Trojaner-Board - Bundestrojaner - nach OTLPENet.exe schwarzer Bildschirm

FRST Logfile:

Code:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 16-07-2013 03

Ran by SYSTEM on 17-07-2013 03:29:38

Running from F:\

Windows 7 Home Premium (X64) OS Language: German Standard

Internet Explorer Version 10

Boot Mode: Recovery
 

The current controlset is ControlSet001
 ATTENTION!:=====> FRST is updated to run from normal or Safe mode to produce a full FRST.txt log and an extra Addition.txt log.
 

==================== Registry (Whitelisted) ==================
 

HKLM\...\Run: [RtHDVBg] - C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [2226280 2011-06-03] (Realtek Semiconductor)

HKLM\...\Run: [AmIcoSinglun64] - C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe [361984 2011-03-21] (Alcor Micro Corp.)

HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2785064 2011-05-05] (Synaptics Incorporated)

HKLM\...\Run: [SynAsusAcpi] - C:\Program Files\Synaptics\SynTP\SynAsusAcpi.exe [97064 2011-05-05] (Synaptics Incorporated)

HKLM\...\Run: [AtherosBtStack] - C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe [617120 2011-03-13] (Atheros Communications)

HKLM\...\Run: [AthBtTray] - C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe [379552 2011-03-13] (Atheros Commnucations)

HKLM\...\Run: [IntelTBRunOnce] - C:\Program Files\Intel\TurboBoost\RunTBGadgetOnce.vbs [4156 2010-04-17] ()

HKLM\...\Run: [Korean IME Migration] - C:\PROGRA~1\COMMON~1\MICROS~1\IME12\IMEKR\IMKRMIG.EXE [43808 2006-10-26] (Microsoft Corporation)

HKLM\...\RunOnce: [*Restore] - C:\Windows\system32\rstrui.exe /RUNONCE [296960 2010-11-20] (Microsoft Corporation)

HKLM-x32\...\Run: [Nuance PDF Reader-reminder] - "C:\Program Files (x86)\Nuance\PDF Reader\Ereg\Ereg.exe" -r "C:\ProgramData\Nuance\PDF Reader\Ereg\Ereg.ini" [328992 2008-11-03] (Nuance Communications, Inc.)

HKLM-x32\...\Run: [ASUSPRP] - "C:\Program Files (x86)\ASUS\APRP\APRP.EXE" [3331312 2011-10-20] (ASUSTek Computer Inc.)

HKLM-x32\...\Run: [ASUSWebStorage] - C:\Program Files (x86)\ASUS\ASUS WebStorage\3.0.108.222\AsusWSPanel.exe /S [737104 2011-07-29] (ecareme)

HKLM-x32\...\Run: [SonicMasterTray] - C:\Program Files (x86)\ASUS\SonicMaster\SonicMasterTray.exe [984400 2010-07-10] (Virage Logic Corporation / Sonic Focus)

HKLM-x32\...\Run: [ATKOSD2] - C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe [5732992 2010-08-17] (ASUS)

HKLM-x32\...\Run: [ATKMEDIA] - C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe [170624 2010-10-07] (ASUS)

HKLM-x32\...\Run: [HControlUser] - C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe [105016 2009-06-19] (ASUS)

HKLM-x32\...\Run: [Wireless Console 3] - C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe [1601536 2010-09-24] ()

HKLM-x32\...\Run: [RemoteControl10] - "C:\Program Files (x86)\Cyberlink\PowerDVD10\PDVD10Serv.exe" [87336 2010-02-03] (CyberLink Corp.)

HKLM-x32\...\Run: [BDRegion] - C:\Program Files (x86)\Cyberlink\Shared files\brs.exe [75048 2011-05-25] (cyberlink)

HKLM-x32\...\Run: [UpdatePSTShortCut] - "C:\Program Files (x86)\Cyberlink\DVD Suite\MUITransfer\MUIStartMenu.exe" "C:\Program Files (x86)\Cyberlink\DVD Suite" UpdateWithCreateOnce "Software\CyberLink\PowerStarter" [222504 2010-11-25] (CyberLink Corp.)

HKLM-x32\...\Run: [Korean IME Migration] - C:\PROGRA~2\COMMON~1\MICROS~1\IME12\IMEKR\IMKRMIG.EXE [26400 2006-10-26] (Microsoft Corporation)

HKLM-x32\...\Run: [Adobe ARM] - "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [958576 2013-04-04] (Adobe Systems Incorporated)

HKLM-x32\...\Run: [APSDaemon] - "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [59720 2013-01-28] (Apple Inc.)

HKLM-x32\...\Run: [HOfficeViewerUpdate] - C:\Program Files (x86)\HNC\HOfficeViewer80\HncUtils\HncViewerChecker.exe [1921648 2012-10-23] (Hancom Inc(HNC).)

HKLM-x32\...\Run: [WinPro] - C:\Program Files (x86)\WinPro\WinPro.exe [x]

HKLM-x32\...\Run: [IETab] - C:\Program Files (x86)\IETab\IETab.exe [x]

HKLM-x32\...\Run: [SunJavaUpdateSched] - "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe" [252848 2012-07-03] (Sun Microsystems, Inc.)

HKLM-x32\...\Run: [iTunesHelper] - "C:\Program Files (x86)\iTunes\iTunesHelper.exe" [152392 2013-02-20] (Apple Inc.)

HKLM-x32\...\Run: [QuickTime Task] - "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime [421888 2012-10-24] (Apple Inc.)

HKU\Haein Suk\...\Run: [DAEMON Tools Lite] - "C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe" -autorun [1305408 2011-01-20] (DT Soft Ltd)

HKU\Haein Suk\...\Run: [ManyCam] - "C:\Program Files (x86)\ManyCam\Bin\ManyCam.exe" /silent [5379472 2012-12-05] (ManyCam LLC)

HKU\Haein Suk\...\Run: [Skype] - "C:\Program Files (x86)\Skype\Phone\Skype.exe" /minimized /regrun [18618472 2013-05-09] (Skype Technologies S.A.)

HKU\Haein Suk\...\Run: [RESTART_STICKY_NOTES] - C:\Windows\System32\StikyNot.exe [427520 2009-07-14] (Microsoft Corporation)

HKU\Haein Suk\...\Run: [qcgce2mrvjq91kk1e7pnbb19m52fx] - C:\Users\HAEINS~1\AppData\Local\Temp\bbnbdxpkchxkrsfiyxh.bfg [x] <===== ATTENTION

HKU\Haein Suk\...\Winlogon: [Shell] cmd.exe [345088 2010-11-20] (Microsoft Corporation) <==== ATTENTION 

HKU\Haein Suk\...\Command Processor: "C:\Users\HAEINS~1\AppData\Local\Temp\bbnbdxpkchxkrsfiyxh.bfg" <===== ATTENTION!

HKU\UpdatusUser\...\Run: [ISUSPM] - C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe -scheduler [222496 2009-05-06] (Acresso Corporation)

AppInit_DLLs: C:\Windows\system32\nvinitx.dll [226920 2011-06-09] (NVIDIA Corporation)

AppInit_DLLs-x32: C:\Windows\SysWOW64\nvinit.dll [193128 2011-06-09] (NVIDIA Corporation)

Startup: C:\ProgramData\Start Menu\Programs\Startup\AsusVibeLauncher.lnk

ShortcutTarget: AsusVibeLauncher.lnk -> C:\Program Files (x86)\ASUS\AsusVibe\AsusVibeLauncher.exe (ASUSTeK Computer Inc.)

Startup: C:\ProgramData\Start Menu\Programs\Startup\FancyStart daemon.lnk

ShortcutTarget: FancyStart daemon.lnk -> C:\Windows\Installer\{C944B4C5-1C4D-4D95-8AC0-7CEF13914131}\_77B5857C27147149171BE7.exe ()
 

==================== Services (Whitelisted) =================
 

S2 Atheros Bt&Wlan Coex Agent; C:\Program Files (x86)\Bluetooth Suite\Ath_CoexAgent.exe [138400 2011-03-13] (Atheros)

S2 CLKMSVC10_38F51D56; C:\Program Files (x86)\CyberLink\PowerDVD10\NavFilter\kmsvc.exe [241648 2011-04-20] (CyberLink)

S2 Image Protection; C:\Windows\ImageSAFERSvc.exe [237568 2011-12-27] (MarkAny)

S3 RichVideo; C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe [249856 2011-02-15] ()
 

==================== Drivers (Whitelisted) ====================
 

S1 AMonTDLH; C:\Windows\system32\Drivers\AMonTDLH.sys [118072 2012-09-14] (AhnLab, Inc.)

S3 CdmDrvNt; C:\Windows\system32\Drivers\CdmDrvNt.sys [25656 2009-07-21] (AhnLab, Inc.)

S1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [254528 2012-02-23] (DT Soft Ltd)

S3 ISMgr; C:\Windows\system32\ImageSAFERDrv64.sys [11256 2009-11-26] ()

S3 JRSKD24; C:\Windows\system32\JRSKD24.SYS [13896 2012-10-28] (SoftSecurity Corporation)

S3 kbfiltr; C:\Windows\System32\DRIVERS\kbfiltr.sys [15416 2009-07-20] ( )

S3 kcrtx64; C:\Windows\system32\kcrtx64.sys [141848 2013-03-10] (Kings Information & Network)

S3 ManyCam; C:\Windows\System32\DRIVERS\mcvidrv_x64.sys [44928 2012-10-11] (ManyCam LLC)

S3 mcaudrv_simple; C:\Windows\System32\drivers\mcaudrv_x64.sys [29696 2012-10-11] (ManyCam LLC)

S3 MfFWEnt; C:\Program Files\AhnLab\ASP\MyFirewall 4.0\MfFWEnt.sys [126072 2010-06-28] (AhnLab, Inc.)

S3 MfIPSEnt; C:\Program Files\AhnLab\ASP\MyFirewall 4.0\MfIPSEnt.sys [155256 2010-06-28] (AhnLab, Inc.)

S3 Mkd2Bthf; C:\Windows\System32\drivers\Mkd2Bthf.sys [98104 2012-11-13] (AhnLab, Inc.)

S3 Mkd2Nadr; C:\Windows\System32\drivers\Mkd2Nadr.sys [112888 2013-03-28] (AhnLab, Inc.)

S3 Mkd3kfNt; C:\Windows\System32\drivers\Mkd3kfNt.sys [167672 2013-03-21] (AhnLab, Inc.)

S3 NPFW; C:\Windows\system32\NPFWVT64.sys [142656 2011-09-15] (INCA Internet Co.,Ltd.)

S3 NPFW; C:\Windows\system32\NPFWVT64.sys [142656 2011-09-15] (INCA Internet Co.,Ltd.)

S3 NPIDS; C:\Windows\system32\NpIdsVt64.sys [88384 2011-08-25] (INCA Internet Co.,Ltd.)

S3 NPIDS; C:\Windows\system32\NpIdsVt64.sys [88384 2011-08-25] (INCA Internet Co.,Ltd.)

