Naveed99

Thank you very much Mr Charlie. All the issues have been resolved and I am much safe and secure to use my machine now. I highly appreciate your time and advice, If your support was not availed I would have been looking to buy a new installation and lost all my data, plus also I could be a victim of identity theft. ( You saved me from facing all this). Best Regards.

Also the Adobe reader is being shown out of date but when I open the reader and click on help--check for updates : it says that no updates are available. where can I install the updates ? and how can I find them if Adobe itself is saying that '' No updates are available''

Thanks have done that, Just few final things : 1. Cant uninstall Security check as I try to run and it just does the scan and doesn't give me an option to uninstall it. 2. Cant find Combofix, RK_Quarantine folder, C:\FRST, MBAR and AdwCleaner... to uninstall them. 3. Google chrome has got two extensions, which I deleted before one is of U-Torrent and the other is Divx extension, can I just disable/delete them from going in settings of Chrome ? 4. I would like to use the extension for blocking adverts in Google, is it safe to re-install it, as I cant see the spam blocker icon in Chrome now. 5. Should I, carry on using MSE and MBAM or there are any other more safer softwares available for the virus and malware protection ? 6. I know the person who posted a fake file on youtube and his description link brought me to a new page where I downloaded file and ended up here, should I, post the link of that website here, so that users could be notified about it ?

Adw Cleaner log file : # AdwCleaner v2.104 - Logfile created 12/30/2012 at 22:59:15 # Updated 29/12/2012 by Xplode # Operating system : Windows 7 Home Premium Service Pack 1 (64 bits) # User : S M Naveed - SMNAVEED-PC # Boot Mode : Normal # Running from : C:\Users\S M Naveed\Desktop\adwcleaner.exe # Option [Delete] ***** [services] ***** ***** [Files / Folders] ***** Folder Deleted : C:\ProgramData\InstallMate Folder Deleted : C:\Users\S M Naveed\AppData\Local\Conduit Folder Deleted : C:\Users\S M Naveed\AppData\LocalLow\boost_interprocess Folder Deleted : C:\Users\S M Naveed\AppData\LocalLow\Conduit Folder Deleted : C:\Users\S M Naveed\AppData\Roaming\OpenCandy ***** [Registry] ***** Key Deleted : HKCU\Software\1ClickDownload Key Deleted : HKCU\Software\AppDataLow\Software\SmartBar Key Deleted : HKCU\Software\Conduit Key Deleted : HKCU\Software\ilivid Key Deleted : HKCU\Software\Softonic Key Deleted : HKCU\Software\SweetIM Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{006EE092-9658-4FD6-BD8E-A21A348E59F5} Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{EEE6C360-6118-11DC-9C72-001320C79847} Key Deleted : HKLM\Software\Babylon Key Deleted : HKLM\SOFTWARE\Classes\AppID\{09C554C3-109B-483C-A06B-F14172F1A947} Key Deleted : HKLM\SOFTWARE\Classes\AppID\{5B1881D1-D9C7-46DF-B041-1E593282C7D0} Key Deleted : HKLM\SOFTWARE\Classes\AppID\{BDB69379-802F-4EAF-B541-F8DE92DD98DB} Key Deleted : HKLM\SOFTWARE\Classes\AppID\{EA28B360-05E0-4F93-8150-02891F1D8D3C} Key Deleted : HKLM\SOFTWARE\Classes\AppID\escort.DLL Key Deleted : HKLM\SOFTWARE\Classes\Prod.cap Key Deleted : HKLM\SOFTWARE\Classes\Toolbar.CT2704262 Key Deleted : HKLM\SOFTWARE\Classes\Toolbar.CT3220468 Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{9C049BA6-EA47-4AC3-AED6-A66D8DC9E1D8} Key Deleted : HKLM\Software\Conduit Key Deleted : HKLM\Software\Iminent Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\iLividSetupV1_RASAPI32 Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\iLividSetupV1_RASMANCS Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\MyBabylontb_RASAPI32 Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\MyBabylontb_RASMANCS Key Deleted : HKLM\Software\SweetIM Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{3C471948-F874-49F5-B338-4F214A2EE0B1} Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{AE07101B-46D4-4A98-AF68-0333EA26E113} Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{E46C8196-B634-44A1-AF6E-957C64278AB1} Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217} Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{813A22E0-3E2B-4188-9BDA-ECA9878B8D48} Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC} Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{BCFF5F55-6F44-11D2-86F8-00104B265ED5} Key Deleted : HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\jcdgjdiieiljkfkdcloehkohchhpekkn Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{006EE092-9658-4FD6-BD8E-A21A348E59F5} Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{EEE6C360-6118-11DC-9C72-001320C79847} Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{AE07101B-46D4-4A98-AF68-0333EA26E113} Key Deleted : HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217} Key Deleted : HKLM\SOFTWARE\Classes\Interface\{79FB5FC8-44B9-4AF5-BADD-CCE547F953E5} Key Deleted : HKLM\SOFTWARE\Classes\Interface\{813A22E0-3E2B-4188-9BDA-ECA9878B8D48} Key Deleted : HKLM\SOFTWARE\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC} Key Deleted : HKLM\SOFTWARE\Classes\Interface\{BCFF5F55-6F44-11D2-86F8-00104B265ED5} Value Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar [{AE07101B-46D4-4A98-AF68-0333EA26E113}] Value Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{AE07101B-46D4-4A98-AF68-0333EA26E113}] ***** [internet Browsers] ***** -\\ Internet Explorer v9.0.8112.16457 Replaced : [HKCU\Software\Microsoft\Internet Explorer\Search - Default_Search_URL] = hxxp://feed.helperbar.com/?publisher=OPENCANDY&dpid=OPENCANDYAPRIL&co=GB&userid=7dd9212d-bb7e-4f1e-b66c-38098f342e76&affid=111585&searchtype=ds&babsrc=lnkry&q={searchTerms} --> hxxp://www.google.com Replaced : [HKCU\Software\Microsoft\Internet Explorer\Search - SearchAssistant] = hxxp://feed.helperbar.com/?publisher=OPENCANDY&dpid=OPENCANDYAPRIL&co=GB&userid=7dd9212d-bb7e-4f1e-b66c-38098f342e76&affid=111585&searchtype=ds&babsrc=lnkry&q={searchTerms} --> hxxp://www.google.com -\\ Mozilla Firefox v17.0.1 (en-US) File : C:\Users\S M Naveed\AppData\Roaming\Mozilla\Firefox\Profiles\pqhsf9ns.default\prefs.js [OK] File is clean. -\\ Google Chrome v23.0.1271.97 File : C:\Users\S M Naveed\AppData\Local\Google\Chrome\User Data\Default\Preferences [OK] File is clean. -\\ Chromium v _signature: D/g4au/hHzdTPkvdCONl6+cTzuX0ou7bFxopm9tIyIg= File : C:\Users\S M Naveed\AppData\Local\Chromium\User Data\Default\Preferences [OK] File is clean. ************************* AdwCleaner[R1].txt - [5491 octets] - [30/12/2012 22:42:45] AdwCleaner[R2].txt - [5551 octets] - [30/12/2012 22:59:04] AdwCleaner[s1].txt - [5366 octets] - [30/12/2012 22:59:15] ########## EOF - C:\AdwCleaner[s1].txt - [5426 octets] ########## _______________________________________________________________ Security Check Log : Results of screen317's Security Check version 0.99.56 Windows 7 Service Pack 1 x64 (UAC is enabled) Internet Explorer 9 ``````````````Antivirus/Firewall Check:`````````````` Windows Firewall Enabled! Microsoft Security Essentials Antivirus up to date! `````````Anti-malware/Other Utilities Check:````````` Malwarebytes Anti-Malware version 1.70.0.1100 Java 7 Update 10 Java version out of Date! Adobe Flash Player 11.5.502.135 Adobe Reader 10.1.4 Adobe Reader out of Date! Mozilla Firefox (17.0.1) Google Chrome 21.0.1180.83 Google Chrome 21.0.1180.89 Google Chrome 22.0.1229.79 Google Chrome 22.0.1229.92 Google Chrome 22.0.1229.94 Google Chrome 23.0.1271.64 Google Chrome 23.0.1271.91 Google Chrome 23.0.1271.95 Google Chrome 23.0.1271.97 ````````Process Check: objlist.exe by Laurent```````` Microsoft Security Essentials MSMpEng.exe Microsoft Security Essentials msseces.exe Malwarebytes Anti-Malware mbamservice.exe Malwarebytes Anti-Malware mbamgui.exe Malwarebytes' Anti-Malware mbamscheduler.exe `````````````````System Health check````````````````` Total Fragmentation on Drive C: 0% ````````````````````End of Log``````````````````````

Hi, Below is the log, I don't want to keep any of these listed files, tool bars, You are good to kill them. (Kindly have a look on my second last post) # AdwCleaner v2.104 - Logfile created 12/30/2012 at 22:42:45 # Updated 29/12/2012 by Xplode # Operating system : Windows 7 Home Premium Service Pack 1 (64 bits) # User : S M Naveed - SMNAVEED-PC # Boot Mode : Normal # Running from : C:\Users\S M Naveed\Desktop\adwcleaner.exe # Option [search] ***** [services] ***** ***** [Files / Folders] ***** Folder Found : C:\ProgramData\InstallMate Folder Found : C:\Users\S M Naveed\AppData\Local\Conduit Folder Found : C:\Users\S M Naveed\AppData\LocalLow\boost_interprocess Folder Found : C:\Users\S M Naveed\AppData\LocalLow\Conduit Folder Found : C:\Users\S M Naveed\AppData\Roaming\OpenCandy ***** [Registry] ***** Key Found : HKCU\Software\1ClickDownload Key Found : HKCU\Software\AppDataLow\Software\SmartBar Key Found : HKCU\Software\Conduit Key Found : HKCU\Software\ilivid Key Found : HKCU\Software\Softonic Key Found : HKCU\Software\SweetIM Key Found : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{006EE092-9658-4FD6-BD8E-A21A348E59F5} Key Found : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{EEE6C360-6118-11DC-9C72-001320C79847} Key Found : HKLM\Software\Babylon Key Found : HKLM\SOFTWARE\Classes\AppID\{09C554C3-109B-483C-A06B-F14172F1A947} Key Found : HKLM\SOFTWARE\Classes\AppID\{5B1881D1-D9C7-46DF-B041-1E593282C7D0} Key Found : HKLM\SOFTWARE\Classes\AppID\{BDB69379-802F-4EAF-B541-F8DE92DD98DB} Key Found : HKLM\SOFTWARE\Classes\AppID\{EA28B360-05E0-4F93-8150-02891F1D8D3C} Key Found : HKLM\SOFTWARE\Classes\AppID\escort.DLL Key Found : HKLM\SOFTWARE\Classes\Prod.cap Key Found : HKLM\SOFTWARE\Classes\Toolbar.CT2704262 Key Found : HKLM\SOFTWARE\Classes\Toolbar.CT3220468 Key Found : HKLM\SOFTWARE\Classes\TypeLib\{9C049BA6-EA47-4AC3-AED6-A66D8DC9E1D8} Key Found : HKLM\Software\Conduit Key Found : HKLM\Software\Iminent Key Found : HKLM\SOFTWARE\Microsoft\Tracing\iLividSetupV1_RASAPI32 Key Found : HKLM\SOFTWARE\Microsoft\Tracing\iLividSetupV1_RASMANCS Key Found : HKLM\SOFTWARE\Microsoft\Tracing\MyBabylontb_RASAPI32 Key Found : HKLM\SOFTWARE\Microsoft\Tracing\MyBabylontb_RASMANCS Key Found : HKLM\Software\SweetIM Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{3C471948-F874-49F5-B338-4F214A2EE0B1} Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{AE07101B-46D4-4A98-AF68-0333EA26E113} Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{E46C8196-B634-44A1-AF6E-957C64278AB1} Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217} Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{813A22E0-3E2B-4188-9BDA-ECA9878B8D48} Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC} Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{BCFF5F55-6F44-11D2-86F8-00104B265ED5} Key Found : HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\jcdgjdiieiljkfkdcloehkohchhpekkn Key Found : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{006EE092-9658-4FD6-BD8E-A21A348E59F5} Key Found : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{EEE6C360-6118-11DC-9C72-001320C79847} Key Found : HKLM\SOFTWARE\Classes\CLSID\{AE07101B-46D4-4A98-AF68-0333EA26E113} Key Found : HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217} Key Found : HKLM\SOFTWARE\Classes\Interface\{79FB5FC8-44B9-4AF5-BADD-CCE547F953E5} Key Found : HKLM\SOFTWARE\Classes\Interface\{813A22E0-3E2B-4188-9BDA-ECA9878B8D48} Key Found : HKLM\SOFTWARE\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC} Key Found : HKLM\SOFTWARE\Classes\Interface\{BCFF5F55-6F44-11D2-86F8-00104B265ED5} Key Found : HKU\S-1-5-21-2314083050-1812539920-3202108154-1000\Software\Microsoft\Internet Explorer\SearchScopes\{006EE092-9658-4FD6-BD8E-A21A348E59F5} Key Found : HKU\S-1-5-21-2314083050-1812539920-3202108154-1000\Software\Microsoft\Internet Explorer\SearchScopes\{EEE6C360-6118-11DC-9C72-001320C79847} Value Found : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar [{AE07101B-46D4-4A98-AF68-0333EA26E113}] Value Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{AE07101B-46D4-4A98-AF68-0333EA26E113}] ***** [internet Browsers] ***** -\\ Internet Explorer v9.0.8112.16457 [HKCU\Software\Microsoft\Internet Explorer\Search - Default_Search_URL] = hxxp://feed.helperbar.com/?publisher=OPENCANDY&dpid=OPENCANDYAPRIL&co=GB&userid=7dd9212d-bb7e-4f1e-b66c-38098f342e76&affid=111585&searchtype=ds&babsrc=lnkry&q={searchTerms} [HKCU\Software\Microsoft\Internet Explorer\Search - SearchAssistant] = hxxp://feed.helperbar.com/?publisher=OPENCANDY&dpid=OPENCANDYAPRIL&co=GB&userid=7dd9212d-bb7e-4f1e-b66c-38098f342e76&affid=111585&searchtype=ds&babsrc=lnkry&q={searchTerms} -\\ Mozilla Firefox v17.0.1 (en-US) File : C:\Users\S M Naveed\AppData\Roaming\Mozilla\Firefox\Profiles\pqhsf9ns.default\prefs.js [OK] File is clean. -\\ Google Chrome v23.0.1271.97 File : C:\Users\S M Naveed\AppData\Local\Google\Chrome\User Data\Default\Preferences [OK] File is clean. -\\ Chromium v _signature: D/g4au/hHzdTPkvdCONl6+cTzuX0ou7bFxopm9tIyIg= File : C:\Users\S M Naveed\AppData\Local\Chromium\User Data\Default\Preferences [OK] File is clean. ************************* AdwCleaner[R1].txt - [5380 octets] - [30/12/2012 22:42:45] ########## EOF - C:\AdwCleaner[R1].txt - [5440 octets] ########## _______________ Thanks

Hi, Just noticed that issue with regards to '' Windows security service center '' cannot be started has been RESOLVED. Now I am getting a message that windows defender is turned off I tried to turned it on and after 2/3 minutes a little window pops up saying that windows defender cannot be turned on. I looked for Microsoft support about this matter and have came to know following: ''Microsoft Security Essentials has its own built-in version of Defender and should automatically disables Vista's version of Windows Defender''. Though I am not using Windows Vista, I am using 7 home-premium but I am using Microsfot Security Essentials, so is the same rule being applied on windows 7 as well i.e. ''Microsoft Security Essentials has its own built-in version of Defender and should automatically disables Vista's version of Windows Defender''. ?

