Jump to content

Arnab

Members
 View Profile  See their activity

  • Posts

    15

  • Joined

  • Last visited

 Content Type 

Posts posted by Arnab

    Trojan Agent svchost.exe

    in Resolved Malware Removal Logs

    Posted

    # AdwCleaner v2.104 - Logfile created 01/03/2013 at 23:32:40

    # Updated 29/12/2012 by Xplode

    # Operating system : Windows 7 Home Premium Service Pack 1 (64 bits)

    # User : Arnab - ARNAB-HP

    # Boot Mode : Normal

    # Running from : C:\Users\Arnab\Downloads\adwcleaner.exe

    # Option [Delete]

    ***** [services] *****

    ***** [Files / Folders] *****

    File Deleted : C:\Users\Arnab\AppData\Roaming\Mozilla\Firefox\Profiles\66yxquzi.default\searchplugins\Askcom.xml

    Folder Deleted : C:\Program Files (x86)\Ask.com

    Folder Deleted : C:\Program Files (x86)\Conduit

    Folder Deleted : C:\Program Files (x86)\Perion

    Folder Deleted : C:\ProgramData\Ask

    Folder Deleted : C:\ProgramData\InstallMate

    Folder Deleted : C:\ProgramData\Premium

    Folder Deleted : C:\Users\Arnab\AppData\Local\APN

    Folder Deleted : C:\Users\Arnab\AppData\Local\Conduit

    Folder Deleted : C:\Users\Arnab\AppData\LocalLow\Conduit

    Folder Deleted : C:\Users\Arnab\AppData\Roaming\OpenCandy

    ***** [Registry] *****

    Key Deleted : HKCU\Software\AppDataLow\Software\SmartBar

    Key Deleted : HKCU\Software\Conduit

    Key Deleted : HKCU\Software\Softonic

    Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{2FA28606-DE77-4029-AF96-B231E3B8F827}

    Key Deleted : HKLM\Software\Conduit

    Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{3C471948-F874-49F5-B338-4F214A2EE0B1}

    Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{2FA28606-DE77-4029-AF96-B231E3B8F827}

    Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{2FA28606-DE77-4029-AF96-B231E3B8F827}

    ***** [internet Browsers] *****

    -\\ Internet Explorer v9.0.8112.16457

    [OK] Registry is clean.

    -\\ Mozilla Firefox v17.0.1 (en-US)

    File : C:\Users\Arnab\AppData\Roaming\Mozilla\Firefox\Profiles\66yxquzi.default\prefs.js

    Deleted : user_pref("browser.search.selectedEngine", "Ask.com");

    Deleted : user_pref("browser.search.order.1", "Ask.com");

    -\\ Google Chrome v23.0.1271.97

    File : C:\Users\Arnab\AppData\Local\Google\Chrome\User Data\Default\Preferences

    Deleted [l.46] : icon_url = "hxxp://www.ask.com/favicon.ico",

    Deleted [l.49] : keyword = "ask.com",

    Deleted [l.52] : search_url = "hxxp://websearch.ask.com/redirect?client=cr&src=kw&tb=ORJ&o=&locale=&apn_uid=73[...]

    Deleted [l.53] : suggest_url = "hxxp://ss.websearch.ask.com/query?qsrc=2922&li=ff&sstype=prefix&q={searchTerms[...]

    *************************

    AdwCleaner[R1].txt - [2071 octets] - [02/01/2013 15:27:04]

    AdwCleaner[R2].txt - [2857 octets] - [03/01/2013 23:32:17]

    AdwCleaner[s1].txt - [2564 octets] - [03/01/2013 23:32:40]

    ########## EOF - C:\AdwCleaner[s1].txt - [2624 octets] ##########

    Trojan Agent svchost.exe

    in Resolved Malware Removal Logs

    Posted

    <p>eset scan found this : </p>

    <p> </p>

    <div>C:\Users\All Users\Spybot - Search & Destroy\Recovery\SmitfraudCgeneric.zip<span class="Apple-tab-span" style="white-space:pre"> </span>Win32/Bagle.gen.zip worm<span class="Apple-tab-span" style="white-space:pre"> </span>unable to clean</div>

    <div>C:\ProgramData\Spybot - Search & Destroy\Recovery\SmitfraudCgeneric.zip<span class="Apple-tab-span" style="white-space:pre"> </span>Win32/Bagle.gen.zip worm<span class="Apple-tab-span" style="white-space:pre"> </span>cleaned by deleting - quarantined</div>

    <div> </div>

    Trojan Agent svchost.exe

    in Resolved Malware Removal Logs

    Posted

    <p> </p>

    <div> Results of screen317's Security Check version 0.99.56  </div>

    <div> Windows 7 Service Pack 1 x64 (UAC is enabled)  </div>

    <div> Internet Explorer 9  </div>

    <div>``````````````Antivirus/Firewall Check:`````````````` </div>

    <div> Windows Firewall Enabled!  </div>

    <div>Microsoft Security Essentials   </div>

    <div> Antivirus up to date!  </div>

    <div>`````````Anti-malware/Other Utilities Check:````````` </div>

    <div> Spybot - Search & Destroy </div>

    <div> Malwarebytes Anti-Malware version 1.70.0.1100  </div>

    <div> Java 6 Update 31  </div>

    <div> Java 7 Update 6  </div>

    <div> Java version out of Date! </div>

    <div> Adobe Flash Player 11.5.502.135  </div>

    <div> Adobe Reader 10.1.4 Adobe Reader out of Date!  </div>

    <div> Mozilla Firefox (17.0.1) </div>

    <div> Google Chrome 23.0.1271.97  </div>

    <div>````````Process Check: objlist.exe by Laurent````````  </div>

    <div> Microsoft Security Essentials MSMpEng.exe </div>

    <div> Microsoft Security Essentials msseces.exe </div>

    <div> Malwarebytes Anti-Malware mbamservice.exe  </div>

    <div> Malwarebytes Anti-Malware mbamgui.exe  </div>

    <div> ESET ESET Online Scanner OnlineScannerApp.exe  </div>

    <div> ESET ESET Online Scanner OnlineCmdLineScanner.exe  </div>

    <div> Malwarebytes' Anti-Malware mbamscheduler.exe   </div>

    <div>`````````````````System Health check````````````````` </div>

    <div> Total Fragmentation on Drive C: 7% </div>

    <div>````````````````````End of Log`````````````````````` </div>

    <div> </div>

    Trojan Agent svchost.exe

    in Resolved Malware Removal Logs

    Posted

    # AdwCleaner v2.104 - Logfile created 01/02/2013 at 15:27:04

    # Updated 29/12/2012 by Xplode

    # Operating system : Windows 7 Home Premium Service Pack 1 (64 bits)

    # User : Arnab - ARNAB-HP

    # Boot Mode : Normal

    # Running from : C:\Users\Arnab\Downloads\adwcleaner.exe

    # Option [search]

    ***** [services] *****

    ***** [Files / Folders] *****

    Folder Found : C:\Program Files (x86)\Conduit

    Folder Found : C:\Program Files (x86)\Perion

    Folder Found : C:\ProgramData\InstallMate

    Folder Found : C:\ProgramData\Premium

    Folder Found : C:\Users\Arnab\AppData\Local\APN

    Folder Found : C:\Users\Arnab\AppData\Local\Conduit

    Folder Found : C:\Users\Arnab\AppData\LocalLow\Conduit

    Folder Found : C:\Users\Arnab\AppData\Roaming\OpenCandy

    ***** [Registry] *****

    Key Found : HKCU\Software\AppDataLow\Software\SmartBar

    Key Found : HKCU\Software\Conduit

    Key Found : HKCU\Software\Softonic

    Key Found : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{2FA28606-DE77-4029-AF96-B231E3B8F827}

    Key Found : HKLM\Software\Conduit

    Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{3C471948-F874-49F5-B338-4F214A2EE0B1}

    Key Found : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{2FA28606-DE77-4029-AF96-B231E3B8F827}

    Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{2FA28606-DE77-4029-AF96-B231E3B8F827}

    Key Found : HKU\S-1-5-21-4260002731-4005127750-2452240090-1000\Software\Microsoft\Internet Explorer\SearchScopes\{2FA28606-DE77-4029-AF96-B231E3B8F827}

    ***** [internet Browsers] *****

    -\\ Internet Explorer v9.0.8112.16457

    [OK] Registry is clean.

    -\\ Mozilla Firefox v17.0.1 (en-US)

    File : C:\Users\Arnab\AppData\Roaming\Mozilla\Firefox\Profiles\66yxquzi.default\prefs.js

    [OK] File is clean.

    -\\ Google Chrome v23.0.1271.97

    File : C:\Users\Arnab\AppData\Local\Google\Chrome\User Data\Default\Preferences

    [OK] File is clean.

    *************************

    AdwCleaner[R1].txt - [1946 octets] - [02/01/2013 15:27:04]

    ########## EOF - C:\AdwCleaner[R1].txt - [2006 octets] ##########

    Trojan Agent svchost.exe

    in Resolved Malware Removal Logs

    Posted

    DDS (Ver_2012-11-20.01) - NTFS_AMD64

    Internet Explorer: 9.0.8112.16457 BrowserJavaVersion: 10.6.2

    Run by Arnab at 17:37:49 on 2012-12-25

    Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.6092.4347 [GMT -5:00]

    .

    AV: Microsoft Security Essentials *Enabled/Updated* {B140BF4E-23BB-4198-90AB-A51A4C60A69C}

    SP: Microsoft Security Essentials *Enabled/Updated* {0A215EAA-0581-4E16-AA1B-9E6837E7EC21}

    SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

    .

    ============== Running Processes ===============

    .

    C:\Windows\system32\lsm.exe

    C:\Windows\system32\svchost.exe -k DcomLaunch

    C:\Program Files (x86)\HP SimplePass 2011\TrueSuiteService.exe

    C:\Windows\system32\svchost.exe -k RPCSS

    c:\Program Files\Microsoft Security Client\MsMpEng.exe

    C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted

    C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted

    C:\Windows\system32\svchost.exe -k netsvcs

    C:\Program Files\IDT\WDM\STacSV64.exe

    C:\Windows\system32\svchost.exe -k LocalService

    C:\Windows\system32\Hpservice.exe

    C:\Windows\System32\WUDFHost.exe

    C:\Windows\System32\WUDFHost.exe

    C:\Windows\system32\svchost.exe -k NetworkService

    C:\Windows\System32\spoolsv.exe

    C:\Windows\system32\svchost.exe -k WbioSvcGroup

    C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork

    C:\Program Files\IDT\WDM\AESTSr64.exe

    C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe

    C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

    C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe

    C:\Program Files\Hewlett-Packard\HP Client Services\HPClientServices.exe

    C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe

    C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe

    C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe

    C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe

    C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe

    C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe

    C:\Windows\system32\taskhost.exe

    C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe

    C:\Windows\system32\Dwm.exe

    c:\Program Files\Microsoft Security Client\NisSrv.exe

    C:\Program Files (x86)\HP SimplePass 2011\TouchControl.exe

    C:\Windows\Explorer.EXE

    C:\Program Files (x86)\HP SimplePass 2011\BioMonitor.exe

    C:\Windows\system32\wbem\wmiprvse.exe

    C:\Windows\system32\wbem\unsecapp.exe

    C:\Program Files\Apoint2K\Apoint.exe

    C:\Windows\System32\hkcmd.exe

    C:\Windows\System32\igfxpers.exe

    C:\Program Files\IDT\WDM\sttray64.exe

    C:\Program Files\Microsoft Security Client\msseces.exe

    C:\Program Files\HP\HP Deskjet 3510 series\Bin\ScanToPCActivationApp.exe

    C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe

    C:\Users\Arnab\AppData\Roaming\Dropbox\bin\Dropbox.exe

    C:\Windows\system32\RunDll32.exe

    C:\Program Files\Apoint2K\ApMsgFwd.exe

    C:\Program Files\HP\HP Deskjet 3510 series\Bin\HPNetworkCommunicatorCom.exe

    C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe

    C:\Program Files (x86)\Hewlett-Packard\HP CoolSense\CoolSense.exe

    C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe

    C:\Program Files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe

    C:\Program Files\Apoint2K\Apntex.exe

    C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe

    C:\Windows\system32\SearchIndexer.exe

    C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe

    C:\Windows\system32\taskeng.exe

    C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe

    C:\Program Files\HP\HP Deskjet 3510 series\Bin\HPNetworkCommunicator.exe

    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

    C:\Windows\system32\NOTEPAD.EXE

    C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe

    C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe

    C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe

    C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe

    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

    c:\Program Files\Microsoft Security Client\MpCmdRun.exe

    c:\Program Files\Microsoft Security Client\MpCmdRun.exe

    C:\Windows\system32\SearchProtocolHost.exe

    C:\Windows\system32\SearchFilterHost.exe

    C:\Windows\system32\AUDIODG.EXE

    C:\Windows\system32\wbem\wmiprvse.exe

    C:\Windows\System32\cscript.exe

    .

