Security Hijack Errors even after removal

diamondd · February 3, 2015

hi,

I ran a scan with Malwarebytes and it shows ten items with Security.Hijack Error. Even my antivirus is messed up and it somehow seems to wrecking havoc on my pc of all kinds. Need some serious help with this issue. i recently formatted and installed Windows 7 on my pc and installed the antivirus and a few other things and i started getting these weird results. Every i remove the Security Hijack with Malwarebytes it pops up again on the next reboot.

pls advise on the next course of action.

Pls find the attached FRST.TXT and Addition. TXT files

FRST.txt

Addition.txt

kevinf80 · February 3, 2015

Hello and welome,

P2P/Piracy Warning:

If you're using Peer 2 Peer software such as uTorrent, BitTorrent or similar you must either fully uninstall them or completely disable them from running while being assisted here.Failure to remove or disable such software will result in your topic being closed and no further assistance being provided.If you have illegal/cracked software, cracks, keygens etc. on the system, please remove or uninstall them now and read the policy on Piracy.

Next,

Use the instructions in the following link to show hidden files:

http://www.bleepingcomputer.com/tutorials/how-to-see-hidden-files-in-windows/

Next,

Download RKill from here: http://www.bleepingcomputer.com/download/rkill/

There are three buttons to choose from with different names on, select the first one and save it to your desktop.

Double-click on the Rkill desktop icon to run the tool.
If using Vista or Windows 7/8, right-click on it and Run As Administrator.
A black DOS box will briefly flash and then disappear. This is normal and indicates the tool ran successfully.
A log pops up at the end of the run. This log file is located at C:\rkill.log. Please post this in your next reply.
If you do not see the black box flash on the screen delete the icon from the desktop and go back to the link for the download, select the next button and try to run the tool again, continue to repeat this process using the remaining buttons until the tool runs. You will find further links if you scroll down the page with other names, try them one at a time.
If the tool does not run from any of the links provided, please let me know.

Next,

Upload a File to Virustotal

Go to http://www.virustotal.com/

Click the Choose file button
Navigate to the file C:\Program Files\Net Protector 2015\ZVMOUNT.EXE
Click the Scan it tab
If you get a message saying File has already been analyzed: click Reanalyze file now
Copy and paste the results back here please.
Repeat the above steps for the following files

C:\PROGRAM FILES\NET PROTECTOR 2015\NPAV4.exe

Next,

Open Malwarebytes Anti-Malware, from the Dashboard please Check for Updates by clicking the Update Now... link

When the update completes select > Settings > Detection and Protection > Enable Scan for rootkit and Under Non Malware Protection set both PUP and PUM to Treat detections as malware.

Click on the SCAN button and run a Threat Scan with Malwarebytes Anti-Malware by clicking the Scan Now>> button.

When the scan is complete, if there have been detections, click Apply Actions to allow MBAM to clean what was detected.

In most cases, a restart will be required.

Wait for the prompt to restart the computer to appear, then click on Yes.

When the scan is completed from the main GUI click on History > Application Logs. Find your Scan log, the date when run will identify it. Checkmark "select" box > then hit the "view" button. The history log window will open. At the bottom of that window are two options, "Copy to clipboard" and "Export"

Select > "Copy to clipboard" that copies the full log to the windows clipboard, so at your reply you right click into the text field and select "Paste" the log is pasted (copied) to your reply.

Post relevant logs in next reply....

Thanks,

Kevin...

diamondd · February 3, 2015

hi kevin ,

would u want me to post all the result information from all the tabs on the VIrus total site after submitting the file or just the first page info will do. the result info is spread across 4 tabs .

pls advise.

diamondd · February 3, 2015

hi kevin,

Pasted Below is the log for the Malwarebytes scan. Attaching RKill log and NPAV and ZVMount scan logs as well.

Malwarebytes Anti-Malware

www.malwarebytes.org

Scan Date: 03/02/2015

Scan Time: 7:30:58 PM

Logfile:

Administrator: Yes

Version: 2.00.4.1028

Malware Database: v2015.02.03.05

Rootkit Database: v2015.01.14.01

License: Premium

Malware Protection: Enabled

Malicious Website Protection: Enabled

Self-protection: Disabled

OS: Windows 7

CPU: x86

File System: NTFS

User: Ritesh

Scan Type: Threat Scan

Result: Completed

Objects Scanned: 297509

Time Elapsed: 26 min, 20 sec

Memory: Enabled

Startup: Enabled

Filesystem: Enabled

Archives: Enabled

Rootkits: Enabled

Heuristics: Enabled

PUP: Enabled

PUM: Enabled

Processes: 0

(No malicious items detected)

Modules: 0

(No malicious items detected)

Registry Keys: 7

Security.Hijack, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\360tray.exe, Quarantined, [ba9719de2c5dde58097eac4342c17c84],

Security.Hijack, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\empty.jpg, Quarantined, [5df48a6d8702d264371b0763f01418e8],

Security.Hijack, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\HACKER.COM.CN.EXE, Quarantined, [62ef688fb8d1c37343470f3a38cc0af6],

Security.Hijack, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\MICROSOFT.EXE, Quarantined, [e76a48af8108b5811880de6c0ef60bf5],

Security.Hijack, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\NEW FOLDER.EXE, Quarantined, [5ff2c13618719f97be525bf0d92bd22e],

Security.Hijack, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\SVCH0ST.EXE, Quarantined, [341d21d6dcadc86e38b3c488689c41bf],

Security.Hijack, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\VCLEANER.EXE, Quarantined, [cd84c631dbae4de9abe4fc51fe0605fb],

Registry Values: 0

(No malicious items detected)

Registry Data: 0

(No malicious items detected)

Folders: 0

(No malicious items detected)

Files: 0

(No malicious items detected)

Physical Sectors: 0

(No malicious items detected)

(end)

NPAV4.txt

Rkill.txt

zvmount.txt

kevinf80 · February 3, 2015

The files I ask to upload to VT are related to your security program, manf Biz Secure Labs Pvt Ltd One file is clean second one (NPPAV4.EXE) is found to be malicious by AVG and Symantec scanners.

Do you know of and trust the security program in Question, I find mixed reviews via Google.... Let me know what you believe regarding that security..

Next,

Run FRST one more time, Ensure all boxes are checkmarked under "Whitelist2 but only Addition.txt under "Optional scan" Select scan, post the two new logs...

Thank you,

Kevin...

diamondd · February 3, 2015

hi kevin,

pls find attached the logs as u requested. Regarding the Security program in question it was a good product with good protection and security features. i do have a paid licence for that product and have been using it for a couple of years with no complains but in recent times as u mentioned as on google there are mixed reviews with regard to this product.

let me know what u find out from all of this.

Thanks

FRST.txt

Addition.txt

kevinf80 · February 3, 2015

Run the following:

Download attached fixlist.txt file (end of reply) and save it to the Desktop, or the folder you saved FRST into.

NOTE. It's important that both FRST and fixlist.txt are in the same location or the fix will not work.

Run FRST and press the Fix button just once and wait.

The tool will make a log on the Desktop (Fixlog.txt) or the folder it was ran from. Please post it to your reply.

Next,

Open Malwarebytes Anti-Malware, from the Dashboard please Check for Updates by clicking the Update Now... link

When the update completes select > Settings > Detection and Protection > Enable Scan for rootkit and Under Non Malware Protection set both PUP and PUM to Treat detections as malware.

Click on the SCAN button and run a Threat Scan with Malwarebytes Anti-Malware by clicking the Scan Now>> button.

When the scan is complete, if there have been detections, click Apply Actions to allow MBAM to clean what was detected.

In most cases, a restart will be required.

Wait for the prompt to restart the computer to appear, then click on Yes.

When the scan is completed from the main GUI click on History > Application Logs. Find your Scan log, the date when run will identify it. Checkmark "select" box > then hit the "view" button. The history log window will open. At the bottom of that window are two options, "Copy to clipboard" and "Export"

Select > "Copy to clipboard" that copies the full log to the windows clipboard, so at your reply you right click into the text field and select "Paste" the log is pasted (copied) to your reply.

Next,

Download AdwCleaner by Xplode onto your Desktop.

Double click on Adwcleaner.exe to run the tool.
Click on Scan
Once the scan is done, click on the Clean button.
You will get a prompt asking to close all programs. Click OK.
Click OK again to reboot your computer.
A text file will open after the restart. Please post the content of that logfile in your reply.
You can also find the logfile at C:\AdwCleaner[sn].txt. Where n in the scan reference number

Next,

Please download Junkware Removal Tool to your desktop.

Shut down your protection software now to avoid potential conflicts. (re-enable when done)
Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator".
The tool will open and start scanning your system.
Please be patient as this can take a while to complete depending on your system's specifications.
On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
Post the contents of JRT.txt into your next message.

Next,

Download Microsoft's " Malicious Software Removal Tool" and save direct to the desktop

Ensure to get the correct version for your system....

32 Bit version:

https://www.microsoft.com/downloads/en/confirmation.aspx?FamilyId=AD724AE0-E72D-4F54-9AB3-75B8EB148356&displaylang=en

64 Bit version:

https://www.microsoft.com/downloads/en/confirmation.aspx?FamilyId=585D2BDE-367F-495E-94E7-6349F4EFFC74&displaylang=en'>https://www.microsoft.com/downloads/en/confirmation.aspx?FamilyId=585D2BDE-367F-495E-94E7-6349F4EFFC74&displaylang=en

Right click on the Tool, select “Run as Administrator” the tool will expand to the options Window

In the "Scan Type" window, select Quick Scan

Perform a scan and Click Finish when the scan is done.

Retrieve the MSRT log as follows, and post it in your next reply:

1) Select the Windows key and R key together to open the "Run" function

2) Type or Copy/Paste the following command to the "Run Line" and Press Enter:

notepad c:\windows\debug\mrt.log

Let me see those logs, also give an update on any remaining issues or concerns....

Thanks,

Kevin...

Fixlist.txt

diamondd · February 4, 2015

hi kevin,

i have performed the scans as you had advised. Please find the logs in this post pasted respectively. i have limited my activities on the pc to a very minimum such as posting in here and checking my mail. Also every now and then my antivirus cum security software keeps giving up pop-ups to enable the Application Control feature currently ignoring that without doing anything thought it better to ask u first . Awaiting your further advise.

