[Back Door Trojan, Windows security system cannot start.]

Thank you very much Mr Charlie.

All the issues have been resolved and I am much safe and secure to use my machine now.

I highly appreciate your time and advice, If your support was not availed I would have been looking to buy a new installation and lost all my data, plus also I could be a victim of identity theft. ( You saved me from facing all this).

Best Regards.

[Back Door Trojan, Windows security system cannot start.]

Also the Adobe reader is being shown out of date but when I open the reader and click on help--check for updates : it says that no updates are available. where can I install the updates ? and how can I find them if Adobe itself is saying that '' No updates are available''

[Back Door Trojan, Windows security system cannot start.]

Thanks have done that,

Just few final things :

1. Cant uninstall Security check as I try to run and it just does the scan and doesn't give me an option to uninstall it.

2. Cant find Combofix, RK_Quarantine folder, C:\FRST, MBAR and AdwCleaner... to uninstall them.

3. Google chrome has got two extensions, which I deleted before one is of U-Torrent and the other is Divx extension, can I just disable/delete them from going in settings of Chrome ?

4. I would like to use the extension for blocking adverts in Google, is it safe to re-install it, as I cant see the spam blocker icon in Chrome now.

5. Should I, carry on using MSE and MBAM or there are any other more safer softwares available for the virus and malware protection ?

6. I know the person who posted a fake file on youtube and his description link brought me to a new page where I downloaded file and ended up here, should I, post the link of that website here, so that users could be notified about it ?

[Back Door Trojan, Windows security system cannot start.]

Adw Cleaner log file :

# AdwCleaner v2.104 - Logfile created 12/30/2012 at 22:59:15

# Updated 29/12/2012 by Xplode

# Operating system : Windows 7 Home Premium Service Pack 1 (64 bits)

# User : S M Naveed - SMNAVEED-PC

# Boot Mode : Normal

# Running from : C:\Users\S M Naveed\Desktop\adwcleaner.exe

# Option [Delete]

***** [services] *****

***** [Files / Folders] *****

Folder Deleted : C:\ProgramData\InstallMate

Folder Deleted : C:\Users\S M Naveed\AppData\Local\Conduit

Folder Deleted : C:\Users\S M Naveed\AppData\LocalLow\boost_interprocess

Folder Deleted : C:\Users\S M Naveed\AppData\LocalLow\Conduit

Folder Deleted : C:\Users\S M Naveed\AppData\Roaming\OpenCandy

***** [Registry] *****

Key Deleted : HKCU\Software\1ClickDownload

Key Deleted : HKCU\Software\AppDataLow\Software\SmartBar

Key Deleted : HKCU\Software\Conduit

Key Deleted : HKCU\Software\ilivid

Key Deleted : HKCU\Software\Softonic

Key Deleted : HKCU\Software\SweetIM

Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{006EE092-9658-4FD6-BD8E-A21A348E59F5}

Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{EEE6C360-6118-11DC-9C72-001320C79847}

Key Deleted : HKLM\Software\Babylon

Key Deleted : HKLM\SOFTWARE\Classes\AppID\{09C554C3-109B-483C-A06B-F14172F1A947}

Key Deleted : HKLM\SOFTWARE\Classes\AppID\{5B1881D1-D9C7-46DF-B041-1E593282C7D0}

Key Deleted : HKLM\SOFTWARE\Classes\AppID\{BDB69379-802F-4EAF-B541-F8DE92DD98DB}

Key Deleted : HKLM\SOFTWARE\Classes\AppID\{EA28B360-05E0-4F93-8150-02891F1D8D3C}

Key Deleted : HKLM\SOFTWARE\Classes\AppID\escort.DLL

Key Deleted : HKLM\SOFTWARE\Classes\Prod.cap

Key Deleted : HKLM\SOFTWARE\Classes\Toolbar.CT2704262

Key Deleted : HKLM\SOFTWARE\Classes\Toolbar.CT3220468

Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{9C049BA6-EA47-4AC3-AED6-A66D8DC9E1D8}

Key Deleted : HKLM\Software\Conduit

Key Deleted : HKLM\Software\Iminent

Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\iLividSetupV1_RASAPI32

Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\iLividSetupV1_RASMANCS

Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\MyBabylontb_RASAPI32

Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\MyBabylontb_RASMANCS

Key Deleted : HKLM\Software\SweetIM

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{3C471948-F874-49F5-B338-4F214A2EE0B1}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{AE07101B-46D4-4A98-AF68-0333EA26E113}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{E46C8196-B634-44A1-AF6E-957C64278AB1}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{813A22E0-3E2B-4188-9BDA-ECA9878B8D48}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{BCFF5F55-6F44-11D2-86F8-00104B265ED5}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\jcdgjdiieiljkfkdcloehkohchhpekkn

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{006EE092-9658-4FD6-BD8E-A21A348E59F5}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{EEE6C360-6118-11DC-9C72-001320C79847}

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{AE07101B-46D4-4A98-AF68-0333EA26E113}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{79FB5FC8-44B9-4AF5-BADD-CCE547F953E5}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{813A22E0-3E2B-4188-9BDA-ECA9878B8D48}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{BCFF5F55-6F44-11D2-86F8-00104B265ED5}

Value Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar [{AE07101B-46D4-4A98-AF68-0333EA26E113}]

Value Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{AE07101B-46D4-4A98-AF68-0333EA26E113}]

***** [internet Browsers] *****

-\\ Internet Explorer v9.0.8112.16457

Replaced : [HKCU\Software\Microsoft\Internet Explorer\Search - Default_Search_URL] = hxxp://feed.helperbar.com/?publisher=OPENCANDY&dpid=OPENCANDYAPRIL&co=GB&userid=7dd9212d-bb7e-4f1e-b66c-38098f342e76&affid=111585&searchtype=ds&babsrc=lnkry&q={searchTerms} --> hxxp://www.google.com

Replaced : [HKCU\Software\Microsoft\Internet Explorer\Search - SearchAssistant] = hxxp://feed.helperbar.com/?publisher=OPENCANDY&dpid=OPENCANDYAPRIL&co=GB&userid=7dd9212d-bb7e-4f1e-b66c-38098f342e76&affid=111585&searchtype=ds&babsrc=lnkry&q={searchTerms} --> hxxp://www.google.com

-\\ Mozilla Firefox v17.0.1 (en-US)

File : C:\Users\S M Naveed\AppData\Roaming\Mozilla\Firefox\Profiles\pqhsf9ns.default\prefs.js

[OK] File is clean.

-\\ Google Chrome v23.0.1271.97

File : C:\Users\S M Naveed\AppData\Local\Google\Chrome\User Data\Default\Preferences

[OK] File is clean.

-\\ Chromium v _signature: D/g4au/hHzdTPkvdCONl6+cTzuX0ou7bFxopm9tIyIg=

File : C:\Users\S M Naveed\AppData\Local\Chromium\User Data\Default\Preferences

[OK] File is clean.

*************************

AdwCleaner[R1].txt - [5491 octets] - [30/12/2012 22:42:45]

AdwCleaner[R2].txt - [5551 octets] - [30/12/2012 22:59:04]

AdwCleaner[s1].txt - [5366 octets] - [30/12/2012 22:59:15]

########## EOF - C:\AdwCleaner[s1].txt - [5426 octets] ##########

_______________________________________________________________

Security Check Log :

Results of screen317's Security Check version 0.99.56

Windows 7 Service Pack 1 x64 (UAC is enabled)

Internet Explorer 9

``````````````Antivirus/Firewall Check:``````````````

Windows Firewall Enabled!

Microsoft Security Essentials

Antivirus up to date!

`````````Anti-malware/Other Utilities Check:`````````

Malwarebytes Anti-Malware version 1.70.0.1100

Java 7 Update 10

Java version out of Date!

Adobe Flash Player 11.5.502.135

Adobe Reader 10.1.4 Adobe Reader out of Date!

Mozilla Firefox (17.0.1)

Google Chrome 21.0.1180.83

Google Chrome 21.0.1180.89

Google Chrome 22.0.1229.79

Google Chrome 22.0.1229.92

Google Chrome 22.0.1229.94

Google Chrome 23.0.1271.64

Google Chrome 23.0.1271.91

Google Chrome 23.0.1271.95

Google Chrome 23.0.1271.97

````````Process Check: objlist.exe by Laurent````````

Microsoft Security Essentials MSMpEng.exe

Microsoft Security Essentials msseces.exe

Malwarebytes Anti-Malware mbamservice.exe

Malwarebytes Anti-Malware mbamgui.exe

Malwarebytes' Anti-Malware mbamscheduler.exe