    ============== Pseudo HJT Report ===============

    .

    uStart Page = hxxps://www.google.com/

    uURLSearchHooks: {49c795c2-604a-4d18-aeb1-b3eba27e5ea2} - <orphaned>

    BHO: {02478D38-C3F9-4efb-9B51-7695ECA05670} - <orphaned>

    BHO: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

    BHO: Spybot-S&D IE Protection: {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files (x86)\Spybot - Search & Destroy\SDHelper.dll

    BHO: Groove GFS Browser Helper: {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll

    BHO: Java Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll

    BHO: TrueSuite Website Log On: {8590886E-EC8C-43C1-A32C-E4C2B0B6395B} - C:\Program Files (x86)\HP SimplePass 2011\IEBHO.dll

    BHO: Skype Browser Helper: {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll

    BHO: Java Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll

    BHO: HP Network Check Helper: {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll

    uRun: [HP Deskjet 3510 series (NET)] "C:\Program Files\HP\HP Deskjet 3510 series\Bin\ScanToPCActivationApp.exe" -deviceID "CN28G181KZ05R7:NW" -scfn "HP Deskjet 3510 series (NET)" -AutoStart 1

    uRun: [spybotSD TeaTimer] C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe

    mRun: [iAStorIcon] C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe

    mRun: [HP CoolSense] C:\Program Files (x86)\Hewlett-Packard\HP CoolSense\CoolSense.exe -byrunkey

    mRun: [GrooveMonitor] "C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe"

    mRun: [HP Quick Launch] C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe

    mRun: [HPOSD] C:\Program Files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe

    mRun: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

    mRun: [HP Software Update] C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe

    StartupFolder: C:\Users\Arnab\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Dropbox.lnk - C:\Users\Arnab\AppData\Roaming\Dropbox\bin\Dropbox.exe

    StartupFolder: C:\Users\Arnab\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\MONITO~2.LNK - C:\Windows\System32\RunDll32.exe

    uPolicies-Explorer: NoDriveTypeAutoRun = dword:145

    uPolicies-Explorer: NoDrives = dword:0

    mPolicies-Explorer: NoDrives = dword:0

    mPolicies-System: ConsentPromptBehaviorAdmin = dword:5

    mPolicies-System: ConsentPromptBehaviorUser = dword:3

    mPolicies-System: EnableUIADesktopToggle = dword:0

    IE: E&xport to Microsoft Excel - C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000

    IE: {22CC3EBD-C286-43aa-B8E6-06B115F74162} - C:\Program Files (x86)\Hewlett-Packard\SmartPrint\smartprintsetup.exe

    IE: {25510184-5A38-4A99-B273-DCA8EEF6CD08} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\NCLauncherFromIE.exe

    IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\Program Files (x86)\Microsoft Office\Office12\ONBttnIE.dll

    IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll

    IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503}

    IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files (x86)\Spybot - Search & Destroy\SDHelper.dll

    .

    INFO: HKCU has more than 50 listed domains.

    If you wish to scan all of them, select the 'Force scan all domains' option.

    .

    .

    INFO: HKLM has more than 50 listed domains.

    If you wish to scan all of them, select the 'Force scan all domains' option.

    .

    DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab

    DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab

    DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab

    TCP: NameServer = 192.168.1.1

    TCP: Interfaces\{BA7A31F7-966C-4E0D-A6B4-151C9D8FE2E5} : DHCPNameServer = 192.168.1.1

    TCP: Interfaces\{BA7A31F7-966C-4E0D-A6B4-151C9D8FE2E5}\E416478616C696560274E2 : DHCPNameServer = 172.26.38.1 172.26.38.2

    Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveSystemServices.dll

    Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll

    Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll

    SSODL: WebCheck - <orphaned>

    SEH: Groove GFS Stub Execution Hook - {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll

    x64-BHO: TrueSuite Website Log On: {8590886E-EC8C-43C1-A32C-E4C2B0B6395B} - C:\Program Files (x86)\HP SimplePass 2011\x64\IEBHO.dll

    x64-BHO: Skype add-on for Internet Explorer: {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll

    x64-BHO: {DBC80044-A445-435b-BC74-9C25C1C588A9} - <orphaned>

    x64-Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe

    x64-Run: [igfxTray] C:\Windows\System32\igfxtray.exe

    x64-Run: [HotKeysCmds] C:\Windows\System32\hkcmd.exe

    x64-Run: [Persistence] C:\Windows\System32\igfxpers.exe

    x64-Run: [sysTrayApp] C:\Program Files\IDT\WDM\sttray64.exe

    x64-Run: [MSC] "c:\Program Files\Microsoft Security Client\msseces.exe" -hide -runkey

    x64-IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll

    .

    INFO: x64-HKLM has more than 50 listed domains.

    If you wish to scan all of them, select the 'Force scan all domains' option.

    .

    x64-Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - <orphaned>

    x64-Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll

    x64-Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - <orphaned>

    x64-Notify: igfxcui - igfxdev.dll

    x64-SSODL: WebCheck - <orphaned>

    .

    ================= FIREFOX ===================

    .

    FF - ProfilePath - C:\Users\Arnab\AppData\Roaming\Mozilla\Firefox\Profiles\66yxquzi.default\

    FF - ExtSQL: 2012-12-18 11:18; {635abd67-4fe9-1b23-4f01-e679fa7484c1}; C:\Users\Arnab\AppData\Roaming\Mozilla\Firefox\Profiles\66yxquzi.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}

    FF - ExtSQL: 2012-12-19 09:36; websitelogon@truesuite.com; C:\Program Files (x86)\Mozilla Firefox\extensions\websitelogon@truesuite.com

    .

    ============= SERVICES / DRIVERS ===============

    .

    R0 MpFilter;Microsoft Malware Protection Driver;C:\Windows\System32\drivers\MpFilter.sys [2012-8-30 228768]

    R2 AESTFilters;Andrea ST Filters Service;C:\Program Files\IDT\WDM\AESTSr64.exe [2011-12-5 89600]

    R2 AMPPALR3;Intel® Centrino® Bluetooth 3.0 + High Speed Service;C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe [2011-4-21 1136640]

    R2 BTHSSecurityMgr;Intel® Centrino® Wireless Bluetooth® 3.0 + High Speed Security Service;C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe [2011-4-21 134928]

    R2 FPLService;TrueSuiteService;C:\Program Files (x86)\HP SimplePass 2011\TrueSuiteService.exe [2011-8-25 260424]

    R2 HP Support Assistant Service;HP Support Assistant Service;C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSA_Service.exe [2012-9-27 86528]

    R2 HPClientSvc;HP Client Services;C:\Program Files\Hewlett-Packard\HP Client Services\HPClientServices.exe [2010-10-11 346168]

    R2 HPDrvMntSvc.exe;HP Quick Synchronization Service;C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe [2012-8-10 197536]

    R2 hpsrv;HP Service;C:\Windows\System32\hpservice.exe [2011-5-27 30520]

    R2 HPWMISVC;HPWMISVC;C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe [2011-7-11 26680]

    R2 IAStorDataMgrSvc;Intel® Rapid Storage Technology;C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe [2011-11-21 13592]

    R2 IconMan_R;IconMan_R;C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe [2011-11-21 2375168]

    R2 MBAMScheduler;MBAMScheduler;C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [2012-12-2 399432]

    R2 MBAMService;MBAMService;C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2012-12-2 676936]

    R2 NisDrv;Microsoft Network Inspection System;C:\Windows\System32\drivers\NisDrvWFP.sys [2012-8-30 128456]

    R2 Skype C2C Service;Skype C2C Service;C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe [2012-12-13 3290896]

    R2 UNS;Intel® Management and Security Application User Notification Service;C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe [2011-11-21 2656280]

    R3 AMPPAL;Intel® Centrino® Bluetooth 3.0 + High Speed Virtual Adapter;C:\Windows\System32\drivers\AmpPal.sys [2011-4-21 294912]

    R3 clwvd;CyberLink WebCam Virtual Driver;C:\Windows\System32\drivers\clwvd.sys [2010-7-28 31088]

    R3 IntcDAud;Intel® Display Audio;C:\Windows\System32\drivers\IntcDAud.sys [2010-10-15 317440]

    R3 L1C;NDIS Miniport Driver for Atheros AR813x/AR815x PCI-E Ethernet Controller;C:\Windows\System32\drivers\L1C62x64.sys [2011-12-5 77936]

    R3 MBAMProtector;MBAMProtector;C:\Windows\System32\drivers\mbam.sys [2012-12-2 25928]

    R3 NisSrv;Microsoft Network Inspection;C:\Program Files\Microsoft Security Client\NisSrv.exe [2012-9-12 368896]

    R3 USBAAPL64;Apple Mobile USB Driver;C:\Windows\System32\drivers\usbaapl64.sys [2012-7-9 52736]

    R3 wdkmd;Intel WiDi KMD;C:\Windows\System32\drivers\WDKMD.sys [2011-2-16 42392]

    S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]

    S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]

    S2 SkypeUpdate;Skype Updater;C:\Program Files (x86)\Skype\Updater\Updater.exe [2012-7-13 160944]

    S3 AMPPALP;Intel® Centrino® Bluetooth 3.0 + High Speed Protocol;C:\Windows\System32\drivers\AmpPal.sys [2011-4-21 294912]

    S3 cpudrv64;cpudrv64;C:\Program Files (x86)\SystemRequirementsLab\cpudrv64.sys [2011-6-2 17864]

    S3 GamesAppService;GamesAppService;C:\Program Files (x86)\WildTangent Games\App\GamesAppService.exe [2010-10-12 206072]

    S3 RSPCIESTOR;Realtek PCIE CardReader Driver;C:\Windows\System32\drivers\RtsPStor.sys [2011-11-21 335464]

    S3 SrvHsfHDA;SrvHsfHDA;C:\Windows\System32\drivers\VSTAZL6.SYS [2009-7-13 292864]

    S3 SrvHsfV92;SrvHsfV92;C:\Windows\System32\drivers\VSTDPV6.SYS [2009-7-13 1485312]

    S3 SrvHsfWinac;SrvHsfWinac;C:\Windows\System32\drivers\VSTCNXT6.SYS [2009-7-13 740864]

    S3 TsUsbFlt;TsUsbFlt;C:\Windows\System32\drivers\TsUsbFlt.sys [2010-11-20 59392]

    S3 TsUsbGD;Remote Desktop Generic USB Device;C:\Windows\System32\drivers\TsUsbGD.sys [2010-11-20 31232]

    S3 WatAdminSvc;Windows Activation Technologies Service;C:\Windows\System32\Wat\WatAdminSvc.exe [2011-11-25 1255736]

    S3 WinRing0_1_2_0;WinRing0_1_2_0;C:\Program Files (x86)\Razer\Razer Game Booster\Driver\WinRing0x64.sys [2012-11-13 14544]

    S4 SBSDWSCService;SBSD Security Center Service;C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe [2012-9-30 1153368]

    .

    =============== Created Last 30 ================

    .

