UsbFix

############################## | UsbFix V 7.137 | [Research]

User: NTB HP (Administrator) # NTBHP-PC
Updated 18/09/2013 by El Desaparecido - Team SosVirus
Started at 18:38:36 | 19/09/2013

Website: http://www.usbfix.net/
Forum : http://www.sosvirus.net/
Upload Malware: http://www.sosvirus.net/upload_malware.php
Contact: http://www.usbfix.net/contact/

PC: Hewlett-Packard (HP 635 Notebook PC ) (X86-based PC)
CPU: AMD E-350 Processor (1600)
RAM -> [Total : 1643 | Free : 179]
BIOS: InsydeH2O Version CCB.03.61.11F.34
BOOT: Normal boot

OS: Microsoft Windows 7 Ultimate (6.1.7600 32-Bit) #
WB: Windows Internet Explorer 9.0.8112.16421

SC: Security Center Service [Enabled]
WU: Windows Update Service [Enabled]
AV: AVG Internet Security 2014 [Enabled | Updated]
FW: Windows FireWall Service [Enabled]

C:\ (%systemdrive%) -> Fixed drive # 298 Gb (229 Mb free - 77%) [] # NTFS
D:\ -> CD-ROM
E:\ -> Fixed drive # 466 Gb (184 Mb free - 40%) [IMATION HDD] # FAT32

################## | Active Processes |

C:\PROGRA~1\AVG\AVG2014\avgrsx.exe (376)
C:\Windows\system32\csrss.exe (452)
C:\Windows\system32\wininit.exe (532)
C:\Windows\system32\csrss.exe (540)
C:\Windows\system32\services.exe (588)
C:\Windows\system32\lsass.exe (604)
C:\Windows\system32\lsm.exe (612)
C:\Windows\system32\winlogon.exe (644)
C:\Windows\system32\svchost.exe (764)
C:\Windows\system32\svchost.exe (840)
C:\Windows\system32\atiesrxx.exe (884)
C:\Windows\System32\svchost.exe (960)
C:\Windows\System32\svchost.exe (1000)
C:\Windows\system32\svchost.exe (1052)
C:\Windows\system32\svchost.exe (1204)
C:\Windows\system32\atieclxx.exe (1260)
C:\Windows\system32\svchost.exe (1348)
C:\Windows\System32\spoolsv.exe (1544)
C:\Windows\system32\svchost.exe (1624)
C:\Windows\system32\Dwm.exe (1696)
C:\Windows\system32\taskhost.exe (1712)
C:\Windows\Explorer.EXE (1720)
C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe (1912)
C:\Program Files\Realtek\Audio\HDA\AERTSrv.exe (1976)
c:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe (2000)
C:\Program Files\Bluetooth Suite\Ath_CoexAgent.exe (2036)
C:\Program Files\Realtek\Audio\HDA\RtkNGUI.exe (356)
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe (368)
C:\Program Files\Bluetooth Suite\BtvStack.exe (440)
C:\Program Files\Bluetooth Suite\adminservice.exe (528)
C:\Program Files\AVG\AVG2014\avgui.exe (608)
C:\Program Files\Bluetooth Suite\AthBtTray.exe (1228)
C:\Program Files\AVG\AVG2014\avgfws.exe (1612)
C:\Program Files\Common Files\Java\Java Update\jusched.exe (1616)
C:\Program Files\Skype\Phone\Skype.exe (856)
C:\Program Files\AVG\AVG2014\avgidsagent.exe (2060)
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe (2156)
C:\Program Files\AVG\AVG2014\avgwdsvc.exe (2196)
C:\Windows\system32\taskeng.exe (2456)
C:\Program Files\Garmin\Core Update Service\Garmin.Cartography.MapUpdate.CoreService.exe (2476)
C:\Program Files\AVG\AVG2014\avgcsrvx.exe (3076)
C:\Windows\system32\svchost.exe (3332)
C:\Program Files\Realtek\Realtek PCIE Card Reader\RIconMan.exe (3360)
C:\Program Files\Common Files\LightScribe\LSSrvc.exe (3396)
C:\Windows\System32\svchost.exe (3440)
C:\Windows\System32\svchost.exe (3484)
C:\Program Files\RealNetworks\RealDownloader\rndlresolversvc.exe (3540)
C:\Program Files\Microsoft Application Virtualization Client\sftvsa.exe (3768)
C:\Windows\system32\svchost.exe (3832)
C:\Program Files\LemurLeap\updateLemurLeap.exe (3864)
C:\Program Files\CyberLink\YouCam\YCMMirage.exe (2168)
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE (700)
C:\Program Files\Microsoft Application Virtualization Client\sftlist.exe (2852)
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe (2820)
C:\Program Files\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE (2416)
C:\Windows\system32\svchost.exe (4320)
C:\Windows\system32\svchost.exe (4580)
c:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe (4764)
C:\PROGRAM FILES\SYNAPTICS\SYNTP\SYNTPHELPER.EXE (4940)
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe (5016)
C:\Program Files\Windows Media Player\wmpnetwk.exe (5056)
C:\Windows\system32\svchost.exe (5236)
C:\Program Files\AVG\AVG2014\avgnsx.exe (5592)
C:\Program Files\AVG\AVG2014\avgemcx.exe (5652)
C:\Program Files\AVG\AVG2014\avgcsrvx.exe (5948)
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe (5972)
C:\Program Files\HP\Digital Imaging\bin\hpqbam08.exe (6104)
C:\Program Files\HP\Digital Imaging\bin\hpqgpc01.exe (4744)
C:\Windows\system32\SearchIndexer.exe (5308)
C:\Windows\System32\svchost.exe (4708)
C:\Windows\system32\DllHost.exe (5040)
C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe (2212)
C:\Program Files\Nero\Update\NASvc.exe (3672)
C:\Windows\helppane.exe (1972)
C:\Program Files\AVG\AVG2014\avgcsrvx.exe (4808)
C:\Program Files\Mozilla Firefox\firefox.exe (5480)
C:\Windows\system32\taskeng.exe (2668)
C:\Program Files\CCleaner\CCleaner.exe (4380)
C:\Program Files\Mozilla Firefox\plugin-container.exe (6460)
C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_9_900_96.exe (7676)
C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_9_900_96.exe (7684)
C:\UsbFix\Go.exe (5544)
C:\Windows\system32\wbem\wmiprvse.exe (6508)
C:\UsbFix\Go.exe (8056)