I am sorry, I failed to read the foot note on your last message which is regarding the ComboFix run and having trouble with the Google Chrome or any explorer's opening issue and popping message that: If you get the message Illegal operation attempted on registry key that has been marked fordeletion after you run ComboFix....please reboot the computer, this should resolve the problem. You may have to do this several times if needed. I have rebooted the system now and Chrome , Firefox plus IE all three are working fine. Below is the report of ComboFix: ComboFix 12-12-30.01 - S M Naveed 30/12/2012 21:04:08.1.4 - x64 Microsoft Windows 7 Home Premium 6.1.7601.1.1252.44.1033.18.2979.1566 [GMT 0:00] Running from: c:\users\S M Naveed\Desktop\ComboFix.exe AV: ESET NOD32 Antivirus 5.2 *Enabled/Updated* {77DEAFED-8149-104B-25A1-21771CA47CD1} SP: ESET NOD32 Antivirus 5.2 *Enabled/Updated* {CCBF4E09-A773-1FC5-1F11-1A056723366C} SP: Spybot - Search and Destroy *Enabled/Updated* {9BC38DF1-3CCA-732D-A930-C1CA5F20A4B0} SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . . c:\programdata\100 c:\programdata\5159734F10.sys c:\programdata\emopts.dat c:\programdata\msadoex.dll c:\programdata\Roaming C:\System c:\system\fastlaps.txt c:\users\S M Naveed\AppData\Local\Microsoft\Windows\Ardamax Keylogger Setup.exe c:\users\S M Naveed\AppData\Local\Microsoft\Windows\winupdate.exe c:\users\S M Naveed\AppData\Roaming\S M Naveedlog.dat c:\windows\~GLC0000.TMP c:\windows\~GLC0001.TMP c:\windows\~GLH0000.TMP c:\windows\~GLH0001.TMP c:\windows\SNMPAPI.DLL c:\windows\SysWow64\CTF c:\windows\SysWow64\drivers\npf.sys c:\windows\SysWow64\Packet.dll c:\windows\SysWow64\WanPacket.dll c:\windows\SysWow64\wpcap.dll c:\windows\wininit.ini c:\windows\WinRAR . . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . . -------\Service_NPF . . ((((((((((((((((((((((((( Files Created from 2012-11-28 to 2012-12-30 ))))))))))))))))))))))))))))))) . . 2012-12-30 20:12 . 2012-11-08 09:24 9125352 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{15B752F6-CCCE-49B2-A686-981C220A9E73}\mpengine.dll 2012-12-29 03:56 . 2012-12-14 16:49 24176 ----a-w- c:\windows\system32\drivers\mbam.sys 2012-12-29 01:37 . 2012-12-29 01:37 -------- d-----w- c:\users\S M Naveed\AppData\Roaming\SUPERAntiSpyware.com 2012-12-28 22:15 . 2012-12-28 22:15 972264 ------w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{7AEC934D-E713-4E29-BFD9-1A0C6C95597A}\gapaengine.dll 2012-12-28 22:15 . 2012-11-08 09:24 9125352 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll 2012-12-28 22:14 . 2012-12-28 22:14 -------- d-----w- c:\program files (x86)\Microsoft Security Client 2012-12-28 19:47 . 2012-11-08 17:24 9125352 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{FE31C3C7-CAE9-46E8-82BC-3CDC0FB60E2E}\mpengine.dll 2012-12-28 06:42 . 2012-12-28 22:14 -------- d-----w- c:\program files\Microsoft Security Client 2012-12-28 01:19 . 2012-12-28 01:19 -------- d-----w- c:\users\S M Naveed\AppData\Roaming\QFX Software 2012-12-28 01:19 . 2012-12-28 01:19 -------- d-----w- c:\programdata\QFX Software 2012-12-28 00:14 . 2012-12-28 00:53 -------- d-----w- c:\programdata\Spybot - Search & Destroy 2012-12-28 00:13 . 2012-12-28 00:13 -------- d-----w- c:\users\S M Naveed\AppData\Local\Programs 2012-12-28 00:03 . 2012-12-28 01:01 -------- d-----w- c:\programdata\SecTaskMan 2012-12-27 23:14 . 2012-12-27 23:14 -------- d-----w- c:\users\S M Naveed\AppData\Local\Welltek_Software 2012-12-27 19:31 . 2012-12-27 19:31 -------- d-----w- c:\program files (x86)\Ccleaner Business Edition x64 x86 Tom_Da_Man 2012-12-26 20:33 . 2012-12-27 02:19 -------- d-----w- c:\users\S M Naveed\AppData\Local\WMTools Downloaded Files 2012-12-20 20:26 . 2012-12-16 17:11 46080 ----a-w- c:\windows\system32\atmlib.dll 2012-12-20 20:26 . 2012-12-16 14:13 34304 ----a-w- c:\windows\SysWow64\atmlib.dll 2012-12-20 20:25 . 2012-12-16 14:45 367616 ----a-w- c:\windows\system32\atmfd.dll 2012-12-20 20:25 . 2012-12-16 14:13 295424 ----a-w- c:\windows\SysWow64\atmfd.dll 2012-12-20 04:42 . 2012-12-20 04:42 -------- d-----w- c:\users\S M Naveed\AppData\Roaming\Strongvault 2012-12-20 04:41 . 2012-12-20 04:41 -------- d-----w- c:\users\S M Naveed\AppData\Local\Stronghold_LLC 2012-12-20 04:41 . 2012-12-22 00:54 -------- d-sh--w- c:\windows\SysWow64\AI_RecycleBin 2012-12-20 04:40 . 2012-12-20 04:41 -------- d-----w- c:\programdata\Freemake 2012-12-20 04:39 . 2012-12-20 04:40 -------- d-----w- c:\program files (x86)\Freemake 2012-12-19 23:19 . 2012-12-19 23:19 -------- d-----w- c:\users\S M Naveed\AppData\Roaming\Softplicity 2012-12-19 23:18 . 2012-12-19 23:19 -------- d-----w- c:\program files (x86)\TotalAudioConverter 2012-12-19 23:10 . 2012-12-20 00:09 -------- d-----w- c:\users\S M Naveed\AppData\Roaming\WindSolutions 2012-12-19 23:10 . 2012-12-20 00:09 -------- d-----w- c:\programdata\WindSolutions 2012-12-19 05:19 . 2012-12-19 05:19 -------- d-----w- c:\program files (x86)\Common Files\Java 2012-12-19 05:19 . 2012-12-19 05:19 95184 ----a-w- c:\windows\SysWow64\WindowsAccessBridge-32.dll 2012-12-19 05:18 . 2012-12-19 05:18 -------- d-----w- c:\program files (x86)\Java 2012-12-19 02:12 . 2012-12-19 05:25 -------- d-----w- c:\users\S M Naveed\AppData\Roaming\Apple Computer 2012-12-19 02:12 . 2012-12-19 02:12 -------- d-----w- c:\users\S M Naveed\AppData\Local\Apple Computer 2012-12-19 02:11 . 2012-08-21 13:01 33240 ----a-w- c:\windows\system32\drivers\GEARAspiWDM.sys 2012-12-19 02:10 . 2012-12-19 02:10 -------- d-----w- c:\program files\iPod 2012-12-19 02:10 . 2012-12-19 02:11 -------- d-----w- c:\programdata\34BE82C4-E596-4e99-A191-52C6199EBF69 2012-12-19 02:10 . 2012-12-19 02:11 -------- d-----w- c:\program files\iTunes 2012-12-19 02:10 . 2012-12-19 02:11 -------- d-----w- c:\program files (x86)\iTunes 2012-12-19 02:10 . 2012-12-19 02:10 -------- d-----w- c:\programdata\Apple Computer 2012-12-19 02:08 . 2012-12-19 02:08 -------- d-----w- c:\users\S M Naveed\AppData\Local\Apple 2012-12-19 02:07 . 2012-12-19 02:08 -------- d-----w- c:\program files (x86)\Apple Software Update 2012-12-19 02:07 . 2012-12-19 02:07 -------- d-----w- c:\program files\Common Files\Apple 2012-12-19 02:07 . 2012-12-19 02:07 -------- d-----w- c:\program files\Bonjour 2012-12-19 02:07 . 2012-12-19 02:07 -------- d-----w- c:\program files (x86)\Bonjour 2012-12-19 02:06 . 2012-12-19 02:10 -------- d-----w- c:\program files (x86)\Common Files\Apple 2012-12-19 02:06 . 2012-12-19 02:07 -------- d-----w- c:\programdata\Apple 2012-12-19 01:21 . 2012-12-19 01:36 -------- d-----w- c:\program files (x86)\Total Video Converter 2012-12-17 22:16 . 2012-12-17 22:16 -------- d-----w- c:\users\S M Naveed\dwhelper 2012-12-17 22:07 . 2012-12-17 22:07 -------- d-----w- c:\users\S M Naveed\AppData\Local\Macromedia 2012-12-17 22:05 . 2012-12-17 22:05 -------- d-----w- c:\program files (x86)\Mozilla Maintenance Service 2012-12-14 22:59 . 2012-12-14 22:59 -------- d-----w- c:\program files (x86)\PhotoScape 2012-12-12 19:55 . 2012-11-02 05:59 478208 ----a-w- c:\windows\system32\dpnet.dll 2012-12-12 19:55 . 2012-11-02 05:11 376832 ----a-w- c:\windows\SysWow64\dpnet.dll 2012-12-01 05:04 . 2012-12-01 05:04 -------- d-----w- c:\program files (x86)\Intelore . . . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2012-12-27 20:32 . 2011-12-16 00:51 231376 ----a-w- c:\windows\system32\drivers\truecrypt.sys 2012-12-19 05:18 . 2011-11-09 20:26 779704 ----a-w- c:\windows\SysWow64\deployJava1.dll 2012-12-13 03:06 . 2011-11-10 23:52 67413224 ----a-w- c:\windows\system32\MRT.exe 2012-12-12 19:57 . 2012-04-06 18:04 697272 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe 2012-12-12 19:57 . 2011-11-09 20:29 73656 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl 2012-11-13 20:29 . 2012-11-13 20:29 354216 ----a-w- c:\windows\SysWow64\DivXControlPanelApplet.cpl 2012-10-19 19:53 . 2012-10-19 19:53 163056 ----a-w- c:\programdata\Microsoft\Windows\Sqm\Manifest\Sqm10142.bin 2012-10-16 08:38 . 2012-11-27 19:51 135168 ----a-w- c:\windows\apppatch\AppPatch64\AcXtrnal.dll 2012-10-16 08:38 . 2012-11-27 19:51 350208 ----a-w- c:\windows\apppatch\AppPatch64\AcLayers.dll 2012-10-16 07:39 . 2012-11-27 19:51 561664 ----a-w- c:\windows\apppatch\AcLayers.dll 2012-10-09 18:17 . 2012-11-13 20:48 55296 ----a-w- c:\windows\system32\dhcpcsvc6.dll 2012-10-09 18:17 . 2012-11-13 20:48 226816 ----a-w- c:\windows\system32\dhcpcore6.dll 2012-10-09 17:40 . 2012-11-13 20:48 44032 ----a-w- c:\windows\SysWow64\dhcpcsvc6.dll 2012-10-09 17:40 . 2012-11-13 20:48 193536 ----a-w- c:\windows\SysWow64\dhcpcore6.dll 2012-10-04 16:40 . 2012-12-12 19:56 44032 ----a-w- c:\windows\apppatch\acwow64.dll 2012-10-03 17:56 . 2012-11-13 20:45 1914248 ----a-w- c:\windows\system32\drivers\tcpip.sys 2012-10-03 17:44 . 2012-11-13 20:45 303104 ----a-w- c:\windows\system32\nlasvc.dll 2012-10-03 17:44 . 2012-11-13 20:45 70656 ----a-w- c:\windows\system32\nlaapi.dll 2012-10-03 17:44 . 2012-11-13 20:45 246272 ----a-w- c:\windows\system32\netcorehc.dll 2012-10-03 17:44 . 2012-11-13 20:45 18944 ----a-w- c:\windows\system32\netevent.dll 2012-10-03 17:44 . 2012-11-13 20:45 216576 ----a-w- c:\windows\system32\ncsi.dll 2012-10-03 17:42 . 2012-11-13 20:45 569344 ----a-w- c:\windows\system32\iphlpsvc.dll 2012-10-03 16:42 . 2012-11-13 20:45 18944 ----a-w- c:\windows\SysWow64\netevent.dll 2012-10-03 16:42 . 2012-11-13 20:45 175104 ----a-w- c:\windows\SysWow64\netcorehc.dll 2012-10-03 16:42 . 2012-11-13 20:45 156672 ----a-w- c:\windows\SysWow64\ncsi.dll 2012-10-03 16:07 . 2012-11-13 20:45 45568 ----a-w- c:\windows\system32\drivers\tcpipreg.sys . . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NokiaSuite.exe"="c:\program files (x86)\Nokia\Nokia Suite\NokiaSuite.exe" [2012-10-13 1088424] . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] "Dell Webcam Central"="c:\program files (x86)\Dell Webcam\Dell Webcam Central\WebcamDell2.exe" [2010-08-19 487562] "IAStorIcon"="c:\program files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe" [2010-11-06 283160] "NUSB3MON"="c:\program files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe" [2010-11-17 113288] "RoxWatchTray"="c:\program files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxWatchTray12OEM.exe" [2010-11-25 240112] "Desktop Disc Tool"="c:\program files (x86)\Roxio\OEM\Roxio Burn\RoxioBurnLauncher.exe" [2010-11-17 514544] "Dell Registration"="c:\program files (x86)\System Registration\prodreg.exe" [2010-08-23 3926528] "Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe" [2012-07-27 35768] "Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-07-27 919008] "PWRISOVM.EXE"="c:\program files (x86)\PowerISO\PWRISOVM.EXE" [2007-08-07 200704] "DivXMediaServer"="c:\program files (x86)\DivX\DivX Media Server\DivXMediaServer.exe" [2012-11-13 450560] "DivXUpdate"="c:\program files (x86)\DivX\DivX Update\DivXUpdate.exe" [2012-11-01 1263512] "APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-11-28 59280] "iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2012-12-12 152544] "SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2012-07-03 252848] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorUser"= 3 (0x3) "EnableUIADesktopToggle"= 0 (0x0) "ConsentPromptBehaviorAdmin"= 5 (0x5) . [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system] "EnableLUA"= 0 (0x0) . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32] "mixer"=wdmaud.drv . [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager] BootExecute REG_MULTI_SZ autocheck autochk *\0\0sdnclean64.exe . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS] @="" . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc] @="Service" . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys] @="Driver" . [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusDisableNotify"="0" . R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576] R2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2012-12-14 682344] R2 RoxWatch12;Roxio Hard Drive Watcher 12;c:\program files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxWatch12OEM.exe [2010-11-25 219632] R3 massfilter;ZTE Mass Storage Filter Driver;c:\windows\system32\drivers\massfilter.sys [x] R3 MyWiFiDHCPDNS;Wireless PAN DHCP Server;c:\program files\Intel\WiFi\bin\PanDhcpDns.exe [2010-12-17 340240] R3 Netaapl;Apple Mobile Device Ethernet Service;c:\windows\system32\DRIVERS\netaapl64.sys [2012-03-26 22528] R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys [2012-08-30 128456] R3 NisSrv;Microsoft Network Inspection;c:\program files\Microsoft Security Client\NisSrv.exe [2012-09-12 368896] R3 nmwcdnsucx64;Nokia USB Flashing Generic;c:\windows\system32\drivers\nmwcdnsucx64.sys [2012-06-11 12800] R3 nmwcdnsux64;Nokia USB Flashing Phone Parent;c:\windows\system32\drivers\nmwcdnsux64.sys [2012-06-11 171008] R3 ose64;Office 64 Source Engine;c:\program files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2010-01-09 174440] R3 RoxMediaDB12OEM;RoxMediaDB12OEM;c:\program files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxMediaDB12OEM.exe [2010-11-25 1116656] R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUStor.sys [2010-10-30 250984] R3 SWNC8U80;Sierra Wireless MUX NDIS Driver (UMTS80);c:\windows\system32\DRIVERS\swnc8u80.sys [2008-05-20 199168] R3 SWUMX80;Sierra Wireless USB MUX Driver (UMTS80);c:\windows\system32\DRIVERS\swumx80.sys [2008-05-20 192256] R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-21 59392] R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [2010-11-21 31232] R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [2012-09-28 53760] R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2011-11-11 1255736] R3 ZTEusbnet;ZTE USB-NDIS miniport;c:\windows\system32\DRIVERS\ZTEusbnet.sys [2009-07-21 135168] R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-22 57184] S0 PxHlpa64;PxHlpa64;c:\windows\System32\Drivers\PxHlpa64.sys [2010-03-19 55856] S0 sptd;sptd;c:\windows\\SystemRoot\System32\Drivers\sptd.sys [x] S2 AESTFilters;Andrea ST Filters Service;c:\program files\IDT\WDM\AESTSr64.exe [2009-03-03 89600] S2 Bluetooth Device Monitor;Bluetooth Device Monitor;c:\program files (x86)\Intel\Bluetooth\devmonsrv.exe [2010-11-03 897088] S2 FlexService;Remote Connections Service;c:\program files (x86)\RapidBIT\cisvc.exe [2009-05-17 41984] S2 IAStorDataMgrSvc;Intel® Rapid Storage Technology;c:\program files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe [2010-11-06 13336] S2 MBAMScheduler;MBAMScheduler;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [2012-12-14 398184] S2 TeamViewer8;TeamViewer 8;c:\program files (x86)\TeamViewer\Version8\TeamViewer_Service.exe [2012-12-14 3467768] S2 UNS;Intel® Management and Security Application User Notification Service;c:\program files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe [2010-10-06 2655768] S3 btmaux;Intel Bluetooth Auxiliary Service;c:\windows\system32\DRIVERS\btmaux.sys [2010-11-04 58128] S3 btmhsf;btmhsf;c:\windows\system32\DRIVERS\btmhsf.sys [2010-10-19 274432] S3 CtClsFlt;Creative Camera Class Upper Filter Driver;c:\windows\system32\DRIVERS\CtClsFlt.sys [2010-08-12 175168] S3 iBtFltCoex;iBtFltCoex;c:\windows\system32\DRIVERS\iBtFltCoex.sys [2010-11-04 59904] S3 IntcDAud;Intel® Display Audio;c:\windows\system32\DRIVERS\IntcDAud.sys [2010-10-15 317440] S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2012-12-14 24176] S3 nusb3hub;Renesas Electronics USB 3.0 Hub Driver;c:\windows\system32\DRIVERS\nusb3hub.sys [2010-12-10 80384] S3 nusb3xhc;Renesas Electronics USB 3.0 Host Controller Driver;c:\windows\system32\DRIVERS\nusb3xhc.sys [2010-12-10 181248] S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [2010-10-26 406632] S3 swivsp;AC8xx Virtual Serial Port;c:\windows\system32\DRIVERS\swivspnt.sys [2007-03-26 23552] S3 wdkmd;Intel WiDi KMD;c:\windows\system32\DRIVERS\WDKMD.sys [2010-12-01 42392] . . --- Other Services/Drivers In Memory --- . *NewlyCreated* - WS2IFSL . Contents of the 'Scheduled Tasks' folder . 2012-12-30 c:\windows\Tasks\Adobe Flash Player Updater.job - c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-06 19:57] . 2012-12-30 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-01-26 04:05] . 2012-12-30 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-01-26 04:05] . 2012-12-29 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2314083050-1812539920-3202108154-1000Core.job - c:\users\S M Naveed\AppData\Local\Google\Update\GoogleUpdate.exe [2012-08-10 02:17] . 2012-12-30 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2314083050-1812539920-3202108154-1000UA.job - c:\users\S M Naveed\AppData\Local\Google\Update\GoogleUpdate.exe [2012-08-10 02:17] . 2012-12-16 c:\windows\Tasks\PCDoctorBackgroundMonitorTask.job - c:\program files\Dell Support Center\uaclauncher.exe [2011-10-06 20:32] . 2012-12-30 c:\windows\Tasks\SystemToolsDailyTest.job - c:\program files\Dell Support Center\uaclauncher.exe [2011-10-06 20:32] . . --------- X64 Entries ----------- . . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveBlacklistedOverlay] @="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42}" [HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42}] 2012-11-08 16:58 755224 ----a-w- c:\program files (x86)\Google\Drive\googledrivesync64.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSharedOverlay] @="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D43}" [HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D43}] 2012-11-08 16:58 755224 ----a-w- c:\program files (x86)\Google\Drive\googledrivesync64.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSyncedOverlay] @="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40}" [HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40}] 2012-11-08 16:58 755224 ----a-w- c:\program files (x86)\Google\Drive\googledrivesync64.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSyncingOverlay] @="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41}" [HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41}] 2012-11-08 16:58 755224 ----a-w- c:\program files (x86)\Google\Drive\googledrivesync64.dll . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "IgfxTray"="c:\windows\system32\igfxtray.exe" [2011-03-30 167960] "HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2011-03-30 391704] "Persistence"="c:\windows\system32\igfxpers.exe" [2011-03-30 418840] "SysTrayApp"="c:\program files\IDT\WDM\sttray64.exe" [2011-01-25 525312] "Apoint"="c:\program files\DellTPad\Apoint.exe" [2011-04-12 609144] "IntelWireless"="c:\program files\Common Files\Intel\WirelessCommon\iFrmewrk.exe" [2010-12-17 1933584] "BTMTrayAgent"="c:\program files (x86)\Intel\Bluetooth\btmshell.dll" [2010-11-03 10228224] "DellStage"="c:\program files (x86)\Dell Stage\Dell Stage\stage_primary.exe" [2011-01-25 1802472] "itype"="c:\program files\Microsoft IntelliType Pro\itype.exe" [2011-08-10 1873256] "Windows Mobile Device Center"="c:\windows\WindowsMobile\wmdc.exe" [2007-05-31 660360] "Windows Mobile-based device management"="c:\windows\WindowsMobile\wmdc.exe" [2007-05-31 660360] "BCSSync"="c:\program files\Microsoft Office\Office14\BCSSync.exe" [2010-03-13 112512] "MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2012-09-12 1289704] . ------- Supplementary Scan ------- . uLocal Page = c:\windows\system32\blank.htm uStart Page = mLocal Page = c:\windows\SysWOW64\blank.htm uInternet Settings,ProxyOverride = <local>;*.local uSearchAssistant = hxxp://feed.helperbar.com/?publisher=OPENCANDY&dpid=OPENCANDYAPRIL&co=GB&userid=7dd9212d-bb7e-4f1e-b66c-38098f342e76&affid=111585&searchtype=ds&babsrc=lnkry&q={searchTerms} IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~1\Office14\EXCEL.EXE/3000 IE: Se&nd to OneNote - c:\progra~2\MICROS~1\Office14\ONBttnIE.dll/105 TCP: DhcpNameServer = 192.168.1.254 TCP: Interfaces\{C4FE17F4-E75C-4F22-B042-7C68441C8C8F}: NameServer = 8.8.8.8,8.8.4.4 TCP: Interfaces\{C4FE17F4-E75C-4F22-B042-7C68441C8C8F}\371617962602B68616E6: NameServer = 8.8.8.8,8.8.4.4 TCP: Interfaces\{C4FE17F4-E75C-4F22-B042-7C68441C8C8F}\4516C6B64516C6B6532303: NameServer = 8.8.8.8,8.8.4.4 TCP: Interfaces\{C4FE17F4-E75C-4F22-B042-7C68441C8C8F}\642716762716E63656: NameServer = 8.8.8.8,8.8.4.4 TCP: Interfaces\{C4FE17F4-E75C-4F22-B042-7C68441C8C8F}\9446F62457479444F6E647: NameServer = 8.8.8.8,8.8.4.4 FF - ProfilePath - c:\users\S M Naveed\AppData\Roaming\Mozilla\Firefox\Profiles\pqhsf9ns.default\ FF - ExtSQL: 2012-11-16 04:43; {23fcfd51-4958-4f00-80a3-ae97e717ed8b}; c:\program files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5 FF - ExtSQL: 2012-12-17 22:13; {b9db16a4-6edc-47ec-a1f4-b86292ed211d}; c:\users\S M Naveed\AppData\Roaming\Mozilla\Firefox\Profiles\pqhsf9ns.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d} FF - ExtSQL: 2012-12-17 22:19; {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}; c:\users\S M Naveed\AppData\Roaming\Mozilla\Firefox\Profiles\pqhsf9ns.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi . - - - - ORPHANS REMOVED - - - - . URLSearchHooks-{7473b6bd-4691-4744-a82b-7854eb3d70b6} - (no file) Wow6432Node-HKCU-Run-Facebook Update - c:\users\S M Naveed\AppData\Local\Facebook\Update\FacebookUpdate.exe AddRemove-Adobe Shockwave Player - c:\windows\system32\Adobe\Shockwave 11\uninstaller.exe . . . --------------------- LOCKED REGISTRY KEYS --------------------- . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\windows\\system32\\Macromed\\Flash\\FlashUtil64_11_5_502_135_ActiveX.exe,-101" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation] "Enabled"=dword:00000001 . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32] @="c:\\windows\\system32\\Macromed\\Flash\\FlashUtil64_11_5_502_135_ActiveX.exe" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="IFlashBroker5" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_5_502_135_ActiveX.exe,-101" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation] "Enabled"=dword:00000001 . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32] @="c:\\windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_5_502_135_ActiveX.exe" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Shockwave Flash Object" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_5_502_135.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus] @="0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID] @="ShockwaveFlash.ShockwaveFlash.11" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_5_502_135.ocx, 1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="ShockwaveFlash.ShockwaveFlash" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Macromedia Flash Factory Object" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_5_502_135.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID] @="FlashFactory.FlashFactory.1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_5_502_135.ocx, 1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="FlashFactory.FlashFactory" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="IFlashBroker5" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\McAfee] "SymbolicLinkValue"=hex(6):5c,00,72,00,65,00,67,00,69,00,73,00,74,00,72,00,79, 00,5c,00,6d,00,61,00,63,00,68,00,69,00,6e,00,65,00,5c,00,53,00,6f,00,66,00,\ . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}] @Denied: (A) (Everyone) "Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3] @Denied: (A) (Everyone) . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0] "Key"="ActionsPane3" "Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd" . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows CE Services] "SymbolicLinkValue"=hex(6):5c,00,72,00,65,00,67,00,69,00,73,00,74,00,72,00,79, 00,5c,00,4d,00,41,00,43,00,48,00,49,00,4e,00,45,00,5c,00,53,00,4f,00,46,00,\ . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security] @Denied: (Full) (Everyone) . ------------------------ Other Running Processes ------------------------ . c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe c:\program files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe . ************************************************************************** . Completion time: 2012-12-30 21:31:42 - machine was rebooted ComboFix-quarantined-files.txt 2012-12-30 21:31 . Pre-Run: 188,268,494,848 bytes free Post-Run: 188,661,366,784 bytes free . - - End Of File - - 90F7C8A13ECAD268E42161432F4DA960 ______________ Many thanks