`````````````````System Health check`````````````````

Total Fragmentation on Drive C: 0%

````````````````````End of Log``````````````````````

[Back Door Trojan, Windows security system cannot start.]

Hi,

Below is the log, I don't want to keep any of these listed files, tool bars, You are good to kill them.

(Kindly have a look on my second last post)

# AdwCleaner v2.104 - Logfile created 12/30/2012 at 22:42:45

# Updated 29/12/2012 by Xplode

# Operating system : Windows 7 Home Premium Service Pack 1 (64 bits)

# User : S M Naveed - SMNAVEED-PC

# Boot Mode : Normal

# Running from : C:\Users\S M Naveed\Desktop\adwcleaner.exe

# Option [search]

***** [services] *****

***** [Files / Folders] *****

Folder Found : C:\ProgramData\InstallMate

Folder Found : C:\Users\S M Naveed\AppData\Local\Conduit

Folder Found : C:\Users\S M Naveed\AppData\LocalLow\boost_interprocess

Folder Found : C:\Users\S M Naveed\AppData\LocalLow\Conduit

Folder Found : C:\Users\S M Naveed\AppData\Roaming\OpenCandy

***** [Registry] *****

Key Found : HKCU\Software\1ClickDownload

Key Found : HKCU\Software\AppDataLow\Software\SmartBar

Key Found : HKCU\Software\Conduit

Key Found : HKCU\Software\ilivid

Key Found : HKCU\Software\Softonic

Key Found : HKCU\Software\SweetIM

Key Found : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{006EE092-9658-4FD6-BD8E-A21A348E59F5}

Key Found : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{EEE6C360-6118-11DC-9C72-001320C79847}

Key Found : HKLM\Software\Babylon

Key Found : HKLM\SOFTWARE\Classes\AppID\{09C554C3-109B-483C-A06B-F14172F1A947}

Key Found : HKLM\SOFTWARE\Classes\AppID\{5B1881D1-D9C7-46DF-B041-1E593282C7D0}

Key Found : HKLM\SOFTWARE\Classes\AppID\{BDB69379-802F-4EAF-B541-F8DE92DD98DB}

Key Found : HKLM\SOFTWARE\Classes\AppID\{EA28B360-05E0-4F93-8150-02891F1D8D3C}

Key Found : HKLM\SOFTWARE\Classes\AppID\escort.DLL

Key Found : HKLM\SOFTWARE\Classes\Prod.cap

Key Found : HKLM\SOFTWARE\Classes\Toolbar.CT2704262

Key Found : HKLM\SOFTWARE\Classes\Toolbar.CT3220468

Key Found : HKLM\SOFTWARE\Classes\TypeLib\{9C049BA6-EA47-4AC3-AED6-A66D8DC9E1D8}

Key Found : HKLM\Software\Conduit

Key Found : HKLM\Software\Iminent

Key Found : HKLM\SOFTWARE\Microsoft\Tracing\iLividSetupV1_RASAPI32

Key Found : HKLM\SOFTWARE\Microsoft\Tracing\iLividSetupV1_RASMANCS

Key Found : HKLM\SOFTWARE\Microsoft\Tracing\MyBabylontb_RASAPI32

Key Found : HKLM\SOFTWARE\Microsoft\Tracing\MyBabylontb_RASMANCS

Key Found : HKLM\Software\SweetIM

Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{3C471948-F874-49F5-B338-4F214A2EE0B1}

Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{AE07101B-46D4-4A98-AF68-0333EA26E113}

Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{E46C8196-B634-44A1-AF6E-957C64278AB1}

Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}

Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}

Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{813A22E0-3E2B-4188-9BDA-ECA9878B8D48}

Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}

Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{BCFF5F55-6F44-11D2-86F8-00104B265ED5}

Key Found : HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\jcdgjdiieiljkfkdcloehkohchhpekkn

Key Found : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{006EE092-9658-4FD6-BD8E-A21A348E59F5}

Key Found : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{EEE6C360-6118-11DC-9C72-001320C79847}

Key Found : HKLM\SOFTWARE\Classes\CLSID\{AE07101B-46D4-4A98-AF68-0333EA26E113}

Key Found : HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}

Key Found : HKLM\SOFTWARE\Classes\Interface\{79FB5FC8-44B9-4AF5-BADD-CCE547F953E5}

Key Found : HKLM\SOFTWARE\Classes\Interface\{813A22E0-3E2B-4188-9BDA-ECA9878B8D48}

Key Found : HKLM\SOFTWARE\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}

Key Found : HKLM\SOFTWARE\Classes\Interface\{BCFF5F55-6F44-11D2-86F8-00104B265ED5}

Key Found : HKU\S-1-5-21-2314083050-1812539920-3202108154-1000\Software\Microsoft\Internet Explorer\SearchScopes\{006EE092-9658-4FD6-BD8E-A21A348E59F5}

Key Found : HKU\S-1-5-21-2314083050-1812539920-3202108154-1000\Software\Microsoft\Internet Explorer\SearchScopes\{EEE6C360-6118-11DC-9C72-001320C79847}

Value Found : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar [{AE07101B-46D4-4A98-AF68-0333EA26E113}]

Value Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{AE07101B-46D4-4A98-AF68-0333EA26E113}]

***** [internet Browsers] *****

-\\ Internet Explorer v9.0.8112.16457

[HKCU\Software\Microsoft\Internet Explorer\Search - Default_Search_URL] = hxxp://feed.helperbar.com/?publisher=OPENCANDY&dpid=OPENCANDYAPRIL&co=GB&userid=7dd9212d-bb7e-4f1e-b66c-38098f342e76&affid=111585&searchtype=ds&babsrc=lnkry&q={searchTerms}

[HKCU\Software\Microsoft\Internet Explorer\Search - SearchAssistant] = hxxp://feed.helperbar.com/?publisher=OPENCANDY&dpid=OPENCANDYAPRIL&co=GB&userid=7dd9212d-bb7e-4f1e-b66c-38098f342e76&affid=111585&searchtype=ds&babsrc=lnkry&q={searchTerms}

-\\ Mozilla Firefox v17.0.1 (en-US)

File : C:\Users\S M Naveed\AppData\Roaming\Mozilla\Firefox\Profiles\pqhsf9ns.default\prefs.js

[OK] File is clean.

-\\ Google Chrome v23.0.1271.97

File : C:\Users\S M Naveed\AppData\Local\Google\Chrome\User Data\Default\Preferences

[OK] File is clean.

-\\ Chromium v _signature: D/g4au/hHzdTPkvdCONl6+cTzuX0ou7bFxopm9tIyIg=

File : C:\Users\S M Naveed\AppData\Local\Chromium\User Data\Default\Preferences

[OK] File is clean.

*************************

AdwCleaner[R1].txt - [5380 octets] - [30/12/2012 22:42:45]

########## EOF - C:\AdwCleaner[R1].txt - [5440 octets] ##########

_______________

Thanks

[Back Door Trojan, Windows security system cannot start.]

Hi,

Just noticed that issue with regards to '' Windows security service center '' cannot be started has been RESOLVED.

Now I am getting a message that windows defender is turned off I tried to turned it on and after 2/3 minutes a little window pops up saying that windows defender cannot be turned on. I looked for Microsoft support about this matter and have came to know following:

''Microsoft Security Essentials has its own built-in version of Defender and should automatically disables Vista's version of Windows Defender''.

Though I am not using Windows Vista, I am using 7 home-premium but I am using Microsfot Security Essentials, so is the same rule being applied on windows 7 as well i.e. ''Microsoft Security Essentials has its own built-in version of Defender and should automatically disables Vista's version of Windows Defender''. ?

[Back Door Trojan, Windows security system cannot start.]

I am sorry,

I failed to read the foot note on your last message which is regarding the ComboFix run and having trouble with the Google Chrome or any explorer's opening issue and popping message that: If you get the message Illegal operation attempted on registry key that has been marked fordeletion after you run ComboFix....please reboot the computer, this should resolve the problem. You may have to do this several times if needed.

I have rebooted the system now and Chrome , Firefox plus IE all three are working fine.

Below is the report of ComboFix:

ComboFix 12-12-30.01 - S M Naveed 30/12/2012 21:04:08.1.4 - x64

Microsoft Windows 7 Home Premium 6.1.7601.1.1252.44.1033.18.2979.1566 [GMT 0:00]

Running from: c:\users\S M Naveed\Desktop\ComboFix.exe

AV: ESET NOD32 Antivirus 5.2 *Enabled/Updated* {77DEAFED-8149-104B-25A1-21771CA47CD1}

SP: ESET NOD32 Antivirus 5.2 *Enabled/Updated* {CCBF4E09-A773-1FC5-1F11-1A056723366C}

SP: Spybot - Search and Destroy *Enabled/Updated* {9BC38DF1-3CCA-732D-A930-C1CA5F20A4B0}

SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

.

c:\programdata\100

c:\programdata\5159734F10.sys

c:\programdata\emopts.dat

c:\programdata\msadoex.dll

c:\programdata\Roaming

C:\System

c:\system\fastlaps.txt

c:\users\S M Naveed\AppData\Local\Microsoft\Windows\Ardamax Keylogger Setup.exe

c:\users\S M Naveed\AppData\Local\Microsoft\Windows\winupdate.exe

c:\users\S M Naveed\AppData\Roaming\S M Naveedlog.dat

c:\windows\~GLC0000.TMP

c:\windows\~GLC0001.TMP

c:\windows\~GLH0000.TMP

c:\windows\~GLH0001.TMP

c:\windows\SNMPAPI.DLL

c:\windows\SysWow64\CTF

c:\windows\SysWow64\drivers\npf.sys

c:\windows\SysWow64\Packet.dll

c:\windows\SysWow64\WanPacket.dll

c:\windows\SysWow64\wpcap.dll

c:\windows\wininit.ini

c:\windows\WinRAR

.

.

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.

.

-------\Service_NPF

.

.

((((((((((((((((((((((((( Files Created from 2012-11-28 to 2012-12-30 )))))))))))))))))))))))))))))))

.

.

2012-12-30 20:12 . 2012-11-08 09:24 9125352 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{15B752F6-CCCE-49B2-A686-981C220A9E73}\mpengine.dll

2012-12-29 03:56 . 2012-12-14 16:49 24176 ----a-w- c:\windows\system32\drivers\mbam.sys

2012-12-29 01:37 . 2012-12-29 01:37 -------- d-----w- c:\users\S M Naveed\AppData\Roaming\SUPERAntiSpyware.com

2012-12-28 22:15 . 2012-12-28 22:15 972264 ------w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{7AEC934D-E713-4E29-BFD9-1A0C6C95597A}\gapaengine.dll

2012-12-28 22:15 . 2012-11-08 09:24 9125352 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll

2012-12-28 22:14 . 2012-12-28 22:14 -------- d-----w- c:\program files (x86)\Microsoft Security Client

2012-12-28 19:47 . 2012-11-08 17:24 9125352 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{FE31C3C7-CAE9-46E8-82BC-3CDC0FB60E2E}\mpengine.dll

2012-12-28 06:42 . 2012-12-28 22:14 -------- d-----w- c:\program files\Microsoft Security Client

2012-12-28 01:19 . 2012-12-28 01:19 -------- d-----w- c:\users\S M Naveed\AppData\Roaming\QFX Software

2012-12-28 01:19 . 2012-12-28 01:19 -------- d-----w- c:\programdata\QFX Software

2012-12-28 00:14 . 2012-12-28 00:53 -------- d-----w- c:\programdata\Spybot - Search & Destroy

2012-12-28 00:13 . 2012-12-28 00:13 -------- d-----w- c:\users\S M Naveed\AppData\Local\Programs

2012-12-28 00:03 . 2012-12-28 01:01 -------- d-----w- c:\programdata\SecTaskMan

2012-12-27 23:14 . 2012-12-27 23:14 -------- d-----w- c:\users\S M Naveed\AppData\Local\Welltek_Software

2012-12-27 19:31 . 2012-12-27 19:31 -------- d-----w- c:\program files (x86)\Ccleaner Business Edition x64 x86 Tom_Da_Man

2012-12-26 20:33 . 2012-12-27 02:19 -------- d-----w- c:\users\S M Naveed\AppData\Local\WMTools Downloaded Files

2012-12-20 20:26 . 2012-12-16 17:11 46080 ----a-w- c:\windows\system32\atmlib.dll

2012-12-20 20:26 . 2012-12-16 14:13 34304 ----a-w- c:\windows\SysWow64\atmlib.dll

2012-12-20 20:25 . 2012-12-16 14:45 367616 ----a-w- c:\windows\system32\atmfd.dll

2012-12-20 20:25 . 2012-12-16 14:13 295424 ----a-w- c:\windows\SysWow64\atmfd.dll

2012-12-20 04:42 . 2012-12-20 04:42 -------- d-----w- c:\users\S M Naveed\AppData\Roaming\Strongvault

2012-12-20 04:41 . 2012-12-20 04:41 -------- d-----w- c:\users\S M Naveed\AppData\Local\Stronghold_LLC

2012-12-20 04:41 . 2012-12-22 00:54 -------- d-sh--w- c:\windows\SysWow64\AI_RecycleBin

2012-12-20 04:40 . 2012-12-20 04:41 -------- d-----w- c:\programdata\Freemake

2012-12-20 04:39 . 2012-12-20 04:40 -------- d-----w- c:\program files (x86)\Freemake

2012-12-19 23:19 . 2012-12-19 23:19 -------- d-----w- c:\users\S M Naveed\AppData\Roaming\Softplicity

2012-12-19 23:18 . 2012-12-19 23:19 -------- d-----w- c:\program files (x86)\TotalAudioConverter

2012-12-19 23:10 . 2012-12-20 00:09 -------- d-----w- c:\users\S M Naveed\AppData\Roaming\WindSolutions

2012-12-19 23:10 . 2012-12-20 00:09 -------- d-----w- c:\programdata\WindSolutions

2012-12-19 05:19 . 2012-12-19 05:19 -------- d-----w- c:\program files (x86)\Common Files\Java

2012-12-19 05:19 . 2012-12-19 05:19 95184 ----a-w- c:\windows\SysWow64\WindowsAccessBridge-32.dll

2012-12-19 05:18 . 2012-12-19 05:18 -------- d-----w- c:\program files (x86)\Java

2012-12-19 02:12 . 2012-12-19 05:25 -------- d-----w- c:\users\S M Naveed\AppData\Roaming\Apple Computer

2012-12-19 02:12 . 2012-12-19 02:12 -------- d-----w- c:\users\S M Naveed\AppData\Local\Apple Computer

2012-12-19 02:11 . 2012-08-21 13:01 33240 ----a-w- c:\windows\system32\drivers\GEARAspiWDM.sys

2012-12-19 02:10 . 2012-12-19 02:10 -------- d-----w- c:\program files\iPod

2012-12-19 02:10 . 2012-12-19 02:11 -------- d-----w- c:\programdata\34BE82C4-E596-4e99-A191-52C6199EBF69

2012-12-19 02:10 . 2012-12-19 02:11 -------- d-----w- c:\program files\iTunes

2012-12-19 02:10 . 2012-12-19 02:11 -------- d-----w- c:\program files (x86)\iTunes

2012-12-19 02:10 . 2012-12-19 02:10 -------- d-----w- c:\programdata\Apple Computer

2012-12-19 02:08 . 2012-12-19 02:08 -------- d-----w- c:\users\S M Naveed\AppData\Local\Apple

2012-12-19 02:07 . 2012-12-19 02:08 -------- d-----w- c:\program files (x86)\Apple Software Update

2012-12-19 02:07 . 2012-12-19 02:07 -------- d-----w- c:\program files\Common Files\Apple

2012-12-19 02:07 . 2012-12-19 02:07 -------- d-----w- c:\program files\Bonjour

2012-12-19 02:07 . 2012-12-19 02:07 -------- d-----w- c:\program files (x86)\Bonjour

2012-12-19 02:06 . 2012-12-19 02:10 -------- d-----w- c:\program files (x86)\Common Files\Apple

2012-12-19 02:06 . 2012-12-19 02:07 -------- d-----w- c:\programdata\Apple

2012-12-19 01:21 . 2012-12-19 01:36 -------- d-----w- c:\program files (x86)\Total Video Converter