    2012-12-25 22:16:46 -------- d-sh--w- C:\$RECYCLE.BIN

    2012-12-25 22:03:26 98816 ----a-w- C:\Windows\sed.exe

    2012-12-25 22:03:26 256000 ----a-w- C:\Windows\PEV.exe

    2012-12-25 22:03:26 208896 ----a-w- C:\Windows\MBR.exe

    2012-12-25 22:03:20 -------- d-----w- C:\ComboFix

    2012-12-24 21:28:46 9125352 ----a-w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{CB26CFD9-FE44-43DB-8A8C-43526E077895}\mpengine.dll

    2012-12-23 21:17:47 9125352 ----a-w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll

    2012-12-21 04:00:30 46080 ----a-w- C:\Windows\System32\atmlib.dll

    2012-12-21 04:00:30 34304 ----a-w- C:\Windows\SysWow64\atmlib.dll

    2012-12-21 04:00:29 367616 ----a-w- C:\Windows\System32\atmfd.dll

    2012-12-21 04:00:28 295424 ----a-w- C:\Windows\SysWow64\atmfd.dll

    2012-12-19 14:36:32 1671680 ----a-w- C:\Program Files (x86)\Mozilla Firefox\extensions\websitelogon@truesuite.com\components\FFXPCOM3.dll

    2012-12-19 14:36:32 1669120 ----a-w- C:\Program Files (x86)\Mozilla Firefox\extensions\websitelogon@truesuite.com\components\FFXPCOM6.dll

    2012-12-19 14:36:32 1668608 ----a-w- C:\Program Files (x86)\Mozilla Firefox\extensions\websitelogon@truesuite.com\components\FFXPCOM5.dll

    2012-12-19 14:36:32 1668608 ----a-w- C:\Program Files (x86)\Mozilla Firefox\extensions\websitelogon@truesuite.com\components\FFXPCOM4.dll

    2012-12-19 14:36:32 1667072 ----a-w- C:\Program Files (x86)\Mozilla Firefox\extensions\websitelogon@truesuite.com\components\FFXPCOM7.dll

    2012-12-18 22:20:38 -------- d-----w- C:\Users\Arnab\AppData\Local\Macromedia

    2012-12-18 17:50:05 15728568 ----a-w- C:\Windows\SysWow64\FlashPlayerInstaller.exe

    2012-12-18 16:18:28 -------- d-----w- C:\Users\Arnab\AppData\Local\Mozilla

    2012-12-18 16:17:30 -------- d-----w- C:\Program Files (x86)\Mozilla Maintenance Service

    2012-12-15 00:26:57 -------- d-----w- C:\Program Files (x86)\GUM2B8A.tmp

    2012-12-13 04:14:40 -------- d-----w- C:\ProgramData\regid.1986-12.com.adobe

    2012-12-13 03:19:18 -------- d-----w- C:\Users\Arnab\AppData\Local\Torch

    2012-12-13 02:29:26 478208 ----a-w- C:\Windows\System32\dpnet.dll

    2012-12-13 02:28:52 2048 ----a-w- C:\Windows\SysWow64\tzres.dll

    2012-12-13 02:28:52 2048 ----a-w- C:\Windows\System32\tzres.dll

    2012-12-08 00:43:53 -------- d-----w- C:\Program Files (x86)\Common Files\Symantec Shared

    2012-12-06 15:48:31 -------- d-----w- C:\Program Files\CCleaner

    2012-12-06 10:57:11 -------- d-----w- C:\Windows\Microsoft Antimalware

    2012-12-06 07:31:17 -------- d-----w- C:\03c9ed3c08a3a4c322169d90

    2012-12-06 03:28:30 -------- d-----w- C:\Program Files (x86)\Trojan SVCHOSTRemoval Tool

    2012-12-04 17:32:08 -------- d-----w- C:\Users\Arnab\AppData\Roaming\DriverCure

    2012-12-04 17:32:07 -------- d-----w- C:\Users\Arnab\AppData\Roaming\SpeedyPC Software

    2012-12-04 17:31:56 -------- d-----w- C:\ProgramData\SpeedyPC Software

    2012-12-03 02:36:27 25928 ----a-w- C:\Windows\System32\drivers\mbam.sys

    2012-12-03 02:36:27 -------- d-----w- C:\Program Files (x86)\Malwarebytes' Anti-Malware

    2012-12-01 08:38:36 -------- d-sh--w- C:\Windows\System32\%APPDATA%

    2012-12-01 01:53:32 -------- d-----w- C:\Users\Arnab\AppData\Local\Razer

    2012-11-28 14:16:58 972264 ------w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{66ED165E-E99E-45FF-8E69-FC51D714B953}\gapaengine.dll

    .

    ==================== Find3M ====================

    .

    2012-12-18 17:50:39 73656 ----a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl

    2012-12-18 17:50:39 697272 ----a-w- C:\Windows\SysWow64\FlashPlayerApp.exe

    2012-11-22 03:26:40 3149824 ----a-w- C:\Windows\System32\win32k.sys

    2012-11-14 06:11:44 2312704 ----a-w- C:\Windows\System32\jscript9.dll

    2012-11-14 06:04:11 1392128 ----a-w- C:\Windows\System32\wininet.dll

    2012-11-14 06:02:49 1494528 ----a-w- C:\Windows\System32\inetcpl.cpl

    2012-11-14 05:57:46 599040 ----a-w- C:\Windows\System32\vbscript.dll

    2012-11-14 05:57:35 173056 ----a-w- C:\Windows\System32\ieUnatt.exe

    2012-11-14 05:52:40 2382848 ----a-w- C:\Windows\System32\mshtml.tlb

    2012-11-14 02:09:22 1800704 ----a-w- C:\Windows\SysWow64\jscript9.dll

    2012-11-14 01:58:15 1427968 ----a-w- C:\Windows\SysWow64\inetcpl.cpl

    2012-11-14 01:57:37 1129472 ----a-w- C:\Windows\SysWow64\wininet.dll

    2012-11-14 01:49:25 142848 ----a-w- C:\Windows\SysWow64\ieUnatt.exe

    2012-11-14 01:48:27 420864 ----a-w- C:\Windows\SysWow64\vbscript.dll

    2012-11-14 01:44:42 2382848 ----a-w- C:\Windows\SysWow64\mshtml.tlb

    2012-11-02 05:11:31 376832 ----a-w- C:\Windows\SysWow64\dpnet.dll

    2012-10-16 08:38:37 135168 ----a-w- C:\Windows\apppatch\AppPatch64\AcXtrnal.dll

    2012-10-16 08:38:34 350208 ----a-w- C:\Windows\apppatch\AppPatch64\AcLayers.dll

    2012-10-16 07:39:52 561664 ----a-w- C:\Windows\apppatch\AcLayers.dll

    2012-10-09 18:17:13 55296 ----a-w- C:\Windows\System32\dhcpcsvc6.dll

    2012-10-09 18:17:13 226816 ----a-w- C:\Windows\System32\dhcpcore6.dll

    2012-10-09 17:40:31 44032 ----a-w- C:\Windows\SysWow64\dhcpcsvc6.dll

    2012-10-09 17:40:31 193536 ----a-w- C:\Windows\SysWow64\dhcpcore6.dll

    2012-10-04 17:46:16 362496 ----a-w- C:\Windows\System32\wow64win.dll

    2012-10-04 17:46:15 243200 ----a-w- C:\Windows\System32\wow64.dll

    2012-10-04 17:46:15 13312 ----a-w- C:\Windows\System32\wow64cpu.dll

    2012-10-04 17:45:55 215040 ----a-w- C:\Windows\System32\winsrv.dll

    2012-10-04 17:43:28 16384 ----a-w- C:\Windows\System32\ntvdm64.dll

    2012-10-04 17:41:16 424960 ----a-w- C:\Windows\System32\KernelBase.dll

    2012-10-04 16:47:41 5120 ----a-w- C:\Windows\SysWow64\wow32.dll

    2012-10-04 16:47:41 274944 ----a-w- C:\Windows\SysWow64\KernelBase.dll

    2012-10-04 15:21:55 338432 ----a-w- C:\Windows\System32\conhost.exe

    2012-10-04 14:46:46 7680 ----a-w- C:\Windows\SysWow64\instnm.exe

    2012-10-04 14:46:46 25600 ----a-w- C:\Windows\SysWow64\setup16.exe

    2012-10-04 14:46:44 14336 ----a-w- C:\Windows\SysWow64\ntvdm64.dll

    2012-10-04 14:46:43 2048 ----a-w- C:\Windows\SysWow64\user.exe

    2012-10-04 14:41:50 6144 ---ha-w- C:\Windows\SysWow64\api-ms-win-security-base-l1-1-0.dll

    2012-10-04 14:41:50 4608 ---ha-w- C:\Windows\SysWow64\api-ms-win-core-threadpool-l1-1-0.dll

    2012-10-04 14:41:50 3584 ---ha-w- C:\Windows\SysWow64\api-ms-win-core-xstate-l1-1-0.dll

    2012-10-04 14:41:50 3072 ---ha-w- C:\Windows\SysWow64\api-ms-win-core-util-l1-1-0.dll

    2012-10-03 17:56:54 1914248 ----a-w- C:\Windows\System32\drivers\tcpip.sys

    2012-10-03 17:44:21 70656 ----a-w- C:\Windows\System32\nlaapi.dll

    2012-10-03 17:44:21 303104 ----a-w- C:\Windows\System32\nlasvc.dll

    2012-10-03 17:44:17 246272 ----a-w- C:\Windows\System32\netcorehc.dll

    2012-10-03 17:44:17 18944 ----a-w- C:\Windows\System32\netevent.dll

    2012-10-03 17:44:16 216576 ----a-w- C:\Windows\System32\ncsi.dll

    2012-10-03 17:42:16 569344 ----a-w- C:\Windows\System32\iphlpsvc.dll

    2012-10-03 16:42:24 18944 ----a-w- C:\Windows\SysWow64\netevent.dll

    2012-10-03 16:42:24 175104 ----a-w- C:\Windows\SysWow64\netcorehc.dll

    2012-10-03 16:42:23 156672 ----a-w- C:\Windows\SysWow64\ncsi.dll

    2012-10-03 16:07:26 45568 ----a-w- C:\Windows\System32\drivers\tcpipreg.sys

    .

    ============= FINISH: 17:38:43.74 ===============

    Please let me know if its safe to uninstall combofix and thanks for all your help

    Trojan Agent svchost.exe

    in Resolved Malware Removal Logs

    Posted

    ComboFix 12-12-25.02 - Arnab 12/25/2012 17:06:33.1.4 - x64

    Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.6092.4395 [GMT -5:00]

    Running from: c:\users\Arnab\Downloads\ComboFix.exe

    AV: Microsoft Security Essentials *Enabled/Updated* {B140BF4E-23BB-4198-90AB-A51A4C60A69C}

    SP: Microsoft Security Essentials *Enabled/Updated* {0A215EAA-0581-4E16-AA1B-9E6837E7EC21}

    SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

    .

    .

    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

    .

    .

    C:\install.exe

    c:\programdata\34C

    c:\programdata\34C\{BF498E51-B3AA-4D5D-B974-D45B08976EFC}.swf

    c:\programdata\Microsoft\Windows\DRM\8D57.tmp

    c:\programdata\Microsoft\Windows\DRM\8D67.tmp

    c:\programdata\Roaming

    c:\users\Arnab\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Monitor Ink Alerts - .lnk

    c:\users\Arnab\GoToAssistDownloadHelper.exe

    c:\windows\SysWow64\C

    .

    .

    ((((((((((((((((((((((((( Files Created from 2012-11-25 to 2012-12-25 )))))))))))))))))))))))))))))))

    .

    .