My Goodness just read the foot note

Many thanks for your help, I dont know how to post that ComboFix report from myiphone, Since it is saved on my system and chrome plus firefox are not opening there. What should I follow now ?

Hi, It has finished the scan and rebooted the system but now I cannot open google chrome or Firefox, when I click to open them the window doesnt open and a little window pop ups with following message: C:\users\S M Naveed\App Data\Local\Chrome\Application\Chrome.exe Illegal operation attempted on a registery key that has been marker for deletion. Sent frm iphone

Hi, I have already uninstalled ESET NOD32 and Spybot from my system two days ago. and at the moment I only have mbam and Microsoft security essentials which are disabled at the moment for the ComboFix to perform scan but I am still receiving following message whilst trying to run ComboFix: ComboFix has detected the following real times scanner(s) to be active: antivirus: ESET NOD32 Antivirus 5.2 antispyware: ESET NOD32 Antivirus 5.2 antispyware: Spybot - Search and Destroy Antivirus and intrusions prevention programs are known to interfere with ComboFix's running. This may lead to unpredictable results or possible machine damage. Please disable these scanners before clicking 'OK'. ______________________________________________ I clicked OK and below was the next message which appeared: Warning !!! antivirus: ESET NOD32 Antivirus 5.2 antispyware: ESET NOD32 Antivirus 5.2 antispyware: Spybot - Search and Destroy These above real time scanner(s) are still active but ComboFix shall continue to run. Kindly note that this is at your own risk. ''OK'' I clicked on X icon at the top right to close and stop the scanning but still a new blue window opened and started scanning but no sooner it started I clicked on the cross, on top right to close and it closed down and disappeared.

Rogue Killer report: RogueKiller V8.4.1 [Dec 28 2012] by Tigzy mail : tigzyRK<at>gmail<dot>com Feedback : http://www.geekstogo.com/forum/files/file/413-roguekiller/ Website : http://tigzy.geekstogo.com/roguekiller.php Blog : http://tigzyrk.blogspot.com/ Operating System : Windows 7 (6.1.7601 Service Pack 1) 64 bits version Started in : Normal mode User : S M Naveed [Admin rights] Mode : Scan -- Date : 12/30/2012 20:08:49 ¤¤¤ Bad processes : 0 ¤¤¤ ¤¤¤ Registry Entries : 5 ¤¤¤ [HJPOL] HKCU\[...]\System : DisableTaskMgr (0) -> FOUND [HJPOL] HKCU\[...]\System : DisableRegistryTools (0) -> FOUND [HJ] HKCU\[...]\System : EnableLUA (0) -> FOUND [HJ DESK] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> FOUND [HJ DESK] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND ¤¤¤ Particular Files / Folders: ¤¤¤ ¤¤¤ Driver : [NOT LOADED] ¤¤¤ ¤¤¤ HOSTS File: ¤¤¤ --> C:\windows\system32\drivers\etc\hosts ¤¤¤ MBR Check: ¤¤¤ +++++ PhysicalDrive0: WDC WD5000BPVT-75HXZT1 +++++ --- User --- [MBR] 2928d5df92ec4e876bd083063558990d [bSP] f6ffd7acb865219c12efc2eb06e726f9 : Windows 7/8 MBR Code Partition table: 0 - [XXXXXX] DELL-UTIL (0xde) [VISIBLE] Offset (sectors): 2048 | Size: 100 Mo 1 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 206848 | Size: 15000 Mo 2 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 30926848 | Size: 461838 Mo User = LL1 ... OK! User = LL2 ... OK! Finished : << RKreport[1]_S_12302012_02d2008.txt >> RKreport[1]_S_12302012_02d2008.txt

Malwarebytes Anti-Malware (PRO) 1.70.0.1100 www.malwarebytes.org Database version: v2012.12.29.02 Windows 7 Service Pack 1 x64 NTFS Internet Explorer 9.0.8112.16421 S M Naveed :: SMNAVEED-PC [administrator] Protection: Enabled 29/12/2012 04:03:18 mbam-log-2012-12-29 (04-03-18).txt Scan type: Full scan (C:\|D:\|) Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM Scan options disabled: P2P Objects scanned: 347720 Time elapsed: 1 hour(s), 7 minute(s), 47 second(s) Memory Processes Detected: 0 (No malicious items detected) Memory Modules Detected: 0 (No malicious items detected) Registry Keys Detected: 0 (No malicious items detected) Registry Values Detected: 0 (No malicious items detected) Registry Data Items Detected: 0 (No malicious items detected) Folders Detected: 0 (No malicious items detected) Files Detected: 0 (No malicious items detected) (end)

This log was after I updated to 1.70.mbam Malwarebytes Anti-Malware (PRO) 1.70.0.1100 www.malwarebytes.org Database version: v2012.12.30.08 Windows 7 Service Pack 1 x64 NTFS Internet Explorer 9.0.8112.16421 S M Naveed :: SMNAVEED-PC [administrator] Protection: Enabled 30/12/2012 18:48:50 mbam-log-2012-12-30 (18-48-50).txt Scan type: Full scan (C:\|D:\|) Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM Scan options disabled: P2P Objects scanned: 48881 Time elapsed: 7 minute(s), 30 second(s) [aborted] Memory Processes Detected: 0 (No malicious items detected) Memory Modules Detected: 0 (No malicious items detected) Registry Keys Detected: 0 (No malicious items detected) Registry Values Detected: 0 (No malicious items detected) Registry Data Items Detected: 0 (No malicious items detected) Folders Detected: 0 (No malicious items detected) Files Detected: 0 (No malicious items detected) (end)

Thanks, follwing are the mbam logs which I randomly did plus dds.text and attach,text Malwarebytes Anti-Malware (PRO) 1.60.1.1000 www.malwarebytes.org Database version: v2012.12.27.01 Windows 7 Service Pack 1 x64 NTFS Internet Explorer 9.0.8112.16421 S M Naveed :: SMNAVEED-PC [administrator] Protection: Enabled 28/12/2012 01:36:47 mbam-log-2012-12-28 (01-36-47).txt Scan type: Full scan Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM Scan options disabled: P2P Objects scanned: 351596 Time elapsed: 1 hour(s), 5 minute(s), 8 second(s) Memory Processes Detected: 1 C:\Windupdt\winupdate.exe (Trojan.MSIL.Gen) -> 1320 -> Delete on reboot. Memory Modules Detected: 0 (No malicious items detected) Registry Keys Detected: 1 HKCU\Software\DC3_FEXEC (Malware.Trace) -> Quarantined and deleted successfully. Registry Values Detected: 1 HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|winupdater (Trojan.MSIL.Gen) -> Data: C:\Windupdt\winupdate.exe -> Quarantined and deleted successfully. Registry Data Items Detected: 3 HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System|DisableTaskMgr (PUM.Hijack.TaskManager) -> Bad: (1) Good: (0) -> Quarantined and repaired successfully. HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System|DisableRegistryTools (PUM.Hijack.Regedit) -> Bad: (1) Good: (0) -> Quarantined and repaired successfully. HKLM\SOFTWARE\Microsoft\Security Center|AntiVirusDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and repaired successfully. Folders Detected: 1 C:\Users\S M Naveed\AppData\Local\Temp\dclogs (Stolen.Data) -> Quarantined and deleted successfully. Files Detected: 4 C:\Windupdt\winupdate.exe (Trojan.MSIL.Gen) -> Delete on reboot. C:\$Recycle.Bin\S-1-5-21-2314083050-1812539920-3202108154-1000\$RBXO9P3.exe (RiskWare.Tool.CK) -> Quarantined and deleted successfully. C:\ProgramData\SUS\SUS.01 (Trojan.Ardamax) -> Quarantined and deleted successfully. C:\Users\S M Naveed\AppData\Local\Temp\dclogs\2012-12-28-6.dc (Stolen.Data) -> Quarantined and deleted successfully. (end) --------------------------------------------- Malwarebytes Anti-Malware (PRO) 1.60.1.1000 www.malwarebytes.org Database version: v2012.12.28.01 Windows 7 Service Pack 1 x64 NTFS Internet Explorer 9.0.8112.16421 S M Naveed :: SMNAVEED-PC [administrator] Protection: Enabled 28/12/2012 07:13:08 mbam-log-2012-12-28 (07-13-08).txt Scan type: Full scan Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM Scan options disabled: P2P Objects scanned: 350827 Time elapsed: 1 hour(s), 31 minute(s), 22 second(s) Memory Processes Detected: 0 (No malicious items detected) Memory Modules Detected: 0 (No malicious items detected) Registry Keys Detected: 0 (No malicious items detected) Registry Values Detected: 1 HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|winupdater (Backdoor.Agent) -> Data: C:\Windupdt\winupdate.exe -> Quarantined and deleted successfully. Registry Data Items Detected: 0 (No malicious items detected) Folders Detected: 0 (No malicious items detected) Files Detected: 0 (No malicious items detected) (end) _____________________________________ Malwarebytes Anti-Malware (PRO) 1.60.1.1000 www.malwarebytes.org Database version: v2012.12.28.01 Windows 7 Service Pack 1 x64 NTFS Internet Explorer 9.0.8112.16421 S M Naveed :: SMNAVEED-PC [administrator] Protection: Enabled 28/12/2012 19:33:13 mbam-log-2012-12-28 (19-33-13).txt Scan type: Full scan Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM Scan options disabled: P2P Objects scanned: 1869 Time elapsed: 53 second(s) [aborted] Memory Processes Detected: 0 (No malicious items detected) Memory Modules Detected: 0 (No malicious items detected) Registry Keys Detected: 0 (No malicious items detected) Registry Values Detected: 0 (No malicious items detected) Registry Data Items Detected: 0 (No malicious items detected) Folders Detected: 0 (No malicious items detected) Files Detected: 0 (No malicious items detected) (end) _______________________________ DDS (Ver_2012-11-20.01) - NTFS_AMD64 Internet Explorer: 9.0.8112.16457 BrowserJavaVersion: 10.10.2 Run by S M Naveed at 19:10:47 on 2012-12-30 Microsoft Windows 7 Home Premium 6.1.7601.1.1252.44.1033.18.2979.1054 [GMT 0:00] . AV: ESET NOD32 Antivirus 5.2 *Enabled/Updated* {77DEAFED-8149-104B-25A1-21771CA47CD1} SP: ESET NOD32 Antivirus 5.2 *Enabled/Updated* {CCBF4E09-A773-1FC5-1F11-1A056723366C} SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} SP: Spybot - Search and Destroy *Enabled/Updated* {9BC38DF1-3CCA-732D-A930-C1CA5F20A4B0} . ============== Running Processes =============== . C:\windows\system32\lsm.exe C:\windows\system32\svchost.exe -k DcomLaunch C:\windows\system32\svchost.exe -k RPCSS c:\Program Files\Microsoft Security Client\MsMpEng.exe C:\windows\System32\svchost.exe -k LocalServiceNetworkRestricted C:\windows\System32\svchost.exe -k LocalSystemNetworkRestricted C:\windows\system32\svchost.exe -k netsvcs C:\Program Files\IDT\WDM\STacSV64.exe C:\windows\system32\svchost.exe -k LocalService C:\windows\system32\svchost.exe -k NetworkService C:\windows\system32\WLANExt.exe C:\windows\System32\spoolsv.exe C:\windows\system32\svchost.exe -k LocalServiceNoNetwork C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe C:\Program Files\IDT\WDM\AESTSr64.exe C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\Program Files\Intel\WiFi\bin\EvtEng.exe C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe C:\windows\system32\svchost.exe -k imgsvc C:\Program Files (x86)\TeamViewer\Version8\TeamViewer_Service.exe C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe C:\windows\system32\wbem\unsecapp.exe C:\windows\system32\wbem\wmiprvse.exe C:\windows\system32\svchost.exe -k bthsvcs C:\windows\system32\svchost.exe -k NetworkServiceNetworkRestricted C:\windows\system32\taskhost.exe C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe C:\windows\system32\Dwm.exe C:\windows\Explorer.EXE C:\Windows\System32\hkcmd.exe C:\Windows\System32\igfxpers.exe C:\Program Files\IDT\WDM\sttray64.exe C:\Program Files\DellTPad\Apoint.exe C:\Program Files\Dell\QuickSet\quickset.exe C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe C:\Windows\System32\rundll32.exe C:\Program Files\Microsoft IntelliType Pro\itype.exe C:\Windows\WindowsMobile\wmdc.exe C:\Program Files\Microsoft Security Client\msseces.exe C:\Program Files (x86)\Nokia\Nokia Suite\NokiaSuite.exe C:\windows\system32\svchost.exe -k WindowsMobile C:\windows\system32\wbem\unsecapp.exe C:\Program Files\DellTPad\ApMsgFwd.exe C:\Program Files\DellTPad\HidFind.exe C:\Program Files\DellTPad\Apntex.exe C:\Program Files (x86)\Dell Webcam\Dell Webcam Central\WebcamDell2.exe C:\windows\system32\SearchIndexer.exe C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe C:\Program Files (x86)\Roxio\OEM\Roxio Burn\RoxioBurnLauncher.exe C:\Program Files (x86)\PowerISO\PWRISOVM.EXE C:\Program Files\Windows Media Player\wmpnetwk.exe C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe C:\Program Files (x86)\PC Connectivity Solution\ServiceLayer.exe C:\Program Files (x86)\PC Connectivity Solution\Transports\NclUSBSrv64.exe C:\Program Files (x86)\PC Connectivity Solution\Transports\NclMSBTSrvEx.exe C:\Program Files (x86)\iTunes\iTunesHelper.exe C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe C:\Program Files\iPod\bin\iPodService.exe C:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation C:\Program Files (x86)\RapidBIT\cidaemon.exe C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe C:\windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe C:\Users\S M Naveed\AppData\Local\Google\Chrome\Application\chrome.exe C:\Users\S M Naveed\AppData\Local\Google\Chrome\Application\chrome.exe C:\Users\S M Naveed\AppData\Local\Google\Chrome\Application\chrome.exe C:\Users\S M Naveed\AppData\Local\Google\Chrome\Application\chrome.exe C:\Users\S M Naveed\AppData\Local\Google\Chrome\Application\chrome.exe C:\Program Files (x86)\Java\jre7\bin\jp2launcher.exe C:\Program Files (x86)\Java\jre7\bin\java.exe C:\Program Files (x86)\Mozilla Firefox\firefox.exe C:\windows\system32\SearchProtocolHost.exe C:\windows\system32\SearchFilterHost.exe C:\windows\system32\wbem\wmiprvse.exe C:\windows\System32\cscript.exe . ============== Pseudo HJT Report =============== . uWindow Title = Windows Internet Explorer provided by MSN and Bing uSearch Bar = hxxp://feed.helperbar.com/?publisher=OPENCANDY&dpid=OPENCANDYAPRIL&co=GB&userid=7dd9212d-bb7e-4f1e-b66c-38098f342e76&affid=111585&searchtype=ds&babsrc=lnkry&q={searchTerms} uSearch Page = hxxp://feed.helperbar.com/?publisher=OPENCANDY&dpid=OPENCANDYAPRIL&co=GB&userid=7dd9212d-bb7e-4f1e-b66c-38098f342e76&affid=111585&searchtype=ds&babsrc=lnkry&q={searchTerms} uProxyOverride = <local>;*.local uSearchAssistant = hxxp://feed.helperbar.com/?publisher=OPENCANDY&dpid=OPENCANDYAPRIL&co=GB&userid=7dd9212d-bb7e-4f1e-b66c-38098f342e76&affid=111585&searchtype=ds&babsrc=lnkry&q={searchTerms} uURLSearchHooks: {7473b6bd-4691-4744-a82b-7854eb3d70b6} - <orphaned> mWinlogon: Userinit = userinit.exe, BHO: {02478D38-C3F9-4efb-9B51-7695ECA05670} - <orphaned> BHO: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll BHO: DivX Plus Web Player HTML5 <video>: {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files (x86)\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll BHO: Groove GFS Browser Helper: {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL BHO: Java Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll BHO: Office Document Cache Handler: {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL BHO: Java Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll TB: <No Name>: {ae07101b-46d4-4a98-af68-0333ea26e113} - LocalServer32 - <no file> uRun: [Facebook Update] "C:\Users\S M Naveed\AppData\Local\Facebook\Update\FacebookUpdate.exe" /c /nocrashserver uRun: [NokiaSuite.exe] C:\Program Files (x86)\Nokia\Nokia Suite\NokiaSuite.exe -tray mRun: [Dell Webcam Central] "C:\Program Files (x86)\Dell Webcam\Dell Webcam Central\WebcamDell2.exe" /mode2 mRun: [iAStorIcon] C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe mRun: [NUSB3MON] "C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe" mRun: [RoxWatchTray] "c:\Program Files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxWatchTray12OEM.exe" mRun: [Desktop Disc Tool] "c:\Program Files (x86)\Roxio\OEM\Roxio Burn\RoxioBurnLauncher.exe" mRun: [Dell Registration] C:\Program Files (x86)\System Registration\prodreg.exe /boot mRun: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe" mRun: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" mRun: [PWRISOVM.EXE] C:\Program Files (x86)\PowerISO\PWRISOVM.EXE mRun: [DivXMediaServer] C:\Program Files (x86)\DivX\DivX Media Server\DivXMediaServer.exe mRun: [DivXUpdate] "C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW mRun: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" mRun: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe" mRun: [sunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe" uPolicies-Explorer: NoDriveTypeAutoRun = dword:145 uPolicies-System: EnableLUA = dword:0 mPolicies-Explorer: NoActiveDesktop = dword:1 mPolicies-Explorer: NoActiveDesktopChanges = dword:1 mPolicies-System: ConsentPromptBehaviorUser = dword:3 mPolicies-System: EnableUIADesktopToggle = dword:0 mPolicies-System: ConsentPromptBehaviorAdmin = dword:5 IE: E&xport to Microsoft Excel - C:\PROGRA~2\MICROS~1\Office14\EXCEL.EXE/3000 IE: Se&nd to OneNote - C:\PROGRA~2\MICROS~1\Office14\ONBttnIE.dll/105 IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll IE: {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - {2EAF5BB0-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll IE: {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - {2EAF5BB0-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll IE: {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - {FFFDC614-B694-4AE6-AB38-5D6374584B52} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab DPF: {4871A87A-BFDD-4106-8153-FFDE2BAC2967} - hxxp://dlm.tools.akamai.com/dlmanager/versions/activex/dlm-activex-2.2.6.2.cab DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_07-windows-i586.cab DPF: {CAFEEFAC-0017-0000-0007-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_07-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_07-windows-i586.cab TCP: NameServer = 192.168.1.254 TCP: Interfaces\{7018303E-A653-4A05-A8A9-DD8362940348} : DHCPNameServer = 192.168.1.254 TCP: Interfaces\{907F1EA0-56E2-42BB-A686-7F6F86343BF1} : DHCPNameServer = 82.132.254.2 82.132.254.3 TCP: Interfaces\{C4FE17F4-E75C-4F22-B042-7C68441C8C8F} : NameServer = 8.8.8.8,8.8.4.4 TCP: Interfaces\{C4FE17F4-E75C-4F22-B042-7C68441C8C8F} : DHCPNameServer = 192.168.1.254 TCP: Interfaces\{C4FE17F4-E75C-4F22-B042-7C68441C8C8F}\244564F4E4 : DHCPNameServer = 192.168.22.22 192.168.22.23 TCP: Interfaces\{C4FE17F4-E75C-4F22-B042-7C68441C8C8F}\371617962602B68616E6 : NameServer = 8.8.8.8,8.8.4.4 TCP: Interfaces\{C4FE17F4-E75C-4F22-B042-7C68441C8C8F}\371617962602B68616E6 : DHCPNameServer = 172.30.139.17 172.31.139.17 TCP: Interfaces\{C4FE17F4-E75C-4F22-B042-7C68441C8C8F}\4516C6B64516C6B6532303 : NameServer = 8.8.8.8,8.8.4.4 TCP: Interfaces\{C4FE17F4-E75C-4F22-B042-7C68441C8C8F}\4516C6B64516C6B6532303 : DHCPNameServer = 46.37.181.234 212.117.175.185 TCP: Interfaces\{C4FE17F4-E75C-4F22-B042-7C68441C8C8F}\642716762716E63656 : NameServer = 8.8.8.8,8.8.4.4 TCP: Interfaces\{C4FE17F4-E75C-4F22-B042-7C68441C8C8F}\642716762716E63656 : DHCPNameServer = 109.249.185.224 109.249.186.32 TCP: Interfaces\{C4FE17F4-E75C-4F22-B042-7C68441C8C8F}\9446F62457479444F6E647 : NameServer = 8.8.8.8,8.8.4.4 TCP: Interfaces\{C4FE17F4-E75C-4F22-B042-7C68441C8C8F}\9446F62457479444F6E647 : DHCPNameServer = 172.31.139.17 172.30.139.17 TCP: Interfaces\{C4FE17F4-E75C-4F22-B042-7C68441C8C8F}\E4164796F6E616C654870727563737 : DHCPNameServer = 10.0.0.1 10.0.0.1 TCP: Interfaces\{C4FE17F4-E75C-4F22-B042-7C68441C8C8F}\E4544574541425 : DHCPNameServer = 192.168.0.1 Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll SSODL: WebCheck - <orphaned> SEH: Groove GFS Stub Execution Hook - {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL x64-mWinlogon: Userinit = C:\windows\System32\userinit.exe,C:\Windupdt\winupdate.exe x64-BHO: Groove GFS Browser Helper: {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL x64-BHO: Office Document Cache Handler: {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL x64-TB: <No Name>: {ae07101b-46d4-4a98-af68-0333ea26e113} - LocalServer32 - <no file> x64-Run: [igfxTray] C:\windows\System32\igfxtray.exe x64-Run: [HotKeysCmds] C:\windows\System32\hkcmd.exe x64-Run: [Persistence] C:\windows\System32\igfxpers.exe x64-Run: [sysTrayApp] C:\Program Files\IDT\WDM\sttray64.exe x64-Run: [Apoint] C:\Program Files\DellTPad\Apoint.exe x64-Run: [QuickSet] C:\Program Files\Dell\QuickSet\QuickSet.exe x64-Run: [intelWireless] "C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe" /tf