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version: 01-02-2015

Ran by Ritesh at 2015-02-04 13:41:02 Run:1

Running from C:\Downloads

Loaded Profiles: Ritesh (Available profiles: Ritesh)

Boot Mode: Normal

==============================================

Content of fixlist:

*****************

start

HKU\S-1-5-21-402215625-2697488044-1135593907-1001\...\Winlogon: [shell] C:\Windows\Explorer.exe [2613248 2009-07-14] (Microsoft Corporation) <==== ATTENTION

IFEO\$RECYCLE.BIN.exe: [Debugger] B-NPAV

IFEO\%temp%.exe: [Debugger] B-NPAV

IFEO\(??????.exe: [Debugger] M-NPAV

IFEO\360tray.exe: [Debugger] B-NPAV

IFEO\AAAAAAAA.EXE: [Debugger] B-NPAV

IFEO\AADRIVE32.EXE: [Debugger] B-NPAV

IFEO\ACLEANER.EXE: [Debugger] B-NPAV

IFEO\ADKS_QONE8.EXE: [Debugger] B-NPAV

IFEO\Adobe Gamma Loader.com: [Debugger] B-NPAV

IFEO\Adobe Online.com: [Debugger] B-NPAV

IFEO\Adobe update.com: [Debugger] B-NPAV

IFEO\AEGVVP.EXE: [Debugger] B-NPAV

IFEO\ahnabc.exe: [Debugger] B-NPAV

IFEO\AMT_ISTARTSURF.EXE: [Debugger] B-NPAV

IFEO\AMT_WEBSSEARCHES.EXE: [Debugger] B-NPAV

IFEO\antiviruspro_2010.exe: [Debugger] B-NPAV

IFEO\APPDATADB.EXE: [Debugger] B-NPAV

IFEO\APPINSTALY.EXE: [Debugger] B-NPAV

IFEO\ARKING.EXE: [Debugger] B-NPAV

IFEO\ArmasNgSamar.exe: [Debugger] B-NPAV

IFEO\asd26.tmp.exe: [Debugger] B-NPAV

IFEO\ASR64_LDM.EXE: [Debugger] B-NPAV

IFEO\AutoDrive.exe: [Debugger] B-NPAV

IFEO\autorun.inf.exe: [Debugger] B-NPAV

IFEO\ave.exe: [Debugger] B-NPAV

IFEO\AVIRA32.EXE: [Debugger] B-NPAV

IFEO\AWESOMEHP.EXE: [Debugger] B-NPAV

IFEO\BDO_QONE8.EXE: [Debugger] B-NPAV

IFEO\best7.exe: [Debugger] B-NPAV

IFEO\best77.exe: [Debugger] B-NPAV

IFEO\blank.doc: [Debugger] B-NPAV

IFEO\BLUET00TH.EXE: [Debugger] B-NPAV

IFEO\bprotect.exe: [Debugger] B-NPAV

IFEO\BRONSTAB.EXE: [Debugger] B-NPAV

IFEO\BUENOSEARCHTB: [Debugger] B-NPAV

IFEO\CBZVL.EXE: [Debugger] B-NPAV

IFEO\cista.exe: [Debugger] B-NPAV

IFEO\cmt.exe: [Debugger] B-NPAV

IFEO\COMMGR.EXE: [Debugger] B-NPAV

IFEO\CONTINUETOSAVE.EXE: [Debugger] B-NPAV

IFEO\COOL_GAMESETUP.EXE: [Debugger] B-NPAV

IFEO\CSRCS.EXE: [Debugger] B-NPAV

IFEO\CSSRSS.EXE: [Debugger] B-NPAV

IFEO\DATAMNGRUI.EXE: [Debugger] B-NPAV

IFEO\DEFAULTTABHOST.EXE: [Debugger] B-NPAV

IFEO\Demokratska4.exe: [Debugger] B-NPAV

IFEO\desk365.exe: [Debugger] B-NPAV

IFEO\desktoplayer.exe: [Debugger] B-NPAV

IFEO\DISETYPKIDOZ.EXE: [Debugger] B-NPAV

IFEO\diskperfxp.exe: [Debugger] B-NPAV

IFEO\DLLRUN32.EXE: [Debugger] B-NPAV

IFEO\DRVGUARD.EXE: [Debugger] B-NPAV

IFEO\E5188982.EXE: [Debugger] B-NPAV

IFEO\EDEALSPOP.EXE: [Debugger] B-NPAV

IFEO\EHTHUMBS.EXE: [Debugger] B-NPAV

IFEO\EKSPLORASI.EXE: [Debugger] B-NPAV

IFEO\empty.jpg: [Debugger] B-NPAV

IFEO\empty.pif: [Debugger] B-NPAV

IFEO\EXE32.EXE: [Debugger] B-NPAV

IFEO\FAENOL.EXE: [Debugger] B-NPAV

IFEO\FASTANTIVIRUS2011.EXE: [Debugger] B-NPAV

IFEO\FindRight.FirstRun.exe: [Debugger] B-NPAV

IFEO\FINDRIGHTSETUP.EXE: [Debugger] B-NPAV

IFEO\firefox2.exe: [Debugger] B-NPAV

IFEO\FIREWORK.MP3.EXE: [Debugger] B-NPAV

IFEO\FKREKK456.EXE: [Debugger] B-NPAV

IFEO\FUN.XLS.EXE: [Debugger] B-NPAV

IFEO\GNJA.EXE: [Debugger] B-NPAV

IFEO\GOOGIE .EXE: [Debugger] B-NPAV

IFEO\google.com: [Debugger] B-NPAV

IFEO\GOOGLEOEZ.EXE: [Debugger] B-NPAV

IFEO\GOOGLEUPDATEBETA.EXE: [Debugger] B-NPAV

IFEO\gphone.exe: [Debugger] B-NPAV

IFEO\GSYZQ.EXE: [Debugger] B-NPAV

IFEO\HACKER.COM.CN.EXE: [Debugger] B-NPAV

IFEO\HDAV.EXE: [Debugger] B-NPAV

IFEO\HELLOPUPPY.EXE: [Debugger] B-NPAV

IFEO\hexapple.exe: [Debugger] B-NPAV

IFEO\hexsvchost.exe: [Debugger] B-NPAV

IFEO\hhcbrnaff.exe: [Debugger] B-NPAV

IFEO\hhgnrddkjee.exe: [Debugger] B-NPAV

IFEO\IACNATIVEMSGHOST.EXE: [Debugger] B-NPAV

IFEO\ibsvc.exe: [Debugger] B-NPAV

IFEO\ICREINSTALL_OMIGA-PLUS.EXE: [Debugger] B-NPAV

IFEO\IFREETV.EXE: [Debugger] B-NPAV

IFEO\igfxdvb32.exe: [Debugger] B-NPAV

IFEO\ILD_ISTARTSURF.EXE: [Debugger] B-NPAV

IFEO\ILD_QONE8.EXE: [Debugger] B-NPAV

IFEO\IMPORTANT.FILES.EXE: [Debugger] B-NPAV

IFEO\INBOXACE[1].EXE: [Debugger] B-NPAV

IFEO\INDAPUR COLLEGE.EXE: [Debugger] B-NPAV

IFEO\INOVICE COPY(1).EXE: [Debugger] B-NPAV

IFEO\Install_kuwo.dat: [Debugger] B-NPAV

IFEO\Internet Explorer Settings.exe: [Debugger] B-NPAV

IFEO\INVOICE..EXE: [Debugger] B-NPAV

IFEO\ISE32.EXE: [Debugger] B-NPAV

IFEO\jodrive32.exe: [Debugger] B-NPAV

IFEO\juzjf.exe: [Debugger] B-NPAV

IFEO\kelly.exe: [Debugger] B-NPAV

IFEO\khatra.exe: [Debugger] B-NPAV

IFEO\L1REZERV.EXE: [Debugger] B-NPAV

IFEO\lbisov.exe: [Debugger] B-NPAV

IFEO\LIB32WAOT.EXE: [Debugger] B-NPAV

IFEO\LIDLLLA.EXE: [Debugger] B-NPAV

IFEO\lizkavd.exe: [Debugger] B-NPAV

IFEO\LLY_ISTARTSURF.EXE: [Debugger] B-NPAV

IFEO\LLY_WEBSSEARCHES.EXE: [Debugger] B-NPAV

IFEO\LOAD[1].EXE: [Debugger] B-NPAV

IFEO\ltzqai.exe: [Debugger] B-NPAV

IFEO\MAKARONI.EXE: [Debugger] B-NPAV

IFEO\MCSHELD.EXE: [Debugger] B-NPAV

IFEO\MgAssist.exe: [Debugger] B-NPAV

IFEO\MGJWIN32.EXE: [Debugger] B-NPAV

IFEO\MGRSVN.EXE: [Debugger] B-NPAV

IFEO\MICROSOFT.EXE: [Debugger] B-NPAV

IFEO\MMMPC.EXE: [Debugger] B-NPAV

IFEO\Mobogenie.exe: [Debugger] B-NPAV

IFEO\MONILOR.EXE: [Debugger] B-NPAV

IFEO\MOSODCYSBEAR.EXE: [Debugger] B-NPAV

IFEO\MOVIEMODE.EXE: [Debugger] B-NPAV

IFEO\MOVIEMODE64.EXE: [Debugger] B-NPAV

IFEO\moviemodeservice.exe: [Debugger] B-NPAV

IFEO\MP3_QONE8.EXE: [Debugger] B-NPAV

IFEO\MRPKY.EXE: [Debugger] B-NPAV

IFEO\mrsys.exe: [Debugger] B-NPAV

IFEO\MS-DOS.COM: [Debugger] B-NPAV

IFEO\MSA.EXE: [Debugger] B-NPAV

IFEO\MSB.EXE: [Debugger] B-NPAV

IFEO\MSBACKUP.EXE: [Debugger] B-NPAV

IFEO\msconfig32.exe: [Debugger] B-NPAV

IFEO\msm.com: [Debugger] B-NPAV

IFEO\MSMXENG.EXE: [Debugger] B-NPAV

IFEO\MSRZOCKX.SCR: [Debugger] B-NPAV

IFEO\MSVMIODE.EXE: [Debugger] B-NPAV

IFEO\mwagent.exe: [Debugger] B-NPAV

IFEO\mwaser.exe: [Debugger] B-NPAV

IFEO\MWAU.EXE: [Debugger] B-NPAV

IFEO\My Documents.exe: [Debugger] B-NPAV

IFEO\MySearchDial.exe: [Debugger] B-NPAV

IFEO\NEW FOLDER .EXE: [Debugger] B-NPAV

IFEO\NEW FOLDER.EXE: [Debugger] B-NPAV

IFEO\new29.exe: [Debugger] B-NPAV

IFEO\NISSAN.EXE: [Debugger] B-NPAV

IFEO\nsvb.exe: [Debugger] B-NPAV

IFEO\NTDETEC1.EXE: [Debugger] B-NPAV

IFEO\ONEBROWSESERVICE.EXE: [Debugger] B-NPAV

IFEO\ONEBROWSEUIPROCESS.EXE: [Debugger] B-NPAV

IFEO\ONEKIT4FFX.EXE: [Debugger] B-NPAV

IFEO\OOVOOSETUP.EXE: [Debugger] B-NPAV

IFEO\Outdoor Amateur.exe: [Debugger] B-NPAV

IFEO\P2PHOSTA.EXE: [Debugger] B-NPAV

IFEO\Passwords.exe: [Debugger] B-NPAV

IFEO\PAYMENTSLIP.EXE: [Debugger] B-NPAV

IFEO\PHIM HAI CUC HAY.EXE: [Debugger] B-NPAV

IFEO\photo_id.exe: [Debugger] B-NPAV

IFEO\PHYSICALDRIVE2.COM: [Debugger] B-NPAV

IFEO\PIPINSTALLER_PTV_.EXE: [Debugger] B-NPAV

IFEO\PLUGINSERVICE.EXE: [Debugger] B-NPAV

IFEO\PLUSHDINSTALLER.EXE: [Debugger] B-NPAV

IFEO\porn.exe: [Debugger] B-NPAV

IFEO\PRINCE(2010)-PDVDRIP{NEWSOURCE}-1CDRIP-XVID-MP3-[DRC].EXE: [Debugger] B-NPAV

IFEO\PRODUCT SAMPLE.EXE: [Debugger] B-NPAV

IFEO\PROTECTWINDOWSMANAGER.EXE: [Debugger] B-NPAV

IFEO\PURCHASE ORDER DETAILS.COM: [Debugger] B-NPAV

IFEO\PURCHASE ORDER..EXE: [Debugger] B-NPAV