S3 scsk5; C:\Windows\SysWow64\drivers\scsk5.sys [47280 2013-04-28] ()

S3 scsk5; C:\Windows\SysWow64\drivers\scsk5.sys [47280 2013-04-28] ()

S2 TurboB; C:\Windows\System32\DRIVERS\TurboB.sys [13832 2010-04-17] ()

S3 ezty2; \??\C:\Windows\system32\ezty2.sys [x]

S3 x64kdss; syswow64\Drivers\x64kdss.sys [x]

S3 xspirit; \??\C:\Windows\xspirit.sys [x]
 

==================== NetSvcs (Whitelisted) ===================
 
 

==================== One Month Created Files and Folders ========
 

2013-07-17 06:03 - 2011-07-13 03:55 - 02237440 ____R (OldTimer Tools) C:\OTLPE.exe

2013-07-17 06:01 - 2013-07-17 06:01 - 00000000 ____D C:\_OTL

2013-07-17 05:17 - 2013-07-17 05:31 - 00117090 _____ C:\OTL.Txt

2013-07-17 03:29 - 2013-07-17 03:29 - 00000000 ____D C:\FRST

2013-07-15 19:07 - 2013-07-15 19:07 - 00003416 ____N C:\bootsqm.dat

2013-07-14 21:23 - 2013-07-14 21:23 - 00393531 _____ C:\Users\Haein Suk\AppData\Roaming\2433f433

2013-07-14 21:23 - 2013-07-14 21:23 - 00393521 _____ C:\Users\Haein Suk\AppData\Local\2433f433

2013-07-14 21:23 - 2013-07-14 21:23 - 00393512 _____ C:\ProgramData\2433f433

2013-07-14 21:23 - 2013-07-14 21:23 - 00000000 ____D C:\Windows\Sun

2013-07-14 00:33 - 2013-07-14 00:33 - 01985812 _____ C:\Users\Haein Suk\Downloads\19._Cute_decoration_of_the_tank_1.swf

2013-07-14 00:33 - 2013-07-14 00:33 - 01985812 _____ C:\Users\Haein Suk\Downloads\19._Cute_decoration_of_the_tank_1 (1).swf

2013-07-13 14:00 - 2013-07-13 14:00 - 00000000 ____D C:\Users\Haein Suk\AppData\Local\{4F0B12A6-9E27-4160-98AC-3331D73EE888}

2013-07-12 13:51 - 2013-07-13 01:52 - 00000000 ____D C:\Users\Haein Suk\AppData\Local\{B341C501-309F-4552-A407-550862E8A76A}

2013-07-11 13:40 - 2013-06-12 00:42 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll

2013-07-11 13:40 - 2013-06-12 00:25 - 00526336 _____ (Microsoft Corporation) C:\Windows\System32\ieui.dll

2013-07-11 13:40 - 2013-06-07 04:22 - 02706432 _____ (Microsoft Corporation) C:\Windows\System32\mshtml.tlb

2013-07-11 13:40 - 2013-06-07 03:37 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb

2013-07-11 13:39 - 2013-06-12 00:43 - 14329856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll

2013-07-11 13:39 - 2013-06-12 00:43 - 02877440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll

2013-07-11 13:39 - 2013-06-12 00:43 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll

2013-07-11 13:39 - 2013-06-12 00:43 - 01141248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll

2013-07-11 13:39 - 2013-06-12 00:43 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll

2013-07-11 13:39 - 2013-06-12 00:43 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll

2013-07-11 13:39 - 2013-06-12 00:43 - 00039424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll

2013-07-11 13:39 - 2013-06-12 00:42 - 13760512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll

2013-07-11 13:39 - 2013-06-12 00:42 - 02046976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll

2013-07-11 13:39 - 2013-06-12 00:42 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll

2013-07-11 13:39 - 2013-06-12 00:42 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll

2013-07-11 13:39 - 2013-06-12 00:42 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll

2013-07-11 13:39 - 2013-06-12 00:26 - 02241024 _____ (Microsoft Corporation) C:\Windows\System32\wininet.dll

2013-07-11 13:39 - 2013-06-12 00:26 - 01365504 _____ (Microsoft Corporation) C:\Windows\System32\urlmon.dll

2013-07-11 13:39 - 2013-06-12 00:26 - 00051712 _____ (Microsoft Corporation) C:\Windows\System32\ie4uinit.exe

2013-07-11 13:39 - 2013-06-12 00:25 - 19238912 _____ (Microsoft Corporation) C:\Windows\System32\mshtml.dll

2013-07-11 13:39 - 2013-06-12 00:25 - 15404032 _____ (Microsoft Corporation) C:\Windows\System32\ieframe.dll

2013-07-11 13:39 - 2013-06-12 00:25 - 03958784 _____ (Microsoft Corporation) C:\Windows\System32\jscript9.dll

2013-07-11 13:39 - 2013-06-12 00:25 - 02648576 _____ (Microsoft Corporation) C:\Windows\System32\iertutil.dll

2013-07-11 13:39 - 2013-06-12 00:25 - 00855552 _____ (Microsoft Corporation) C:\Windows\System32\jscript.dll

2013-07-11 13:39 - 2013-06-12 00:25 - 00603136 _____ (Microsoft Corporation) C:\Windows\System32\msfeeds.dll

2013-07-11 13:39 - 2013-06-12 00:25 - 00136704 _____ (Microsoft Corporation) C:\Windows\System32\iesysprep.dll

2013-07-11 13:39 - 2013-06-12 00:25 - 00067072 _____ (Microsoft Corporation) C:\Windows\System32\iesetup.dll

2013-07-11 13:39 - 2013-06-12 00:25 - 00053248 _____ (Microsoft Corporation) C:\Windows\System32\jsproxy.dll

2013-07-11 13:39 - 2013-06-12 00:25 - 00039936 _____ (Microsoft Corporation) C:\Windows\System32\iernonce.dll

2013-07-11 13:39 - 2013-06-11 23:51 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe

2013-07-11 13:39 - 2013-06-11 23:50 - 00089600 _____ (Microsoft Corporation) C:\Windows\System32\RegisterIEPKEYs.exe

2013-07-11 11:49 - 2013-07-11 11:49 - 00000000 ____D C:\Users\Haein Suk\AppData\Local\{4694E3EA-1671-488D-99B2-47CDF25787A5}

2013-07-11 10:55 - 2013-06-05 04:34 - 03153920 _____ (Microsoft Corporation) C:\Windows\System32\win32k.sys

2013-07-11 10:55 - 2013-06-04 07:00 - 00624128 _____ (Microsoft Corporation) C:\Windows\System32\qedit.dll

2013-07-11 10:55 - 2013-06-04 05:53 - 00509440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qedit.dll

2013-07-11 10:55 - 2013-05-06 07:03 - 01887744 _____ (Microsoft Corporation) C:\Windows\System32\WMVDECOD.DLL

2013-07-11 10:55 - 2013-05-06 05:56 - 01620480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMVDECOD.DLL

2013-07-11 10:55 - 2013-04-10 00:34 - 01247744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DWrite.dll

2013-07-11 10:55 - 2013-04-02 23:51 - 01643520 _____ (Microsoft Corporation) C:\Windows\System32\DWrite.dll

2013-06-29 19:34 - 2013-06-29 19:34 - 00000000 ____D C:\Users\Haein Suk\Documents\566cb5194643925ec30183d7a1f14f25873ca11c

2013-06-29 19:22 - 2013-06-29 19:23 - 00000000 ____D C:\Users\Haein Suk\Desktop\subs-bridget-joness-diary-2001-www.subtitlecube.com

2013-06-29 17:36 - 2013-06-29 17:36 - 00000000 ____D C:\Users\Haein Suk\AppData\Local\{8A4DD1BF-CD6B-4EBE-B022-D77D0C3E3D00}

2013-06-28 19:01 - 2013-06-28 19:01 - 00152118 _____ C:\Users\Haein Suk\Desktop\d.bmp

2013-06-28 19:00 - 2013-06-28 19:00 - 00151374 _____ C:\Users\Haein Suk\Desktop\lunch.bmp

2013-06-28 16:07 - 2013-06-28 16:07 - 00151194 _____ C:\Users\Haein Suk\Desktop\untitled.bmp

2013-06-27 22:49 - 2013-06-27 22:50 - 00000000 ____D C:\Users\Haein Suk\Desktop\PHOTO디카

2013-06-21 22:50 - 2013-06-22 11:23 - 00000000 ____D C:\Users\Haein Suk\Desktop\105PHOTO

2013-06-21 16:02 - 2013-06-21 16:04 - 1872046861 _____ C:\Users\Haein Suk\Desktop\PHOTO디카.zip

2013-06-21 15:45 - 2013-06-21 15:46 - 1147330998 _____ C:\Users\Haein Suk\Desktop\105PHOTO.zip

2013-06-21 15:38 - 2013-06-21 15:40 - 1482992864 _____ C:\Users\Haein Suk\Desktop\104PHOTO.zip

2013-06-21 15:33 - 2013-06-21 15:35 - 1177013224 _____ C:\Users\Haein Suk\Desktop\103PHOTO.zip

2013-06-21 15:31 - 2013-06-21 15:33 - 1338389554 _____ C:\Users\Haein Suk\Desktop\102PHOTO.zip

2013-06-21 15:03 - 2013-06-21 15:04 - 1160285522 _____ C:\Users\Haein Suk\Desktop\101PHOTO.zip

2013-06-21 14:55 - 2013-06-21 14:57 - 2075488733 _____ C:\Users\Haein Suk\Desktop\100PHOTO.zip
 

==================== One Month Modified Files and Folders =======
 

2013-07-17 06:01 - 2013-07-17 06:01 - 00000000 ____D C:\_OTL

2013-07-17 05:31 - 2013-07-17 05:17 - 00117090 _____ C:\OTL.Txt

2013-07-17 05:15 - 2012-02-01 13:34 - 00000000 ____D C:\users\Haein Suk

2013-07-17 03:29 - 2013-07-17 03:29 - 00000000 ____D C:\FRST

2013-07-17 02:14 - 2013-05-02 19:31 - 00000374 _____ C:\Windows\System32\Drivers\etc\hosts.ics

2013-07-17 02:14 - 2013-04-30 22:02 - 00000686 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job

2013-07-17 02:14 - 2012-01-13 21:36 - 00000000 ____D C:\ProgramData\NVIDIA

2013-07-17 02:14 - 2009-07-14 06:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT

2013-07-17 02:14 - 2009-07-14 05:51 - 00119868 _____ C:\Windows\setupact.log

2013-07-17 02:12 - 2013-04-30 22:02 - 00000690 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job

2013-07-17 02:12 - 2012-01-13 21:27 - 01916510 _____ C:\Windows\WindowsUpdate.log

2013-07-17 02:01 - 2009-07-14 05:45 - 00009920 ____H C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2013-07-17 02:01 - 2009-07-14 05:45 - 00009920 ____H C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2013-07-15 19:07 - 2013-07-15 19:07 - 00003416 ____N C:\bootsqm.dat