    2012-12-24 21:28 . 2012-11-08 17:24 9125352 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{CB26CFD9-FE44-43DB-8A8C-43526E077895}\mpengine.dll

    2012-12-23 21:17 . 2012-11-08 17:24 9125352 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll

    2012-12-21 04:00 . 2012-12-16 17:11 46080 ----a-w- c:\windows\system32\atmlib.dll

    2012-12-21 04:00 . 2012-12-16 14:13 34304 ----a-w- c:\windows\SysWow64\atmlib.dll

    2012-12-21 04:00 . 2012-12-16 14:45 367616 ----a-w- c:\windows\system32\atmfd.dll

    2012-12-21 04:00 . 2012-12-16 14:13 295424 ----a-w- c:\windows\SysWow64\atmfd.dll

    2012-12-18 22:20 . 2012-12-18 22:20 -------- d-----w- c:\users\Arnab\AppData\Local\Macromedia

    2012-12-18 17:50 . 2012-12-18 17:50 15728568 ----a-w- c:\windows\SysWow64\FlashPlayerInstaller.exe

    2012-12-18 16:18 . 2012-12-18 16:18 -------- d-----w- c:\users\Arnab\AppData\Local\Mozilla

    2012-12-18 16:17 . 2012-12-19 14:36 -------- d-----w- c:\program files (x86)\Mozilla Maintenance Service

    2012-12-15 00:26 . 2012-12-15 00:27 -------- d-----w- c:\program files (x86)\GUM2B8A.tmp

    2012-12-13 04:14 . 2012-12-13 04:14 -------- d-----w- c:\programdata\regid.1986-12.com.adobe

    2012-12-13 03:19 . 2012-12-13 03:21 -------- d-----w- c:\users\Arnab\AppData\Local\Torch

    2012-12-13 02:29 . 2012-11-02 05:59 478208 ----a-w- c:\windows\system32\dpnet.dll

    2012-12-13 02:28 . 2012-11-09 05:45 2048 ----a-w- c:\windows\system32\tzres.dll

    2012-12-13 02:28 . 2012-11-09 04:42 2048 ----a-w- c:\windows\SysWow64\tzres.dll

    2012-12-08 00:43 . 2012-12-08 00:58 -------- d-----w- c:\program files (x86)\Common Files\Symantec Shared

    2012-12-06 15:48 . 2012-12-06 15:48 -------- d-----w- c:\program files\CCleaner

    2012-12-06 10:57 . 2012-12-06 10:57 -------- d-----w- c:\windows\Microsoft Antimalware

    2012-12-06 07:31 . 2012-12-06 07:31 -------- d-----w- C:\03c9ed3c08a3a4c322169d90

    2012-12-06 03:28 . 2012-12-06 03:57 -------- d-----w- c:\program files (x86)\Trojan SVCHOSTRemoval Tool

    2012-12-04 17:32 . 2012-12-04 17:32 -------- d-----w- c:\users\Arnab\AppData\Roaming\DriverCure

    2012-12-04 17:32 . 2012-12-04 17:32 -------- d-----w- c:\users\Arnab\AppData\Roaming\SpeedyPC Software

    2012-12-04 17:31 . 2012-12-04 18:09 -------- d-----w- c:\programdata\SpeedyPC Software

    2012-12-03 02:44 . 2012-12-15 00:27 -------- d-----w- c:\program files (x86)\Google

    2012-12-03 02:36 . 2012-12-03 02:36 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware

    2012-12-03 02:36 . 2012-09-30 00:54 25928 ----a-w- c:\windows\system32\drivers\mbam.sys

    2012-12-01 08:38 . 2012-12-01 08:38 -------- d-sh--w- c:\windows\system32\%APPDATA%

    2012-12-01 01:53 . 2012-12-01 01:53 -------- d-----w- c:\users\Arnab\AppData\Local\Razer

    2012-12-01 01:53 . 2012-12-01 01:53 -------- d-----w- c:\programdata\Razer

    2012-12-01 01:53 . 2012-12-01 01:53 -------- d-----w- c:\program files (x86)\Razer

    2012-11-28 14:16 . 2012-11-28 14:16 972264 ------w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{66ED165E-E99E-45FF-8E69-FC51D714B953}\gapaengine.dll

    .

    .

    .

    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

    .

    2012-12-18 17:50 . 2012-05-18 02:57 697272 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe

    2012-12-18 17:50 . 2011-11-25 02:08 73656 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl

    2012-12-13 02:34 . 2011-11-26 16:48 67413224 ----a-w- c:\windows\system32\MRT.exe

    2012-10-16 08:38 . 2012-11-29 19:32 135168 ----a-w- c:\windows\apppatch\AppPatch64\AcXtrnal.dll

    2012-10-16 08:38 . 2012-11-29 19:32 350208 ----a-w- c:\windows\apppatch\AppPatch64\AcLayers.dll

    2012-10-16 07:39 . 2012-11-29 19:32 561664 ----a-w- c:\windows\apppatch\AcLayers.dll

    2012-10-09 18:17 . 2012-11-14 19:11 55296 ----a-w- c:\windows\system32\dhcpcsvc6.dll

    2012-10-09 18:17 . 2012-11-14 19:11 226816 ----a-w- c:\windows\system32\dhcpcore6.dll

    2012-10-09 17:40 . 2012-11-14 19:11 193536 ----a-w- c:\windows\SysWow64\dhcpcore6.dll

    2012-10-09 17:40 . 2012-11-14 19:11 44032 ----a-w- c:\windows\SysWow64\dhcpcsvc6.dll

    2012-10-04 16:40 . 2012-12-13 02:29 44032 ----a-w- c:\windows\apppatch\acwow64.dll

    2012-10-03 17:56 . 2012-11-14 19:11 1914248 ----a-w- c:\windows\system32\drivers\tcpip.sys

    2012-10-03 17:44 . 2012-11-14 19:11 303104 ----a-w- c:\windows\system32\nlasvc.dll

    2012-10-03 17:44 . 2012-11-14 19:11 70656 ----a-w- c:\windows\system32\nlaapi.dll

    2012-10-03 17:44 . 2012-11-14 19:11 246272 ----a-w- c:\windows\system32\netcorehc.dll

    2012-10-03 17:44 . 2012-11-14 19:11 18944 ----a-w- c:\windows\system32\netevent.dll

    2012-10-03 17:44 . 2012-11-14 19:11 216576 ----a-w- c:\windows\system32\ncsi.dll

    2012-10-03 17:42 . 2012-11-14 19:11 569344 ----a-w- c:\windows\system32\iphlpsvc.dll

    2012-10-03 16:42 . 2012-11-14 19:11 175104 ----a-w- c:\windows\SysWow64\netcorehc.dll

    2012-10-03 16:42 . 2012-11-14 19:11 18944 ----a-w- c:\windows\SysWow64\netevent.dll

    2012-10-03 16:42 . 2012-11-14 19:11 156672 ----a-w- c:\windows\SysWow64\ncsi.dll

    2012-10-03 16:07 . 2012-11-14 19:11 45568 ----a-w- c:\windows\system32\drivers\tcpipreg.sys

    2012-09-30 18:03 . 2012-10-05 15:56 972192 ------w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\NISBackup\gapaengine.dll

    .

    .

    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

    .

    .

    *Note* empty entries & legit default entries are not shown

    REGEDIT4

    .

    [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]

    @="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"

    [HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]

    2012-02-14 22:58 94208 ----a-w- c:\users\Arnab\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll

    .

    [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]

    @="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"

    [HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]

    2012-02-14 22:58 94208 ----a-w- c:\users\Arnab\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll

    .

    [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]

    @="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"

    [HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]

    2012-02-14 22:58 94208 ----a-w- c:\users\Arnab\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll

    .

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

    "HP Deskjet 3510 series (NET)"="c:\program files\HP\HP Deskjet 3510 series\Bin\ScanToPCActivationApp.exe" [2012-05-08 2552168]

    "SpybotSD TeaTimer"="c:\program files (x86)\Spybot - Search & Destroy\TeaTimer.exe" [2009-01-26 2144088]

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]

    "IAStorIcon"="c:\program files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe" [2011-04-30 284440]

    "HP CoolSense"="c:\program files (x86)\Hewlett-Packard\HP CoolSense\CoolSense.exe" [2011-08-26 1342008]

    "GrooveMonitor"="c:\program files (x86)\Microsoft Office\Office12\GrooveMonitor.exe" [2009-02-26 30040]

    "HP Quick Launch"="c:\program files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe" [2011-07-11 574008]

    "HPOSD"="c:\program files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe" [2011-08-19 379960]

    "Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-03 919008]

    "HP Software Update"="c:\program files (x86)\Hp\HP Software Update\HPWuSchd2.exe" [2011-10-28 49208]

    .

    c:\users\Arnab\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\

    Dropbox.lnk - c:\users\Arnab\AppData\Roaming\Dropbox\bin\Dropbox.exe [2012-5-24 27112840]

    Monitor Ink Alerts - HP Deskjet 3510 series (Network).lnk - c:\windows\system32\RunDll32.exe [2009-7-13 45568]

    .

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

    "ConsentPromptBehaviorAdmin"= 5 (0x5)

    "ConsentPromptBehaviorUser"= 3 (0x3)

    "EnableUIADesktopToggle"= 0 (0x0)

    .

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]

    @=""

    .

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]

    @="Service"

    .

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]

    @="Driver"

    .

    R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]

    R2 HP Support Assistant Service;HP Support Assistant Service;c:\program files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe [2012-09-27 86528]

    R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe [2012-07-13 160944]

    R3 AMPPALP;Intel® Centrino® Bluetooth 3.0 + High Speed Protocol;c:\windows\system32\DRIVERS\amppal.sys [2011-04-21 294912]

    R3 cpudrv64;cpudrv64;c:\program files (x86)\SystemRequirementsLab\cpudrv64.sys [2011-06-02 17864]

    R3 dc3d;MS Hardware Device Detection Driver;c:\windows\system32\DRIVERS\dc3d.sys [2011-05-18 47616]

    R3 GamesAppService;GamesAppService;c:\program files (x86)\WildTangent Games\App\GamesAppService.exe [2010-10-12 206072]

    R3 RSPCIESTOR;Realtek PCIE CardReader Driver;c:\windows\system32\DRIVERS\RtsPStor.sys [2011-02-15 335464]

    R3 SrvHsfHDA;SrvHsfHDA;c:\windows\system32\DRIVERS\VSTAZL6.SYS [2009-06-10 292864]

    R3 SrvHsfV92;SrvHsfV92;c:\windows\system32\DRIVERS\VSTDPV6.SYS [2009-06-10 1485312]

    R3 SrvHsfWinac;SrvHsfWinac;c:\windows\system32\DRIVERS\VSTCNXT6.SYS [2009-06-10 740864]

    R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-21 59392]

    R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [2010-11-21 31232]

    R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2011-11-25 1255736]

    R3 WinRing0_1_2_0;WinRing0_1_2_0;c:\program files (x86)\Razer\Razer Game Booster\Driver\WinRing0x64.sys [2012-11-14 14544]

    R4 SBSDWSCService;SBSD Security Center Service;c:\program files (x86)\Spybot - Search & Destroy\SDWinSec.exe [2009-01-26 1153368]

    S2 AESTFilters;Andrea ST Filters Service;c:\program files\IDT\WDM\AESTSr64.exe [2011-12-06 89600]

    S2 AMPPALR3;Intel® Centrino® Bluetooth 3.0 + High Speed Service;c:\program files\Intel\BluetoothHS\BTHSAmpPalService.exe [2011-04-21 1136640]

    S2 BTHSSecurityMgr;Intel® Centrino® Wireless Bluetooth® 3.0 + High Speed Security Service;c:\program files\Intel\BluetoothHS\BTHSSecurityMgr.exe [2011-04-21 134928]

    S2 FPLService;TrueSuiteService;c:\program files (x86)\HP SimplePass 2011\TrueSuiteService.exe [2011-08-25 260424]

    S2 HPClientSvc;HP Client Services;c:\program files\Hewlett-Packard\HP Client Services\HPClientServices.exe [2010-10-11 346168]

    S2 HPDrvMntSvc.exe;HP Quick Synchronization Service;c:\program files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe [2012-08-10 197536]

    S2 hpsrv;HP Service;c:\windows\system32\Hpservice.exe [2011-05-27 30520]

    S2 HPWMISVC;HPWMISVC;c:\program files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe [2011-07-11 26680]

    S2 IAStorDataMgrSvc;Intel® Rapid Storage Technology;c:\program files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe [2011-04-30 13592]

    S2 IconMan_R;IconMan_R;c:\program files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe [2011-03-04 2375168]

    S2 MBAMScheduler;MBAMScheduler;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [2012-09-30 399432]

    S2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2012-09-30 676936]

    S2 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys [2012-08-31 128456]

    S2 Skype C2C Service;Skype C2C Service;c:\programdata\Skype\Toolbars\Skype C2C Service\c2c_service.exe [2012-12-13 3290896]

    S2 UNS;Intel® Management and Security Application User Notification Service;c:\program files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe [2010-11-23 2656280]

    S3 AMPPAL;Intel® Centrino® Bluetooth 3.0 + High Speed Virtual Adapter;c:\windows\system32\DRIVERS\AMPPAL.sys [2011-04-21 294912]

    S3 clwvd;CyberLink WebCam Virtual Driver;c:\windows\system32\DRIVERS\clwvd.sys [2010-07-28 31088]

    S3 IntcDAud;Intel® Display Audio;c:\windows\system32\DRIVERS\IntcDAud.sys [2010-10-15 317440]

    S3 L1C;NDIS Miniport Driver for Atheros AR813x/AR815x PCI-E Ethernet Controller;c:\windows\system32\DRIVERS\L1C62x64.sys [2011-12-06 77936]

    S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2012-09-30 25928]

    S3 NisSrv;Microsoft Network Inspection;c:\program files\Microsoft Security Client\NisSrv.exe [2012-09-13 368896]

    S3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [2012-07-09 52736]

    S3 wdkmd;Intel WiDi KMD;c:\windows\system32\DRIVERS\WDKMD.sys [2011-02-17 42392]

    .