IFEO\PURCHASE ORDER.BAT: [Debugger] B-NPAV

IFEO\PURCHASE-ORDERS.EXE: [Debugger] B-NPAV

IFEO\PUSK2.EXE: [Debugger] B-NPAV

IFEO\PUSK3.EXE: [Debugger] B-NPAV

IFEO\qgfmc.exe: [Debugger] B-NPAV

IFEO\QONE8.EXE: [Debugger] B-NPAV

IFEO\qtfcyyp.exe: [Debugger] B-NPAV

IFEO\RABC.EXE: [Debugger] B-NPAV

IFEO\RADSTEROIDS.EXE: [Debugger] B-NPAV

IFEO\RADSTEROIDS64.EXE: [Debugger] B-NPAV

IFEO\RADSTEROIDSSERVICE.EXE: [Debugger] B-NPAV

IFEO\RECYCLE.EXE: [Debugger] B-NPAV

IFEO\RECYCLEBIN.EXE: [Debugger] B-NPAV

IFEO\RECYCLEBINPROTECT.EXE: [Debugger] B-NPAV

IFEO\RECYCLED.EXE: [Debugger] B-NPAV

IFEO\RECYCLED.SCR: [Debugger] B-NPAV

IFEO\RECYCLER .EXE: [Debugger] B-NPAV

IFEO\RECYCLER.EXE: [Debugger] B-NPAV

IFEO\regedit32.com: [Debugger] B-NPAV

IFEO\regsvr.exe: [Debugger] B-NPAV

IFEO\Rensolt.exe: [Debugger] B-NPAV

IFEO\Rensolu.exe: [Debugger] B-NPAV

IFEO\Rensolv.exe: [Debugger] B-NPAV

IFEO\Rensolve.exe: [Debugger] B-NPAV

IFEO\RESTORER64_A.EXE: [Debugger] B-NPAV

IFEO\rknew.cc3: [Debugger] B-NPAV

IFEO\Rmhzb.exe: [Debugger] B-NPAV

IFEO\runouce.exe: [Debugger] B-NPAV

IFEO\SACHOST.EXE: [Debugger] B-NPAV

IFEO\SafeDrvse.exe: [Debugger] B-NPAV

IFEO\SAVESENSE1218.EXE: [Debugger] B-NPAV

IFEO\SAVESENSELIVE.EXE: [Debugger] B-NPAV

IFEO\SAVESENSEUPDATEVER.EXE: [Debugger] B-NPAV

IFEO\SCVHOST.EXE: [Debugger] B-NPAV

IFEO\SDRA64.EXE: [Debugger] B-NPAV

IFEO\SEABI.EXE: [Debugger] B-NPAV

IFEO\SEAFAST.EXE: [Debugger] B-NPAV

IFEO\SEARCHPROTECT1204.EXE: [Debugger] B-NPAV

IFEO\SEARCHPROTECTIONSTUB.EXE: [Debugger] B-NPAV

IFEO\SecureDrive.exe: [Debugger] B-NPAV

IFEO\seres.exe: [Debugger] B-NPAV

IFEO\serivces.exe: [Debugger] B-NPAV

IFEO\SETTINGSMANAGERSETUP.EXE: [Debugger] B-NPAV

IFEO\SFPSNEW1_QONE8.EXE: [Debugger] B-NPAV

IFEO\SFPSNEW2_QONE8.EXE: [Debugger] B-NPAV

IFEO\SFPSNEW3_QONE8.EXE: [Debugger] B-NPAV

IFEO\shell32.com: [Debugger] B-NPAV

IFEO\SHELLOPEN.EXE: [Debugger] B-NPAV

IFEO\SHMEKERICA.EXE: [Debugger] B-NPAV

IFEO\SHOPPERPROJSINJFULL.EXE: [Debugger] B-NPAV

IFEO\SICHOST.EXE: [Debugger] B-NPAV

IFEO\sienozv.exe: [Debugger] B-NPAV

IFEO\SIEN_QONE8.EXE: [Debugger] B-NPAV

IFEO\SmdmFService.exe: [Debugger] B-NPAV

IFEO\smdmfu.exe: [Debugger] B-NPAV

IFEO\SMSS32.EXE: [Debugger] B-NPAV

IFEO\SMTNEW_QONE8.EXE: [Debugger] B-NPAV

IFEO\SMT_OMIGA-PLUS_NEW.EXE: [Debugger] B-NPAV

IFEO\SMT_QONE8.EXE: [Debugger] B-NPAV

IFEO\SPECIJALAC.EXE: [Debugger] B-NPAV

IFEO\SPERMICI.EXE: [Debugger] B-NPAV

IFEO\spoclsv.exe: [Debugger] B-NPAV

IFEO\SSVICHOSST.EXE: [Debugger] B-NPAV

IFEO\SVCH0ST.EXE: [Debugger] B-NPAV

IFEO\SVCH0STS.EXE: [Debugger] B-NPAV

IFEO\SVCHAST.EXE: [Debugger] B-NPAV

IFEO\SVCHHOST.EXE: [Debugger] B-NPAV

IFEO\SVCHOSTS.EXE: [Debugger] B-NPAV

IFEO\SVCNOST.EXE: [Debugger] B-NPAV

IFEO\svcst.exe: [Debugger] B-NPAV

IFEO\SVHOST.EXE: [Debugger] B-NPAV

IFEO\SysAnti.exe: [Debugger] B-NPAV

IFEO\SYSDATE.EXE: [Debugger] B-NPAV

IFEO\SYSDIAG64.EXE: [Debugger] B-NPAV

IFEO\SYSDRIVER32.EXE: [Debugger] B-NPAV

IFEO\SYSDRIVER32_.EXE: [Debugger] B-NPAV

IFEO\SYSHOST.EXE: [Debugger] B-NPAV

IFEO\SYSMNGR32.EXE: [Debugger] B-NPAV

IFEO\systam.exe: [Debugger] B-NPAV

IFEO\SYSTEM3_.EXE: [Debugger] B-NPAV

IFEO\SYSTEMIL2.EXE: [Debugger] B-NPAV

IFEO\systim32.exe: [Debugger] B-NPAV

IFEO\SYTVSM.EXE: [Debugger] B-NPAV

IFEO\TCPWAMMLIB.EXE: [Debugger] B-NPAV

IFEO\TCPWAMULIB.EXE: [Debugger] B-NPAV

IFEO\TCPWANBLIB.EXE: [Debugger] B-NPAV

IFEO\ToolbarUpdaterService.exe: [Debugger] B-NPAV

IFEO\Tuneup.exe: [Debugger] B-NPAV

IFEO\TXP1ATFORM.EXE: [Debugger] B-NPAV

IFEO\TXPLATFORM.EXE: [Debugger] B-NPAV

IFEO\UA3KMH73O3JYUT4IOK.EXE: [Debugger] B-NPAV

IFEO\ucigxo.exe: [Debugger] B-NPAV

IFEO\unwise_.exe: [Debugger] B-NPAV

IFEO\updateFindRight.exe: [Debugger] B-NPAV

IFEO\updateluckyleap.exe: [Debugger] B-NPAV

IFEO\UPDATEMELONDREA.EXE: [Debugger] B-NPAV

IFEO\UpdateMoboGenie.exe: [Debugger] B-NPAV

IFEO\UPDATEOUTOBOX.EXE: [Debugger] B-NPAV

IFEO\USBDRIVE32.EXE: [Debugger] B-NPAV

IFEO\userini.exe: [Debugger] B-NPAV

IFEO\USPS REPORT.EXE: [Debugger] B-NPAV

IFEO\utilluckyleap.exe: [Debugger] B-NPAV

IFEO\UTILMELONDREA.EXE: [Debugger] B-NPAV

IFEO\UTILOUTOBOX.EXE: [Debugger] B-NPAV

IFEO\uygkr9b.exe: [Debugger] B-NPAV

IFEO\VCLEANER.EXE: [Debugger] B-NPAV

IFEO\voicemail.scr: [Debugger] B-NPAV

IFEO\VOICEMAIL_MUMBAI.EXE: [Debugger] B-NPAV

IFEO\vrt1.tmp: [Debugger] B-NPAV

IFEO\VRT5.TMP: [Debugger] B-NPAV

IFEO\VRT6.TMP: [Debugger] B-NPAV

IFEO\VRT75.TMP: [Debugger] B-NPAV

IFEO\VRT9.TMP: [Debugger] B-NPAV

IFEO\VSBNTLO.EXE: [Debugger] B-NPAV

IFEO\VTT_QONE8.EXE: [Debugger] B-NPAV

IFEO\vuout.exe: [Debugger] B-NPAV

IFEO\VXZCEGI.EXE: [Debugger] B-NPAV

IFEO\watermark.exe: [Debugger] B-NPAV

IFEO\WEBSHIELD.EXE: [Debugger] B-NPAV

IFEO\WEBSHIELD64.EXE: [Debugger] B-NPAV

IFEO\WEBSHIELDSERVICE.EXE: [Debugger] B-NPAV

IFEO\WEBSSEARCHES_0905-11F33B8C.EXE: [Debugger] B-NPAV

IFEO\WEBSTEROIDS.EXE: [Debugger] B-NPAV

IFEO\WEBSTEROIDS64.EXE: [Debugger] B-NPAV

IFEO\WEBSTEROIDSSERVICE.EXE: [Debugger] B-NPAV

IFEO\WIHELP32.EXE: [Debugger] B-NPAV

IFEO\win002.exe: [Debugger] B-NPAV

IFEO\WIN7.EXE: [Debugger] B-NPAV

IFEO\WINALERT.EXE: [Debugger] B-NPAV

IFEO\WINDLL.EXE: [Debugger] B-NPAV

IFEO\WINFIXER.EXE: [Debugger] B-NPAV

IFEO\WinHdvm32.exe: [Debugger] B-NPAV

IFEO\winlok.exe: [Debugger] B-NPAV

IFEO\WINMINEA.EXE: [Debugger] B-NPAV

IFEO\winrsdrv32.exe: [Debugger] B-NPAV

IFEO\WINSVCHOSTS.EXE: [Debugger] B-NPAV

IFEO\WINSYSAPP.EXE: [Debugger] B-NPAV

IFEO\WINSYSTEM.EXE: [Debugger] B-NPAV

IFEO\WISENI32.EXE: [Debugger] B-NPAV

IFEO\WMFCGR.EXE: [Debugger] B-NPAV

IFEO\WMIMGMT.COM: [Debugger] B-NPAV

IFEO\WMISTIP.EXE: [Debugger] B-NPAV

IFEO\wmnig.exe: [Debugger] B-NPAV

IFEO\WMPRWISE.EXE: [Debugger] B-NPAV

IFEO\WMPTD32.EXE: [Debugger] B-NPAV

IFEO\wnzip32.exe: [Debugger] B-NPAV

IFEO\WPM_NS_V20.0.0.502.EXE: [Debugger] B-NPAV

IFEO\WPM_V18.8.0.273.EXE: [Debugger] B-NPAV

IFEO\WPM_V18.8.0.304.EXE: [Debugger] B-NPAV

IFEO\WPM_V20.0.0.401.EXE: [Debugger] B-NPAV

IFEO\WPM_V20.0.0.502.EXE: [Debugger] B-NPAV

IFEO\WPROTECTMANAGER.EXE: [Debugger] B-NPAV

IFEO\wsynalib.exe: [Debugger] B-NPAV

IFEO\WUAUCLDT.EXE: [Debugger] B-NPAV

IFEO\X: [Debugger] B-NPAV

IFEO\xiazaii.exe: [Debugger] B-NPAV

IFEO\XPLORER.EXE: [Debugger] B-NPAV

IFEO\YDNED.EXE: [Debugger] B-NPAV

IFEO\zavupd32.exe: [Debugger] B-NPAV

IFEO\ZIPAS.EXE: [Debugger] B-NPAV

IFEO\_RECYCLING49.EXE: [Debugger] B-NPAV

IFEO\?.exe: [Debugger] M-NPAV

C:\Users\Ritesh\NPProt.exe

C:\Users\Ritesh\AppData\Local\Temp\gtapi_signed.dll

C:\Users\Ritesh\AppData\Local\Temp\NEventMessages.dll

C:\Users\Ritesh\AppData\Local\Temp\NOSEventMessages.dll

C:\Users\Ritesh\AppData\Local\Temp\npp.6.7.4.Installer.exe

C:\Users\Ritesh\AppData\Local\Temp\xmlUpdater.exe

hosts:

Emptytemp:

end

*****************

HKU\S-1-5-21-402215625-2697488044-1135593907-1001\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell => value deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\$RECYCLE.BIN.exe" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\%temp%.exe" => Key deleted successfully.

HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\(??????.exe => Key not found.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\360tray.exe" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\AAAAAAAA.EXE" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\AADRIVE32.EXE" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\ACLEANER.EXE" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\ADKS_QONE8.EXE" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\Adobe Gamma Loader.com" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\Adobe Online.com" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\Adobe update.com" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\AEGVVP.EXE" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\ahnabc.exe" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\AMT_ISTARTSURF.EXE" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\AMT_WEBSSEARCHES.EXE" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\antiviruspro_2010.exe" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\APPDATADB.EXE" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\APPINSTALY.EXE" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\ARKING.EXE" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\ArmasNgSamar.exe" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\asd26.tmp.exe" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\ASR64_LDM.EXE" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\AutoDrive.exe" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\autorun.inf.exe" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\ave.exe" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\AVIRA32.EXE" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\AWESOMEHP.EXE" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\BDO_QONE8.EXE" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\best7.exe" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\best77.exe" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\blank.doc" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\BLUET00TH.EXE" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\bprotect.exe" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\BRONSTAB.EXE" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\BUENOSEARCHTB" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\CBZVL.EXE" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\cista.exe" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\cmt.exe" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\COMMGR.EXE" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\CONTINUETOSAVE.EXE" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\COOL_GAMESETUP.EXE" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\CSRCS.EXE" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\CSSRSS.EXE" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\DATAMNGRUI.EXE" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\DEFAULTTABHOST.EXE" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\Demokratska4.exe" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\desk365.exe" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\desktoplayer.exe" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\DISETYPKIDOZ.EXE" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\diskperfxp.exe" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\DLLRUN32.EXE" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\DRVGUARD.EXE" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\E5188982.EXE" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\EDEALSPOP.EXE" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\EHTHUMBS.EXE" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\EKSPLORASI.EXE" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\empty.jpg" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\empty.pif" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\EXE32.EXE" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\FAENOL.EXE" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\FASTANTIVIRUS2011.EXE" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\FindRight.FirstRun.exe" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\FINDRIGHTSETUP.EXE" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\firefox2.exe" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\FIREWORK.MP3.EXE" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\FKREKK456.EXE" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\FUN.XLS.EXE" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\GNJA.EXE" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\GOOGIE .EXE" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\google.com" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\GOOGLEOEZ.EXE" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\GOOGLEUPDATEBETA.EXE" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\gphone.exe" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\GSYZQ.EXE" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\HACKER.COM.CN.EXE" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\HDAV.EXE" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\HELLOPUPPY.EXE" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\hexapple.exe" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\hexsvchost.exe" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\hhcbrnaff.exe" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\hhgnrddkjee.exe" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\IACNATIVEMSGHOST.EXE" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\ibsvc.exe" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\ICREINSTALL_OMIGA-PLUS.EXE" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\IFREETV.EXE" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\igfxdvb32.exe" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\ILD_ISTARTSURF.EXE" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\ILD_QONE8.EXE" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\IMPORTANT.FILES.EXE" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\INBOXACE[1].EXE" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\INDAPUR COLLEGE.EXE" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\INOVICE COPY(1).EXE" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\Install_kuwo.dat" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\Internet Explorer Settings.exe" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\INVOICE..EXE" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\ISE32.EXE" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\jodrive32.exe" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\juzjf.exe" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\kelly.exe" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\khatra.exe" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\L1REZERV.EXE" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\lbisov.exe" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\LIB32WAOT.EXE" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\LIDLLLA.EXE" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\lizkavd.exe" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\LLY_ISTARTSURF.EXE" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\LLY_WEBSSEARCHES.EXE" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\LOAD[1].EXE" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\ltzqai.exe" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\MAKARONI.EXE" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\MCSHELD.EXE" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\MgAssist.exe" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\MGJWIN32.EXE" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\MGRSVN.EXE" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\MICROSOFT.EXE" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\MMMPC.EXE" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\Mobogenie.exe" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\MONILOR.EXE" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\MOSODCYSBEAR.EXE" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\MOVIEMODE.EXE" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\MOVIEMODE64.EXE" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\moviemodeservice.exe" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\MP3_QONE8.EXE" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\MRPKY.EXE" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\mrsys.exe" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\MS-DOS.COM" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\MSA.EXE" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\MSB.EXE" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\MSBACKUP.EXE" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\msconfig32.exe" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\msm.com" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\MSMXENG.EXE" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\MSRZOCKX.SCR" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\MSVMIODE.EXE" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\mwagent.exe" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\mwaser.exe" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\MWAU.EXE" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\My Documents.exe" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\MySearchDial.exe" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\NEW FOLDER .EXE" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\NEW FOLDER.EXE" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\new29.exe" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\NISSAN.EXE" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\nsvb.exe" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\NTDETEC1.EXE" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\ONEBROWSESERVICE.EXE" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\ONEBROWSEUIPROCESS.EXE" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\ONEKIT4FFX.EXE" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\OOVOOSETUP.EXE" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\Outdoor Amateur.exe" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\P2PHOSTA.EXE" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\Passwords.exe" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\PAYMENTSLIP.EXE" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\PHIM HAI CUC HAY.EXE" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\photo_id.exe" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\PHYSICALDRIVE2.COM" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\PIPINSTALLER_PTV_.EXE" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\PLUGINSERVICE.EXE" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\PLUSHDINSTALLER.EXE" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\porn.exe" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\PRINCE(2010)-PDVDRIP{NEWSOURCE}-1CDRIP-XVID-MP3-[DRC].EXE" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\PRODUCT SAMPLE.EXE" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\PROTECTWINDOWSMANAGER.EXE" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\PURCHASE ORDER DETAILS.COM" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\PURCHASE ORDER..EXE" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\PURCHASE ORDER.BAT" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\PURCHASE-ORDERS.EXE" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\PUSK2.EXE" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\PUSK3.EXE" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\qgfmc.exe" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\QONE8.EXE" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\qtfcyyp.exe" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\RABC.EXE" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\RADSTEROIDS.EXE" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\RADSTEROIDS64.EXE" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\RADSTEROIDSSERVICE.EXE" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\RECYCLE.EXE" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\RECYCLEBIN.EXE" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\RECYCLEBINPROTECT.EXE" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\RECYCLED.EXE" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\RECYCLED.SCR" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\RECYCLER .EXE" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\RECYCLER.EXE" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\regedit32.com" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\regsvr.exe" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\Rensolt.exe" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\Rensolu.exe" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\Rensolv.exe" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\Rensolve.exe" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\RESTORER64_A.EXE" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\rknew.cc3" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\Rmhzb.exe" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\runouce.exe" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\SACHOST.EXE" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\SafeDrvse.exe" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\SAVESENSE1218.EXE" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\SAVESENSELIVE.EXE" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\SAVESENSEUPDATEVER.EXE" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\SCVHOST.EXE" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\SDRA64.EXE" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\SEABI.EXE" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\SEAFAST.EXE" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\SEARCHPROTECT1204.EXE" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\SEARCHPROTECTIONSTUB.EXE" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\SecureDrive.exe" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\seres.exe" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\serivces.exe" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\SETTINGSMANAGERSETUP.EXE" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\SFPSNEW1_QONE8.EXE" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\SFPSNEW2_QONE8.EXE" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\SFPSNEW3_QONE8.EXE" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\shell32.com" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\SHELLOPEN.EXE" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\SHMEKERICA.EXE" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\SHOPPERPROJSINJFULL.EXE" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\SICHOST.EXE" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\sienozv.exe" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\SIEN_QONE8.EXE" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\SmdmFService.exe" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\smdmfu.exe" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\SMSS32.EXE" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\SMTNEW_QONE8.EXE" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\SMT_OMIGA-PLUS_NEW.EXE" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\SMT_QONE8.EXE" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\SPECIJALAC.EXE" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\SPERMICI.EXE" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\spoclsv.exe" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\SSVICHOSST.EXE" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\SVCH0ST.EXE" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\SVCH0STS.EXE" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\SVCHAST.EXE" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\SVCHHOST.EXE" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\SVCHOSTS.EXE" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\SVCNOST.EXE" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\svcst.exe" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\SVHOST.EXE" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\SysAnti.exe" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\SYSDATE.EXE" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\SYSDIAG64.EXE" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\SYSDRIVER32.EXE" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\SYSDRIVER32_.EXE" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\SYSHOST.EXE" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\SYSMNGR32.EXE" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\systam.exe" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\SYSTEM3_.EXE" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\SYSTEMIL2.EXE" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\systim32.exe" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\SYTVSM.EXE" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\TCPWAMMLIB.EXE" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\TCPWAMULIB.EXE" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\TCPWANBLIB.EXE" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\ToolbarUpdaterService.exe" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\Tuneup.exe" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\TXP1ATFORM.EXE" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\TXPLATFORM.EXE" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\UA3KMH73O3JYUT4IOK.EXE" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\ucigxo.exe" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\unwise_.exe" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\updateFindRight.exe" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\updateluckyleap.exe" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\UPDATEMELONDREA.EXE" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\UpdateMoboGenie.exe" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\UPDATEOUTOBOX.EXE" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\USBDRIVE32.EXE" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\userini.exe" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\USPS REPORT.EXE" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\utilluckyleap.exe" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\UTILMELONDREA.EXE" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\UTILOUTOBOX.EXE" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\uygkr9b.exe" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\VCLEANER.EXE" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\voicemail.scr" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\VOICEMAIL_MUMBAI.EXE" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\vrt1.tmp" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\VRT5.TMP" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\VRT6.TMP" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\VRT75.TMP" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\VRT9.TMP" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\VSBNTLO.EXE" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\VTT_QONE8.EXE" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\vuout.exe" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\VXZCEGI.EXE" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\watermark.exe" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\WEBSHIELD.EXE" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\WEBSHIELD64.EXE" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\WEBSHIELDSERVICE.EXE" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\WEBSSEARCHES_0905-11F33B8C.EXE" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\WEBSTEROIDS.EXE" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\WEBSTEROIDS64.EXE" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\WEBSTEROIDSSERVICE.EXE" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\WIHELP32.EXE" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\win002.exe" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\WIN7.EXE" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\WINALERT.EXE" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\WINDLL.EXE" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\WINFIXER.EXE" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\WinHdvm32.exe" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\winlok.exe" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\WINMINEA.EXE" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\winrsdrv32.exe" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\WINSVCHOSTS.EXE" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\WINSYSAPP.EXE" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\WINSYSTEM.EXE" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\WISENI32.EXE" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\WMFCGR.EXE" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\WMIMGMT.COM" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\WMISTIP.EXE" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\wmnig.exe" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\WMPRWISE.EXE" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\WMPTD32.EXE" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\wnzip32.exe" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\WPM_NS_V20.0.0.502.EXE" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\WPM_V18.8.0.273.EXE" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\WPM_V18.8.0.304.EXE" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\WPM_V20.0.0.401.EXE" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\WPM_V20.0.0.502.EXE" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\WPROTECTMANAGER.EXE" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\wsynalib.exe" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\WUAUCLDT.EXE" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\X" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\xiazaii.exe" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\XPLORER.EXE" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\YDNED.EXE" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\zavupd32.exe" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\ZIPAS.EXE" => Key deleted successfully.

"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\_RECYCLING49.EXE" => Key deleted successfully.

HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\?.exe => Key not found.

C:\Users\Ritesh\NPProt.exe => Moved successfully.

C:\Users\Ritesh\AppData\Local\Temp\gtapi_signed.dll => Moved successfully.

C:\Users\Ritesh\AppData\Local\Temp\NEventMessages.dll => Moved successfully.

C:\Users\Ritesh\AppData\Local\Temp\NOSEventMessages.dll => Moved successfully.

C:\Users\Ritesh\AppData\Local\Temp\npp.6.7.4.Installer.exe => Moved successfully.

C:\Users\Ritesh\AppData\Local\Temp\xmlUpdater.exe => Moved successfully.

C:\Windows\System32\Drivers\etc\hosts => Moved successfully.