2013-07-14 21:42 - 2012-01-13 21:47 - 00002302 _____ C:\Windows\System32\AutoRunFilter.ini

2013-07-14 21:26 - 2012-11-08 04:21 - 00000622 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job

2013-07-14 21:23 - 2013-07-14 21:23 - 00393531 _____ C:\Users\Haein Suk\AppData\Roaming\2433f433

2013-07-14 21:23 - 2013-07-14 21:23 - 00393521 _____ C:\Users\Haein Suk\AppData\Local\2433f433

2013-07-14 21:23 - 2013-07-14 21:23 - 00393512 _____ C:\ProgramData\2433f433

2013-07-14 21:23 - 2013-07-14 21:23 - 00000000 ____D C:\Windows\Sun

2013-07-14 21:23 - 2012-12-25 16:06 - 00000000 ____D C:\Users\Haein Suk\AppData\Roaming\Skype

2013-07-14 15:16 - 2012-02-01 13:34 - 00045056 _____ C:\Windows\System32\acovcnt.exe

2013-07-14 15:16 - 2012-02-01 13:34 - 00000000 ___HD C:\ASUS.DAT

2013-07-14 00:46 - 2013-04-07 13:00 - 00003920 _____ C:\Windows\System32\Tasks\User_Feed_Synchronization-{348EBFE9-7709-48FE-AF07-FF8B7D8B1AFD}

2013-07-14 00:33 - 2013-07-14 00:33 - 01985812 _____ C:\Users\Haein Suk\Downloads\19._Cute_decoration_of_the_tank_1.swf

2013-07-14 00:33 - 2013-07-14 00:33 - 01985812 _____ C:\Users\Haein Suk\Downloads\19._Cute_decoration_of_the_tank_1 (1).swf

2013-07-13 23:58 - 2012-03-20 12:46 - 01776640 ___SH C:\Users\Haein Suk\Desktop\Thumbs.db

2013-07-13 17:56 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\rescache

2013-07-13 17:13 - 2013-05-17 21:47 - 00002185 _____ C:\Users\Public\Desktop\Chrome.lnk

2013-07-13 14:00 - 2013-07-13 14:00 - 00000000 ____D C:\Users\Haein Suk\AppData\Local\{4F0B12A6-9E27-4160-98AC-3331D73EE888}

2013-07-13 14:00 - 2012-02-01 14:14 - 00000000 ____D C:\Users\Haein Suk\AppData\Local\Windows Live

2013-07-13 01:52 - 2013-07-12 13:51 - 00000000 ____D C:\Users\Haein Suk\AppData\Local\{B341C501-309F-4552-A407-550862E8A76A}

2013-07-11 19:45 - 2009-07-14 05:45 - 00523880 _____ C:\Windows\System32\FNTCACHE.DAT

2013-07-11 19:44 - 2009-07-14 08:45 - 00000000 ____D C:\Program Files\Windows Journal

2013-07-11 19:44 - 2009-07-14 06:32 - 00000000 ____D C:\Program Files\Windows Defender

2013-07-11 19:44 - 2009-07-14 06:32 - 00000000 ____D C:\Program Files (x86)\Windows Defender

2013-07-11 19:43 - 2013-03-13 13:53 - 00000000 ____D C:\Program Files\Microsoft Silverlight

2013-07-11 19:43 - 2013-03-13 13:53 - 00000000 ____D C:\Program Files (x86)\Microsoft Silverlight

2013-07-11 19:43 - 2011-10-20 19:28 - 01241750 _____ C:\Windows\PFRO.log

2013-07-11 13:42 - 2011-02-19 07:38 - 00438592 _____ C:\Windows\System32\perfh012.dat

2013-07-11 13:42 - 2011-02-19 07:38 - 00123162 _____ C:\Windows\System32\perfc012.dat

2013-07-11 13:42 - 2009-07-14 06:13 - 01368780 _____ C:\Windows\System32\PerfStringBackup.INI

2013-07-11 13:40 - 2012-02-05 09:49 - 00000000 ____D C:\ProgramData\Microsoft Help

2013-07-11 11:49 - 2013-07-11 11:49 - 00000000 ____D C:\Users\Haein Suk\AppData\Local\{4694E3EA-1671-488D-99B2-47CDF25787A5}

2013-07-10 21:12 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\System32\NDF

2013-06-29 19:34 - 2013-06-29 19:34 - 00000000 ____D C:\Users\Haein Suk\Documents\566cb5194643925ec30183d7a1f14f25873ca11c

2013-06-29 19:34 - 2012-04-05 13:09 - 00000000 ____D C:\Users\Haein Suk\AppData\Roaming\vlc

2013-06-29 19:23 - 2013-06-29 19:22 - 00000000 ____D C:\Users\Haein Suk\Desktop\subs-bridget-joness-diary-2001-www.subtitlecube.com

2013-06-29 17:36 - 2013-06-29 17:36 - 00000000 ____D C:\Users\Haein Suk\AppData\Local\{8A4DD1BF-CD6B-4EBE-B022-D77D0C3E3D00}

2013-06-28 19:01 - 2013-06-28 19:01 - 00152118 _____ C:\Users\Haein Suk\Desktop\d.bmp

2013-06-28 19:00 - 2013-06-28 19:00 - 00151374 _____ C:\Users\Haein Suk\Desktop\lunch.bmp

2013-06-28 16:07 - 2013-06-28 16:07 - 00151194 _____ C:\Users\Haein Suk\Desktop\untitled.bmp

2013-06-27 22:50 - 2013-06-27 22:49 - 00000000 ____D C:\Users\Haein Suk\Desktop\PHOTO디카

2013-06-22 11:23 - 2013-06-21 22:50 - 00000000 ____D C:\Users\Haein Suk\Desktop\105PHOTO

2013-06-21 16:04 - 2013-06-21 16:02 - 1872046861 _____ C:\Users\Haein Suk\Desktop\PHOTO디카.zip

2013-06-21 15:46 - 2013-06-21 15:45 - 1147330998 _____ C:\Users\Haein Suk\Desktop\105PHOTO.zip

2013-06-21 15:40 - 2013-06-21 15:38 - 1482992864 _____ C:\Users\Haein Suk\Desktop\104PHOTO.zip

2013-06-21 15:35 - 2013-06-21 15:33 - 1177013224 _____ C:\Users\Haein Suk\Desktop\103PHOTO.zip

2013-06-21 15:33 - 2013-06-21 15:31 - 1338389554 _____ C:\Users\Haein Suk\Desktop\102PHOTO.zip

2013-06-21 15:04 - 2013-06-21 15:03 - 1160285522 _____ C:\Users\Haein Suk\Desktop\101PHOTO.zip

2013-06-21 14:57 - 2013-06-21 14:55 - 2075488733 _____ C:\Users\Haein Suk\Desktop\100PHOTO.zip

2013-06-17 15:12 - 2012-02-17 07:05 - 00000000 ____D C:\Users\Haein Suk\AppData\Local\CrashDumps
 

Files to move or delete:

====================

C:\ProgramData\FullRemove.exe
 

==================== Known DLLs (Whitelisted) ================
 
 

==================== Bamital & volsnap Check =================
 

C:\Windows\System32\winlogon.exe => MD5 is legit

C:\Windows\System32\wininit.exe => MD5 is legit

C:\Windows\SysWOW64\wininit.exe => MD5 is legit

C:\Windows\explorer.exe => MD5 is legit

C:\Windows\SysWOW64\explorer.exe => MD5 is legit

C:\Windows\System32\svchost.exe => MD5 is legit

C:\Windows\SysWOW64\svchost.exe => MD5 is legit

C:\Windows\System32\services.exe => MD5 is legit

C:\Windows\System32\User32.dll => MD5 is legit

C:\Windows\SysWOW64\User32.dll => MD5 is legit

C:\Windows\System32\userinit.exe => MD5 is legit

C:\Windows\SysWOW64\userinit.exe => MD5 is legit

C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
 

==================== EXE ASSOCIATION =====================
 

HKLM\...\.exe: exefile => OK

HKLM\...\exefile\DefaultIcon: %1 => OK

HKLM\...\exefile\open\command: "%1" %* => OK
 

==================== Restore Points  =========================
 

Restore point made on: 2013-06-25 07:37:32

Restore point made on: 2013-06-28 12:21:02

Restore point made on: 2013-07-02 16:18:59

Restore point made on: 2013-07-11 10:52:04

Restore point made on: 2013-07-11 13:33:11
 

==================== Memory info =========================== 
 

Percentage of memory in use: 10%

Total physical RAM: 8096.05 MB

Available physical RAM: 7256.15 MB

Total Pagefile: 8094.2 MB

Available Pagefile: 7260.18 MB

Total Virtual: 8192 MB

Available Virtual: 8191.84 MB
 

==================== Drives ================================
 

Drive c: (OS) (Fixed) (Total:300 GB) (Free:157.05 GB) NTFS (Disk=0 Partition=2) ==>[Drive with boot components (obtained from BCD)]

Drive d: (DATA) (Fixed) (Total:373.64 GB) (Free:129.5 GB) NTFS (Disk=0 Partition=3)

Drive e: (Reparaturdatenträger Windows 7 6) (CDROM) (Total:0.16 GB) (Free:0 GB) UDF

Drive f: () (Removable) (Total:1.87 GB) (Free:1.75 GB) FAT (Disk=1 Partition=1)

Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS
 

==================== MBR & Partition Table ==================
 

========================================================

Disk: 0 (MBR Code: Windows 7 or 8) (Size: 699 GB) (Disk ID: 5BE4A3F9)

Partition 1: (Not Active) - (Size=25 GB) - (Type=1C)

Partition 2: (Active) - (Size=300 GB) - (Type=07 NTFS)

Partition 3: (Not Active) - (Size=374 GB) - (Type=07 NTFS)
 

========================================================

Disk: 1 (Size: 2 GB) (Disk ID: 03392250)

Partition 1: (Active) - (Size=2 GB) - (Type=06)
 
 

LastRegBack: 2013-07-13 17:47
 

==================== End Of Log ============================

--- --- ---

AdwCleaner Logfile:

Code:

# AdwCleaner v2.305 - Logfile created 07/18/2013 at 01:59:17

# Updated 11/07/2013 by Xplode

# Operating system : Windows 7 Home Premium Service Pack 1 (64 bits)

# User : Haein Suk - HAEINSUK-PC

# Boot Mode : Normal

# Running from : C:\Users\Haein Suk\Desktop\adwcleaner.exe

# Option [Delete]
 
 

***** [Services] *****
 
 

***** [Files / Folders] *****
 

File Deleted : C:\END

Folder Deleted : C:\Program Files (x86)\Conduit

Folder Deleted : C:\Program Files (x86)\Red Sky

Folder Deleted : C:\Program Files (x86)\WizSearch

Folder Deleted : C:\ProgramData\APN

Folder Deleted : C:\Users\Haein Suk\AppData\Local\Conduit

Folder Deleted : C:\Users\Haein Suk\AppData\Local\DownTango

Folder Deleted : C:\Users\Haein Suk\AppData\LocalLow\Conduit

Folder Deleted : C:\Users\Haein Suk\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\TornTV.com
 

***** [Registry] *****
 

Key Deleted : HKCU\Software\1ClickDownload

Key Deleted : HKCU\Software\APN PIP

Key Deleted : HKCU\Software\AppDataLow\Software\Conduit

Key Deleted : HKCU\Software\AppDataLow\Software\ConduitSearchScopes

Key Deleted : HKCU\Software\Conduit

Key Deleted : HKCU\Software\WizSearch

Key Deleted : HKLM\SOFTWARE\Classes\AppID\{608D3067-77E8-463D-9084-908966806826}

Key Deleted : HKLM\SOFTWARE\Classes\AppID\{EA28B360-05E0-4F93-8150-02891F1D8D3C}

Key Deleted : HKLM\SOFTWARE\Classes\Toolbar.CT2801948

Key Deleted : HKLM\Software\Conduit

Key Deleted : HKLM\Software\Iminent

Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\ConduitInstaller_RASAPI32

Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\ConduitInstaller_RASMANCS

Key Deleted : HKLM\Software\PIP

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{3C471948-F874-49F5-B338-4F214A2EE0B1}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\jbpkiefagocgkmemidfngdkamloieekf

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}
 

***** [Internet Browsers] *****
 

-\\ Internet Explorer v10.0.9200.16635
 

[OK] Registry is clean.
 

-\\ Google Chrome v28.0.1500.72
 

File : C:\Users\Haein Suk\AppData\Local\Google\Chrome\User Data\Default\Preferences
 

[OK] File is clean.
 

*************************
 

AdwCleaner[S1].txt - [2349 octets] - [18/07/2013 01:59:17]
 

########## EOF - C:\AdwCleaner[S1].txt - [2409 octets] ##########

--- --- ---

---- und ComboFix----

Code:

ComboFix 13-07-16.01 - Haein Suk 2013-07-18   2:42.2.8 - x64

Microsoft Windows 7 Home Premium K   6.1.7601.1.949.82.1042.18.8096.6346 [GMT 2:00]

Running from: c:\users\Haein Suk\Desktop\ComboFix.exe

SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

.

(((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))

.

.

c:\program files (x86)\IESide

c:\program files\Fasoo DRM\f_CM.dll

c:\users\Haein Suk\AppData\Local\Temp\XTMP1MC3VE\DEMF6EB.tmp

c:\users\Haein Suk\AppData\Local\Temp\XTMP1MC3VE\DEMF6FD.tmp

c:\users\Haein Suk\AppData\Local\Temp\XTMP1MC3VE\DEMF70E.tmp

c:\users\Haein Suk\AppData\Local\Temp\XTMP1MC3VE\DEMF720.tmp

c:\users\Haein Suk\AppData\Local\Temp\XTMP1MC3VE\DEMF722.tmp

c:\users\Haein Suk\AppData\Local\Temp\XTMP1MC3VE\DEMF724.tmp

c:\users\Haein Suk\AppData\Local\Temp\XTMP1MC3VE\DEMF745.tmp

c:\users\Haein Suk\AppData\Local\Temp\XTMP1MC3VE\DEMF766.tmp

c:\users\Haein Suk\AppData\Local\Temp\XTMP1MC3VE\DEMF76A.tmp

c:\users\Haein Suk\AppData\Local\Temp\XTMP1MC3VE\DEMF77C.tmp

c:\users\Haein Suk\AppData\Local\Temp\XTMP1MC3VE\DEMF78E.tmp

c:\users\Haein Suk\AppData\Local\Temp\XTMP1MC3VE\DEMF79F.tmp

c:\users\Haein Suk\AppData\Local\Temp\XTMP1MC3VE\DEMF7A1.tmp

c:\users\Haein Suk\AppData\Local\Temp\XTMP1MC3VE\DEMF7B3.tmp

c:\users\Haein Suk\AppData\Local\Temp\XTMP1MC3VE\DEMF7C4.tmp

c:\users\Haein Suk\AppData\Local\Temp\XTMP1MC3VE\DEMF7E6.tmp

c:\users\Haein Suk\AppData\Local\Temp\XTMP1MC3VE\DEMF7E8.tmp

c:\users\Haein Suk\AppData\Local\Temp\XTMP1MC3VE\DEMF7F9.tmp

c:\users\Haein Suk\AppData\Local\Temp\XTMP1MC3VE\DEMF80B.tmp

c:\users\Haein Suk\AppData\Local\Temp\XTMP1MC3VE\DEMF81C.tmp

c:\users\Haein Suk\AppData\Local\Temp\XTMP1MC3VE\DEMF82E.tmp

c:\users\Haein Suk\AppData\Local\Temp\XTMP1MC3VE\DEMF840.tmp

c:\users\Haein Suk\AppData\Local\Temp\XTMP1MC3VE\DEMF870.tmp

c:\users\Haein Suk\AppData\Local\Temp\XTMP1MC3VE\DEMF893.tmp

c:\users\Haein Suk\AppData\Local\Temp\XTMP1MC3VE\DEMF8B4.tmp

c:\users\Haein Suk\AppData\Local\Temp\XTMP1MC3VE\DEMF8C5.tmp

c:\users\Haein Suk\AppData\Local\Temp\XTMP1MC3VE\DEMF8E7.tmp

c:\users\Haein Suk\AppData\Local\Temp\XTMP1MC3VE\DEMF8F8.tmp

c:\users\Haein Suk\AppData\Local\Temp\XTMP1MC3VE\DEMF919.tmp

c:\users\Haein Suk\AppData\Local\Temp\XTMP1MC3VE\DEMF93B.tmp

c:\users\Haein Suk\AppData\Local\Temp\XTMP1MC3VE\DEMF94C.tmp

c:\users\Haein Suk\AppData\Local\Temp\XTMP1MC3VE\DEMF96D.tmp

c:\users\Haein Suk\AppData\Local\Temp\XTMP1MC3VE\DEMF97F.tmp

c:\users\Haein Suk\AppData\Local\Temp\XTMP1MC3VE\DEMF9A0.tmp

c:\users\Haein Suk\AppData\Local\Temp\XTMP1MC3VE\DEMFA8C.tmp

c:\users\Haein Suk\AppData\Local\Temp\XTMP1MC3VE\DEMFAAD.tmp

c:\users\Haein Suk\AppData\Local\Temp\XTMP1MC3VE\DEMFC55.tmp

c:\users\Haein Suk\AppData\Local\Temp\XTMP1MC3VE\DEMFC66.tmp

c:\users\Haein Suk\AppData\Local\Temp\XTMP1MC3VE\DEMFC87.tmp

c:\users\Haein Suk\AppData\Local\Temp\XTMP1MC3VE\DEMFCA9.tmp

c:\users\Haein Suk\AppData\Local\Temp\XTMP1MC3VE\DEMFCCA.tmp

c:\users\Haein Suk\AppData\Local\Temp\XTMP1MC3VE\DEMFCDB.tmp

c:\users\Haein Suk\AppData\Local\Temp\XTMP1MC3VE\DEMFD1E.tmp

c:\users\Haein Suk\AppData\Local\Temp\XTMP1MC3VE\DEMFD2F.tmp

c:\users\Haein Suk\AppData\Local\Temp\XTMP1MC3VE\DEMFD31.tmp

c:\users\Haein Suk\AppData\Local\Temp\XTMP1MC3VE\DEMFD33.tmp

c:\users\Haein Suk\AppData\Local\Temp\YTMP7MC8AA\TAAF768.tmp

c:\users\Haein Suk\Documents\~WRL0005.tmp

c:\users\HAEINS~1\AppData\Local\Temp\XTMP1MC3VE\DEMF6EB.tmp

c:\users\HAEINS~1\AppData\Local\Temp\XTMP1MC3VE\DEMF6FD.tmp

c:\users\HAEINS~1\AppData\Local\Temp\XTMP1MC3VE\DEMF70E.tmp

c:\users\HAEINS~1\AppData\Local\Temp\XTMP1MC3VE\DEMF720.tmp

c:\users\HAEINS~1\AppData\Local\Temp\XTMP1MC3VE\DEMF722.tmp

c:\users\HAEINS~1\AppData\Local\Temp\XTMP1MC3VE\DEMF724.tmp

c:\users\HAEINS~1\AppData\Local\Temp\XTMP1MC3VE\DEMF745.tmp

c:\users\HAEINS~1\AppData\Local\Temp\XTMP1MC3VE\DEMF766.tmp

c:\users\HAEINS~1\AppData\Local\Temp\XTMP1MC3VE\DEMF76A.tmp

c:\users\HAEINS~1\AppData\Local\Temp\XTMP1MC3VE\DEMF77C.tmp

c:\users\HAEINS~1\AppData\Local\Temp\XTMP1MC3VE\DEMF78E.tmp

c:\users\HAEINS~1\AppData\Local\Temp\XTMP1MC3VE\DEMF79F.tmp

c:\users\HAEINS~1\AppData\Local\Temp\XTMP1MC3VE\DEMF7A1.tmp

c:\users\HAEINS~1\AppData\Local\Temp\XTMP1MC3VE\DEMF7B3.tmp

c:\users\HAEINS~1\AppData\Local\Temp\XTMP1MC3VE\DEMF7C4.tmp

c:\users\HAEINS~1\AppData\Local\Temp\XTMP1MC3VE\DEMF7E6.tmp

c:\users\HAEINS~1\AppData\Local\Temp\XTMP1MC3VE\DEMF7E8.tmp

c:\users\HAEINS~1\AppData\Local\Temp\XTMP1MC3VE\DEMF7F9.tmp

c:\users\HAEINS~1\AppData\Local\Temp\XTMP1MC3VE\DEMF80B.tmp

c:\users\HAEINS~1\AppData\Local\Temp\XTMP1MC3VE\DEMF81C.tmp

c:\users\HAEINS~1\AppData\Local\Temp\XTMP1MC3VE\DEMF82E.tmp

c:\users\HAEINS~1\AppData\Local\Temp\XTMP1MC3VE\DEMF840.tmp

c:\users\HAEINS~1\AppData\Local\Temp\XTMP1MC3VE\DEMF870.tmp

c:\users\HAEINS~1\AppData\Local\Temp\XTMP1MC3VE\DEMF893.tmp

c:\users\HAEINS~1\AppData\Local\Temp\XTMP1MC3VE\DEMF8B4.tmp

c:\users\HAEINS~1\AppData\Local\Temp\XTMP1MC3VE\DEMF8C5.tmp

c:\users\HAEINS~1\AppData\Local\Temp\XTMP1MC3VE\DEMF8E7.tmp

c:\users\HAEINS~1\AppData\Local\Temp\XTMP1MC3VE\DEMF8F8.tmp

c:\users\HAEINS~1\AppData\Local\Temp\XTMP1MC3VE\DEMF919.tmp

c:\users\HAEINS~1\AppData\Local\Temp\XTMP1MC3VE\DEMF93B.tmp

c:\users\HAEINS~1\AppData\Local\Temp\XTMP1MC3VE\DEMF94C.tmp

c:\users\HAEINS~1\AppData\Local\Temp\XTMP1MC3VE\DEMF96D.tmp

c:\users\HAEINS~1\AppData\Local\Temp\XTMP1MC3VE\DEMF97F.tmp

c:\users\HAEINS~1\AppData\Local\Temp\XTMP1MC3VE\DEMF9A0.tmp

c:\users\HAEINS~1\AppData\Local\Temp\XTMP1MC3VE\DEMFA8C.tmp

c:\users\HAEINS~1\AppData\Local\Temp\XTMP1MC3VE\DEMFAAD.tmp

c:\users\HAEINS~1\AppData\Local\Temp\XTMP1MC3VE\DEMFC55.tmp

c:\users\HAEINS~1\AppData\Local\Temp\XTMP1MC3VE\DEMFC66.tmp

c:\users\HAEINS~1\AppData\Local\Temp\XTMP1MC3VE\DEMFC87.tmp

c:\users\HAEINS~1\AppData\Local\Temp\XTMP1MC3VE\DEMFCA9.tmp

c:\users\HAEINS~1\AppData\Local\Temp\XTMP1MC3VE\DEMFCCA.tmp

c:\users\HAEINS~1\AppData\Local\Temp\XTMP1MC3VE\DEMFCDB.tmp

c:\users\HAEINS~1\AppData\Local\Temp\XTMP1MC3VE\DEMFD1E.tmp

c:\users\HAEINS~1\AppData\Local\Temp\XTMP1MC3VE\DEMFD2F.tmp

c:\users\HAEINS~1\AppData\Local\Temp\XTMP1MC3VE\DEMFD31.tmp

c:\users\HAEINS~1\AppData\Local\Temp\XTMP1MC3VE\DEMFD33.tmp

c:\users\HAEINS~1\AppData\Local\Temp\YTMP7MC8AA\TAAF768.tmp

c:\windows\Downloaded Program Files\XPayPlugin

c:\windows\Downloaded Program Files\XPayPlugin\LGDacomPaymentView.ocx

c:\windows\msvcr71.dll

c:\windows\SysWow64\11st.ico

c:\windows\SysWow64\Temp

.

.

(((((((((((((((((((((((((   Files Created from 2013-06-18 to 2013-07-18  )))))))))))))))))))))))))))))))

.

.

2013-07-17 05:03 . 2011-07-13 02:55        2237440        ----a-r-        C:\OTLPE.exe

2013-07-17 05:01 . 2013-07-17 05:01        --------        d-----w-        C:\_OTL

