mshta.exe
2012-01-08 11:02 . 2012-01-08 11:02 1127424 ----a-w- c:\windows\SysWow64\wininet.dll
2012-01-08 11:02 . 2012-01-08 11:02 110592 ----a-w- c:\windows\SysWow64\IEAdvpack.dll
2012-01-08 11:02 . 2012-01-08 11:02 101888 ----a-w- c:\windows\SysWow64\admparse.dll
2012-01-08 11:02 . 2012-01-08 11:02 91648 ----a-w- c:\windows\system32\SetIEInstalledDate.exe
2012-01-08 11:02 . 2012-01-08 11:02 85504 ----a-w- c:\windows\system32\iesetup.dll
2012-01-08 11:02 . 2012-01-08 11:02 76800 ----a-w- c:\windows\system32\tdc.ocx
2012-01-08 11:02 . 2012-01-08 11:02 603648 ----a-w- c:\windows\system32\vbscript.dll
2012-01-08 11:02 . 2012-01-08 11:02 49664 ----a-w- c:\windows\system32\imgutil.dll
2012-01-08 11:02 . 2012-01-08 11:02 48640 ----a-w- c:\windows\system32\mshtmler.dll
2012-01-08 11:02 . 2012-01-08 11:02 448512 ----a-w- c:\windows\system32\html.iec
2012-01-08 11:02 . 2012-01-08 11:02 30720 ----a-w- c:\windows\system32\licmgr10.dll
2012-01-08 11:02 . 2012-01-08 11:02 2382848 ----a-w- c:\windows\system32\mshtml.tlb
2012-01-08 11:02 . 2012-01-08 11:02 2309120 ----a-w- c:\windows\system32\jscript9.dll
2012-01-08 11:02 . 2012-01-08 11:02 173056 ----a-w- c:\windows\system32\ieUnatt.exe
2012-01-08 11:02 . 2012-01-08 11:02 165888 ----a-w- c:\windows\system32\iexpress.exe
2012-01-08 11:02 . 2012-01-08 11:02 160256 ----a-w- c:\windows\system32\wextract.exe
2012-01-08 11:02 . 2012-01-08 11:02 1493504 ----a-w- c:\windows\system32\inetcpl.cpl
2012-01-08 11:02 . 2012-01-08 11:02 135168 ----a-w- c:\windows\system32\IEAdvpack.dll
2012-01-08 11:02 . 2012-01-08 11:02 12288 ----a-w- c:\windows\system32\mshta.exe
2012-01-08 11:02 . 2012-01-08 11:02 114176 ----a-w- c:\windows\system32\admparse.dll
2012-01-08 11:02 . 2012-01-08 11:02 111616 ----a-w- c:\windows\system32\iesysprep.dll
2011-12-25 20:53 . 2011-12-25 20:48 19968 ----a-w- c:\windows\system32\wshelper.dll
2011-12-25 04:02 . 2011-12-25 04:02 355 ----a-w- c:\windows\system32\drivers\etc\hosts.ussclean.tmp
2011-12-24 23:08 . 2011-12-24 23:08 35712 ----a-w- c:\windows\SysWow64\drivers\BlackBox.sys
2011-12-19 21:45 . 2012-01-24 12:19 224048 ----a-w- c:\windows\system32\drivers\VBoxDrv.sys
2011-12-19 21:45 . 2012-01-24 12:19 130864 ----a-w- c:\windows\system32\drivers\VBoxUSBMon.sys
2011-12-19 21:45 . 2011-12-19 21:45 146736 ----a-w- c:\windows\system32\drivers\VBoxNetAdp.sys
2011-12-19 21:43 . 2011-12-19 21:43 320816 ----a-w- c:\windows\system32\VBoxNetFltNobj.dll
2011-12-19 21:43 . 2011-12-19 21:43 165680 ----a-w- c:\windows\system32\drivers\VBoxNetFlt.sys
2011-12-15 09:29 . 2011-12-15 09:31 737280 ----a-w- c:\windows\iun6002.exe
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12 94208 ----a-w- c:\users\Mafu\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12 94208 ----a-w- c:\users\Mafu\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12 94208 ----a-w- c:\users\Mafu\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]
@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12 94208 ----a-w- c:\users\Mafu\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"$Volumouse$"="c:\program files (x86)\NirSoft\Volumouse\volumouse.exe" [2012-01-08 35328]
"EvolveClient"="c:\program files\Echobit\Evolve\EvolveClient.exe" [2012-02-22 1735672]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"QlbCtrl.exe"="c:\program files (x86)\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2010-02-25 323640]
"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2010-11-26 98304]
"WD Drive Manager"="c:\program files\Western Digital\WD Drive Manager\WDBtnMgrUI.exe" [2009-06-26 480768]
"GrooveMonitor"="c:\program files (x86)\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 31072]
"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2011-11-02 59240]
"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2011-12-08 421736]
.
c:\users\Mafu\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Dropbox.lnk - c:\users\Mafu\AppData\Roaming\Dropbox\bin\Dropbox.exe [2012-2-14 24246216]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"HideSCAHealth"= 1 (0x1)
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2012-01-03 07:37 843712 ----a-w- c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2011-09-05 17:04 35736 ----a-w- c:\program files (x86)\Adobe\Reader 10.0\Reader\reader_sl.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdobeCS5ServiceManager]
2010-02-22 11:57 406992 ----a-w- c:\program files (x86)\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATICustomerCare]
2010-05-05 00:05 311296 ----a-r- c:\program files (x86)\ATI\ATICustomerCare\ATICustomerCare.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor]
2008-10-25 18:44 31072 ----a-w- c:\program files (x86)\Microsoft Office\Office12\GrooveMonitor.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2010-11-30 01:38 421888 ----a-w- c:\program files (x86)\QuickTime\QTTask.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SwitchBoard]
2010-02-19 21:37 517096 ----a-w- c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R3 Aken;Aken;c:\users\Mafu\AppData\Local\0 A.D. alpha\binaries\system\aken64.sys [x]
R3 BlackBox;BlackBox SR2; [x]
R3 cpuz135;cpuz135;c:\windows\TEMP\cpuz135\cpuz135_x64.sys [x]
R3 EagleX64;EagleX64;c:\windows\system32\drivers\EagleX64.sys [x]
R3 MonitorFunction;Driver for Monitor;c:\windows\system32\DRIVERS\TVMonitor.sys [x]
R3 MpNWMon;Microsoft Malware Protection Network Driver;c:\windows\system32\DRIVERS\MpNWMon.sys [x]