Hosts was reset successfully.

EmptyTemp: => Removed 549.3 MB temporary data.

The system needed a reboot.

==== End of Fixlog 13:41:27 ====

Malwarebytes Anti-Malware

www.malwarebytes.org

Scan Date: 04/02/2015

Scan Time: 1:56:37 PM

Logfile:

Administrator: Yes

Version: 2.00.4.1028

Malware Database: v2015.02.04.04

Rootkit Database: v2015.02.03.01

License: Premium

Malware Protection: Enabled

Malicious Website Protection: Enabled

Self-protection: Disabled

OS: Windows 7

CPU: x86

File System: NTFS

User: Ritesh

Scan Type: Threat Scan

Result: Completed

Objects Scanned: 296595

Time Elapsed: 27 min, 33 sec

Memory: Enabled

Startup: Enabled

Filesystem: Enabled

Archives: Enabled

Rootkits: Enabled

Heuristics: Enabled

PUP: Enabled

PUM: Enabled

Processes: 0

(No malicious items detected)

Modules: 0

(No malicious items detected)

Registry Keys: 10

Security.Hijack, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\360tray.exe, Quarantined, [bc568f8ba3e70b2be7c229c7d330c040],

Security.Hijack, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\antiviruspro_2010.exe, Quarantined, [d1411dfd9cee4aec8bd34efa3fc5e51b],

Security.Hijack, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\empty.jpg, Quarantined, [0d058c8ef09a40f642324a219e6622de],

Security.Hijack, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\HACKER.COM.CN.EXE, Quarantined, [1cf69f7bb7d3bf77119bb892a1634ab6],

Security.Hijack, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\MICROSOFT.EXE, Quarantined, [f51dc159d6b4181e32888cbf689cf010],

Security.Hijack, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\MSA.EXE, Quarantined, [f71b4dcd1e6c0e280bcd6ae147bd33cd],

Security.Hijack, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\NEW FOLDER.EXE, Quarantined, [e52d51c97218cd69320033199e667d83],

Security.Hijack, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\SMSS32.EXE, Quarantined, [71a150ca7e0c23135a7b0e3f749024dc],

Security.Hijack, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\SVCH0ST.EXE, Quarantined, [5eb4c3577d0df343d73687c7a262a25e],

Security.Hijack, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\VCLEANER.EXE, Quarantined, [c94917037713af876b46a5a9fb09b947],

Registry Values: 0

(No malicious items detected)

Registry Data: 0

(No malicious items detected)

Folders: 0

(No malicious items detected)

Files: 0

(No malicious items detected)

Physical Sectors: 0

(No malicious items detected)

(end)

# AdwCleaner v4.109 - Report created 04/02/2015 at 14:49:25

# Updated 24/01/2015 by Xplode

# Database : 2015-01-24.3 [Local]

# Operating System : Windows 7 Professional (32 bits)

# Username : Ritesh - RITESH-PC

# Running from : C:\Downloads\adwcleaner_4.109.exe

# Option : Clean

***** [ Services ] *****

***** [ Files / Folders ] *****

***** [ Scheduled Tasks ] *****

***** [ Shortcuts ] *****

***** [ Registry ] *****

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bprotect.exe

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{2974C985-8151-4DE5-B23C-B875F0A8522F}

Key Deleted : HKCU\Software\Myfree Codec

Key Deleted : HKLM\SOFTWARE\Myfree Codec

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SAVESENSELIVE.EXE

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WEBSTEROIDS.EXE

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WEBSTEROIDSSERVICE.EXE

***** [ Browsers ] *****

-\\ Internet Explorer v8.0.7600.16385

-\\ Mozilla Firefox v35.0.1 (x86 en-US)

-\\ Google Chrome v40.0.2214.94

[C:\Users\Ritesh\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Deleted [search Provider] : hxxp://www.ask.com/web?q={searchTerms}

[C:\Users\Ritesh\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Deleted [search Provider] : hxxp://search.aol.com/aol/search?q={searchTerms}

*************************

AdwCleaner[R0].txt - [2428 octets] - [02/02/2015 14:26:04]

AdwCleaner[R1].txt - [1890 octets] - [03/02/2015 15:42:05]

AdwCleaner[R2].txt - [1950 octets] - [04/02/2015 14:27:50]

AdwCleaner[s0].txt - [2430 octets] - [02/02/2015 14:31:45]

AdwCleaner[s1].txt - [1784 octets] - [04/02/2015 14:49:25]

########## EOF - C:\AdwCleaner\AdwCleaner[s1].txt - [1844 octets] ##########

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Junkware Removal Tool (JRT) by Thisisu

Version: 6.4.2 (02.02.2015:1)

OS: Windows 7 Professional x86

Ran by Ritesh on 04/02/2015 at 14:53:52.05

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

~~~ Services

~~~ Registry Values

Successfully repaired: [Registry Value] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\\Start Page

Successfully repaired: [Registry Value] HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Main\\Start Page

Successfully repaired: [Registry Value] HKEY_USERS\S-1-5-18\Software\Microsoft\Internet Explorer\Main\\Start Page

Successfully repaired: [Registry Value] HKEY_USERS\S-1-5-19\Software\Microsoft\Internet Explorer\Main\\Start Page

Successfully repaired: [Registry Value] HKEY_USERS\S-1-5-20\Software\Microsoft\Internet Explorer\Main\\Start Page

Successfully repaired: [Registry Value] HKEY_USERS\S-1-5-21-402215625-2697488044-1135593907-1001\Software\Microsoft\Internet Explorer\Main\\Start Page

~~~ Registry Keys

~~~ Files

~~~ Folders

~~~ Event Viewer Logs were cleared

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Scan was completed on 04/02/2015 at 15:00:41.46

End of JRT log

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

---------------------------------------------------------------------------------------

Microsoft Windows Malicious Software Removal Tool v5.20, January 2015 (build 5.20.11000.0)

Started On Wed Feb 04 15:09:42 2015

Engine: 1.1.11302.0

Signatures: 1.191.1276.0

Results Summary:

----------------

No infection found.

kevinf80 · February 4, 2015

Run the following please and post logs...

1.Download Malwarebytes Anti-Rootkit from this link:

http://www.malwarebytes.org/products/mbar/

2. Unzip the File to a convenient location. (Recommend the Desktop)

3. Open the folder where the contents were unzipped to run mbar.exe

4. Double-click on the mbar.exe file, you may receive a User Account Control prompt asking if you are sure you wish to allow the program to run. Please allow the program to run and MBAR will now start to install any necessary drivers that are required for the program to operate correctly. If a rootkit is interfering with the installation of the drivers you will see a message that states that the DDA driver was not installed and that you should reboot your computer to install it. You will see this image:

5. If you receive this message, please click on the Yes button and Malwarebytes Anti-Rootkit will now restart your computer. Once the computer is rebooted and you login, MBAR will automatically start and you will now be at the start screen. (If no Rootkit warning you will go from step 4 to 6.)

6. The following image opens, select Next.

7. The following image opens, select Update

8. When the update completes select Next.

9. In the following window ensure "Targets" are ticked. Then select "Scan"

10. If an infection is found select the "Cleanup Button" to remove threats, Reboot if prompted. Wait while the system shuts down and the cleanup process is performed.

11. Perform another scan with Malwarebytes Anti-Rootkit to verify that no threats remain. If they do, then click "Cleanup Button" once more and repeat the process.

12. If no threats were found you will see the following image, Select Exit:

13. Verify that your system is now running normally, making sure that the following items are functional:

      Internet access
      Windows Update
      Windows Firewall

14. If there are additional problems with your system, such as any of those listed above or other system issues, then run the 'fixdamage' tool included within Malwarebytes Anti-Rootkit folder.

15. Select "Y" from your Keyboard, tap Enter.

16. The fix will be applied, select any key to Exit.

17. Let me know how your system now responds. Copy and paste the two following logs from the mbar folder:

System - log

Mbar - log Date and time of scan will also be shown

Thanks,

Kevin...

diamondd · February 4, 2015

hi kevin,

i downloaded the Malwarebytes Anit-Rootkit from the link but initially chrome would not open the link on the first , then on the second go it opened the link and i downloaded and saved and installed Malwarebytes Anti-Rootkit. While running the mbar.exe it updated the database with new updates but would not run Malwarebytes Anti-Rootkit because the Malwarebytes Anti-Malware instance was running coz that also had the Rootkit in it. Only after closing the Malwarebytes Anti-Malware i was able to run the Malwarebytes Anti-Rootkit. Just putting it here so that u know what i was doing and what was happening.

The Anti-Rookit scanned and found the 10 malware entries and cleaned them. After a successful boot, tried the scan again and nothing was found in the scan. Attaching the log files as u requested.

Internet Access, Windows Update and windows Firewall are working fine.

i did not run the "fixdamage" tool from the Malwarebytes Anti-Rootkit folder. Do i need to run it now ? pls advise.

Also the security software in question is giving a lot of pop-ups to enable certain things. i haven't done anything with that uptil now. waiting for ur advise on how to go about it.

Also another thing to be mentioned is that I noticed a folder in Drive C with the name ZV and all the applications and other files similiar to the NetProtector Solution which is normally installed in the Program Files directory. What needs to be done about it? Is it Part of the same installation or installed by Malware.

Malwarebytes Anti-Rootkit BETA 1.08.3.1004

www.malwarebytes.org

Database version:

main: v2015.02.04.04

rootkit: v2015.02.03.01

Windows 7 x86 NTFS

Internet Explorer 8.0.7600.16385

Ritesh :: RITESH-PC [administrator]

04/02/2015 4:02:17 PM

mbar-log-2015-02-04 (16-02-17).txt

Scan type: Quick scan

Scan options disabled:

Objects scanned: 296108

Time elapsed: 23 minute(s), 20 second(s)

Memory Processes Detected: 0

(No malicious items detected)

Memory Modules Detected: 0

(No malicious items detected)

Registry Keys Detected: 10

HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\360tray.exe (Security.Hijack) -> Delete on reboot. [1460b763bbcfa5910a9f0fe1bd468977]

HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\antiviruspro_2010.exe (Security.Hijack) -> Delete on reboot. [b6beca5017733cfac797a5a349bbd52b]

HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\empty.jpg (Security.Hijack) -> Delete on reboot. [f282cb4f3852e4526f0526451aea6f91]

HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\HACKER.COM.CN.EXE (Security.Hijack) -> Delete on reboot. [88eca674e3a737ff63499fab30d4e41c]

HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\MICROSOFT.EXE (Security.Hijack) -> Delete on reboot. [4f25cf4b4842a98d5e5cd576e1238e72]

HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\MSA.EXE (Security.Hijack) -> Delete on reboot. [5b19d44644466ec8d800262531d35aa6]

HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\NEW FOLDER.EXE (Security.Hijack) -> Delete on reboot. [b3c131e933574fe750e259f37490f907]

HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\SMSS32.EXE (Security.Hijack) -> Delete on reboot. [9ada8d8d9ceece68498c5cf12bd9e11f]

HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\SVCH0ST.EXE (Security.Hijack) -> Delete on reboot. [353fc9517e0cc571ba53dd718c78b050]

HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\VCLEANER.EXE (Security.Hijack) -> Delete on reboot. [492b4bcf88025cda09a82d2133d1817f]

Registry Values Detected: 0

(No malicious items detected)

Registry Data Items Detected: 0

(No malicious items detected)

Folders Detected: 0

(No malicious items detected)

Files Detected: 0

(No malicious items detected)

Physical Sectors Detected: 0

(No malicious items detected)

(end)

---------------------------------------

Malwarebytes Anti-Rootkit BETA 1.08.3.1004

OS version: 6.1.7600 Windows 7 x86

Account is Administrative

Internet Explorer version: 8.0.7600.16385

File system is: NTFS

Disk drives: C:\ DRIVE_FIXED, D:\ DRIVE_FIXED

CPU speed: 3.014000 GHz

Memory total: 2138628096, free: 880128000

---------------------------------------

Malwarebytes Anti-Rootkit BETA 1.08.3.1004

OS version: 6.1.7600 Windows 7 x86

Account is Administrative

Internet Explorer version: 8.0.7600.16385

File system is: NTFS

Disk drives: C:\ DRIVE_FIXED, D:\ DRIVE_FIXED

CPU speed: 3.014000 GHz

Memory total: 2138628096, free: 861200384

Downloaded database version: v2015.02.04.04

Downloaded database version: v2015.02.03.01

Downloaded database version: v2014.12.06.01

=======================================

Initializing...