2013-07-17 02:29 . 2013-07-17 02:29        --------        d-----w-        C:\FRST

2013-07-14 20:23 . 2013-07-14 20:23        --------        d-----w-        c:\windows\Sun

2013-07-12 13:03 . 2013-06-12 03:08        9552976        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{A4C501E1-A962-4022-BAA0-AD84D932CF13}\mpengine.dll

2013-07-11 12:40 . 2013-06-07 03:22        2706432        ----a-w-        c:\windows\system32\mshtml.tlb

2013-07-11 12:40 . 2013-06-07 02:37        2706432        ----a-w-        c:\windows\SysWow64\mshtml.tlb

2013-07-11 12:40 . 2013-06-11 23:43        217600        ----a-w-        c:\program files (x86)\Internet Explorer\sqmapi.dll

2013-07-11 12:40 . 2013-06-11 23:42        257536        ----a-w-        c:\program files (x86)\Internet Explorer\ieproxy.dll

2013-07-11 12:40 . 2013-06-11 23:42        235520        ----a-w-        c:\program files (x86)\Internet Explorer\IEShims.dll

2013-07-11 12:40 . 2013-06-11 23:26        278528        ----a-w-        c:\program files\Internet Explorer\sqmapi.dll

2013-07-11 12:40 . 2013-06-11 23:25        701952        ----a-w-        c:\program files\Internet Explorer\ieproxy.dll

2013-07-11 12:40 . 2013-06-11 23:25        526336        ----a-w-        c:\windows\system32\ieui.dll

2013-07-11 12:40 . 2013-06-11 23:25        356864        ----a-w-        c:\program files\Internet Explorer\IEShims.dll

.

.

.

((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2013-07-18 00:49 . 2012-02-01 12:34        45056        ----a-w-        c:\windows\system32\acovcnt.exe

2013-06-12 11:26 . 2012-11-08 03:21        692104        ----a-w-        c:\windows\SysWow64\FlashPlayerApp.exe

2013-06-12 11:26 . 2012-02-20 15:32        71048        ----a-w-        c:\windows\SysWow64\FlashPlayerCPLApp.cpl

2013-06-11 04:04 . 2012-10-16 13:52        3066096        ----a-w-        c:\windows\system32\btscan.exe

2013-05-30 22:35 . 2013-05-30 22:35        1054720        ----a-w-        c:\windows\system32\MsSpellCheckingFacility.exe

2013-05-30 22:35 . 2013-05-30 22:35        97280        ----a-w-        c:\windows\system32\mshtmled.dll

2013-05-30 22:35 . 2013-05-30 22:35        92160        ----a-w-        c:\windows\system32\SetIEInstalledDate.exe

2013-05-30 22:35 . 2013-05-30 22:35        905728        ----a-w-        c:\windows\system32\mshtmlmedia.dll

2013-05-30 22:35 . 2013-05-30 22:35        81408        ----a-w-        c:\windows\system32\icardie.dll

2013-05-30 22:35 . 2013-05-30 22:35        77312        ----a-w-        c:\windows\system32\tdc.ocx

2013-05-30 22:35 . 2013-05-30 22:35        762368        ----a-w-        c:\windows\system32\ieapfltr.dll

2013-05-30 22:35 . 2013-05-30 22:35        73728        ----a-w-        c:\windows\SysWow64\SetIEInstalledDate.exe

2013-05-30 22:35 . 2013-05-30 22:35        719360        ----a-w-        c:\windows\SysWow64\mshtmlmedia.dll

2013-05-30 22:35 . 2013-05-30 22:35        62976        ----a-w-        c:\windows\system32\pngfilt.dll

2013-05-30 22:35 . 2013-05-30 22:35        61952        ----a-w-        c:\windows\SysWow64\tdc.ocx

2013-05-30 22:35 . 2013-05-30 22:35        599552        ----a-w-        c:\windows\system32\vbscript.dll

2013-05-30 22:35 . 2013-05-30 22:35        523264        ----a-w-        c:\windows\SysWow64\vbscript.dll

2013-05-30 22:35 . 2013-05-30 22:35        52224        ----a-w-        c:\windows\system32\msfeedsbs.dll

2013-05-30 22:35 . 2013-05-30 22:35        51200        ----a-w-        c:\windows\system32\imgutil.dll

2013-05-30 22:35 . 2013-05-30 22:35        48640        ----a-w-        c:\windows\SysWow64\mshtmler.dll

2013-05-30 22:35 . 2013-05-30 22:35        48640        ----a-w-        c:\windows\system32\mshtmler.dll

2013-05-30 22:35 . 2013-05-30 22:35        452096        ----a-w-        c:\windows\system32\dxtmsft.dll

2013-05-30 22:35 . 2013-05-30 22:35        441856        ----a-w-        c:\windows\system32\html.iec

2013-05-30 22:35 . 2013-05-30 22:35        38400        ----a-w-        c:\windows\SysWow64\imgutil.dll

2013-05-30 22:35 . 2013-05-30 22:35        361984        ----a-w-        c:\windows\SysWow64\html.iec

2013-05-30 22:35 . 2013-05-30 22:35        281600        ----a-w-        c:\windows\system32\dxtrans.dll

2013-05-30 22:35 . 2013-05-30 22:35        27648        ----a-w-        c:\windows\system32\licmgr10.dll

2013-05-30 22:35 . 2013-05-30 22:35        270848        ----a-w-        c:\windows\system32\iedkcs32.dll

2013-05-30 22:35 . 2013-05-30 22:35        247296        ----a-w-        c:\windows\system32\webcheck.dll

2013-05-30 22:35 . 2013-05-30 22:35        235008        ----a-w-        c:\windows\system32\url.dll

2013-05-30 22:35 . 2013-05-30 22:35        23040        ----a-w-        c:\windows\SysWow64\licmgr10.dll

2013-05-30 22:35 . 2013-05-30 22:35        226304        ----a-w-        c:\windows\system32\elshyph.dll

2013-05-30 22:35 . 2013-05-30 22:35        216064        ----a-w-        c:\windows\system32\msls31.dll

2013-05-30 22:35 . 2013-05-30 22:35        197120        ----a-w-        c:\windows\system32\msrating.dll

2013-05-30 22:35 . 2013-05-30 22:35        185344        ----a-w-        c:\windows\SysWow64\elshyph.dll

2013-05-30 22:35 . 2013-05-30 22:35        173568        ----a-w-        c:\windows\system32\ieUnatt.exe

2013-05-30 22:35 . 2013-05-30 22:35        167424        ----a-w-        c:\windows\system32\iexpress.exe

2013-05-30 22:35 . 2013-05-30 22:35        158720        ----a-w-        c:\windows\SysWow64\msls31.dll

2013-05-30 22:35 . 2013-05-30 22:35        1509376        ----a-w-        c:\windows\system32\inetcpl.cpl

2013-05-30 22:35 . 2013-05-30 22:35        150528        ----a-w-        c:\windows\SysWow64\iexpress.exe

2013-05-30 22:35 . 2013-05-30 22:35        149504        ----a-w-        c:\windows\system32\occache.dll

2013-05-30 22:35 . 2013-05-30 22:35        144896        ----a-w-        c:\windows\system32\wextract.exe

2013-05-30 22:35 . 2013-05-30 22:35        1441280        ----a-w-        c:\windows\SysWow64\inetcpl.cpl

2013-05-30 22:35 . 2013-05-30 22:35        1400416        ----a-w-        c:\windows\system32\ieapfltr.dat

2013-05-30 22:35 . 2013-05-30 22:35        138752        ----a-w-        c:\windows\SysWow64\wextract.exe

2013-05-30 22:35 . 2013-05-30 22:35        13824        ----a-w-        c:\windows\system32\mshta.exe

2013-05-30 22:35 . 2013-05-30 22:35        137216        ----a-w-        c:\windows\SysWow64\ieUnatt.exe

2013-05-30 22:35 . 2013-05-30 22:35        136192        ----a-w-        c:\windows\system32\iepeers.dll

2013-05-30 22:35 . 2013-05-30 22:35        135680        ----a-w-        c:\windows\system32\IEAdvpack.dll

2013-05-30 22:35 . 2013-05-30 22:35        12800        ----a-w-        c:\windows\SysWow64\mshta.exe

2013-05-30 22:35 . 2013-05-30 22:35        12800        ----a-w-        c:\windows\system32\msfeedssync.exe

2013-05-30 22:35 . 2013-05-30 22:35        110592        ----a-w-        c:\windows\SysWow64\IEAdvpack.dll