Intel Wireless Tray x64-Run: [bTMTrayAgent] rundll32.exe "C:\Program Files (x86)\Intel\Bluetooth\btmshell.dll",TrayApp x64-Run: [DellStage] "C:\Program Files (x86)\Dell Stage\Dell Stage\stage_primary.exe" "C:\Program Files (x86)\Dell Stage\Dell Stage\start.umj" --startup x64-Run: [itype] "c:\Program Files\Microsoft IntelliType Pro\itype.exe" x64-Run: [Windows Mobile Device Center] C:\windows\WindowsMobile\wmdc.exe x64-Run: [Windows Mobile-based device management] C:\windows\WindowsMobile\wmdc.exe x64-Run: [bCSSync] "C:\Program Files\Microsoft Office\Office14\BCSSync.exe" /DelayServices x64-Run: [MSC] "c:\Program Files\Microsoft Security Client\msseces.exe" -hide -runkey x64-IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll x64-IE: {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - {FFFDC614-B694-4AE6-AB38-5D6374584B52} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll x64-Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL x64-Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - <orphaned> x64-Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - <orphaned> x64-Notify: igfxcui - igfxdev.dll x64-SSODL: WebCheck - <orphaned> x64-SEH: Groove GFS Stub Execution Hook - {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL . ================= FIREFOX =================== . FF - ProfilePath - C:\Users\S M Naveed\AppData\Roaming\Mozilla\Firefox\Profiles\pqhsf9ns.default\ FF - plugin: C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL FF - plugin: C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL FF - plugin: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll FF - plugin: C:\Program Files (x86)\Common Files\mpDRM\NPMPDRM.dll FF - plugin: C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll FF - plugin: C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll FF - plugin: C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll FF - plugin: C:\Program Files (x86)\Google\Update\1.3.21.123\npGoogleUpdate3.dll FF - plugin: C:\Program Files (x86)\Java\jre7\bin\dtplugin\npdeployJava1.dll FF - plugin: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll FF - plugin: c:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrlui.dll FF - plugin: C:\Program Files (x86)\Nokia\Nokia Suite\npNokiaSuiteEnabler.dll FF - plugin: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll FF - plugin: C:\Users\S M Naveed\AppData\Local\Google\Update\1.3.21.123\npGoogleUpdate3.dll FF - plugin: C:\windows\SysWOW64\Macromed\Flash\NPSWF32_11_5_502_135.dll FF - ExtSQL: 2012-11-16 04:43; {23fcfd51-4958-4f00-80a3-ae97e717ed8b}; C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5 FF - ExtSQL: 2012-12-17 22:13; {b9db16a4-6edc-47ec-a1f4-b86292ed211d}; C:\Users\S M Naveed\AppData\Roaming\Mozilla\Firefox\Profiles\pqhsf9ns.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d} FF - ExtSQL: 2012-12-17 22:19; {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}; C:\Users\S M Naveed\AppData\Roaming\Mozilla\Firefox\Profiles\pqhsf9ns.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi . ============= SERVICES / DRIVERS =============== . R0 MpFilter;Microsoft Malware Protection Driver;C:\windows\System32\drivers\MpFilter.sys [2012-8-30 228768] R0 PxHlpa64;PxHlpa64;C:\windows\System32\drivers\PxHlpa64.sys [2011-6-25 55856] R2 AESTFilters;Andrea ST Filters Service;C:\Program Files\IDT\WDM\AESTSr64.exe [2011-6-25 89600] R2 Bluetooth Device Monitor;Bluetooth Device Monitor;C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe [2010-11-3 897088] R2 IAStorDataMgrSvc;Intel® Rapid Storage Technology;C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe [2011-6-25 13336] R2 MBAMScheduler;MBAMScheduler;C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [2012-12-29 398184] R2 MBAMService;MBAMService;C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2012-12-29 682344] R2 TeamViewer8;TeamViewer 8;C:\Program Files (x86)\TeamViewer\Version8\TeamViewer_Service.exe [2012-12-21 3467768] R2 UNS;Intel® Management and Security Application User Notification Service;C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe [2011-6-25 2655768] R3 btmaux;Intel Bluetooth Auxiliary Service;C:\windows\System32\drivers\btmaux.sys [2010-11-4 58128] R3 btmhsf;btmhsf;C:\windows\System32\drivers\btmhsf.sys [2010-10-19 274432] R3 CtClsFlt;Creative Camera Class Upper Filter Driver;C:\windows\System32\drivers\CtClsFlt.sys [2011-6-25 175168] R3 iBtFltCoex;iBtFltCoex;C:\windows\System32\drivers\iBtFltCoex.sys [2010-11-4 59904] R3 IntcDAud;Intel® Display Audio;C:\windows\System32\drivers\IntcDAud.sys [2011-6-25 317440] R3 MBAMProtector;MBAMProtector;C:\windows\System32\drivers\mbam.sys [2012-12-29 24176] R3 nusb3hub;Renesas Electronics USB 3.0 Hub Driver;C:\windows\System32\drivers\nusb3hub.sys [2010-12-10 80384] R3 nusb3xhc;Renesas Electronics USB 3.0 Host Controller Driver;C:\windows\System32\drivers\nusb3xhc.sys [2010-12-10 181248] R3 RTL8167;Realtek 8167 NT Driver;C:\windows\System32\drivers\Rt64win7.sys [2011-6-25 406632] R3 swivsp;AC8xx Virtual Serial Port;C:\windows\System32\drivers\swivspnt.sys [2007-3-26 23552] R3 wdkmd;Intel WiDi KMD;C:\windows\System32\drivers\WDKMD.sys [2010-12-1 42392] S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384] S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576] S2 FlexService;Remote Connections Service;C:\Program Files (x86)\RapidBIT\cisvc.exe [2009-5-17 41984] S2 RoxWatch12;Roxio Hard Drive Watcher 12;C:\Program Files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxWatch12OEM.exe [2010-11-25 219632] S3 MyWiFiDHCPDNS;Wireless PAN DHCP Server;C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [2010-12-17 340240] S3 Netaapl;Apple Mobile Device Ethernet Service;C:\windows\System32\drivers\netaapl64.sys [2012-3-26 22528] S3 NisDrv;Microsoft Network Inspection System;C:\windows\System32\drivers\NisDrvWFP.sys [2012-8-30 128456] S3 NisSrv;Microsoft Network Inspection;C:\Program Files\Microsoft Security Client\NisSrv.exe [2012-9-12 368896] S3 nmwcdnsucx64;Nokia USB Flashing Generic;C:\windows\System32\drivers\nmwcdnsucx64.sys [2012-6-11 12800] S3 nmwcdnsux64;Nokia USB Flashing Phone Parent;C:\windows\System32\drivers\nmwcdnsux64.sys [2012-6-11 171008] S3 ose64;Office 64 Source Engine;C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2010-1-9 174440] S3 RoxMediaDB12OEM;RoxMediaDB12OEM;C:\Program Files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxMediaDB12OEM.exe [2010-11-25 1116656] S3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;C:\windows\System32\drivers\RtsUStor.sys [2011-6-25 250984] S3 SWNC8U80;Sierra Wireless MUX NDIS Driver (UMTS80);C:\windows\System32\drivers\swnc8u80.sys [2008-5-20 199168] S3 SWUMX80;Sierra Wireless USB MUX Driver (UMTS80);C:\windows\System32\drivers\swumx80.sys [2008-5-20 192256] S3 TsUsbFlt;TsUsbFlt;C:\windows\System32\drivers\TsUsbFlt.sys [2010-11-21 59392] S3 TsUsbGD;Remote Desktop Generic USB Device;C:\windows\System32\drivers\TsUsbGD.sys [2010-11-21 31232] S3 USBAAPL64;Apple Mobile USB Driver;C:\windows\System32\drivers\usbaapl64.sys [2012-9-28 53760] S3 WatAdminSvc;Windows Activation Technologies Service;C:\windows\System32\Wat\WatAdminSvc.exe [2011-11-11 1255736] S3 ZTEusbnet;ZTE USB-NDIS miniport;C:\windows\System32\drivers\ZTEusbnet.sys [2011-11-18 135168] S4 wlcrasvc;Windows Live Mesh remote connections service;C:\Program Files\Windows Live\Mesh\wlcrasvc.exe [2010-9-22 57184] . =============== Created Last 30 ================ . 2012-12-30 19:01:23 9125352 ----a-w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{B9807963-C66C-4B33-8243-A1AC02B8BAA9}\mpengine.dll 2012-12-29 03:56:50 24176 ----a-w- C:\windows\System32\drivers\mbam.sys 2012-12-29 01:37:49 -------- d-----w- C:\Users\S M Naveed\AppData\Roaming\SUPERAntiSpyware.com 2012-12-28 22:15:29 972264 ------w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{7AEC934D-E713-4E29-BFD9-1A0C6C95597A}\gapaengine.dll 2012-12-28 22:15:24 9125352 ------w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll 2012-12-28 22:14:33 -------- d-----w- C:\Program Files (x86)\Microsoft Security Client 2012-12-28 19:47:17 9125352 ----a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{FE31C3C7-CAE9-46E8-82BC-3CDC0FB60E2E}\mpengine.dll 2012-12-28 06:42:10 -------- d-----w- C:\Program Files\Microsoft Security Client 2012-12-28 01:19:06 -------- d-----w- C:\Users\S M Naveed\AppData\Roaming\QFX Software 2012-12-28 01:19:06 -------- d-----w- C:\ProgramData\QFX Software 2012-12-28 00:14:09 -------- d-----w- C:\ProgramData\Spybot - Search & Destroy 2012-12-28 00:13:25 -------- d-----w- C:\Users\S M Naveed\AppData\Local\Programs 2012-12-28 00:03:18 -------- d-----w- C:\ProgramData\SecTaskMan 2012-12-27 23:14:26 -------- d-----w- C:\Users\S M Naveed\AppData\Local\Welltek_Software 2012-12-27 19:31:14 -------- d-----w- C:\Program Files (x86)\Ccleaner Business Edition x64 x86 Tom_Da_Man 2012-12-27 19:10:30 -------- d-----w- C:\Users\S M Naveed\AppData\Local\{261B7CC5-F930-4E60-8625-714578AEE67A} 2012-12-26 20:33:26 -------- d-----w- C:\Users\S M Naveed\AppData\Local\WMTools Downloaded Files 2012-12-26 20:17:47 -------- d-----w- C:\Users\S M Naveed\AppData\Local\{27A7DD48-3206-4CB3-B6ED-B01E9162D941} 2012-12-26 00:10:39 -------- d-----w- C:\Users\S M Naveed\AppData\Local\{A9511AE4-C6AE-4F12-AA55-306FC164070A} 2012-12-25 01:03:38 -------- d-----w- C:\Users\S M Naveed\AppData\Local\{52A9980E-FCCA-47C8-A868-141B8A8FE602} 2012-12-23 18:50:01 -------- d-----w- C:\Users\S M Naveed\AppData\Local\{925E911E-205A-42A6-98E0-8A40947190E9} 2012-12-21 20:04:05 -------- d-----w- C:\Users\S M Naveed\AppData\Local\{0AA74DC4-8CD5-4E59-9697-91986FDC5CE8} 2012-12-20 20:26:00 46080 ----a-w- C:\windows\System32\atmlib.dll 2012-12-20 20:26:00 34304 ----a-w- C:\windows\SysWow64\atmlib.dll 2012-12-20 20:25:58 367616 ----a-w- C:\windows\System32\atmfd.dll 2012-12-20 20:25:56 295424 ----a-w- C:\windows\SysWow64\atmfd.dll 2012-12-20 19:49:04 -------- d-----w- C:\Users\S M Naveed\AppData\Local\{520A96A1-525F-4CC7-8D58-498E4436F001} 2012-12-20 04:42:09 -------- d-----w- C:\Users\S M Naveed\AppData\Roaming\Strongvault 2012-12-20 04:41:46 -------- d-----w- C:\Program Files (x86)\Common Files\MSSoap 2012-12-20 04:41:23 -------- d-----w- C:\Users\S M Naveed\AppData\Local\Stronghold_LLC 2012-12-20 04:41:05 -------- d-sh--w- C:\windows\SysWow64\AI_RecycleBin 2012-12-20 04:40:04 -------- d-----w- C:\ProgramData\Freemake 2012-12-20 04:39:42 -------- d-----w- C:\Program Files (x86)\Freemake 2012-12-19 23:19:13 -------- d-----w- C:\Users\S M Naveed\AppData\Roaming\Softplicity 2012-12-19 23:18:53 -------- d-----w- C:\Program Files (x86)\TotalAudioConverter 2012-12-19 23:10:07 -------- d-----w- C:\Users\S M Naveed\AppData\Roaming\WindSolutions 2012-12-19 23:10:06 -------- d-----w- C:\ProgramData\WindSolutions 2012-12-19 19:39:42 -------- d-----w- C:\Users\S M Naveed\AppData\Local\{3A8AF86B-9A4E-4572-97C0-47D001566B89} 2012-12-19 05:19:18 95184 ----a-w- C:\windows\SysWow64\WindowsAccessBridge-32.dll 2012-12-19 02:12:13 -------- d-----w- C:\Users\S M Naveed\AppData\Local\Apple Computer 2012-12-19 02:11:31 33240 ----a-w- C:\windows\System32\drivers\GEARAspiWDM.sys 2012-12-19 02:10:47 -------- d-----w- C:\Program Files\iPod 2012-12-19 02:10:42 -------- d-----w- C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69 2012-12-19 02:10:42 -------- d-----w- C:\Program Files\iTunes 2012-12-19 02:10:42 -------- d-----w- C:\Program Files (x86)\iTunes 2012-12-19 02:08:06 -------- d-----w- C:\Users\S M Naveed\AppData\Local\Apple 2012-12-19 02:07:09 -------- d-----w- C:\Program Files\Bonjour 2012-12-19 02:07:09 -------- d-----w- C:\Program Files (x86)\Bonjour 2012-12-19 01:21:18 -------- d-----w- C:\Program Files (x86)\Total Video Converter 2012-12-18 20:32:35 -------- d-----w- C:\Users\S M Naveed\AppData\Local\{4AE88E9E-6CD8-432A-ACAC-1AA5F8E31B9B} 2012-12-17 22:16:22 -------- d-----w- C:\Users\S M Naveed\dwhelper 2012-12-17 22:07:33 -------- d-----w- C:\Users\S M Naveed\AppData\Local\Macromedia 2012-12-17 20:23:16 -------- d-----w- C:\Users\S M Naveed\AppData\Local\{B97DAC54-855C-4984-B625-F9D72DB60CF4} 2012-12-16 19:27:27 -------- d-----w- C:\Users\S M Naveed\AppData\Local\{C42F45AB-2225-4F2D-A068-635D139B431F} 2012-12-14 22:59:28 -------- d-----w- C:\Program Files (x86)\PhotoScape 2012-12-14 19:53:55 -------- d-----w- C:\Users\S M Naveed\AppData\Local\{18078A65-FC85-4B98-A2FC-8D0B5584056A} 2012-12-13 19:51:02 -------- d-----w- C:\Users\S M Naveed\AppData\Local\{E05F193B-47BA-4087-BE53-6F8D7AF98205} 2012-12-12 19:59:48 -------- d-----w- C:\Users\S M Naveed\AppData\Local\{33EFF6DF-14D9-4A15-90A7-46074D63C18D} 2012-12-12 19:55:37 478208 ----a-w- C:\windows\System32\dpnet.dll 2012-12-12 19:55:35 376832 ----a-w- C:\windows\SysWow64\dpnet.dll 2012-12-11 19:44:12 -------- d-----w- C:\Users\S M Naveed\AppData\Local\{95864AD3-CBB2-4E67-9455-B4F30A303434} 2012-12-10 19:39:44 -------- d-----w- C:\Users\S M Naveed\AppData\Local\{DEE04ED9-C82D-4DA8-8814-E6F78833155C} 2012-12-09 19:01:23 -------- d-----w- C:\Users\S M Naveed\AppData\Local\{ADEE7E66-2645-47AB-9515-74C6B8215EEF} 2012-12-07 19:42:33 -------- d-----w- C:\Users\S M Naveed\AppData\Local\{1D0664D6-D358-48F6-804E-8928BD2BAD42} 2012-12-06 19:51:55 -------- d-----w- C:\Users\S M Naveed\AppData\Local\{3AB98608-878C-4276-88CE-0138383CE798} 2012-12-05 20:48:25 -------- d-----w- C:\Users\S M Naveed\AppData\Local\{09DF63F1-CE02-4D30-9352-C9D42179A3E6} 2012-12-04 20:26:34 -------- d-----w- C:\Users\S M Naveed\AppData\Local\{38477F75-CD3E-4F29-8BF4-7A06D98D5509} 2012-12-03 19:46:24 -------- d-----w- C:\Users\S M Naveed\AppData\Local\{BA42BA49-0536-4016-9D9E-EEE1C190006D} 2012-12-02 18:56:12 -------- d-----w- C:\Users\S M Naveed\AppData\Local\{7D0FACBC-0C3D-4014-AE40-DC5E3E5CF656} 2012-12-01 05:04:13 -------- d-----w- C:\Program Files (x86)\Intelore 2012-11-30 19:56:49 -------- d-----w- C:\Users\S M Naveed\AppData\Local\{83449ECF-6D80-46D4-92C3-F8C3B3B7C0F5} . ==================== Find3M ==================== . 2012-12-27 20:32:52 231376 ----a-w- C:\windows\System32\drivers\truecrypt.sys 2012-12-19 05:18:51 779704 ----a-w- C:\windows\SysWow64\deployJava1.dll 2012-12-12 19:57:45 73656 ----a-w- C:\windows\SysWow64\FlashPlayerCPLApp.cpl 2012-12-12 19:57:45 697272 ----a-w- C:\windows\SysWow64\FlashPlayerApp.exe 2012-11-22 03:26:40 3149824 ----a-w- C:\windows\System32\win32k.sys 2012-11-16 06:02:52 116 ---ha-w- C:\ProgramData\msadoex.dll 2012-11-14 06:11:44 2312704 ----a-w- C:\windows\System32\jscript9.dll 2012-11-14 06:04:11 1392128 ----a-w- C:\windows\System32\wininet.dll 2012-11-14 06:02:49 1494528 ----a-w- C:\windows\System32\inetcpl.cpl 2012-11-14 05:57:46 599040 ----a-w- C:\windows\System32\vbscript.dll 2012-11-14 05:57:35 173056 ----a-w- C:\windows\System32\ieUnatt.exe 2012-11-14 05:52:40 2382848 ----a-w- C:\windows\System32\mshtml.tlb 2012-11-14 02:09:22 1800704 ----a-w- C:\windows\SysWow64\jscript9.dll 2012-11-14 01:58:15 1427968 ----a-w- C:\windows\SysWow64\inetcpl.cpl 2012-11-14 01:57:37 1129472 ----a-w- C:\windows\SysWow64\wininet.dll 2012-11-14 01:49:25 142848 ----a-w- C:\windows\SysWow64\ieUnatt.exe 2012-11-14 01:48:27 420864 ----a-w- C:\windows\SysWow64\vbscript.dll 2012-11-14 01:44:42 2382848 ----a-w- C:\windows\SysWow64\mshtml.tlb 2012-11-13 20:29:04 354216 ----a-w- C:\windows\SysWow64\DivXControlPanelApplet.cpl 2012-11-09 05:45:09 2048 ----a-w- C:\windows\System32\tzres.dll 2012-11-09 04:42:49 2048 ----a-w- C:\windows\SysWow64\tzres.dll 2012-10-16 08:38:37 135168 ----a-w- C:\windows\apppatch\AppPatch64\AcXtrnal.dll 2012-10-16 08:38:34 350208 ----a-w- C:\windows\apppatch\AppPatch64\AcLayers.dll 2012-10-16 07:39:52 561664 ----a-w- C:\windows\apppatch\AcLayers.dll 2012-10-09 18:17:13 55296 ----a-w- C:\windows\System32\dhcpcsvc6.dll 2012-10-09 18:17:13 226816 ----a-w- C:\windows\System32\dhcpcore6.dll 2012-10-09 17:40:31 44032 ----a-w- C:\windows\SysWow64\dhcpcsvc6.dll 2012-10-09 17:40:31 193536 ----a-w- C:\windows\SysWow64\dhcpcore6.dll 2012-10-04 17:46:16 362496 ----a-w- C:\windows\System32\wow64win.dll 2012-10-04 17:46:15 243200 ----a-w- C:\windows\System32\wow64.dll 2012-10-04 17:46:15 13312 ----a-w- C:\windows\System32\wow64cpu.dll 2012-10-04 17:45:55 215040 ----a-w- C:\windows\System32\winsrv.dll 2012-10-04 17:43:28 16384 ----a-w- C:\windows\System32\ntvdm64.dll 2012-10-04 17:41:16 424960 ----a-w- C:\windows\System32\KernelBase.dll 2012-10-04 16:47:41 5120 ----a-w- C:\windows\SysWow64\wow32.dll 2012-10-04 16:47:41 274944 ----a-w- C:\windows\SysWow64\KernelBase.dll 2012-10-04 15:21:55 338432 ----a-w- C:\windows\System32\conhost.exe 2012-10-04 14:46:46 7680 ----a-w- C:\windows\SysWow64\instnm.exe 2012-10-04 14:46:46 25600 ----a-w- C:\windows\SysWow64\setup16.exe 2012-10-04 14:46:44 14336 ----a-w- C:\windows\SysWow64\ntvdm64.dll 2012-10-04 14:46:43 2048 ----a-w- C:\windows\SysWow64\user.exe 2012-10-04 14:41:50 6144 ---ha-w- C:\windows\SysWow64\api-ms-win-security-base-l1-1-0.dll 2012-10-04 14:41:50 4608 ---ha-w- C:\windows\SysWow64\api-ms-win-core-threadpool-l1-1-0.dll 2012-10-04 14:41:50 3584 ---ha-w- C:\windows\SysWow64\api-ms-win-core-xstate-l1-1-0.dll 2012-10-04 14:41:50 3072 ---ha-w- C:\windows\SysWow64\api-ms-win-core-util-l1-1-0.dll 2012-10-03 17:56:54 1914248 ----a-w- C:\windows\System32\drivers\tcpip.sys 2012-10-03 17:44:21 70656 ----a-w- C:\windows\System32\nlaapi.dll 2012-10-03 17:44:21 303104 ----a-w- C:\windows\System32\nlasvc.dll 2012-10-03 17:44:17 246272 ----a-w- C:\windows\System32\netcorehc.dll 2012-10-03 17:44:17 18944 ----a-w- C:\windows\System32\netevent.dll 2012-10-03 17:44:16 216576 ----a-w- C:\windows\System32\ncsi.dll 2012-10-03 17:42:16 569344 ----a-w- C:\windows\System32\iphlpsvc.dll 2012-10-03 16:42:24 18944 ----a-w- C:\windows\SysWow64\netevent.dll 2012-10-03 16:42:24 175104 ----a-w- C:\windows\SysWow64\netcorehc.dll 2012-10-03 16:42:23 156672 ----a-w- C:\windows\SysWow64\ncsi.dll 2012-10-03 16:07:26 45568 ----a-w- C:\windows\System32\drivers\tcpipreg.sys . ============= FINISH: 19:12:15.60 =============== _______________________________ . UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG. IF REQUESTED, ZIP IT UP & ATTACH IT . DDS (Ver_2012-11-20.01) . Microsoft Windows 7 Home Premium Boot Device: \Device\HarddiskVolume2 Install Date: 09/11/2011 19:49:05 System Uptime: 30/12/2012 18:37:00 (1 hours ago) . Motherboard: Dell Inc. | | 034W60 Processor: Intel® Core i3-2310M CPU @ 2.10GHz | CPU 1 | 798/100mhz . ==== Disk Partitions ========================= . C: is FIXED (NTFS) - 451 GiB total, 175.879 GiB free. D: is CDROM () . ==== Disabled Device Manager Items ============= . Class GUID: Description: Bluetooth Peripheral Device Device ID: BTHENUM\{00000002-0000-1000-8000-0002EE000002}_LOCALMFG&0002\8&2AC20834&0&3CF72A07BF6E_C00000000 Manufacturer: Name: Bluetooth Peripheral Device PNP Device ID: BTHENUM\{00000002-0000-1000-8000-0002EE000002}_LOCALMFG&0002\8&2AC20834&0&3CF72A07BF6E_C00000000 Service: . Class GUID: Description: Bluetooth Peripheral Device Device ID: BTHENUM\{00005005-0000-1000-8000-0002EE000001}_LOCALMFG&0002\8&2AC20834&0&3CF72A07BF6E_C00000000 Manufacturer: Name: Bluetooth Peripheral Device PNP Device ID: BTHENUM\{00005005-0000-1000-8000-0002EE000001}_LOCALMFG&0002\8&2AC20834&0&3CF72A07BF6E_C00000000 Service: . Class GUID: Description: Bluetooth Peripheral Device Device ID: BTHENUM\{00000004-0000-1000-8000-0002EE000002}_LOCALMFG&0002\8&2AC20834&0&3CF72A07BF6E_C00000000 Manufacturer: Name: Bluetooth Peripheral Device PNP Device ID: BTHENUM\{00000004-0000-1000-8000-0002EE000002}_LOCALMFG&0002\8&2AC20834&0&3CF72A07BF6E_C00000000 Service: . ==== System Restore Points =================== . RP254: 25/12/2012 08:02:30 - Windows Update RP255: 27/12/2012 20:32:13 - TrueCrypt installation RP256: 27/12/2012 23:07:18 - Installed 001 File Joiner and Splitter. RP257: 27/12/2012 23:48:28 - Removed 001 File Joiner and Splitter. RP258: 28/12/2012 00:58:04 - Removed 001 File Joiner and Splitter. RP259: 28/12/2012 05:47:12 - Removed Skype™ 5.9 RP260: 28/12/2012 19:35:15 - Restore Operation RP261: 28/12/2012 19:45:14 - Windows Update RP262: 29/12/2012 06:21:13 - Installed Windows Mobile Device Center . ==== Installed Programs ====================== . 7-Zip 9.20 (x64 edition) Adobe AIR Adobe Flash Player 11 ActiveX Adobe Flash Player 11 Plugin Adobe Reader X (10.1.4) MUI Adobe Shockwave Player 11.6 Advanced Audio FX Engine Apple Application Support Apple Mobile Device Support Apple Software Update µTorrent AudioConverter Bonjour Ccleaner Business Edition x64 x86 Tom_Da_Man CopyTrans Suite Remove Only D3DX10 Definition Update for Microsoft Office 2010 (KB982726) 64-Bit Edition Dell DataSafe Local Backup Dell DataSafe Local Backup - Support Software Dell Edoc Viewer Dell Getting Started Guide Dell MusicStage Dell PhotoStage Dell Product Registration Dell Stage Dell Support Center Dell Touchpad Dell VideoStage Dell Webcam Central DirectX 9 Runtime DivX Setup Facebook Video Calling 1.2.0.287 Freemake Audio Converter version 1.1.0 GOM Player Google Chrome Google Drive Google Earth Google Update Helper IDT Audio Intel PROSet Wireless Intel® Control Center Intel® Management Engine Components Intel® Processor Graphics Intel® PROSet/Wireless Software for Bluetooth® Technology Intel® PROSet/Wireless WiFi Software Intel® Rapid Storage Technology Intel® Wireless Display iTunes Java 7 Update 10 Java Auto Updater Junk Mail filter update Malwarebytes Anti-Malware version 1.70.0.1100 Mesh Runtime Microsoft .NET Framework 4 Client Profile Microsoft .NET Framework 4 Extended Microsoft Application Error Reporting Microsoft Games for Windows - LIVE Redistributable Microsoft Games for Windows Marketplace Microsoft IntelliType Pro 8.2 Microsoft Office 2010 Service Pack 1 (SP1) Microsoft Office Access MUI (English) 2010 Microsoft Office Access Setup Metadata MUI (English) 2010 Microsoft Office Excel MUI (English) 2010 Microsoft Office Groove MUI (English) 2010 Microsoft Office InfoPath MUI (English) 2010 Microsoft Office Office 32-bit Components 2010 Microsoft Office OneNote MUI (English) 2010 Microsoft Office Outlook MUI (English) 2010 Microsoft Office PowerPoint MUI (English) 2010 Microsoft Office Professional Plus 2010 Microsoft Office Proof (English) 2010 Microsoft Office Proof (French) 2010 Microsoft Office Proof (Spanish) 2010 Microsoft Office Proofing (English) 2010 Microsoft Office Publisher MUI (English) 2010 Microsoft Office Shared 32-bit MUI (English) 2010 Microsoft Office Shared MUI (English) 2010 Microsoft Office Shared Setup Metadata MUI (English) 2010 Microsoft Office Word MUI (English) 2010 Microsoft Security Client Microsoft Security Essentials Microsoft Silverlight Microsoft SQL Server 2005 Compact Edition [ENU] Microsoft Visual C++ 2005 Redistributable Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 Microsoft Visual C++ 2010 x86 Redistributable - 10.0.30319 Microsoft_VC100_CRT_SP1_x64 Microsoft_VC100_CRT_SP1_x86 Mozilla Firefox 17.0.1 (x86 en-US) Mozilla Maintenance Service MSVC80_x64_v2 MSVC80_x86_v2 MSVC90_x64 MSVC90_x86 MSVCRT MSVCRT_amd64 MSXML 4.0 SP2 (KB954430) MSXML 4.0 SP2 (KB973688) MSXML 4.0 SP3 Parser MSXML 4.0 SP3 Parser (KB2721691) MSXML 4.0 SP3 Parser (KB973685) Need for Speed - Most Wanted v1.3 ( RE ) Nokia Connectivity Cable Driver Nokia Suite OpenAL PC Connectivity Solution PhotoScape PhotoShowExpress PowerISO Quickset64 RBVirtualFolder64Inst Realtek Ethernet Controller Driver Realtek USB 2.0 Card Reader Renesas Electronics USB 3.0 Host Controller Driver Roxio Activation Module Roxio BackOnTrack Roxio Burn Roxio Creator Starter Roxio Express Labeler 3 Roxio File Backup Security Update for Microsoft .NET Framework 4 Client Profile (KB2160841) Security Update for Microsoft .NET Framework 4 Client Profile (KB2478663) Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870) Security Update for Microsoft .NET Framework 4 Client Profile (KB2539636) Security Update for Microsoft .NET Framework 4 Client Profile (KB2572078) Security Update for Microsoft .NET Framework 4 Client Profile (KB2604121) Security Update for Microsoft .NET Framework 4 Client Profile (KB2633870) Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351) Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368) Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368v2) Security Update for Microsoft .NET Framework 4 Client Profile (KB2656405) Security Update for Microsoft .NET Framework 4 Client Profile (KB2686827) Security Update for Microsoft .NET Framework 4 Client Profile (KB2729449) Security Update for Microsoft .NET Framework 4 Client Profile (KB2737019) Security Update for Microsoft .NET Framework 4 Extended (KB2416472) Security Update for Microsoft .NET Framework 4 Extended (KB2487367) Security Update for Microsoft .NET Framework 4 Extended (KB2656351) Security Update for Microsoft Excel 2010 (KB2597126) 64-Bit Edition Security Update for Microsoft InfoPath 2010 (KB2687417) 64-Bit Edition Security Update for Microsoft InfoPath 2010 (KB2687436) 64-Bit Edition Security Update for Microsoft Office 2010 (KB2553091) Security Update for Microsoft Office 2010 (KB2553096) Security Update for Microsoft Office 2010 (KB2553371) 64-Bit Edition Security Update for Microsoft Office 2010 (KB2553447) 64-Bit Edition Security Update for Microsoft Office 2010 (KB2589320) 64-Bit Edition Security Update for Microsoft Office 2010 (KB2598243) 64-Bit Edition Security Update for Microsoft Office 2010 (KB2687501) 64-Bit Edition Security Update for Microsoft Office 2010 (KB2687510) 64-Bit Edition Security Update for Microsoft PowerPoint 2010 (KB2553185) 64-Bit Edition Security Update for Microsoft Visio 2010 (KB2687508) 64-Bit Edition Security Update for Microsoft Visio Viewer 2010 (KB2598287) 64-Bit Edition Security Update for Microsoft Word 2010 (KB2760410) 64-Bit Edition Skype™ 5.9 Sonic CinePlayer Decoder Pack SRWare Iron version SRWare Iron 22.0.1250.0 Strongvault Online Backup swMSM TeamViewer 8 Total Video Converter 3.71 100812 Update for Microsoft .NET Framework 4 Client Profile (KB2468871) Update for Microsoft .NET Framework 4 Client Profile (KB2473228) Update for Microsoft .NET Framework 4 Client Profile (KB2533523) Update for Microsoft .NET Framework 4 Client Profile (KB2600217) Update for Microsoft .NET Framework 4 Extended (KB2468871) Update for Microsoft .NET Framework 4 Extended (KB2533523) Update for Microsoft .NET Framework 4 Extended (KB2600217) Update for Microsoft Office 2010 (KB2553065) Update for Microsoft Office 2010 (KB2553092) Update for Microsoft Office 2010 (KB2553181) 64-Bit Edition Update for Microsoft Office 2010 (KB2553267) 64-Bit Edition Update for Microsoft Office 2010 (KB2553310) 64-Bit Edition Update for Microsoft Office 2010 (KB2566458) Update for Microsoft Office 2010 (KB2598242) 64-Bit Edition Update for Microsoft Office 2010 (KB2687509) 64-Bit Edition Update for Microsoft OneNote 2010 (KB2553290) 64-Bit Edition Update for Microsoft OneNote 2010 (KB2687277) 64-Bit Edition Update for Microsoft Outlook 2010 (KB2687623) 64-Bit Edition Update for Microsoft Outlook Social Connector 2010 (KB2553406) 64-Bit Edition Update for Microsoft SharePoint Workspace 2010 (KB2589371) 64-Bit Edition VC80CRTRedist - 8.0.50727.6195 Visual C++ 8.0 Runtime Setup Package (x64) Visual Studio 2008 x64 Redistributables VLC media player 1.1.11 Windows Driver Package - Nokia pccsmcfd LegacyDriver (05/31/2012 7.1.2.0) Windows Live Communications Platform Windows Live Essentials Windows Live ID Sign-in Assistant Windows Live Installer Windows Live Language Selector Windows Live Mail Windows Live Mesh Windows Live Mesh ActiveX Control for Remote Connections Windows Live Messenger Windows Live MIME IFilter Windows Live Movie Maker Windows Live Photo Common Windows Live Photo Gallery Windows Live PIMT Platform Windows Live Remote Client Windows Live Remote Client Resources Windows Live Remote Service Windows Live Remote Service Resources Windows Live SOXE Windows Live SOXE Definitions Windows Live UX Platform Windows Live UX Platform Language Pack Windows Live Writer Windows Live Writer Resources Windows Media Player Firefox Plugin Windows Mobile Device Center Windows Mobile Device Center Driver Update Windows Movie Maker 2.6 WinRAR 4.20 (64-bit) Yahoo! Messenger . ==== Event Viewer Messages From Past Week ======== . 30/12/2012 18:39:40, Error: Service Control Manager [7000] - The Security Center service failed to start due to the following error: The account specified for this service is different from the account specified for other services running in the same process. 28/12/2012 22:47:51, Error: Disk [11] - The driver detected a controller error on \Device\Harddisk1\DR1. 28/12/2012 22:08:33, Error: Service Control Manager [7001] - The Spybot-S&D 2 Security Center Service service depends on the Security Center service which failed to start because of the following error: The account specified for this service is different from the account specified for other services running in the same process. 28/12/2012 04:38:21, Error: Service Control Manager [7001] - The Spybot-S&D 2 Security Center Service service depends on the Security Center service which failed to start because of the following error: The service cannot be started, either because it is disabled or because it has no enabled devices associated with it. 27/12/2012 08:00:44, Error: Service Control Manager [7043] - The Windows Update service did not shut down properly after receiving a preshutdown control. 24/12/2012 21:31:42, Error: Ntfs [55] - The file system structure on the disk is corrupt and unusable. Please run the chkdsk utility on the volume OS. 24/12/2012 21:31:42, Error: Ntfs [55] - The file system structure on the disk is corrupt and unusable. Please run the chkdsk utility on the volume C:. . ==== End Of File =========================== ____ Many thanks again

Hi there, Thanks for your prominent responce, just to inform you that, I have recieved an email as well regarding this matter and have been instructed same as you did , do I need to reply that email and attache the required logs or do I need to post them here ? Many thanks

DaleDoc1: Thanks for putting me back on right place .. lolss I am beginner and beginners are awsome lols. Many thanks hopefully moderators wont go on new year leave after they finish Xmas leaves.

Hi, System information: Windows 7 Home-premium 64x. I am the beginner in this forum and would like to thank you in advance for your time and assistance to help me solving the following issue. Last night I mistakenly installed an .exe file, after installation it disappeared and I couldn't find it, after sometime my Windows Security Center service stooped and a flag icon with red cross on it appeared on system icons,I clicked on it and under security it was mentioned that WSCS ( Windows Security Center services) has stopped working. and Under maintenance it was mentioned that messenger plus live has stopped working and is missing some updates. I, immediately performed a full scan with Malwarebytes anti-malware and it came with the following results : Malwarebytes Anti-Malware (PRO) 1.60.1.1000 www.malwarebytes.org Database version: v2012.12.27.01 Windows 7 Service Pack 1 x64 NTFS Internet Explorer 9.0.8112.16421 S M Naveed :: SMNAVEED-PC [administrator] Protection: Enabled 28/12/2012 01:36:47 mbam-log-2012-12-28 (01-36-47).txt Scan type: Full scan Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM Scan options disabled: P2P Objects scanned: 351596 Time elapsed: 1 hour(s), 5 minute(s), 8 second(s) Memory Processes Detected: 1 C:\Windupdt\winupdate.exe (Trojan.MSIL.Gen) -> 1320 -> Delete on reboot. Memory Modules Detected: 0 (No malicious items detected) Registry Keys Detected: 1 HKCU\Software\DC3_FEXEC (Malware.Trace) -> Quarantined and deleted successfully. Registry Values Detected: 1 HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|winupdater (Trojan.MSIL.Gen) -> Data: C:\Windupdt\winupdate.exe -> Quarantined and deleted successfully. Registry Data Items Detected: 3 HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System|DisableTaskMgr (PUM.Hijack.TaskManager) -> Bad: (1) Good: (0) -> Quarantined and repaired successfully. HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System|DisableRegistryTools (PUM.Hijack.Regedit) -> Bad: (1) Good: (0) -> Quarantined and repaired successfully. HKLM\SOFTWARE\Microsoft\Security Center|AntiVirusDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and repaired successfully. Folders Detected: 1 C:\Users\S M Naveed\AppData\Local\Temp\dclogs (Stolen.Data) -> Quarantined and deleted successfully. Files Detected: 4 C:\Windupdt\winupdate.exe (Trojan.MSIL.Gen) -> Delete on reboot. C:\$Recycle.Bin\S-1-5-21-2314083050-1812539920-3202108154-1000\$RBXO9P3.exe (RiskWare.Tool.CK) -> Quarantined and deleted successfully. C:\ProgramData\SUS\SUS.01 (Trojan.Ardamax) -> Quarantined and deleted successfully. C:\Users\S M Naveed\AppData\Local\Temp\dclogs\2012-12-28-6.dc (Stolen.Data) -> Quarantined and deleted successfully. (end) Then restarted the system but that flagged icon with red cross came up again after few moments then I ran ESET NOD32 antivirus for full system scan and it did not showed any infected files. Then I restarted the system again and the same problem occurred after sometime. Finally I restored the system to a previous date, which happened successfully but the problem was still there after the system was restored to a previous date and was updated. I ran Malwarebytes anti-malware again and this time it came up with this result: Malwarebytes Anti-Malware (PRO) 1.60.1.1000 www.malwarebytes.org Database version: v2012.12.28.01 Windows 7 Service Pack 1 x64 NTFS Internet Explorer 9.0.8112.16421 S M Naveed :: SMNAVEED-PC [administrator] Protection: Enabled 28/12/2012 19:43:30 mbam-log-2012-12-28 (19-43-30).txt Scan type: Full scan Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM Scan options disabled: P2P Objects scanned: 350799 Time elapsed: 1 hour(s), 9 minute(s), 45 second(s) Memory Processes Detected: 0 (No malicious items detected) Memory Modules Detected: 0 (No malicious items detected) Registry Keys Detected: 0 (No malicious items detected) Registry Values Detected: 1 HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|winupdater (Backdoor.Agent) -> Data: C:\Windupdt\winupdate.exe -> Quarantined and deleted successfully. Registry Data Items Detected: 0 (No malicious items detected) Folders Detected: 0 (No malicious items detected) Files Detected: 0 (No malicious items detected) (end) ___________________________________ Malwarebytes anti-malware needed me to restart the system immediately, I followed but the problem is still there. Could you please advice me something that what should I do now ? How much safe I am ? If Malwarebytes anti-malware says that all malicious files have been quarantined and deleted successfully then why I am this problem again ? I don't have an external hard-disk to back up all of my data but is it to safe to transfer some of my files from system to an external USB stick ? will those files be not carrying virus with them in my USB ? Is there anyway this all can be fixed ? I will be very thankful for your assistance and support.

Hi, System information: Windows 7 Home-premium 64x. I am the beginner in this forum and would like to thank you in advance for your time and assistance to help me solving the following issue. Last night I mistakenly installed an .exe file, after installation it disappeared and I couldn't find it, after sometime my Windows Security Center service stooped and a flag icon with red cross on it appeared on system icons,I clicked on it and under security it was mentioned that WSCS ( Windows Security Center services) has stopped working. and Under maintenance it was mentioned that messenger plus live has stopped working and is missing some updates. I, immediately performed a full scan with Malwarebytes anti-malware and it came with the following results : Malwarebytes Anti-Malware (PRO) 1.60.1.1000 www.malwarebytes.org Database version: v2012.12.27.01 Windows 7 Service Pack 1 x64 NTFS Internet Explorer 9.0.8112.16421 S M Naveed :: SMNAVEED-PC [administrator] Protection: Enabled 28/12/2012 01:36:47 mbam-log-2012-12-28 (01-36-47).txt Scan type: Full scan Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM Scan options disabled: P2P Objects scanned: 351596 Time elapsed: 1 hour(s), 5 minute(s), 8 second(s) Memory Processes Detected: 1 C:\Windupdt\winupdate.exe (Trojan.MSIL.Gen) -> 1320 -> Delete on reboot. Memory Modules Detected: 0 (No malicious items detected) Registry Keys Detected: 1 HKCU\Software\DC3_FEXEC (Malware.Trace) -> Quarantined and deleted successfully. Registry Values Detected: 1 HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|winupdater (Trojan.MSIL.Gen) -> Data: C:\Windupdt\winupdate.exe -> Quarantined and deleted successfully. Registry Data Items Detected: 3 HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System|DisableTaskMgr (PUM.Hijack.TaskManager) -> Bad: (1) Good: (0) -> Quarantined and repaired successfully. HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System|DisableRegistryTools (PUM.Hijack.Regedit) -> Bad: (1) Good: (0) -> Quarantined and repaired successfully. HKLM\SOFTWARE\Microsoft\Security Center|AntiVirusDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and repaired successfully. Folders Detected: 1 C:\Users\S M Naveed\AppData\Local\Temp\dclogs (Stolen.Data) -> Quarantined and deleted successfully. Files Detected: 4 C:\Windupdt\winupdate.exe (Trojan.MSIL.Gen) -> Delete on reboot. C:\$Recycle.Bin\S-1-5-21-2314083050-1812539920-3202108154-1000\$RBXO9P3.exe (RiskWare.Tool.CK) -> Quarantined and deleted successfully. C:\ProgramData\SUS\SUS.01 (Trojan.Ardamax) -> Quarantined and deleted successfully. C:\Users\S M Naveed\AppData\Local\Temp\dclogs\2012-12-28-6.dc (Stolen.Data) -> Quarantined and deleted successfully. (end) Then restarted the system but that flagged icon with red cross came up again after few moments then I ran ESET NOD32 antivirus for full system scan and it did not showed any infected files. Then I restarted the system again and the same problem occurred after sometime. Finally I restored the system to a previous date, which happened successfully but the problem was still there after the system was restored to a previous date and was updated. I ran Malwarebytes anti-malware again and this time it came up with this result: Malwarebytes Anti-Malware (PRO) 1.60.1.1000 www.malwarebytes.org Database version: v2012.12.28.01 Windows 7 Service Pack 1 x64 NTFS Internet Explorer 9.0.8112.16421 S M Naveed :: SMNAVEED-PC [administrator] Protection: Enabled 28/12/2012 19:43:30 mbam-log-2012-12-28 (19-43-30).txt Scan type: Full scan Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM Scan options disabled: P2P Objects scanned: 350799 Time elapsed: 1 hour(s), 9 minute(s), 45 second(s) Memory Processes Detected: 0 (No malicious items detected) Memory Modules Detected: 0 (No malicious items detected) Registry Keys Detected: 0 (No malicious items detected) Registry Values Detected: 1 HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|winupdater (Backdoor.Agent) -> Data: C:\Windupdt\winupdate.exe -> Quarantined and deleted successfully. Registry Data Items Detected: 0 (No malicious items detected) Folders Detected: 0 (No malicious items detected) Files Detected: 0 (No malicious items detected) (end) ___________________________________ Malwarebytes anti-malware needed me to restart the system immediately, I followed but the problem is still there. Could you please advice me something that what should I do now ? How much safe I am ? If Malwarebytes anti-malware says that all malicious files have been quarantined and deleted successfully then why I am this problem again ? I don't have an external hard-disk to back up all of my data but is it to safe to transfer some of my files from system to an external USB stick ? will those files be not carrying virus with them in my USB ? Is there anyway this all can be fixed ? I will be very thankful for your assistance and support.