################## | El Desaparecido Section |

HKLM\SOFTWARE | Run : [StartCCC] - "c:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
HKLM\SOFTWARE | Run : [RTHDVCPL] - C:\Program Files\Realtek\Audio\HDA\RtkNGUI.exe -s
HKLM\SOFTWARE | Run : [SynTPEnh] - %ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe
HKLM\SOFTWARE | Run : [] -
HKLM\SOFTWARE | Run : [APSDaemon] - "C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe"
HKLM\SOFTWARE | Run : [AtherosBtStack] - "C:\Program Files\Bluetooth Suite\BtvStack.exe"
HKLM\SOFTWARE | Run : [AVG_UI] - "C:\Program Files\AVG\AVG2014\avgui.exe" /TRAYONLY
HKLM\SOFTWARE | Run : [Adobe ARM] - "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
HKLM\SOFTWARE | Run : [AthBtTray] - "C:\Program Files\Bluetooth Suite\AthBtTray.exe"
HKLM\SOFTWARE | Run : [SunJavaUpdateSched] - "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
HKLM\SOFTWARE | RunOnce : [] -
HKU\S-1-5-19\SOFTWARE | Run : [Sidebar] - %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun
HKU\S-1-5-20\SOFTWARE | Run : [Sidebar] - %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun
HKU\S-1-5-21-3243819653-3838960596-2158971354-1000\SOFTWARE | Run : [Google Update] - "C:\Users\NTB HP\AppData\Local\Google\Update\GoogleUpdate.exe" /c
HKU\S-1-5-21-3243819653-3838960596-2158971354-1000\SOFTWARE | Run : [Skype] - "C:\Program Files\Skype\Phone\Skype.exe" /minimized /regrun
HKU\S-1-5-21-3243819653-3838960596-2158971354-1000\SOFTWARE | Run : [Facebook Update] - "C:\Users\NTB HP\AppData\Local\Facebook\Update\FacebookUpdate.exe" /c /nocrashserver
HKU\S-1-5-21-3243819653-3838960596-2158971354-1000\SOFTWARE | Run : [FileHippo.com] - "C:\Program Files\FileHippo.com\UpdateChecker.exe" /background
HKU\S-1-5-19\SOFTWARE | RunOnce : [mctadmin] - C:\Windows\System32\mctadmin.exe
HKU\S-1-5-20\SOFTWARE | RunOnce : [mctadmin] - C:\Windows\System32\mctadmin.exe

################## | Files # Infected Folders |

Found ! E:\Thumbs.db
Found ! E:\winamp_metadata.dat

################## | Registry |


################## | Mountpoints2 |



################## | Vaccin |

(!) This computer is not vaccinated!

################## | E.O.F | http://www.usbfix.net - http://www.sosvirus.net |