2012-12-17 22:16 . 2012-12-17 22:16 -------- d-----w- c:\users\S M Naveed\dwhelper

2012-12-17 22:07 . 2012-12-17 22:07 -------- d-----w- c:\users\S M Naveed\AppData\Local\Macromedia

2012-12-17 22:05 . 2012-12-17 22:05 -------- d-----w- c:\program files (x86)\Mozilla Maintenance Service

2012-12-14 22:59 . 2012-12-14 22:59 -------- d-----w- c:\program files (x86)\PhotoScape

2012-12-12 19:55 . 2012-11-02 05:59 478208 ----a-w- c:\windows\system32\dpnet.dll

2012-12-12 19:55 . 2012-11-02 05:11 376832 ----a-w- c:\windows\SysWow64\dpnet.dll

2012-12-01 05:04 . 2012-12-01 05:04 -------- d-----w- c:\program files (x86)\Intelore

.

.

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2012-12-27 20:32 . 2011-12-16 00:51 231376 ----a-w- c:\windows\system32\drivers\truecrypt.sys

2012-12-19 05:18 . 2011-11-09 20:26 779704 ----a-w- c:\windows\SysWow64\deployJava1.dll

2012-12-13 03:06 . 2011-11-10 23:52 67413224 ----a-w- c:\windows\system32\MRT.exe

2012-12-12 19:57 . 2012-04-06 18:04 697272 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe

2012-12-12 19:57 . 2011-11-09 20:29 73656 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl

2012-11-13 20:29 . 2012-11-13 20:29 354216 ----a-w- c:\windows\SysWow64\DivXControlPanelApplet.cpl

2012-10-19 19:53 . 2012-10-19 19:53 163056 ----a-w- c:\programdata\Microsoft\Windows\Sqm\Manifest\Sqm10142.bin

2012-10-16 08:38 . 2012-11-27 19:51 135168 ----a-w- c:\windows\apppatch\AppPatch64\AcXtrnal.dll

2012-10-16 08:38 . 2012-11-27 19:51 350208 ----a-w- c:\windows\apppatch\AppPatch64\AcLayers.dll

2012-10-16 07:39 . 2012-11-27 19:51 561664 ----a-w- c:\windows\apppatch\AcLayers.dll

2012-10-09 18:17 . 2012-11-13 20:48 55296 ----a-w- c:\windows\system32\dhcpcsvc6.dll

2012-10-09 18:17 . 2012-11-13 20:48 226816 ----a-w- c:\windows\system32\dhcpcore6.dll

2012-10-09 17:40 . 2012-11-13 20:48 44032 ----a-w- c:\windows\SysWow64\dhcpcsvc6.dll

2012-10-09 17:40 . 2012-11-13 20:48 193536 ----a-w- c:\windows\SysWow64\dhcpcore6.dll

2012-10-04 16:40 . 2012-12-12 19:56 44032 ----a-w- c:\windows\apppatch\acwow64.dll

2012-10-03 17:56 . 2012-11-13 20:45 1914248 ----a-w- c:\windows\system32\drivers\tcpip.sys

2012-10-03 17:44 . 2012-11-13 20:45 303104 ----a-w- c:\windows\system32\nlasvc.dll

2012-10-03 17:44 . 2012-11-13 20:45 70656 ----a-w- c:\windows\system32\nlaapi.dll

2012-10-03 17:44 . 2012-11-13 20:45 246272 ----a-w- c:\windows\system32\netcorehc.dll

2012-10-03 17:44 . 2012-11-13 20:45 18944 ----a-w- c:\windows\system32\netevent.dll

2012-10-03 17:44 . 2012-11-13 20:45 216576 ----a-w- c:\windows\system32\ncsi.dll

2012-10-03 17:42 . 2012-11-13 20:45 569344 ----a-w- c:\windows\system32\iphlpsvc.dll

2012-10-03 16:42 . 2012-11-13 20:45 18944 ----a-w- c:\windows\SysWow64\netevent.dll

2012-10-03 16:42 . 2012-11-13 20:45 175104 ----a-w- c:\windows\SysWow64\netcorehc.dll

2012-10-03 16:42 . 2012-11-13 20:45 156672 ----a-w- c:\windows\SysWow64\ncsi.dll

2012-10-03 16:07 . 2012-11-13 20:45 45568 ----a-w- c:\windows\system32\drivers\tcpipreg.sys

.

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"NokiaSuite.exe"="c:\program files (x86)\Nokia\Nokia Suite\NokiaSuite.exe" [2012-10-13 1088424]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]

"Dell Webcam Central"="c:\program files (x86)\Dell Webcam\Dell Webcam Central\WebcamDell2.exe" [2010-08-19 487562]

"IAStorIcon"="c:\program files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe" [2010-11-06 283160]

"NUSB3MON"="c:\program files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe" [2010-11-17 113288]

"RoxWatchTray"="c:\program files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxWatchTray12OEM.exe" [2010-11-25 240112]

"Desktop Disc Tool"="c:\program files (x86)\Roxio\OEM\Roxio Burn\RoxioBurnLauncher.exe" [2010-11-17 514544]

"Dell Registration"="c:\program files (x86)\System Registration\prodreg.exe" [2010-08-23 3926528]

"Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe" [2012-07-27 35768]

"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-07-27 919008]

"PWRISOVM.EXE"="c:\program files (x86)\PowerISO\PWRISOVM.EXE" [2007-08-07 200704]

"DivXMediaServer"="c:\program files (x86)\DivX\DivX Media Server\DivXMediaServer.exe" [2012-11-13 450560]

"DivXUpdate"="c:\program files (x86)\DivX\DivX Update\DivXUpdate.exe" [2012-11-01 1263512]

"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-11-28 59280]

"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2012-12-12 152544]

"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2012-07-03 252848]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"ConsentPromptBehaviorUser"= 3 (0x3)

"EnableUIADesktopToggle"= 0 (0x0)

"ConsentPromptBehaviorAdmin"= 5 (0x5)

.

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]

"EnableLUA"= 0 (0x0)

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]

"mixer"=wdmaud.drv

.

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]

BootExecute REG_MULTI_SZ autocheck autochk *\0\0sdnclean64.exe

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]

@=""

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]

@="Service"

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]

@="Driver"

.

[HKEY_LOCAL_MACHINE\software\microsoft\security center]

"AntiVirusDisableNotify"="0"

.

R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]

R2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2012-12-14 682344]

R2 RoxWatch12;Roxio Hard Drive Watcher 12;c:\program files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxWatch12OEM.exe [2010-11-25 219632]

R3 massfilter;ZTE Mass Storage Filter Driver;c:\windows\system32\drivers\massfilter.sys [x]

R3 MyWiFiDHCPDNS;Wireless PAN DHCP Server;c:\program files\Intel\WiFi\bin\PanDhcpDns.exe [2010-12-17 340240]

R3 Netaapl;Apple Mobile Device Ethernet Service;c:\windows\system32\DRIVERS\netaapl64.sys [2012-03-26 22528]

R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys [2012-08-30 128456]

R3 NisSrv;Microsoft Network Inspection;c:\program files\Microsoft Security Client\NisSrv.exe [2012-09-12 368896]

R3 nmwcdnsucx64;Nokia USB Flashing Generic;c:\windows\system32\drivers\nmwcdnsucx64.sys [2012-06-11 12800]

R3 nmwcdnsux64;Nokia USB Flashing Phone Parent;c:\windows\system32\drivers\nmwcdnsux64.sys [2012-06-11 171008]

R3 ose64;Office 64 Source Engine;c:\program files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2010-01-09 174440]

R3 RoxMediaDB12OEM;RoxMediaDB12OEM;c:\program files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxMediaDB12OEM.exe [2010-11-25 1116656]

R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUStor.sys [2010-10-30 250984]

R3 SWNC8U80;Sierra Wireless MUX NDIS Driver (UMTS80);c:\windows\system32\DRIVERS\swnc8u80.sys [2008-05-20 199168]

R3 SWUMX80;Sierra Wireless USB MUX Driver (UMTS80);c:\windows\system32\DRIVERS\swumx80.sys [2008-05-20 192256]

R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-21 59392]

R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [2010-11-21 31232]

R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [2012-09-28 53760]

R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2011-11-11 1255736]

R3 ZTEusbnet;ZTE USB-NDIS miniport;c:\windows\system32\DRIVERS\ZTEusbnet.sys [2009-07-21 135168]

R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-22 57184]

S0 PxHlpa64;PxHlpa64;c:\windows\System32\Drivers\PxHlpa64.sys [2010-03-19 55856]

S0 sptd;sptd;c:\windows\\SystemRoot\System32\Drivers\sptd.sys [x]

S2 AESTFilters;Andrea ST Filters Service;c:\program files\IDT\WDM\AESTSr64.exe [2009-03-03 89600]

S2 Bluetooth Device Monitor;Bluetooth Device Monitor;c:\program files (x86)\Intel\Bluetooth\devmonsrv.exe [2010-11-03 897088]

S2 FlexService;Remote Connections Service;c:\program files (x86)\RapidBIT\cisvc.exe [2009-05-17 41984]

S2 IAStorDataMgrSvc;Intel® Rapid Storage Technology;c:\program files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe [2010-11-06 13336]

S2 MBAMScheduler;MBAMScheduler;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [2012-12-14 398184]

S2 TeamViewer8;TeamViewer 8;c:\program files (x86)\TeamViewer\Version8\TeamViewer_Service.exe [2012-12-14 3467768]

S2 UNS;Intel® Management and Security Application User Notification Service;c:\program files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe [2010-10-06 2655768]

S3 btmaux;Intel Bluetooth Auxiliary Service;c:\windows\system32\DRIVERS\btmaux.sys [2010-11-04 58128]

S3 btmhsf;btmhsf;c:\windows\system32\DRIVERS\btmhsf.sys [2010-10-19 274432]

S3 CtClsFlt;Creative Camera Class Upper Filter Driver;c:\windows\system32\DRIVERS\CtClsFlt.sys [2010-08-12 175168]

S3 iBtFltCoex;iBtFltCoex;c:\windows\system32\DRIVERS\iBtFltCoex.sys [2010-11-04 59904]

S3 IntcDAud;Intel® Display Audio;c:\windows\system32\DRIVERS\IntcDAud.sys [2010-10-15 317440]

S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2012-12-14 24176]

S3 nusb3hub;Renesas Electronics USB 3.0 Hub Driver;c:\windows\system32\DRIVERS\nusb3hub.sys [2010-12-10 80384]

S3 nusb3xhc;Renesas Electronics USB 3.0 Host Controller Driver;c:\windows\system32\DRIVERS\nusb3xhc.sys [2010-12-10 181248]

S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [2010-10-26 406632]

S3 swivsp;AC8xx Virtual Serial Port;c:\windows\system32\DRIVERS\swivspnt.sys [2007-03-26 23552]

S3 wdkmd;Intel WiDi KMD;c:\windows\system32\DRIVERS\WDKMD.sys [2010-12-01 42392]

.

.

--- Other Services/Drivers In Memory ---

.

*NewlyCreated* - WS2IFSL

.

Contents of the 'Scheduled Tasks' folder

.

2012-12-30 c:\windows\Tasks\Adobe Flash Player Updater.job

- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-06 19:57]

.

2012-12-30 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-01-26 04:05]

.

2012-12-30 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-01-26 04:05]

.

2012-12-29 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2314083050-1812539920-3202108154-1000Core.job

- c:\users\S M Naveed\AppData\Local\Google\Update\GoogleUpdate.exe [2012-08-10 02:17]

.

2012-12-30 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2314083050-1812539920-3202108154-1000UA.job

- c:\users\S M Naveed\AppData\Local\Google\Update\GoogleUpdate.exe [2012-08-10 02:17]

.

2012-12-16 c:\windows\Tasks\PCDoctorBackgroundMonitorTask.job

- c:\program files\Dell Support Center\uaclauncher.exe [2011-10-06 20:32]

.

2012-12-30 c:\windows\Tasks\SystemToolsDailyTest.job

- c:\program files\Dell Support Center\uaclauncher.exe [2011-10-06 20:32]

.

.

--------- X64 Entries -----------

.

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveBlacklistedOverlay]

@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42}"

[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42}]

2012-11-08 16:58 755224 ----a-w- c:\program files (x86)\Google\Drive\googledrivesync64.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSharedOverlay]

@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D43}"

[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D43}]

2012-11-08 16:58 755224 ----a-w- c:\program files (x86)\Google\Drive\googledrivesync64.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSyncedOverlay]

@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40}"

[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40}]

2012-11-08 16:58 755224 ----a-w- c:\program files (x86)\Google\Drive\googledrivesync64.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSyncingOverlay]

@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41}"

[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41}]

2012-11-08 16:58 755224 ----a-w- c:\program files (x86)\Google\Drive\googledrivesync64.dll

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"IgfxTray"="c:\windows\system32\igfxtray.exe" [2011-03-30 167960]

"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2011-03-30 391704]

"Persistence"="c:\windows\system32\igfxpers.exe" [2011-03-30 418840]

"SysTrayApp"="c:\program files\IDT\WDM\sttray64.exe" [2011-01-25 525312]

"Apoint"="c:\program files\DellTPad\Apoint.exe" [2011-04-12 609144]

"IntelWireless"="c:\program files\Common Files\Intel\WirelessCommon\iFrmewrk.exe" [2010-12-17 1933584]

"BTMTrayAgent"="c:\program files (x86)\Intel\Bluetooth\btmshell.dll" [2010-11-03 10228224]

"DellStage"="c:\program files (x86)\Dell Stage\Dell Stage\stage_primary.exe" [2011-01-25 1802472]

"itype"="c:\program files\Microsoft IntelliType Pro\itype.exe" [2011-08-10 1873256]

"Windows Mobile Device Center"="c:\windows\WindowsMobile\wmdc.exe" [2007-05-31 660360]

"Windows Mobile-based device management"="c:\windows\WindowsMobile\wmdc.exe" [2007-05-31 660360]

"BCSSync"="c:\program files\Microsoft Office\Office14\BCSSync.exe" [2010-03-13 112512]

"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2012-09-12 1289704]

.

------- Supplementary Scan -------

.

uLocal Page = c:\windows\system32\blank.htm

uStart Page =

mLocal Page = c:\windows\SysWOW64\blank.htm

uInternet Settings,ProxyOverride = <local>;*.local

uSearchAssistant = hxxp://feed.helperbar.com/?publisher=OPENCANDY&dpid=OPENCANDYAPRIL&co=GB&userid=7dd9212d-bb7e-4f1e-b66c-38098f342e76&affid=111585&searchtype=ds&babsrc=lnkry&q={searchTerms}

IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~1\Office14\EXCEL.EXE/3000

IE: Se&nd to OneNote - c:\progra~2\MICROS~1\Office14\ONBttnIE.dll/105

TCP: DhcpNameServer = 192.168.1.254