    .

    --- Other Services/Drivers In Memory ---

    .

    *NewlyCreated* - WS2IFSL

    .

    Contents of the 'Scheduled Tasks' folder

    .

    2012-12-25 c:\windows\Tasks\Adobe Flash Player Updater.job

    - c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-05-18 16:55]

    .

    2012-12-25 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

    - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-12-15 00:26]

    .

    2012-12-25 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

    - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-12-15 00:26]

    .

    2012-12-25 c:\windows\Tasks\HPCeeScheduleForArnab.job

    - c:\program files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2010-09-14 05:15]

    .

    .

    --------- X64 Entries -----------

    .

    .

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]

    @="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"

    [HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]

    2012-02-14 22:58 97792 ----a-w- c:\users\Arnab\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll

    .

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]

    @="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"

    [HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]

    2012-02-14 22:58 97792 ----a-w- c:\users\Arnab\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll

    .

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]

    @="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"

    [HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]

    2012-02-14 22:58 97792 ----a-w- c:\users\Arnab\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll

    .

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]

    @="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"

    [HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]

    2012-02-14 22:58 97792 ----a-w- c:\users\Arnab\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

    "Apoint"="c:\program files\Apoint2K\Apoint.exe" [2011-02-19 569200]

    "IgfxTray"="c:\windows\system32\igfxtray.exe" [2011-12-06 168216]

    "HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2011-12-06 392472]

    "Persistence"="c:\windows\system32\igfxpers.exe" [2011-12-06 416024]

    "SysTrayApp"="c:\program files\IDT\WDM\sttray64.exe" [2011-12-06 1128448]

    "MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2012-09-13 1289704]

    .

    ------- Supplementary Scan -------

    .

    uStart Page = https://www.google.com/

    uLocal Page = c:\windows\system32\blank.htm

    mLocal Page = c:\windows\SysWOW64\blank.htm

    uInternet Settings,ProxyOverride = *.local

    IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~1\Office12\EXCEL.EXE/3000

    TCP: DhcpNameServer = 192.168.1.1

    FF - ProfilePath - c:\users\Arnab\AppData\Roaming\Mozilla\Firefox\Profiles\66yxquzi.default\

    FF - ExtSQL: 2012-12-18 11:18; {635abd67-4fe9-1b23-4f01-e679fa7484c1}; c:\users\Arnab\AppData\Roaming\Mozilla\Firefox\Profiles\66yxquzi.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}

    FF - ExtSQL: 2012-12-19 09:36; websitelogon@truesuite.com; c:\program files (x86)\Mozilla Firefox\extensions\websitelogon@truesuite.com

    .

    - - - - ORPHANS REMOVED - - - -

    .

    URLSearchHooks-{49c795c2-604a-4d18-aeb1-b3eba27e5ea2} - (no file)

    AddRemove-Adobe Shockwave Player - c:\windows\system32\Adobe\Shockwave 11\uninstaller.exe

    AddRemove-{EE202411-2C26-49E8-9784-1BC1DBF7DE96} - c:\program files (x86)\InstallShield Installation Information\{EE202411-2C26-49E8-9784-1BC1DBF7DE96}\setup.exe

    .

    .

    .

    --------------------- LOCKED REGISTRY KEYS ---------------------

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]

    @Denied: (A 2) (Everyone)

    @="FlashBroker"

    "LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_5_502_135_ActiveX.exe,-101"

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]

    "Enabled"=dword:00000001

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]

    @="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_5_502_135_ActiveX.exe"

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]

    @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]

    @Denied: (A 2) (Everyone)

    @="IFlashBroker5"

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]

    @="{00020424-0000-0000-C000-000000000046}"

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]

    @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

    "Version"="1.0"

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]

    @Denied: (A 2) (Everyone)

    @="FlashBroker"

    "LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_5_502_135_ActiveX.exe,-101"

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]

    "Enabled"=dword:00000001

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]

    @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_5_502_135_ActiveX.exe"

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]

    @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]

    @Denied: (A 2) (Everyone)

    @="Shockwave Flash Object"

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]

    @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_5_502_135.ocx"

    "ThreadingModel"="Apartment"

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]

    @="0"

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]

    @="ShockwaveFlash.ShockwaveFlash.11"

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

    @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_5_502_135.ocx, 1"

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]

    @="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]

    @="1.0"

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

    @="ShockwaveFlash.ShockwaveFlash"

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]

    @Denied: (A 2) (Everyone)

    @="Macromedia Flash Factory Object"

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]

    @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_5_502_135.ocx"

    "ThreadingModel"="Apartment"

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]

    @="FlashFactory.FlashFactory.1"

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

    @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_5_502_135.ocx, 1"

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]

    @="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]

    @="1.0"

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

    @="FlashFactory.FlashFactory"

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]

    @Denied: (A 2) (Everyone)

    @="IFlashBroker5"

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]

    @="{00020424-0000-0000-C000-000000000046}"

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]

    @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

    "Version"="1.0"

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\McAfee]

    "SymbolicLinkValue"=hex(6):5c,00,72,00,65,00,67,00,69,00,73,00,74,00,72,00,79,

    00,5c,00,6d,00,61,00,63,00,68,00,69,00,6e,00,65,00,5c,00,53,00,6f,00,66,00,\

    .

    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]

    @Denied: (Full) (Everyone)

    .

    ------------------------ Other Running Processes ------------------------

    .

    c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

    c:\program files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe

    c:\program files (x86)\CyberLink\YouCam\YCMMirage.exe

    c:\program files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe

    .

    **************************************************************************

    .

    Completion time: 2012-12-25 17:23:43 - machine was rebooted

    ComboFix-quarantined-files.txt 2012-12-25 22:23

    .

    Pre-Run: 526,936,334,336 bytes free

    Post-Run: 526,551,580,672 bytes free

    .

    - - End Of File - - AC42F122649FEDCD736B978E5E845E5C

    Trojan Agent svchost.exe

    in Resolved Malware Removal Logs

    Posted

    ---------------------------------------

    Malwarebytes Anti-Rootkit BETA 1.01.0.1011

    © Malwarebytes Corporation 2011-2012

    OS version: 6.1.7601 Windows 7 Service Pack 1 x64

    Account is Administrative

    Internet Explorer version: 9.0.8112.16421

    Java version: 1.6.0_31

    File system is: NTFS

    Disk drives: C:\ DRIVE_FIXED, D:\ DRIVE_FIXED

    CPU speed: 2.294000 GHz

    Memory total: 6387777536, free: 3988951040

    ------------ Kernel report ------------

    12/18/2012 16:17:49

    ------------ Loaded modules -----------

    \SystemRoot\system32\ntoskrnl.exe

    \SystemRoot\system32\hal.dll

    \SystemRoot\system32\kdcom.dll

    \SystemRoot\system32\mcupdate_GenuineIntel.dll

    \SystemRoot\system32\PSHED.dll

    \SystemRoot\system32\CLFS.SYS

    \SystemRoot\system32\CI.dll

    \SystemRoot\system32\drivers\Wdf01000.sys

    \SystemRoot\system32\drivers\WDFLDR.SYS

    \SystemRoot\system32\drivers\ACPI.sys

    \SystemRoot\system32\drivers\WMILIB.SYS

    \SystemRoot\system32\drivers\msisadrv.sys

    \SystemRoot\system32\drivers\pci.sys

    \SystemRoot\system32\drivers\vdrvroot.sys

    \SystemRoot\System32\drivers\partmgr.sys

    \SystemRoot\system32\drivers\compbatt.sys

    \SystemRoot\system32\drivers\BATTC.SYS

    \SystemRoot\system32\drivers\volmgr.sys

    \SystemRoot\System32\drivers\volmgrx.sys

    \SystemRoot\System32\drivers\mountmgr.sys

    \SystemRoot\system32\DRIVERS\iaStor.sys

    \SystemRoot\system32\drivers\atapi.sys

    \SystemRoot\system32\drivers\ataport.SYS

    \SystemRoot\system32\drivers\msahci.sys

    \SystemRoot\system32\drivers\PCIIDEX.SYS

    \SystemRoot\system32\drivers\amdxata.sys

    \SystemRoot\system32\drivers\fltmgr.sys

    \SystemRoot\system32\drivers\fileinfo.sys

    \SystemRoot\system32\DRIVERS\MpFilter.sys

    \SystemRoot\System32\Drivers\Ntfs.sys

    \SystemRoot\System32\Drivers\msrpc.sys

    \SystemRoot\System32\Drivers\ksecdd.sys

    \SystemRoot\System32\Drivers\cng.sys

    \SystemRoot\System32\drivers\pcw.sys

    \SystemRoot\System32\Drivers\Fs_Rec.sys

    \SystemRoot\system32\drivers\ndis.sys

    \SystemRoot\system32\drivers\NETIO.SYS

    \SystemRoot\System32\Drivers\ksecpkg.sys

    \SystemRoot\System32\drivers\tcpip.sys

    \SystemRoot\System32\drivers\fwpkclnt.sys

    \SystemRoot\system32\drivers\wd.sys

    \SystemRoot\system32\drivers\volsnap.sys

    \SystemRoot\System32\Drivers\spldr.sys

    \SystemRoot\System32\drivers\rdyboost.sys

    \SystemRoot\System32\Drivers\mup.sys

    \SystemRoot\System32\drivers\hwpolicy.sys

    \SystemRoot\system32\DRIVERS\hpdskflt.sys

    \SystemRoot\System32\DRIVERS\fvevol.sys

    \SystemRoot\system32\drivers\disk.sys

    \SystemRoot\system32\drivers\CLASSPNP.SYS

    \SystemRoot\system32\DRIVERS\cdrom.sys

    \SystemRoot\System32\Drivers\Null.SYS

    \SystemRoot\System32\Drivers\Beep.SYS

    \SystemRoot\System32\drivers\vga.sys

    \SystemRoot\System32\drivers\VIDEOPRT.SYS

    \SystemRoot\System32\drivers\watchdog.sys

    \SystemRoot\System32\DRIVERS\RDPCDD.sys

    \SystemRoot\system32\drivers\rdpencdd.sys

    \SystemRoot\system32\drivers\rdprefmp.sys

    \SystemRoot\System32\Drivers\Msfs.SYS

    \SystemRoot\System32\Drivers\Npfs.SYS

    \SystemRoot\system32\DRIVERS\tdx.sys

    \SystemRoot\system32\DRIVERS\TDI.SYS

    \SystemRoot\System32\DRIVERS\netbt.sys

    \SystemRoot\system32\drivers\afd.sys

    \SystemRoot\system32\DRIVERS\wfplwf.sys

    \SystemRoot\system32\DRIVERS\pacer.sys

    \SystemRoot\system32\DRIVERS\vwififlt.sys

    \SystemRoot\system32\DRIVERS\netbios.sys

    \SystemRoot\system32\DRIVERS\wanarp.sys

    \SystemRoot\system32\drivers\termdd.sys

    \SystemRoot\system32\DRIVERS\rdbss.sys

    \SystemRoot\system32\drivers\nsiproxy.sys

    \SystemRoot\system32\drivers\mssmbios.sys

    \SystemRoot\System32\drivers\discache.sys

    \SystemRoot\System32\Drivers\dfsc.sys

    \SystemRoot\system32\drivers\blbdrive.sys

    \SystemRoot\system32\DRIVERS\tunnel.sys

    \SystemRoot\system32\DRIVERS\igdkmd64.sys

    \SystemRoot\System32\drivers\dxgkrnl.sys

    \SystemRoot\System32\drivers\dxgmms1.sys

    \SystemRoot\system32\DRIVERS\HECIx64.sys

    \SystemRoot\system32\drivers\usbehci.sys

    \SystemRoot\system32\drivers\USBPORT.SYS

    \SystemRoot\system32\DRIVERS\HDAudBus.sys

    \SystemRoot\system32\DRIVERS\Netwsw00.sys

    \SystemRoot\system32\DRIVERS\vwifibus.sys

    \SystemRoot\system32\DRIVERS\L1C62x64.sys

    \SystemRoot\system32\DRIVERS\i8042prt.sys

    \SystemRoot\system32\DRIVERS\kbdclass.sys

    \SystemRoot\system32\DRIVERS\Apfiltr.sys

    \SystemRoot\system32\DRIVERS\mouclass.sys

    \SystemRoot\system32\DRIVERS\GEARAspiWDM.sys

    \SystemRoot\system32\DRIVERS\Accelerometer.sys

    \SystemRoot\system32\drivers\CmBatt.sys

    \SystemRoot\system32\drivers\wmiacpi.sys

    \SystemRoot\system32\DRIVERS\intelppm.sys

    \SystemRoot\system32\DRIVERS\AMPPAL.sys

    \SystemRoot\system32\drivers\CompositeBus.sys

    \SystemRoot\system32\DRIVERS\clwvd.sys

    \SystemRoot\system32\DRIVERS\ks.sys

    \SystemRoot\system32\drivers\ksthunk.sys

    \SystemRoot\system32\DRIVERS\AgileVpn.sys

    \SystemRoot\system32\DRIVERS\rasl2tp.sys

    \SystemRoot\system32\DRIVERS\ndistapi.sys

    \SystemRoot\system32\DRIVERS\ndiswan.sys

    \SystemRoot\system32\DRIVERS\raspppoe.sys

    \SystemRoot\system32\DRIVERS\raspptp.sys

    \SystemRoot\system32\DRIVERS\rassstp.sys

    \SystemRoot\system32\DRIVERS\serscan.sys

    \SystemRoot\system32\drivers\swenum.sys

    \SystemRoot\system32\DRIVERS\umbus.sys

    \SystemRoot\system32\DRIVERS\WDKMD.sys

    \SystemRoot\system32\DRIVERS\usbhub.sys

    \SystemRoot\System32\Drivers\NDProxy.SYS

    \SystemRoot\system32\DRIVERS\stwrt64.sys

    \SystemRoot\system32\DRIVERS\portcls.sys

    \SystemRoot\system32\DRIVERS\drmk.sys

    \SystemRoot\system32\DRIVERS\IntcDAud.sys

    \SystemRoot\System32\Drivers\crashdmp.sys

    \SystemRoot\System32\Drivers\dump_iaStor.sys

    \SystemRoot\System32\Drivers\dump_dumpfve.sys

    \SystemRoot\system32\DRIVERS\usbccgp.sys

    \SystemRoot\system32\DRIVERS\USBD.SYS

    \SystemRoot\system32\DRIVERS\hidusb.sys

    \SystemRoot\system32\DRIVERS\HIDCLASS.SYS

    \SystemRoot\system32\DRIVERS\HIDPARSE.SYS

    \SystemRoot\system32\DRIVERS\mouhid.sys

    \SystemRoot\System32\Drivers\usbvideo.sys

    \SystemRoot\System32\win32k.sys

    \SystemRoot\System32\drivers\Dxapi.sys

    \SystemRoot\system32\DRIVERS\monitor.sys

    \SystemRoot\System32\TSDDD.dll

    \SystemRoot\System32\cdd.dll

    \SystemRoot\System32\ATMFD.DLL

    \SystemRoot\system32\drivers\luafv.sys

    \??\C:\Windows\system32\drivers\mbam.sys

    \SystemRoot\system32\drivers\WudfPf.sys

    \SystemRoot\system32\DRIVERS\WinUSB.sys

    \SystemRoot\system32\DRIVERS\WUDFRd.sys

    \SystemRoot\system32\DRIVERS\lltdio.sys

    \SystemRoot\system32\DRIVERS\nwifi.sys

    \SystemRoot\system32\DRIVERS\ndisuio.sys

    \SystemRoot\system32\DRIVERS\rspndr.sys

    \SystemRoot\system32\drivers\HTTP.sys

    \SystemRoot\system32\DRIVERS\vwifimp.sys

    \SystemRoot\system32\DRIVERS\bowser.sys

    \SystemRoot\System32\drivers\mpsdrv.sys

    \SystemRoot\system32\DRIVERS\mrxsmb.sys

    \SystemRoot\system32\DRIVERS\mrxsmb10.sys

    \SystemRoot\system32\DRIVERS\mrxsmb20.sys

    \SystemRoot\system32\DRIVERS\NisDrvWFP.sys

    \SystemRoot\system32\drivers\peauth.sys

    \SystemRoot\System32\Drivers\secdrv.SYS

    \SystemRoot\System32\DRIVERS\srvnet.sys

    \SystemRoot\System32\drivers\tcpipreg.sys

    \SystemRoot\System32\DRIVERS\srv2.sys

    \SystemRoot\System32\DRIVERS\srv.sys

    \??\C:\Windows\system32\drivers\mbamchameleon.sys

    \??\C:\Windows\system32\drivers\mbamswissarmy.sys

    \Windows\System32\ntdll.dll

    \Windows\System32\smss.exe

    \Windows\System32\apisetschema.dll

    \Windows\System32\autochk.exe

    \Windows\System32\normaliz.dll

    \Windows\System32\comdlg32.dll

    \Windows\System32\user32.dll

    \Windows\System32\setupapi.dll

    \Windows\System32\Wldap32.dll

    \Windows\System32\gdi32.dll

    \Windows\System32\difxapi.dll

    \Windows\System32\ws2_32.dll

    \Windows\System32\rpcrt4.dll

    \Windows\System32\advapi32.dll

    \Windows\System32\psapi.dll

    \Windows\System32\msvcrt.dll

    \Windows\System32\imm32.dll

    \Windows\System32\clbcatq.dll

    \Windows\System32\shell32.dll

    \Windows\System32\wininet.dll

    \Windows\System32\sechost.dll

    \Windows\System32\imagehlp.dll

    \Windows\System32\oleaut32.dll

    \Windows\System32\ole32.dll

    \Windows\System32\urlmon.dll

    \Windows\System32\msctf.dll

    \Windows\System32\iertutil.dll

    \Windows\System32\kernel32.dll

    \Windows\System32\nsi.dll

    \Windows\System32\usp10.dll

    \Windows\System32\shlwapi.dll

    \Windows\System32\lpk.dll

    \Windows\System32\comctl32.dll

    \Windows\System32\wintrust.dll

    \Windows\System32\crypt32.dll

    \Windows\System32\KernelBase.dll

    \Windows\System32\devobj.dll

    \Windows\System32\cfgmgr32.dll

    \Windows\System32\msasn1.dll

    ----------- End -----------

    <<<1>>>

    Upper Device Name: \Device\Harddisk0\DR0

    Upper Device Object: 0xfffffa8008acb060

    Upper Device Driver Name: \Driver\Disk\

    Lower Device Name: \Device\Ide\IAAStorageDevice-1\

    Lower Device Object: 0xfffffa8006223050

    Lower Device Driver Name: \Driver\iaStor\

    Driver name found: iaStor

    DriverEntry returned 0x0

    Function returned 0x0

    Downloaded database version: v2012.12.18.07

    Initializing...

    Done!

    <<<2>>>

    Device number: 0, partition: 2

    Physical Sector Size: 512

    Drive: 0, DevicePointer: 0xfffffa8008acb060, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\

    --------- Disk Stack ------

    DevicePointer: 0xfffffa8008acbb90, DeviceName: Unknown, DriverName: \Driver\partmgr\

    DevicePointer: 0xfffffa8008acb060, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\

    DevicePointer: 0xfffffa800893fb10, DeviceName: Unknown, DriverName: \Driver\hpdskflt\

    DevicePointer: 0xfffffa8006223050, DeviceName: \Device\Ide\IAAStorageDevice-1\, DriverName: \Driver\iaStor\

    ------------ End ----------

    Upper DeviceData: 0xfffff8a0053f7a10, 0xfffffa8008acb060, 0xfffffa800602a790

    Lower DeviceData: 0xfffff8a00c7a79e0, 0xfffffa8006223050, 0xfffffa800a7a3520

    <<<3>>>

    Volume: C:

    File system type: NTFS

    SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes

    Scanning directory: C:\Windows\system32\drivers...

    Done!

    Drive 0

    Scanning MBR on drive 0...

    Inspecting partition table:

    MBR Signature: 55AA

    Disk Signature: CFDF4276

    Partition information:

    Partition 0 type is Primary (0x7)

    Partition is ACTIVE.

    Partition starts at LBA: 2048 Numsec = 407552

    Partition file system is NTFS

    Partition is bootable

    Partition 1 type is Primary (0x7)

    Partition is NOT ACTIVE.

    Partition starts at LBA: 409600 Numsec = 1219946496

    Partition 2 type is Primary (0x7)

    Partition is NOT ACTIVE.

    Partition starts at LBA: 1220356096 Numsec = 29693952

    Partition 3 type is Empty (0x0)

    Partition is NOT ACTIVE.

    Partition starts at LBA: 0 Numsec = 0

    Disk Size: 640135028736 bytes

    Sector size: 512 bytes

    Scanning physical sectors of unpartitioned space on drive 0 (1-2047-1250243728-1250263728)...

    Done!

    Performing system, memory and registry scan...

    Done!

    Scan finished

    =======================================

    Trojan Agent svchost.exe

    in Resolved Malware Removal Logs

    Posted

    Hi,

    Thank you very much for helping me out. The rootkit successfully removed the viruses however it did not create a log. I ran it many times and it did not create any logs. The computer runs fine without any problem. here is the log of regular Mbam quick scan:

    Malwarebytes Anti-Malware 1.65.1.1000

    www.malwarebytes.org

    Database version: v2012.12.06.09

    Windows 7 Service Pack 1 x64 NTFS

    Internet Explorer 9.0.8112.16421

    Arnab :: ARNAB-HP [administrator]

    12/12/2012 9:13:16 PM

    mbam-log-2012-12-12 (21-13-16).txt

    Scan type: Quick scan

    Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM

    Scan options disabled: P2P

    Objects scanned: 204447

    Time elapsed: 4 minute(s), 40 second(s)

    Memory Processes Detected: 0

    (No malicious items detected)

    Memory Modules Detected: 0

    (No malicious items detected)

    Registry Keys Detected: 0

    (No malicious items detected)

    Registry Values Detected: 0

    (No malicious items detected)

    Registry Data Items Detected: 0

    (No malicious items detected)

    Folders Detected: 0

    (No malicious items detected)

    Files Detected: 0

    (No malicious items detected)

    (end)

    Trojan Agent svchost.exe

    in Resolved Malware Removal Logs

    Posted

    hello the MBAM scan showed 1 virus on the log but I ran it again and it showed 2 this time here is more recent MBAM log. Thanks again for help. Let me know if you need me to do the other scans over.