2013-05-30 22:35 . 2013-05-30 22:35        102912        ----a-w-        c:\windows\system32\inseng.dll

2013-05-30 22:34 . 2013-05-30 22:34        9728        ---ha-w-        c:\windows\SysWow64\api-ms-win-downlevel-shlwapi-l1-1-0.dll

2013-05-30 22:34 . 2013-05-30 22:34        9728        ---ha-w-        c:\windows\system32\api-ms-win-downlevel-shlwapi-l1-1-0.dll

2013-05-30 22:34 . 2013-05-30 22:34        648192        ----a-w-        c:\windows\system32\d3d10level9.dll

2013-05-30 22:34 . 2013-05-30 22:34        604160        ----a-w-        c:\windows\SysWow64\d3d10level9.dll

2013-05-30 22:34 . 2013-05-30 22:34        5632        ---ha-w-        c:\windows\SysWow64\api-ms-win-downlevel-shlwapi-l2-1-0.dll

2013-05-30 22:34 . 2013-05-30 22:34        5632        ---ha-w-        c:\windows\SysWow64\api-ms-win-downlevel-ole32-l1-1-0.dll

2013-05-30 22:34 . 2013-05-30 22:34        5632        ---ha-w-        c:\windows\system32\api-ms-win-downlevel-shlwapi-l2-1-0.dll

2013-05-30 22:34 . 2013-05-30 22:34        5632        ---ha-w-        c:\windows\system32\api-ms-win-downlevel-ole32-l1-1-0.dll

2013-05-30 22:34 . 2013-05-30 22:34        522752        ----a-w-        c:\windows\system32\XpsGdiConverter.dll

2013-05-30 22:34 . 2013-05-30 22:34        465920        ----a-w-        c:\windows\system32\WMPhoto.dll

2013-05-30 22:34 . 2013-05-30 22:34        417792        ----a-w-        c:\windows\SysWow64\WMPhoto.dll

2013-05-30 22:34 . 2013-05-30 22:34        4096        ---ha-w-        c:\windows\SysWow64\api-ms-win-downlevel-user32-l1-1-0.dll

2013-05-30 22:34 . 2013-05-30 22:34        4096        ---ha-w-        c:\windows\system32\api-ms-win-downlevel-user32-l1-1-0.dll

2013-05-30 22:34 . 2013-05-30 22:34        3928064        ----a-w-        c:\windows\system32\d2d1.dll

2013-05-30 22:34 . 2013-05-30 22:34        364544        ----a-w-        c:\windows\SysWow64\XpsGdiConverter.dll

2013-05-30 22:34 . 2013-05-30 22:34        363008        ----a-w-        c:\windows\system32\dxgi.dll

2013-05-30 22:34 . 2013-05-30 22:34        3584        ---ha-w-        c:\windows\SysWow64\api-ms-win-downlevel-advapi32-l2-1-0.dll

2013-05-30 22:34 . 2013-05-30 22:34        3584        ---ha-w-        c:\windows\system32\api-ms-win-downlevel-advapi32-l2-1-0.dll

2013-05-30 22:34 . 2013-05-30 22:34        3419136        ----a-w-        c:\windows\SysWow64\d2d1.dll

2013-05-30 22:34 . 2013-05-30 22:34        333312        ----a-w-        c:\windows\system32\d3d10_1core.dll

2013-05-30 22:34 . 2013-05-30 22:34        3072        ---ha-w-        c:\windows\SysWow64\api-ms-win-downlevel-version-l1-1-0.dll

2013-05-30 22:34 . 2013-05-30 22:34        3072        ---ha-w-        c:\windows\SysWow64\api-ms-win-downlevel-shell32-l1-1-0.dll

2013-05-30 22:34 . 2013-05-30 22:34        3072        ---ha-w-        c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll

2013-05-30 22:34 . 2013-05-30 22:34        3072        ---ha-w-        c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll

2013-05-30 22:34 . 2013-05-30 22:34        296960        ----a-w-        c:\windows\system32\d3d10core.dll

2013-05-30 22:34 . 2013-05-30 22:34        293376        ----a-w-        c:\windows\SysWow64\dxgi.dll

2013-05-30 22:34 . 2013-05-30 22:34        2776576        ----a-w-        c:\windows\system32\msmpeg2vdec.dll

2013-05-30 22:34 . 2013-05-30 22:34        2565120        ----a-w-        c:\windows\system32\d3d10warp.dll

2013-05-30 22:34 . 2013-05-30 22:34        2560        ---ha-w-        c:\windows\SysWow64\api-ms-win-downlevel-normaliz-l1-1-0.dll

2013-05-30 22:34 . 2013-05-30 22:34        2560        ---ha-w-        c:\windows\system32\api-ms-win-downlevel-normaliz-l1-1-0.dll

2013-05-30 22:34 . 2013-05-30 22:34        249856        ----a-w-        c:\windows\SysWow64\d3d10_1core.dll

2013-05-30 22:34 . 2013-05-30 22:34        245248        ----a-w-        c:\windows\system32\WindowsCodecsExt.dll

2013-05-30 22:34 . 2013-05-30 22:34        2284544        ----a-w-        c:\windows\SysWow64\msmpeg2vdec.dll

2013-05-30 22:34 . 2013-05-30 22:34        221184        ----a-w-        c:\windows\system32\UIAnimation.dll

2013-05-30 22:34 . 2013-05-30 22:34        220160        ----a-w-        c:\windows\SysWow64\d3d10core.dll

2013-05-30 22:34 . 2013-05-30 22:34        207872        ----a-w-        c:\windows\SysWow64\WindowsCodecsExt.dll

2013-05-30 22:34 . 2013-05-30 22:34        1988096        ----a-w-        c:\windows\SysWow64\d3d10warp.dll

2013-05-30 22:34 . 2013-05-30 22:34        194560        ----a-w-        c:\windows\system32\d3d10_1.dll

2013-05-30 22:34 . 2013-05-30 22:34        187392        ----a-w-        c:\windows\SysWow64\UIAnimation.dll

2013-05-30 22:34 . 2013-05-30 22:34        1682432        ----a-w-        c:\windows\system32\XpsPrint.dll

2013-05-30 22:34 . 2013-05-30 22:34        161792        ----a-w-        c:\windows\SysWow64\d3d10_1.dll

2013-05-30 22:34 . 2013-05-30 22:34        1238528        ----a-w-        c:\windows\system32\d3d10.dll

2013-05-30 22:34 . 2013-05-30 22:34        1175552        ----a-w-        c:\windows\system32\FntCache.dll

2013-05-30 22:34 . 2013-05-30 22:34        1158144        ----a-w-        c:\windows\SysWow64\XpsPrint.dll

2013-05-30 22:34 . 2013-05-30 22:34        1080832        ----a-w-        c:\windows\SysWow64\d3d10.dll

2013-05-30 22:34 . 2013-05-30 22:34        10752        ---ha-w-        c:\windows\SysWow64\api-ms-win-downlevel-advapi32-l1-1-0.dll

2013-05-30 22:34 . 2013-05-30 22:34        10752        ---ha-w-        c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll

.

.

(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Note* empty entries & legit default entries are not shown 

REGEDIT4

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"DAEMON Tools Lite"="c:\program files (x86)\DAEMON Tools Lite\DTLite.exe" [2011-01-20 1305408]

"ManyCam"="c:\program files (x86)\ManyCam\Bin\ManyCam.exe" [2012-12-05 5379472]

"Skype"="c:\program files (x86)\Skype\Phone\Skype.exe" [2013-05-09 18618472]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]

"Nuance PDF Reader-reminder"="c:\program files (x86)\Nuance\PDF Reader\Ereg\Ereg.exe" [2008-11-03 328992]

"ASUSPRP"="c:\program files (x86)\ASUS\APRP\APRP.EXE" [2011-10-20 3331312]

"ASUSWebStorage"="c:\program files (x86)\ASUS\ASUS WebStorage\3.0.108.222\AsusWSPanel.exe" [2011-07-29 737104]

"SonicMasterTray"="c:\program files (x86)\ASUS\SonicMaster\SonicMasterTray.exe" [2010-07-10 984400]

"ATKOSD2"="c:\program files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe" [2010-08-17 5732992]

"ATKMEDIA"="c:\program files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe" [2010-10-07 170624]

"HControlUser"="c:\program files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe" [2009-06-19 105016]

"Wireless Console 3"="c:\program files (x86)\ASUS\Wireless Console 3\wcourier.exe" [2010-09-24 1601536]

"RemoteControl10"="c:\program files (x86)\Cyberlink\PowerDVD10\PDVD10Serv.exe" [2010-02-03 87336]

"BDRegion"="c:\program files (x86)\Cyberlink\Shared files\brs.exe" [2011-05-25 75048]

"UpdatePSTShortCut"="c:\program files (x86)\Cyberlink\DVD Suite\MUITransfer\MUIStartMenu.exe" [2010-11-24 222504]

"Korean IME Migration"="c:\progra~2\COMMON~1\MICROS~1\IME12\IMEKR\IMKRMIG.EXE" [2006-10-26 26400]

"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-04-04 958576]

"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2013-01-28 59720]

"HOfficeViewerUpdate"="c:\program files (x86)\HNC\HOfficeViewer80\HncUtils\HncViewerChecker.exe" [2012-10-23 1921648]

"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2012-07-03 252848]

"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2013-02-20 152392]

"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2012-10-24 421888]

.

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\

AsusVibeLauncher.lnk - c:\program files (x86)\ASUS\AsusVibe\AsusVibeLauncher.exe /start [2011-10-20 549040]

FancyStart daemon.lnk - c:\windows\Installer\{C944B4C5-1C4D-4D95-8AC0-7CEF13914131}\_77B5857C27147149171BE7.exe -d [2012-1-13 12862]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"ConsentPromptBehaviorAdmin"= 0 (0x0)

"ConsentPromptBehaviorUser"= 3 (0x3)

"EnableLUA"= 0 (0x0)

"EnableUIADesktopToggle"= 0 (0x0)

"PromptOnSecureDesktop"= 0 (0x0)

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]

"LoadAppInit_DLLs"=1 (0x1)

"AppInit_DLLs"=c:\windows\SysWOW64\nvinit.dll

.

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\keyboard layouts\e0200412]

   Ime File        REG_SZ                 IMKR12.IME

.