TCP: Interfaces\{C4FE17F4-E75C-4F22-B042-7C68441C8C8F}: NameServer = 8.8.8.8,8.8.4.4

TCP: Interfaces\{C4FE17F4-E75C-4F22-B042-7C68441C8C8F}\371617962602B68616E6: NameServer = 8.8.8.8,8.8.4.4

TCP: Interfaces\{C4FE17F4-E75C-4F22-B042-7C68441C8C8F}\4516C6B64516C6B6532303: NameServer = 8.8.8.8,8.8.4.4

TCP: Interfaces\{C4FE17F4-E75C-4F22-B042-7C68441C8C8F}\642716762716E63656: NameServer = 8.8.8.8,8.8.4.4

TCP: Interfaces\{C4FE17F4-E75C-4F22-B042-7C68441C8C8F}\9446F62457479444F6E647: NameServer = 8.8.8.8,8.8.4.4

FF - ProfilePath - c:\users\S M Naveed\AppData\Roaming\Mozilla\Firefox\Profiles\pqhsf9ns.default\

FF - ExtSQL: 2012-11-16 04:43; {23fcfd51-4958-4f00-80a3-ae97e717ed8b}; c:\program files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5

FF - ExtSQL: 2012-12-17 22:13; {b9db16a4-6edc-47ec-a1f4-b86292ed211d}; c:\users\S M Naveed\AppData\Roaming\Mozilla\Firefox\Profiles\pqhsf9ns.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}

FF - ExtSQL: 2012-12-17 22:19; {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}; c:\users\S M Naveed\AppData\Roaming\Mozilla\Firefox\Profiles\pqhsf9ns.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi

.

- - - - ORPHANS REMOVED - - - -

.

URLSearchHooks-{7473b6bd-4691-4744-a82b-7854eb3d70b6} - (no file)

Wow6432Node-HKCU-Run-Facebook Update - c:\users\S M Naveed\AppData\Local\Facebook\Update\FacebookUpdate.exe

AddRemove-Adobe Shockwave Player - c:\windows\system32\Adobe\Shockwave 11\uninstaller.exe

.

.

.

--------------------- LOCKED REGISTRY KEYS ---------------------

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\windows\\system32\\Macromed\\Flash\\FlashUtil64_11_5_502_135_ActiveX.exe,-101"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]

"Enabled"=dword:00000001

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]

@="c:\\windows\\system32\\Macromed\\Flash\\FlashUtil64_11_5_502_135_ActiveX.exe"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="IFlashBroker5"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_5_502_135_ActiveX.exe,-101"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]

"Enabled"=dword:00000001

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]

@="c:\\windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_5_502_135_ActiveX.exe"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Shockwave Flash Object"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_5_502_135.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]

@="0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]

@="ShockwaveFlash.ShockwaveFlash.11"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_5_502_135.ocx, 1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="ShockwaveFlash.ShockwaveFlash"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Macromedia Flash Factory Object"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_5_502_135.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]

@="FlashFactory.FlashFactory.1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_5_502_135.ocx, 1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="FlashFactory.FlashFactory"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="IFlashBroker5"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\McAfee]

"SymbolicLinkValue"=hex(6):5c,00,72,00,65,00,67,00,69,00,73,00,74,00,72,00,79,

00,5c,00,6d,00,61,00,63,00,68,00,69,00,6e,00,65,00,5c,00,53,00,6f,00,66,00,\

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]

@Denied: (A) (Everyone)

"Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3]

@Denied: (A) (Everyone)

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0]

"Key"="ActionsPane3"

"Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows CE Services]

"SymbolicLinkValue"=hex(6):5c,00,72,00,65,00,67,00,69,00,73,00,74,00,72,00,79,

00,5c,00,4d,00,41,00,43,00,48,00,49,00,4e,00,45,00,5c,00,53,00,4f,00,46,00,\

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]

@Denied: (Full) (Everyone)

.

------------------------ Other Running Processes ------------------------

.

c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

c:\program files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe

.

**************************************************************************

.

Completion time: 2012-12-30 21:31:42 - machine was rebooted

ComboFix-quarantined-files.txt 2012-12-30 21:31

.

Pre-Run: 188,268,494,848 bytes free

Post-Run: 188,661,366,784 bytes free

.

- - End Of File - - 90F7C8A13ECAD268E42161432F4DA960

______________

Many thanks

[Back Door Trojan, Windows security system cannot start.]

My Goodness just read the foot note

[Back Door Trojan, Windows security system cannot start.]

Many thanks for your help,

I dont know how to post that ComboFix report from myiphone, Since it is saved on my system and chrome plus firefox are not opening there.

What should I follow now ?

[Back Door Trojan, Windows security system cannot start.]

Hi,

It has finished the scan and rebooted the system but now I cannot open google chrome or Firefox, when I click to open them the window doesnt open and a little window pop ups with following message:

C:\users\S M Naveed\App Data\Local\Chrome\Application\Chrome.exe

Illegal operation attempted on a registery key that has been marker for deletion.

Sent frm iphone

[Back Door Trojan, Windows security system cannot start.]

Hi,

I have already uninstalled ESET NOD32 and Spybot from my system two days ago. and at the moment I only have mbam and Microsoft security essentials which are disabled at the moment for the ComboFix to perform scan but I am still receiving following message whilst trying to run ComboFix:

ComboFix has detected the following real times scanner(s) to be active:

antivirus: ESET NOD32 Antivirus 5.2

antispyware: ESET NOD32 Antivirus 5.2

antispyware: Spybot - Search and Destroy

Antivirus and intrusions prevention programs are known to interfere with ComboFix's running. This may lead to unpredictable results or possible machine damage.

Please disable these scanners before clicking 'OK'.

______________________________________________

I clicked OK and below was the next message which appeared:

Warning !!!

antivirus: ESET NOD32 Antivirus 5.2

antispyware: ESET NOD32 Antivirus 5.2

antispyware: Spybot - Search and Destroy

These above real time scanner(s) are still active but ComboFix shall continue to run. Kindly note that this is at your own risk. ''OK''

I clicked on X icon at the top right to close and stop the scanning but still a new blue window opened and started scanning but no sooner it started I clicked on the cross, on top right to close and it closed down and disappeared.

[Back Door Trojan, Windows security system cannot start.]

Rogue Killer report:

RogueKiller V8.4.1 [Dec 28 2012] by Tigzy

mail : tigzyRK<at>gmail<dot>com

Feedback : http://www.geekstogo.com/forum/files/file/413-roguekiller/

Website : http://tigzy.geekstogo.com/roguekiller.php

Blog : http://tigzyrk.blogspot.com/

Operating System : Windows 7 (6.1.7601 Service Pack 1) 64 bits version

Started in : Normal mode

User : S M Naveed [Admin rights]

Mode : Scan -- Date : 12/30/2012 20:08:49

¤¤¤ Bad processes : 0 ¤¤¤

¤¤¤ Registry Entries : 5 ¤¤¤

[HJPOL] HKCU\[...]\System : DisableTaskMgr (0) -> FOUND

[HJPOL] HKCU\[...]\System : DisableRegistryTools (0) -> FOUND

[HJ] HKCU\[...]\System : EnableLUA (0) -> FOUND

[HJ DESK] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> FOUND

[HJ DESK] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND

¤¤¤ Particular Files / Folders: ¤¤¤

¤¤¤ Driver : [NOT LOADED] ¤¤¤

¤¤¤ HOSTS File: ¤¤¤

--> C:\windows\system32\drivers\etc\hosts

¤¤¤ MBR Check: ¤¤¤

+++++ PhysicalDrive0: WDC WD5000BPVT-75HXZT1 +++++

--- User ---

[MBR] 2928d5df92ec4e876bd083063558990d

[bSP] f6ffd7acb865219c12efc2eb06e726f9 : Windows 7/8 MBR Code

Partition table:

0 - [XXXXXX] DELL-UTIL (0xde) [VISIBLE] Offset (sectors): 2048 | Size: 100 Mo

1 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 206848 | Size: 15000 Mo

2 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 30926848 | Size: 461838 Mo

User = LL1 ... OK!

User = LL2 ... OK!

Finished : << RKreport[1]_S_12302012_02d2008.txt >>

RKreport[1]_S_12302012_02d2008.txt

[Back Door Trojan, Windows security system cannot start.]

Malwarebytes Anti-Malware (PRO) 1.70.0.1100

www.malwarebytes.org

Database version: v2012.12.29.02

Windows 7 Service Pack 1 x64 NTFS

Internet Explorer 9.0.8112.16421

S M Naveed :: SMNAVEED-PC [administrator]

Protection: Enabled

29/12/2012 04:03:18

mbam-log-2012-12-29 (04-03-18).txt

Scan type: Full scan (C:\|D:\|)

Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM

Scan options disabled: P2P

Objects scanned: 347720

Time elapsed: 1 hour(s), 7 minute(s), 47 second(s)

Memory Processes Detected: 0

(No malicious items detected)

Memory Modules Detected: 0

(No malicious items detected)

Registry Keys Detected: 0

(No malicious items detected)

Registry Values Detected: 0

(No malicious items detected)

Registry Data Items Detected: 0

(No malicious items detected)

Folders Detected: 0

(No malicious items detected)

Files Detected: 0

(No malicious items detected)

(end)

[Back Door Trojan, Windows security system cannot start.]

This log was after I updated to 1.70.mbam

Malwarebytes Anti-Malware (PRO) 1.70.0.1100

www.malwarebytes.org

Database version: v2012.12.30.08

Windows 7 Service Pack 1 x64 NTFS

Internet Explorer 9.0.8112.16421

S M Naveed :: SMNAVEED-PC [administrator]

Protection: Enabled

30/12/2012 18:48:50

mbam-log-2012-12-30 (18-48-50).txt

Scan type: Full scan (C:\|D:\|)

Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM

Scan options disabled: P2P

Objects scanned: 48881

Time elapsed: 7 minute(s), 30 second(s) [aborted]

Memory Processes Detected: 0

(No malicious items detected)

Memory Modules Detected: 0

(No malicious items detected)

Registry Keys Detected: 0

(No malicious items detected)

Registry Values Detected: 0

(No malicious items detected)

Registry Data Items Detected: 0

(No malicious items detected)

Folders Detected: 0

(No malicious items detected)

Files Detected: 0

(No malicious items detected)

(end)

[Back Door Trojan, Windows security system cannot start.]

Thanks, follwing are the mbam logs which I randomly did plus dds.text and attach,text

Malwarebytes Anti-Malware (PRO) 1.60.1.1000

www.malwarebytes.org

Database version: v2012.12.27.01

Windows 7 Service Pack 1 x64 NTFS

Internet Explorer 9.0.8112.16421

S M Naveed :: SMNAVEED-PC [administrator]

Protection: Enabled

28/12/2012 01:36:47

mbam-log-2012-12-28 (01-36-47).txt

Scan type: Full scan

Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM

Scan options disabled: P2P

Objects scanned: 351596

Time elapsed: 1 hour(s), 5 minute(s), 8 second(s)

Memory Processes Detected: 1

C:\Windupdt\winupdate.exe (Trojan.MSIL.Gen) -> 1320 -> Delete on reboot.

Memory Modules Detected: 0

(No malicious items detected)

Registry Keys Detected: 1

HKCU\Software\DC3_FEXEC (Malware.Trace) -> Quarantined and deleted successfully.

Registry Values Detected: 1

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|winupdater (Trojan.MSIL.Gen) -> Data: C:\Windupdt\winupdate.exe -> Quarantined and deleted successfully.

Registry Data Items Detected: 3

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System|DisableTaskMgr (PUM.Hijack.TaskManager) -> Bad: (1) Good: (0) -> Quarantined and repaired successfully.

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System|DisableRegistryTools (PUM.Hijack.Regedit) -> Bad: (1) Good: (0) -> Quarantined and repaired successfully.

HKLM\SOFTWARE\Microsoft\Security Center|AntiVirusDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and repaired successfully.

Folders Detected: 1

C:\Users\S M Naveed\AppData\Local\Temp\dclogs (Stolen.Data) -> Quarantined and deleted successfully.

Files Detected: 4

C:\Windupdt\winupdate.exe (Trojan.MSIL.Gen) -> Delete on reboot.

C:\$Recycle.Bin\S-1-5-21-2314083050-1812539920-3202108154-1000\$RBXO9P3.exe (RiskWare.Tool.CK) -> Quarantined and deleted successfully.

C:\ProgramData\SUS\SUS.01 (Trojan.Ardamax) -> Quarantined and deleted successfully.

C:\Users\S M Naveed\AppData\Local\Temp\dclogs\2012-12-28-6.dc (Stolen.Data) -> Quarantined and deleted successfully.

(end)

---------------------------------------------

Malwarebytes Anti-Malware (PRO) 1.60.1.1000

www.malwarebytes.org

Database version: v2012.12.28.01

Windows 7 Service Pack 1 x64 NTFS

Internet Explorer 9.0.8112.16421

S M Naveed :: SMNAVEED-PC [administrator]

Protection: Enabled

28/12/2012 07:13:08

mbam-log-2012-12-28 (07-13-08).txt

Scan type: Full scan

Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM

Scan options disabled: P2P

Objects scanned: 350827

Time elapsed: 1 hour(s), 31 minute(s), 22 second(s)

Memory Processes Detected: 0

(No malicious items detected)

Memory Modules Detected: 0

(No malicious items detected)

Registry Keys Detected: 0

(No malicious items detected)

Registry Values Detected: 1

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|winupdater (Backdoor.Agent) -> Data: C:\Windupdt\winupdate.exe -> Quarantined and deleted successfully.

Registry Data Items Detected: 0

(No malicious items detected)

Folders Detected: 0

(No malicious items detected)

Files Detected: 0

(No malicious items detected)

(end)

_____________________________________

Malwarebytes Anti-Malware (PRO) 1.60.1.1000

www.malwarebytes.org

Database version: v2012.12.28.01

Windows 7 Service Pack 1 x64 NTFS

Internet Explorer 9.0.8112.16421

S M Naveed :: SMNAVEED-PC [administrator]

Protection: Enabled

28/12/2012 19:33:13

mbam-log-2012-12-28 (19-33-13).txt

Scan type: Full scan

Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM

Scan options disabled: P2P

Objects scanned: 1869

Time elapsed: 53 second(s) [aborted]

Memory Processes Detected: 0

(No malicious items detected)

Memory Modules Detected: 0

(No malicious items detected)

Registry Keys Detected: 0

(No malicious items detected)

Registry Values Detected: 0

(No malicious items detected)

Registry Data Items Detected: 0

(No malicious items detected)

Folders Detected: 0

(No malicious items detected)

Files Detected: 0

(No malicious items detected)

(end)

_______________________________

DDS (Ver_2012-11-20.01) - NTFS_AMD64

Internet Explorer: 9.0.8112.16457 BrowserJavaVersion: 10.10.2

Run by S M Naveed at 19:10:47 on 2012-12-30

Microsoft Windows 7 Home Premium 6.1.7601.1.1252.44.1033.18.2979.1054 [GMT 0:00]

.

AV: ESET NOD32 Antivirus 5.2 *Enabled/Updated* {77DEAFED-8149-104B-25A1-21771CA47CD1}

SP: ESET NOD32 Antivirus 5.2 *Enabled/Updated* {CCBF4E09-A773-1FC5-1F11-1A056723366C}

SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

SP: Spybot - Search and Destroy *Enabled/Updated* {9BC38DF1-3CCA-732D-A930-C1CA5F20A4B0}

.

============== Running Processes ===============

.

C:\windows\system32\lsm.exe

C:\windows\system32\svchost.exe -k DcomLaunch

C:\windows\system32\svchost.exe -k RPCSS

c:\Program Files\Microsoft Security Client\MsMpEng.exe

C:\windows\System32\svchost.exe -k LocalServiceNetworkRestricted

C:\windows\System32\svchost.exe -k LocalSystemNetworkRestricted

C:\windows\system32\svchost.exe -k netsvcs

C:\Program Files\IDT\WDM\STacSV64.exe

C:\windows\system32\svchost.exe -k LocalService

C:\windows\system32\svchost.exe -k NetworkService

C:\windows\system32\WLANExt.exe

C:\windows\System32\spoolsv.exe

C:\windows\system32\svchost.exe -k LocalServiceNoNetwork

C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

C:\Program Files\IDT\WDM\AESTSr64.exe

C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\Program Files\Intel\WiFi\bin\EvtEng.exe

C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe

C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe

C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe

C:\windows\system32\svchost.exe -k imgsvc

C:\Program Files (x86)\TeamViewer\Version8\TeamViewer_Service.exe

C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe

C:\windows\system32\wbem\unsecapp.exe

C:\windows\system32\wbem\wmiprvse.exe

C:\windows\system32\svchost.exe -k bthsvcs

C:\windows\system32\svchost.exe -k NetworkServiceNetworkRestricted

C:\windows\system32\taskhost.exe

C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe

C:\windows\system32\Dwm.exe

C:\windows\Explorer.EXE

C:\Windows\System32\hkcmd.exe

C:\Windows\System32\igfxpers.exe

C:\Program Files\IDT\WDM\sttray64.exe

C:\Program Files\DellTPad\Apoint.exe

C:\Program Files\Dell\QuickSet\quickset.exe

C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe

C:\Windows\System32\rundll32.exe

C:\Program Files\Microsoft IntelliType Pro\itype.exe

C:\Windows\WindowsMobile\wmdc.exe

C:\Program Files\Microsoft Security Client\msseces.exe

C:\Program Files (x86)\Nokia\Nokia Suite\NokiaSuite.exe

C:\windows\system32\svchost.exe -k WindowsMobile

C:\windows\system32\wbem\unsecapp.exe

C:\Program Files\DellTPad\ApMsgFwd.exe

C:\Program Files\DellTPad\HidFind.exe

C:\Program Files\DellTPad\Apntex.exe

C:\Program Files (x86)\Dell Webcam\Dell Webcam Central\WebcamDell2.exe

C:\windows\system32\SearchIndexer.exe

C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe

C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe

C:\Program Files (x86)\Roxio\OEM\Roxio Burn\RoxioBurnLauncher.exe

C:\Program Files (x86)\PowerISO\PWRISOVM.EXE

C:\Program Files\Windows Media Player\wmpnetwk.exe

C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe

C:\Program Files (x86)\PC Connectivity Solution\ServiceLayer.exe

C:\Program Files (x86)\PC Connectivity Solution\Transports\NclUSBSrv64.exe

C:\Program Files (x86)\PC Connectivity Solution\Transports\NclMSBTSrvEx.exe

C:\Program Files (x86)\iTunes\iTunesHelper.exe

C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe

C:\Program Files\iPod\bin\iPodService.exe

C:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation

C:\Program Files (x86)\RapidBIT\cidaemon.exe

C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe

C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe

C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe

C:\windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe

C:\Users\S M Naveed\AppData\Local\Google\Chrome\Application\chrome.exe

C:\Users\S M Naveed\AppData\Local\Google\Chrome\Application\chrome.exe

C:\Users\S M Naveed\AppData\Local\Google\Chrome\Application\chrome.exe

C:\Users\S M Naveed\AppData\Local\Google\Chrome\Application\chrome.exe

C:\Users\S M Naveed\AppData\Local\Google\Chrome\Application\chrome.exe

C:\Program Files (x86)\Java\jre7\bin\jp2launcher.exe

C:\Program Files (x86)\Java\jre7\bin\java.exe

C:\Program Files (x86)\Mozilla Firefox\firefox.exe

C:\windows\system32\SearchProtocolHost.exe

C:\windows\system32\SearchFilterHost.exe

C:\windows\system32\wbem\wmiprvse.exe

C:\windows\System32\cscript.exe

.

============== Pseudo HJT Report ===============

.

uWindow Title = Windows Internet Explorer provided by MSN and Bing

uSearch Bar = hxxp://feed.helperbar.com/?publisher=OPENCANDY&dpid=OPENCANDYAPRIL&co=GB&userid=7dd9212d-bb7e-4f1e-b66c-38098f342e76&affid=111585&searchtype=ds&babsrc=lnkry&q={searchTerms}

uSearch Page = hxxp://feed.helperbar.com/?publisher=OPENCANDY&dpid=OPENCANDYAPRIL&co=GB&userid=7dd9212d-bb7e-4f1e-b66c-38098f342e76&affid=111585&searchtype=ds&babsrc=lnkry&q={searchTerms}

uProxyOverride = <local>;*.local

uSearchAssistant = hxxp://feed.helperbar.com/?publisher=OPENCANDY&dpid=OPENCANDYAPRIL&co=GB&userid=7dd9212d-bb7e-4f1e-b66c-38098f342e76&affid=111585&searchtype=ds&babsrc=lnkry&q={searchTerms}

uURLSearchHooks: {7473b6bd-4691-4744-a82b-7854eb3d70b6} - <orphaned>

mWinlogon: Userinit = userinit.exe,

BHO: {02478D38-C3F9-4efb-9B51-7695ECA05670} - <orphaned>

BHO: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

BHO: DivX Plus Web Player HTML5 <video>: {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files (x86)\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll

BHO: Groove GFS Browser Helper: {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL

BHO: Java Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll

BHO: Office Document Cache Handler: {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL

BHO: Java Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll

TB: <No Name>: {ae07101b-46d4-4a98-af68-0333ea26e113} - LocalServer32 - <no file>

uRun: [Facebook Update] "C:\Users\S M Naveed\AppData\Local\Facebook\Update\FacebookUpdate.exe" /c /nocrashserver

uRun: [NokiaSuite.exe] C:\Program Files (x86)\Nokia\Nokia Suite\NokiaSuite.exe -tray

mRun: [Dell Webcam Central] "C:\Program Files (x86)\Dell Webcam\Dell Webcam Central\WebcamDell2.exe" /mode2

mRun: [iAStorIcon] C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe

mRun: [NUSB3MON] "C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe"

mRun: [RoxWatchTray] "c:\Program Files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxWatchTray12OEM.exe"

mRun: [Desktop Disc Tool] "c:\Program Files (x86)\Roxio\OEM\Roxio Burn\RoxioBurnLauncher.exe"

mRun: [Dell Registration] C:\Program Files (x86)\System Registration\prodreg.exe /boot

mRun: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe"

mRun: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

mRun: [PWRISOVM.EXE] C:\Program Files (x86)\PowerISO\PWRISOVM.EXE

mRun: [DivXMediaServer] C:\Program Files (x86)\DivX\DivX Media Server\DivXMediaServer.exe

mRun: [DivXUpdate] "C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW

mRun: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"

mRun: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe"

mRun: [sunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"

uPolicies-Explorer: NoDriveTypeAutoRun = dword:145

uPolicies-System: EnableLUA = dword:0

mPolicies-Explorer: NoActiveDesktop = dword:1

mPolicies-Explorer: NoActiveDesktopChanges = dword:1

mPolicies-System: ConsentPromptBehaviorUser = dword:3

mPolicies-System: EnableUIADesktopToggle = dword:0

mPolicies-System: ConsentPromptBehaviorAdmin = dword:5

IE: E&xport to Microsoft Excel - C:\PROGRA~2\MICROS~1\Office14\EXCEL.EXE/3000

IE: Se&nd to OneNote - C:\PROGRA~2\MICROS~1\Office14\ONBttnIE.dll/105

IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll

IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll

IE: {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - {2EAF5BB0-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll

IE: {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - {2EAF5BB0-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll

IE: {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - {FFFDC614-B694-4AE6-AB38-5D6374584B52} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll

DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab

DPF: {4871A87A-BFDD-4106-8153-FFDE2BAC2967} - hxxp://dlm.tools.akamai.com/dlmanager/versions/activex/dlm-activex-2.2.6.2.cab

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_07-windows-i586.cab

DPF: {CAFEEFAC-0017-0000-0007-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_07-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_07-windows-i586.cab

TCP: NameServer = 192.168.1.254

TCP: Interfaces\{7018303E-A653-4A05-A8A9-DD8362940348} : DHCPNameServer = 192.168.1.254

TCP: Interfaces\{907F1EA0-56E2-42BB-A686-7F6F86343BF1} : DHCPNameServer = 82.132.254.2 82.132.254.3

TCP: Interfaces\{C4FE17F4-E75C-4F22-B042-7C68441C8C8F} : NameServer = 8.8.8.8,8.8.4.4

TCP: Interfaces\{C4FE17F4-E75C-4F22-B042-7C68441C8C8F} : DHCPNameServer = 192.168.1.254

TCP: Interfaces\{C4FE17F4-E75C-4F22-B042-7C68441C8C8F}\244564F4E4 : DHCPNameServer = 192.168.22.22 192.168.22.23

TCP: Interfaces\{C4FE17F4-E75C-4F22-B042-7C68441C8C8F}\371617962602B68616E6 : NameServer = 8.8.8.8,8.8.4.4

TCP: Interfaces\{C4FE17F4-E75C-4F22-B042-7C68441C8C8F}\371617962602B68616E6 : DHCPNameServer = 172.30.139.17 172.31.139.17

TCP: Interfaces\{C4FE17F4-E75C-4F22-B042-7C68441C8C8F}\4516C6B64516C6B6532303 : NameServer = 8.8.8.8,8.8.4.4

TCP: Interfaces\{C4FE17F4-E75C-4F22-B042-7C68441C8C8F}\4516C6B64516C6B6532303 : DHCPNameServer = 46.37.181.234 212.117.175.185

TCP: Interfaces\{C4FE17F4-E75C-4F22-B042-7C68441C8C8F}\642716762716E63656 : NameServer = 8.8.8.8,8.8.4.4

TCP: Interfaces\{C4FE17F4-E75C-4F22-B042-7C68441C8C8F}\642716762716E63656 : DHCPNameServer = 109.249.185.224 109.249.186.32

TCP: Interfaces\{C4FE17F4-E75C-4F22-B042-7C68441C8C8F}\9446F62457479444F6E647 : NameServer = 8.8.8.8,8.8.4.4

TCP: Interfaces\{C4FE17F4-E75C-4F22-B042-7C68441C8C8F}\9446F62457479444F6E647 : DHCPNameServer = 172.31.139.17 172.30.139.17

TCP: Interfaces\{C4FE17F4-E75C-4F22-B042-7C68441C8C8F}\E4164796F6E616C654870727563737 : DHCPNameServer = 10.0.0.1 10.0.0.1

TCP: Interfaces\{C4FE17F4-E75C-4F22-B042-7C68441C8C8F}\E4544574541425 : DHCPNameServer = 192.168.0.1

Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL

Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll

Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll

SSODL: WebCheck - <orphaned>

SEH: Groove GFS Stub Execution Hook - {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL

x64-mWinlogon: Userinit = C:\windows\System32\userinit.exe,C:\Windupdt\winupdate.exe

x64-BHO: Groove GFS Browser Helper: {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL

x64-BHO: Office Document Cache Handler: {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL

x64-TB: <No Name>: {ae07101b-46d4-4a98-af68-0333ea26e113} - LocalServer32 - <no file>

x64-Run: [igfxTray] C:\windows\System32\igfxtray.exe

x64-Run: [HotKeysCmds] C:\windows\System32\hkcmd.exe

x64-Run: [Persistence] C:\windows\System32\igfxpers.exe

x64-Run: [sysTrayApp] C:\Program Files\IDT\WDM\sttray64.exe

x64-Run: [Apoint] C:\Program Files\DellTPad\Apoint.exe

x64-Run: [QuickSet] C:\Program Files\Dell\QuickSet\QuickSet.exe

x64-Run: [intelWireless] "C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe" /tf Intel Wireless Tray

x64-Run: [bTMTrayAgent] rundll32.exe "C:\Program Files (x86)\Intel\Bluetooth\btmshell.dll",TrayApp

x64-Run: [DellStage] "C:\Program Files (x86)\Dell Stage\Dell Stage\stage_primary.exe" "C:\Program Files (x86)\Dell Stage\Dell Stage\start.umj" --startup

x64-Run: [itype] "c:\Program Files\Microsoft IntelliType Pro\itype.exe"

x64-Run: [Windows Mobile Device Center] C:\windows\WindowsMobile\wmdc.exe

x64-Run: [Windows Mobile-based device management] C:\windows\WindowsMobile\wmdc.exe

x64-Run: [bCSSync] "C:\Program Files\Microsoft Office\Office14\BCSSync.exe" /DelayServices

x64-Run: [MSC] "c:\Program Files\Microsoft Security Client\msseces.exe" -hide -runkey

x64-IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll

x64-IE: {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - {FFFDC614-B694-4AE6-AB38-5D6374584B52} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll

x64-Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL

x64-Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - <orphaned>

x64-Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - <orphaned>

x64-Notify: igfxcui - igfxdev.dll

x64-SSODL: WebCheck - <orphaned>

x64-SEH: Groove GFS Stub Execution Hook - {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL

.

================= FIREFOX ===================

.

FF - ProfilePath - C:\Users\S M Naveed\AppData\Roaming\Mozilla\Firefox\Profiles\pqhsf9ns.default\

FF - plugin: C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL

FF - plugin: C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL

FF - plugin: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll

FF - plugin: C:\Program Files (x86)\Common Files\mpDRM\NPMPDRM.dll

FF - plugin: C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll

FF - plugin: C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll

FF - plugin: C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll

FF - plugin: C:\Program Files (x86)\Google\Update\1.3.21.123\npGoogleUpdate3.dll

FF - plugin: C:\Program Files (x86)\Java\jre7\bin\dtplugin\npdeployJava1.dll

FF - plugin: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll

FF - plugin: c:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrlui.dll

FF - plugin: C:\Program Files (x86)\Nokia\Nokia Suite\npNokiaSuiteEnabler.dll

FF - plugin: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll

FF - plugin: C:\Users\S M Naveed\AppData\Local\Google\Update\1.3.21.123\npGoogleUpdate3.dll

FF - plugin: C:\windows\SysWOW64\Macromed\Flash\NPSWF32_11_5_502_135.dll

FF - ExtSQL: 2012-11-16 04:43; {23fcfd51-4958-4f00-80a3-ae97e717ed8b}; C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5

FF - ExtSQL: 2012-12-17 22:13; {b9db16a4-6edc-47ec-a1f4-b86292ed211d}; C:\Users\S M Naveed\AppData\Roaming\Mozilla\Firefox\Profiles\pqhsf9ns.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}

FF - ExtSQL: 2012-12-17 22:19; {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}; C:\Users\S M Naveed\AppData\Roaming\Mozilla\Firefox\Profiles\pqhsf9ns.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi

.

============= SERVICES / DRIVERS ===============

.

R0 MpFilter;Microsoft Malware Protection Driver;C:\windows\System32\drivers\MpFilter.sys [2012-8-30 228768]

R0 PxHlpa64;PxHlpa64;C:\windows\System32\drivers\PxHlpa64.sys [2011-6-25 55856]

R2 AESTFilters;Andrea ST Filters Service;C:\Program Files\IDT\WDM\AESTSr64.exe [2011-6-25 89600]

R2 Bluetooth Device Monitor;Bluetooth Device Monitor;C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe [2010-11-3 897088]

R2 IAStorDataMgrSvc;Intel® Rapid Storage Technology;C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe [2011-6-25 13336]

R2 MBAMScheduler;MBAMScheduler;C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [2012-12-29 398184]

R2 MBAMService;MBAMService;C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2012-12-29 682344]

R2 TeamViewer8;TeamViewer 8;C:\Program Files (x86)\TeamViewer\Version8\TeamViewer_Service.exe [2012-12-21 3467768]

R2 UNS;Intel® Management and Security Application User Notification Service;C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe [2011-6-25 2655768]

R3 btmaux;Intel Bluetooth Auxiliary Service;C:\windows\System32\drivers\btmaux.sys [2010-11-4 58128]

R3 btmhsf;btmhsf;C:\windows\System32\drivers\btmhsf.sys [2010-10-19 274432]

R3 CtClsFlt;Creative Camera Class Upper Filter Driver;C:\windows\System32\drivers\CtClsFlt.sys [2011-6-25 175168]

R3 iBtFltCoex;iBtFltCoex;C:\windows\System32\drivers\iBtFltCoex.sys [2010-11-4 59904]

R3 IntcDAud;Intel® Display Audio;C:\windows\System32\drivers\IntcDAud.sys [2011-6-25 317440]

R3 MBAMProtector;MBAMProtector;C:\windows\System32\drivers\mbam.sys [2012-12-29 24176]

R3 nusb3hub;Renesas Electronics USB 3.0 Hub Driver;C:\windows\System32\drivers\nusb3hub.sys [2010-12-10 80384]

R3 nusb3xhc;Renesas Electronics USB 3.0 Host Controller Driver;C:\windows\System32\drivers\nusb3xhc.sys [2010-12-10 181248]

R3 RTL8167;Realtek 8167 NT Driver;C:\windows\System32\drivers\Rt64win7.sys [2011-6-25 406632]

R3 swivsp;AC8xx Virtual Serial Port;C:\windows\System32\drivers\swivspnt.sys [2007-3-26 23552]

R3 wdkmd;Intel WiDi KMD;C:\windows\System32\drivers\WDKMD.sys [2010-12-1 42392]

S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]

S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]

S2 FlexService;Remote Connections Service;C:\Program Files (x86)\RapidBIT\cisvc.exe [2009-5-17 41984]

S2 RoxWatch12;Roxio Hard Drive Watcher 12;C:\Program Files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxWatch12OEM.exe [2010-11-25 219632]

S3 MyWiFiDHCPDNS;Wireless PAN DHCP Server;C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [2010-12-17 340240]

S3 Netaapl;Apple Mobile Device Ethernet Service;C:\windows\System32\drivers\netaapl64.sys [2012-3-26 22528]

S3 NisDrv;Microsoft Network Inspection System;C:\windows\System32\drivers\NisDrvWFP.sys [2012-8-30 128456]

S3 NisSrv;Microsoft Network Inspection;C:\Program Files\Microsoft Security Client\NisSrv.exe [2012-9-12 368896]

S3 nmwcdnsucx64;Nokia USB Flashing Generic;C:\windows\System32\drivers\nmwcdnsucx64.sys [2012-6-11 12800]

S3 nmwcdnsux64;Nokia USB Flashing Phone Parent;C:\windows\System32\drivers\nmwcdnsux64.sys [2012-6-11 171008]

S3 ose64;Office 64 Source Engine;C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2010-1-9 174440]

S3 RoxMediaDB12OEM;RoxMediaDB12OEM;C:\Program Files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxMediaDB12OEM.exe [2010-11-25 1116656]

S3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;C:\windows\System32\drivers\RtsUStor.sys [2011-6-25 250984]

S3 SWNC8U80;Sierra Wireless MUX NDIS Driver (UMTS80);C:\windows\System32\drivers\swnc8u80.sys [2008-5-20 199168]

S3 SWUMX80;Sierra Wireless USB MUX Driver (UMTS80);C:\windows\System32\drivers\swumx80.sys [2008-5-20 192256]

S3 TsUsbFlt;TsUsbFlt;C:\windows\System32\drivers\TsUsbFlt.sys [2010-11-21 59392]

S3 TsUsbGD;Remote Desktop Generic USB Device;C:\windows\System32\drivers\TsUsbGD.sys [2010-11-21 31232]

S3 USBAAPL64;Apple Mobile USB Driver;C:\windows\System32\drivers\usbaapl64.sys [2012-9-28 53760]

S3 WatAdminSvc;Windows Activation Technologies Service;C:\windows\System32\Wat\WatAdminSvc.exe [2011-11-11 1255736]

S3 ZTEusbnet;ZTE USB-NDIS miniport;C:\windows\System32\drivers\ZTEusbnet.sys [2011-11-18 135168]

S4 wlcrasvc;Windows Live Mesh remote connections service;C:\Program Files\Windows Live\Mesh\wlcrasvc.exe [2010-9-22 57184]

.

=============== Created Last 30 ================

.

2012-12-30 19:01:23 9125352 ----a-w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{B9807963-C66C-4B33-8243-A1AC02B8BAA9}\mpengine.dll

2012-12-29 03:56:50 24176 ----a-w- C:\windows\System32\drivers\mbam.sys

2012-12-29 01:37:49 -------- d-----w- C:\Users\S M Naveed\AppData\Roaming\SUPERAntiSpyware.com

2012-12-28 22:15:29 972264 ------w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{7AEC934D-E713-4E29-BFD9-1A0C6C95597A}\gapaengine.dll

2012-12-28 22:15:24 9125352 ------w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll

2012-12-28 22:14:33 -------- d-----w- C:\Program Files (x86)\Microsoft Security Client

2012-12-28 19:47:17 9125352 ----a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{FE31C3C7-CAE9-46E8-82BC-3CDC0FB60E2E}\mpengine.dll

2012-12-28 06:42:10 -------- d-----w- C:\Program Files\Microsoft Security Client

2012-12-28 01:19:06 -------- d-----w- C:\Users\S M Naveed\AppData\Roaming\QFX Software

2012-12-28 01:19:06 -------- d-----w- C:\ProgramData\QFX Software

2012-12-28 00:14:09 -------- d-----w- C:\ProgramData\Spybot - Search & Destroy

2012-12-28 00:13:25 -------- d-----w- C:\Users\S M Naveed\AppData\Local\Programs

2012-12-28 00:03:18 -------- d-----w- C:\ProgramData\SecTaskMan

2012-12-27 23:14:26 -------- d-----w- C:\Users\S M Naveed\AppData\Local\Welltek_Software

2012-12-27 19:31:14 -------- d-----w- C:\Program Files (x86)\Ccleaner Business Edition x64 x86 Tom_Da_Man

2012-12-27 19:10:30 -------- d-----w- C:\Users\S M Naveed\AppData\Local\{261B7CC5-F930-4E60-8625-714578AEE67A}

2012-12-26 20:33:26 -------- d-----w- C:\Users\S M Naveed\AppData\Local\WMTools Downloaded Files

2012-12-26 20:17:47 -------- d-----w- C:\Users\S M Naveed\AppData\Local\{27A7DD48-3206-4CB3-B6ED-B01E9162D941}

2012-12-26 00:10:39 -------- d-----w- C:\Users\S M Naveed\AppData\Local\{A9511AE4-C6AE-4F12-AA55-306FC164070A}

2012-12-25 01:03:38 -------- d-----w- C:\Users\S M Naveed\AppData\Local\{52A9980E-FCCA-47C8-A868-141B8A8FE602}

2012-12-23 18:50:01 -------- d-----w- C:\Users\S M Naveed\AppData\Local\{925E911E-205A-42A6-98E0-8A40947190E9}

2012-12-21 20:04:05 -------- d-----w- C:\Users\S M Naveed\AppData\Local\{0AA74DC4-8CD5-4E59-9697-91986FDC5CE8}

2012-12-20 20:26:00 46080 ----a-w- C:\windows\System32\atmlib.dll

2012-12-20 20:26:00 34304 ----a-w- C:\windows\SysWow64\atmlib.dll

2012-12-20 20:25:58 367616 ----a-w- C:\windows\System32\atmfd.dll

2012-12-20 20:25:56 295424 ----a-w- C:\windows\SysWow64\atmfd.dll

2012-12-20 19:49:04 -------- d-----w- C:\Users\S M Naveed\AppData\Local\{520A96A1-525F-4CC7-8D58-498E4436F001}

2012-12-20 04:42:09 -------- d-----w- C:\Users\S M Naveed\AppData\Roaming\Strongvault

2012-12-20 04:41:46 -------- d-----w- C:\Program Files (x86)\Common Files\MSSoap

2012-12-20 04:41:23 -------- d-----w- C:\Users\S M Naveed\AppData\Local\Stronghold_LLC

2012-12-20 04:41:05 -------- d-sh--w- C:\windows\SysWow64\AI_RecycleBin

2012-12-20 04:40:04 -------- d-----w- C:\ProgramData\Freemake

2012-12-20 04:39:42 -------- d-----w- C:\Program Files (x86)\Freemake

2012-12-19 23:19:13 -------- d-----w- C:\Users\S M Naveed\AppData\Roaming\Softplicity

2012-12-19 23:18:53 -------- d-----w- C:\Program Files (x86)\TotalAudioConverter

2012-12-19 23:10:07 -------- d-----w- C:\Users\S M Naveed\AppData\Roaming\WindSolutions

2012-12-19 23:10:06 -------- d-----w- C:\ProgramData\WindSolutions

2012-12-19 19:39:42 -------- d-----w- C:\Users\S M Naveed\AppData\Local\{3A8AF86B-9A4E-4572-97C0-47D001566B89}

2012-12-19 05:19:18 95184 ----a-w- C:\windows\SysWow64\WindowsAccessBridge-32.dll

2012-12-19 02:12:13 -------- d-----w- C:\Users\S M Naveed\AppData\Local\Apple Computer

2012-12-19 02:11:31 33240 ----a-w- C:\windows\System32\drivers\GEARAspiWDM.sys

2012-12-19 02:10:47 -------- d-----w- C:\Program Files\iPod

2012-12-19 02:10:42 -------- d-----w- C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69

2012-12-19 02:10:42 -------- d-----w- C:\Program Files\iTunes

2012-12-19 02:10:42 -------- d-----w- C:\Program Files (x86)\iTunes

2012-12-19 02:08:06 -------- d-----w- C:\Users\S M Naveed\AppData\Local\Apple

2012-12-19 02:07:09 -------- d-----w- C:\Program Files\Bonjour

2012-12-19 02:07:09 -------- d-----w- C:\Program Files (x86)\Bonjour

2012-12-19 01:21:18 -------- d-----w- C:\Program Files (x86)\Total Video Converter

2012-12-18 20:32:35 -------- d-----w- C:\Users\S M Naveed\AppData\Local\{4AE88E9E-6CD8-432A-ACAC-1AA5F8E31B9B}

2012-12-17 22:16:22 -------- d-----w- C:\Users\S M Naveed\dwhelper

2012-12-17 22:07:33 -------- d-----w- C:\Users\S M Naveed\AppData\Local\Macromedia

2012-12-17 20:23:16 -------- d-----w- C:\Users\S M Naveed\AppData\Local\{B97DAC54-855C-4984-B625-F9D72DB60CF4}

2012-12-16 19:27:27 -------- d-----w- C:\Users\S M Naveed\AppData\Local\{C42F45AB-2225-4F2D-A068-635D139B431F}

2012-12-14 22:59:28 -------- d-----w- C:\Program Files (x86)\PhotoScape

2012-12-14 19:53:55 -------- d-----w- C:\Users\S M Naveed\AppData\Local\{18078A65-FC85-4B98-A2FC-8D0B5584056A}

2012-12-13 19:51:02 -------- d-----w- C:\Users\S M Naveed\AppData\Local\{E05F193B-47BA-4087-BE53-6F8D7AF98205}

2012-12-12 19:59:48 -------- d-----w- C:\Users\S M Naveed\AppData\Local\{33EFF6DF-14D9-4A15-90A7-46074D63C18D}

2012-12-12 19:55:37 478208 ----a-w- C:\windows\System32\dpnet.dll

2012-12-12 19:55:35 376832 ----a-w- C:\windows\SysWow64\dpnet.dll

2012-12-11 19:44:12 -------- d-----w- C:\Users\S M Naveed\AppData\Local\{95864AD3-CBB2-4E67-9455-B4F30A303434}

2012-12-10 19:39:44 -------- d-----w- C:\Users\S M Naveed\AppData\Local\{DEE04ED9-C82D-4DA8-8814-E6F78833155C}

2012-12-09 19:01:23 -------- d-----w- C:\Users\S M Naveed\AppData\Local\{ADEE7E66-2645-47AB-9515-74C6B8215EEF}

2012-12-07 19:42:33 -------- d-----w- C:\Users\S M Naveed\AppData\Local\{1D0664D6-D358-48F6-804E-8928BD2BAD42}

2012-12-06 19:51:55 -------- d-----w- C:\Users\S M Naveed\AppData\Local\{3AB98608-878C-4276-88CE-0138383CE798}

2012-12-05 20:48:25 -------- d-----w- C:\Users\S M Naveed\AppData\Local\{09DF63F1-CE02-4D30-9352-C9D42179A3E6}

2012-12-04 20:26:34 -------- d-----w- C:\Users\S M Naveed\AppData\Local\{38477F75-CD3E-4F29-8BF4-7A06D98D5509}

2012-12-03 19:46:24 -------- d-----w- C:\Users\S M Naveed\AppData\Local\{BA42BA49-0536-4016-9D9E-EEE1C190006D}

2012-12-02 18:56:12 -------- d-----w- C:\Users\S M Naveed\AppData\Local\{7D0FACBC-0C3D-4014-AE40-DC5E3E5CF656}

2012-12-01 05:04:13 -------- d-----w- C:\Program Files (x86)\Intelore

2012-11-30 19:56:49 -------- d-----w- C:\Users\S M Naveed\AppData\Local\{83449ECF-6D80-46D4-92C3-F8C3B3B7C0F5}

.

==================== Find3M ====================

.

2012-12-27 20:32:52 231376 ----a-w- C:\windows\System32\drivers\truecrypt.sys

2012-12-19 05:18:51 779704 ----a-w- C:\windows\SysWow64\deployJava1.dll

2012-12-12 19:57:45 73656 ----a-w- C:\windows\SysWow64\FlashPlayerCPLApp.cpl

2012-12-12 19:57:45 697272 ----a-w- C:\windows\SysWow64\FlashPlayerApp.exe

2012-11-22 03:26:40 3149824 ----a-w- C:\windows\System32\win32k.sys

2012-11-16 06:02:52 116 ---ha-w- C:\ProgramData\msadoex.dll

2012-11-14 06:11:44 2312704 ----a-w- C:\windows\System32\jscript9.dll

2012-11-14 06:04:11 1392128 ----a-w- C:\windows\System32\wininet.dll

2012-11-14 06:02:49 1494528 ----a-w- C:\windows\System32\inetcpl.cpl

2012-11-14 05:57:46 599040 ----a-w- C:\windows\System32\vbscript.dll

2012-11-14 05:57:35 173056 ----a-w- C:\windows\System32\ieUnatt.exe

2012-11-14 05:52:40 2382848 ----a-w- C:\windows\System32\mshtml.tlb

2012-11-14 02:09:22 1800704 ----a-w- C:\windows\SysWow64\jscript9.dll

2012-11-14 01:58:15 1427968 ----a-w- C:\windows\SysWow64\inetcpl.cpl

2012-11-14 01:57:37 1129472 ----a-w- C:\windows\SysWow64\wininet.dll

2012-11-14 01:49:25 142848 ----a-w- C:\windows\SysWow64\ieUnatt.exe

2012-11-14 01:48:27 420864 ----a-w- C:\windows\SysWow64\vbscript.dll

2012-11-14 01:44:42 2382848 ----a-w- C:\windows\SysWow64\mshtml.tlb

2012-11-13 20:29:04 354216 ----a-w- C:\windows\SysWow64\DivXControlPanelApplet.cpl

2012-11-09 05:45:09 2048 ----a-w- C:\windows\System32\tzres.dll

2012-11-09 04:42:49 2048 ----a-w- C:\windows\SysWow64\tzres.dll

2012-10-16 08:38:37 135168 ----a-w- C:\windows\apppatch\AppPatch64\AcXtrnal.dll

2012-10-16 08:38:34 350208 ----a-w- C:\windows\apppatch\AppPatch64\AcLayers.dll

2012-10-16 07:39:52 561664 ----a-w- C:\windows\apppatch\AcLayers.dll

2012-10-09 18:17:13 55296 ----a-w- C:\windows\System32\dhcpcsvc6.dll

2012-10-09 18:17:13 226816 ----a-w- C:\windows\System32\dhcpcore6.dll

2012-10-09 17:40:31 44032 ----a-w- C:\windows\SysWow64\dhcpcsvc6.dll

2012-10-09 17:40:31 193536 ----a-w- C:\windows\SysWow64\dhcpcore6.dll

2012-10-04 17:46:16 362496 ----a-w- C:\windows\System32\wow64win.dll

2012-10-04 17:46:15 243200 ----a-w- C:\windows\System32\wow64.dll

2012-10-04 17:46:15 13312 ----a-w- C:\windows\System32\wow64cpu.dll

2012-10-04 17:45:55 215040 ----a-w- C:\windows\System32\winsrv.dll

2012-10-04 17:43:28 16384 ----a-w- C:\windows\System32\ntvdm64.dll

2012-10-04 17:41:16 424960 ----a-w- C:\windows\System32\KernelBase.dll

2012-10-04 16:47:41 5120 ----a-w- C:\windows\SysWow64\wow32.dll

2012-10-04 16:47:41 274944 ----a-w- C:\windows\SysWow64\KernelBase.dll

2012-10-04 15:21:55 338432 ----a-w- C:\windows\System32\conhost.exe

2012-10-04 14:46:46 7680 ----a-w- C:\windows\SysWow64\instnm.exe

2012-10-04 14:46:46 25600 ----a-w- C:\windows\SysWow64\setup16.exe

2012-10-04 14:46:44 14336 ----a-w- C:\windows\SysWow64\ntvdm64.dll

2012-10-04 14:46:43 2048 ----a-w- C:\windows\SysWow64\user.exe

2012-10-04 14:41:50 6144 ---ha-w- C:\windows\SysWow64\api-ms-win-security-base-l1-1-0.dll

2012-10-04 14:41:50 4608 ---ha-w- C:\windows\SysWow64\api-ms-win-core-threadpool-l1-1-0.dll

2012-10-04 14:41:50 3584 ---ha-w- C:\windows\SysWow64\api-ms-win-core-xstate-l1-1-0.dll

2012-10-04 14:41:50 3072 ---ha-w- C:\windows\SysWow64\api-ms-win-core-util-l1-1-0.dll

2012-10-03 17:56:54 1914248 ----a-w- C:\windows\System32\drivers\tcpip.sys

2012-10-03 17:44:21 70656 ----a-w- C:\windows\System32\nlaapi.dll

2012-10-03 17:44:21 303104 ----a-w- C:\windows\System32\nlasvc.dll

2012-10-03 17:44:17 246272 ----a-w- C:\windows\System32\netcorehc.dll

2012-10-03 17:44:17 18944 ----a-w- C:\windows\System32\netevent.dll

2012-10-03 17:44:16 216576 ----a-w- C:\windows\System32\ncsi.dll

2012-10-03 17:42:16 569344 ----a-w- C:\windows\System32\iphlpsvc.dll

2012-10-03 16:42:24 18944 ----a-w- C:\windows\SysWow64\netevent.dll

2012-10-03 16:42:24 175104 ----a-w- C:\windows\SysWow64\netcorehc.dll

2012-10-03 16:42:23 156672 ----a-w- C:\windows\SysWow64\ncsi.dll

2012-10-03 16:07:26 45568 ----a-w- C:\windows\System32\drivers\tcpipreg.sys

.

============= FINISH: 19:12:15.60 ===============

_______________________________

.

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.

IF REQUESTED, ZIP IT UP & ATTACH IT

.

DDS (Ver_2012-11-20.01)

.

Microsoft Windows 7 Home Premium

Boot Device: \Device\HarddiskVolume2

Install Date: 09/11/2011 19:49:05

System Uptime: 30/12/2012 18:37:00 (1 hours ago)

.

Motherboard: Dell Inc. | | 034W60

Processor: Intel® Core i3-2310M CPU @ 2.10GHz | CPU 1 | 798/100mhz

.

==== Disk Partitions =========================

.

C: is FIXED (NTFS) - 451 GiB total, 175.879 GiB free.

D: is CDROM ()

.

==== Disabled Device Manager Items =============

.

Class GUID:

Description: Bluetooth Peripheral Device

Device ID: BTHENUM\{00000002-0000-1000-8000-0002EE000002}_LOCALMFG&0002\8&2AC20834&0&3CF72A07BF6E_C00000000

Manufacturer:

Name: Bluetooth Peripheral Device

PNP Device ID: BTHENUM\{00000002-0000-1000-8000-0002EE000002}_LOCALMFG&0002\8&2AC20834&0&3CF72A07BF6E_C00000000

Service:

.

Class GUID:

Description: Bluetooth Peripheral Device

Device ID: BTHENUM\{00005005-0000-1000-8000-0002EE000001}_LOCALMFG&0002\8&2AC20834&0&3CF72A07BF6E_C00000000

Manufacturer:

Name: Bluetooth Peripheral Device

PNP Device ID: BTHENUM\{00005005-0000-1000-8000-0002EE000001}_LOCALMFG&0002\8&2AC20834&0&3CF72A07BF6E_C00000000

Service:

.

Class GUID:

Description: Bluetooth Peripheral Device

Device ID: BTHENUM\{00000004-0000-1000-8000-0002EE000002}_LOCALMFG&0002\8&2AC20834&0&3CF72A07BF6E_C00000000

Manufacturer:

Name: Bluetooth Peripheral Device

PNP Device ID: BTHENUM\{00000004-0000-1000-8000-0002EE000002}_LOCALMFG&0002\8&2AC20834&0&3CF72A07BF6E_C00000000

Service:

.

==== System Restore Points ===================

.

RP254: 25/12/2012 08:02:30 - Windows Update

RP255: 27/12/2012 20:32:13 - TrueCrypt installation

RP256: 27/12/2012 23:07:18 - Installed 001 File Joiner and Splitter.

RP257: 27/12/2012 23:48:28 - Removed 001 File Joiner and Splitter.

RP258: 28/12/2012 00:58:04 - Removed 001 File Joiner and Splitter.

RP259: 28/12/2012 05:47:12 - Removed Skype™ 5.9

RP260: 28/12/2012 19:35:15 - Restore Operation

RP261: 28/12/2012 19:45:14 - Windows Update

RP262: 29/12/2012 06:21:13 - Installed Windows Mobile Device Center

.

==== Installed Programs ======================

.

7-Zip 9.20 (x64 edition)

Adobe AIR

Adobe Flash Player 11 ActiveX

Adobe Flash Player 11 Plugin

Adobe Reader X (10.1.4) MUI

Adobe Shockwave Player 11.6

Advanced Audio FX Engine

Apple Application Support

Apple Mobile Device Support

Apple Software Update

µTorrent

AudioConverter

Bonjour

Ccleaner Business Edition x64 x86 Tom_Da_Man

CopyTrans Suite Remove Only

D3DX10

Definition Update for Microsoft Office 2010 (KB982726) 64-Bit Edition

Dell DataSafe Local Backup

Dell DataSafe Local Backup - Support Software

Dell Edoc Viewer

Dell Getting Started Guide

Dell MusicStage

Dell PhotoStage

Dell Product Registration

Dell Stage

Dell Support Center

Dell Touchpad

Dell VideoStage

Dell Webcam Central

DirectX 9 Runtime

DivX Setup

Facebook Video Calling 1.2.0.287

Freemake Audio Converter version 1.1.0

GOM Player

Google Chrome

Google Drive

Google Earth

Google Update Helper

IDT Audio

Intel PROSet Wireless

Intel® Control Center

Intel® Management Engine Components

Intel® Processor Graphics

Intel® PROSet/Wireless Software for Bluetooth® Technology

Intel® PROSet/Wireless WiFi Software

Intel® Rapid Storage Technology

Intel® Wireless Display

iTunes

Java 7 Update 10

Java Auto Updater

Junk Mail filter update

Malwarebytes Anti-Malware version 1.70.0.1100

Mesh Runtime

Microsoft .NET Framework 4 Client Profile

Microsoft .NET Framework 4 Extended

Microsoft Application Error Reporting

Microsoft Games for Windows - LIVE Redistributable

Microsoft Games for Windows Marketplace

Microsoft IntelliType Pro 8.2

Microsoft Office 2010 Service Pack 1 (SP1)

Microsoft Office Access MUI (English) 2010

Microsoft Office Access Setup Metadata MUI (English) 2010

Microsoft Office Excel MUI (English) 2010

Microsoft Office Groove MUI (English) 2010

Microsoft Office InfoPath MUI (English) 2010

Microsoft Office Office 32-bit Components 2010

Microsoft Office OneNote MUI (English) 2010

Microsoft Office Outlook MUI (English) 2010

Microsoft Office PowerPoint MUI (English) 2010

Microsoft Office Professional Plus 2010

Microsoft Office Proof (English) 2010

Microsoft Office Proof (French) 2010

Microsoft Office Proof (Spanish) 2010

Microsoft Office Proofing (English) 2010

Microsoft Office Publisher MUI (English) 2010

Microsoft Office Shared 32-bit MUI (English) 2010

Microsoft Office Shared MUI (English) 2010

Microsoft Office Shared Setup Metadata MUI (English) 2010

Microsoft Office Word MUI (English) 2010

Microsoft Security Client

Microsoft Security Essentials

Microsoft Silverlight

Microsoft SQL Server 2005 Compact Edition [ENU]

Microsoft Visual C++ 2005 Redistributable

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161

Microsoft Visual C++ 2010 x86 Redistributable - 10.0.30319

Microsoft_VC100_CRT_SP1_x64

Microsoft_VC100_CRT_SP1_x86

Mozilla Firefox 17.0.1 (x86 en-US)

Mozilla Maintenance Service

MSVC80_x64_v2

MSVC80_x86_v2

MSVC90_x64

MSVC90_x86

MSVCRT

MSVCRT_amd64

MSXML 4.0 SP2 (KB954430)

MSXML 4.0 SP2 (KB973688)

MSXML 4.0 SP3 Parser

MSXML 4.0 SP3 Parser (KB2721691)

MSXML 4.0 SP3 Parser (KB973685)

Need for Speed - Most Wanted v1.3 ( RE )

Nokia Connectivity Cable Driver

Nokia Suite

OpenAL

PC Connectivity Solution

PhotoScape

PhotoShowExpress

PowerISO

Quickset64

RBVirtualFolder64Inst

Realtek Ethernet Controller Driver

Realtek USB 2.0 Card Reader

Renesas Electronics USB 3.0 Host Controller Driver

Roxio Activation Module

Roxio BackOnTrack

Roxio Burn

Roxio Creator Starter

Roxio Express Labeler 3

Roxio File Backup

Security Update for Microsoft .NET Framework 4 Client Profile (KB2160841)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2478663)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2539636)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2572078)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2604121)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2633870)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368v2)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2656405)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2686827)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2729449)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2737019)

Security Update for Microsoft .NET Framework 4 Extended (KB2416472)

Security Update for Microsoft .NET Framework 4 Extended (KB2487367)

Security Update for Microsoft .NET Framework 4 Extended (KB2656351)

Security Update for Microsoft Excel 2010 (KB2597126) 64-Bit Edition

Security Update for Microsoft InfoPath 2010 (KB2687417) 64-Bit Edition

Security Update for Microsoft InfoPath 2010 (KB2687436) 64-Bit Edition

Security Update for Microsoft Office 2010 (KB2553091)

Security Update for Microsoft Office 2010 (KB2553096)

Security Update for Microsoft Office 2010 (KB2553371) 64-Bit Edition

Security Update for Microsoft Office 2010 (KB2553447) 64-Bit Edition

Security Update for Microsoft Office 2010 (KB2589320) 64-Bit Edition

Security Update for Microsoft Office 2010 (KB2598243) 64-Bit Edition

Security Update for Microsoft Office 2010 (KB2687501) 64-Bit Edition

Security Update for Microsoft Office 2010 (KB2687510) 64-Bit Edition

Security Update for Microsoft PowerPoint 2010 (KB2553185) 64-Bit Edition

Security Update for Microsoft Visio 2010 (KB2687508) 64-Bit Edition

Security Update for Microsoft Visio Viewer 2010 (KB2598287) 64-Bit Edition

Security Update for Microsoft Word 2010 (KB2760410) 64-Bit Edition

Skype™ 5.9

Sonic CinePlayer Decoder Pack

SRWare Iron version SRWare Iron 22.0.1250.0

Strongvault Online Backup

swMSM

TeamViewer 8

Total Video Converter 3.71 100812

Update for Microsoft .NET Framework 4 Client Profile (KB2468871)

Update for Microsoft .NET Framework 4 Client Profile (KB2473228)

Update for Microsoft .NET Framework 4 Client Profile (KB2533523)

Update for Microsoft .NET Framework 4 Client Profile (KB2600217)

Update for Microsoft .NET Framework 4 Extended (KB2468871)

Update for Microsoft .NET Framework 4 Extended (KB2533523)

Update for Microsoft .NET Framework 4 Extended (KB2600217)

Update for Microsoft Office 2010 (KB2553065)

Update for Microsoft Office 2010 (KB2553092)

Update for Microsoft Office 2010 (KB2553181) 64-Bit Edition

Update for Microsoft Office 2010 (KB2553267) 64-Bit Edition

Update for Microsoft Office 2010 (KB2553310) 64-Bit Edition

Update for Microsoft Office 2010 (KB2566458)

Update for Microsoft Office 2010 (KB2598242) 64-Bit Edition

Update for Microsoft Office 2010 (KB2687509) 64-Bit Edition

Update for Microsoft OneNote 2010 (KB2553290) 64-Bit Edition

Update for Microsoft OneNote 2010 (KB2687277) 64-Bit Edition

Update for Microsoft Outlook 2010 (KB2687623) 64-Bit Edition

Update for Microsoft Outlook Social Connector 2010 (KB2553406) 64-Bit Edition

Update for Microsoft SharePoint Workspace 2010 (KB2589371) 64-Bit Edition

VC80CRTRedist - 8.0.50727.6195

Visual C++ 8.0 Runtime Setup Package (x64)