    Malwarebytes Anti-Malware 1.65.1.1000

    www.malwarebytes.org

    Database version: v2012.12.06.09

    Windows 7 Service Pack 1 x64 NTFS

    Internet Explorer 9.0.8112.16421

    Arnab :: ARNAB-HP [administrator]

    12/7/2012 8:04:57 PM

    mbam-log-2012-12-07 (20-04-57).txt

    Scan type: Quick scan

    Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM

    Scan options disabled: P2P

    Objects scanned: 204150

    Time elapsed: 4 minute(s), 29 second(s)

    Memory Processes Detected: 1

    C:\Windows\svchost.exe (Trojan.Agent) -> 4828 -> Delete on reboot.

    Memory Modules Detected: 0

    (No malicious items detected)

    Registry Keys Detected: 0

    (No malicious items detected)

    Registry Values Detected: 0

    (No malicious items detected)

    Registry Data Items Detected: 0

    (No malicious items detected)

    Folders Detected: 0

    (No malicious items detected)

    Files Detected: 1

    C:\Windows\svchost.exe (Trojan.Agent) -> Delete on reboot.

    (end)

    Trojan Agent svchost.exe

    in Resolved Malware Removal Logs

    Posted

    Malwarebytes Anti-Malware 1.65.1.1000

    www.malwarebytes.org

    Database version: v2012.12.06.09

    Windows 7 Service Pack 1 x64 NTFS

    Internet Explorer 9.0.8112.16421

    Arnab :: ARNAB-HP [administrator]

    12/6/2012 11:14:23 AM

    mbam-log-2012-12-06 (11-14-23).txt

    Scan type: Quick scan

    Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM

    Scan options disabled: P2P

    Objects scanned: 204050

    Time elapsed: 4 minute(s), 33 second(s)

    Memory Processes Detected: 0

    (No malicious items detected)

    Memory Modules Detected: 0

    (No malicious items detected)

    Registry Keys Detected: 0

    (No malicious items detected)

    Registry Values Detected: 0

    (No malicious items detected)

    Registry Data Items Detected: 0

    (No malicious items detected)

    Folders Detected: 0

    (No malicious items detected)

    Files Detected: 1

    C:\Windows\svchost.exe (Trojan.Agent) -> Delete on reboot.

    (end)

    DDS (Ver_2012-11-20.01) - NTFS_AMD64

    Internet Explorer: 9.0.8112.16455 BrowserJavaVersion: 10.6.2

    Run by Arnab at 11:24:02 on 2012-12-06

    Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.6092.4069 [GMT -5:00]

    .

    AV: Microsoft Security Essentials *Enabled/Updated* {B140BF4E-23BB-4198-90AB-A51A4C60A69C}

    SP: Microsoft Security Essentials *Enabled/Updated* {0A215EAA-0581-4E16-AA1B-9E6837E7EC21}

    SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

    .

    ============== Running Processes ===============

    .

    C:\Windows\system32\lsm.exe

    C:\Windows\system32\svchost.exe -k DcomLaunch

    C:\Program Files (x86)\HP SimplePass 2011\TrueSuiteService.exe

    C:\Windows\system32\svchost.exe -k RPCSS

    c:\Program Files\Microsoft Security Client\MsMpEng.exe

    C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted

    C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted

    C:\Windows\system32\svchost.exe -k netsvcs

    C:\Program Files\IDT\WDM\STacSV64.exe

    C:\Windows\system32\AUDIODG.EXE

    C:\Windows\system32\svchost.exe -k LocalService

    C:\Windows\system32\Hpservice.exe

    C:\Windows\System32\WUDFHost.exe

    C:\Windows\system32\svchost.exe -k NetworkService

    C:\Windows\System32\spoolsv.exe

    C:\Windows\system32\svchost.exe -k WbioSvcGroup

    C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork

    C:\Program Files\IDT\WDM\AESTSr64.exe

    C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe

    C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

    C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe

    C:\Program Files\Hewlett-Packard\HP Client Services\HPClientServices.exe

    C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe

    C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe

    C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe

    C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe

    C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe

    C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe

    C:\Windows\system32\taskhost.exe

    C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe

    C:\Windows\system32\Dwm.exe

    C:\Windows\Explorer.EXE

    C:\Program Files (x86)\HP SimplePass 2011\TouchControl.exe

    c:\Program Files\Microsoft Security Client\NisSrv.exe

    C:\Program Files (x86)\HP SimplePass 2011\BioMonitor.exe

    C:\Windows\system32\wbem\wmiprvse.exe

    C:\Windows\system32\wbem\unsecapp.exe

    C:\Program Files\Apoint2K\Apoint.exe

    C:\Windows\System32\hkcmd.exe

    C:\Windows\System32\igfxpers.exe

    C:\Program Files\IDT\WDM\sttray64.exe

    C:\Program Files\Microsoft Security Client\msseces.exe

    C:\Program Files\HP\HP Deskjet 3510 series\Bin\ScanToPCActivationApp.exe

    C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe

    C:\Windows\system32\RunDll32.exe

    C:\Windows\system32\RunDll32.exe

    C:\Program Files\HP\HP Deskjet 3510 series\Bin\HPNetworkCommunicatorCom.exe

    C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe

    C:\Program Files (x86)\Hewlett-Packard\HP CoolSense\CoolSense.exe

    C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe

    C:\Program Files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe

    C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe

    C:\Program Files\Apoint2K\ApMsgFwd.exe

    C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe

    C:\Program Files\Apoint2K\Apntex.exe

    C:\Windows\system32\SearchIndexer.exe

    C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbam.exe

    C:\Program Files\HP\HP Deskjet 3510 series\Bin\HPNetworkCommunicator.exe

    C:\Windows\system32\taskeng.exe

    C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe

    \\.\globalroot\systemroot\svchost.exe -netsvcs

    C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe

    C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe

    C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe

    C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe

    C:\Windows\servicing\TrustedInstaller.exe

    C:\Windows\notepad.exe

    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

    C:\Windows\system32\SearchProtocolHost.exe

    C:\Windows\system32\SearchFilterHost.exe

    C:\Windows\system32\wbem\wmiprvse.exe

    C:\Windows\System32\cscript.exe

    .

    ============== Pseudo HJT Report ===============

    .

    uStart Page = hxxp://google.com/

    uURLSearchHooks: {49c795c2-604a-4d18-aeb1-b3eba27e5ea2} - <orphaned>

    mWinlogon: Userinit = userinit.exe,

    BHO: {02478D38-C3F9-4efb-9B51-7695ECA05670} - <orphaned>

    BHO: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

    BHO: {27B4851A-3207-45A2-B947-BE8AFE6163AB} - <orphaned>

    BHO: Spybot-S&D IE Protection: {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files (x86)\Spybot - Search & Destroy\SDHelper.dll

    BHO: Groove GFS Browser Helper: {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll

    BHO: Java Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll

    BHO: TrueSuite Website Log On: {8590886E-EC8C-43C1-A32C-E4C2B0B6395B} - C:\Program Files (x86)\HP SimplePass 2011\IEBHO.dll

    BHO: Skype Browser Helper: {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll

    BHO: Java Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll

    BHO: HP Network Check Helper: {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll

    uRun: [HP Deskjet 3510 series (NET)] "C:\Program Files\HP\HP Deskjet 3510 series\Bin\ScanToPCActivationApp.exe" -deviceID "CN28G181KZ05R7:NW" -scfn "HP Deskjet 3510 series (NET)" -AutoStart 1

    uRun: [spybotSD TeaTimer] C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe

    mRun: [iAStorIcon] C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe

    mRun: [HP CoolSense] C:\Program Files (x86)\Hewlett-Packard\HP CoolSense\CoolSense.exe -byrunkey

    mRun: [GrooveMonitor] "C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe"

    mRun: [HP Quick Launch] C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe

    mRun: [HPOSD] C:\Program Files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe

    mRun: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

    mRun: [HP Software Update] C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe

    mRunOnce: [Malwarebytes Anti-Malware (cleanup)] rundll32.exe "C:\ProgramData\Malwarebytes\Malwarebytes' Anti-Malware\cleanup.dll",ProcessCleanupScript

    StartupFolder: C:\Users\Arnab\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\MONITO~1.LNK - C:\Windows\System32\RunDll32.exe

    StartupFolder: C:\Users\Arnab\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\MONITO~2.LNK - C:\Windows\System32\RunDll32.exe

    uPolicies-Explorer: NoDriveTypeAutoRun = dword:145

    mPolicies-Explorer: NoActiveDesktop = dword:1

    mPolicies-Explorer: NoActiveDesktopChanges = dword:1

    mPolicies-System: ConsentPromptBehaviorAdmin = dword:5

    mPolicies-System: ConsentPromptBehaviorUser = dword:3

    mPolicies-System: EnableUIADesktopToggle = dword:0

    IE: E&xport to Microsoft Excel - C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000

    IE: {22CC3EBD-C286-43aa-B8E6-06B115F74162} - C:\Program Files (x86)\Hewlett-Packard\SmartPrint\smartprintsetup.exe

    IE: {25510184-5A38-4A99-B273-DCA8EEF6CD08} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\NCLauncherFromIE.exe

    IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\Program Files (x86)\Microsoft Office\Office12\ONBttnIE.dll

    IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll

    IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503}

    IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files (x86)\Spybot - Search & Destroy\SDHelper.dll

    .

    INFO: HKCU has more than 50 listed domains.

    If you wish to scan all of them, select the 'Force scan all domains' option.

    .

    .

    INFO: HKLM has more than 50 listed domains.

    If you wish to scan all of them, select the 'Force scan all domains' option.

    .

    DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab

    DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab

    DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab

    TCP: NameServer = 192.168.1.1

    TCP: Interfaces\{BA7A31F7-966C-4E0D-A6B4-151C9D8FE2E5} : DHCPNameServer = 192.168.1.1

    TCP: Interfaces\{BA7A31F7-966C-4E0D-A6B4-151C9D8FE2E5}\E416478616C696560274E2 : DHCPNameServer = 172.26.38.1 172.26.38.2

    Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveSystemServices.dll

    Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll

    Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll

    SSODL: WebCheck - <orphaned>

    SEH: Groove GFS Stub Execution Hook - {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll

    x64-BHO: {27B4851A-3207-45A2-B947-BE8AFE6163AB} - <orphaned>

    x64-BHO: TrueSuite Website Log On: {8590886E-EC8C-43C1-A32C-E4C2B0B6395B} - C:\Program Files (x86)\HP SimplePass 2011\x64\IEBHO.dll

    x64-BHO: Skype add-on for Internet Explorer: {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll

    x64-BHO: {DBC80044-A445-435b-BC74-9C25C1C588A9} - <orphaned>

    x64-Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe

    x64-Run: [igfxTray] C:\Windows\System32\igfxtray.exe

    x64-Run: [HotKeysCmds] C:\Windows\System32\hkcmd.exe

    x64-Run: [Persistence] C:\Windows\System32\igfxpers.exe

    x64-Run: [sysTrayApp] C:\Program Files\IDT\WDM\sttray64.exe

    x64-Run: [MSC] "c:\Program Files\Microsoft Security Client\msseces.exe" -hide -runkey

    x64-IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll

    .

    INFO: x64-HKLM has more than 50 listed domains.

    If you wish to scan all of them, select the 'Force scan all domains' option.

    .

    x64-Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - <orphaned>

    x64-Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll

    x64-Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - <orphaned>

    x64-Notify: igfxcui - igfxdev.dll

    x64-SSODL: WebCheck - <orphaned>

    Hosts: 127.0.0.1 www.spywareinfo.com

    .

    ============= SERVICES / DRIVERS ===============

    .

    R0 MpFilter;Microsoft Malware Protection Driver;C:\Windows\System32\drivers\MpFilter.sys [2012-8-30 228768]

    R2 AESTFilters;Andrea ST Filters Service;C:\Program Files\IDT\WDM\AESTSr64.exe [2011-12-5 89600]

    R2 AMPPALR3;Intel® Centrino® Bluetooth 3.0 + High Speed Service;C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe [2011-4-21 1136640]

    R2 BTHSSecurityMgr;Intel® Centrino® Wireless Bluetooth® 3.0 + High Speed Security Service;C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe [2011-4-21 134928]

    R2 FPLService;TrueSuiteService;C:\Program Files (x86)\HP SimplePass 2011\TrueSuiteService.exe [2011-8-25 260424]

    R2 HP Support Assistant Service;HP Support Assistant Service;C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSA_Service.exe [2012-9-27 86528]

    R2 HPClientSvc;HP Client Services;C:\Program Files\Hewlett-Packard\HP Client Services\HPClientServices.exe [2010-10-11 346168]

    R2 HPDrvMntSvc.exe;HP Quick Synchronization Service;C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe [2012-8-10 197536]

    R2 hpsrv;HP Service;C:\Windows\System32\hpservice.exe [2011-5-27 30520]

    R2 HPWMISVC;HPWMISVC;C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe [2011-7-11 26680]

    R2 IAStorDataMgrSvc;Intel® Rapid Storage Technology;C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe [2011-11-21 13592]

    R2 IconMan_R;IconMan_R;C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe [2011-11-21 2375168]

    R2 MBAMScheduler;MBAMScheduler;C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [2012-12-2 399432]

    R2 MBAMService;MBAMService;C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2012-12-2 676936]

    R2 NisDrv;Microsoft Network Inspection System;C:\Windows\System32\drivers\NisDrvWFP.sys [2012-8-30 128456]

    R2 Skype C2C Service;Skype C2C Service;C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe [2012-11-22 3290304]

    R2 UNS;Intel® Management and Security Application User Notification Service;C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe [2011-11-21 2656280]

    R3 AMPPAL;Intel® Centrino® Bluetooth 3.0 + High Speed Virtual Adapter;C:\Windows\System32\drivers\AmpPal.sys [2011-4-21 294912]

    R3 clwvd;CyberLink WebCam Virtual Driver;C:\Windows\System32\drivers\clwvd.sys [2010-7-28 31088]

    R3 IntcDAud;Intel® Display Audio;C:\Windows\System32\drivers\IntcDAud.sys [2010-10-15 317440]

    R3 L1C;NDIS Miniport Driver for Atheros AR813x/AR815x PCI-E Ethernet Controller;C:\Windows\System32\drivers\L1C62x64.sys [2011-12-5 77936]

    R3 MBAMProtector;MBAMProtector;C:\Windows\System32\drivers\mbam.sys [2012-12-2 25928]

    R3 NisSrv;Microsoft Network Inspection;C:\Program Files\Microsoft Security Client\NisSrv.exe [2012-9-12 368896]

    R3 wdkmd;Intel WiDi KMD;C:\Windows\System32\drivers\WDKMD.sys [2011-2-16 42392]

    S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]

    S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]

    S2 SkypeUpdate;Skype Updater;C:\Program Files (x86)\Skype\Updater\Updater.exe [2012-7-13 160944]

    S3 AMPPALP;Intel® Centrino® Bluetooth 3.0 + High Speed Protocol;C:\Windows\System32\drivers\AmpPal.sys [2011-4-21 294912]

    S3 cpudrv64;cpudrv64;C:\Program Files (x86)\SystemRequirementsLab\cpudrv64.sys [2011-6-2 17864]

    S3 GamesAppService;GamesAppService;C:\Program Files (x86)\WildTangent Games\App\GamesAppService.exe [2010-10-12 206072]

    S3 RSPCIESTOR;Realtek PCIE CardReader Driver;C:\Windows\System32\drivers\RtsPStor.sys [2011-11-21 335464]

    S3 SrvHsfHDA;SrvHsfHDA;C:\Windows\System32\drivers\VSTAZL6.SYS [2009-7-13 292864]

    S3 SrvHsfV92;SrvHsfV92;C:\Windows\System32\drivers\VSTDPV6.SYS [2009-7-13 1485312]

    S3 SrvHsfWinac;SrvHsfWinac;C:\Windows\System32\drivers\VSTCNXT6.SYS [2009-7-13 740864]

    S3 TsUsbFlt;TsUsbFlt;C:\Windows\System32\drivers\TsUsbFlt.sys [2010-11-20 59392]

    S3 TsUsbGD;Remote Desktop Generic USB Device;C:\Windows\System32\drivers\TsUsbGD.sys [2010-11-20 31232]

    S3 USBAAPL64;Apple Mobile USB Driver;C:\Windows\System32\drivers\usbaapl64.sys [2012-7-9 52736]

    S3 WatAdminSvc;Windows Activation Technologies Service;C:\Windows\System32\Wat\WatAdminSvc.exe [2011-11-25 1255736]

    S3 WinRing0_1_2_0;WinRing0_1_2_0;C:\Program Files (x86)\Razer\Razer Game Booster\Driver\WinRing0x64.sys [2012-11-13 14544]

    S4 SBSDWSCService;SBSD Security Center Service;C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe [2012-9-30 1153368]

    .

    =============== Created Last 30 ================

    .

    2012-12-06 16:14:36 20480 ------w- C:\Windows\svchost.exe

    2012-12-06 15:48:31 -------- d-----w- C:\Program Files\CCleaner

    2012-12-06 10:57:11 -------- d-----w- C:\Windows\Microsoft Antimalware

    2012-12-06 07:31:17 -------- d-----w- C:\03c9ed3c08a3a4c322169d90

    2012-12-06 03:28:30 -------- d-----w- C:\Program Files (x86)\Trojan SVCHOSTRemoval Tool

    2012-12-06 00:45:37 9125352 ----a-w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{9DB14B34-194D-447C-927D-001B08EF6AAE}\mpengine.dll

    2012-12-04 17:32:08 -------- d-----w- C:\Users\Arnab\AppData\Roaming\DriverCure

    2012-12-04 17:32:07 -------- d-----w- C:\Users\Arnab\AppData\Roaming\SpeedyPC Software

    2012-12-04 17:31:56 -------- d-----w- C:\ProgramData\SpeedyPC Software

    2012-12-04 02:44:01 9125352 ----a-w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll

    2012-12-03 02:36:27 25928 ----a-w- C:\Windows\System32\drivers\mbam.sys

    2012-12-03 02:36:27 -------- d-----w- C:\Program Files (x86)\Malwarebytes' Anti-Malware

    2012-12-02 00:38:33 7168 ----a-w- C:\ProgramData\Microsoft\Windows\DRM\8D67.tmp

    2012-12-02 00:38:33 7168 ----a-w- C:\ProgramData\Microsoft\Windows\DRM\8D57.tmp

    2012-12-01 08:38:36 -------- d-sh--w- C:\Windows\System32\%APPDATA%

    2012-12-01 01:53:32 -------- d-----w- C:\Users\Arnab\AppData\Local\Razer

    2012-11-28 14:16:58 972264 ------w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{66ED165E-E99E-45FF-8E69-FC51D714B953}\gapaengine.dll

    2012-11-20 18:05:15 -------- d-----w- C:\ProgramData\{9BF4D58B-C6D6-467B-BC5A-FD0C1278F4AF}

    2012-11-15 02:04:26 9728 ----a-w- C:\Windows\System32\Wdfres.dll

    2012-11-15 02:04:26 785512 ----a-w- C:\Windows\System32\drivers\Wdf01000.sys

    2012-11-15 02:04:26 54376 ----a-w- C:\Windows\System32\drivers\WdfLdr.sys

    2012-11-15 02:04:26 2560 ----a-w- C:\Windows\System32\drivers\en-US\wdf01000.sys.mui

    2012-11-14 21:56:25 87040 ----a-w- C:\Windows\System32\drivers\WUDFPf.sys

    2012-11-14 21:56:25 198656 ----a-w- C:\Windows\System32\drivers\WUDFRd.sys

    2012-11-14 21:56:24 84992 ----a-w- C:\Windows\System32\WUDFSvc.dll

    2012-11-14 21:56:24 194048 ----a-w- C:\Windows\System32\WUDFPlatform.dll

    2012-11-14 21:56:23 744448 ----a-w- C:\Windows\System32\WUDFx.dll

    2012-11-14 21:56:23 45056 ----a-w- C:\Windows\System32\WUDFCoinstaller.dll

    2012-11-14 21:56:23 229888 ----a-w- C:\Windows\System32\WUDFHost.exe

    2012-11-14 21:55:45 -------- d-sh--w- C:\Windows\SysWow64\%APPDATA%

    2012-11-14 19:10:34 95744 ----a-w- C:\Windows\System32\synceng.dll

    2012-11-14 19:10:34 78336 ----a-w- C:\Windows\SysWow64\synceng.dll

    .

    ==================== Find3M ====================

    .

    2012-10-18 18:25:58 3149824 ----a-w- C:\Windows\System32\win32k.sys

    2012-10-16 08:38:37 135168 ----a-w- C:\Windows\apppatch\AppPatch64\AcXtrnal.dll

    2012-10-16 08:38:34 350208 ----a-w- C:\Windows\apppatch\AppPatch64\AcLayers.dll

    2012-10-16 07:39:52 561664 ----a-w- C:\Windows\apppatch\AcLayers.dll

    2012-10-09 18:17:13 55296 ----a-w- C:\Windows\System32\dhcpcsvc6.dll

    2012-10-09 18:17:13 226816 ----a-w- C:\Windows\System32\dhcpcore6.dll

    2012-10-09 17:40:31 44032 ----a-w- C:\Windows\SysWow64\dhcpcsvc6.dll

    2012-10-09 17:40:31 193536 ----a-w- C:\Windows\SysWow64\dhcpcore6.dll

    2012-10-08 11:31:03 2312704 ----a-w- C:\Windows\System32\jscript9.dll

    2012-10-08 11:23:52 1392128 ----a-w- C:\Windows\System32\wininet.dll

    2012-10-08 11:22:55 1494528 ----a-w- C:\Windows\System32\inetcpl.cpl

    2012-10-08 11:18:22 173056 ----a-w- C:\Windows\System32\ieUnatt.exe

    2012-10-08 11:17:35 599040 ----a-w- C:\Windows\System32\vbscript.dll

    2012-10-08 11:13:33 2382848 ----a-w- C:\Windows\System32\mshtml.tlb

    2012-10-08 07:56:24 1800704 ----a-w- C:\Windows\SysWow64\jscript9.dll

    2012-10-08 07:48:03 1129472 ----a-w- C:\Windows\SysWow64\wininet.dll

    2012-10-08 07:47:44 1427968 ----a-w- C:\Windows\SysWow64\inetcpl.cpl

    2012-10-08 07:44:05 142848 ----a-w- C:\Windows\SysWow64\ieUnatt.exe

    2012-10-08 07:43:21 420864 ----a-w- C:\Windows\SysWow64\vbscript.dll

    2012-10-08 07:40:56 2382848 ----a-w- C:\Windows\SysWow64\mshtml.tlb

    2012-10-03 17:56:54 1914248 ----a-w- C:\Windows\System32\drivers\tcpip.sys

    2012-10-03 17:44:21 70656 ----a-w- C:\Windows\System32\nlaapi.dll

    2012-10-03 17:44:21 303104 ----a-w- C:\Windows\System32\nlasvc.dll

    2012-10-03 17:44:17 246272 ----a-w- C:\Windows\System32\netcorehc.dll

    2012-10-03 17:44:17 18944 ----a-w- C:\Windows\System32\netevent.dll

    2012-10-03 17:44:16 216576 ----a-w- C:\Windows\System32\ncsi.dll

    2012-10-03 17:42:16 569344 ----a-w- C:\Windows\System32\iphlpsvc.dll

    2012-10-03 16:42:24 18944 ----a-w- C:\Windows\SysWow64\netevent.dll

    2012-10-03 16:42:24 175104 ----a-w- C:\Windows\SysWow64\netcorehc.dll

    2012-10-03 16:42:23 156672 ----a-w- C:\Windows\SysWow64\ncsi.dll

    2012-10-03 16:07:26 45568 ----a-w- C:\Windows\System32\drivers\tcpipreg.sys

    2012-09-14 19:19:29 2048 ----a-w- C:\Windows\System32\tzres.dll

    2012-09-14 18:28:53 2048 ----a-w- C:\Windows\SysWow64\tzres.dll

    .

    ============= FINISH: 11:24:54.68 ===============

Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.