R2 CLKMSVC10_38F51D56;CyberLink Product - 2012/01/13 12:54;c:\program files (x86)\CyberLink\PowerDVD10\NavFilter\kmsvc.exe;c:\program files (x86)\CyberLink\PowerDVD10\NavFilter\kmsvc.exe [x]

R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]

R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]

R3 AmUStor;AM USB Stroage Driver;c:\windows\system32\drivers\AmUStor.SYS;c:\windows\SYSNATIVE\drivers\AmUStor.SYS [x]

R3 AthBTPort;Atheros Virtual Bluetooth Class;c:\windows\system32\DRIVERS\btath_flt.sys;c:\windows\SYSNATIVE\DRIVERS\btath_flt.sys [x]

R3 BTATH_A2DP;Bluetooth A2DP Audio Driver;c:\windows\system32\drivers\btath_a2dp.sys;c:\windows\SYSNATIVE\drivers\btath_a2dp.sys [x]

R3 BTATH_HCRP;Bluetooth HCRP Server driver;c:\windows\system32\DRIVERS\btath_hcrp.sys;c:\windows\SYSNATIVE\DRIVERS\btath_hcrp.sys [x]

R3 BTATH_LWFLT;Bluetooth LWFLT Device;c:\windows\system32\DRIVERS\btath_lwflt.sys;c:\windows\SYSNATIVE\DRIVERS\btath_lwflt.sys [x]

R3 BTATH_RCP;Bluetooth AVRCP Device;c:\windows\system32\DRIVERS\btath_rcp.sys;c:\windows\SYSNATIVE\DRIVERS\btath_rcp.sys [x]

R3 BtFilter;BtFilter;c:\windows\system32\DRIVERS\btfilter.sys;c:\windows\SYSNATIVE\DRIVERS\btfilter.sys [x]

R3 CdmDrvNt;CdmDrvNt;c:\windows\system32\Drivers\CdmDrvNt.sys;c:\windows\SYSNATIVE\Drivers\CdmDrvNt.sys [x]

R3 FirebirdServerMAGIXInstance;Firebird Server - MAGIX Instance;c:\program files (x86)\Common Files\MAGIX Services\Database\bin\fbserver.exe;c:\program files (x86)\Common Files\MAGIX Services\Database\bin\fbserver.exe [x]

R3 ISMgr;Image SAFER Process Managerment NT.;c:\windows\system32\ImageSAFERDrv64.sys;c:\windows\SYSNATIVE\ImageSAFERDrv64.sys [x]

R3 JRSKD24;JRSKD24;c:\windows\system32\JRSKD24.SYS;c:\windows\SYSNATIVE\JRSKD24.SYS [x]

R3 kcrtx64;kcrtx64;c:\windows\system32\kcrtx64.sys;c:\windows\SYSNATIVE\kcrtx64.sys [x]

R3 MfFWEnt;MfFWEnt;c:\program files\AhnLab\ASP\MyFirewall 4.0\MfFWEnt.sys;c:\program files\AhnLab\ASP\MyFirewall 4.0\MfFWEnt.sys [x]

R3 MfIPSEnt;MfIPSEnt;c:\program files\AhnLab\ASP\MyFirewall 4.0\MfIPSEnt.sys;c:\program files\AhnLab\ASP\MyFirewall 4.0\MfIPSEnt.sys [x]

R3 Mkd2Bthf;Mkd2Bthf;c:\windows\system32\drivers\Mkd2Bthf.sys;c:\windows\SYSNATIVE\drivers\Mkd2Bthf.sys [x]

R3 Mkd2Nadr;Mkd2Nadr;c:\windows\system32\drivers\Mkd2Nadr.sys;c:\windows\SYSNATIVE\drivers\Mkd2Nadr.sys [x]

R3 Mkd3kfNt;Mkd3kfNt;c:\windows\system32\drivers\Mkd3kfNt.sys;c:\windows\SYSNATIVE\drivers\Mkd3kfNt.sys [x]

R3 NPFW;NPFW;c:\windows\system32\NPFWVT64.sys;c:\windows\SYSNATIVE\NPFWVT64.sys [x]

R3 NPIDS;NPIDS;c:\windows\system32\NpIdsVt64.sys;c:\windows\SYSNATIVE\NpIdsVt64.sys [x]

R3 scsk5;SCSK5 Driver Service;syswow64\drivers\scsk5.sys;syswow64\drivers\scsk5.sys [x]

R3 SiSGbeLH;SiS191/SiS190 Ethernet Device NDIS 6.0 Driver;c:\windows\system32\DRIVERS\SiSG664.sys;c:\windows\SYSNATIVE\DRIVERS\SiSG664.sys [x]

R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]

R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys;c:\windows\SYSNATIVE\drivers\TsUsbGD.sys [x]

R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys;c:\windows\SYSNATIVE\Drivers\usbaapl64.sys [x]

R3 WatAdminSvc;Windows Á¤Ç° ÀÎÁõ ±â¼ú ¼*ºñ½º;c:\windows\system32\Wat\WatAdminSvc.exe;c:\windows\SYSNATIVE\Wat\WatAdminSvc.exe [x]

R3 x64kdss;x64kdss;syswow64\Drivers\x64kdss.sys;syswow64\Drivers\x64kdss.sys [x]

R3 xspirit;xspirit;c:\windows\xspirit.sys;c:\windows\xspirit.sys [x]

R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe;c:\program files\Windows Live\Mesh\wlcrasvc.exe [x]

S0 nvpciflt;nvpciflt;c:\windows\system32\DRIVERS\nvpciflt.sys;c:\windows\SYSNATIVE\DRIVERS\nvpciflt.sys [x]

S1 AMonTDLH;AMonTDLH;c:\windows\system32\Drivers\AMonTDLH.sys;c:\windows\SYSNATIVE\Drivers\AMonTDLH.sys [x]

S1 ATKWMIACPIIO;ATKWMIACPI Driver;c:\program files (x86)\ASUS\ATK Package\ATK WMIACPI\atkwmiacpi64.sys;c:\program files (x86)\ASUS\ATK Package\ATK WMIACPI\atkwmiacpi64.sys [x]

S1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys;c:\windows\SYSNATIVE\DRIVERS\dtsoftbus01.sys [x]

S2 AFBAgent;AFBAgent;c:\windows\system32\FBAgent.exe;c:\windows\SYSNATIVE\FBAgent.exe [x]

S2 ASMMAP64;ASMMAP64;c:\program files (x86)\ASUS\ATK Package\ATKGFNEX\ASMMAP64.sys;c:\program files (x86)\ASUS\ATK Package\ATKGFNEX\ASMMAP64.sys [x]

S2 ASUS InstantOn;ASUS InstantOn Service;c:\program files (x86)\Common Files\InstantOn\InsOnSrv.exe;c:\program files (x86)\Common Files\InstantOn\InsOnSrv.exe [x]

S2 Atheros Bt&Wlan Coex Agent;Atheros Bt&Wlan Coex Agent;c:\program files (x86)\Bluetooth Suite\Ath_CoexAgent.exe;c:\program files (x86)\Bluetooth Suite\Ath_CoexAgent.exe [x]

S2 AtherosSvc;AtherosSvc;c:\program files (x86)\Bluetooth Suite\adminservice.exe;c:\program files (x86)\Bluetooth Suite\adminservice.exe [x]

S2 Fabs;FABS - Helping agent for MAGIX media database;c:\program files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe;c:\program files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe [x]

S2 Image Protection;Image Protect Service;c:\windows\ImageSAFERSvc.exe;c:\windows\ImageSAFERSvc.exe [x]

S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [x]

S2 TurboB;Turbo Boost UI Monitor driver;c:\windows\system32\DRIVERS\TurboB.sys;c:\windows\SYSNATIVE\DRIVERS\TurboB.sys [x]

S2 TurboBoost;Intel(R) Turbo Boost Technology Monitor;c:\program files\Intel\TurboBoost\TurboBoost.exe;c:\program files\Intel\TurboBoost\TurboBoost.exe [x]

S2 UNS;Intel(R) Management and Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [x]

S3 AiCharger;ASUS Charger Driver;c:\windows\system32\DRIVERS\AiCharger.sys;c:\windows\SYSNATIVE\DRIVERS\AiCharger.sys [x]

S3 asmthub3;ASMedia USB3 Hub Service;c:\windows\system32\DRIVERS\asmthub3.sys;c:\windows\SYSNATIVE\DRIVERS\asmthub3.sys [x]

S3 asmtxhci;ASMEDIA XHCI Service;c:\windows\system32\DRIVERS\asmtxhci.sys;c:\windows\SYSNATIVE\DRIVERS\asmtxhci.sys [x]

S3 BTATH_BUS;Atheros Bluetooth Bus;c:\windows\system32\DRIVERS\btath_bus.sys;c:\windows\SYSNATIVE\DRIVERS\btath_bus.sys [x]

S3 L1C;NDIS Miniport Driver for Atheros AR813x/AR815x PCI-E Ethernet Controller;c:\windows\system32\DRIVERS\L1C62x64.sys;c:\windows\SYSNATIVE\DRIVERS\L1C62x64.sys [x]

S3 ManyCam;ManyCam Virtual Webcam;c:\windows\system32\DRIVERS\mcvidrv_x64.sys;c:\windows\SYSNATIVE\DRIVERS\mcvidrv_x64.sys [x]

S3 mcaudrv_simple;ManyCam Virtual Microphone;c:\windows\system32\drivers\mcaudrv_x64.sys;c:\windows\SYSNATIVE\drivers\mcaudrv_x64.sys [x]

.

.

--- Other Services/Drivers In Memory ---

.

*Deregistered* - CLKMDRV10_38F51D56

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]

2013-07-13 16:12        1173456        ----a-w-        c:\program files (x86)\Google\Chrome\Application\28.0.1500.72\Installer\chrmstp.exe

.

Contents of the 'Scheduled Tasks' folder

.

2013-07-14 c:\windows\Tasks\Adobe Flash Player Updater.job

- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-11-08 11:26]

.

2013-07-18 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2013-04-30 21:02]

.

2013-07-18 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2013-04-30 21:02]

.

.

--------- X64 Entries -----------

.

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\AsusWSShellExt_B]

@="{6D4133E5-0742-4ADC-8A8C-9303440F7190}"

[HKEY_CLASSES_ROOT\CLSID\{6D4133E5-0742-4ADC-8A8C-9303440F7190}]

2011-05-25 07:09        227840        ----a-w-        c:\program files (x86)\ASUS\ASUS WebStorage\3.0.108.222\AsusWSShellExt64.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\AsusWSShellExt_O]

@="{64174815-8D98-4CE6-8646-4C039977D808}"

[HKEY_CLASSES_ROOT\CLSID\{64174815-8D98-4CE6-8646-4C039977D808}]

2011-05-25 07:09        227840        ----a-w-        c:\program files (x86)\ASUS\ASUS WebStorage\3.0.108.222\AsusWSShellExt64.dll

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"IgfxTray"="c:\windows\system32\igfxtray.exe" [2011-06-01 168216]

"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2011-06-01 391960]

"Persistence"="c:\windows\system32\igfxpers.exe" [2011-06-01 419096]

"RtHDVBg"="c:\program files\Realtek\Audio\HDA\RAVBg64.exe" [2011-06-03 2226280]

"AmIcoSinglun64"="c:\program files (x86)\AmIcoSingLun\AmIcoSinglun64.exe" [2011-03-21 361984]

"AtherosBtStack"="c:\program files (x86)\Bluetooth Suite\BtvStack.exe" [2011-03-13 617120]

"AthBtTray"="c:\program files (x86)\Bluetooth Suite\AthBtTray.exe" [2011-03-13 379552]

"IntelTBRunOnce"="wscript.exe" [2009-07-14 168960]

"Korean IME Migration"="c:\progra~1\COMMON~1\MICROS~1\IME12\IMEKR\IMKRMIG.EXE" [2006-10-26 43808]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]

"AppInit_DLLs"=c:\windows\System32\nvinitx.dll

.