This version of Malwarebytes Anti-Rootkit requires you to completely exit the Malwarebytes Anti-Malware application to continue.

=======================================

Initializing...

======================

This version of Malwarebytes Anti-Rootkit requires you to completely exit the Malwarebytes Anti-Malware application to continue.

=======================================

---------------------------------------

Malwarebytes Anti-Rootkit BETA 1.08.3.1004

OS version: 6.1.7600 Windows 7 x86

Account is Administrative

Internet Explorer version: 8.0.7600.16385

File system is: NTFS

Disk drives: C:\ DRIVE_FIXED, D:\ DRIVE_FIXED

CPU speed: 3.014000 GHz

Memory total: 2138628096, free: 988770304

=======================================

Initializing...

This version of Malwarebytes Anti-Rootkit requires you to completely exit the Malwarebytes Anti-Malware application to continue.

=======================================

---------------------------------------

Malwarebytes Anti-Rootkit BETA 1.08.3.1004

OS version: 6.1.7600 Windows 7 x86

Account is Administrative

Internet Explorer version: 8.0.7600.16385

File system is: NTFS

Disk drives: C:\ DRIVE_FIXED, D:\ DRIVE_FIXED

CPU speed: 3.014000 GHz

Memory total: 2138628096, free: 1084903424

Initializing...

======================

------------ Kernel report ------------

02/04/2015 16:02:00

------------ Loaded modules -----------

\SystemRoot\system32\ntkrnlpa.exe

\SystemRoot\system32\halmacpi.dll

\SystemRoot\system32\kdcom.dll

\SystemRoot\system32\mcupdate_GenuineIntel.dll

\SystemRoot\system32\PSHED.dll

\SystemRoot\system32\BOOTVID.dll

\SystemRoot\system32\CLFS.SYS

\SystemRoot\system32\CI.dll

\SystemRoot\system32\drivers\Wdf01000.sys

\SystemRoot\system32\drivers\WDFLDR.SYS

\SystemRoot\system32\DRIVERS\ACPI.sys

\SystemRoot\system32\DRIVERS\WMILIB.SYS

\SystemRoot\system32\DRIVERS\msisadrv.sys

\SystemRoot\system32\DRIVERS\pci.sys

\SystemRoot\system32\DRIVERS\vdrvroot.sys

\SystemRoot\System32\drivers\partmgr.sys

\SystemRoot\system32\DRIVERS\volmgr.sys

\SystemRoot\System32\drivers\volmgrx.sys

\SystemRoot\system32\DRIVERS\intelide.sys

\SystemRoot\system32\DRIVERS\PCIIDEX.SYS

\SystemRoot\System32\drivers\mountmgr.sys

\SystemRoot\system32\DRIVERS\atapi.sys

\SystemRoot\system32\DRIVERS\ataport.SYS

\SystemRoot\system32\DRIVERS\amdxata.sys

\SystemRoot\system32\drivers\fltmgr.sys

\SystemRoot\system32\drivers\fileinfo.sys

\SystemRoot\System32\Drivers\Ntfs.sys

\SystemRoot\System32\Drivers\msrpc.sys

\SystemRoot\System32\Drivers\ksecdd.sys

\SystemRoot\System32\Drivers\cng.sys

\SystemRoot\System32\drivers\pcw.sys

\SystemRoot\System32\Drivers\Fs_Rec.sys

\SystemRoot\system32\drivers\ndis.sys

\SystemRoot\system32\drivers\NETIO.SYS

\SystemRoot\System32\Drivers\ksecpkg.sys

\SystemRoot\System32\drivers\tcpip.sys

\SystemRoot\System32\drivers\fwpkclnt.sys

\SystemRoot\system32\DRIVERS\vmstorfl.sys

\SystemRoot\system32\DRIVERS\volsnap.sys

\SystemRoot\System32\Drivers\spldr.sys

\SystemRoot\System32\drivers\rdyboost.sys

\SystemRoot\System32\Drivers\mup.sys

\SystemRoot\System32\drivers\hwpolicy.sys

\SystemRoot\System32\DRIVERS\fvevol.sys

\SystemRoot\system32\DRIVERS\disk.sys

\SystemRoot\system32\DRIVERS\CLASSPNP.SYS

\SystemRoot\system32\DRIVERS\cdrom.sys

\SystemRoot\System32\Drivers\Null.SYS

\SystemRoot\System32\Drivers\Beep.SYS

\SystemRoot\System32\drivers\vga.sys

\SystemRoot\System32\drivers\VIDEOPRT.SYS

\SystemRoot\System32\drivers\watchdog.sys

\SystemRoot\System32\DRIVERS\RDPCDD.sys

\SystemRoot\system32\drivers\rdpencdd.sys

\SystemRoot\system32\drivers\rdprefmp.sys

\SystemRoot\System32\Drivers\Msfs.SYS

\SystemRoot\System32\Drivers\Npfs.SYS

\SystemRoot\system32\DRIVERS\tdx.sys

\SystemRoot\system32\DRIVERS\TDI.SYS

\SystemRoot\system32\drivers\afd.sys

\SystemRoot\System32\DRIVERS\netbt.sys

\SystemRoot\system32\DRIVERS\wfplwf.sys

\SystemRoot\system32\DRIVERS\pacer.sys

\SystemRoot\system32\DRIVERS\netbios.sys

\SystemRoot\system32\DRIVERS\serial.sys

\SystemRoot\system32\DRIVERS\wanarp.sys

\SystemRoot\system32\DRIVERS\termdd.sys

\SystemRoot\system32\DRIVERS\rdbss.sys

\SystemRoot\system32\drivers\nsiproxy.sys

\SystemRoot\system32\DRIVERS\mssmbios.sys

\SystemRoot\System32\drivers\discache.sys

\SystemRoot\system32\drivers\csc.sys

\SystemRoot\System32\Drivers\dfsc.sys

\SystemRoot\system32\DRIVERS\blbdrive.sys

\SystemRoot\system32\DRIVERS\tunnel.sys

\SystemRoot\system32\DRIVERS\intelppm.sys

\SystemRoot\system32\DRIVERS\igdkmd32.sys

\SystemRoot\System32\drivers\dxgkrnl.sys

\SystemRoot\System32\drivers\dxgmms1.sys

\SystemRoot\system32\DRIVERS\HDAudBus.sys

\SystemRoot\system32\DRIVERS\usbuhci.sys

\SystemRoot\system32\DRIVERS\USBPORT.SYS

\SystemRoot\system32\DRIVERS\usbehci.sys

\SystemRoot\system32\DRIVERS\dlkfet5b.sys

\SystemRoot\system32\DRIVERS\serenum.sys

\SystemRoot\system32\DRIVERS\parport.sys

\SystemRoot\system32\DRIVERS\i8042prt.sys

\SystemRoot\system32\DRIVERS\mouclass.sys

\SystemRoot\system32\DRIVERS\kbdclass.sys

\SystemRoot\system32\DRIVERS\CompositeBus.sys

\SystemRoot\system32\DRIVERS\AgileVpn.sys

\SystemRoot\system32\DRIVERS\rasl2tp.sys

\SystemRoot\system32\DRIVERS\ndistapi.sys

\SystemRoot\system32\DRIVERS\ndiswan.sys

\SystemRoot\system32\DRIVERS\raspppoe.sys

\SystemRoot\system32\DRIVERS\raspptp.sys

\SystemRoot\system32\DRIVERS\rassstp.sys

\SystemRoot\system32\DRIVERS\rdpbus.sys

\SystemRoot\system32\DRIVERS\swenum.sys

\SystemRoot\system32\DRIVERS\ks.sys

\SystemRoot\system32\DRIVERS\umbus.sys

\SystemRoot\system32\DRIVERS\usbhub.sys

\SystemRoot\System32\Drivers\NDProxy.SYS

\SystemRoot\system32\drivers\RTKVHDA.sys

\SystemRoot\system32\drivers\portcls.sys

\SystemRoot\system32\drivers\drmk.sys

\SystemRoot\System32\Drivers\crashdmp.sys

\SystemRoot\System32\Drivers\dump_dumpata.sys

\SystemRoot\System32\Drivers\dump_atapi.sys

\SystemRoot\System32\Drivers\dump_dumpfve.sys

\SystemRoot\System32\win32k.sys

\SystemRoot\System32\drivers\Dxapi.sys

\SystemRoot\system32\DRIVERS\monitor.sys

\SystemRoot\System32\TSDDD.dll

\SystemRoot\System32\cdd.dll

\SystemRoot\system32\drivers\luafv.sys

\SystemRoot\system32\DRIVERS\lltdio.sys

\SystemRoot\system32\DRIVERS\rspndr.sys

\SystemRoot\system32\drivers\HTTP.sys

\SystemRoot\system32\DRIVERS\bowser.sys

\SystemRoot\System32\drivers\mpsdrv.sys

\SystemRoot\system32\DRIVERS\mrxsmb.sys

\SystemRoot\system32\DRIVERS\mrxsmb10.sys

\SystemRoot\system32\DRIVERS\mrxsmb20.sys

\SystemRoot\system32\DRIVERS\parvdm.sys

\SystemRoot\system32\drivers\peauth.sys

\SystemRoot\System32\Drivers\secdrv.SYS

\SystemRoot\System32\DRIVERS\srvnet.sys

\SystemRoot\System32\drivers\tcpipreg.sys

\SystemRoot\System32\DRIVERS\srv2.sys

\SystemRoot\System32\DRIVERS\srv.sys

\??\C:\PROGRAM FILES\NET PROTECTOR 2015\npzvft32.sys

\??\C:\Windows\system32\drivers\mbamchameleon.sys

\??\C:\Windows\system32\drivers\MBAMSwissArmy.sys

\Windows\System32\ntdll.dll

\Windows\System32\smss.exe

\Windows\System32\apisetschema.dll

\Windows\System32\autochk.exe

----------- End -----------

Done!

Scan started

Database versions:

main: v2015.02.04.04

rootkit: v2015.02.03.01

<<<2>>>

Physical Sector Size: 512

Drive: 0, DevicePointer: 0xffffffff85608a90, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\

--------- Disk Stack ------

DevicePointer: 0xffffffff85608778, DeviceName: Unknown, DriverName: \Driver\partmgr\

DevicePointer: 0xffffffff85608a90, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\

DevicePointer: 0xffffffff85526918, DeviceName: Unknown, DriverName: \Driver\ACPI\

DevicePointer: 0xffffffff848a0610, DeviceName: \Device\Ide\IdeDeviceP0T0L0-0\, DriverName: \Driver\atapi\

------------ End ----------

Alternate DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\

Upper DeviceData: 0x0, 0x0, 0x0

Lower DeviceData: 0x0, 0x0, 0x0

<<<3>>>

Volume: C:

File system type: NTFS

SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes

<<<2>>>

<<<3>>>

Volume: C:

File system type: NTFS

SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes

Scanning drivers directory: C:\WINDOWS\SYSTEM32\drivers...

Done!

Drive 0

This is a System drive

Scanning MBR on drive 0...

Inspecting partition table:

MBR Signature: 55AA

Disk Signature: 3A613A60

Partition information:

Partition 0 type is Primary (0x7)

Partition is ACTIVE.