Visual Studio 2008 x64 Redistributables

VLC media player 1.1.11

Windows Driver Package - Nokia pccsmcfd LegacyDriver (05/31/2012 7.1.2.0)

Windows Live Communications Platform

Windows Live Essentials

Windows Live ID Sign-in Assistant

Windows Live Installer

Windows Live Language Selector

Windows Live Mail

Windows Live Mesh

Windows Live Mesh ActiveX Control for Remote Connections

Windows Live Messenger

Windows Live MIME IFilter

Windows Live Movie Maker

Windows Live Photo Common

Windows Live Photo Gallery

Windows Live PIMT Platform

Windows Live Remote Client

Windows Live Remote Client Resources

Windows Live Remote Service

Windows Live Remote Service Resources

Windows Live SOXE

Windows Live SOXE Definitions

Windows Live UX Platform

Windows Live UX Platform Language Pack

Windows Live Writer

Windows Live Writer Resources

Windows Media Player Firefox Plugin

Windows Mobile Device Center

Windows Mobile Device Center Driver Update

Windows Movie Maker 2.6

WinRAR 4.20 (64-bit)

Yahoo! Messenger

.

==== Event Viewer Messages From Past Week ========

.

30/12/2012 18:39:40, Error: Service Control Manager [7000] - The Security Center service failed to start due to the following error: The account specified for this service is different from the account specified for other services running in the same process.

28/12/2012 22:47:51, Error: Disk [11] - The driver detected a controller error on \Device\Harddisk1\DR1.

28/12/2012 22:08:33, Error: Service Control Manager [7001] - The Spybot-S&D 2 Security Center Service service depends on the Security Center service which failed to start because of the following error: The account specified for this service is different from the account specified for other services running in the same process.

28/12/2012 04:38:21, Error: Service Control Manager [7001] - The Spybot-S&D 2 Security Center Service service depends on the Security Center service which failed to start because of the following error: The service cannot be started, either because it is disabled or because it has no enabled devices associated with it.

27/12/2012 08:00:44, Error: Service Control Manager [7043] - The Windows Update service did not shut down properly after receiving a preshutdown control.

24/12/2012 21:31:42, Error: Ntfs [55] - The file system structure on the disk is corrupt and unusable. Please run the chkdsk utility on the volume OS.

24/12/2012 21:31:42, Error: Ntfs [55] - The file system structure on the disk is corrupt and unusable. Please run the chkdsk utility on the volume C:.

.

==== End Of File ===========================

____

Many thanks again

[Back Door Trojan, Windows security system cannot start.]

Hi there,

Thanks for your prominent responce, just to inform you that, I have recieved an email as well regarding this matter and have been instructed same as you did , do I need to reply that email and attache the required logs or do I need to post them here ?

Many thanks

[TROJAN wont let me start Windows Security Centre Service plz Help.]

DaleDoc1:

Thanks for putting me back on right place .. lolss I am beginner and beginners are awsome lols.

Many thanks hopefully moderators wont go on new year leave after they finish Xmas leaves.

[TROJAN wont let me start Windows Security Centre Service plz Help.]

Hi,

System information: Windows 7 Home-premium 64x.

I am the beginner in this forum and would like to thank you in advance for your time and assistance to help me solving the following issue.

Last night I mistakenly installed an .exe file, after installation it disappeared and I couldn't find it, after sometime my Windows Security Center service stooped and a flag icon with red cross on it appeared on system icons,I clicked on it and under security it was mentioned that WSCS ( Windows Security Center services) has stopped working. and Under maintenance it was mentioned that messenger plus live has stopped working and is missing some updates.

I, immediately performed a full scan with Malwarebytes anti-malware and it came with the following results :

Malwarebytes Anti-Malware (PRO) 1.60.1.1000

www.malwarebytes.org

Database version: v2012.12.27.01

Windows 7 Service Pack 1 x64 NTFS

Internet Explorer 9.0.8112.16421

S M Naveed :: SMNAVEED-PC [administrator]

Protection: Enabled

28/12/2012 01:36:47

mbam-log-2012-12-28 (01-36-47).txt

Scan type: Full scan

Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM

Scan options disabled: P2P

Objects scanned: 351596

Time elapsed: 1 hour(s), 5 minute(s), 8 second(s)

Memory Processes Detected: 1

C:\Windupdt\winupdate.exe (Trojan.MSIL.Gen) -> 1320 -> Delete on reboot.

Memory Modules Detected: 0

(No malicious items detected)

Registry Keys Detected: 1

HKCU\Software\DC3_FEXEC (Malware.Trace) -> Quarantined and deleted successfully.

Registry Values Detected: 1

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|winupdater (Trojan.MSIL.Gen) -> Data: C:\Windupdt\winupdate.exe -> Quarantined and deleted successfully.

Registry Data Items Detected: 3

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System|DisableTaskMgr (PUM.Hijack.TaskManager) -> Bad: (1) Good: (0) -> Quarantined and repaired successfully.

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System|DisableRegistryTools (PUM.Hijack.Regedit) -> Bad: (1) Good: (0) -> Quarantined and repaired successfully.

HKLM\SOFTWARE\Microsoft\Security Center|AntiVirusDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and repaired successfully.

Folders Detected: 1

C:\Users\S M Naveed\AppData\Local\Temp\dclogs (Stolen.Data) -> Quarantined and deleted successfully.

Files Detected: 4

C:\Windupdt\winupdate.exe (Trojan.MSIL.Gen) -> Delete on reboot.

C:\$Recycle.Bin\S-1-5-21-2314083050-1812539920-3202108154-1000\$RBXO9P3.exe (RiskWare.Tool.CK) -> Quarantined and deleted successfully.

C:\ProgramData\SUS\SUS.01 (Trojan.Ardamax) -> Quarantined and deleted successfully.

C:\Users\S M Naveed\AppData\Local\Temp\dclogs\2012-12-28-6.dc (Stolen.Data) -> Quarantined and deleted successfully.

(end)

Then restarted the system but that flagged icon with red cross came up again after few moments then I ran ESET NOD32 antivirus for full system scan and it did not showed any infected files. Then I restarted the system again and the same problem occurred after sometime.

Finally I restored the system to a previous date, which happened successfully but the problem was still there after the system was restored to a previous date and was updated.

I ran Malwarebytes anti-malware again and this time it came up with this result:

Malwarebytes Anti-Malware (PRO) 1.60.1.1000

www.malwarebytes.org

Database version: v2012.12.28.01

Windows 7 Service Pack 1 x64 NTFS

Internet Explorer 9.0.8112.16421

S M Naveed :: SMNAVEED-PC [administrator]

Protection: Enabled

28/12/2012 19:43:30

mbam-log-2012-12-28 (19-43-30).txt

Scan type: Full scan

Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM

Scan options disabled: P2P

Objects scanned: 350799

Time elapsed: 1 hour(s), 9 minute(s), 45 second(s)

Memory Processes Detected: 0

(No malicious items detected)

Memory Modules Detected: 0

(No malicious items detected)

Registry Keys Detected: 0

(No malicious items detected)

Registry Values Detected: 1

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|winupdater (Backdoor.Agent) -> Data: C:\Windupdt\winupdate.exe -> Quarantined and deleted successfully.

Registry Data Items Detected: 0

(No malicious items detected)

Folders Detected: 0

(No malicious items detected)

Files Detected: 0

(No malicious items detected)

(end)

___________________________________

Malwarebytes anti-malware needed me to restart the system immediately, I followed but the problem is still there.

Could you please advice me something that what should I do now ?

How much safe I am ?

If Malwarebytes anti-malware says that all malicious files have been quarantined and deleted successfully then why I am this problem again ?

I don't have an external hard-disk to back up all of my data but is it to safe to transfer some of my files from system to an external USB stick ? will those files be not carrying virus with them in my USB ?

Is there anyway this all can be fixed ?

I will be very thankful for your assistance and support.

[Back Door Trojan, Windows security system cannot start.]

Hi,

System information: Windows 7 Home-premium 64x.

I am the beginner in this forum and would like to thank you in advance for your time and assistance to help me solving the following issue.

Last night I mistakenly installed an .exe file, after installation it disappeared and I couldn't find it, after sometime my Windows Security Center service stooped and a flag icon with red cross on it appeared on system icons,I clicked on it and under security it was mentioned that WSCS ( Windows Security Center services) has stopped working. and Under maintenance it was mentioned that messenger plus live has stopped working and is missing some updates.

I, immediately performed a full scan with Malwarebytes anti-malware and it came with the following results :

Malwarebytes Anti-Malware (PRO) 1.60.1.1000

www.malwarebytes.org

Database version: v2012.12.27.01

Windows 7 Service Pack 1 x64 NTFS

Internet Explorer 9.0.8112.16421

S M Naveed :: SMNAVEED-PC [administrator]

Protection: Enabled

28/12/2012 01:36:47

mbam-log-2012-12-28 (01-36-47).txt

Scan type: Full scan

Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM

Scan options disabled: P2P

Objects scanned: 351596

Time elapsed: 1 hour(s), 5 minute(s), 8 second(s)

Memory Processes Detected: 1

C:\Windupdt\winupdate.exe (Trojan.MSIL.Gen) -> 1320 -> Delete on reboot.

Memory Modules Detected: 0

(No malicious items detected)

Registry Keys Detected: 1

HKCU\Software\DC3_FEXEC (Malware.Trace) -> Quarantined and deleted successfully.

Registry Values Detected: 1

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|winupdater (Trojan.MSIL.Gen) -> Data: C:\Windupdt\winupdate.exe -> Quarantined and deleted successfully.

Registry Data Items Detected: 3

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System|DisableTaskMgr (PUM.Hijack.TaskManager) -> Bad: (1) Good: (0) -> Quarantined and repaired successfully.

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System|DisableRegistryTools (PUM.Hijack.Regedit) -> Bad: (1) Good: (0) -> Quarantined and repaired successfully.

HKLM\SOFTWARE\Microsoft\Security Center|AntiVirusDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and repaired successfully.

Folders Detected: 1

C:\Users\S M Naveed\AppData\Local\Temp\dclogs (Stolen.Data) -> Quarantined and deleted successfully.

Files Detected: 4

C:\Windupdt\winupdate.exe (Trojan.MSIL.Gen) -> Delete on reboot.

C:\$Recycle.Bin\S-1-5-21-2314083050-1812539920-3202108154-1000\$RBXO9P3.exe (RiskWare.Tool.CK) -> Quarantined and deleted successfully.

C:\ProgramData\SUS\SUS.01 (Trojan.Ardamax) -> Quarantined and deleted successfully.

C:\Users\S M Naveed\AppData\Local\Temp\dclogs\2012-12-28-6.dc (Stolen.Data) -> Quarantined and deleted successfully.

(end)

Then restarted the system but that flagged icon with red cross came up again after few moments then I ran ESET NOD32 antivirus for full system scan and it did not showed any infected files. Then I restarted the system again and the same problem occurred after sometime.

Finally I restored the system to a previous date, which happened successfully but the problem was still there after the system was restored to a previous date and was updated.

I ran Malwarebytes anti-malware again and this time it came up with this result:

Malwarebytes Anti-Malware (PRO) 1.60.1.1000

www.malwarebytes.org

Database version: v2012.12.28.01

Windows 7 Service Pack 1 x64 NTFS

Internet Explorer 9.0.8112.16421

S M Naveed :: SMNAVEED-PC [administrator]

Protection: Enabled

28/12/2012 19:43:30

mbam-log-2012-12-28 (19-43-30).txt

Scan type: Full scan

Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM

Scan options disabled: P2P

Objects scanned: 350799

Time elapsed: 1 hour(s), 9 minute(s), 45 second(s)

Memory Processes Detected: 0

(No malicious items detected)

Memory Modules Detected: 0

(No malicious items detected)

Registry Keys Detected: 0

(No malicious items detected)

Registry Values Detected: 1

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|winupdater (Backdoor.Agent) -> Data: C:\Windupdt\winupdate.exe -> Quarantined and deleted successfully.

Registry Data Items Detected: 0

(No malicious items detected)

Folders Detected: 0

(No malicious items detected)

Files Detected: 0

(No malicious items detected)

(end)

___________________________________

Malwarebytes anti-malware needed me to restart the system immediately, I followed but the problem is still there.

Could you please advice me something that what should I do now ?

How much safe I am ?

If Malwarebytes anti-malware says that all malicious files have been quarantined and deleted successfully then why I am this problem again ?

I don't have an external hard-disk to back up all of my data but is it to safe to transfer some of my files from system to an external USB stick ? will those files be not carrying virus with them in my USB ?

Is there anyway this all can be fixed ?

I will be very thankful for your assistance and support.