------- Supplementary Scan -------

.

uLocal Page = c:\windows\system32\blank.htm

uStart Page = hxxp://www.naver.com/

mLocal Page = c:\windows\SysWOW64\blank.htm

uInternet Settings,ProxyOverride = *.local

Trusted Zone: cattoeic.com

Trusted Zone: dacom.net

Trusted Zone: ebs.co.kr

Trusted Zone: ebsi.co.kr

Trusted Zone: ieside.com

Trusted Zone: lgdacom.net

Trusted Zone: uplus.co.kr

TCP: Interfaces\{E37772B4-157C-4517-89B2-5D00E6016D8B}: NameServer = 10.156.33.53,129.187.5.1

Handler: cup - {A0BE0236-AB5A-45DC-A304-2269CE96708E} - c:\windows\SysWOW64\AILogix\CUXLMon.dll

Handler: dup - {A0BE0236-AB5A-45DC-A304-2269CE96708E} - c:\windows\SysWOW64\AILogix\CUXLMon.dll

DPF: {00001026-A15C-11D4-97A4-0050BF0FBE67} - hxxp://download.netmarble.net/web/nmstarter/NMStarter26_20120305.cab

DPF: {1219B6C3-CD4D-4243-9A4F-4C9F12FCC6E7} - hxxps://ck.softforum.co.kr/CKKeyPro/yessign/CKKeyProInst.cab

DPF: {20BBA18F-5BC8-47B5-8FC9-5DFCA8E56A4B} - hxxps://mpi.dacom.net/XMPI/js/LGUplus_XMPI_20110503.cab

DPF: {24F6E6A8-852C-45A8-ADD3-C4AB0D6FD231} - hxxp://plugin.inicis.com/wallet61/INIwallet61_vista.cab

DPF: {2587A1BE-8046-4FC3-A957-C489945110E1} - hxxp://pgdownload.uplus.co.kr/dacom/IssacWebProCMS_4_3_1_3_LG_UPLUS.cab

DPF: {286A75C3-11FB-4FB4-AC4A-4DD1B0750050} - hxxps://accesscontrol.citibank.co.kr/acsapp/initech/plugin/down/INIS60.cab

DPF: {29A84C9B-9AC0-4A18-B0D7-60571B0E88CE} - hxxps://www.11st.co.kr/ocx/SKSCmaker.cab

DPF: {29C82122-1980-4DE2-BC79-08497A6574DA} - hxxp://ebookcase.genomad.co.kr/download/general/commerce_media_client(v1.4.3.3).cab

DPF: {2DCB00FB-3485-486B-BD41-C49AD605264D} - hxxp://update.spaceinter.com/easykeytec/bin/easykeytec.cab

DPF: {48ECCD73-123C-4C25-A64C-76E8E8A30CAF} - hxxps://mpi.dacom.net/XPayMPI/XPayMPI.cab

DPF: {4CAA1AB3-3448-4FE9-8B42-D8E2BC070083} - hxxp://appdown.naver.com/naver/cassiod/cab/NVLauncher.cab

DPF: {51B1D5ED-67DC-43F0-A3F8-8502F1A5E404} - hxxp://update.nprotect.net/nprotect2007/shinhancard/npstarter_070716.cab

DPF: {53863B9E-F97C-4789-B9EA-64D9F9623837} - hxxp://www.cencloud.com/_app_/CenCloudWebCtrlX.cab

DPF: {55D9860A-AB9C-44A1-BB74-75AF7F805333} - hxxps://uni.webminwon.com/wm1.0/pki/download/TSToolkit.cab

DPF: {5C1B293E-DA77-4AFF-8B52-63DEF8C8A071} - hxxp://download.netmarble.net/ActiveX/NMAutoUpdateX/NMAutoUpdateX_1.0.1.1_20091109.cab

DPF: {7E9FDB80-5316-11D4-B02C-00C04F0CD404} - hxxps://vbv.shinhancard.com/XecureObject/xw_install.cab

DPF: {89F434A7-4A49-4394-AC02-007480331AE2} - hxxp://download.netmarble.net/ActiveX/NMAutoUpdateX/SystemIDInfo/NMSystemIDInfo_1.0.0.1.cab

DPF: {8DC067B8-911D-473A-90F1-1171B887CDE0} - hxxp://cyimg8.cyworld.com/ImageUpload/CyPictureU1233.cab?20081124

DPF: {92E82FBB-DA00-41E0-ABFE-95482E21A4F6} - hxxp://download.netmarble.net/NMChatX/NMTransX.cab

DPF: {9963FACF-7618-417B-B6DD-AB8B65AF8CD1} - hxxp://pgdownload.uplus.co.kr/lgdacom/LGDacomXPayUpdater.cab

DPF: {99C709C7-4F58-46C1-855B-90213C760395} - hxxps://v3d.kcp.co.kr/file/kcp_ansimclick.cab

DPF: {A4508A45-F1C4-40F3-99B4-0CA08AC77E3B} - hxxp://download.netmarble.net/kdefence/100929/kdfense8.cab

DPF: {B0A75875-3622-48BA-B5FF-45AD77AC2D0E} - hxxps://www.bankpay.or.kr/BankPayEFT.cab

DPF: {B3E4F985-F780-4CC8-ADC7-9ABF07DFC12D} - hxxp://www.hidisk.com/mmsv/HidiskWebControl.CAB

DPF: {B70EA6F1-4C66-4F85-AB4D-CB3B1EB1A341} - hxxp://img.shinhan.com/shttp/sphone/1108/INISAFECertClientv1.cab

DPF: {C1143E84-B2B1-473B-9F20-E62DD754FCAF} - hxxps://vbv.shinhancard.com/infovine/VineTransfer.cab

DPF: {C342F4EE-6D48-4239-A55D-CF2D0D1F3BC6} - hxxp://cyimg7.cyworld.com/cymusic/package/skcaset.cab

DPF: {C5742545-35C9-4081-AF92-2329A3739C6D} - hxxp://csatscorecard.kice.re.kr/RexServer30/cab/MAOnFPS_KICERex.cab

DPF: {D23BF791-F408-4AFC-A76A-DAF51141112A} - hxxp://www.cattoeic.com/esls/cabsetup/eSLSWeb3.cab

DPF: {E42F7FEB-DE20-43F4-A342-47F1DA77F667} - hxxps://pgdownload.uplus.co.kr/lguplus/XPayPlugin_3.0.0.1.cab

DPF: {E78928A6-3D2A-4BF7-A100-F3FBAA351B49} - hxxps://www.vpay.co.kr/kvpfiles_new/KVPISPCTLD_VISTA64.cab

DPF: {F4F2AFFA-0BAD-4E2E-A35F-4B5D55A81E6F} - hxxps://pgweb.dacom.net/WEB_SERVER/wmp/mertadmin/escrow/DPayEscrow.cab

DPF: {F939FEB8-9518-4A4A-BE60-D10FFB9557F2} - hxxp://update.nprotect.net/netizenv55/card/shinhan/npenkIEInstall5.cab

DPF: {FB7E9222-12FC-421E-B6F9-23F6A001C523} - hxxp://ebookcase.genomad.co.kr/download/general/launcher/2,0,0,22/ezPDFLaunch2.cab

DPF: {FC035099-833E-4AB1-BF48-37D08F5E553C} - hxxp://csatscorecard.kice.re.kr/RexServer30/cab/Rexpert30ViewerEXE.cab

DPF: {FE342FC7-4374-4EBE-86DB-D73AE861F779} - hxxp://file.naver.com/activex/NaverAXGuide.cab

.

- - - - ORPHANS REMOVED - - - -

.

BHO-{39AA03A6-B5D9-4F47-99DF-1666A7B8D8E8} - c:\program files (x86)\NATEON\BIN\NateSearchSafe.dll

Toolbar-Locked - (no file)

Wow6432Node-HKCU-Run-RESTART_STICKY_NOTES - c:\windows\System32\StikyNot.exe

Wow6432Node-HKLM-Run-WinPro - c:\program files (x86)\WinPro\WinPro.exe

Wow6432Node-HKLM-Run-IETab - c:\program files (x86)\IETab\IETab.exe

HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start

Toolbar-Locked - (no file)

WebBrowser-{37483B40-C254-4A72-BDA4-22EE90182C1E} - (no file)

HKLM-Run-SynTPEnh - c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe

HKLM-Run-SynAsusAcpi - c:\program files (x86)\Synaptics\SynTP\SynAsusAcpi.exe

AddRemove-INFovine - c:\windows\system32\UbiKeyUninstall.exe

AddRemove-kdefense - c:\windows\system32\uninstallkdf8.exe

AddRemove-SoftcampSCSK - c:\windows\system32\UnSCSK.exe

AddRemove-UnINISafeWeb7 - c:\windows\system32\UnINIS70.exe

AddRemove-XecureCK - c:\windows\system32\CKSetup32.exe

.

.

.

--------------------- LOCKED REGISTRY KEYS ---------------------

.

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_7_700_224_ActiveX.exe,-101"

.

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]

"Enabled"=dword:00000001

.

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]

@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_7_700_224_ActiveX.exe"

.

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="IFlashBroker5"

.

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_7_700_224_ActiveX.exe,-101"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]

"Enabled"=dword:00000001

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_7_700_224_ActiveX.exe"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Shockwave Flash Object"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_224.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]

@="0"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]

@="ShockwaveFlash.ShockwaveFlash.11"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_224.ocx, 1"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="ShockwaveFlash.ShockwaveFlash"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Macromedia Flash Factory Object"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_224.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]

@="FlashFactory.FlashFactory.1"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_224.ocx, 1"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="FlashFactory.FlashFactory"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="IFlashBroker5"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]

@Denied: (Full) (Everyone)

.

------------------------ Other Running Processes ------------------------

.

c:\program files (x86)\ASUS\ATK Package\ATK Hotkey\ASLDRSrv.exe

c:\program files (x86)\ASUS\SmartLogon\smartlogon.exe

c:\program files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe

c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

c:\program files (x86)\Common Files\InstantOn\InsOnWMI.exe

c:\program files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exe

c:\program files (x86)\ASUS\USBChargerPlus\USBChargerPlus.exe

c:\program files (x86)\ASUS\SmartLogon\sensorsrv.exe

c:\program files (x86)\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe

c:\program files (x86)\CyberLink\Shared files\RichVideo.exe

c:\program files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe

c:\program files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe

.

**************************************************************************

.

Completion time: 2013-07-18  02:53:29 - machine was rebooted

ComboFix-quarantined-files.txt  2013-07-18 00:53

.

Pre-Run: 169,692,487,680 ¹ÙÀÌÆ® ³²À½

Post-Run: 169,632,305,152 ¹ÙÀÌÆ® ³²À½

.

- - End Of File - - E28A80D876B6752F40EBDEDD76E77984

D41D8CD98F00B204E9800998ECF8427E