Partition starts at LBA: 63 Numsec = 167766732

Partition file system is NTFS

Partition is bootable

Partition 1 type is Extended with LBA (0xf)

Partition is NOT ACTIVE.

Partition starts at LBA: 167766795 Numsec = 144793845

Partition 2 type is Empty (0x0)

Partition is NOT ACTIVE.

Partition starts at LBA: 0 Numsec = 0

Partition 3 type is Empty (0x0)

Partition is NOT ACTIVE.

Partition starts at LBA: 0 Numsec = 0

Disk Size: 160040803840 bytes

Sector size: 512 bytes

Done!

Infected: HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\360tray.exe --> [security.Hijack]

Infected: HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\antiviruspro_2010.exe --> [security.Hijack]

Infected: HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\empty.jpg --> [security.Hijack]

Infected: HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\HACKER.COM.CN.EXE --> [security.Hijack]

Infected: HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\MICROSOFT.EXE --> [security.Hijack]

Infected: HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\MSA.EXE --> [security.Hijack]

Infected: HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\NEW FOLDER.EXE --> [security.Hijack]

Infected: HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\SMSS32.EXE --> [security.Hijack]

Infected: HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\SVCH0ST.EXE --> [security.Hijack]

Infected: HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\VCLEANER.EXE --> [security.Hijack]

Scan finished

Creating System Restore point...

Cleaning up...

Removal scheduling successful. System shutdown needed.

System shutdown occurred

=======================================

kevinf80 · February 4, 2015

Yes please run "fixdamage" let me know if any remaiing issues or concerns on completion... If your security package still has problems maybe an uninstall then reinstall will help..

Thank you,

Kevin...

diamondd · February 4, 2015

i ran the "fixdamage" tool and it applied a fix and rebooted the system. On reboot got a message asking to disable User Account Setting from BixSecure Labs Program to install software. This is the same security solution in question here. If i deny its request i keep getting a solve Error on every boot. Also somehow the browser is blocking me from accessing this site and everytime i try to open the forum page i get a page not found error and on multiple refresh i can finally see the page. Pls Advise.

kevinf80 · February 4, 2015

BixSecure Labs Program, do you mean BizSecure Labs? I already ask that you UNinstall then REinstall your security to see if that would help

diamondd · February 5, 2015

hi kevin,

yes its the same security program , i apologize for the spelling mistake..my bad. I uninstalled the security program, performed the Malware AntiMalware twice and found a threat each time. i did quarantine each time. I am pasting the scan logs for the same in here. After a clean again installed the Security program but Malware Antiware detects one of the file from installation to be a Malware and quarantines it automatically. I am attaching all the logs here for ur reference.

Pls advice on next course of action. i apologize for attaching the xml logs. these are the only ones i could find.

mbam-log-2015-02-05 (13-15-36).xml

mbam-log-2015-02-05 (13-34-56).xml

protection-log-2015-02-05.xml

diamondd · February 5, 2015

hi kevin ,

Putting up some additional information. while installing the security software i was not connected to the internet. i connected only for registering and updating the software. Immediately i performed a scan with Malwarebytes Anti-ware and to my amusement i ending up with the Security Hijack errors again and it shows one file GHP3.exe an update to GHP2.exe to be infected and a Trojan Agent. Performed a quarantine operation. Posting a log below. Performing a scan again in the meantime. Pls advise. But it seems the Security Software itself is bundled with a trojan agent or its not doing what it is supposed to do.

Malwarebytes Anti-Malware

www.malwarebytes.org

Scan Date: 05/02/2015

Scan Time: 6:28:22 PM

Logfile:

Administrator: Yes

Version: 2.00.4.1028

Malware Database: v2015.02.05.05

Rootkit Database: v2015.02.03.01

License: Premium

Malware Protection: Enabled

Malicious Website Protection: Enabled

Self-protection: Disabled

OS: Windows 7

CPU: x86

File System: NTFS

User: Ritesh

Scan Type: Threat Scan

Result: Completed

Objects Scanned: 296894

Time Elapsed: 32 min, 56 sec

Memory: Enabled

Startup: Enabled

Filesystem: Enabled

Archives: Enabled

Rootkits: Enabled

Heuristics: Enabled

PUP: Enabled

PUM: Enabled

Processes: 0

(No malicious items detected)

Modules: 0

(No malicious items detected)

Registry Keys: 10

Security.Hijack, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\360tray.exe, Quarantined, [0c069387b3d72b0bc854da18c04350b0],

Security.Hijack, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\antiviruspro_2010.exe, Quarantined, [52c0e931018982b4b41dd07933d1eb15],

Security.Hijack, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\empty.jpg, Quarantined, [b06255c523675adcfbec4329d0348d73],

Security.Hijack, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\HACKER.COM.CN.EXE, Quarantined, [22f0a674f09a54e241de8fbd7094649c],

Security.Hijack, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\MICROSOFT.EXE, Quarantined, [bd5550cac5c5ab8bf637232a749017e9],

Security.Hijack, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\MSA.EXE, Quarantined, [6aa8a07a3e4cef47b09b2a2364a0d030],

Security.Hijack, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\NEW FOLDER.EXE, Quarantined, [de349b7fb2d8e6505a4b55f858acf808],

Security.Hijack, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\SMSS32.EXE, Quarantined, [9a784bcf84064ee869dfe8670bf99e62],

Security.Hijack, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\SVCH0ST.EXE, Quarantined, [1af8a3773b4faa8c81fff6592ada24dc],

Security.Hijack, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\VCLEANER.EXE, Quarantined, [d9390911f199c1752afa6de3d72d9868],

Registry Values: 0

(No malicious items detected)

Registry Data: 2

PUM.Disabled.SecurityCenter, HKLM\SOFTWARE\MICROSOFT\SECURITY CENTER|UpdatesDisableNotify, 1, Good: (0), Bad: (1),Replaced,[31e1c555c1c951e53028b5f80ff641bf]

PUM.Disabled.SecurityCenter, HKLM\SOFTWARE\MICROSOFT\SECURITY CENTER|FirewallDisableNotify, 1, Good: (0), Bad: (1),Replaced,[4ac80f0b02885adcda7d5b5213f2b749]

Folders: 0

(No malicious items detected)

Files: 1

Trojan.Agent, C:\Program Files\Net Protector 2015\GHP3.EXE, Quarantined, [4ac878a26d1d79bd29dfd4ea996ca45c],

Physical Sectors: 0

(No malicious items detected)

(end)

kevinf80 · February 5, 2015

In my opinion the security package you have installed is definitely suspicious, we already had malicious confirmation from Virus Total, also now we have similar prompts from Malwarebytes...

I firmly believe the security in question should be UNinstalled/removed from your system, it is definitely very suspicious.... Let me know how you want to progress.. Read the following link to fully understand PC security and best practices, you may find it useful....

http://www.bleepingcomputer.com/forums/t/407147/answers-to-common-security-questions-best-practices/#entry2316629

Thanks,

Kevin...

diamondd · February 5, 2015

hi kevin,

i think it is advisable to discontinue with the Security Software in question and look for another better option. i think for the time being i would like to uninstall the same software and perhaps install the ESET antivirus (trial version for 30 days) before coming on a solid option regarding the antivirus and in the meanwhile get the pc cleaned and uninfected. So i think i would definitely follow your advise on the same and continue with resolving this topic.

kevinf80 · February 5, 2015

Thanks for the update, once you have your security put right continue as follows:

Run FRST one more time, ensure all boxes are checkmarked under "Whitelist" but only checkmark Addition.txt under "Optional scan" select scan, post the two produced logs...

Thanks,

Kevin

diamondd · February 6, 2015

kevin,

i have installed the ESET NOD32 Antivirus (30 day trial ) for now. I am attaching the logs as you requested.

Addition.txt

FRST.txt

kevinf80 · February 6, 2015

Thanks for the logs, run the following:

Download attached fixlist.txt file (end of reply) and save it to the Desktop, or the folder you saved FRST into.

NOTE. It's important that both FRST and fixlist.txt are in the same location or the fix will not work.

Run FRST and press the Fix button just once and wait.

The tool will make a log on the Desktop (Fixlog.txt) or the folder it was ran from. Please post it to your reply.

Next,

Open Malwarebytes Anti-Malware, from the Dashboard please Check for Updates by clicking the Update Now... link

When the update completes select > Settings > Detection and Protection > Enable Scan for rootkit and Under Non Malware Protection set both PUP and PUM to Treat detections as malware.

Click on the SCAN button and run a Threat Scan with Malwarebytes Anti-Malware by clicking the Scan Now>> button.

When the scan is complete, if there have been detections, click Apply Actions to allow MBAM to clean what was detected.

In most cases, a restart will be required.

Wait for the prompt to restart the computer to appear, then click on Yes.

When the scan is completed from the main GUI click on History > Application Logs. Find your Scan log, the date when run will identify it. Checkmark "select" box > then hit the "view" button. The history log window will open. At the bottom of that window are two options, "Copy to clipboard" and "Export"

Select > "Copy to clipboard" that copies the full log to the windows clipboard, so at your reply you right click into the text field and select "Paste" the log is pasted (copied) to your reply.

Next,

run an online AV scan to ensure there are no remnants of any infection left on your system that may have been missed. This scan is very thorough and well worth running, it can take several hours please be patient and let it complete:

Run Eset Online Scanner

**Note** You will need to use Internet explorer for this scan - Vista and Windows 7/8 right click on IE shortcut and run as admin.

(To run ESET Online Scanner in a browser other than Internet Explorer, you'll need to download ESET SMART Installer during the process)

Go to Eset web page http://www.eset.com/us/online-scanner/ to run an online scan from ESET.

Turn off the real time scanner of any existing antivirus program while performing the online scan
click on the Run ESET Online Scanner button
Tick the box next to YES, I accept the Terms of Use.
Click Start
When asked, allow the add/on to be installed
Click Start
Make sure that the option "Remove found threats" is UNticked
Click on Advanced Settings, ensure the following options are checked:

Scan for potentially unsafe applications
Enable Anti-Stealth Technology

Click Scan

wait for the virus definitions to be downloaded
Wait for the scan to finish

When the scan is complete

If no threats were found
put a checkmark in "Uninstall application on close"
close program
report to me that nothing was found

If threats were found

click on "list of threats found"
click on "export to text file" and save it as ESET SCAN and save to the desktop
Click on back
put a checkmark in "Uninstall application on close"
click on finish

close program

Copy and paste the report in next reply.

Let me see those logs, also give an updaye on any remaining issues or concerns.....

Kevin...

Fixlist.txt

diamondd · February 6, 2015

hi,

i ran the fixlist file from FRST. one thing that i have noticed is that it frees a lot of RAM and also unblocks my keyboard in some otherwise certain keys would get locked or the system response would be very close. Pls find the attached logs as you requested.

ESET Scan - No threats found in online scan.