R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys [x]
R3 NisSrv;Microsoft Network Inspection;c:\program files\Microsoft Security Client\Antimalware\NisSrv.exe [2011-04-28 288272]
R3 PsSdk41;PsSdk41;c:\windows\system32\Drivers\pssdk41.sys [x]
R3 SwitchBoard;Adobe SwitchBoard;c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096]
R3 teamviewervpn;TeamViewer VPN Adapter;c:\windows\system32\DRIVERS\teamviewervpn.sys [x]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [x]
R3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\DRIVERS\vwifimp.sys [x]
R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [x]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-23 57184]
S1 CbFs;CbFs;c:\windows\system32\drivers\cbfs.sys [x]
S1 nm3;Microsoft Network Monitor 3 Driver;c:\windows\system32\DRIVERS\nm3.sys [x]
S1 VBoxDrv;VirtualBox Service;c:\windows\system32\DRIVERS\VBoxDrv.sys [x]
S1 VBoxUSBMon;VirtualBox USB Monitor Driver;c:\windows\system32\DRIVERS\VBoxUSBMon.sys [x]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x]
S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2011-06-06 64952]
S2 AESTFilters;Andrea ST Filters Service;c:\windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_960c1f056a541068\AESTSr64.exe [2009-03-03 89600]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [x]
S2 Appupdater;Appupdater;c:\program files (x86)\Appupdater\appupdaters.exe [2011-07-16 2439971]
S2 EvoSvc;Evolve Service;c:\program files\Echobit\Evolve\EvoSvc.exe [2012-02-22 1459192]
S2 HPDrvMntSvc.exe;HP Quick Synchronization Service;c:\program files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe [2011-03-17 92216]
S2 hpsrv;HP Service;c:\windows\system32\Hpservice.exe [x]
S2 StkSSrv;Syntek AVStream USB2.0 ATV Service;c:\windows\System32\StkCSrv.exe [x]
S2 WDBtnMgrSvc.exe;WD Drive Manager Service;c:\program files\Western Digital\WD Drive Manager\WDBtnMgrSvc.exe [2009-06-26 119296]
S3 amdkmdag;amdkmdag;c:\windows\system32\DRIVERS\atikmdag.sys [x]
S3 amdkmdap;amdkmdap;c:\windows\system32\DRIVERS\atikmpag.sys [x]
S3 AtiHDAudioService;ATI Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW76.sys [x]
S3 BazisVirtualCDBus;WinCDEmu Virtual Bus Driver;c:\windows\system32\DRIVERS\BazisVirtualCDBus.sys [x]
S3 EvolveVirtualAdapter;Evolve Virtual Miniport Driver;c:\windows\system32\DRIVERS\evolve.sys [x]
S3 hipeer20;Remobo Instant Private Network;c:\windows\system32\DRIVERS\remobo64.sys [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [x]
S3 VBoxNetAdp;VirtualBox Host-Only Ethernet Adapter;c:\windows\system32\DRIVERS\VBoxNetAdp.sys [x]
S3 VBoxNetFlt;VirtualBox Bridged Networking Service;c:\windows\system32\DRIVERS\VBoxNetFlt.sys [x]
.
.
Contents of the 'Scheduled Tasks' folder
.
2012-02-23 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2302230544-2342101270-558501468-1000Core.job
- c:\users\Mafu\AppData\Local\Google\Update\GoogleUpdate.exe [2011-02-10 10:54]
.
2012-02-24 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2302230544-2342101270-558501468-1000UA.job
- c:\users\Mafu\AppData\Local\Google\Update\GoogleUpdate.exe [2011-02-10 10:54]
.
.
--------- x86-64 -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12 97792 ----a-w- c:\users\Mafu\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12 97792 ----a-w- c:\users\Mafu\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12 97792 ----a-w- c:\users\Mafu\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]
@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12 97792 ----a-w- c:\users\Mafu\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SysTrayApp"="c:\program files\IDT\WDM\sttray64.exe" [2010-03-23 487424]
"DVD or CD Sharing"="c:\program files\DVD or CD Sharing\ODSAgent.exe" [2009-07-22 603448]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2011-06-15 1436736]
.
------- Supplementary Scan -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = about:blank
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = <local>;*.local
IE: Download with Mipony - file://c:\program files (x86)\MiPony\Browser\IEContext.htm
IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~2\Office12\EXCEL.EXE/3000
TCP: DhcpNameServer = 75.75.75.75 75.75.76.76
CLSID: {603d3801-bd81-11d0-a3a5-00c04fd706ec} - %SystemRoot%\SysWow64\shell32.dll
FF - ProfilePath - c:\users\Mafu\AppData\Roaming\Mozilla\Firefox\Profiles\x9qp4l2y.default\
FF - prefs.js: browser.startup.homepage - google.com
FF - prefs.js: network.proxy.type - 4
.
- - - - ORPHANS REMOVED - - - -
.
MSConfigStartUp-SunJavaUpdateSched - c:\program files (x86)\Common Files\Java\Java Update\jusched.exe
HKLM-Run-SynTPEnh - c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe
.
.
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10l_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10l_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10l.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.10"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10l.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10l.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10l.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Completion time: 2012-02-23 23:45:45
ComboFix-quarantined-files.txt 2012-02-24 07:45
.
Pre-Run: 15,975,079,936 bytes free
Post-Run: 15,920,152,576 bytes free
.
- - End Of File - - E76048E9630E882F78B87C3E2F50C09B

[SweetTech]

Hi Matt,

Please try this.

Please download the MVPS host file from here: http://winhelp2002.mvps.org/hosts.zip

Then visit this page here: http://winhelp2002.m...g/hostswin7.htm and follow the instructions under: "Important! Updating the MVPS HOSTS file in Windows 7 requires special instructions"

Let me know how that goes.

[Matt Smith]

It stated:
"THE MVPS HOSTS FILE IS NOW UPDATED (CheckMark)"

[SweetTech]

Matt,

Please let me know if you're still experiencing the redirects now.

[Matt Smith]

Will let you know. Haven't experienced any redirects so far, but doesn't mean they don't exist. We will see with a few days testing.

On another note.. Got any idea how I can my PC's current issue with not being able to install MSI files and not being able to install Java 32? You don't have to help with this issue since you have most definitely done much more then I expected.

[SweetTech]

Hi Matt,

Okay.

Can you remind me what happens when you try to install any MSI files? Is there an error message, if so, can you provide it to me?

Also, can you remind me of the Java error you're receiving?

Cheers,
ST.

[Matt Smith]

As for MSI files: This is when I try to install Hamachi.MSI.
"The windows installer service could not be accessed.
This can occur if the Windows Installer is not correctly installed. Contact your support personnel for assistance."

When trying to install the 32bit version of Java it says something like:
"To run the installer please refresh the page"
..which doesn't make sense when I'm running an installer file without a single web browser running.

[SweetTech]

Hi Matt!

Download Windows Repair (all in one) from this site

Install the program then run

Skip over to the Start Repairs tab. Click the Advanced Mode and click Start



Please ensure that items seen in the image below are ticked as well as the Repair MSI (Windows Installer).

Click on box next to the Restart System when Finished. Then click on Start


See if that fixes the issue with the MSI files.

[Matt Smith]

Same thing happened again after running the fix above.

As for MSI files: This is when I try to install Hamachi.MSI.
"The windows installer service could not be accessed.
This can occur if the Windows Installer is not correctly installed. Contact your support personnel for assistance."

[SweetTech]

Matt,

Did you make sure that you placed a check mark in this box: Repair MSI (Windows Installer). ??

[Matt Smith]

I did. And I'm rerunning the program with just the MSI fix just to make sure I didn't mess something up.

Edited by Matt Smith, 02 March 2012 - 05:48 AM.

[SweetTech]

Okay, let me know how things go when you re-run it. In the meantime I'll be looking into this some more.