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version: 05-02-2015

Ran by Ritesh at 2015-02-06 18:44:37 Run:2

Running from C:\Downloads

Loaded Profiles: Ritesh (Available profiles: Ritesh)

Boot Mode: Normal

==============================================

Content of fixlist:

*****************

start

HKU\S-1-5-21-402215625-2697488044-1135593907-1001\...\Winlogon: [shell] C:\Windows\Explorer.exe [2613248 2009-07-14] (Microsoft Corporation) <==== ATTENTION

IFEO\(??????.exe: [Debugger] M-NPAV

IFEO\AAAAAAAA.EXE: [Debugger] B-NPAV

IFEO\ACLEANER.EXE: [Debugger] B-NPAV

IFEO\Adobe Gamma Loader.com: [Debugger] B-NPAV

IFEO\Adobe update.com: [Debugger] B-NPAV

IFEO\ahnabc.exe: [Debugger] B-NPAV

IFEO\AMT_WEBSSEARCHES.EXE: [Debugger] B-NPAV

IFEO\APPDATADB.EXE: [Debugger] B-NPAV

IFEO\ARKING.EXE: [Debugger] B-NPAV

IFEO\asd26.tmp.exe: [Debugger] B-NPAV

IFEO\AutoDrive.exe: [Debugger] B-NPAV

IFEO\ave.exe: [Debugger] B-NPAV

IFEO\AWESOMEHP.EXE: [Debugger] B-NPAV

IFEO\best7.exe: [Debugger] B-NPAV

IFEO\blank.doc: [Debugger] B-NPAV

IFEO\bprotect.exe: [Debugger] B-NPAV

IFEO\BUENOSEARCHTB: [Debugger] B-NPAV

IFEO\cista.exe: [Debugger] B-NPAV

IFEO\COMMGR.EXE: [Debugger] B-NPAV

IFEO\COOL_GAMESETUP.EXE: [Debugger] B-NPAV

IFEO\CSSRSS.EXE: [Debugger] B-NPAV

IFEO\DEFAULTTABHOST.EXE: [Debugger] B-NPAV

IFEO\desk365.exe: [Debugger] B-NPAV

IFEO\DISETYPKIDOZ.EXE: [Debugger] B-NPAV

IFEO\DRVGUARD.EXE: [Debugger] B-NPAV

IFEO\EDEALSPOP.EXE: [Debugger] B-NPAV

IFEO\EKSPLORASI.EXE: [Debugger] B-NPAV

IFEO\empty.pif: [Debugger] B-NPAV

IFEO\FAENOL.EXE: [Debugger] B-NPAV

IFEO\FindRight.FirstRun.exe: [Debugger] B-NPAV

IFEO\firefox2.exe: [Debugger] B-NPAV

IFEO\FKREKK456.EXE: [Debugger] B-NPAV

IFEO\GNJA.EXE: [Debugger] B-NPAV

IFEO\google.com: [Debugger] B-NPAV

IFEO\gphone.exe: [Debugger] B-NPAV

IFEO\HACKER.COM.CN.EXE: [Debugger] B-NPAV

IFEO\HELLOPUPPY.EXE: [Debugger] B-NPAV

IFEO\hexsvchost.exe: [Debugger] B-NPAV

IFEO\hhgnrddkjee.exe: [Debugger] B-NPAV

IFEO\ibsvc.exe: [Debugger] B-NPAV

IFEO\igfxdvb32.exe: [Debugger] B-NPAV

IFEO\ILD_QONE8.EXE: [Debugger] B-NPAV

IFEO\INBOXACE[1].EXE: [Debugger] B-NPAV

IFEO\INOVICE COPY(1).EXE: [Debugger] B-NPAV

IFEO\Internet Explorer Settings.exe: [Debugger] B-NPAV

IFEO\ISE32.EXE: [Debugger] B-NPAV

IFEO\juzjf.exe: [Debugger] B-NPAV

IFEO\khatra.exe: [Debugger] B-NPAV

IFEO\lbisov.exe: [Debugger] B-NPAV

IFEO\LIDLLLA.EXE: [Debugger] B-NPAV

IFEO\LLY_ISTARTSURF.EXE: [Debugger] B-NPAV

IFEO\LOAD[1].EXE: [Debugger] B-NPAV

IFEO\MAKARONI.EXE: [Debugger] B-NPAV

IFEO\MgAssist.exe: [Debugger] B-NPAV

IFEO\MGRSVN.EXE: [Debugger] B-NPAV

IFEO\MMMPC.EXE: [Debugger] B-NPAV

IFEO\MONILOR.EXE: [Debugger] B-NPAV

IFEO\MOVIEMODE.EXE: [Debugger] B-NPAV

IFEO\moviemodeservice.exe: [Debugger] B-NPAV

IFEO\MRPKY.EXE: [Debugger] B-NPAV

IFEO\MS-DOS.COM: [Debugger] B-NPAV

IFEO\MSB.EXE: [Debugger] B-NPAV

IFEO\msconfig32.exe: [Debugger] B-NPAV

IFEO\MSMXENG.EXE: [Debugger] B-NPAV

IFEO\MSVMIODE.EXE: [Debugger] B-NPAV

IFEO\mwaser.exe: [Debugger] B-NPAV

IFEO\My Documents.exe: [Debugger] B-NPAV

IFEO\NEW FOLDER .EXE: [Debugger] B-NPAV

IFEO\new29.exe: [Debugger] B-NPAV

IFEO\nsvb.exe: [Debugger] B-NPAV

IFEO\ONEBROWSESERVICE.EXE: [Debugger] B-NPAV

IFEO\ONEKIT4FFX.EXE: [Debugger] B-NPAV

IFEO\Outdoor Amateur.exe: [Debugger] B-NPAV

IFEO\Passwords.exe: [Debugger] B-NPAV

IFEO\PHIM HAI CUC HAY.EXE: [Debugger] B-NPAV

IFEO\PHYSICALDRIVE2.COM: [Debugger] B-NPAV

IFEO\PLUGINSERVICE.EXE: [Debugger] B-NPAV

IFEO\popupzv.exe: [Debugger] B-NPAV

IFEO\PRINCE(2010)-PDVDRIP{NEWSOURCE}-1CDRIP-XVID-MP3-[DRC].EXE: [Debugger] B-NPAV

IFEO\PROTECTWINDOWSMANAGER.EXE: [Debugger] B-NPAV

IFEO\PURCHASE ORDER..EXE: [Debugger] B-NPAV

IFEO\PURCHASE-ORDERS.EXE: [Debugger] B-NPAV

IFEO\PUSK3.EXE: [Debugger] B-NPAV

IFEO\QONE8.EXE: [Debugger] B-NPAV

IFEO\RABC.EXE: [Debugger] B-NPAV

IFEO\RADSTEROIDS64.EXE: [Debugger] B-NPAV

IFEO\RECYCLE.EXE: [Debugger] B-NPAV

IFEO\RECYCLEBINPROTECT.EXE: [Debugger] B-NPAV

IFEO\RECYCLED.SCR: [Debugger] B-NPAV

IFEO\RECYCLER.EXE: [Debugger] B-NPAV

IFEO\regsvr.exe: [Debugger] B-NPAV

IFEO\Rensolu.exe: [Debugger] B-NPAV

IFEO\Rensolve.exe: [Debugger] B-NPAV

IFEO\rknew.cc3: [Debugger] B-NPAV

IFEO\runouce.exe: [Debugger] B-NPAV

IFEO\SafeDrvse.exe: [Debugger] B-NPAV

IFEO\SAVESENSELIVE.EXE: [Debugger] B-NPAV

IFEO\SCVHOST.EXE: [Debugger] B-NPAV

IFEO\SEABI.EXE: [Debugger] B-NPAV

IFEO\SEARCHPROTECT1204.EXE: [Debugger] B-NPAV

IFEO\SecureDrive.exe: [Debugger] B-NPAV

IFEO\serivces.exe: [Debugger] B-NPAV

IFEO\SFPSNEW1_QONE8.EXE: [Debugger] B-NPAV

IFEO\SFPSNEW3_QONE8.EXE: [Debugger] B-NPAV

IFEO\SHELLOPEN.EXE: [Debugger] B-NPAV

IFEO\SHOPPERPROJSINJFULL.EXE: [Debugger] B-NPAV

IFEO\sienozv.exe: [Debugger] B-NPAV

IFEO\SmdmFService.exe: [Debugger] B-NPAV

IFEO\SMSS32.EXE: [Debugger] B-NPAV

IFEO\SMT_OMIGA-PLUS_NEW.EXE: [Debugger] B-NPAV

IFEO\SPECIJALAC.EXE: [Debugger] B-NPAV

IFEO\spoclsv.exe: [Debugger] B-NPAV

IFEO\SVCH0ST.EXE: [Debugger] B-NPAV

IFEO\SVCHAST.EXE: [Debugger] B-NPAV

IFEO\SVCHOSTS.EXE: [Debugger] B-NPAV

IFEO\svcst.exe: [Debugger] B-NPAV

IFEO\SysAnti.exe: [Debugger] B-NPAV

IFEO\SYSDIAG64.EXE: [Debugger] B-NPAV

IFEO\SYSDRIVER32_.EXE: [Debugger] B-NPAV

IFEO\SYSMNGR32.EXE: [Debugger] B-NPAV

IFEO\SYSTEM3_.EXE: [Debugger] B-NPAV

IFEO\systim32.exe: [Debugger] B-NPAV

IFEO\TCPWAMMLIB.EXE: [Debugger] B-NPAV

IFEO\TCPWANBLIB.EXE: [Debugger] B-NPAV

IFEO\Tuneup.exe: [Debugger] B-NPAV

IFEO\TXPLATFORM.EXE: [Debugger] B-NPAV

IFEO\ucigxo.exe: [Debugger] B-NPAV

IFEO\updateFindRight.exe: [Debugger] B-NPAV

IFEO\UPDATEMELONDREA.EXE: [Debugger] B-NPAV

IFEO\UPDATEOUTOBOX.EXE: [Debugger] B-NPAV

IFEO\userini.exe: [Debugger] B-NPAV

IFEO\utilluckyleap.exe: [Debugger] B-NPAV

IFEO\UTILOUTOBOX.EXE: [Debugger] B-NPAV

IFEO\VCLEANER.EXE: [Debugger] B-NPAV

IFEO\VOICEMAIL_MUMBAI.EXE: [Debugger] B-NPAV

IFEO\VRT5.TMP: [Debugger] B-NPAV

IFEO\VRT75.TMP: [Debugger] B-NPAV

IFEO\VSBNTLO.EXE: [Debugger] B-NPAV

IFEO\vuout.exe: [Debugger] B-NPAV

IFEO\watermark.exe: [Debugger] B-NPAV

IFEO\WEBSHIELD64.EXE: [Debugger] B-NPAV

IFEO\WEBSSEARCHES_0905-11F33B8C.EXE: [Debugger] B-NPAV

IFEO\WEBSTEROIDS64.EXE: [Debugger] B-NPAV

IFEO\WIHELP32.EXE: [Debugger] B-NPAV

IFEO\WIN7.EXE: [Debugger] B-NPAV

IFEO\WINDLL.EXE: [Debugger] B-NPAV

IFEO\WinHdvm32.exe: [Debugger] B-NPAV

IFEO\WINMINEA.EXE: [Debugger] B-NPAV

IFEO\WINSVCHOSTS.EXE: [Debugger] B-NPAV

IFEO\WINSYSTEM.EXE: [Debugger] B-NPAV

IFEO\WMFCGR.EXE: [Debugger] B-NPAV

IFEO\WMISTIP.EXE: [Debugger] B-NPAV

IFEO\WMPRWISE.EXE: [Debugger] B-NPAV

IFEO\wnzip32.exe: [Debugger] B-NPAV

IFEO\WPM_V18.8.0.273.EXE: [Debugger] B-NPAV

IFEO\WPM_V20.0.0.401.EXE: [Debugger] B-NPAV

IFEO\WPROTECTMANAGER.EXE: [Debugger] B-NPAV

IFEO\WUAUCLDT.EXE: [Debugger] B-NPAV

IFEO\xiazaii.exe: [Debugger] B-NPAV

IFEO\YDNED.EXE: [Debugger] B-NPAV

IFEO\ZIPAS.EXE: [Debugger] B-NPAV

IFEO\?.exe: [Debugger] M-NPAV

BootExecute: autocheck autochk * nprootkt.exe

S1 WNPPORTFR; system32\drivers\WNPPORTFR.sys [X]

2015-02-05 16:58 - 2011-09-19 20:25 - 00049152 _____ (Biz Secure Labs Pvt Ltd.) C:\Users\Ritesh\NPProt.bkp

C:\Users\Ritesh\AppData\Local\Temp\InstHelper.exe

C:\Users\Ritesh\AppData\Local\Temp\NEventMessages.dll

C:\Users\Ritesh\AppData\Local\Temp\NOSEventMessages.dll

C:\Users\Ritesh\AppData\Local\Temp\sqlite3.dll

Hosts: